Merge branch 'nixos-unstable-small' of https://github.com/NixOS/nixpkgs

author: Alyssa Ross <hi@alyssa.is> 2023-12-17 17:44:14 +0100
committer: Alyssa Ross <hi@alyssa.is> 2023-12-17 17:44:14 +0100
commit: 778336429cc37ad5b0d736336141d09bf227653d (patch)
tree: 4aa85bd5d87d5bb5fb2c35ab9313987606abca89 /nixpkgs
parent: 6b8e2555ef013b579cda57025b17d662e0f1fe1f (diff)
parent: 7d6929828a2d28eda9d37254ff6be3b6819506ca (diff)
download: nixlib-778336429cc37ad5b0d736336141d09bf227653d.tar
nixlib-778336429cc37ad5b0d736336141d09bf227653d.tar.gz
nixlib-778336429cc37ad5b0d736336141d09bf227653d.tar.bz2
nixlib-778336429cc37ad5b0d736336141d09bf227653d.tar.lz
nixlib-778336429cc37ad5b0d736336141d09bf227653d.tar.xz
nixlib-778336429cc37ad5b0d736336141d09bf227653d.tar.zst
nixlib-778336429cc37ad5b0d736336141d09bf227653d.zip
237 files changed, 2296 insertions, 1305 deletions
diff --git a/nixpkgs/.github/CODEOWNERS b/nixpkgs/.github/CODEOWNERS
index 5ff1371fe7e9..effb31eb6163 100644
--- a/nixpkgs/.github/CODEOWNERS
+++ b/nixpkgs/.github/CODEOWNERS
@@ -25,7 +25,7 @@
 /lib/cli.nix                @infinisil @Profpatsch
 /lib/debug.nix              @infinisil @Profpatsch
 /lib/asserts.nix            @infinisil @Profpatsch
-/lib/path.*                 @infinisil @fricklerhandwerk
+/lib/path.*                 @infinisil
 /lib/fileset                @infinisil
 ## Libraries / Module system
 /lib/modules.nix            @infinisil @roberth
@@ -73,8 +73,8 @@
 # Contributor documentation
 /CONTRIBUTING.md @infinisil
 /.github/PULL_REQUEST_TEMPLATE.md @infinisil
-/doc/contributing/ @fricklerhandwerk @infinisil
-/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @fricklerhandwerk @infinisil
+/doc/contributing/ @infinisil
+/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @infinisil
 /lib/README.md @infinisil
 /doc/README.md @infinisil
 /nixos/README.md @infinisil
diff --git a/nixpkgs/.github/workflows/check-by-name.yml b/nixpkgs/.github/workflows/check-by-name.yml
index 294775fa1c8e..5e3e65641f82 100644
--- a/nixpkgs/.github/workflows/check-by-name.yml
+++ b/nixpkgs/.github/workflows/check-by-name.yml
@@ -8,8 +8,9 @@ on:
   # Using pull_request_target instead of pull_request avoids having to approve first time contributors
   pull_request_target
 
-# The tool doesn't need any permissions, it only outputs success or not based on the checkout
-permissions: {}
+permissions:
+  # We need this permission to cancel the workflow run if there's a merge conflict
+  actions: write
 
 jobs:
   check:
@@ -62,7 +63,14 @@ jobs:
           if [[ "$mergeable" == "true" ]]; then
             echo "The PR can be merged, checking the merge commit $mergedSha"
           else
-            echo "The PR cannot be merged, it has a merge conflict"
+            echo "The PR cannot be merged, it has a merge conflict, cancelling the workflow.."
+            gh api \
+              --method POST \
+              -H "Accept: application/vnd.github+json" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              /repos/"$GITHUB_REPOSITORY"/actions/runs/"$GITHUB_RUN_ID"/cancel
+            sleep 60
+            # If it's still not canceled after a minute, something probably went wrong, just exit
             exit 1
           fi
           echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
diff --git a/nixpkgs/lib/generators.nix b/nixpkgs/lib/generators.nix
index 8e93ed04916e..ed59654cc07e 100644
--- a/nixpkgs/lib/generators.nix
+++ b/nixpkgs/lib/generators.nix
@@ -525,6 +525,8 @@ ${expr "" v}
           "(${v.expr})"
         else if v == { } then
           "{}"
+        else if libAttr.isDerivation v then
+          ''"${toString v}"''
         else
           "{${introSpace}${concatItems (
             lib.attrsets.mapAttrsToList (key: value: "[${builtins.toJSON key}] = ${toLua innerArgs value}") v
diff --git a/nixpkgs/lib/tests/release.nix b/nixpkgs/lib/tests/release.nix
index 843180490bb2..96d34be8c2d3 100644
--- a/nixpkgs/lib/tests/release.nix
+++ b/nixpkgs/lib/tests/release.nix
@@ -67,5 +67,17 @@ let
 in
   pkgs.symlinkJoin {
     name = "nixpkgs-lib-tests";
-    paths = map testWithNix nixVersions;
+    paths = map testWithNix nixVersions ++
+
+      #
+      # TEMPORARY MIGRATION MECHANISM
+      #
+      # This comment and the expression which follows it should be
+      # removed as part of resolving this issue:
+      #
+      #   https://github.com/NixOS/nixpkgs/issues/272591
+      #
+      [(import ../../pkgs/test/release {})]
+    ;
+
   }
diff --git a/nixpkgs/lib/types.nix b/nixpkgs/lib/types.nix
index 51e58eaa8ab5..4378568c141f 100644
--- a/nixpkgs/lib/types.nix
+++ b/nixpkgs/lib/types.nix
@@ -67,6 +67,7 @@ let
     ;
   outer_types =
 rec {
+  __attrsFailEvaluation = true;
   isType = type: x: (x._type or "") == type;
 
   setType = typeName: value: value // {
diff --git a/nixpkgs/nixos/modules/module-list.nix b/nixpkgs/nixos/modules/module-list.nix
index dc95ff8016b2..a8d55a73a10f 100644
--- a/nixpkgs/nixos/modules/module-list.nix
+++ b/nixpkgs/nixos/modules/module-list.nix
@@ -278,6 +278,7 @@
   ./programs/wayland/waybar.nix
   ./programs/wayland/wayfire.nix
   ./programs/weylus.nix
+  ./programs/winbox.nix
   ./programs/wireshark.nix
   ./programs/xastir.nix
   ./programs/wshowkeys.nix
diff --git a/nixpkgs/nixos/modules/programs/winbox.nix b/nixpkgs/nixos/modules/programs/winbox.nix
new file mode 100644
index 000000000000..6af299d52009
--- /dev/null
+++ b/nixpkgs/nixos/modules/programs/winbox.nix
@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg  = config.programs.winbox;
+in
+{
+  options.programs.winbox = {
+    enable = lib.mkEnableOption ("MikroTik Winbox");
+    package = lib.mkPackageOption pkgs "winbox" { };
+
+    openFirewall = lib.mkOption {
+      description = ''
+        Whether to open ports for the MikroTik Neighbor Discovery protocol. Required for Winbox neighbor discovery.
+      '';
+      default = false;
+      type = lib.types.bool;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedUDPPorts = lib.optionals cfg.openFirewall [ 5678 ];
+  };
+}
diff --git a/nixpkgs/nixos/modules/services/hardware/udev.nix b/nixpkgs/nixos/modules/services/hardware/udev.nix
index 311f60795bae..670b9087f110 100644
--- a/nixpkgs/nixos/modules/services/hardware/udev.nix
+++ b/nixpkgs/nixos/modules/services/hardware/udev.nix
@@ -112,7 +112,8 @@ let
       echo "OK"
 
       filesToFixup="$(for i in "$out"/*; do
-        grep -l '\B\(/usr\)\?/s\?bin' "$i" || :
+        # list all files referring to (/usr)/bin paths, but allow references to /bin/sh.
+        grep -P -l '\B(?!\/bin\/sh\b)(\/usr)?\/bin(?:\/.*)?' "$i" || :
       done)"
 
       if [ -n "$filesToFixup" ]; then
diff --git a/nixpkgs/nixos/modules/services/network-filesystems/drbd.nix b/nixpkgs/nixos/modules/services/network-filesystems/drbd.nix
index e74ed391d48e..79a1b768b461 100644
--- a/nixpkgs/nixos/modules/services/network-filesystems/drbd.nix
+++ b/nixpkgs/nixos/modules/services/network-filesystems/drbd.nix
@@ -55,8 +55,8 @@ let cfg = config.services.drbd; in
       wants = [ "systemd-udev.settle.service" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        ExecStart = "${pkgs.drbd}/sbin/drbdadm up all";
-        ExecStop = "${pkgs.drbd}/sbin/drbdadm down all";
+        ExecStart = "${pkgs.drbd}/bin/drbdadm up all";
+        ExecStop = "${pkgs.drbd}/bin/drbdadm down all";
       };
     };
   };
diff --git a/nixpkgs/nixos/modules/services/network-filesystems/kubo.nix b/nixpkgs/nixos/modules/services/network-filesystems/kubo.nix
index fbf9b32a2b25..e0b3fb0f36a7 100644
--- a/nixpkgs/nixos/modules/services/network-filesystems/kubo.nix
+++ b/nixpkgs/nixos/modules/services/network-filesystems/kubo.nix
@@ -361,6 +361,8 @@ in
         Group = cfg.group;
         StateDirectory = "";
         ReadWritePaths = optionals (!cfg.autoMount) [ "" cfg.dataDir ];
+        # Make sure the socket units are started before ipfs.service
+        Sockets = [ "ipfs-gateway.socket" "ipfs-api.socket" ];
       } // optionalAttrs (cfg.serviceFdlimit != null) { LimitNOFILE = cfg.serviceFdlimit; };
     } // optionalAttrs (!cfg.startWhenNeeded) {
       wantedBy = [ "default.target" ];
diff --git a/nixpkgs/nixos/modules/services/networking/quicktun.nix b/nixpkgs/nixos/modules/services/networking/quicktun.nix
index 7aed972adc88..2d44659f2080 100644
--- a/nixpkgs/nixos/modules/services/networking/quicktun.nix
+++ b/nixpkgs/nixos/modules/services/networking/quicktun.nix
@@ -1,94 +1,153 @@
-{ config, pkgs, lib, ... }:
+{ options, config, pkgs, lib, ... }:
 
 let
+  inherit (lib) mkOption mdDoc types mkIf;
 
+  opt = options.services.quicktun;
   cfg = config.services.quicktun;
-
 in
-
-with lib;
-
 {
   options = {
-
     services.quicktun = mkOption {
       default = { };
-      description = lib.mdDoc "QuickTun tunnels";
-      type = types.attrsOf (types.submodule {
+      description = mdDoc ''
+        QuickTun tunnels.
+
+        See <http://wiki.ucis.nl/QuickTun> for more information about available options.
+      '';
+      type = types.attrsOf (types.submodule ({ name, ... }: let
+        qtcfg = cfg.${name};
+      in {
         options = {
           tunMode = mkOption {
-            type = types.int;
-            default = 0;
-            example = 1;
-            description = lib.mdDoc "";
+            type = with types; coercedTo bool (b: if b then 1 else 0) (ints.between 0 1);
+            default = false;
+            example = true;
+            description = mdDoc "Whether to operate in tun (IP) or tap (Ethernet) mode.";
           };
 
           remoteAddress = mkOption {
             type = types.str;
+            default = "0.0.0.0";
             example = "tunnel.example.com";
-            description = lib.mdDoc "";
+            description = mdDoc ''
+              IP address or hostname of the remote end (use `0.0.0.0` for a floating/dynamic remote endpoint).
+            '';
           };
 
           localAddress = mkOption {
-            type = types.str;
+            type = with types; nullOr str;
+            default = null;
             example = "0.0.0.0";
-            description = lib.mdDoc "";
+            description = mdDoc "IP address or hostname of the local end.";
           };
 
           localPort = mkOption {
-            type = types.int;
+            type = types.port;
             default = 2998;
-            description = lib.mdDoc "";
+            description = mdDoc "Local UDP port.";
           };
 
           remotePort = mkOption {
-            type = types.int;
-            default = 2998;
-            description = lib.mdDoc "";
+            type = types.port;
+            default = qtcfg.localPort;
+            defaultText = lib.literalExpression "config.services.quicktun.<name>.localPort";
+            description = mdDoc " remote UDP port";
           };
 
           remoteFloat = mkOption {
-            type = types.int;
-            default = 0;
-            description = lib.mdDoc "";
+            type = with types; coercedTo bool (b: if b then 1 else 0) (ints.between 0 1);
+            default = false;
+            example = true;
+            description = mdDoc ''
+              Whether to allow the remote address and port to change when properly encrypted packets are received.
+            '';
           };
 
           protocol = mkOption {
-            type = types.str;
+            type = types.enum [ "raw" "nacl0" "nacltai" "salty" ];
             default = "nacltai";
-            description = lib.mdDoc "";
+            description = mdDoc "Which protocol to use.";
           };
 
           privateKey = mkOption {
-            type = types.str;
-            description = lib.mdDoc "";
+            type = with types; nullOr str;
+            default = null;
+            description = mdDoc ''
+              Local secret key in hexadecimal form.
+
+              ::: {.warning}
+              This option is deprecated. Please use {var}`services.quicktun.<name>.privateKeyFile` instead.
+              :::
+
+              ::: {.note}
+              Not needed when {var}`services.quicktun.<name>.protocol` is set to `raw`.
+              :::
+            '';
+          };
+
+          privateKeyFile = mkOption {
+            type = with types; nullOr path;
+            # This is a hack to deprecate `privateKey` without using `mkChangedModuleOption`
+            default = if qtcfg.privateKey == null then null else pkgs.writeText "quickttun-key-${name}" qtcfg.privateKey;
+            defaultText = "null";
+            description = mdDoc ''
+              Path to file containing local secret key in binary or hexadecimal form.
+
+              ::: {.note}
+              Not needed when {var}`services.quicktun.<name>.protocol` is set to `raw`.
+              :::
+            '';
           };
 
           publicKey = mkOption {
-            type = types.str;
-            description = lib.mdDoc "";
+            type = with types; nullOr str;
+            default = null;
+            description = mdDoc ''
+              Remote public key in hexadecimal form.
+
+              ::: {.note}
+              Not needed when {var}`services.quicktun.<name>.protocol` is set to `raw`.
+              :::
+            '';
           };
 
           timeWindow = mkOption {
-            type = types.int;
+            type = types.ints.unsigned;
             default = 5;
-            description = lib.mdDoc "";
+            description = mdDoc ''
+              Allowed time window for first received packet in seconds (positive number allows packets from history)
+            '';
           };
 
           upScript = mkOption {
-            type = types.lines;
-            default = "";
-            description = lib.mdDoc "";
+            type = with types; nullOr lines;
+            default = null;
+            description = mdDoc ''
+              Run specified command or script after the tunnel device has been opened.
+            '';
           };
         };
-      });
+      }));
     };
-
   };
 
-  config = mkIf (cfg != []) {
-    systemd.services = foldr (a: b: a // b) {} (
-      mapAttrsToList (name: qtcfg: {
+  config = {
+    warnings = lib.pipe cfg [
+      (lib.mapAttrsToList (name: value: if value.privateKey != null then name else null))
+      (builtins.filter (n: n != null))
+      (map (n: "  - services.quicktun.${n}.privateKey"))
+      (services: lib.optional (services != [ ]) ''
+        `services.quicktun.<name>.privateKey` is deprecated.
+        Please use `services.quicktun.<name>.privateKeyFile` instead.
+
+        Offending options:
+        ${lib.concatStringsSep "\n" services}
+      '')
+    ];
+
+    systemd.services = lib.mkMerge (
+      lib.mapAttrsToList (name: qtcfg: {
         "quicktun-${name}" = {
           wantedBy = [ "multi-user.target" ];
           after = [ "network.target" ];
@@ -96,14 +155,14 @@ with lib;
             INTERFACE = name;
             TUN_MODE = toString qtcfg.tunMode;
             REMOTE_ADDRESS = qtcfg.remoteAddress;
-            LOCAL_ADDRESS = qtcfg.localAddress;
+            LOCAL_ADDRESS = mkIf (qtcfg.localAddress != null) (qtcfg.localAddress);
             LOCAL_PORT = toString qtcfg.localPort;
             REMOTE_PORT = toString qtcfg.remotePort;
             REMOTE_FLOAT = toString qtcfg.remoteFloat;
-            PRIVATE_KEY = qtcfg.privateKey;
-            PUBLIC_KEY = qtcfg.publicKey;
+            PRIVATE_KEY_FILE = mkIf (qtcfg.privateKeyFile != null) qtcfg.privateKeyFile;
+            PUBLIC_KEY = mkIf (qtcfg.publicKey != null) qtcfg.publicKey;
             TIME_WINDOW = toString qtcfg.timeWindow;
-            TUN_UP_SCRIPT = pkgs.writeScript "quicktun-${name}-up.sh" qtcfg.upScript;
+            TUN_UP_SCRIPT = mkIf (qtcfg.upScript != null) (pkgs.writeScript "quicktun-${name}-up.sh" qtcfg.upScript);
             SUID = "nobody";
           };
           serviceConfig = {
@@ -114,5 +173,4 @@ with lib;
       }) cfg
     );
   };
-
 }
diff --git a/nixpkgs/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixpkgs/nixos/modules/services/x11/desktop-managers/plasma5.nix
index 027479b1ce09..e0227f93e2f2 100644
--- a/nixpkgs/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixpkgs/nixos/modules/services/x11/desktop-managers/plasma5.nix
@@ -295,7 +295,7 @@ in
         ++ lib.optional config.powerManagement.enable powerdevil
         ++ lib.optional config.services.colord.enable pkgs.colord-kde
         ++ lib.optional config.services.hardware.bolt.enable pkgs.plasma5Packages.plasma-thunderbolt
-        ++ lib.optionals config.services.samba.enable [ kdenetwork-filesharing pkgs.samba ]
+        ++ lib.optional config.services.samba.enable kdenetwork-filesharing
         ++ lib.optional config.services.xserver.wacom.enable pkgs.wacomtablet
         ++ lib.optional config.services.flatpak.enable flatpak-kcm;
 
diff --git a/nixpkgs/nixos/tests/all-tests.nix b/nixpkgs/nixos/tests/all-tests.nix
index ab07428cf055..c9234fc52536 100644
--- a/nixpkgs/nixos/tests/all-tests.nix
+++ b/nixpkgs/nixos/tests/all-tests.nix
@@ -717,6 +717,7 @@ in {
   qgis-ltr = handleTest ./qgis.nix { qgisPackage = pkgs.qgis-ltr; };
   qownnotes = handleTest ./qownnotes.nix {};
   quake3 = handleTest ./quake3.nix {};
+  quicktun = handleTest ./quicktun.nix {};
   quorum = handleTest ./quorum.nix {};
   rabbitmq = handleTest ./rabbitmq.nix {};
   radarr = handleTest ./radarr.nix {};
diff --git a/nixpkgs/nixos/tests/kubo/default.nix b/nixpkgs/nixos/tests/kubo/default.nix
index 629922fc366d..d8c0c69dc1fb 100644
--- a/nixpkgs/nixos/tests/kubo/default.nix
+++ b/nixpkgs/nixos/tests/kubo/default.nix
@@ -1,5 +1,7 @@
 { recurseIntoAttrs, runTest }:
 recurseIntoAttrs {
   kubo = runTest ./kubo.nix;
-  kubo-fuse = runTest ./kubo-fuse.nix;
+  # The FUSE functionality is completely broken since Kubo v0.24.0
+  # See https://github.com/ipfs/kubo/issues/10242
+  # kubo-fuse = runTest ./kubo-fuse.nix;
 }
diff --git a/nixpkgs/nixos/tests/kubo/kubo.nix b/nixpkgs/nixos/tests/kubo/kubo.nix
index 7965ad277385..b8222c652b33 100644
--- a/nixpkgs/nixos/tests/kubo/kubo.nix
+++ b/nixpkgs/nixos/tests/kubo/kubo.nix
@@ -46,6 +46,13 @@
             f"ipfs --api /unix/run/ipfs.sock cat /ipfs/{ipfs_hash.strip()} | grep fnord2"
         )
 
+    machine.stop_job("ipfs")
+
+    with subtest("Socket activation for the Gateway"):
+        machine.succeed(
+            f"curl 'http://127.0.0.1:8080/ipfs/{ipfs_hash.strip()}' | grep fnord2"
+        )
+
     with subtest("Setting dataDir works properly with the hardened systemd unit"):
         machine.succeed("test -e /mnt/ipfs/config")
         machine.succeed("test ! -e /var/lib/ipfs/")
diff --git a/nixpkgs/nixos/tests/quicktun.nix b/nixpkgs/nixos/tests/quicktun.nix
new file mode 100644
index 000000000000..a5a632457117
--- /dev/null
+++ b/nixpkgs/nixos/tests/quicktun.nix
@@ -0,0 +1,18 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+{
+  name = "quicktun";
+  meta.maintainers = with lib.maintainers; [ h7x4 ];
+
+  nodes = {
+    machine = { ... }: {
+      services.quicktun."test-tunnel" = {
+        protocol = "raw";
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("quicktun-test-tunnel.service")
+  '';
+})
diff --git a/nixpkgs/pkgs/applications/audio/lsp-plugins/default.nix b/nixpkgs/pkgs/applications/audio/lsp-plugins/default.nix
index 43e5338cb9bb..e6db737c4016 100644
--- a/nixpkgs/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/nixpkgs/pkgs/applications/audio/lsp-plugins/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, makeWrapper
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, makeWrapper
 , libsndfile, jack2
 , libGLU, libGL, lv2, cairo
 , ladspaH, php, libXrandr }:
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
     sha256 = "sha256-eJO+1fCNzqjTdGrPlhIrHc3UimkJOydRqTq49IN+Iwo=";
   };
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/lsp-plugins/lsp-dsp-lib/commit/58c3f985f009c84347fa91236f164a9e47aafa93.patch";
+      stripLen = 1;
+      extraPrefix = "modules/lsp-dsp-lib/";
+      hash = "sha256-pCLucLijXOgp69xNjSRCRxgVoQziT0YiHLnQGbkefqE=";
+    })
+  ];
 
   outputs = [ "out" "dev" "doc" ];
 
diff --git a/nixpkgs/pkgs/applications/blockchains/elements/default.nix b/nixpkgs/pkgs/applications/blockchains/elements/default.nix
index 0fa8ddd46dc5..68dfa2be0579 100644
--- a/nixpkgs/pkgs/applications/blockchains/elements/default.nix
+++ b/nixpkgs/pkgs/applications/blockchains/elements/default.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = if withGui then "elements" else "elementsd";
-  version = "22.1.1";
+  version = "23.2.1";
 
   src = fetchFromGitHub {
     owner = "ElementsProject";
     repo = "elements";
     rev = "elements-${version}";
-    sha256 = "sha256-V8Ym4dGshf2E6KsboALXn1DJ5nL3QQvMmVMNdjSw7B8=";
+    sha256 = "sha256-qHtSgfZGZ4Beu5fsJAOZm8ejj7wfHBbOS6WAjOrCuw4=";
   };
 
   nativeBuildInputs =
diff --git a/nixpkgs/pkgs/applications/blockchains/ergo/default.nix b/nixpkgs/pkgs/applications/blockchains/ergo/default.nix
index d630ce55383c..1ff9817bfd15 100644
--- a/nixpkgs/pkgs/applications/blockchains/ergo/default.nix
+++ b/nixpkgs/pkgs/applications/blockchains/ergo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "5.0.15";
+  version = "5.0.16";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-/VMuye6uCQghjwotjmWEe55RADVwHCpH6PelZXVXSzM=";
+    sha256 = "sha256-20k2/701CqNJS2nFDCCeCzr1s/Rh2VB2g5KcU5XmsFQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/nixpkgs/pkgs/applications/editors/codux/default.nix b/nixpkgs/pkgs/applications/editors/codux/default.nix
index 314f639f1060..ac81aea354d4 100644
--- a/nixpkgs/pkgs/applications/editors/codux/default.nix
+++ b/nixpkgs/pkgs/applications/editors/codux/default.nix
@@ -5,11 +5,11 @@
 
 let
   pname = "codux";
-  version = "15.14.0";
+  version = "15.16.1";
 
   src = fetchurl {
     url = "https://github.com/wixplosives/codux-versions/releases/download/${version}/Codux-${version}.x86_64.AppImage";
-    sha256 = "sha256-GTp9wJrL0TA0Jee1aXKAqmyHfotm7u7gxq/6W8+ermY=";
+    sha256 = "sha256-vc0lnYGOgb1uKAQlj6xc8mbSfJ6apGNSlyDRX3qHeTM=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
diff --git a/nixpkgs/pkgs/applications/editors/eclipse/default.nix b/nixpkgs/pkgs/applications/editors/eclipse/default.nix
index 72ecd8e094f4..dd33558e06f6 100644
--- a/nixpkgs/pkgs/applications/editors/eclipse/default.nix
+++ b/nixpkgs/pkgs/applications/editors/eclipse/default.nix
@@ -226,6 +226,6 @@ in rec {
 
   ### Plugins
 
-  plugins = callPackage ./plugins.nix { };
+  plugins = callPackage ./plugins.nix { } // { __attrsFailEvaluation = true; };
 
 }
diff --git a/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/elpa-devel-packages.nix b/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/elpa-devel-packages.nix
index 60c257e365ce..3d0073bf8143 100644
--- a/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/elpa-devel-packages.nix
+++ b/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/elpa-devel-packages.nix
@@ -89,4 +89,4 @@ self: let
 
   in elpaDevelPackages // { inherit elpaBuild; });
 
-in generateElpa { }
+in (generateElpa { }) // { __attrsFailEvaluation = true; }
diff --git a/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix b/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix
index 2a6cb016cdc8..112445453abb 100644
--- a/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix
+++ b/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix
@@ -181,4 +181,4 @@ self: let
 
   in elpaPackages // { inherit elpaBuild; });
 
-in generateElpa { }
+in (generateElpa { }) // { __attrsFailEvaluation = true; }
diff --git a/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix b/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
index d53ee7056a89..bd0f1114b1cd 100644
--- a/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
+++ b/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
@@ -113,4 +113,6 @@ in
   emacsSessionManagement = self.session-management-for-emacs;
   rectMark = self.rect-mark;
   sunriseCommander = self.sunrise-commander;
+
+  __attrsFailEvaluation = true;
 }
diff --git a/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index aa1fb2f8050b..bb45c383487c 100644
--- a/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -735,4 +735,5 @@ let
     in lib.mapAttrs (n: v: if lib.hasAttr n overrides then overrides.${n} else v) super);
 
 in
-generateMelpa { }
+(generateMelpa { })
+// { __attrsFailEvaluation = true; }
diff --git a/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/nongnu-packages.nix b/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/nongnu-packages.nix
index cd32a8bd3975..beca93ea4c35 100644
--- a/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/nongnu-packages.nix
+++ b/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/nongnu-packages.nix
@@ -20,12 +20,12 @@ self: let
     generated ? ./nongnu-generated.nix
   }: let
 
-    imported = import generated {
+    imported = (import generated {
       callPackage = pkgs: args: self.callPackage pkgs (args // {
         # Use custom elpa url fetcher with fallback/uncompress
         fetchurl = buildPackages.callPackage ./fetchelpa.nix { };
       });
-    };
+    }) // { __attrsFailEvaluation = true; };
 
     super = imported;
 
diff --git a/nixpkgs/pkgs/applications/editors/jetbrains/default.nix b/nixpkgs/pkgs/applications/editors/jetbrains/default.nix
index 7ce12807985b..e40fa4c68d72 100644
--- a/nixpkgs/pkgs/applications/editors/jetbrains/default.nix
+++ b/nixpkgs/pkgs/applications/editors/jetbrains/default.nix
@@ -249,6 +249,6 @@ rec {
 
   webstorm = mkJetBrainsProduct { pname = "webstorm"; extraBuildInputs = [ stdenv.cc.cc musl ]; };
 
-  plugins = callPackage ./plugins { };
+  plugins = callPackage ./plugins { } // { __attrsFailEvaluation = true; };
 
 }
diff --git a/nixpkgs/pkgs/applications/editors/vim/plugins/generated.nix b/nixpkgs/pkgs/applications/editors/vim/plugins/generated.nix
index 96a874b9006e..d416b48f8930 100644
--- a/nixpkgs/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/nixpkgs/pkgs/applications/editors/vim/plugins/generated.nix
@@ -29,12 +29,12 @@ final: prev:
 
   ChatGPT-nvim = buildVimPlugin {
     pname = "ChatGPT.nvim";
-    version = "2023-12-13";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "jackMort";
       repo = "ChatGPT.nvim";
-      rev = "f189c51d03316b4ab02766c5fed6f876f5d57cbb";
-      sha256 = "1h6fggfqifx47vhd3n0c4vldrx5lqbizkijm14nkj55224sq5i61";
+      rev = "48c59167beeb6ee0caa501c46cecc97b9be8571d";
+      sha256 = "013jns9jz630zc79npadrh5a75spgmglq76d4m56wx89qkbchfxm";
     };
     meta.homepage = "https://github.com/jackMort/ChatGPT.nvim/";
   };
@@ -305,12 +305,12 @@ final: prev:
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "2023-12-08";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "177cae4f44ddf7c166ef263956378ae308ff77ff";
-      sha256 = "12q4m3c0y7qc12mhaqlf4sbyk0ffm8jbnfl29fg3zyq0shdk9lb1";
+      rev = "3927fbff75d5777660bfc4d29ff8d5b4a0cae2af";
+      sha256 = "03n0qln4vyi708k0xxr94v4c01qcxv8419nhby59270h2yyzvfx5";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
   };
@@ -3058,12 +3058,12 @@ final: prev:
 
   dropbar-nvim = buildVimPlugin {
     pname = "dropbar.nvim";
-    version = "2023-12-09";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "Bekaboo";
       repo = "dropbar.nvim";
-      rev = "9405df5f20aea9e7f6ce056da2f50bd755a7a2e7";
-      sha256 = "170g3akg93f02xpyb0yacdydv2x2l9ha2213mqqzb2njmijhsjhs";
+      rev = "e218e882a8e993e267b727859d8688f84e91ef1a";
+      sha256 = "171xhasyrl7fs83ykc3bbn3ayjqxqm1m5v0407wndaq28m3hz8qp";
     };
     meta.homepage = "https://github.com/Bekaboo/dropbar.nvim/";
   };
@@ -3889,12 +3889,12 @@ final: prev:
 
   go-nvim = buildVimPlugin {
     pname = "go.nvim";
-    version = "2023-12-01";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "go.nvim";
-      rev = "7b7c20029a817ef51f6b498388488e9850fe45ac";
-      sha256 = "0qbgmg9kvhxz4akmxd56lwr2zjxrayccgiynkcfnqakvya271jji";
+      rev = "13a1044fc66bb8170b8f1ed12cb929efa946fa82";
+      sha256 = "16sv3h1z8xzw3fp0vj572xfg0lh33h8yd703amqkyl2pzsk41m0j";
     };
     meta.homepage = "https://github.com/ray-x/go.nvim/";
   };
@@ -4069,12 +4069,12 @@ final: prev:
 
   hardtime-nvim = buildVimPlugin {
     pname = "hardtime.nvim";
-    version = "2023-12-12";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "m4xshen";
       repo = "hardtime.nvim";
-      rev = "dbb0b135fa69017e455d48c65109c634a425f067";
-      sha256 = "06hyrwnz1nvika14mpvblxdfwhcfhj54a6cazq7pxxl08dxm5wz0";
+      rev = "9a79ec3d7a6112dd997ac4b2130c97fcdb9ee98f";
+      sha256 = "11dbsbs5vxw3vvvyiapa4dlv21vg7sssji0fxi19sfl6xj5ihbmi";
     };
     meta.homepage = "https://github.com/m4xshen/hardtime.nvim/";
   };
@@ -4104,12 +4104,12 @@ final: prev:
 
   haskell-tools-nvim = buildNeovimPlugin {
     pname = "haskell-tools.nvim";
-    version = "2023-12-11";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "haskell-tools.nvim";
-      rev = "7168f8e133abf55d30772a7c3b6519c85fbeff33";
-      sha256 = "15p1gvbvzlymhzas3ckm357ilfk43mlbkc11b1fwgxyizy1dmsyw";
+      rev = "1b344add99cf64be0bf384c13dda5eb5f3060736";
+      sha256 = "0fyhq0w5nivplq7g8xglmdqp0a2r7zrgn2him9nfjv8jaajm21cw";
     };
     meta.homepage = "https://github.com/MrcJkb/haskell-tools.nvim/";
   };
@@ -4680,12 +4680,12 @@ final: prev:
 
   julia-vim = buildVimPlugin {
     pname = "julia-vim";
-    version = "2023-07-05";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "JuliaEditorSupport";
       repo = "julia-vim";
-      rev = "69dd4b076b9b4f863647b424f856bbe6d5ba0cd4";
-      sha256 = "1rvrm39xcm30mxxd6zbhxfqqz677d4vn55qcm0rxr08zcy431p89";
+      rev = "20542b50610e075e5f4199187800ede2425f6cb8";
+      sha256 = "02yy03w15s4f779qphg2smcsa6dka8vspsyixqajc4w9g7y1si7k";
     };
     meta.homepage = "https://github.com/JuliaEditorSupport/julia-vim/";
   };
@@ -4824,12 +4824,12 @@ final: prev:
 
   lazygit-nvim = buildVimPlugin {
     pname = "lazygit.nvim";
-    version = "2023-09-26";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "kdheepak";
       repo = "lazygit.nvim";
-      rev = "de35012036d43bca03628d40d083f7c02a4cda3f";
-      sha256 = "1wgcl487gijm0ydp8n79jc8pmh947vphhh67vk6p79fxaihc56bl";
+      rev = "1e08e3f5ac1152339690140e61a4a32b3bdc7de5";
+      sha256 = "1rs3sva578j28hy6881w2wjxixl7g7rirard0fljxz460wfnr0vx";
     };
     meta.homepage = "https://github.com/kdheepak/lazygit.nvim/";
   };
@@ -5339,12 +5339,12 @@ final: prev:
 
   luasnip = buildNeovimPlugin {
     pname = "luasnip";
-    version = "2023-12-05";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "l3mon4d3";
       repo = "luasnip";
-      rev = "954c81b53989097faaff0fabc11c29575288c3e1";
-      sha256 = "1a7yz1clg750fbhkv81c5igqd90b9sa9y8c6dy6prcmkyyn1756a";
+      rev = "6a001360cea89df50f7c5cc8c7a75e6a21f1ef5c";
+      sha256 = "1qpd59221lcaxy7kb830v3g8h38ml590g1vn7q98z1fddm142vif";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/l3mon4d3/luasnip/";
@@ -5496,12 +5496,12 @@ final: prev:
 
   material-nvim = buildVimPlugin {
     pname = "material.nvim";
-    version = "2023-12-11";
+    version = "2023-12-13";
     src = fetchFromGitHub {
       owner = "marko-cerovac";
       repo = "material.nvim";
-      rev = "e6059169795ebdc9256ad1d104860b2c1a229384";
-      sha256 = "0gvfc0bdqnvknmzc1w9yvnd8dyn9jclqgrqg0wfdq3g027nfw8pk";
+      rev = "60416124a07a3358f3b93915092db50fcb712b41";
+      sha256 = "160ycm9dh95r240jgz6wgfqgmi2i6wxwf32jq7348jabxbl3n7si";
     };
     meta.homepage = "https://github.com/marko-cerovac/material.nvim/";
   };
@@ -5604,12 +5604,12 @@ final: prev:
 
   mkdnflow-nvim = buildVimPlugin {
     pname = "mkdnflow.nvim";
-    version = "2023-12-12";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "jakewvincent";
       repo = "mkdnflow.nvim";
-      rev = "cefce2a0dc243645fe70096fa083e6d93575a0ce";
-      sha256 = "132c76dhhj3g2f8v96mmmi1mz0qikcgwzp3i54ilhgq35jqaglnr";
+      rev = "d10908058836afe3ec2867cf3f603c1fd78dd8fb";
+      sha256 = "0404dbdpkd8s2gkm8nv2wymj14bmvzpk3r377cnlbxydrbiqfshx";
     };
     meta.homepage = "https://github.com/jakewvincent/mkdnflow.nvim/";
   };
@@ -5664,12 +5664,12 @@ final: prev:
 
   molten-nvim = buildVimPlugin {
     pname = "molten-nvim";
-    version = "2023-12-10";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "benlubas";
       repo = "molten-nvim";
-      rev = "883ecb358e3b4dca9a83daa05b51f22b81f878e9";
-      sha256 = "00x89gb56rx310mg7bx03x14m1s3110bn9lxpwpbx9hdy01gyz9n";
+      rev = "ebf2bda74e8b903222ad0378ffda57c9afb5cc84";
+      sha256 = "19a01mrvykjszxia7gr1jbxh3bi9hfj6rrnna0gfgd0ml37ahmgr";
     };
     meta.homepage = "https://github.com/benlubas/molten-nvim/";
   };
@@ -6024,24 +6024,24 @@ final: prev:
 
   neodev-nvim = buildVimPlugin {
     pname = "neodev.nvim";
-    version = "2023-12-07";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neodev.nvim";
-      rev = "c4ce017bd4bacf60bf59330cec9e93c5d5e104a6";
-      sha256 = "18qz4540m9b8xz849w9n8w8x4m8zp8bbqxv3cs9gqsg4k0asl1wl";
+      rev = "58f83ce5145329f5866ef1c7ff523de03549d24f";
+      sha256 = "0vwqb5rrdl66inaza3rq3bhaga5175yinsgmbcinlqq6shb0qpq7";
     };
     meta.homepage = "https://github.com/folke/neodev.nvim/";
   };
 
   neoformat = buildVimPlugin {
     pname = "neoformat";
-    version = "2023-11-22";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "sbdchd";
       repo = "neoformat";
-      rev = "afbc055587e88554b1fd11408cfab859d0cd40d3";
-      sha256 = "0p7vvl7nc5caijgksshwibdq704kq3r6rq7w5ih3vnk1i7s5sw1h";
+      rev = "cd45ca8309d5261e8e76557c11a22b2f1ffc710b";
+      sha256 = "1jfn7s9k8zylnx4xsvlgi0akv96ysxyx8wh8y765v7cjxjq7cnhq";
     };
     meta.homepage = "https://github.com/sbdchd/neoformat/";
   };
@@ -6060,12 +6060,12 @@ final: prev:
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "2023-12-12";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "a2361d2c6caaecbe2565836f94e7945df22963ab";
-      sha256 = "0vf9pz7mpc3kyh75xmbzxvnz8fvpw1ivx8nnd09bbwvqfnxd9d13";
+      rev = "d6f21d87194f51bc934466c7841579caf60b796a";
+      sha256 = "122shgkln7kldwx0zl8nsjagi4m1kjg1425n2lpbvixd2jnjpsnl";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
   };
@@ -6529,12 +6529,12 @@ final: prev:
 
   nfnl = buildVimPlugin {
     pname = "nfnl";
-    version = "2023-09-08";
+    version = "2023-12-07";
     src = fetchFromGitHub {
       owner = "Olical";
       repo = "nfnl";
-      rev = "979dbfc48bcb601a9107764a99f9459cb5bd4051";
-      sha256 = "0m1yf62w4r75amva8708c4i0qvhgfia2i9p64z6i6589mq4mw6ip";
+      rev = "eaeef3337d7377cf16d8592ad2d345b1a192e4f2";
+      sha256 = "1smdmihg26jrhcdg086h682mi9038gv8cha63xd63szz67pfd7w8";
     };
     meta.homepage = "https://github.com/Olical/nfnl/";
   };
@@ -6553,12 +6553,12 @@ final: prev:
 
   nightfox-nvim = buildVimPlugin {
     pname = "nightfox.nvim";
-    version = "2023-11-22";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "EdenEast";
       repo = "nightfox.nvim";
-      rev = "eb82712f86319272f4b7b9dbb4ec6df650e6987f";
-      sha256 = "1ab734sg19g9q448qkv183rcj72r2gchwpmr0snnlkbmz9x547js";
+      rev = "44154e1596e801ed669fe9371c34ece0e635eaa5";
+      sha256 = "1v5jcqp168mh5is3ir3b64gz9mx4m36hs5s5y4j0x2qww3ff5r5l";
     };
     meta.homepage = "https://github.com/EdenEast/nightfox.nvim/";
   };
@@ -6625,12 +6625,12 @@ final: prev:
 
   no-neck-pain-nvim = buildVimPlugin {
     pname = "no-neck-pain.nvim";
-    version = "2023-12-12";
+    version = "2023-12-13";
     src = fetchFromGitHub {
       owner = "shortcuts";
       repo = "no-neck-pain.nvim";
-      rev = "ba409c31b8d8ae9a36f560f38cfb6b718acfa6ea";
-      sha256 = "166rxrh67w5wg4a06cxyyd2xhi6syvkm0rzjllx98yyznrlbdzp5";
+      rev = "baf3efd1a1785a96a0568e1fdd6aefa4a59e5edc";
+      sha256 = "127m8cjqbkrip7s83xwq0bvv2qcvjdw01056fkjsfmhh1s6gkigb";
     };
     meta.homepage = "https://github.com/shortcuts/no-neck-pain.nvim/";
   };
@@ -6649,12 +6649,12 @@ final: prev:
 
   none-ls-nvim = buildVimPlugin {
     pname = "none-ls.nvim";
-    version = "2023-12-07";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "nvimtools";
       repo = "none-ls.nvim";
-      rev = "45d0e8fa9094dcc3fabad9065a5822af9cf099c7";
-      sha256 = "0g5vc7r3xhvrdrajidzxlnilvmygpyrp85vyb9amn0zbga5rmcc4";
+      rev = "ef09f14eab78ca6ce3bee1ddc73db5511f5cd953";
+      sha256 = "066wr59s0bqrmnx46f9yfa0yr8mmpghahzn3wc6jaj2l9rc1k7cw";
     };
     meta.homepage = "https://github.com/nvimtools/none-ls.nvim/";
   };
@@ -6865,12 +6865,12 @@ final: prev:
 
   nvim-cmp = buildNeovimPlugin {
     pname = "nvim-cmp";
-    version = "2023-12-10";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "hrsh7th";
       repo = "nvim-cmp";
-      rev = "41d7633e4146dce1072de32cea31ee31b056a131";
-      sha256 = "0l72vrylmw8zv9hvl8rhiycn69s50fn5064h3ydhpf432b8b65sb";
+      rev = "538e37ba87284942c1d76ed38dd497e54e65b891";
+      sha256 = "1mxigpm4h8ad8hjd8zy6ajkk2c03vgcrigqarhybz6zsi52iil06";
     };
     meta.homepage = "https://github.com/hrsh7th/nvim-cmp/";
   };
@@ -6985,12 +6985,12 @@ final: prev:
 
   nvim-dap = buildVimPlugin {
     pname = "nvim-dap";
-    version = "2023-12-08";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap";
-      rev = "bbe2c6f3438542a37cc2141a8e385f7dfe07d87d";
-      sha256 = "1aqvlnm0zdc6k2jn53jlj8rdxc9agq9jky3qpjc2j6gx04llhd48";
+      rev = "e64ebf3309154b578a03c76229ebf51c37898118";
+      sha256 = "11j71rdx4mx3g0x8vxp19jqnpihbwdrcr29651cn5q00myzvgzx9";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap/";
   };
@@ -7236,12 +7236,12 @@ final: prev:
 
   nvim-lint = buildVimPlugin {
     pname = "nvim-lint";
-    version = "2023-12-08";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-lint";
-      rev = "849ccb610de3f6ce1a239ea1e68568ef1a53d5df";
-      sha256 = "0jlk9j538fpxv2m4l7smi2j3bhrfdl6i3qckn9x38j8m3vq5jdxs";
+      rev = "5b42e12f397e9fd2629e6f0ce1c780a12b9e6597";
+      sha256 = "0y0nx8960fnfwj6j59a1qd63ylia4wvpcxpqg9lcnhsf78vczis2";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-lint/";
   };
@@ -7272,12 +7272,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPlugin {
     pname = "nvim-lspconfig";
-    version = "2023-12-12";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "f451052bd6804e9e5ccd0ac874d7df8d3d4c55b9";
-      sha256 = "1cf0vzdk2jmj63x7cg9p5m2lhi5ch7p8mrsidclx9h4qpf4vl0ns";
+      rev = "84f2dd42efffa20d505ac44c78568d778ca7e0a1";
+      sha256 = "07ngajqlkgfaijj2ampyr0d4why1slq5bp6izyki22310yifdbhj";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -7332,12 +7332,12 @@ final: prev:
 
   nvim-metals = buildVimPlugin {
     pname = "nvim-metals";
-    version = "2023-11-24";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "scalameta";
       repo = "nvim-metals";
-      rev = "826b7542b8bccf9a120d1c613481fb0496f93724";
-      sha256 = "03hifwc01nc3s4hlbfhfpcw7as0l6sfgsrh0flmqpxhdix52gljm";
+      rev = "0abecb7c37586d015185cd6a4c9dbfa01f2c0f48";
+      sha256 = "18iqrf9vschirjqzx3l0c0jqdhmk6zqvg1rv7y6cl8fmbvbs0cmp";
     };
     meta.homepage = "https://github.com/scalameta/nvim-metals/";
   };
@@ -7632,12 +7632,12 @@ final: prev:
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "2023-12-13";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "42381aae7c1f785e4658cdb34a750be9851ba9af";
-      sha256 = "1kfa6677p277crw7h9g563b951jlcbqklxl48vja4cvpvn1l0qza";
+      rev = "194b3f0047816132b08bcc2857b23a49fa967d04";
+      sha256 = "0mx5b8q0czirif5wzran7x8vcafb07xhz72zslqlhm9nx1vfl2fk";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
@@ -8787,12 +8787,12 @@ final: prev:
 
   rustaceanvim = buildNeovimPlugin {
     pname = "rustaceanvim";
-    version = "2023-12-12";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "mrcjkb";
       repo = "rustaceanvim";
-      rev = "1e6d6c93cddaaf7b97a5c22771b2a4bf877eeea8";
-      sha256 = "0qbsirbjvbyhl08ij23lyangixrr8im7pxp9vcalri75vnsc0r73";
+      rev = "ff208ee3c9d67f450e88eb05417ad256c7ebfec4";
+      sha256 = "0nlxs1bwmc114rfhhfig7zyfw4j0j1mhmrddrhzpg6vnc7a813mm";
     };
     meta.homepage = "https://github.com/mrcjkb/rustaceanvim/";
   };
@@ -8955,12 +8955,12 @@ final: prev:
 
   sg-nvim = buildVimPlugin {
     pname = "sg.nvim";
-    version = "2023-12-13";
+    version = "2023-12-14";
     src = fetchFromGitHub {
       owner = "sourcegraph";
       repo = "sg.nvim";
-      rev = "9eeb00c758a394cccd2828720b0eaadce6f1ad51";
-      sha256 = "085vpy7vrmzcx5143gcxsgan99g6g9p05rljs0pkrw5kn7fw6szb";
+      rev = "817f1f36e4c43f82e8e1cdfa4cf978dffa037255";
+      sha256 = "12zlrlqmny9f6y781pnlfn7qzac41mwx8a3qdmarrgns08hfp6l5";
     };
     meta.homepage = "https://github.com/sourcegraph/sg.nvim/";
   };
@@ -10102,12 +10102,12 @@ final: prev:
 
   text-case-nvim = buildVimPlugin {
     pname = "text-case.nvim";
-    version = "2023-12-06";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "johmsalas";
       repo = "text-case.nvim";
-      rev = "59dcb71ee9920b888d91c3e20ab20f4b3f667449";
-      sha256 = "08bzns7k3ffk09bm4jsqxdlndmi61pjbcw8hwzyjn3xhxp7ky4dw";
+      rev = "68a0a58996d58ed36fbfc945821a34e7b953d12a";
+      sha256 = "1slnj1hcb9125j8ybz1b9bsfayy2b4967c1jspwqry7p839ihld2";
     };
     meta.homepage = "https://github.com/johmsalas/text-case.nvim/";
   };
@@ -10463,12 +10463,12 @@ final: prev:
 
   unison = buildVimPlugin {
     pname = "unison";
-    version = "2023-12-13";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "unisonweb";
       repo = "unison";
-      rev = "a91e3c32060862ea2ba1ebdedd3d3eaa636edcdd";
-      sha256 = "15wm2jx6vrrx8f00g7p0w3jzqgpg6c0jbzj2n7h6vl93s7d65207";
+      rev = "d2bb9576005fae111918d653bee24e907f633ede";
+      sha256 = "1yp117d87q50fal71c8sxz9acd0ygcy0fg3r7g6h6r70rpkzayiz";
     };
     meta.homepage = "https://github.com/unisonweb/unison/";
   };
@@ -13177,12 +13177,12 @@ final: prev:
 
   vim-lsp-settings = buildVimPlugin {
     pname = "vim-lsp-settings";
-    version = "2023-11-15";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "mattn";
       repo = "vim-lsp-settings";
-      rev = "3d99f09affd1ea6b9289949d5b282c43fe21eab8";
-      sha256 = "08983vwgcaz2ydl4pf5nlzjli7aa88bmdp3m56519ihfhj2s1s22";
+      rev = "a0c5cf830a45795142b65ff38268265889757a00";
+      sha256 = "067qn02q7mazd9wngmxmb1kq1zs5ig0dsyxl4gicd6m41d5x6p4k";
     };
     meta.homepage = "https://github.com/mattn/vim-lsp-settings/";
   };
@@ -14871,12 +14871,12 @@ final: prev:
 
   vim-test = buildVimPlugin {
     pname = "vim-test";
-    version = "2023-12-05";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "vim-test";
       repo = "vim-test";
-      rev = "84373ffca386edd667e09f2bf1024b1de7bdfdf1";
-      sha256 = "092fy9bvccf5xizs6s904r6ipb2sigq51bli4kr0x9i9xgi6yjx0";
+      rev = "b7ca2a825c8308286c21a563802290b3ca6e20c1";
+      sha256 = "0p9ks8nq517bzk543k6am6d2njbl9fz43aiq2zlsmpl5n06p6zsb";
     };
     meta.homepage = "https://github.com/vim-test/vim-test/";
   };
@@ -16097,12 +16097,12 @@ final: prev:
 
   catppuccin-nvim = buildVimPlugin {
     pname = "catppuccin-nvim";
-    version = "2023-12-08";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "nvim";
-      rev = "64dc309bc157779691be38bbfc5123584e0a4a85";
-      sha256 = "1nm4ykjrbkk7mmc8lghhgl0nidwlmjs7mqxm0858d2nc6l3yy4k3";
+      rev = "32ee05d014a4611555c7f56a73283efb4718d9c5";
+      sha256 = "1r835mhmqs6akdnyg0sd1mszk97mgfxkdx0dqzg7mmqi9vnqrcaz";
     };
     meta.homepage = "https://github.com/catppuccin/nvim/";
   };
@@ -16157,12 +16157,12 @@ final: prev:
 
   harpoon2 = buildVimPlugin {
     pname = "harpoon2";
-    version = "2023-12-13";
+    version = "2023-12-15";
     src = fetchFromGitHub {
       owner = "ThePrimeagen";
       repo = "harpoon";
-      rev = "8f67088e9d479397347b63e69920ee861a9838cd";
-      sha256 = "0j5m4hm3fzkfwf1mjy3mq9askf3jkb9d5bfy8v50k2z4l9imbvz1";
+      rev = "362cdc869f7e10c470afdd437c65c4e9d5129018";
+      sha256 = "0pic3pfdp81756pc8skaqrqy06xw8qp7gyb2ncxnkigr13kv6ijz";
     };
     meta.homepage = "https://github.com/ThePrimeagen/harpoon/";
   };
diff --git a/nixpkgs/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/nixpkgs/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index 8d1ed1981eb6..d14e5f1cda9d 100644
--- a/nixpkgs/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/nixpkgs/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -550,12 +550,12 @@
   };
   erlang = buildGrammar {
     language = "erlang";
-    version = "0.0.0+rev=5694277";
+    version = "0.0.0+rev=0821889";
     src = fetchFromGitHub {
       owner = "WhatsApp";
       repo = "tree-sitter-erlang";
-      rev = "56942778b5791d07949e6c7b6093e01aba5b7ab4";
-      hash = "sha256-0a36KKjacSbVb8zXaq2SHPw8njkZLb5rRWoaEUdsYyA=";
+      rev = "08218898824c68fc8439cba1540042081e2da18d";
+      hash = "sha256-0IFJFA2/eN72OjYFPPVhkYdMNKuTrhrXdlgUGjv00Y0=";
     };
     meta.homepage = "https://github.com/WhatsApp/tree-sitter-erlang";
   };
@@ -902,12 +902,12 @@
   };
   haskell = buildGrammar {
     language = "haskell";
-    version = "0.0.0+rev=d70b321";
+    version = "0.0.0+rev=23ad72f";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-haskell";
-      rev = "d70b321b8b702939d722c2c15f4c28d14e91a400";
-      hash = "sha256-CJ6xwEUhh/rGr07edmx99nY4eHdBdsysaOzmuKM6SDE=";
+      rev = "23ad72f4b755269004a0a3f3796192705313643d";
+      hash = "sha256-2MtxGMqxhKHuQQ8sME4QzVe1NxsMok6JZrg7Etgi1lg=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-haskell";
   };
@@ -1455,12 +1455,12 @@
   };
   nim = buildGrammar {
     language = "nim";
-    version = "0.0.0+rev=d41fd3e";
+    version = "0.0.0+rev=0fdb059";
     src = fetchFromGitHub {
       owner = "alaviss";
       repo = "tree-sitter-nim";
-      rev = "d41fd3e4c1f83a0e6429c2d035209e107e80e6f8";
-      hash = "sha256-2OqwU10JW7l87v2QXtBn5znP8Ptq9GZ/1PNAQOXJPVA=";
+      rev = "0fdb059ce7c1926a0287c3deb80e20186e4451d7";
+      hash = "sha256-dalcbpzdY0ZIEWNkcD5j/9Ifq/IyvGHu+SEMME6p2ws=";
     };
     meta.homepage = "https://github.com/alaviss/tree-sitter-nim";
   };
@@ -2558,12 +2558,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "0.0.0+rev=fdd1374";
+    version = "0.0.0+rev=f7c31c7";
     src = fetchFromGitHub {
       owner = "v-analyzer";
       repo = "v-analyzer";
-      rev = "fdd137445c50d73767548c1b2386e5f560d5d042";
-      hash = "sha256-LjO0gRuvu8i4JZ71KKJVdEb5xvE56JP+5wL9Hua/eRg=";
+      rev = "f7c31c7578ebd35b95cfa85c6461ed6480697a9a";
+      hash = "sha256-MmnV7k8xmPGKUoVwf66y5JI8IzHcC7n0fstOMbj3UG0=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/v-analyzer/v-analyzer";
@@ -2658,12 +2658,12 @@
   };
   wing = buildGrammar {
     language = "wing";
-    version = "0.0.0+rev=693ee4b";
+    version = "0.0.0+rev=698e645";
     src = fetchFromGitHub {
       owner = "winglang";
       repo = "wing";
-      rev = "693ee4b3a995a9c305479b32c10e0a87013ff125";
-      hash = "sha256-WgCeDShSDUJRSY3LcX8zT+JlJIxHwLhD7lKDIBLoIfc=";
+      rev = "698e645b30e871a58c7de68e0ecd6d2ebbdd0009";
+      hash = "sha256-7MlqVa0g/+RmSD9Aa7FW50icoQfv5Gj/3l2YMFDSU30=";
     };
     location = "libs/tree-sitter-wing";
     generate = true;
diff --git a/nixpkgs/pkgs/applications/editors/vim/plugins/overrides.nix b/nixpkgs/pkgs/applications/editors/vim/plugins/overrides.nix
index e519f4e5268d..fe8ba4fe423f 100644
--- a/nixpkgs/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/nixpkgs/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1007,7 +1007,7 @@ self: super: {
         pname = "sg-nvim-rust";
         inherit (old) version src;
 
-        cargoHash = "sha256-XaCBFAq/T17fz4Zn1OtG9Or3p4UwxXYKr+PTkl+Ho3k=";
+        cargoHash = "sha256-U+EGS0GMWzE2yFyMH04gXpR9lR7HRMgWBecqICfTUbE=";
 
         nativeBuildInputs = [ pkg-config ];
 
@@ -1048,12 +1048,12 @@ self: super: {
 
   sniprun =
     let
-      version = "1.3.8";
+      version = "1.3.9";
       src = fetchFromGitHub {
         owner = "michaelb";
         repo = "sniprun";
         rev = "refs/tags/v${version}";
-        hash = "sha256-xQb/VZOuwB1J4m6iOs1JMfH1f1rOzJzpvq3D4HHOHAI=";
+        hash = "sha256-g2zPGAJIjMDWn8FCsuRPZyYHDk+ZHCd04lGlYHvb4OI=";
       };
       sniprun-bin = rustPlatform.buildRustPackage {
         pname = "sniprun-bin";
@@ -1063,7 +1063,7 @@ self: super: {
           darwin.apple_sdk.frameworks.Security
         ];
 
-        cargoHash = "sha256-6h0P0UVks6dQz2PZ1A/CLa1T8okD3CIUnfrH3vHe4L8=";
+        cargoHash = "sha256-h/NhDFp+Yiyx37Tlfu0W9rMnd+ZmQp5gt+qhY3PB7DE=";
 
         nativeBuildInputs = [ makeWrapper ];
 
diff --git a/nixpkgs/pkgs/applications/emulators/yuzu/sources.nix b/nixpkgs/pkgs/applications/emulators/yuzu/sources.nix
index 640bbcd50acd..4952c74ac4b4 100644
--- a/nixpkgs/pkgs/applications/emulators/yuzu/sources.nix
+++ b/nixpkgs/pkgs/applications/emulators/yuzu/sources.nix
@@ -1,19 +1,19 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2023-12-02
+# Last updated: 2023-12-14
 {
   compatList = {
-    rev = "3447075b5b565adcef1de0b47dd32c33f3c52e75";
+    rev = "fc974b6e78105774dae5f68e712a6beb51b9db1e";
     hash = "sha256:1hdsza3wf9a0yvj6h55gsl7xqvhafvbz1i8paz9kg7l49b0gnlh1";
   };
 
   mainline = {
-    version = "1639";
-    hash = "sha256:10wj8yrk4q3sq0fqj6qqd45sjsv0ch3ldbxayirzv002lqb62jcy";
+    version = "1651";
+    hash = "sha256:00cxyh3d18k17g982yqcbaq4b6bgs4kji0yz6i15h066aj15dimy";
   };
 
   ea = {
-    version = "4003";
-    distHash = "sha256:1sr79h3v2nlkr114d14bry5bkgniw1kqq2bxjlzr5x9hlvavz710";
-    fullHash = "sha256:0kx8f8h6l86prxm0v3fxmff43d6swmcrvzy5vg54b55zvqm1byr1";
+    version = "4019";
+    distHash = "sha256:1qd953bl216yxmaa6y0iil6pn2pn53k87qwagbmcd4l5h4aaqi7h";
+    fullHash = "sha256:0na96hqfdd40q6drrlgak4qdsxs3wfizxhb8kf8qrbai3qfpx00v";
   };
 }
diff --git a/nixpkgs/pkgs/applications/file-managers/felix-fm/default.nix b/nixpkgs/pkgs/applications/file-managers/felix-fm/default.nix
index b6166f2586d4..6cbc47901562 100644
--- a/nixpkgs/pkgs/applications/file-managers/felix-fm/default.nix
+++ b/nixpkgs/pkgs/applications/file-managers/felix-fm/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "felix";
-  version = "2.10.2";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "kyoheiu";
     repo = "felix";
     rev = "v${version}";
-    hash = "sha256-vDQHOv6ejp2aOQY0s80mC7x5sG6wB1/98/taw7aYEnE=";
+    hash = "sha256-Q+D5A4KVhVuas7sGy0CqN95cvTLAw5LWet/BECjJUPg=";
   };
 
-  cargoHash = "sha256-xy/h2O7aTURt4t8sNRASLhMYtceQrZnOynwhfhaecDA=";
+  cargoHash = "sha256-RfBRm/YiTPxkAN8A+uAoN047DBHEVSL0isQfJgO1Bo0=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/nixpkgs/pkgs/applications/misc/clipcat/default.nix b/nixpkgs/pkgs/applications/misc/clipcat/default.nix
index be12af08f92b..7ba97bc7a9b4 100644
--- a/nixpkgs/pkgs/applications/misc/clipcat/default.nix
+++ b/nixpkgs/pkgs/applications/misc/clipcat/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "clipcat";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "xrelkd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-BpJI6IseQpAHrdZ+rbh9Ar8HhAVD6grdM2tpviKd51c=";
+    hash = "sha256-Q9uGufIfqRLk3YJjaEEyu29JP8vSwUCe4ch9tf6Vz9g=";
   };
 
-  cargoHash = "sha256-BcqrQ4oUZazTSVtaAPgNKmLxhBbxR+sfpFFD1WiYP40=";
+  cargoHash = "sha256-9TPj4W+BSpHlOWkbiV7jNgjiYJjjw9j2c3o8vesrJeI=";
 
   nativeBuildInputs = [
     protobuf
diff --git a/nixpkgs/pkgs/applications/misc/gpu-burn/default.nix b/nixpkgs/pkgs/applications/misc/gpu-burn/default.nix
index ad11b734762e..4d6abb585c30 100644
--- a/nixpkgs/pkgs/applications/misc/gpu-burn/default.nix
+++ b/nixpkgs/pkgs/applications/misc/gpu-burn/default.nix
@@ -1,20 +1,20 @@
 { lib, stdenv, fetchFromGitHub, addOpenGLRunpath, cudatoolkit }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "gpu-burn";
-  version = "unstable-2021-04-29";
+  version = "unstable-2023-11-10";
 
   src = fetchFromGitHub {
     owner = "wilicc";
     repo = "gpu-burn";
-    rev = "1e9a84f4bec3b0835c00daace45d79ed6c488edb";
-    sha256 = "sha256-x+kta81Z08PsBgbf+fzRTXhNXUPBd5w8bST/T5nNiQA=";
+    rev = "b99aedce3e020d2ca419832ee27b7f29dfa6373e";
+    sha256 = "sha256-cLO0GXvujZ+g64j+OY31n43MsVER3ljo8Qrt+EzSKjc=";
   };
 
   postPatch = ''
     substituteInPlace gpu_burn-drv.cpp \
-      --replace "const char *kernelFile = \"compare.ptx\";" \
-                "const char *kernelFile = \"$out/share/compare.ptx\";"
+      --replace "#define COMPARE_KERNEL \"compare.ptx\"" \
+                "#define COMPARE_KERNEL \"$out/share/compare.ptx\""
   '';
 
   buildInputs = [ cudatoolkit ];
diff --git a/nixpkgs/pkgs/applications/misc/mission-center/Cargo.lock b/nixpkgs/pkgs/applications/misc/mission-center/Cargo.lock
index 0de461f2eb23..93df955ddf1d 100644
--- a/nixpkgs/pkgs/applications/misc/mission-center/Cargo.lock
+++ b/nixpkgs/pkgs/applications/misc/mission-center/Cargo.lock
@@ -897,12 +897,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
-name = "hermit-abi"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
-
-[[package]]
 name = "image"
 version = "0.23.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1130,7 +1124,7 @@ dependencies = [
 
 [[package]]
 name = "missioncenter"
-version = "0.4.1"
+version = "0.4.3"
 dependencies = [
  "arrayvec 0.7.4",
  "dbus",
@@ -1144,7 +1138,6 @@ dependencies = [
  "libadwaita",
  "libc",
  "libudev-sys",
- "num_cpus",
  "pathfinder_canvas",
  "pathfinder_color",
  "pathfinder_content",
@@ -1228,16 +1221,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "num_cpus"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
-dependencies = [
- "hermit-abi",
- "libc",
-]
-
-[[package]]
 name = "objc"
 version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/nixpkgs/pkgs/applications/misc/mission-center/default.nix b/nixpkgs/pkgs/applications/misc/mission-center/default.nix
index 5994cc151b07..cc8cae481129 100644
--- a/nixpkgs/pkgs/applications/misc/mission-center/default.nix
+++ b/nixpkgs/pkgs/applications/misc/mission-center/default.nix
@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mission-center";
-  version = "0.4.1";
+  version = "0.4.3";
 
   src = fetchFromGitLab {
     owner = "mission-center-devs";
     repo = "mission-center";
     rev = "v${version}";
-    hash = "sha256-RENB5rD+DZrmE6awWRT9PGed2bJFDEAEqHh1tBjqWrY=";
+    hash = "sha256-Yc3oiiD0ernuewq32hk3pDn1vQJNZFgMPPb4lArKP9w=";
   };
 
   cargoDeps = symlinkJoin {
diff --git a/nixpkgs/pkgs/applications/misc/mission-center/gatherer-Cargo.lock b/nixpkgs/pkgs/applications/misc/mission-center/gatherer-Cargo.lock
index 41f888017e3e..99951e03a337 100644
--- a/nixpkgs/pkgs/applications/misc/mission-center/gatherer-Cargo.lock
+++ b/nixpkgs/pkgs/applications/misc/mission-center/gatherer-Cargo.lock
@@ -320,7 +320,7 @@ dependencies = [
 
 [[package]]
 name = "gatherer"
-version = "0.4.1"
+version = "0.4.3"
 dependencies = [
  "arrayvec",
  "ash",
@@ -334,7 +334,6 @@ dependencies = [
  "gbm",
  "lazy_static",
  "libc 0.2.150",
- "num_cpus",
  "pkg-config",
  "rust-ini",
  "serde",
@@ -394,12 +393,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
 
 [[package]]
-name = "hermit-abi"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
-
-[[package]]
 name = "hex"
 version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -513,16 +506,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "num_cpus"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
-dependencies = [
- "hermit-abi",
- "libc 0.2.150",
-]
-
-[[package]]
 name = "once_cell"
 version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/nixpkgs/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix b/nixpkgs/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
index 84f0e5188466..cfaac49f25b5 100644
--- a/nixpkgs/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
+++ b/nixpkgs/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "cloudfoundry-cli";
-  version = "8.7.5";
+  version = "8.7.6";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-saGtll+feAZ3eQGMHN4XcI+eSkfniTfsEHNN+tABmR4=";
+    sha256 = "sha256-QvQqFl8RcVO+oNKhAeKkX0bmjv8qrtiR2gQ5ufpfMBo=";
   };
-  vendorHash = "sha256-OjgZHN/57CmWmpOXqRFVf+duVCy26hg4lbSkDHgsV44=";
+  vendorHash = "sha256-MBV8GIxgAHFEturqlQgBuzGUQcRdMsYU7c1kcTlZf9I=";
 
   subPackages = [ "." ];
 
diff --git a/nixpkgs/pkgs/applications/networking/cluster/glooctl/default.nix b/nixpkgs/pkgs/applications/networking/cluster/glooctl/default.nix
index ce52fdb6a355..e28e9ab49300 100644
--- a/nixpkgs/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/nixpkgs/pkgs/applications/networking/cluster/glooctl/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.15.16";
+  version = "1.15.17";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-GsT9ffQdLDxckKyf9U0sWZBf388o6ee9clrUuLJT/bA=";
+    hash = "sha256-tTsiDlpjQ86CAMzyZhRKPYrEqFm8sCPoeCRzTrmfyx4=";
   };
 
   vendorHash = "sha256-/JliAQtUd8fbKThqkwC4u4XNawXhoZaV1XdJRciJxmw=";
diff --git a/nixpkgs/pkgs/applications/networking/cluster/nomad/default.nix b/nixpkgs/pkgs/applications/networking/cluster/nomad/default.nix
index d80e703988bb..be82663079d1 100644
--- a/nixpkgs/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/nixpkgs/pkgs/applications/networking/cluster/nomad/default.nix
@@ -52,7 +52,7 @@ rec {
   # Upstream partially documents used Go versions here
   # https://github.com/hashicorp/nomad/blob/master/contributing/golang.md
 
-  nomad = nomad_1_5;
+  nomad = nomad_1_6;
 
   nomad_1_4 = generic {
     buildGoModule = buildGo120Module;
@@ -63,10 +63,10 @@ rec {
   };
 
   nomad_1_5 = generic {
-    buildGoModule = buildGo120Module;
-    version = "1.5.8";
-    sha256 = "sha256-5VAUNunQz4s1Icd+s5i8Kx6u1P0By+ikl4C5wXM1oho=";
-    vendorHash = "sha256-y3WiQuoQn6SdwTgtPWuB6EBtsJC+YleQPzownZQNkno=";
+    buildGoModule = buildGo121Module;
+    version = "1.5.12";
+    sha256 = "sha256-BhKetWtwysWTYI0ruEp/Ixh4eoGxDX0Geup2PCXfsZY=";
+    vendorHash = "sha256-X4pBxKWr5QFRxh9tw5QDpytyuVNXQvV1LHm5IbPELY0=";
     passthru.tests.nomad = nixosTests.nomad;
     preCheck = ''
       export PATH="$PATH:$NIX_BUILD_TOP/go/bin"
@@ -75,9 +75,9 @@ rec {
 
   nomad_1_6 = generic {
     buildGoModule = buildGo121Module;
-    version = "1.6.4";
-    sha256 = "sha256-tlbuxKCm7he1Tij4BYKGvv7a6LKiyWgs2PvbcWg/7A0=";
-    vendorHash = "sha256-PrQit4egSq/pkILb6M7A3gsiQvLPABhyLXWgv8GFz/Y=";
+    version = "1.6.5";
+    sha256 = "sha256-10s/yRWGoYTRbMytWShuTgYc1b388IID5doAvWXpyCU=";
+    vendorHash = "sha256-gd6a/CBJ+OOTNHEaRLoDky2f2cDCyW9wSZzD6K22voQ=";
     passthru.tests.nomad = nixosTests.nomad;
     preCheck = ''
       export PATH="$PATH:$NIX_BUILD_TOP/go/bin"
@@ -86,9 +86,9 @@ rec {
 
   nomad_1_7 = generic {
     buildGoModule = buildGo121Module;
-    version = "1.7.1";
-    sha256 = "sha256-dlKlpgQRug/72UmIogOkKNGBT3sPjgGVVuvzHZ4vh3c=";
-    vendorHash = "sha256-MZmhFdZZBkKZDgON1ewVm9Z9jZ1EULp/yMT9q6fCqIw=";
+    version = "1.7.2";
+    sha256 = "sha256-tFmsX9C++nuUBqLjjpMMyVCwQHn4nlB3OywIPMYE32Q=";
+    vendorHash = "sha256-iMEEBDxK7ALa19GMIabofzq557aXcYpt0H3/jAKnBBM=";
     passthru.tests.nomad = nixosTests.nomad;
     preCheck = ''
       export PATH="$PATH:$NIX_BUILD_TOP/go/bin"
diff --git a/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix b/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
index 68c5552b251c..15db7d09ac42 100644
--- a/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
+++ b/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
@@ -159,8 +159,7 @@ in stdenv.mkDerivation rec {
   preFixup = ''
     gappsWrapperArgs+=(
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc pipewire ] }"
-      # Currently crashes see https://github.com/NixOS/nixpkgs/issues/222043
-      #--add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
       --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
     )
 
diff --git a/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix b/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
index bfae729772f4..58b119605d58 100644
--- a/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix {} rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "6.40.0";
+  version = "6.42.0";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-vyXHlycPSyEyv938IKzGM6pdERHHerx2CLY/U+WMrH4=";
+  hash = "sha256-uGsVv/J8eMjPOdUs+8GcYopy9D2g3SUhS09banrA6hY=";
 }
diff --git a/nixpkgs/pkgs/applications/networking/instant-messengers/slack/default.nix b/nixpkgs/pkgs/applications/networking/instant-messengers/slack/default.nix
index 2e1cae4fb2a3..05417bd8d6c5 100644
--- a/nixpkgs/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/nixpkgs/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -45,14 +45,14 @@ let
 
   pname = "slack";
 
-  x86_64-darwin-version = "4.35.126";
-  x86_64-darwin-sha256 = "1fmcvj4ryf9k82hbrkb4fl7iki6v80msgrwsc7l996wzkg5j771n";
+  x86_64-darwin-version = "4.36.134";
+  x86_64-darwin-sha256 = "13s7vcbi180y221qh5dpvp9s94511lqwih3k52k61p98xjarrcwv";
 
-  x86_64-linux-version = "4.35.126";
-  x86_64-linux-sha256 = "0axwmhr8r8q3ih91zxwj3z64fnjy7w4mzmlyxcp2iws5gd541lcm";
+  x86_64-linux-version = "4.35.131";
+  x86_64-linux-sha256 = "0mb33vvb36aavn52yvk5fiyc8f7z56cqm1siknaap707iqqfpwpb";
 
-  aarch64-darwin-version = "4.35.126";
-  aarch64-darwin-sha256 = "0g477a31sdyxmg66aklpw359k1kk7vrd96vgcy5lxsvwvihiinkz";
+  aarch64-darwin-version = "4.36.134";
+  aarch64-darwin-sha256 = "0yyqmyicf4rkpvp6al2kb7g188xhg3m8hyi24a23yhnil8hk2r3v";
 
   version = {
     x86_64-darwin = x86_64-darwin-version;
diff --git a/nixpkgs/pkgs/applications/radio/flex-ncat/default.nix b/nixpkgs/pkgs/applications/radio/flex-ncat/default.nix
index 5425c6b73ac8..96912b95d183 100644
--- a/nixpkgs/pkgs/applications/radio/flex-ncat/default.nix
+++ b/nixpkgs/pkgs/applications/radio/flex-ncat/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flex-ncat";
-  version = "0.2-20230126.0";
+  version = "0.4-20231210.1";
 
   src = fetchFromGitHub {
     owner = "kc2g-flex-tools";
     repo = "nCAT";
     rev = "v${version}";
-    hash = "sha256-2taQQVTgAFyqtS06zZ+4Qmr/JIqU6mxNQYvxt+L/Mtc=";
+    hash = "sha256-oC7TPq+Xsl960B7qJP81cWF+GGc28Miv4L8+1vWo7jA=";
   };
 
-  vendorHash = "sha256-Tv6sbfWNOHYwA7v1SpNeM9aHs+3DSFv4V4qxllxrzJc=";
+  vendorHash = "sha256-1i9v8Ej7TMIO+aMYFPFxdfD4b5j84/zkegaYb67WokU=";
 
   meta = with lib; {
     homepage = "https://github.com/kc2g-flex-tools/nCAT";
diff --git a/nixpkgs/pkgs/applications/radio/gridtracker/default.nix b/nixpkgs/pkgs/applications/radio/gridtracker/default.nix
index d3a6d104dc26..c961e1bd2d49 100644
--- a/nixpkgs/pkgs/applications/radio/gridtracker/default.nix
+++ b/nixpkgs/pkgs/applications/radio/gridtracker/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gridtracker";
-  version = "1.23.1202";
+  version = "1.23.1207";
 
   src = fetchFromGitLab {
     owner = "gridtracker.org";
     repo = "gridtracker";
     rev = "v${version}";
-    sha256 = "sha256-XrHA+h6qAYyZjp/C7+oS3eAvX0ptD+T4UKFzM2ROBCw=";
+    sha256 = "sha256-r7H+fds8FbSLDxPQqn0XUPC6loLgsaNX+DBqJJ96/d4=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];
diff --git a/nixpkgs/pkgs/applications/science/logic/cadical/default.nix b/nixpkgs/pkgs/applications/science/logic/cadical/default.nix
index ddad93b1e18a..85406dbaf38a 100644
--- a/nixpkgs/pkgs/applications/science/logic/cadical/default.nix
+++ b/nixpkgs/pkgs/applications/science/logic/cadical/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cadical";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "arminbiere";
     repo = "cadical";
     rev = "rel-${version}";
-    sha256 = "sha256-2cMaBo4u7uqrsp11dc9PHOI9ZBnir51BftPE4C6/U7Q=";
+    sha256 = "sha256-WQNaRkjJyWc3PDkK5uwLHEymlnpytVkbJqIVbc7HgZY=";
   };
 
   outputs = [ "out" "dev" "lib" ];
diff --git a/nixpkgs/pkgs/applications/science/misc/root/default.nix b/nixpkgs/pkgs/applications/science/misc/root/default.nix
index 24844eb621ec..9fe06f6d7969 100644
--- a/nixpkgs/pkgs/applications/science/misc/root/default.nix
+++ b/nixpkgs/pkgs/applications/science/misc/root/default.nix
@@ -113,7 +113,11 @@ stdenv.mkDerivation rec {
   ];
 
   preConfigure = ''
-    rm -rf builtins/*
+    for path in builtins/*; do
+      if [[ "$path" != "builtins/openui5" ]] && [[ "$path" != "builtins/rendercore" ]]; then
+        rm -rf "$path"
+      fi
+    done
     substituteInPlace cmake/modules/SearchInstalledSoftware.cmake \
       --replace 'set(lcgpackages ' '#set(lcgpackages '
 
@@ -147,7 +151,7 @@ stdenv.mkDerivation rec {
     "-Dbuiltin_freetype=OFF"
     "-Dbuiltin_gtest=OFF"
     "-Dbuiltin_nlohmannjson=OFF"
-    "-Dbuiltin_openui5=OFF"
+    "-Dbuiltin_openui5=ON"
     "-Dalien=OFF"
     "-Dbonjour=OFF"
     "-Dcastor=OFF"
@@ -176,12 +180,12 @@ stdenv.mkDerivation rec {
     "-Dpythia6=OFF"
     "-Dpythia8=OFF"
     "-Drfio=OFF"
-    "-Droot7=OFF"
+    "-Droot7=ON"
     "-Dsqlite=OFF"
     "-Dssl=ON"
     "-Dtmva=ON"
     "-Dvdt=OFF"
-    "-Dwebgui=OFF"
+    "-Dwebgui=ON"
     "-Dxml=ON"
     "-Dxrootd=ON"
   ]
diff --git a/nixpkgs/pkgs/applications/version-management/git-lfs/default.nix b/nixpkgs/pkgs/applications/version-management/git-lfs/default.nix
index 54ce30907323..6988e590cf72 100644
--- a/nixpkgs/pkgs/applications/version-management/git-lfs/default.nix
+++ b/nixpkgs/pkgs/applications/version-management/git-lfs/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "git-lfs";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "git-lfs";
     repo = "git-lfs";
     rev = "v${version}";
-    hash = "sha256-lZx+sJQttclZPET0jkv3dmpQysCpsYani+La7yfSUlI=";
+    hash = "sha256-XqxkNCC2yzUTVOi/1iDsnxtLkw4jfQuBh9UsjtZ1zVc=";
   };
 
   vendorHash = "sha256-VmPeQYWOHFqFLHKcKH3WHz50yx7GMHVIDPzqiVwwjSg=";
diff --git a/nixpkgs/pkgs/applications/version-management/git-machete/default.nix b/nixpkgs/pkgs/applications/version-management/git-machete/default.nix
index a1f45d65db35..776ec66d3a77 100644
--- a/nixpkgs/pkgs/applications/version-management/git-machete/default.nix
+++ b/nixpkgs/pkgs/applications/version-management/git-machete/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.20.0";
+  version = "3.22.0";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-6TntyAkDIcCVcAsNdAlgvKYO7Db0oMDWKW92rMRIDI4=";
+    hash = "sha256-2oEpBNMHj4qpkPp8rXEMsRRiRQeC30hQCQh7d8bOLUU=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/nixpkgs/pkgs/applications/version-management/git-mit/default.nix b/nixpkgs/pkgs/applications/version-management/git-mit/default.nix
index 68b3fc6cd467..6c24ef1d3242 100644
--- a/nixpkgs/pkgs/applications/version-management/git-mit/default.nix
+++ b/nixpkgs/pkgs/applications/version-management/git-mit/default.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "5.12.178";
+  version = "5.12.180";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-PyQhg3JJqfOVjT72kvfki4krLB3YRP9EHqbIptRI9nc=";
+    hash = "sha256-12ZMyKIar5ck4jr7PCmyrnGWd6iv9cCwvTGSLbOCl4o=";
   };
 
-  cargoHash = "sha256-/8zrqj3Nlm84eAYfMzpZJ9Bgv5Tjyucfv9YcXdGXXFQ=";
+  cargoHash = "sha256-n2wsOJrQvMKI1mNYGxntz8hZt5adL3obSdIo4DqF1Fs=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/nixpkgs/pkgs/applications/video/ani-cli/default.nix b/nixpkgs/pkgs/applications/video/ani-cli/default.nix
index 389d00dc1a41..375a930b0294 100644
--- a/nixpkgs/pkgs/applications/video/ani-cli/default.nix
+++ b/nixpkgs/pkgs/applications/video/ani-cli/default.nix
@@ -21,13 +21,13 @@ assert withMpv || withVlc || withIina;
 
 stdenvNoCC.mkDerivation rec {
   pname = "ani-cli";
-  version = "4.6";
+  version = "4.7";
 
   src = fetchFromGitHub {
     owner = "pystardust";
     repo = "ani-cli";
     rev = "v${version}";
-    hash = "sha256-ahyCD4QsYyb3xtNK03HITeF0+hJFIHZ+PAjisuS/Kdo=";
+    hash = "sha256-Ll4bHKrDZukoQX35iiMI6rMSgiTC6wp7fHUnOMPagOA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/nixpkgs/pkgs/applications/video/davinci-resolve/default.nix b/nixpkgs/pkgs/applications/video/davinci-resolve/default.nix
index 5b44ddc042a3..951d46d783b0 100644
--- a/nixpkgs/pkgs/applications/video/davinci-resolve/default.nix
+++ b/nixpkgs/pkgs/applications/video/davinci-resolve/default.nix
@@ -31,7 +31,7 @@ let
   davinci = (
     stdenv.mkDerivation rec {
       pname = "davinci-resolve${lib.optionalString studioVariant "-studio"}";
-      version = "18.6.3";
+      version = "18.6.4";
 
       nativeBuildInputs = [
         (appimage-run.override { buildFHSEnv = buildFHSEnvChroot; } )
@@ -52,8 +52,8 @@ let
           outputHashAlgo = "sha256";
           outputHash =
             if studioVariant
-            then "sha256-OX8PyMhfl0jRdXBNsjlwkCAh8XUNJv8HEbmyAdjIv18="
-            else "sha256-PNzdVxGgXIHM2vi3ChHx67TQBFlCYBOZCiFkDi/RSu4=";
+            then "sha256-Us8DsxdGwBxUL+yUHT9DNJFIV7EO+J9CSN2Juyf8VQ4="
+            else "sha256-yPdfmS42ID7MOTB3XlGXfOqp46kRLR8martJ9gWqDjA=";
 
           impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
diff --git a/nixpkgs/pkgs/applications/video/haruna/default.nix b/nixpkgs/pkgs/applications/video/haruna/default.nix
index dcfce40ee12b..7e6cef757cd8 100644
--- a/nixpkgs/pkgs/applications/video/haruna/default.nix
+++ b/nixpkgs/pkgs/applications/video/haruna/default.nix
@@ -26,13 +26,13 @@
 
 mkDerivation rec {
   pname = "haruna";
-  version = "0.12.2";
+  version = "0.12.3";
 
   src = fetchFromGitLab {
     owner = "multimedia";
     repo = "haruna";
     rev = "v${version}";
-    hash = "sha256-6UXgAb42DttNgmO5KRFC5M6kuYrv+GIxQ0EQ4P5cgUI=";
+    hash = "sha256-iYf8oTMQ65+6E1dlOj0GU6EezPul6p1GG2CcrcjDUik=";
     domain = "invent.kde.org";
   };
 
diff --git a/nixpkgs/pkgs/applications/virtualization/cloud-hypervisor/Cargo.lock b/nixpkgs/pkgs/applications/virtualization/cloud-hypervisor/Cargo.lock
index f40fbc0f4284..52afc0d15f83 100644
--- a/nixpkgs/pkgs/applications/virtualization/cloud-hypervisor/Cargo.lock
+++ b/nixpkgs/pkgs/applications/virtualization/cloud-hypervisor/Cargo.lock
@@ -36,16 +36,15 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.3.2"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ca84f3628370c59db74ee214b3263d58f9aadd9b4fe7e711fd87dc452b7f163"
+checksum = "2ab91ebe16eb252986481c5b62f6098f3b698a45e34b5b98200cf20dd2484a44"
 dependencies = [
  "anstyle",
  "anstyle-parse",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
- "is-terminal",
  "utf8parse",
 ]
 
@@ -75,9 +74,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle-wincon"
-version = "1.0.2"
+version = "3.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c677ab05e09154296dd37acecd46420c17b9713e8366facafa8fc0885167cf4c"
+checksum = "f0699d10d2f4d628a98ee7b57b289abbc98ff3bad977cb3152709d4bf2330628"
 dependencies = [
  "anstyle",
  "windows-sys 0.48.0",
@@ -147,15 +146,15 @@ dependencies = [
 
 [[package]]
 name = "async-executor"
-version = "1.5.1"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fa3dc5f2a8564f07759c008b9109dc0d39de92a88d5588b8a5036d286383afb"
+checksum = "17ae5ebefcc48e7452b4987947920dac9450be1110cadf34d1b8c116bdbaf97c"
 dependencies = [
- "async-lock",
+ "async-lock 3.2.0",
  "async-task",
  "concurrent-queue",
- "fastrand 1.9.0",
- "futures-lite",
+ "fastrand 2.0.0",
+ "futures-lite 2.1.0",
  "slab",
 ]
 
@@ -165,10 +164,10 @@ version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "279cf904654eeebfa37ac9bb1598880884924aab82e290aa65c9e77a0e142e06"
 dependencies = [
- "async-lock",
+ "async-lock 2.7.0",
  "autocfg",
  "blocking",
- "futures-lite",
+ "futures-lite 1.13.0",
 ]
 
 [[package]]
@@ -177,15 +176,15 @@ version = "1.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fc5b45d93ef0529756f812ca52e44c221b35341892d3dcc34132ac02f3dd2af"
 dependencies = [
- "async-lock",
+ "async-lock 2.7.0",
  "autocfg",
  "cfg-if",
  "concurrent-queue",
- "futures-lite",
+ "futures-lite 1.13.0",
  "log",
  "parking",
  "polling",
- "rustix 0.37.25",
+ "rustix 0.37.27",
  "slab",
  "socket2",
  "waker-fn",
@@ -201,27 +200,38 @@ dependencies = [
 ]
 
 [[package]]
+name = "async-lock"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7125e42787d53db9dd54261812ef17e937c95a51e4d291373b670342fa44310c"
+dependencies = [
+ "event-listener 4.0.0",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
 name = "async-process"
 version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bf012553ce51eb7aa6dc2143804cc8252bd1cb681a1c5cb7fa94ca88682dee1d"
 dependencies = [
  "async-io",
- "async-lock",
+ "async-lock 2.7.0",
  "async-signal",
  "blocking",
  "cfg-if",
  "event-listener 3.0.0",
- "futures-lite",
+ "futures-lite 1.13.0",
  "rustix 0.38.8",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "async-recursion"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e97ce7de6cf12de5d7226c73f5ba9811622f4db3a5b91b55c53e987e5f91cba"
+checksum = "5fd55a5ba1179988837d24ab4c7cc8ed6efdeff578ede0416b4225a5fca35bd0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -235,7 +245,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c99f3cb3f9ff89f7d718fbb942c9eb91bedff12e396adf09a622dfe7ffec2bc2"
 dependencies = [
  "async-io",
- "async-lock",
+ "async-lock 2.7.0",
  "atomic-waker",
  "cfg-if",
  "concurrent-queue",
@@ -249,9 +259,9 @@ dependencies = [
 
 [[package]]
 name = "async-task"
-version = "4.4.0"
+version = "4.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc7ab41815b3c653ccd2978ec3255c81349336702dfdf62ee6f7069b12a3aae"
+checksum = "b4eb2cdb97421e01129ccb49169d8279ed21e829929144f4a22a6e54ac549ca1"
 
 [[package]]
 name = "async-trait"
@@ -361,11 +371,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77231a1c8f801696fc0123ec6150ce92cffb8e164a02afb9c8ddee0e9b65ad65"
 dependencies = [
  "async-channel",
- "async-lock",
+ "async-lock 2.7.0",
  "async-task",
  "atomic-waker",
  "fastrand 1.9.0",
- "futures-lite",
+ "futures-lite 1.13.0",
  "log",
 ]
 
@@ -398,36 +408,35 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "clap"
-version = "4.3.11"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1640e5cc7fb47dbb8338fd471b105e7ed6c3cb2aeb00c2e067127ffd3764a05d"
+checksum = "ac495e00dcec98c83465d5ad66c5c4fabd652fd6686e7c6269b117e729a6f17b"
 dependencies = [
  "clap_builder",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.3.11"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98c59138d527eeaf9b53f35a77fcc1fad9d883116070c63d5de1c7dc7b00c72b"
+checksum = "c77ed9a32a62e6ca27175d00d29d05ca32e396ea1eb5fb01d8256b669cec7663"
 dependencies = [
  "anstream",
  "anstyle",
  "clap_lex",
- "once_cell",
  "strsim",
  "terminal_size",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2da6da31387c7e4ef160ffab6d5e7f00c42626fe39aea70a7b0f1773f7dd6c1b"
+checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
 
 [[package]]
 name = "cloud-hypervisor"
-version = "36.0.0"
+version = "37.0.0"
 dependencies = [
  "anyhow",
  "api_client",
@@ -464,9 +473,9 @@ checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
 
 [[package]]
 name = "concurrent-queue"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62ec6771ecfa0762d24683ee5a32ad78487a3d3afdc0fb8cae19d2c5deb50b7c"
+checksum = "f057a694a54f12365049b0958a1685bb52d567f5593b355fbf685838e873d400"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -719,6 +728,27 @@ dependencies = [
 ]
 
 [[package]]
+name = "event-listener"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "770d968249b5d99410d61f5bf89057f3199a077a04d087092f58e7d10692baae"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "958e4d70b6d5e81971bebec42271ec641e7ff4e170a6fa605f2b8a8b65cb97d3"
+dependencies = [
+ "event-listener 4.0.0",
+ "pin-project-lite",
+]
+
+[[package]]
 name = "event_monitor"
 version = "0.1.0"
 dependencies = [
@@ -796,9 +826,9 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bca583b7e26f571124fe5b7561d49cb2868d79116cfa0eefce955557c6fee8c"
+checksum = "eb1d22c66e66d9d72e1758f0bd7d4fd0bee04cad842ee34587d68c07e45d088c"
 
 [[package]]
 name = "futures-executor"
@@ -833,6 +863,19 @@ dependencies = [
 ]
 
 [[package]]
+name = "futures-lite"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aeee267a1883f7ebef3700f262d2d54de95dfaf38189015a74fdc4e0c7ad8143"
+dependencies = [
+ "fastrand 2.0.0",
+ "futures-core",
+ "futures-io",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
 name = "futures-macro"
 version = "0.3.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -851,9 +894,9 @@ checksum = "f43be4fe21a13b9781a69afa4985b0f6ee0e1afab2c6f454a8cf30e2b2237b6e"
 
 [[package]]
 name = "futures-task"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76d3d132be6c0e6aa1534069c705a74a5997a356c0dc2f86a47765e5617c5b65"
+checksum = "efd193069b0ddadc69c46389b740bbccdd97203899b48d09c5f7969591d6bae2"
 
 [[package]]
 name = "futures-util"
@@ -875,11 +918,11 @@ dependencies = [
 
 [[package]]
 name = "gdbstub"
-version = "0.6.6"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4e02bf1b1a624d96925c608f1b268d82a76cbc587ce9e59f7c755e9ea11c75c"
+checksum = "09a8b954f9d02b74fe8e89a1c77bd9a6b8206713ebf1b272bfad9573b4a86f88"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.4.1",
  "cfg-if",
  "log",
  "managed",
@@ -889,9 +932,9 @@ dependencies = [
 
 [[package]]
 name = "gdbstub_arch"
-version = "0.2.4"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eecb536c55c43593a00dde9074dbbdb0e81ce5f20dbca921400f8779c21dea9c"
+checksum = "4e3b1357bd3203fc09a6601327ae0ab38865d14231d0b65d3143f5762cc7977d"
 dependencies = [
  "gdbstub",
  "num-traits",
@@ -1024,9 +1067,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.0.2"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8adf3ddd720272c6ea8bf59463c04e0f93d0bbf7c5439b691bca2987e0270897"
+checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
 dependencies = [
  "equivalent",
  "hashbrown",
@@ -1054,9 +1097,9 @@ dependencies = [
 
 [[package]]
 name = "io-uring"
-version = "0.6.1"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "141a0f4546a50b2ed637c7a6df0d7dff45c9f41523254996764461c8ae0d9424"
+checksum = "460648e47a07a43110fbfa2e0b14afb2be920093c31e5dccc50e49568e099762"
 dependencies = [
  "bitflags 1.3.2",
  "libc",
@@ -1157,9 +1200,9 @@ dependencies = [
 
 [[package]]
 name = "linux-loader"
-version = "0.9.1"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1db6a725c8000971f83fa93ed7ee1b600e55a1471a2a653379d3c84f72effdcf"
+checksum = "132a531b85b3a164012ab682c72f8f2cce7757f187be5f60782fd2b4cda9cb34"
 dependencies = [
  "vm-memory",
 ]
@@ -1188,12 +1231,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.17"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
-dependencies = [
- "cfg-if",
-]
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
 [[package]]
 name = "managed"
@@ -1219,7 +1259,7 @@ dependencies = [
 [[package]]
 name = "micro_http"
 version = "0.1.0"
-source = "git+https://github.com/firecracker-microvm/micro-http?branch=main#0d0fdcd50ea10c1b4777f9a958873fc848a5b7bb"
+source = "git+https://github.com/firecracker-microvm/micro-http?branch=main#a4d632f2c5ea45712c0d2002dc909a63879e85c3"
 dependencies = [
  "libc",
  "vmm-sys-util",
@@ -1247,7 +1287,7 @@ dependencies = [
 [[package]]
 name = "mshv-bindings"
 version = "0.1.1"
-source = "git+https://github.com/rust-vmm/mshv?branch=main#af397ea8514303d3a19d21d33730e867f7415ba9"
+source = "git+https://github.com/rust-vmm/mshv?branch=main#0dd4d3452a7f2e95199f4b58380acc41458474de"
 dependencies = [
  "libc",
  "serde",
@@ -1259,7 +1299,7 @@ dependencies = [
 [[package]]
 name = "mshv-ioctls"
 version = "0.1.1"
-source = "git+https://github.com/rust-vmm/mshv?branch=main#af397ea8514303d3a19d21d33730e867f7415ba9"
+source = "git+https://github.com/rust-vmm/mshv?branch=main#0dd4d3452a7f2e95199f4b58380acc41458474de"
 dependencies = [
  "libc",
  "mshv-bindings",
@@ -1327,18 +1367,18 @@ checksum = "43794a0ace135be66a25d3ae77d41b91615fb68ae937f904090203e81f755b65"
 
 [[package]]
 name = "num-traits"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
 dependencies = [
  "autocfg",
 ]
 
 [[package]]
 name = "object"
-version = "0.30.3"
+version = "0.30.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea86265d3d3dcb6a27fc51bd29a4bf387fae9d2986b823079d4986af253eb439"
+checksum = "03b4680b86d9cfafba8fc491dc9b6df26b68cf40e9e6cd73909194759a63c385"
 dependencies = [
  "memchr",
 ]
@@ -1413,9 +1453,9 @@ dependencies = [
 
 [[package]]
 name = "parking"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e52c774a4c39359c1d1c52e43f73dd91a75a614652c825408eec30c95a9b2067"
+checksum = "bb813b8af86854136c6922af0598d719255ecb2179515e6e7730d468f05c9cae"
 
 [[package]]
 name = "parking_lot"
@@ -1509,18 +1549,18 @@ dependencies = [
 
 [[package]]
 name = "pin-project"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "030ad2bc4db10a8944cb0d837f158bdfec4d4a4873ab701a95046770d11f8842"
+checksum = "fda4ed1c6c173e3fc7a83629421152e01d7b1f9b7f65fb301e490e8cfc656422"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec2e072ecce94ec471b13398d5402c188e76ac03cf74dd1a975161b23a3f6d9c"
+checksum = "4359fd9c9171ec6e8c62926d6faaf553a8dc3f64e1507e76da7911b4f6a04405"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1670,9 +1710,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.67"
+version = "1.0.70"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d433d9f1a3e8c1263d9456598b16fec66f4acc9a74dacffd35c7bb09b3a1328"
+checksum = "39278fbbf5fb4f646ce651690877f89d1c5811a3d4acb27700c1cb3cdb78fd3b"
 dependencies = [
  "unicode-ident",
 ]
@@ -1823,9 +1863,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.37.25"
+version = "0.37.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4eb579851244c2c03e7c24f501c3432bed80b8f720af1d6e5b0e0f01555a035"
+checksum = "fea8ca367a3a01fe35e6943c400addf443c0f57670e6ec51196f71a4b8762dd2"
 dependencies = [
  "bitflags 1.3.2",
  "errno",
@@ -1908,9 +1948,9 @@ dependencies = [
 
 [[package]]
 name = "serde_repr"
-version = "0.1.12"
+version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcec881020c684085e55a25f7fd888954d56609ef363479dc5a1305eb0d40cab"
+checksum = "3081f5ffbb02284dda55132aa26daecedd7372a42417bbbab6f14ab7d6bb9145"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2087,11 +2127,11 @@ dependencies = [
 
 [[package]]
 name = "terminal_size"
-version = "0.2.6"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e6bf6f19e9f8ed8d4048dc22981458ebcf406d67e94cd422e5ecd73d63b3237"
+checksum = "21bebf2b7c9e0a515f6e0f8c51dc0f8e4696391e6f1ff30379559f8365fb0df7"
 dependencies = [
- "rustix 0.37.25",
+ "rustix 0.38.8",
  "windows-sys 0.48.0",
 ]
 
@@ -2138,9 +2178,9 @@ checksum = "3bf63baf9f5039dadc247375c29eb13706706cfde997d0330d05aa63a77d8820"
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.3"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cda73e2f1397b1262d6dfdcef8aafae14d1de7748d66822d3bfeeb6d03e5e4b"
+checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
 
 [[package]]
 name = "toml_edit"
@@ -2227,9 +2267,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.11"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "301abaae475aa91687eb82514b328ab47a211a533026cb25fc3e519b86adfc3c"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "utf8parse"
@@ -2288,7 +2328,7 @@ dependencies = [
 [[package]]
 name = "vfio-bindings"
 version = "0.4.0"
-source = "git+https://github.com/rust-vmm/vfio?branch=main#847b0aa504ac6367efe42ba7e96a2d050737d4f0"
+source = "git+https://github.com/rust-vmm/vfio?branch=main#59c604fa6e42080f0a47c124ba29454fe4cb7475"
 dependencies = [
  "vmm-sys-util",
 ]
@@ -2296,7 +2336,7 @@ dependencies = [
 [[package]]
 name = "vfio-ioctls"
 version = "0.2.0"
-source = "git+https://github.com/rust-vmm/vfio?branch=main#847b0aa504ac6367efe42ba7e96a2d050737d4f0"
+source = "git+https://github.com/rust-vmm/vfio?branch=main#59c604fa6e42080f0a47c124ba29454fe4cb7475"
 dependencies = [
  "byteorder",
  "kvm-bindings",
@@ -2314,7 +2354,7 @@ dependencies = [
 [[package]]
 name = "vfio_user"
 version = "0.1.0"
-source = "git+https://github.com/rust-vmm/vfio-user?branch=main#2d96b90a7279547356ad8f83aaa3115ad5497302"
+source = "git+https://github.com/rust-vmm/vfio-user?branch=main#6c72e997e61d9e84b8ee691ad63ece6c717cf5aa"
 dependencies = [
  "bitflags 1.3.2",
  "libc",
@@ -2330,11 +2370,11 @@ dependencies = [
 
 [[package]]
 name = "vhost"
-version = "0.8.1"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61957aeb36daf0b00b87fff9c10dd28a161bd35ab157553d340d183b3d8756e6"
+checksum = "289adfce099c71f8310f895932ccd978f352ca494ea47496dbe20d4241888b82"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.4.1",
  "libc",
  "vm-memory",
  "vmm-sys-util",
@@ -2342,9 +2382,9 @@ dependencies = [
 
 [[package]]
 name = "vhost-user-backend"
-version = "0.10.1"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab069cdedaf18a0673766eb0a07a0f4ee3ed1b8e17fbfe4aafe5b988e2de1d01"
+checksum = "61255322e3ebe93fb77d9f6d99577eca7089bbea4174076c5353a8024a463061"
 dependencies = [
  "libc",
  "log",
@@ -2394,9 +2434,9 @@ dependencies = [
 
 [[package]]
 name = "virtio-bindings"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c18d7b74098a946470ea265b5bacbbf877abc3373021388454de0d47735a5b98"
+checksum = "878bcb1b2812a10c30d53b0ed054999de3d98f25ece91fc173973f9c57aaae86"
 
 [[package]]
 name = "virtio-devices"
@@ -2434,9 +2474,9 @@ dependencies = [
 
 [[package]]
 name = "virtio-queue"
-version = "0.9.0"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35aca00da06841bd99162c381ec65893cace23ca0fb89254302cfe4bec4c300f"
+checksum = "73a01db2cfb6c4b9bc20608b1336263d16714ea8db05de9fec2a254e076f9385"
 dependencies = [
  "log",
  "virtio-bindings",
@@ -2473,9 +2513,9 @@ source = "git+https://github.com/rust-vmm/vm-fdt?branch=main#77212bd0d62913e445c
 
 [[package]]
 name = "vm-memory"
-version = "0.12.2"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dc276f0d00c17b9aeb584da0f1e1c673df0d183cc2539e3636ec8cbc5eae99b"
+checksum = "5376c9ee5ebe2103a310d8241936cfb93c946734b0479a4fa5bdf7a64abbacd8"
 dependencies = [
  "arc-swap",
  "libc",
@@ -2525,15 +2565,20 @@ dependencies = [
  "futures",
  "gdbstub",
  "gdbstub_arch",
+ "hex",
  "hypervisor",
+ "igvm",
+ "igvm_defs",
  "libc",
  "linux-loader",
  "log",
  "micro_http",
+ "mshv-bindings",
  "net_util",
  "once_cell",
  "option_parser",
  "pci",
+ "range_map_vec",
  "seccompiler",
  "serde",
  "serde_json",
@@ -2837,7 +2882,7 @@ dependencies = [
  "async-executor",
  "async-fs",
  "async-io",
- "async-lock",
+ "async-lock 2.7.0",
  "async-process",
  "async-recursion",
  "async-task",
diff --git a/nixpkgs/pkgs/applications/virtualization/cloud-hypervisor/default.nix b/nixpkgs/pkgs/applications/virtualization/cloud-hypervisor/default.nix
index b1ca5fa1f2a5..8c0d6e9e1c1b 100644
--- a/nixpkgs/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/nixpkgs/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cloud-hypervisor";
-  version = "36.0";
+  version = "37.0";
 
   src = fetchFromGitHub {
     owner = "cloud-hypervisor";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-SgzohTW0tDn/O65rujZh7hsbvTeu4nQ0HvvXu9f92Vc=";
+    hash = "sha256-zNk3KkKl0bEZUdsWe+9FEMKVepZeQWGasDIn68NEVyw=";
   };
 
   cargoLock = {
@@ -18,11 +18,11 @@ rustPlatform.buildRustPackage rec {
       "igvm-0.1.0" = "sha256-l+Qyhdy3b8h8hPLHg5M0os8aSkjM55hAP5nqi0AGmjo=";
       "kvm-bindings-0.6.0" = "sha256-wGdAuPwsgRIqx9dh0m+hC9A/Akz9qg9BM+p06Fi5ACM=";
       "kvm-ioctls-0.13.0" = "sha256-jHnFGwBWnAa2lRu4a5eRNy1Y26NX5MV8alJ86VR++QE=";
-      "micro_http-0.1.0" = "sha256-wX35VsrO1vxQcGbOrP+yZm9vG0gcTZLe7gH7xuAa12w=";
-      "mshv-bindings-0.1.1" = "sha256-vyNaKp89THzZ/UpfocEwaCUzCuQnBMyv/icuZEghZEQ=";
+      "micro_http-0.1.0" = "sha256-Ov75Gs+wSmsxOHJu024nWtOJp0cKpS8bkxJJGW6jiKw=";
+      "mshv-bindings-0.1.1" = "sha256-4ADpLvi9hmHsMyGtqDQ2Msa3aMZmJsi4BPW7B5ZfAMw=";
       "versionize_derive-0.1.4" = "sha256-oGuREJ5+FDs8ihmv99WmjIPpL2oPdOr4REk6+7cV/7o=";
-      "vfio-bindings-0.4.0" = "sha256-hGhfOE9q9sf/tzPuaAHOca+JKCutcm1Myu1Tt9spaIQ=";
-      "vfio_user-0.1.0" = "sha256-fAqvy3YTDKXQqtJR+R2nBCWIYe89zTwtbgvJfPLqs1Q=";
+      "vfio-bindings-0.4.0" = "sha256-grOV+7W1tB4YDRAFbDNQp5nQ1WaivH+N+qHTIj4WA+E=";
+      "vfio_user-0.1.0" = "sha256-Vi6dBu1mUwyWh7ryKDOBS6GeUD2sqqIrt/bth/LDW6s=";
       "vm-fdt-0.2.0" = "sha256-lKW4ZUraHomSDyxgNlD5qTaBTZqM0Fwhhh/08yhrjyE=";
     };
   };
diff --git a/nixpkgs/pkgs/applications/virtualization/conmon/default.nix b/nixpkgs/pkgs/applications/virtualization/conmon/default.nix
index f929bac673c2..c0d8bf884a20 100644
--- a/nixpkgs/pkgs/applications/virtualization/conmon/default.nix
+++ b/nixpkgs/pkgs/applications/virtualization/conmon/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "conmon";
-  version = "2.1.8";
+  version = "2.1.9";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-gdMNAU+w4u+9DZL9x96OAZihShkQdvSiqPCA+eNf600=";
+    hash = "sha256-GDbCjR3UWDo/AEKO3TZq29fxO9EUfymxWtvLBikJJ04=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/nixpkgs/pkgs/applications/virtualization/ddev/default.nix b/nixpkgs/pkgs/applications/virtualization/ddev/default.nix
index 5ea3aa54b2ef..3709b8dbd901 100644
--- a/nixpkgs/pkgs/applications/virtualization/ddev/default.nix
+++ b/nixpkgs/pkgs/applications/virtualization/ddev/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ddev";
-  version = "1.22.5";
+  version = "1.22.6";
 
   src = fetchFromGitHub {
     owner = "ddev";
     repo = "ddev";
     rev = "v${version}";
-    hash = "sha256-s4uRS/BIRjVVN3u+ocy2RcwSnvJLtWpkvxtvgumuWtk=";
+    hash = "sha256-i+uubmCQwJALt7YRuANpEN2AAn9i6880MaXkayIZ82g=";
   };
 
   vendorHash = null;
diff --git a/nixpkgs/pkgs/build-support/build-fhsenv-bubblewrap/default.nix b/nixpkgs/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
index b6b5f13bba97..7d0138a4d85a 100644
--- a/nixpkgs/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+++ b/nixpkgs/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
@@ -149,6 +149,13 @@ let
       done
     fi
 
+    # propagate /etc from the actual host if nested
+    if [[ -e /.host-etc ]]; then
+      ro_mounts+=(--ro-bind /.host-etc /.host-etc)
+    else
+      ro_mounts+=(--ro-bind /etc /.host-etc)
+    fi
+
     for i in ${lib.escapeShellArgs etcBindEntries}; do
       if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
         continue
@@ -193,7 +200,6 @@ let
       ${lib.optionalString unshareCgroup "--unshare-cgroup"}
       ${lib.optionalString dieWithParent "--die-with-parent"}
       --ro-bind /nix /nix
-      --ro-bind /etc /.host-etc
       ${lib.optionalString privateTmp "--tmpfs /tmp"}
       # Our glibc will look for the cache in its own path in `/nix/store`.
       # As such, we need a cache to exist there, because pressure-vessel
diff --git a/nixpkgs/pkgs/by-name/ad/ad-miner/package.nix b/nixpkgs/pkgs/by-name/ad/ad-miner/package.nix
new file mode 100644
index 000000000000..d8134263c5f7
--- /dev/null
+++ b/nixpkgs/pkgs/by-name/ad/ad-miner/package.nix
@@ -0,0 +1,44 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "ad-miner";
+  version = "0.6.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Mazars-Tech";
+    repo = "AD_Miner";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Iwg00vAnCs9FbEAmB54vNDLmxyZeCtZMl/VEFoYeEcM=";
+  };
+
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    neo4j
+    numpy
+    pytz
+    tqdm
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "ad_miner"
+  ];
+
+  meta = with lib; {
+    description = "Active Directory audit tool that leverages cypher queries to crunch data from Bloodhound";
+    homepage = "https://github.com/Mazars-Tech/AD_Miner";
+    changelog = "https://github.com/Mazars-Tech/AD_Miner/blob/${version}/CHANGELOG.md";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "AD-miner";
+  };
+}
diff --git a/nixpkgs/pkgs/by-name/ca/cargo-xwin/package.nix b/nixpkgs/pkgs/by-name/ca/cargo-xwin/package.nix
index 0b759f520975..6052d780ced3 100644
--- a/nixpkgs/pkgs/by-name/ca/cargo-xwin/package.nix
+++ b/nixpkgs/pkgs/by-name/ca/cargo-xwin/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-xwin";
-  version = "0.14.9";
+  version = "0.16.2";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-xwin";
     rev = "v${version}";
-    hash = "sha256-y2hlzewDWYxkKhr77JB3lkYo5hexcdmPiCRbXLtnolM=";
+    hash = "sha256-EZM1TeWUnoRcsF6m6mDNCoUR2WWe7ohqT3wNWnq0kQY=";
   };
 
-  cargoHash = "sha256-uIFjWgoNCU5kUX4i1Law/YE0TmFLOi6V3Y4b9BpQlI4=";
+  cargoHash = "sha256-MEBMXP7a/w2aN6RuWrm16PsnIPw6+8k5jI2yRnwBy0s=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
diff --git a/nixpkgs/pkgs/by-name/co/codeium/package.nix b/nixpkgs/pkgs/by-name/co/codeium/package.nix
index 5891372364d9..866e32cd0311 100644
--- a/nixpkgs/pkgs/by-name/co/codeium/package.nix
+++ b/nixpkgs/pkgs/by-name/co/codeium/package.nix
@@ -13,10 +13,10 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-/6ss/VRH4ehEgC0DCMoGHxnJzD7zNJXWZ0ZAE5odyig=";
-    aarch64-linux = "sha256-vIAy/2FNIZINyfYedvAsvmXntcvzeCilDsoLtTDDE8c=";
-    x86_64-darwin = "sha256-1nqAaU6zQ4cMmYBDffNpeO6cPQqwx4efZGSPX6fRRZA=";
-    aarch64-darwin = "sha256-TjPOr7+GbEyE8s3XZNczkjAzlEhz9Gd47nhU6rQiga4=";
+    x86_64-linux = "sha256-rgA0n0XxYmP9mjjz8lQGL4dbqpXj9CNx3d8qT7e9Ye4=";
+    aarch64-linux = "sha256-pX+CPvJbhrrAxmZhy/aBeNFq9ShgYDQXbBNa6lbPnSo=";
+    x86_64-darwin = "sha256-vQj7tZghYZOcDpGT4DmFIrwiY8hguTtyo83M2BaUOkw=";
+    aarch64-darwin = "sha256-qd6newnk/9nRMM/7aaVO+CkTP74mMwAPKu658c6KZyY=";
   }.${system} or throwSystem;
 
   bin = "$out/bin/codeium_language_server";
@@ -24,7 +24,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "codeium";
-  version = "1.4.26";
+  version = "1.6.10";
   src = fetchurl {
     name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
     url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";
diff --git a/nixpkgs/pkgs/by-name/de/dep-scan/package.nix b/nixpkgs/pkgs/by-name/de/dep-scan/package.nix
new file mode 100644
index 000000000000..48ba5c4c51ae
--- /dev/null
+++ b/nixpkgs/pkgs/by-name/de/dep-scan/package.nix
@@ -0,0 +1,66 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "dep-scan";
+  version = "5.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "owasp-dep-scan";
+    repo = "dep-scan";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qiJyGBGxznNF4LNG9fbmjG7wX0odhrUO2LxOWABtLQA=";
+  };
+
+  postPatch = ''
+    substituteInPlace pytest.ini \
+      --replace " --cov-append --cov-report term --cov depscan" ""
+  '';
+
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    appthreat-vulnerability-db
+    defusedxml
+    jinja2
+    oras
+    pdfkit
+    pygithub
+    pyyaml
+    quart
+    rich
+    toml
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [
+    httpretty
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "depscan"
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  disabledTests = [
+    # Test is not present
+    "test_query_metadata2"
+  ];
+
+  meta = with lib; {
+    description = "Security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies";
+    homepage = "https://github.com/owasp-dep-scan/dep-scan";
+    changelog = "https://github.com/owasp-dep-scan/dep-scan/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "dep-scan";
+  };
+}
diff --git a/nixpkgs/pkgs/by-name/fl/flarectl/package.nix b/nixpkgs/pkgs/by-name/fl/flarectl/package.nix
index c59976c694c3..8e6dcb2953ef 100644
--- a/nixpkgs/pkgs/by-name/fl/flarectl/package.nix
+++ b/nixpkgs/pkgs/by-name/fl/flarectl/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "flarectl";
-  version = "0.82.0";
+  version = "0.83.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflare-go";
     rev = "v${version}";
-    hash = "sha256-GWxtbPCo0t0HXCiLJEVtuJPiY8Ahlij8zaMwe67zjqU=";
+    hash = "sha256-TPUHSoot+Hsq71KcNXuJn5sHRuDn3J1FB3r/29Ce9/c=";
   };
 
-  vendorHash = "sha256-VGePv/RzX1t5+Ftp3iTKYxm3mN6rr+Kdav4jRIKim9E=";
+  vendorHash = "sha256-XziR/ZB0kva/sl2Tj+m0pdK5HxLW6osBXD00+m/y0cQ=";
 
   subPackages = [ "cmd/flarectl" ];
 
diff --git a/nixpkgs/pkgs/development/tools/hjson-go/default.nix b/nixpkgs/pkgs/by-name/hj/hjson-go/package.nix
index 00af9d409f81..0e625e2985b6 100644
--- a/nixpkgs/pkgs/development/tools/hjson-go/default.nix
+++ b/nixpkgs/pkgs/by-name/hj/hjson-go/package.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "hjson-go";
-  version = "4.3.1";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "hjson";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ox6/PY7Nx282bUekLoXezWfKDiDzCBUZMa5/nu2qG40=";
+    hash = "sha256-fonPxk/9ue8LzHTdKpuHJcucQoMl4P6gq+tbjS8Ui7Q=";
   };
 
   vendorHash = null;
diff --git a/nixpkgs/pkgs/applications/networking/kubo/default.nix b/nixpkgs/pkgs/by-name/ku/kubo/package.nix
index 117fbc850d06..ae20f84e8170 100644
--- a/nixpkgs/pkgs/applications/networking/kubo/default.nix
+++ b/nixpkgs/pkgs/by-name/ku/kubo/package.nix
@@ -7,7 +7,7 @@
 
 buildGoModule rec {
   pname = "kubo";
-  version = "0.24.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.25.0"; # When updating, also check if the repo version changed and adjust repoVersion below
   rev = "v${version}";
 
   passthru.repoVersion = "15"; # Also update kubo-migrator when changing the repo version
@@ -15,7 +15,7 @@ buildGoModule rec {
   # Kubo makes changes to its source tarball that don't match the git source.
   src = fetchurl {
     url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-stSjLvg8G1EiXon3Qby4wLgbhX7Aaj9pnxcvE32/42k=";
+    hash = "sha256-+Mk3rDdtjhETmdaOOSXEFdLTJ0nX9G3qUxctsu5vrSc=";
   };
 
   # tarball contains multiple files/directories
diff --git a/nixpkgs/pkgs/applications/networking/kubo/test-repoVersion.nix b/nixpkgs/pkgs/by-name/ku/kubo/test-repoVersion.nix
index 25fd8fcfbf43..25fd8fcfbf43 100644
--- a/nixpkgs/pkgs/applications/networking/kubo/test-repoVersion.nix
+++ b/nixpkgs/pkgs/by-name/ku/kubo/test-repoVersion.nix
diff --git a/nixpkgs/pkgs/by-name/op/openai-triton-llvm/package.nix b/nixpkgs/pkgs/by-name/op/openai-triton-llvm/package.nix
index 5744cfa10c11..7b6f40662a75 100644
--- a/nixpkgs/pkgs/by-name/op/openai-triton-llvm/package.nix
+++ b/nixpkgs/pkgs/by-name/op/openai-triton-llvm/package.nix
@@ -45,7 +45,7 @@ let
   isNative = stdenv.hostPlatform == stdenv.buildPlatform;
 in stdenv.mkDerivation (finalAttrs: {
   pname = "openai-triton-llvm";
-  version = "14.0.6-f28c006a5895";
+  version = "17.0.0-c5dede880d17";
 
   outputs = [
     "out"
@@ -60,8 +60,8 @@ in stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "llvm-project";
-    rev = "f28c006a5895fc0e329fe15fead81e37457cb1d1";
-    hash = "sha256-vffu4HilvYwtzwgq+NlS26m65DGbp6OSSne2aje1yJE=";
+    rev = "c5dede880d175f7229c9b2923f4753e12702305d";
+    hash = "sha256-v4r3+7XVFK+Dzxt/rErZNJ9REqFO3JmGN4X4vZ+77ew=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/by-name/tr/treecat/package.nix b/nixpkgs/pkgs/by-name/tr/treecat/package.nix
new file mode 100644
index 000000000000..df184b9d1062
--- /dev/null
+++ b/nixpkgs/pkgs/by-name/tr/treecat/package.nix
@@ -0,0 +1,47 @@
+{ stdenv
+, fetchFromSourcehut
+, hare
+, haredo
+, lib
+, scdoc
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "treecat";
+  version = "1.0.2-unstable-2023-11-28";
+
+  outputs = [ "out" "man" ];
+
+  src = fetchFromSourcehut {
+    owner = "~autumnull";
+    repo = "treecat";
+    rev = "d277aed99eb48eef891b76916a61029989c41d2d";
+    hash = "sha256-4A01MAGkBSSzkyRw4omNbLoX8z+pHfoUO7/6QvEUu70=";
+  };
+
+  nativeBuildInputs = [
+    hare
+    haredo
+    scdoc
+  ];
+
+  dontConfigure = true;
+
+  preBuild = ''
+    HARECACHE="$(mktemp -d)"
+    export HARECACHE
+    export PREFIX="${builtins.placeholder "out"}"
+  '';
+
+  meta = {
+    description = "Serialize a directory to a tree diagram, and vice versa";
+    longDescription = ''
+      Treecat is an amalgamation of `tree(1)` and `cat(1)`, with the added
+      bonus that it can reconstruct its output back into the original filetree.
+    '';
+    homepage = "https://sr.ht/~autumnull/treecat/";
+    license = lib.licenses.wtfpl;
+    maintainers = with lib.maintainers; [ onemoresuza ];
+    mainProgram = "treecat";
+    inherit (hare.meta) platforms badPlatforms;
+  };
+})
diff --git a/nixpkgs/pkgs/desktops/cinnamon/cinnamon-common/default.nix b/nixpkgs/pkgs/desktops/cinnamon/cinnamon-common/default.nix
index fd1ad256d20c..678bcfcd14cd 100644
--- a/nixpkgs/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/nixpkgs/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@@ -71,13 +71,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cinnamon-common";
-  version = "6.0.0";
+  version = "6.0.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon";
     rev = version;
-    hash = "sha256-kQvPdamS0t7YcWyCekdsLNXZfidaV3tdSptzHPGMSZ0=";
+    hash = "sha256-QEJNBQnj4vXZim5HsRY15VU2CBbnsw/jtSP9JRbWpog=";
   };
 
   patches = [
diff --git a/nixpkgs/pkgs/desktops/cinnamon/mint-artwork/default.nix b/nixpkgs/pkgs/desktops/cinnamon/mint-artwork/default.nix
index 4025bb570fb8..d20be81f37a6 100644
--- a/nixpkgs/pkgs/desktops/cinnamon/mint-artwork/default.nix
+++ b/nixpkgs/pkgs/desktops/cinnamon/mint-artwork/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "mint-artwork";
-  version = "1.7.7";
+  version = "1.7.9";
 
   src = fetchurl {
     urls = [
       "http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
-      "https://web.archive.org/web/20231123132622/http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
+      "https://web.archive.org/web/20231214142428/http://packages.linuxmint.com/pool/main/m/mint-artwork/mint-artwork_${version}.tar.xz"
     ];
-    hash = "sha256-FwhZmquT+tByqBIhsoLQOtqsbkp+v4eWIoFenVlgCGc=";
+    hash = "sha256-64S7NAQtJuhSeMiSTbW2bqosL4A9M/nzmPYJI/ZAi0U=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/desktops/cinnamon/mint-l-icons/default.nix b/nixpkgs/pkgs/desktops/cinnamon/mint-l-icons/default.nix
index 7361ddb7fde4..d4ace1290ccf 100644
--- a/nixpkgs/pkgs/desktops/cinnamon/mint-l-icons/default.nix
+++ b/nixpkgs/pkgs/desktops/cinnamon/mint-l-icons/default.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-l-icons";
-  version = "1.6.6";
+  version = "1.6.7";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-3bLMuygijkDZ6sIqDzh6Ypwlmz+hpKgdITqrz7Jg3zY=";
+    hash = "sha256-4fBqdJq/JG9SZOLRxv/wXYG9g4wWGkvGwkWzUTDDjXY=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/desktops/cinnamon/mint-y-icons/default.nix b/nixpkgs/pkgs/desktops/cinnamon/mint-y-icons/default.nix
index 1ec2ded83717..b5d2df761fad 100644
--- a/nixpkgs/pkgs/desktops/cinnamon/mint-y-icons/default.nix
+++ b/nixpkgs/pkgs/desktops/cinnamon/mint-y-icons/default.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-y-icons";
-  version = "1.6.9";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-rVcYt7lnQGS8Bs0aneMFu580K0XTUh4P0kcVwps4l6Q=";
+    hash = "sha256-T2tZUMXc3kvTFkWf9AGUTNkkmQ0OT8qTKpQk+ZuvEc0=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/desktops/gnome/extensions/default.nix b/nixpkgs/pkgs/desktops/gnome/extensions/default.nix
index 686f8031ec86..bfb5f4ff33e6 100644
--- a/nixpkgs/pkgs/desktops/gnome/extensions/default.nix
+++ b/nixpkgs/pkgs/desktops/gnome/extensions/default.nix
@@ -35,6 +35,7 @@ let
     lib.trivial.pipe extensions [
       (map (extension: lib.nameValuePair extension.extensionUuid extension))
       builtins.listToAttrs
+      (attrs: attrs // { __attrsFailEvaluation = true; })
     ];
 
   # Map the list of extensions to an attrset based on the pname as key, which is more human readable than the UUID
@@ -66,6 +67,7 @@ in rec {
 
   # Keep the last three versions in here
   gnomeExtensions = lib.trivial.pipe (gnome43Extensions // gnome44Extensions // gnome45Extensions) [
+    (v: builtins.removeAttrs v [ "__attrsFailEvaluation" ])
     # Apply some custom patches for automatically packaged extensions
     (callPackage ./extensionOverrides.nix {})
     # Add all manually packaged extensions
@@ -88,4 +90,5 @@ in rec {
     # Make the set "public"
     lib.recurseIntoAttrs
   ];
+
 }
diff --git a/nixpkgs/pkgs/development/compilers/chicken/4/default.nix b/nixpkgs/pkgs/development/compilers/chicken/4/default.nix
index de64d20d3e05..7502a7a9f1e7 100644
--- a/nixpkgs/pkgs/development/compilers/chicken/4/default.nix
+++ b/nixpkgs/pkgs/development/compilers/chicken/4/default.nix
@@ -3,7 +3,7 @@ let
   callPackage = newScope self;
 
   self = {
-    pkgs = self;
+    pkgs = self // { recurseForDerivations = false; };
 
     fetchegg = callPackage ./fetchegg { };
 
diff --git a/nixpkgs/pkgs/development/compilers/rust/clippy.nix b/nixpkgs/pkgs/development/compilers/rust/clippy.nix
index 8459002743bb..43a10c1c7374 100644
--- a/nixpkgs/pkgs/development/compilers/rust/clippy.nix
+++ b/nixpkgs/pkgs/development/compilers/rust/clippy.nix
@@ -31,8 +31,8 @@ rustPlatform.buildRustPackage {
   # [0]: https://github.com/rust-lang/rust/blob/f77f4d55bdf9d8955d3292f709bd9830c2fdeca5/src/bootstrap/builder.rs#L1543
   # [1]: https://github.com/rust-lang/rust/blob/f77f4d55bdf9d8955d3292f709bd9830c2fdeca5/compiler/rustc_codegen_ssa/src/back/linker.rs#L323-L331
   preFixup = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -add_rpath "${rustc}/lib" "$out/bin/clippy-driver"
-    install_name_tool -add_rpath "${rustc}/lib" "$out/bin/cargo-clippy"
+    install_name_tool -add_rpath "${rustc.unwrapped}/lib" "$out/bin/clippy-driver"
+    install_name_tool -add_rpath "${rustc.unwrapped}/lib" "$out/bin/cargo-clippy"
   '';
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/development/compilers/rust/default.nix b/nixpkgs/pkgs/development/compilers/rust/default.nix
index d56b6fb9e08e..c08ffa848ef5 100644
--- a/nixpkgs/pkgs/development/compilers/rust/default.nix
+++ b/nixpkgs/pkgs/development/compilers/rust/default.nix
@@ -62,7 +62,7 @@ in
       bootRustPlatform = makeRustPlatform bootstrapRustPackages;
     in {
       # Packages suitable for build-time, e.g. `build.rs`-type stuff.
-      buildRustPackages = (selectRustPackage buildPackages).packages.stable;
+      buildRustPackages = (selectRustPackage buildPackages).packages.stable // { __attrsFailEvaluation = true; };
       # Analogous to stdenv
       rustPlatform = makeRustPlatform self.buildRustPackages;
       rustc-unwrapped = self.callPackage ./rustc.nix ({
diff --git a/nixpkgs/pkgs/development/compilers/rust/rustfmt.nix b/nixpkgs/pkgs/development/compilers/rust/rustfmt.nix
index 40f6237dbe98..9cc8df5a9e90 100644
--- a/nixpkgs/pkgs/development/compilers/rust/rustfmt.nix
+++ b/nixpkgs/pkgs/development/compilers/rust/rustfmt.nix
@@ -22,8 +22,8 @@ rustPlatform.buildRustPackage rec {
   # [0]: https://github.com/rust-lang/rust/blob/f77f4d55bdf9d8955d3292f709bd9830c2fdeca5/src/bootstrap/builder.rs#L1543
   # [1]: https://github.com/rust-lang/rust/blob/f77f4d55bdf9d8955d3292f709bd9830c2fdeca5/compiler/rustc_codegen_ssa/src/back/linker.rs#L323-L331
   preFixup = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -add_rpath "${rustc}/lib" "$out/bin/rustfmt"
-    install_name_tool -add_rpath "${rustc}/lib" "$out/bin/git-rustfmt"
+    install_name_tool -add_rpath "${rustc.unwrapped}/lib" "$out/bin/rustfmt"
+    install_name_tool -add_rpath "${rustc.unwrapped}/lib" "$out/bin/git-rustfmt"
   '';
 
   # As of 1.0.0 and rustc 1.30 rustfmt requires a nightly compiler
diff --git a/nixpkgs/pkgs/development/compilers/swift/default.nix b/nixpkgs/pkgs/development/compilers/swift/default.nix
index 0da2510f09a0..afb8ce39dcce 100644
--- a/nixpkgs/pkgs/development/compilers/swift/default.nix
+++ b/nixpkgs/pkgs/development/compilers/swift/default.nix
@@ -55,7 +55,8 @@ let
     darwin = pkgs.darwin.overrideScope (_: prev: {
       inherit apple_sdk;
       inherit (apple_sdk) Libsystem LibsystemCross libcharset libunwind objc4 configd IOKit Security;
-      CF = apple_sdk.CoreFoundation;
+      CF = apple_sdk.CoreFoundation // { __attrsFailEvaluation = true; };
+      __attrsFailEvaluation = true;
     });
     xcodebuild = pkgs.xcbuild.override {
       inherit (apple_sdk.frameworks) CoreServices CoreGraphics ImageIO;
diff --git a/nixpkgs/pkgs/development/embedded/platformio/core.nix b/nixpkgs/pkgs/development/embedded/platformio/core.nix
index e02e76e3ccce..82ccfa41c2f0 100644
--- a/nixpkgs/pkgs/development/embedded/platformio/core.nix
+++ b/nixpkgs/pkgs/development/embedded/platformio/core.nix
@@ -1,42 +1,53 @@
-{ stdenv, lib, python3
+{ lib
+, python3Packages
 , fetchFromGitHub
-, fetchPypi
+, fetchpatch
 , git
 , spdx-license-list-data
+, substituteAll
 }:
 
-with python3.pkgs; buildPythonApplication rec {
-  pname = "platformio";
 
-  version = "6.1.6";
+with python3Packages; buildPythonApplication rec {
+  pname = "platformio";
+  version = "6.1.11";
+  pyproject = true;
 
   # pypi tarballs don't contain tests - https://github.com/platformio/platformio-core/issues/1964
   src = fetchFromGitHub {
     owner = "platformio";
     repo = "platformio-core";
     rev = "v${version}";
-    sha256 = "sha256-BEeMfdmAWqFbQUu8YKKrookQVgmhfZBqXnzeb2gfhms=";
+    hash = "sha256-NR4UyAt8q5sUGtz1Sy6E8Of7y9WrH9xpcAWzLBeDQmo=";
   };
 
   outputs = [ "out" "udev" ];
 
   patches = [
-    ./fix-searchpath.patch
-    ./use-local-spdx-license-list.patch
+    (substituteAll {
+      src = ./interpreter.patch;
+      interpreter = (python3Packages.python.withPackages (_: propagatedBuildInputs)).interpreter;
+    })
+    (substituteAll {
+      src = ./use-local-spdx-license-list.patch;
+      spdx_license_list_data = spdx-license-list-data.json;
+    })
     ./missing-udev-rules-nixos.patch
+    (fetchpatch {
+      # restore PYTHONPATH when calling scons
+      # https://github.com/platformio/platformio-core/commit/097de2be98af533578671baa903a3ae825d90b94
+      url = "https://github.com/platformio/platformio-core/commit/097de2be98af533578671baa903a3ae825d90b94.patch";
+      hash = "sha256-yq+/QHCkhAkFND11MbKFiiWT3oF1cHhgWj5JkYjwuY0=";
+      revert = true;
+    })
   ];
 
-  postPatch = ''
-    substitute platformio/package/manifest/schema.py platformio/package/manifest/schema.py \
-      --subst-var-by SPDX_LICENSE_LIST_DATA '${spdx-license-list-data.json}'
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+  ];
 
-    substituteInPlace setup.py \
-      --replace 'aiofiles==%s" % ("0.8.0" if PY36 else "22.1.*")' 'aiofiles"' \
-      --replace 'starlette==%s" % ("0.19.1" if PY36 else "0.23.*")' 'starlette"' \
-      --replace 'uvicorn==%s" % ("0.16.0" if PY36 else "0.20.*")' 'uvicorn"' \
-      --replace 'tabulate==%s" % ("0.8.10" if PY36 else "0.9.*")' 'tabulate>=0.8.10,<=0.9"' \
-      --replace 'wsproto==%s" % ("1.0.0" if PY36 else "1.2.*")' 'wsproto"'
-  '';
+  pythonRelaxDeps = true;
 
   propagatedBuildInputs = [
     aiofiles
@@ -52,12 +63,14 @@ with python3.pkgs; buildPythonApplication rec {
     pyserial
     requests
     semantic-version
+    setuptools
     spdx-license-list-data.json
     starlette
     tabulate
     uvicorn
     wsproto
     zeroconf
+
   ];
 
   preCheck = ''
@@ -163,11 +176,13 @@ with python3.pkgs; buildPythonApplication rec {
   ]);
 
   passthru = {
-    python = python3;
+    python = python3Packages.python;
   };
 
   meta = with lib; {
+    changelog = "https://github.com/platformio/platformio-core/releases/tag/v${version}";
     description = "An open source ecosystem for IoT development";
+    downloadPage = "https://github.com/platformio/platformio-core";
     homepage = "https://platformio.org";
     license = licenses.asl20;
     maintainers = with maintainers; [ mog makefu ];
diff --git a/nixpkgs/pkgs/development/embedded/platformio/fix-searchpath.patch b/nixpkgs/pkgs/development/embedded/platformio/interpreter.patch
index fe7f9f127a7a..f7e212d57111 100644
--- a/nixpkgs/pkgs/development/embedded/platformio/fix-searchpath.patch
+++ b/nixpkgs/pkgs/development/embedded/platformio/interpreter.patch
@@ -1,9 +1,18 @@
 diff --git a/platformio/proc.py b/platformio/proc.py
-index 80e50201..15cee5a5 100644
+index 707245a1..cae17a29 100644
 --- a/platformio/proc.py
 +++ b/platformio/proc.py
+@@ -165,7 +165,7 @@ def is_container():
+ 
+ 
+ def get_pythonexe_path():
+-    return os.environ.get("PYTHONEXEPATH", os.path.normpath(sys.executable))
++    return "@interpreter@"
+ 
+ 
+ def copy_pythonpath_to_osenv():
 @@ -181,7 +181,7 @@ def copy_pythonpath_to_osenv():
-             conditions.append(isdir(join(p, "click")) or isdir(join(p, "platformio")))
+             )
          if all(conditions):
              _PYTHONPATH.append(p)
 -    os.environ["PYTHONPATH"] = os.pathsep.join(_PYTHONPATH)
diff --git a/nixpkgs/pkgs/development/embedded/platformio/missing-udev-rules-nixos.patch b/nixpkgs/pkgs/development/embedded/platformio/missing-udev-rules-nixos.patch
index 4be06ceac8b1..878470920577 100644
--- a/nixpkgs/pkgs/development/embedded/platformio/missing-udev-rules-nixos.patch
+++ b/nixpkgs/pkgs/development/embedded/platformio/missing-udev-rules-nixos.patch
@@ -1,10 +1,12 @@
 diff --git a/platformio/exception.py b/platformio/exception.py
-index ef1d3bab..445174fc 100644
+index 80ffb496..ea064f97 100644
 --- a/platformio/exception.py
 +++ b/platformio/exception.py
-@@ -57,6 +57,7 @@ class MissedUdevRules(InvalidUdevRules):
+@@ -49,6 +49,7 @@ class MissedUdevRules(InvalidUdevRules):
      MESSAGE = (
          "Warning! Please install `99-platformio-udev.rules`. \nMore details: "
          "https://docs.platformio.org/en/latest/core/installation/udev-rules.html"
-+        "On NixOS add the platformio-core.udev package to services.udev.packages"
++        "On NixOS set `services.udev.packages = with pkgs; [ platformio-core.udev ];`."
      )
+ 
+ 
diff --git a/nixpkgs/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch b/nixpkgs/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
index 6db8585a55f3..ba9b55b788a1 100644
--- a/nixpkgs/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
+++ b/nixpkgs/pkgs/development/embedded/platformio/use-local-spdx-license-list.patch
@@ -1,23 +1,17 @@
 diff --git a/platformio/package/manifest/schema.py b/platformio/package/manifest/schema.py
-index 1e5f935a..26d1ac6a 100644
+index 95e08108..6c2cfaed 100644
 --- a/platformio/package/manifest/schema.py
 +++ b/platformio/package/manifest/schema.py
-@@ -276,9 +276,12 @@ class ManifestSchema(BaseSchema):
+@@ -276,9 +276,6 @@ class ManifestSchema(BaseSchema):
      @staticmethod
      @memoized(expire="1h")
      def load_spdx_licenses():
--        version = "3.19"
+-        version = "3.21"
 -        spdx_data_url = (
 -            "https://raw.githubusercontent.com/spdx/license-list-data/"
--            "v%s/json/licenses.json" % version
+-            f"v{version}/json/licenses.json"
 -        )
 -        return json.loads(fetch_remote_content(spdx_data_url))
-+        # version = "3.19"
-+        # spdx_data_url = (
-+            # "https://raw.githubusercontent.com/spdx/license-list-data/"
-+            # "v%s/json/licenses.json" % version
-+        # )
-+        # return json.loads(fetch_remote_content(spdx_data_url))
-+        with open("@SPDX_LICENSE_LIST_DATA@/json/licenses.json") as f:
-+            spdx = json.load(f)
++        with open("@spdx_license_list_data@/json/licenses.json") as fd:
++            spdx = json.load(fd)
 +        return spdx
diff --git a/nixpkgs/pkgs/development/hare-packages/hare-json/default.nix b/nixpkgs/pkgs/development/hare-third-party/hare-json/default.nix
index d9afdeadf7f0..c7a71f342967 100644
--- a/nixpkgs/pkgs/development/hare-packages/hare-json/default.nix
+++ b/nixpkgs/pkgs/development/hare-third-party/hare-json/default.nix
@@ -2,29 +2,21 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hare-json";
-  version = "unstable-2023-09-21";
+  version = "unstable-2023-03-13";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = "hare-json";
-    rev = "e24e5dceb8628ff569338e6c4fdba35a5017c5e2";
-    hash = "sha256-7QRieokqXarKwLfZynS8Rum9JV9hcxod00BWAUwwliM=";
+    rev = "88256102a9fec62d494628e32cb406574e49e5e1";
+    hash = "sha256-Sx+RBiLhR3ftP89AwinVlBg0u0HX4GVP7TLmuofgC9s=";
   };
 
   nativeBuildInputs = [ hare ];
 
-  configurePhase = ''
-    runHook preConfigure
-
-    export HARECACHE="$NIX_BUILD_TOP/.harecache"
-    export BINOUT="$NIX_BUILD_TOP/.bin"
-
-    makeFlagsArray+=(
-      PREFIX="${builtins.placeholder "out"}"
-    )
-
-    runHook postConfigure
-  '';
+  makeFlags = [
+    "HARECACHE=.harecache"
+    "PREFIX=${builtins.placeholder "out"}"
+  ];
 
   doCheck = true;
 
diff --git a/nixpkgs/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix b/nixpkgs/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
index 7fce340d5c56..bae278f126e4 100644
--- a/nixpkgs/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
+++ b/nixpkgs/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
@@ -119,8 +119,6 @@ self: super: {
   # Forbids base >= 4.18, fix proposed: https://github.com/sjakobi/newtype-generics/pull/25
   newtype-generics = jailbreakForCurrentVersion super.newtype-generics "0.6.2";
 
-  serialise = jailbreakForCurrentVersion super.serialise "0.2.6.0";
-
   #
   # Too strict bounds, waiting on Hackage release in nixpkgs
   #
diff --git a/nixpkgs/pkgs/development/haskell-modules/default.nix b/nixpkgs/pkgs/development/haskell-modules/default.nix
index 7bc1fa0f7e83..e766203bd1f0 100644
--- a/nixpkgs/pkgs/development/haskell-modules/default.nix
+++ b/nixpkgs/pkgs/development/haskell-modules/default.nix
@@ -18,7 +18,8 @@ let
 
   haskellPackages = pkgs.callPackage makePackageSet {
     package-set = initialPackages;
-    inherit stdenv haskellLib ghc buildHaskellPackages extensible-self all-cabal-hashes;
+    inherit stdenv haskellLib ghc extensible-self all-cabal-hashes;
+    buildHaskellPackages = buildHaskellPackages // { __attrsFailEvaluation = true; };
   };
 
   platformConfigurations = lib.optionals stdenv.hostPlatform.isAarch [
diff --git a/nixpkgs/pkgs/development/haskell-modules/make-package-set.nix b/nixpkgs/pkgs/development/haskell-modules/make-package-set.nix
index c39c934bed64..294ca295f22b 100644
--- a/nixpkgs/pkgs/development/haskell-modules/make-package-set.nix
+++ b/nixpkgs/pkgs/development/haskell-modules/make-package-set.nix
@@ -614,7 +614,7 @@ in package-set { inherit pkgs lib callPackage; } self // {
        Type: [str] -> drv -> drv
     */
     generateOptparseApplicativeCompletions =
-      self.callPackage (
+      (self.callPackage (
         { stdenv }:
 
         commands:
@@ -623,7 +623,7 @@ in package-set { inherit pkgs lib callPackage; } self // {
         if stdenv.buildPlatform.canExecute stdenv.hostPlatform
         then lib.foldr haskellLib.__generateOptparseApplicativeCompletion pkg commands
         else pkg
-      ) { };
+      ) { }) // { __attrsFailEvaluation = true; };
 
     /*
       Modify given Haskell package to force GHC to employ the LLVM
diff --git a/nixpkgs/pkgs/development/interpreters/expr/default.nix b/nixpkgs/pkgs/development/interpreters/expr/default.nix
index da0cc15b52f6..7a6384620d44 100644
--- a/nixpkgs/pkgs/development/interpreters/expr/default.nix
+++ b/nixpkgs/pkgs/development/interpreters/expr/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "expr";
-  version = "1.15.5";
+  version = "1.15.7";
 
   src = fetchFromGitHub {
     owner = "antonmedv";
     repo = "expr";
     rev = "v${version}";
-    hash = "sha256-DIJBVL1HAZyD+K+vKnB1O2cZJkBu0R2xueDO1OUHq3I=";
+    hash = "sha256-dSZVReKQqQMKjVocqz6eoh8/+Yyf37egDf1tJ/JePJ0=";
   };
 
   sourceRoot = "${src.name}/repl";
 
-  vendorHash = "sha256-D4JdFY9OweTigT0NIKmBbxrHn5FoVsj/EU6c0y9aaDo=";
+  vendorHash = "sha256-ioNXzEQLLpBWhVw4tnDnL/umkEoExHBTSj2WBjIl3PQ=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/nixpkgs/pkgs/development/interpreters/lua-5/default.nix b/nixpkgs/pkgs/development/interpreters/lua-5/default.nix
index 2fda54bef530..ce91b024ce84 100644
--- a/nixpkgs/pkgs/development/interpreters/lua-5/default.nix
+++ b/nixpkgs/pkgs/development/interpreters/lua-5/default.nix
@@ -65,7 +65,8 @@ let
           inherit (luaPackages) requiredLuaModules;
         };
         withPackages = import ./with-packages.nix { inherit buildEnv luaPackages;};
-        pkgs = luaPackages;
+        pkgs = let lp = luaPackages;
+               in lp // { luaPackages = lp.luaPackages // { __attrsFailEvaluation = true; }; };
         interpreter = "${self}/bin/${executable}";
         inherit executable luaversion;
         luaOnBuild = luaOnBuildForHost.override { inherit packageOverrides; self = luaOnBuild; };
diff --git a/nixpkgs/pkgs/development/libraries/crocoddyl/default.nix b/nixpkgs/pkgs/development/libraries/crocoddyl/default.nix
index a25ca5b97dff..efba13612298 100644
--- a/nixpkgs/pkgs/development/libraries/crocoddyl/default.nix
+++ b/nixpkgs/pkgs/development/libraries/crocoddyl/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "crocoddyl";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "loco-3d";
     repo = finalAttrs.pname;
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-h7rzLSvmWOZCP8rvmUEhFeMEiPhojfbvkt+fNKpgoXo=";
+    hash = "sha256-MsAXHfxLNlIK/PbtVTjvBN1Jk3dyGEkfpj3/98nExj4=";
   };
 
   strictDeps = true;
diff --git a/nixpkgs/pkgs/development/libraries/geos/tests.nix b/nixpkgs/pkgs/development/libraries/geos/tests.nix
index 0f11885ab78c..ad9ab883db2d 100644
--- a/nixpkgs/pkgs/development/libraries/geos/tests.nix
+++ b/nixpkgs/pkgs/development/libraries/geos/tests.nix
@@ -3,7 +3,7 @@
 let
   inherit (geos) pname;
 in
-runCommand "${geos}-tests" { meta.timeout = 60; }
+runCommand "${pname}-tests" { meta.timeout = 60; }
   ''
     ${geos}/bin/geosop \
       --explode \
diff --git a/nixpkgs/pkgs/development/libraries/httplib/default.nix b/nixpkgs/pkgs/development/libraries/httplib/default.nix
index a887ea55330f..22c81d57e9df 100644
--- a/nixpkgs/pkgs/development/libraries/httplib/default.nix
+++ b/nixpkgs/pkgs/development/libraries/httplib/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "httplib";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
     rev = "v${version}";
-    hash = "sha256-JBs2FvcdAvxysYhzakP0wU/mUCWfKZ8dk5ROWL5sej0=";
+    hash = "sha256-JfxeXHo34MKtAkMO3pNWiPorh3f8s4SVrdAaydVYdrY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/nixpkgs/pkgs/development/libraries/intel-gmmlib/default.nix b/nixpkgs/pkgs/development/libraries/intel-gmmlib/default.nix
index 8782e4a5ea65..265a906a9d44 100644
--- a/nixpkgs/pkgs/development/libraries/intel-gmmlib/default.nix
+++ b/nixpkgs/pkgs/development/libraries/intel-gmmlib/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-gmmlib";
-  version = "22.3.14";
+  version = "22.3.15";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "gmmlib";
     rev = "intel-gmmlib-${version}";
-    sha256 = "sha256-hNewfGN/hO9hx2+1YmdPPqUORqpNwckQYSSO7zfeVAY=";
+    sha256 = "sha256-MVM5MfX+uVMik+332blWvqh6Wt1iq6DNR7/hrHC+rWI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/nixpkgs/pkgs/development/libraries/libtiff/default.nix b/nixpkgs/pkgs/development/libraries/libtiff/default.nix
index 22b0f8af2043..8e735369e076 100644
--- a/nixpkgs/pkgs/development/libraries/libtiff/default.nix
+++ b/nixpkgs/pkgs/development/libraries/libtiff/default.nix
@@ -85,7 +85,6 @@ stdenv.mkDerivation rec {
     description = "Library and utilities for working with the TIFF image file format";
     homepage = "https://libtiff.gitlab.io/libtiff";
     changelog = "https://libtiff.gitlab.io/libtiff/v${version}.html";
-    maintainers = with maintainers; [ qyliss ];
     license = licenses.libtiff;
     platforms = platforms.unix;
   };
diff --git a/nixpkgs/pkgs/development/libraries/physics/fastjet/default.nix b/nixpkgs/pkgs/development/libraries/physics/fastjet/default.nix
index 9dacb57e8ea2..d9cd1661af8a 100644
--- a/nixpkgs/pkgs/development/libraries/physics/fastjet/default.nix
+++ b/nixpkgs/pkgs/development/libraries/physics/fastjet/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fastjet";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchurl {
     url = "http://fastjet.fr/repo/fastjet-${version}.tar.gz";
-    hash = "sha256-BWCMb/IT8G3Z3nI4E9a03M1R5mGsEwmPdL/J7q8ctao=";
+    hash = "sha256-s9MxVbVc5D9CDNbZm1Jaz3vcJZOnu36omKnds9jKOOM=";
   };
 
   buildInputs = lib.optional withPython python;
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/5.15/default.nix b/nixpkgs/pkgs/development/libraries/qt-5/5.15/default.nix
index 68a3e3531e19..7a5ff60c9acb 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/nixpkgs/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -23,7 +23,7 @@ Check for any minor version changes.
 
 let
 
-  srcs = import ./srcs.nix { inherit lib fetchgit fetchFromGitHub; };
+  srcs = import ./srcs.nix { inherit lib fetchgit fetchFromGitHub; } // { __attrsFailEvaluation = true; };
 
   qtCompatVersion = srcs.qtbase.version;
 
diff --git a/nixpkgs/pkgs/development/lua-modules/lib.nix b/nixpkgs/pkgs/development/lua-modules/lib.nix
index a07b23ff9cd2..189e3464e81a 100644
--- a/nixpkgs/pkgs/development/lua-modules/lib.nix
+++ b/nixpkgs/pkgs/development/lua-modules/lib.nix
@@ -76,18 +76,23 @@ rec {
 
   /* generate luarocks config
 
-  generateLuarocksConfig {
-    externalDeps = [ { name = "CRYPTO"; dep = pkgs.openssl; } ];
-    rocksSubdir = "subdir";
-  };
+    Example:
+      generateLuarocksConfig {
+        externalDeps = [ { name = "CRYPTO"; dep = pkgs.openssl; } ];
+        rocksSubdir = "subdir";
+      };
+
+    Type:
+       generateLuarocksConfig :: AttrSet -> String
   */
   generateLuarocksConfig = {
-    externalDeps ? []
+      externalDeps ? []
     # a list of lua derivations
     , requiredLuaRocks ? []
     , extraVariables ? {}
     , rocksSubdir ? "rocks-subdir"
-    }: let
+    , ...
+    }@args: let
       rocksTrees = lib.imap0
         (i: dep: {
           name = "dep-${toString i}";
@@ -140,5 +145,7 @@ rec {
     # Some needed machinery to handle multiple-output external dependencies,
     # as per https://github.com/luarocks/luarocks/issues/766
     variables = (depVariables // extraVariables);
-  });
+  }
+  // removeAttrs args [ "rocksSubdir" "extraVariables" "requiredLuaRocks" "externalDeps" ]
+  );
 }
diff --git a/nixpkgs/pkgs/development/misc/juce/default.nix b/nixpkgs/pkgs/development/misc/juce/default.nix
index 6c409a18e7aa..ced9acc27c4f 100644
--- a/nixpkgs/pkgs/development/misc/juce/default.nix
+++ b/nixpkgs/pkgs/development/misc/juce/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "juce";
-  version = "7.0.7";
+  version = "7.0.9";
 
   src = fetchFromGitHub {
     owner = "juce-framework";
     repo = "juce";
     rev = finalAttrs.version;
-    hash = "sha256-r+Wf/skPDexm3rsrVBoWrygKvV9HGlCQd7r0iHr9avM=";
+    hash = "sha256-k8cNTPH9OgOav4dsSLqrd5PlJ1rqO0PLt6Lwmumc2Gg=";
   };
 
   patches = [
diff --git a/nixpkgs/pkgs/development/python-modules/fakeredis/default.nix b/nixpkgs/pkgs/development/python-modules/fakeredis/default.nix
index b1b1080d20b7..b39241bc9058 100644
--- a/nixpkgs/pkgs/development/python-modules/fakeredis/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/fakeredis/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "fakeredis";
-  version = "2.20.0";
+  version = "2.20.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "dsoftwareinc";
     repo = "fakeredis-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-pRvUgK4OXVP2GR+Iu4ddqwApw0gYN4FkKjTpwbC1oWM=";
+    hash = "sha256-TmgHAskR5MF/lzF0NHgXKecLsSCoc7xsm7gRgupm0Ws=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/github-to-sqlite/default.nix b/nixpkgs/pkgs/development/python-modules/github-to-sqlite/default.nix
index 4b791bb5915f..0dfeb4244939 100644
--- a/nixpkgs/pkgs/development/python-modules/github-to-sqlite/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/github-to-sqlite/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "github-to-sqlite";
-  version = "2.8.3";
+  version = "2.9";
   format = "setuptools";
   disabled = !isPy3k;
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "dogsheep";
     repo = pname;
     rev = version;
-    hash = "sha256-4wkwtcChcR7XH421wa3dGdIPhwgeaTFk247zIRX98xo=";
+    hash = "sha256-KwLaaZxBBzRhiBv4p8Imb5XI1hyka9rmr/rxA6wDc7Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/google-auth-httplib2/default.nix b/nixpkgs/pkgs/development/python-modules/google-auth-httplib2/default.nix
index 510b62c5bbae..daf7a64de53a 100644
--- a/nixpkgs/pkgs/development/python-modules/google-auth-httplib2/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-auth-httplib2/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-auth-httplib2";
-  version = "0.1.1";
+  version = "0.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-xkvFVf3G3XiOpi7Pe8z/z0l793JEiHo/PXpaAvjj/Ck=";
+    hash = "sha256-OKp7rfSPl08euYYXlOnAyyoFEaTsBnmx+IbRCPVkDgU=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
index d7ed23f14cec..a7a92d057a73 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-appengine-logging/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-appengine-logging";
-  version = "1.3.2";
+  version = "1.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-opifyg6IRjtWQyqoIeZLgcPRce43uEdxGJtI6Ll81JY=";
+    hash = "sha256-/nT0GNCwHr6+g64hKr8FGtQmkqY2Z345fePUWeANe2Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-asset/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-asset/default.nix
index 94b608e4264d..ddc78dc7cc57 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-asset/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-asset/default.nix
@@ -1,33 +1,38 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, grpc-google-iam-v1
 , google-api-core
 , google-cloud-access-context-manager
 , google-cloud-org-policy
 , google-cloud-os-config
 , google-cloud-testutils
+, grpc-google-iam-v1
 , libcst
-, protobuf
+, mock
 , proto-plus
+, protobuf
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
-, mock
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-asset";
-  version = "3.20.1";
-  format = "setuptools";
+  version = "3.22.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Q6PcdzQ4iCB/dM0YKCUMdfZ1e6oEfG6d40gsUfMLhOQ=";
+    hash = "sha256-S+rJ80pkphkPlNFUn8e0bxpnkBILRS9Uvoa0vlfrK8M=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     grpc-google-iam-v1
     google-api-core
@@ -63,8 +68,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Python Client for Google Cloud Asset API";
-    homepage = "https://github.com/googleapis/python-asset";
-    changelog = "https://github.com/googleapis/python-asset/blob/v${version}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-asset";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-asset-v${version}/packages/google-cloud-asset/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-automl/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-automl/default.nix
index b45492a171f8..2768a79005a8 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-automl/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-automl/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-automl";
-  version = "2.11.4";
+  version = "2.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-oUMXQWkwHMFI26hpe36mAyoh+bQogtyoDgTaBRactUU=";
+    hash = "sha256-IvemHgS0qbA9UE7y22aD30YqAy2lP+P7ssNvUlB0q7U=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-bigtable/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-bigtable/default.nix
index 9b214bebdfd3..1f0695a1770f 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-bigtable/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-bigtable/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigtable";
-  version = "2.21.0";
+  version = "2.22.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2fDvv5QMo5LwfRN4f8LadtHhaN7a+uD48bQgjgwRMtw=";
+    hash = "sha256-Y6HO3Q5JZC4lSBJDbJxMlAHWnF3LzIDLY2ZpK1Abv6E=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-container/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-container/default.nix
index 76ee8d8fa4b2..47d3969dbf6a 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-container/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-container/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-container";
-  version = "2.35.0";
+  version = "2.36.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-d8ASZS2Zp6d/0d4t52w/ZGLXXQdTkUZrA0DGWKCamZY=";
+    hash = "sha256-dDkiUothV1QwMkeD8FsWZloLLMEbCNqJ1yHeraqdbuw=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-dataproc/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-dataproc/default.nix
index c7c79ef0af87..3b0fff422ce1 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-dataproc/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-dataproc/default.nix
@@ -10,20 +10,25 @@
 , pytestCheckHook
 , pytest-asyncio
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-dataproc";
-  version = "5.7.0";
-  format = "setuptools";
+  version = "5.8.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-CGIpoPmHRIu5ICnhZiEqzvhdTo5dlPKCKt0hs4K/HAQ=";
+    hash = "sha256-sDQS3WPLhNwLsIRM2emp7vQOHQ1xlkllkFLMzw0+ldc=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     google-api-core
     grpc-google-iam-v1
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-logging/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-logging/default.nix
index 83842597d877..c6d253d9cb07 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-logging/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-logging/default.nix
@@ -17,20 +17,25 @@
 , pytestCheckHook
 , pythonOlder
 , rich
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-logging";
-  version = "3.8.0";
-  format = "setuptools";
+  version = "3.9.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/dkW5ZqEqowC6BSNf907O2I8V7DB/3H0MpfOjlD8Hqs=";
+    hash = "sha256-TeyxsL7UoOPA5Yo3ZkbmAC1r58rQOeNGaCLoZlBy6jM=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     google-api-core
     google-cloud-appengine-logging
@@ -52,16 +57,18 @@ buildPythonPackage rec {
     rich
   ];
 
-  disabledTests = [
-    # requires credentials
-    "test_write_log_entries"
-  ];
-
   preCheck = ''
-    # prevent google directory from shadowing google imports
+    # Prevent google directory from shadowing google imports
     rm -r google
   '';
 
+  disabledTests = [
+    # Test requires credentials
+    "test_write_log_entries"
+    # No need for a second import check
+    "test_namespace_package_compat"
+  ];
+
   disabledTestPaths = [
     # Tests require credentials
     "tests/system/test_system.py"
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-os-config/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-os-config/default.nix
index 4c71548c0df8..3ea7d25e9d54 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-os-config/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-os-config/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-os-config";
-  version = "1.15.3";
+  version = "1.16.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KNM4wASyfgoBqhXa5k+8tf+AN9VljHDDK0U849N5qHI=";
+    hash = "sha256-1wXyDI1/NMqMwgqYZb3/pLExyi1Wo7st8R/mNwMte44=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-redis/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-redis/default.nix
index 37b9dcf80958..228545f62da4 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-redis/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-redis/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-redis";
-  version = "2.13.2";
+  version = "2.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XEhXMDVdlnI9ZK5jfxsiZPNbV8MB7A7yxtMLLwbcoU4=";
+    hash = "sha256-TzuRWGGdQrsmOLidvLiC80e9t9VVu8LUNhq2Ikk0Pco=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-speech/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-speech/default.nix
index 3999f428c2b6..8fa7bc16d6ce 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-speech/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-speech/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-speech";
-  version = "2.22.0";
+  version = "2.23.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lZKKiYaS1+qgVWbVeiE464tbkjSxw8y3LFUgce0qOrA=";
+    hash = "sha256-H4aDIHCF3cpsXgZIly+KBik30w5zqlVSDwgPSVMse/8=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/google-cloud-vision/default.nix b/nixpkgs/pkgs/development/python-modules/google-cloud-vision/default.nix
index 95c2ed0662ca..7d998aea6f55 100644
--- a/nixpkgs/pkgs/development/python-modules/google-cloud-vision/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/google-cloud-vision/default.nix
@@ -8,20 +8,25 @@
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-vision";
-  version = "3.4.5";
-  format = "setuptools";
+  version = "3.5.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DfgkGrJ3GZuRnKODen3oUFk2P+oOPWYAYIcL587/wEc=";
+    hash = "sha256-dwO/R8iyEIYw0qJ15X9DJuPAceZmISrZorPVqAkMZ2c=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     google-api-core
     proto-plus
@@ -44,6 +49,11 @@ buildPythonPackage rec {
     "google.cloud.vision_v1p4beta1"
   ];
 
+  disabledTests = [
+    # Tests require PROJECT_ID
+    "test_list_products"
+  ];
+
   meta = with lib; {
     description = "Cloud Vision API API client library";
     homepage = "https://github.com/googleapis/python-vision";
diff --git a/nixpkgs/pkgs/development/python-modules/jax/default.nix b/nixpkgs/pkgs/development/python-modules/jax/default.nix
index d2052cccecb0..f60310bdef14 100644
--- a/nixpkgs/pkgs/development/python-modules/jax/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/jax/default.nix
@@ -6,6 +6,7 @@
 , fetchFromGitHub
 , jaxlib
 , jaxlib-bin
+, hypothesis
 , lapack
 , matplotlib
 , ml-dtypes
@@ -27,7 +28,7 @@ let
 in
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.4.21";
+  version = "0.4.23";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -37,7 +38,7 @@ buildPythonPackage rec {
     repo = "jax";
     # google/jax contains tags for jax and jaxlib. Only use jax tags!
     rev = "refs/tags/${pname}-v${version}";
-    hash = "sha256-CMsW/t4/itJxN4pST8EKkN0ooHWdjRnLs073FwbXRJM=";
+    hash = "sha256-PDa3yVH/sszGbWkVkJ+19FdOr3oqdYk+OdbeUTMTDuU=";
   };
 
   nativeBuildInputs = [
@@ -59,6 +60,7 @@ buildPythonPackage rec {
   ] ++ lib.optional (pythonOlder "3.10") importlib-metadata;
 
   nativeCheckInputs = [
+    hypothesis
     jaxlib'
     matplotlib
     pytestCheckHook
diff --git a/nixpkgs/pkgs/development/python-modules/jaxlib/bin.nix b/nixpkgs/pkgs/development/python-modules/jaxlib/bin.nix
index 139cb881e591..f6f8f5e2b1b6 100644
--- a/nixpkgs/pkgs/development/python-modules/jaxlib/bin.nix
+++ b/nixpkgs/pkgs/development/python-modules/jaxlib/bin.nix
@@ -35,7 +35,7 @@
 let
   inherit (cudaPackagesGoogle) cudatoolkit cudnn;
 
-  version = "0.4.21";
+  version = "0.4.23";
 
   inherit (python) pythonVersion;
 
@@ -56,65 +56,65 @@ let
       "3.9-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp39";
-        hash = "sha256-mFA/ZSlluDy96Dy7Ez5MyV/onyXOXfwr+v4YBJ8YAKM=";
+        hash = "sha256-maN9RzK6/hYIuPRd8n8n5qa/HyPgAf6UD+mlqzZ1/Xc=";
       };
       "3.9-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp39";
-        hash = "sha256-pxFJPKl7LqwRpL0u53zAmp1XvFKPXv0tT/ioQ3EF/Cs=";
+        hash = "sha256-gdb07c12HCfK5VXT2C+9lYKSiIpPgD8sNmd4eG2M6M4=";
       };
       "3.9-x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
         dist = "cp39";
-        hash = "sha256-m8VBotK4tvrEgi8Ub5diHjTv8KU5C384srlSIRcX50o=";
+        hash = "sha256-TdU4wEoqEhsDq18MuLEpmKqpU51+xUYp/reZqEDJK1U=";
       };
 
       "3.10-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp310";
-        hash = "sha256-jd4+HWPtGt4xLCabVWg99MP+F2bwrhMAJ/BAXfRmIZE=";
+        hash = "sha256-cnX75aSJxoPFUCYD1V5QgyPNovS9lSGqg4PGdPsKsvM=";
       };
       "3.10-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp310";
-        hash = "sha256-/zEl2jm9A5iwELPPaSeLlubaFyIkgwdNFzCMKaLvK2A=";
+        hash = "sha256-H9sbeR4+4XytREYLP0LJphqGkQqHcinTC9NlT0Rj1aA=";
       };
       "3.10-x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
         dist = "cp310";
-        hash = "sha256-BaMQQHdIGtRKDDvjacYLhD7lB058Q8ZYVo6JckVjyxE=";
+        hash = "sha256-43VuBgGvdjauWPQtJK9w5GBI/++JvV4FwwO4maIXfDY=";
       };
 
       "3.11-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp311";
-        hash = "sha256-/N41pyv1AOFegCXUH/XmOUiaAfH5/k/ydT8JaFGq+bM=";
+        hash = "sha256-mEdm0wmyHKg4RlA7q9/e1OOu+BfGcPKBCSvLwXfFhJI=";
       };
       "3.11-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp311";
-        hash = "sha256-gYN77bddkBWYQIzPWXusN+xwpga47zSAFdQ4php+AZM=";
+        hash = "sha256-1kb/m8DODrtXO2drIfpttCLC72oNVszADbSDspllQVs=";
       };
       "3.11-x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
         dist = "cp311";
-        hash = "sha256-GaneuQIfERYAcHQtQ6OwL87098QS+h8GrZOfmef0a70=";
+        hash = "sha256-jhLX4ps+EtU1sku722v51mz2SSamo4/dkdRWX3zFcRE=";
       };
 
       "3.12-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp312";
-        hash = "sha256-AkyF07UGTfkQHJ/qN2lHe0ki1Fh1uJZkkGQYRkiTIis=";
+        hash = "sha256-oimiuQopgN1oKhbDc7SsRJPnA6JiEI9UieikWR2qpVk=";
       };
       "3.12-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp312";
-        hash = "sha256-qGxiVdHNChS5WObW8j9E6G/oEa9FOLRY0/xowQNns0Y=";
+        hash = "sha256-J4zaKcx0c0Bgk7w/n6klqDlgY9IqTNINfg6g033LUDk=";
       };
       "3.12-x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
         dist = "cp312";
-        hash = "sha256-eYDUrenaHxlCvBYbt12r2VMLBpBBU6o/3ekyj9Ll+AE=";
+        hash = "sha256-UFEE/mBitEOVUoijhUfphyy24QfWPZ+FQPsQ0cjY79A=";
       };
     };
 
@@ -124,19 +124,19 @@ let
   gpuSrcs = {
     "3.9" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp39-cp39-manylinux2014_x86_64.whl";
-      hash = "sha256-VKWX2pTgHWXzbUYXkshmPRxiBs6YDw1WeK72TY1koLc=";
+      hash = "sha256-our2mSwHPdjVoDAZP+9aNUkJ+vxv1Tq7G5UqA9HvhNI=";
     };
     "3.10" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp310-cp310-manylinux2014_x86_64.whl";
-      hash = "sha256-/4wNdMHNT1izYfyX58KH9CAgnQPcv1/GjNlKhFM4X/U=";
+      hash = "sha256-jkIABnJZnn7A6n9VGs/MldzdDiKwWh0fEvl7Vqn85Kg=";
     };
     "3.11" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp311-cp311-manylinux2014_x86_64.whl";
-      hash = "sha256-xAITc/5KbAiaKp6020OWFD7SL3FQGvE0jQcHckIjb7s=";
+      hash = "sha256-dMUcRnHjl8NyUeO3P1x7CNgF0iAHFKIzUtHh+/CNkow=";
     };
     "3.12" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp312-cp312-manylinux2014_x86_64.whl";
-      hash = "sha256-tTbpoF/YINx2Vw1JNKsh3PqUbHqQ1XnQLGFczGmimCw=";
+      hash = "sha256-kXJ6bUwX+QybqYPV9Kpwv+lhdoGEFRr4+1T0vfXoWRo=";
     };
   };
 
diff --git a/nixpkgs/pkgs/development/python-modules/jaxlib/default.nix b/nixpkgs/pkgs/development/python-modules/jaxlib/default.nix
index 4293cc781cb8..27b9e61fbc82 100644
--- a/nixpkgs/pkgs/development/python-modules/jaxlib/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/jaxlib/default.nix
@@ -35,7 +35,6 @@
   # Runtime dependencies:
 , double-conversion
 , giflib
-, grpc
 , libjpeg_turbo
 , python
 , snappy
@@ -54,7 +53,7 @@ let
   inherit (cudaPackagesGoogle) backendStdenv cudatoolkit cudaFlags cudnn nccl;
 
   pname = "jaxlib";
-  version = "0.4.21";
+  version = "0.4.23";
 
   meta = with lib; {
     description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
@@ -98,7 +97,8 @@ let
     # Not packaged in nixpkgs
     # "com_github_googleapis_googleapis"
     # "com_github_googlecloudplatform_google_cloud_cpp"
-    "com_github_grpc_grpc"
+    # Issue with transitive dependencies after https://github.com/grpc/grpc/commit/f1d14f7f0b661bd200b7f269ef55dec870e7c108
+    # "com_github_grpc_grpc"
     # ERROR: /build/output/external/bazel_tools/tools/proto/BUILD:25:6: no such target '@com_google_protobuf//:cc_toolchain':
     # target 'cc_toolchain' not declared in package '' defined by /build/output/external/com_google_protobuf/BUILD.bazel
     # "com_google_protobuf"
@@ -150,7 +150,7 @@ let
       repo = "jax";
       # google/jax contains tags for jax and jaxlib. Only use jaxlib tags!
       rev = "refs/tags/${pname}-v${version}";
-      hash = "sha256-CMsW/t4/itJxN4pST8EKkN0ooHWdjRnLs073FwbXRJM=";
+      hash = "sha256-PDa3yVH/sszGbWkVkJ+19FdOr3oqdYk+OdbeUTMTDuU=";
     };
 
     nativeBuildInputs = [
@@ -169,7 +169,6 @@ let
       curl
       double-conversion
       giflib
-      grpc
       jsoncpp
       libjpeg_turbo
       numpy
@@ -263,10 +262,10 @@ let
       ];
 
       sha256 = (if cudaSupport then {
-        x86_64-linux = "sha256-TgIH7r1IXNkbOFSXvaKVbU9kL+TuQqxVrBge7iv2ykQ=";
+        x86_64-linux = "sha256-q2wRaoCGnISEdtF6jDMk9Wccy/wTmLusVBI7dDATwi4=";
       } else {
-        x86_64-linux = "sha256-on14CAolJ3mvJmKxX2PE21BsYOJJFUSQuUOnOuVR2GQ=";
-        aarch64-linux = "sha256-2tcIiQlMUKMc+juCy+dt37s+lFqr2pcVizCyYkkQtOM=";
+        x86_64-linux = "sha256-0cDJ27HCi3J5xeT6TkTtfUzF/yESBYmEVG1r14kPdRs=";
+        aarch64-linux = "sha256-WbaN8VYjeW0mDthmtoSTttqd4K/Z8dP5+VkTo10pLtU=";
       }).${stdenv.system} or (throw "jaxlib: unsupported system: ${stdenv.system}");
     };
 
@@ -336,7 +335,6 @@ buildPythonPackage {
     double-conversion
     flatbuffers
     giflib
-    grpc
     jsoncpp
     libjpeg_turbo
     ml-dtypes
diff --git a/nixpkgs/pkgs/development/python-modules/mitmproxy/default.nix b/nixpkgs/pkgs/development/python-modules/mitmproxy/default.nix
index e8c941fb950a..d64fbf32614a 100644
--- a/nixpkgs/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/mitmproxy/default.nix
@@ -44,7 +44,7 @@
 
 buildPythonPackage rec {
   pname = "mitmproxy";
-  version = "10.1.5";
+  version = "10.1.6";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     owner = "mitmproxy";
     repo = "mitmproxy";
     rev = "refs/tags/${version}";
-    hash = "sha256-WtZ5KPkTjYMCjrghVcihxuQ2cS88OOCbMYHfqzeo4qQ=";
+    hash = "sha256-W+gxK5bNCit1jK9ojwE/HVjUz6OJcNw6Ac1lN5FxGgw=";
   };
 
   propagatedBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/openai-triton/0000-dont-download-ptxas.patch b/nixpkgs/pkgs/development/python-modules/openai-triton/0000-dont-download-ptxas.patch
index 5038a5ba52e0..d31a4798af05 100644
--- a/nixpkgs/pkgs/development/python-modules/openai-triton/0000-dont-download-ptxas.patch
+++ b/nixpkgs/pkgs/development/python-modules/openai-triton/0000-dont-download-ptxas.patch
@@ -1,39 +1,15 @@
 diff --git a/python/setup.py b/python/setup.py
-index 2ac3accd2..f26161c72 100644
+index 18764ec13..b3bb5b60a 100644
 --- a/python/setup.py
 +++ b/python/setup.py
-@@ -101,25 +101,6 @@ def get_thirdparty_packages(triton_cache_path):
- # ---- package data ---
+@@ -269,10 +269,6 @@ class CMakeBuild(build_ext):
+         subprocess.check_call(["cmake", self.base_dir] + cmake_args, cwd=cmake_dir, env=env)
+         subprocess.check_call(["cmake", "--build", "."] + build_args, cwd=cmake_dir)
  
- 
--def download_and_copy_ptxas():
--    base_dir = os.path.dirname(__file__)
--    src_path = "bin/ptxas"
--    url = "https://conda.anaconda.org/nvidia/label/cuda-12.0.0/linux-64/cuda-nvcc-12.0.76-0.tar.bz2"
--    dst_prefix = os.path.join(base_dir, "triton")
--    dst_suffix = os.path.join("third_party", "cuda", src_path)
--    dst_path = os.path.join(dst_prefix, dst_suffix)
--    if not os.path.exists(dst_path):
--        print(f'downloading and extracting {url} ...')
--        ftpstream = urllib.request.urlopen(url)
--        file = tarfile.open(fileobj=ftpstream, mode="r|*")
--        with tempfile.TemporaryDirectory() as temp_dir:
--            file.extractall(path=temp_dir)
--            src_path = os.path.join(temp_dir, src_path)
--            os.makedirs(os.path.split(dst_path)[0], exist_ok=True)
--            shutil.copy(src_path, dst_path)
--    return dst_suffix
--
 -
- # ---- cmake extension ----
- 
- 
-@@ -200,8 +181,6 @@ class CMakeBuild(build_ext):
-         subprocess.check_call(["cmake", "--build", "."] + build_args, cwd=self.build_temp)
- 
- 
 -download_and_copy_ptxas()
 -
+-
  setup(
      name="triton",
-     version="2.0.0",
+     version="2.1.0",
diff --git a/nixpkgs/pkgs/development/python-modules/openai-triton/bin.nix b/nixpkgs/pkgs/development/python-modules/openai-triton/bin.nix
index a1a04fcf944b..f5a4148d28a7 100644
--- a/nixpkgs/pkgs/development/python-modules/openai-triton/bin.nix
+++ b/nixpkgs/pkgs/development/python-modules/openai-triton/bin.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "triton";
-  version = "2.0.0";
+  version = "2.1.0";
   format = "wheel";
 
   src =
@@ -62,7 +62,7 @@ buildPythonPackage rec {
     newStr = lib.concatMapStringsSep ", " quote new;
   in
     ''
-      substituteInPlace $out/${python.sitePackages}/triton/compiler.py \
+      substituteInPlace $out/${python.sitePackages}/triton/common/build.py \
         --replace '${oldStr}' '${newStr}'
     '');
 
diff --git a/nixpkgs/pkgs/development/python-modules/openai-triton/binary-hashes.nix b/nixpkgs/pkgs/development/python-modules/openai-triton/binary-hashes.nix
index a6baea5942b0..d5f588dc947c 100644
--- a/nixpkgs/pkgs/development/python-modules/openai-triton/binary-hashes.nix
+++ b/nixpkgs/pkgs/development/python-modules/openai-triton/binary-hashes.nix
@@ -6,26 +6,26 @@
 # To add a new version, run "prefetch.sh 'new-version'" to paste the generated file as follows.
 
 version : builtins.getAttr version {
-  "2.0.0" = {
+  "2.1.0" = {
     x86_64-linux-38 = {
-      name = "triton-2.0.0-1-cp38-cp38-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-2.0.0-1-cp38-cp38-manylinux2014_x86_64.manylinux_2_17_x86_64.whl";
-      hash = "sha256-nUl4KYt0/PWadf5x5TXAkrAjCIkzsvHfkz7DJhXkvu8=";
+      name = "triton-2.1.0-cp38-cp38-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-2.1.0-0-cp38-cp38-manylinux2014_x86_64.manylinux_2_17_x86_64.whl";
+      hash = "sha256-Ofb7a9zLPpjzFS4/vqck8a6ufXSUErux+pxEHUdOuiY=";
     };
     x86_64-linux-39 = {
-      name = "triton-2.0.0-1-cp39-cp39-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-2.0.0-1-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.whl";
-      hash = "sha256-dPEYwStDf7LKJeGgR1kXO1F1gvz0x74RkTMWx2QhNlY=";
+      name = "triton-2.1.0-cp39-cp39-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-2.1.0-0-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.whl";
+      hash = "sha256-IVROUiwCAFpibIrWPTm9/y8x1BBpWSkZ7ygelk7SZEY=";
     };
     x86_64-linux-310 = {
-      name = "triton-2.0.0-1-cp310-cp310-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-2.0.0-1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl";
-      hash = "sha256-OIBu6WY/Sw981keQ6WxXk3QInlj0mqxKZggSGqVeJQU=";
+      name = "triton-2.1.0-cp310-cp310-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-2.1.0-0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl";
+      hash = "sha256-ZkOZI6MNXUg5mwip6uEDcPbCYaXshkpkmDuuYxUtOdc=";
     };
     x86_64-linux-311 = {
-      name = "triton-2.0.0-1-cp311-cp311-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-2.0.0-1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl";
-      hash = "sha256-ImlBx7hZUhnd71mh/bgh6MdEKJoTJBXd1YT6zt60dbE=";
+      name = "triton-2.1.0-cp311-cp311-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-2.1.0-0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl";
+      hash = "sha256-kZsGRT8AM+pSwT6veDPeDlfbMXjSPU4E+fxxxPLDK/g=";
     };
   };
 }
diff --git a/nixpkgs/pkgs/development/python-modules/openai-triton/default.nix b/nixpkgs/pkgs/development/python-modules/openai-triton/default.nix
index e1ac9cb4cef6..46f1e6de5684 100644
--- a/nixpkgs/pkgs/development/python-modules/openai-triton/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/openai-triton/default.nix
@@ -2,10 +2,11 @@
 , config
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , addOpenGLRunpath
+, setuptools
 , pytestCheckHook
 , pythonRelaxDepsHook
-, pkgsTargetTarget
 , cmake
 , ninja
 , pybind11
@@ -23,46 +24,32 @@
 }:
 
 let
-  # A time may come we'll want to be cross-friendly
-  #
-  # Short explanation: we need pkgsTargetTarget, because we use string
-  # interpolation instead of buildInputs.
-  #
-  # Long explanation: OpenAI/triton downloads and vendors a copy of NVidia's
-  # ptxas compiler. We're not running this ptxas on the build machine, but on
-  # the user's machine, i.e. our Target platform. The second "Target" in
-  # pkgsTargetTarget maybe doesn't matter, because ptxas compiles programs to
-  # be executed on the GPU.
-  # Cf. https://nixos.org/manual/nixpkgs/unstable/#sec-cross-infra
-  ptxas = "${pkgsTargetTarget.cudaPackages.cuda_nvcc}/bin/ptxas"; # Make sure cudaPackages is the right version each update (See python/setup.py)
+  ptxas = "${cudaPackages.cuda_nvcc}/bin/ptxas"; # Make sure cudaPackages is the right version each update (See python/setup.py)
 in
 buildPythonPackage rec {
   pname = "triton";
-  version = "2.0.0";
-  format = "setuptools";
+  version = "2.1.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-9GZzugab+Pdt74Dj6zjlEzjj4BcJ69rzMJmqcVMxsKU=";
+    hash = "sha256-8UTUwLH+SriiJnpejdrzz9qIquP2zBp1/uwLdHmv0XQ=";
   };
 
   patches = [
-    # TODO: there have been commits upstream aimed at removing the "torch"
-    # circular dependency, but the patches fail to apply on the release
-    # revision. Keeping the link for future reference
-    # Also cf. https://github.com/openai/triton/issues/1374
-
-    # (fetchpatch {
-    #   url = "https://github.com/openai/triton/commit/fc7c0b0e437a191e421faa61494b2ff4870850f1.patch";
-    #   hash = "sha256-f0shIqHJkVvuil2Yku7vuqWFn7VCRKFSFjYRlwx25ig=";
-    # })
+    # fix overflow error
+    (fetchpatch {
+      url = "https://github.com/openai/triton/commit/52c146f66b79b6079bcd28c55312fc6ea1852519.patch";
+      hash = "sha256-098/TCQrzvrBAbQiaVGCMaF3o5Yc3yWDxzwSkzIuAtY=";
+    })
   ] ++ lib.optionals (!cudaSupport) [
     ./0000-dont-download-ptxas.patch
   ];
 
   nativeBuildInputs = [
+    setuptools
     pythonRelaxDepsHook
     # pytestCheckHook # Requires torch (circular dependency) and probably needs GPUs:
     cmake
@@ -111,7 +98,7 @@ buildPythonPackage rec {
       --replace "include(GoogleTest)" "find_package(GTest REQUIRED)"
   '' + lib.optionalString cudaSupport ''
     # Use our linker flags
-    substituteInPlace python/triton/compiler.py \
+    substituteInPlace python/triton/common/build.py \
       --replace '${oldStr}' '${newStr}'
   '';
 
diff --git a/nixpkgs/pkgs/development/python-modules/openai-triton/prefetch.sh b/nixpkgs/pkgs/development/python-modules/openai-triton/prefetch.sh
index 07e39e176dba..f218718a5cf3 100755
--- a/nixpkgs/pkgs/development/python-modules/openai-triton/prefetch.sh
+++ b/nixpkgs/pkgs/development/python-modules/openai-triton/prefetch.sh
@@ -8,10 +8,10 @@ version=$1
 linux_bucket="https://download.pytorch.org/whl"
 
 url_and_key_list=(
-  "x86_64-linux-38 $linux_bucket/triton-${version}-1-cp38-cp38-manylinux2014_x86_64.manylinux_2_17_x86_64.whl triton-${version}-cp38-cp38-linux_x86_64.whl"
-  "x86_64-linux-39 $linux_bucket/triton-${version}-1-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.whl triton-${version}-cp39-cp39-linux_x86_64.whl"
-  "x86_64-linux-310 $linux_bucket/triton-${version}-1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl triton-${version}-cp310-cp310-linux_x86_64.whl"
-  "x86_64-linux-311 $linux_bucket/triton-${version}-1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl triton-${version}-cp311-cp311-linux_x86_64.whl"
+  "x86_64-linux-38 $linux_bucket/triton-${version}-0-cp38-cp38-manylinux2014_x86_64.manylinux_2_17_x86_64.whl triton-${version}-cp38-cp38-linux_x86_64.whl"
+  "x86_64-linux-39 $linux_bucket/triton-${version}-0-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.whl triton-${version}-cp39-cp39-linux_x86_64.whl"
+  "x86_64-linux-310 $linux_bucket/triton-${version}-0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl triton-${version}-cp310-cp310-linux_x86_64.whl"
+  "x86_64-linux-311 $linux_bucket/triton-${version}-0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl triton-${version}-cp311-cp311-linux_x86_64.whl"
 )
 
 hashfile=binary-hashes-"$version".nix
diff --git a/nixpkgs/pkgs/development/python-modules/oras/default.nix b/nixpkgs/pkgs/development/python-modules/oras/default.nix
new file mode 100644
index 000000000000..6dd42eeca3db
--- /dev/null
+++ b/nixpkgs/pkgs/development/python-modules/oras/default.nix
@@ -0,0 +1,54 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, jsonschema
+, pytestCheckHook
+, pythonOlder
+, requests
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "oras";
+  version = "0.1.26";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "oras-project";
+    repo = "oras-py";
+    rev = "refs/tags/${version}";
+    hash = "sha256-t3098ZeAkwLhinyrFwmi7KKrFgZZKPN6qvp3REQNwG8=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    jsonschema
+    requests
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "oras"
+  ];
+
+  disabledTests = [
+    # Test requires network access
+    "test_get_many_tags"
+  ];
+
+  meta = with lib; {
+    description = "ORAS Python SDK";
+    homepage = "https://github.com/oras-project/oras-py";
+    changelog = "https://github.com/oras-project/oras-py/blob/${version}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/nixpkgs/pkgs/development/python-modules/teslajsonpy/default.nix b/nixpkgs/pkgs/development/python-modules/teslajsonpy/default.nix
index fe840bcd4e2c..0c2b87bade1c 100644
--- a/nixpkgs/pkgs/development/python-modules/teslajsonpy/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/teslajsonpy/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "teslajsonpy";
-  version = "3.9.7";
+  version = "3.9.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "zabuldon";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-A59b7qr9Y4LuIwP51ci7k1019/T+qNcDYPDNCkmqpi4=";
+    hash = "sha256-9ySUgRz1Zp0tkHCEkDcygm97mji4mjA5ltrriP9zAiQ=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/python-modules/torch/bin.nix b/nixpkgs/pkgs/development/python-modules/torch/bin.nix
index 74eefd071890..7a4756e905cc 100644
--- a/nixpkgs/pkgs/development/python-modules/torch/bin.nix
+++ b/nixpkgs/pkgs/development/python-modules/torch/bin.nix
@@ -24,7 +24,7 @@ let
   pyVerNoDot = builtins.replaceStrings [ "." ] [ "" ] python.pythonVersion;
   srcs = import ./binary-hashes.nix version;
   unsupported = throw "Unsupported system";
-  version = "2.1.1";
+  version = "2.1.2";
 in buildPythonPackage {
   inherit version;
 
diff --git a/nixpkgs/pkgs/development/python-modules/torch/binary-hashes.nix b/nixpkgs/pkgs/development/python-modules/torch/binary-hashes.nix
index 42eed4485ebf..b22d01262065 100644
--- a/nixpkgs/pkgs/development/python-modules/torch/binary-hashes.nix
+++ b/nixpkgs/pkgs/development/python-modules/torch/binary-hashes.nix
@@ -6,86 +6,86 @@
 # To add a new version, run "prefetch.sh 'new-version'" to paste the generated file as follows.
 
 version : builtins.getAttr version {
-  "2.1.1" = {
+  "2.1.2" = {
     x86_64-linux-38 = {
-      name = "torch-2.1.1-cp38-cp38-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu121/torch-2.1.1%2Bcu121-cp38-cp38-linux_x86_64.whl";
-      hash = "sha256-h8y2g+ZCqYuO8FRV722GRntiB1pDJfTV+aouiTL2Bzk=";
+      name = "torch-2.1.2-cp38-cp38-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu121/torch-2.1.2%2Bcu121-cp38-cp38-linux_x86_64.whl";
+      hash = "sha256-2qF5u1WPePIWXbl0pnROyN4upx62qvNiva52FgEsAwI=";
     };
     x86_64-linux-39 = {
-      name = "torch-2.1.1-cp39-cp39-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu121/torch-2.1.1%2Bcu121-cp39-cp39-linux_x86_64.whl";
-      hash = "sha256-KCRfYtEHPCfW8N4DqBrUnVMzxGBlke2I/tHtuX8FUz0=";
+      name = "torch-2.1.2-cp39-cp39-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu121/torch-2.1.2%2Bcu121-cp39-cp39-linux_x86_64.whl";
+      hash = "sha256-6q9pB+NyPAymqR314Bp+74yr7JMSDppQc59aXxSiqkY=";
     };
     x86_64-linux-310 = {
-      name = "torch-2.1.1-cp310-cp310-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu121/torch-2.1.1%2Bcu121-cp310-cp310-linux_x86_64.whl";
-      hash = "sha256-7HbRE1DI6IejTTZgLNN/UGObyc2p+upNQ/IHDpeS5KQ=";
+      name = "torch-2.1.2-cp310-cp310-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu121/torch-2.1.2%2Bcu121-cp310-cp310-linux_x86_64.whl";
+      hash = "sha256-shhLdynvO5sQBlwHSjfB5gP9mfkeODduJct+1uHVRpY=";
     };
     x86_64-linux-311 = {
-      name = "torch-2.1.1-cp311-cp311-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu121/torch-2.1.1%2Bcu121-cp311-cp311-linux_x86_64.whl";
-      hash = "sha256-g7/hE036irhlU8Fdpd/6GQqG2CKvr+jqbeEWnBDZcao=";
+      name = "torch-2.1.2-cp311-cp311-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu121/torch-2.1.2%2Bcu121-cp311-cp311-linux_x86_64.whl";
+      hash = "sha256-ygXK6TNFBNGQPhbFDd8EUymoWdWxon7S3B1Y7QZt9vo=";
     };
     x86_64-darwin-38 = {
-      name = "torch-2.1.1-cp38-none-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.1.1-cp38-none-macosx_10_9_x86_64.whl";
-      hash = "sha256-1WsDIXZFjir0cJYnu9LCD+KRfv+M0Ien/jE6zM9c4vE=";
+      name = "torch-2.1.2-cp38-none-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.1.2-cp38-none-macosx_10_9_x86_64.whl";
+      hash = "sha256-jiId7M0N72wrrf9r5APgxTSRgF7ZkV4sAprbzbh6trU=";
     };
     x86_64-darwin-39 = {
-      name = "torch-2.1.1-cp39-none-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.1.1-cp39-none-macosx_10_9_x86_64.whl";
-      hash = "sha256-cVtQ2MHeXaVSSmgofrAA9z4CbnTV9rErxFDvaZX89fk=";
+      name = "torch-2.1.2-cp39-none-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.1.2-cp39-none-macosx_10_9_x86_64.whl";
+      hash = "sha256-aYTNUFfAyXezyXVyVOmJ0/EST0zp0HyqbLY3eDxx1Co=";
     };
     x86_64-darwin-310 = {
-      name = "torch-2.1.1-cp310-none-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.1.1-cp310-none-macosx_10_9_x86_64.whl";
-      hash = "sha256-Hh5frd1DqPLA4OIr6s0eI1ouRHeU2AdIPJSp4xtUp1g=";
+      name = "torch-2.1.2-cp310-none-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.1.2-cp310-none-macosx_10_9_x86_64.whl";
+      hash = "sha256-2bU1ytDfPROZfb6L1orDPg465Td2OcmIGUjkB5SmFAM=";
     };
     x86_64-darwin-311 = {
-      name = "torch-2.1.1-cp311-none-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.1.1-cp311-none-macosx_10_9_x86_64.whl";
-      hash = "sha256-pwWTgG8dfmtTZX2WgQUY2g+I7yYIyYpAKVV2W4x51Sw=";
+      name = "torch-2.1.2-cp311-none-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.1.2-cp311-none-macosx_10_9_x86_64.whl";
+      hash = "sha256-dtN5Z8McmVSK0sTT8s8ZHbSEdvLmmzWgk3E3EW2jVqE=";
     };
     aarch64-darwin-38 = {
-      name = "torch-2.1.1-cp38-none-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.1.1-cp38-none-macosx_11_0_arm64.whl";
-      hash = "sha256-KeO5CowoH2ZggEqTnR9CGGBMgBYuUh4ebYyFVzJZAqA=";
+      name = "torch-2.1.2-cp38-none-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.1.2-cp38-none-macosx_11_0_arm64.whl";
+      hash = "sha256-BbGFlPYKkRoMTwI/OKi9p3Ex+6X9dBvaYm6X3PWj3Qo=";
     };
     aarch64-darwin-39 = {
-      name = "torch-2.1.1-cp39-none-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.1.1-cp39-none-macosx_11_0_arm64.whl";
-      hash = "sha256-22foclx29Mf08C51UbsW6BuhoZEoZ7w117uW0r6MeLQ=";
+      name = "torch-2.1.2-cp39-none-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.1.2-cp39-none-macosx_11_0_arm64.whl";
+      hash = "sha256-vBldeSf+q8DrfBEORXyVXtKrYW88fChDndQYjPWJaZ8=";
     };
     aarch64-darwin-310 = {
-      name = "torch-2.1.1-cp310-none-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.1.1-cp310-none-macosx_11_0_arm64.whl";
-      hash = "sha256-52vzxcNUh08dpGXIUqL7YO5svOMG6TUzeIV2DwgPm6o=";
+      name = "torch-2.1.2-cp310-none-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.1.2-cp310-none-macosx_11_0_arm64.whl";
+      hash = "sha256-+aVdVa8Cgm6/ut9Om2gvDyd2a8M9+CNrSNKNcFWHho8=";
     };
     aarch64-darwin-311 = {
-      name = "torch-2.1.1-cp311-none-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.1.1-cp311-none-macosx_11_0_arm64.whl";
-      hash = "sha256-4xL36C5JVl92Z7C7+VWasMWXBj2TBEdAeBwCrNWoeXg=";
+      name = "torch-2.1.2-cp311-none-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.1.2-cp311-none-macosx_11_0_arm64.whl";
+      hash = "sha256-4tg/B7SqyYNFPqW/j5qp2s8ieKjTEkf12QN/N778YOQ=";
     };
     aarch64-linux-38 = {
-      name = "torch-2.1.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.1.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      hash = "sha256-nKD8vz1bpkTWqFcsg6mrvfX3/1dbw4Up72wYWjpxvek=";
+      name = "torch-2.1.2-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.1.2-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
+      hash = "sha256-4yJfR9ULtm91b+kZanaAVdHCawIVTrH3cM5HoleNOqc=";
     };
     aarch64-linux-39 = {
-      name = "torch-2.1.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.1.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      hash = "sha256-sxIwvQWEJOVtun+JkoDbxqyLmUjkOQLgyEpEZmsewVE=";
+      name = "torch-2.1.2-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.1.2-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
+      hash = "sha256-2TunD2ewjCrlWY7nEcvFRqG8gQLO+TiQS4yFwgiaUaA=";
     };
     aarch64-linux-310 = {
-      name = "torch-2.1.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.1.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      hash = "sha256-hP79YzVkFsDNIFeGN8zbuCFkmTQA7Re1fJUd1jdtzug=";
+      name = "torch-2.1.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.1.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
+      hash = "sha256-vvaZbCfY9ukupOE6dy2JYR2g4QO0h5DeeBMeMIz3MHY=";
     };
     aarch64-linux-311 = {
-      name = "torch-2.1.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.1.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      hash = "sha256-YbUbM8YXN8KHBYsMMGHmqdPDY4Y+SglPgEvEhoiKGIo=";
+      name = "torch-2.1.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.1.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
+      hash = "sha256-jzLOWRYWowME83p9XqgLacqeG5S7p/MIGEv2Fv2uoVU=";
     };
   };
 }
diff --git a/nixpkgs/pkgs/development/python-modules/torch/default.nix b/nixpkgs/pkgs/development/python-modules/torch/default.nix
index 3228bee1434c..8fb227cbd36b 100644
--- a/nixpkgs/pkgs/development/python-modules/torch/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/torch/default.nix
@@ -125,7 +125,7 @@ let
 in buildPythonPackage rec {
   pname = "torch";
   # Don't forget to update torch-bin to the same version.
-  version = "2.1.1";
+  version = "2.1.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8.0";
@@ -143,7 +143,7 @@ in buildPythonPackage rec {
     repo = "pytorch";
     rev = "refs/tags/v${version}";
     fetchSubmodules = true;
-    hash = "sha256-01+uqHvPbQVXKLohGWfsCsZOjb7xmfjBKkTGUGMEdAI=";
+    hash = "sha256-E/GQCRWBf3hYsDCCk0twaL9gkVOCEQeCvO3Va+jgIdE=";
   };
 
   patches = lib.optionals cudaSupport [
diff --git a/nixpkgs/pkgs/development/python-modules/torchaudio/bin.nix b/nixpkgs/pkgs/development/python-modules/torchaudio/bin.nix
index 5ad263a8df67..c3567506337d 100644
--- a/nixpkgs/pkgs/development/python-modules/torchaudio/bin.nix
+++ b/nixpkgs/pkgs/development/python-modules/torchaudio/bin.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "torchaudio";
-  version = "2.1.1";
+  version = "2.1.2";
   format = "wheel";
 
   src =
diff --git a/nixpkgs/pkgs/development/python-modules/torchaudio/binary-hashes.nix b/nixpkgs/pkgs/development/python-modules/torchaudio/binary-hashes.nix
index 21241253da3f..964e122168f7 100644
--- a/nixpkgs/pkgs/development/python-modules/torchaudio/binary-hashes.nix
+++ b/nixpkgs/pkgs/development/python-modules/torchaudio/binary-hashes.nix
@@ -6,86 +6,86 @@
 # To add a new version, run "prefetch.sh 'new-version'" to paste the generated file as follows.
 
 version : builtins.getAttr version {
-  "2.1.1" = {
+  "2.1.2" = {
     x86_64-linux-38 = {
-      name = "torchaudio-2.1.1-cp38-cp38-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu121/torchaudio-2.1.1%2Bcu121-cp38-cp38-linux_x86_64.whl";
-      hash = "sha256-GM8TlEbiLP2K+jglzkkvPPEf00LxcI7o9K+EtIKLTGA=";
+      name = "torchaudio-2.1.2-cp38-cp38-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu121/torchaudio-2.1.2%2Bcu121-cp38-cp38-linux_x86_64.whl";
+      hash = "sha256-nptbhxqUhL5rUK687w+M8Cb5w9MLhtfEz0mHbDAwGBU=";
     };
     x86_64-linux-39 = {
-      name = "torchaudio-2.1.1-cp39-cp39-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu121/torchaudio-2.1.1%2Bcu121-cp39-cp39-linux_x86_64.whl";
-      hash = "sha256-4YdH1mdew+TFmvpA23Lp5+pNcVy5KxQ9pV31lhPAPTA=";
+      name = "torchaudio-2.1.2-cp39-cp39-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu121/torchaudio-2.1.2%2Bcu121-cp39-cp39-linux_x86_64.whl";
+      hash = "sha256-L1s1TSIGHHm4fdDBoIQamQVtMuqNuIIf2NZz1rB3wbI=";
     };
     x86_64-linux-310 = {
-      name = "torchaudio-2.1.1-cp310-cp310-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu121/torchaudio-2.1.1%2Bcu121-cp310-cp310-linux_x86_64.whl";
-      hash = "sha256-7/gmDgL4imlKlksrtvY3pq8xB3h9kH6uflgBgWAzv6c=";
+      name = "torchaudio-2.1.2-cp310-cp310-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu121/torchaudio-2.1.2%2Bcu121-cp310-cp310-linux_x86_64.whl";
+      hash = "sha256-HoqSB2Mei6bsve48nWbx6dQ4rWKwtNTxhAFti+idaKc=";
     };
     x86_64-linux-311 = {
-      name = "torchaudio-2.1.1-cp311-cp311-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu121/torchaudio-2.1.1%2Bcu121-cp311-cp311-linux_x86_64.whl";
-      hash = "sha256-qq2dkQ5CDBlVsIpa8yatlplLitDQWW/L9gGxVYDof6c=";
+      name = "torchaudio-2.1.2-cp311-cp311-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu121/torchaudio-2.1.2%2Bcu121-cp311-cp311-linux_x86_64.whl";
+      hash = "sha256-jFpvXk1EDXfU/KxVFV7/xGSpkGIddkinFVZ7eJWr8nU=";
     };
     x86_64-darwin-38 = {
-      name = "torchaudio-2.1.1-cp38-cp38-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.1-cp38-cp38-macosx_10_13_x86_64.whl";
-      hash = "sha256-b8d8SNB5zSbvQMYTqm8xxcePD4FiEWYqJ4Vsf1RPHMw=";
+      name = "torchaudio-2.1.2-cp38-cp38-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.2-cp38-cp38-macosx_10_13_x86_64.whl";
+      hash = "sha256-0O/QCMNd7JYrgPXc40aL0biDAc9lFSu/p/dMAAWhfok=";
     };
     x86_64-darwin-39 = {
-      name = "torchaudio-2.1.1-cp39-cp39-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.1-cp39-cp39-macosx_10_13_x86_64.whl";
-      hash = "sha256-f/BYndc9vepm7SHIF8ttHvjs0+6EmXrqf8DjUroWjkg=";
+      name = "torchaudio-2.1.2-cp39-cp39-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.2-cp39-cp39-macosx_10_13_x86_64.whl";
+      hash = "sha256-rlDc801cb3MYDPaUGV7jEZS51gkDKFdcMKWWC8cW+lI=";
     };
     x86_64-darwin-310 = {
-      name = "torchaudio-2.1.1-cp310-cp310-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.1-cp310-cp310-macosx_10_13_x86_64.whl";
-      hash = "sha256-JPpYcPYgmU5FiEUtVO3LL/tfUJ1+42ugToxo6yiv/Io=";
+      name = "torchaudio-2.1.2-cp310-cp310-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.2-cp310-cp310-macosx_10_13_x86_64.whl";
+      hash = "sha256-BvjAKBTmzdeGJrv0StK7ivpbOatlDGrxgyijIxFGEFg=";
     };
     x86_64-darwin-311 = {
-      name = "torchaudio-2.1.1-cp311-cp311-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.1-cp311-cp311-macosx_10_13_x86_64.whl";
-      hash = "sha256-7j9/B9sCOprjYGpjDbRyJ+d/IOYEyZQGdnzsWKE5uW4=";
+      name = "torchaudio-2.1.2-cp311-cp311-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.2-cp311-cp311-macosx_10_13_x86_64.whl";
+      hash = "sha256-wQhO7fTO0a+f3RiRBpD/YV+JuuswsyAwgGVD+8bzZX4=";
     };
     aarch64-darwin-38 = {
-      name = "torchaudio-2.1.1-cp38-cp38-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.1-cp38-cp38-macosx_11_0_arm64.whl";
-      hash = "sha256-L+SgvGuooE9xrLxmT93CtzY3y/G+NFxkM0KprtNDVDo=";
+      name = "torchaudio-2.1.2-cp38-cp38-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.2-cp38-cp38-macosx_11_0_arm64.whl";
+      hash = "sha256-MK2XESQSWSUYlT88ws0bauFT1lY91b2eq2qXIxX+nZ4=";
     };
     aarch64-darwin-39 = {
-      name = "torchaudio-2.1.1-cp39-cp39-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.1-cp39-cp39-macosx_11_0_arm64.whl";
-      hash = "sha256-VwmUP7JnXIVDvrYfAz+50AGr8VXxUJrzPhO8uD9UPQo=";
+      name = "torchaudio-2.1.2-cp39-cp39-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.2-cp39-cp39-macosx_11_0_arm64.whl";
+      hash = "sha256-FHKcyd9S3vpnT89e1N4NZQcDjvGAErlqL1anftcGdt0=";
     };
     aarch64-darwin-310 = {
-      name = "torchaudio-2.1.1-cp310-cp310-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.1-cp310-cp310-macosx_11_0_arm64.whl";
-      hash = "sha256-fNRlvgb9OHNq2n1MCG8M3SSd4ot1ddEDXOJd+ziW+kw=";
+      name = "torchaudio-2.1.2-cp310-cp310-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.2-cp310-cp310-macosx_11_0_arm64.whl";
+      hash = "sha256-nWdmc8HOTdEfyhReOmzZtOW4l8/60PYX0pBvLT/Iw6k=";
     };
     aarch64-darwin-311 = {
-      name = "torchaudio-2.1.1-cp311-cp311-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.1-cp311-cp311-macosx_11_0_arm64.whl";
-      hash = "sha256-+tHGDPveoxu7KgDk0fFTYEYG3N00vJdPQ8YvpuJpYns=";
+      name = "torchaudio-2.1.2-cp311-cp311-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.1.2-cp311-cp311-macosx_11_0_arm64.whl";
+      hash = "sha256-hgrMMuZQcGPywT2B4mcYGZ4hXzSivNbJYJol6b8hqjY=";
     };
     aarch64-linux-38 = {
-      name = "torchaudio-2.1.1-cp38-cp38-manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/torchaudio-2.1.1-cp38-cp38-linux_aarch64.whl";
-      hash = "sha256-bnhAF5QfPoGtvvJGIkqT1eXSZocF3NxFlWZo3nuiLTI=";
+      name = "torchaudio-2.1.2-cp38-cp38-manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/torchaudio-2.1.2-cp38-cp38-linux_aarch64.whl";
+      hash = "sha256-/3FWsw6wXpEkKGwwyA2oS5PiJ9AJrblusZSJYAtFkzI=";
     };
     aarch64-linux-39 = {
-      name = "torchaudio-2.1.1-cp39-cp39-manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/torchaudio-2.1.1-cp39-cp39-linux_aarch64.whl";
-      hash = "sha256-FXE1qdeNwSe7J0XEZUqn6hQd3Huzn8rSHf+Oq6VXihQ=";
+      name = "torchaudio-2.1.2-cp39-cp39-manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/torchaudio-2.1.2-cp39-cp39-linux_aarch64.whl";
+      hash = "sha256-s7u1Mk5wXe13YW5UZZGySa51iNNaPowsTB2Yal6lHvQ=";
     };
     aarch64-linux-310 = {
-      name = "torchaudio-2.1.1-cp310-cp310-manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/torchaudio-2.1.1-cp310-cp310-linux_aarch64.whl";
-      hash = "sha256-dK3UoOX6BJmO1SoBN9Ox2cKtJdqCEsRt8O1z+h0Uanc=";
+      name = "torchaudio-2.1.2-cp310-cp310-manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/torchaudio-2.1.2-cp310-cp310-linux_aarch64.whl";
+      hash = "sha256-+CZX/E7DtHO/bHUsDuYtf1Ea+e835RQ/gznsBJUE12c=";
     };
     aarch64-linux-311 = {
-      name = "torchaudio-2.1.1-cp311-cp311-manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/torchaudio-2.1.1-cp311-cp311-linux_aarch64.whl";
-      hash = "sha256-6toEKY1TfF0CddoRIsRxmMF31CYetaXSI24Rqg6FyB8=";
+      name = "torchaudio-2.1.2-cp311-cp311-manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/torchaudio-2.1.2-cp311-cp311-linux_aarch64.whl";
+      hash = "sha256-mmut6KJJWnJPTuastehoKP9Ag9xsfFfGOGtUoOp6/nE=";
     };
   };
 }
diff --git a/nixpkgs/pkgs/development/python-modules/torchaudio/default.nix b/nixpkgs/pkgs/development/python-modules/torchaudio/default.nix
index f09175547ebf..81863b4dec18 100644
--- a/nixpkgs/pkgs/development/python-modules/torchaudio/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/torchaudio/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "torchaudio";
-  version = "2.1.1";
+  version = "2.1.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "audio";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5UlnOGXXFu1p9M5B+Ixc9DW5hLZ1nskv81Y+McbWu6Q=";
+    hash = "sha256-kSBDQtOi0ZEnIg801kTtvqBAEbzaUNhWG/9jot2O3o4=";
   };
 
   patches = [
diff --git a/nixpkgs/pkgs/development/python-modules/torchvision/bin.nix b/nixpkgs/pkgs/development/python-modules/torchvision/bin.nix
index 574476ef8777..3f4afca9f308 100644
--- a/nixpkgs/pkgs/development/python-modules/torchvision/bin.nix
+++ b/nixpkgs/pkgs/development/python-modules/torchvision/bin.nix
@@ -16,7 +16,7 @@ let
   pyVerNoDot = builtins.replaceStrings [ "." ] [ "" ] python.pythonVersion;
   srcs = import ./binary-hashes.nix version;
   unsupported = throw "Unsupported system";
-  version = "0.16.1";
+  version = "0.16.2";
 in buildPythonPackage {
   inherit version;
 
diff --git a/nixpkgs/pkgs/development/python-modules/torchvision/binary-hashes.nix b/nixpkgs/pkgs/development/python-modules/torchvision/binary-hashes.nix
index f560d78baaa4..713228240cab 100644
--- a/nixpkgs/pkgs/development/python-modules/torchvision/binary-hashes.nix
+++ b/nixpkgs/pkgs/development/python-modules/torchvision/binary-hashes.nix
@@ -6,66 +6,66 @@
 # To add a new version, run "prefetch.sh 'new-version'" to paste the generated file as follows.
 
 version : builtins.getAttr version {
-  "0.16.1" = {
+  "0.16.2" = {
     x86_64-linux-38 = {
-      name = "torchvision-0.16.1-cp38-cp38-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu121/torchvision-0.16.1%2Bcu121-cp38-cp38-linux_x86_64.whl";
-      hash = "sha256-xPO1sRtw2yyLBlrp3kduqc6yrVc8fFgGi+CXWkABgrQ=";
+      name = "torchvision-0.16.2-cp38-cp38-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu121/torchvision-0.16.2%2Bcu121-cp38-cp38-linux_x86_64.whl";
+      hash = "sha256-AmZyfQifUSqpAK6tKQhTD1TZB3eEveHnykb2a49Wfpg=";
     };
     x86_64-linux-39 = {
-      name = "torchvision-0.16.1-cp39-cp39-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu121/torchvision-0.16.1%2Bcu121-cp39-cp39-linux_x86_64.whl";
-      hash = "sha256-1voLyIMnBZI9kBleyb819IhwW0nAFEizcCy3t9ebVPk=";
+      name = "torchvision-0.16.2-cp39-cp39-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu121/torchvision-0.16.2%2Bcu121-cp39-cp39-linux_x86_64.whl";
+      hash = "sha256-qhMlpuBBYD3uzvxWnmS4x1psmhuHbimi3vKYuoRWR00=";
     };
     x86_64-linux-310 = {
-      name = "torchvision-0.16.1-cp310-cp310-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu121/torchvision-0.16.1%2Bcu121-cp310-cp310-linux_x86_64.whl";
-      hash = "sha256-AglL7N9dxCpq/iGQ4ayz8y3ZwtOt2Cfd/pG1RMwjrfQ=";
+      name = "torchvision-0.16.2-cp310-cp310-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu121/torchvision-0.16.2%2Bcu121-cp310-cp310-linux_x86_64.whl";
+      hash = "sha256-uqeXDGtUNzEuXdC9DyVxogt4bD4oW6/W7T5PYqXDx24=";
     };
     x86_64-linux-311 = {
-      name = "torchvision-0.16.1-cp311-cp311-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu121/torchvision-0.16.1%2Bcu121-cp311-cp311-linux_x86_64.whl";
-      hash = "sha256-tO7B2cBOsDa05yrqX0OuM8BkFNqdNjkb0E/9Ma2C+6k=";
+      name = "torchvision-0.16.2-cp311-cp311-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu121/torchvision-0.16.2%2Bcu121-cp311-cp311-linux_x86_64.whl";
+      hash = "sha256-CS1ZEQqf7PfDtE0YsbWqELqJjiVB4HtnT+WSaFIeuMs=";
     };
     x86_64-darwin-38 = {
-      name = "torchvision-0.16.1-cp38-cp38-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.1-cp38-cp38-macosx_10_13_x86_64.whl";
-      hash = "sha256-TyytYh+5bPEOKa+T4WyYsyJr3VOucStX6HPD3q8GFhc=";
+      name = "torchvision-0.16.2-cp38-cp38-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.2-cp38-cp38-macosx_10_13_x86_64.whl";
+      hash = "sha256-uCcy3Ph2o3yFJ3I0KqbuNIDAO7PiqAKuEJ/F9+KNJuk=";
     };
     x86_64-darwin-39 = {
-      name = "torchvision-0.16.1-cp39-cp39-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.1-cp39-cp39-macosx_10_13_x86_64.whl";
-      hash = "sha256-8U0gHDcXbcQQbux2sinWWFoVBSZrjOqZ0zZv04iXt8A=";
+      name = "torchvision-0.16.2-cp39-cp39-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.2-cp39-cp39-macosx_10_13_x86_64.whl";
+      hash = "sha256-VhFSaLN/C3U2TjZU5HrZq8Zqw0wfnl49+omiLWpAAXo=";
     };
     x86_64-darwin-310 = {
-      name = "torchvision-0.16.1-cp310-cp310-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.1-cp310-cp310-macosx_10_13_x86_64.whl";
-      hash = "sha256-mHEyeV5cA3y3TnvjWmk5mf2y9gMVImbuFbgCBug6Www=";
+      name = "torchvision-0.16.2-cp310-cp310-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.2-cp310-cp310-macosx_10_13_x86_64.whl";
+      hash = "sha256-vIbygAyywMGgnFgUCc3Wv/ZuYvED3IP8Y/czRiZMN1Y=";
     };
     x86_64-darwin-311 = {
-      name = "torchvision-0.16.1-cp311-cp311-macosx_10_9_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.1-cp311-cp311-macosx_10_13_x86_64.whl";
-      hash = "sha256-Supc9JHGwhscvbsb8qODilnU25OtX0kBmmVk08pxJ8c=";
+      name = "torchvision-0.16.2-cp311-cp311-macosx_10_9_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.2-cp311-cp311-macosx_10_13_x86_64.whl";
+      hash = "sha256-Z7Gq+LjLAs513URfKRonyANqUC+MCqduKMN6D6rC4VM=";
     };
     aarch64-darwin-38 = {
-      name = "torchvision-0.16.1-cp38-cp38-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.1-cp38-cp38-macosx_11_0_arm64.whl";
-      hash = "sha256-HWFLPJ4t6c11zA5OGSP8+7zZ/bnwigu7v34TXkoKHPo=";
+      name = "torchvision-0.16.2-cp38-cp38-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.2-cp38-cp38-macosx_11_0_arm64.whl";
+      hash = "sha256-SwZRQ9GnIP6KkHf9S+NdSR+YgZ7ICz27w+xk0LcHqQY=";
     };
     aarch64-darwin-39 = {
-      name = "torchvision-0.16.1-cp39-cp39-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.1-cp39-cp39-macosx_11_0_arm64.whl";
-      hash = "sha256-oV6IqTp1Acx1t2Gi3NB6rtqvnL+vSMiv+oyYmJ7LsZ0=";
+      name = "torchvision-0.16.2-cp39-cp39-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.2-cp39-cp39-macosx_11_0_arm64.whl";
+      hash = "sha256-goBfhEWwlPnR53A5DubMhoVeiZVeCM40ry4idPwOXEU=";
     };
     aarch64-darwin-310 = {
-      name = "torchvision-0.16.1-cp310-cp310-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.1-cp310-cp310-macosx_11_0_arm64.whl";
-      hash = "sha256-JdpqeyLqA0j2LEXsDa8VdzEJa6vK5l0iJAQIGvluCFw=";
+      name = "torchvision-0.16.2-cp310-cp310-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.2-cp310-cp310-macosx_11_0_arm64.whl";
+      hash = "sha256-sCS9QS3206AH3OvzEaiU6zxcIeGvgNEr44K7ywl6fDo=";
     };
     aarch64-darwin-311 = {
-      name = "torchvision-0.16.1-cp311-cp311-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.1-cp311-cp311-macosx_11_0_arm64.whl";
-      hash = "sha256-M5F1cWdjes4+8zpnydXvhrH4y9k+qlutRe688mbqYIk=";
+      name = "torchvision-0.16.2-cp311-cp311-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.16.2-cp311-cp311-macosx_11_0_arm64.whl";
+      hash = "sha256-vvMNA+HRxil2H03KUdO32KDcCszm9AaKsqFjTo57ZOA=";
     };
   };
 }
diff --git a/nixpkgs/pkgs/development/python-modules/torchvision/default.nix b/nixpkgs/pkgs/development/python-modules/torchvision/default.nix
index f2db9c3d1550..fc8526395f94 100644
--- a/nixpkgs/pkgs/development/python-modules/torchvision/default.nix
+++ b/nixpkgs/pkgs/development/python-modules/torchvision/default.nix
@@ -8,18 +8,16 @@
 , pillow
 , pytest
 , scipy
-, symlinkJoin
 , torch
 , which
 }:
 
 let
   inherit (torch) cudaCapabilities cudaPackages cudaSupport;
-  inherit (cudaPackages) backendStdenv cudaVersion;
+  inherit (cudaPackages) backendStdenv;
 
   pname = "torchvision";
-  version = "0.16.1";
-  format = "setuptools";
+  version = "0.16.2";
 in
 buildPythonPackage {
   inherit pname version;
@@ -28,7 +26,7 @@ buildPythonPackage {
     owner = "pytorch";
     repo = "vision";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TsYBDtedTQ3+F3LM4JwzkGH2XOr0WSp1Au5YoR07rSA=";
+    hash = "sha256-fSFoMZbF0bYqonvgoNAE8ZzwCsjhCdVo2BJ0pOC2zd0=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/development/tools/esbuild/default.nix b/nixpkgs/pkgs/development/tools/esbuild/default.nix
index 889fc04c5070..7161bf31ee5a 100644
--- a/nixpkgs/pkgs/development/tools/esbuild/default.nix
+++ b/nixpkgs/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.19.8";
+  version = "0.19.9";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    hash = "sha256-f13YbgHFQk71g7twwQ2nSOGA0RG0YYM01opv6txRMuw=";
+    hash = "sha256-GiQTB/P+7uVGZfUaeM7S/5lGvfHlTl/cFt7XbNfE0qw=";
   };
 
   vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/nixpkgs/pkgs/development/tools/faas-cli/default.nix b/nixpkgs/pkgs/development/tools/faas-cli/default.nix
index 1baa7e9b93e4..8f42ed7250dc 100644
--- a/nixpkgs/pkgs/development/tools/faas-cli/default.nix
+++ b/nixpkgs/pkgs/development/tools/faas-cli/default.nix
@@ -18,13 +18,13 @@ let
 in
 buildGoModule rec {
   pname = "faas-cli";
-  version = "0.16.18";
+  version = "0.16.21";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = version;
-    sha256 = "sha256-qyMOHdOj47ef1NMBIO31xzopO6gOT96tvHhK/TO+E70=";
+    sha256 = "sha256-1zdxxd27XXSDcOhQi/um7jQlLZ3x+T09N1p1JJ8qzkk=";
   };
 
   vendorHash = null;
diff --git a/nixpkgs/pkgs/development/tools/gci/default.nix b/nixpkgs/pkgs/development/tools/gci/default.nix
index b4b226a57cc3..3982686a24e9 100644
--- a/nixpkgs/pkgs/development/tools/gci/default.nix
+++ b/nixpkgs/pkgs/development/tools/gci/default.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "gci";
-  version = "0.11.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "daixiang0";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1JYmnMXm2ywGZAVhcfzvF1I1h0pBvijbeVmqKzgiz8U=";
+    sha256 = "sha256-75ye/624fDcWCn+H0gAYHRPcVUh+JJm3vU6T4w1T0jM=";
   };
 
   vendorHash = "sha256-bPRcOvwbWEpcJUlIqQNeoYME4ky0YE5LlyWhSTWCIHQ=";
diff --git a/nixpkgs/pkgs/development/tools/go-containerregistry/default.nix b/nixpkgs/pkgs/development/tools/go-containerregistry/default.nix
index 51ad526eef7c..956ded6b6edb 100644
--- a/nixpkgs/pkgs/development/tools/go-containerregistry/default.nix
+++ b/nixpkgs/pkgs/development/tools/go-containerregistry/default.nix
@@ -4,13 +4,13 @@ let bins = [ "crane" "gcrane" ]; in
 
 buildGoModule rec {
   pname = "go-containerregistry";
-  version = "0.16.1";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uqTWeA449MhHFWJwyqJgLsQHvjfk46S1YA+Yss5muSk=";
+    sha256 = "sha256-spo8iRf3FqX7DyaTqIuiGOVrgv0PRqa05TQcanzB8FY=";
   };
   vendorHash = null;
 
diff --git a/nixpkgs/pkgs/development/tools/go-toml/default.nix b/nixpkgs/pkgs/development/tools/go-toml/default.nix
index 0b21b92da8dc..b9907280e387 100644
--- a/nixpkgs/pkgs/development/tools/go-toml/default.nix
+++ b/nixpkgs/pkgs/development/tools/go-toml/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-toml";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "pelletier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-BEkshlB1Zze4sVo5YDwpj6ENHFLHL4IFmOIYgrWz+gQ=";
+    sha256 = "sha256-SnSdVBIIir7QSexk//ozpxnbNr92KyWP2sSBg87jGcw=";
   };
 
   vendorHash = "sha256-XOcCsb3zUChiYLTfOCbRQF71E2khzSt/ApFI8NAS13U=";
diff --git a/nixpkgs/pkgs/development/tools/goconst/default.nix b/nixpkgs/pkgs/development/tools/goconst/default.nix
index 7d0123f00f85..da4e9e90ef8b 100644
--- a/nixpkgs/pkgs/development/tools/goconst/default.nix
+++ b/nixpkgs/pkgs/development/tools/goconst/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "goconst";
-  version = "1.6.0";
+  version = "1.7.0";
 
   excludedPackages = [ "tests" ];
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     owner = "jgautheron";
     repo = "goconst";
     rev = "v${version}";
-    sha256 = "sha256-gd+0Gm1qANwgYKWAxpU7759BhyURalJCRxd/P6sczc4=";
+    sha256 = "sha256-yhvZucbFldjTPVdo0epNPFMgmvz0JFPF7Gra0t11zXU=";
   };
 
   vendorHash = null;
diff --git a/nixpkgs/pkgs/development/tools/gofumpt/default.nix b/nixpkgs/pkgs/development/tools/gofumpt/default.nix
index 6c6ca492cbe7..0949c1ff9dd6 100644
--- a/nixpkgs/pkgs/development/tools/gofumpt/default.nix
+++ b/nixpkgs/pkgs/development/tools/gofumpt/default.nix
@@ -1,23 +1,47 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, nix-update-script
+, testVersion
+, gofumpt
+}:
 
 buildGoModule rec {
   pname = "gofumpt";
-  version = "0.3.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "mvdan";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uXRYVLFDyRZ83mth8Fh+MG9fNv2lUfE3BTljM9v9rjI=";
+    hash = "sha256-3buGLgxAaAIwLXWLpX+K7VRx47DuvUI4W8vw4TuXSts=";
   };
 
-  vendorHash = "sha256-Il1E1yOejLEdKRRMqelGeJbHRjx4qFymf7N98BEdFzg=";
+  vendorHash = "sha256-W0WKEQgOIFloWsB4E1RTICVKVlj9ChGSpo92X+bjNEk=";
+
+  CGO_ENABLED = "0";
+
+  ldflags = "-s -w -X main.version=v${version}";
+
+  checkFlags = [
+    # Requires network access (Error: module lookup disabled by GOPROXY=off).
+    "-skip=^TestScript/diagnose$"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testVersion {
+      package = gofumpt;
+      version = "v${version}";
+    };
+  };
 
   meta = with lib; {
     description = "A stricter gofmt";
     homepage = "https://github.com/mvdan/gofumpt";
+    changelog = "https://github.com/mvdan/gofumpt/releases/tag/v${version}";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ rvolosatovs ];
+    maintainers = with maintainers; [ rvolosatovs katexochen ];
     mainProgram = "gofumpt";
   };
 }
diff --git a/nixpkgs/pkgs/development/tools/goimports-reviser/default.nix b/nixpkgs/pkgs/development/tools/goimports-reviser/default.nix
index 7f79d3b5fe33..ceca2ea407e9 100644
--- a/nixpkgs/pkgs/development/tools/goimports-reviser/default.nix
+++ b/nixpkgs/pkgs/development/tools/goimports-reviser/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "goimports-reviser";
-  version = "3.5.6";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "incu6us";
     repo = "goimports-reviser";
     rev = "v${version}";
-    hash = "sha256-OMCmW2GhByuVN8+Kuaw9o2oCrdA6C9fK/C7yl7wI2Ls=";
+    hash = "sha256-bN8bj/JW7Wixv0MUNC43gpjJUndon5twL96axticnIU=";
   };
   vendorHash = "sha256-aYhUsO3Z0uue66XB+/oSVYLG9QGyVcFeZ0ngzhpBZxo=";
 
diff --git a/nixpkgs/pkgs/development/tools/grpc-gateway/default.nix b/nixpkgs/pkgs/development/tools/grpc-gateway/default.nix
index 08452c98c286..52a4b4295a6a 100644
--- a/nixpkgs/pkgs/development/tools/grpc-gateway/default.nix
+++ b/nixpkgs/pkgs/development/tools/grpc-gateway/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "grpc-gateway";
-  version = "2.18.0";
+  version = "2.18.1";
 
   src = fetchFromGitHub {
     owner = "grpc-ecosystem";
     repo = "grpc-gateway";
     rev = "v${version}";
-    sha256 = "sha256-FVb3x/wZ0jLI17lXAT/lcUpJiq3ZcvWjFnORynOvfmY=";
+    sha256 = "sha256-mbRceXqc7UmrhM2Y6JJIUvMf9YxMFMjRW7VvEa8/xHs=";
   };
 
-  vendorHash = "sha256-SV2ZO8Y9yt6iyw9VvNY0xpqZIzLrTyHYYpIpzcEVsLY=";
+  vendorHash = "sha256-zVojs4q8TytJY3myKvLdACnMFJ0iK9Cfn+aZ4d/j34s=";
 
   meta = with lib; {
     description =
diff --git a/nixpkgs/pkgs/development/tools/infisical/default.nix b/nixpkgs/pkgs/development/tools/infisical/default.nix
index 5c4b4ca9e3e4..bc181390664e 100644
--- a/nixpkgs/pkgs/development/tools/infisical/default.nix
+++ b/nixpkgs/pkgs/development/tools/infisical/default.nix
@@ -15,7 +15,7 @@ let
   buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
 
   # the version of infisical
-  version = "0.14.3";
+  version = "0.16.3";
 
   # the platform-specific, statically linked binary
   src =
diff --git a/nixpkgs/pkgs/development/tools/infisical/hashes.json b/nixpkgs/pkgs/development/tools/infisical/hashes.json
index 0e79f2a1e00c..685bb4d1ff68 100644
--- a/nixpkgs/pkgs/development/tools/infisical/hashes.json
+++ b/nixpkgs/pkgs/development/tools/infisical/hashes.json
@@ -1,6 +1,6 @@
 { "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
-, "x86_64-linux": "sha256-sTfwooMN5ckdaxpd4R3yQvDEYT7muYZTyFEm0exM33M="
-, "x86_64-darwin": "sha256-B94+mF5Wu0pHKIo8CuHAbrorzIxK2U64Np3JFlTc1kk="
-, "aarch64-linux": "sha256-eGuKnC6h1YPW0UdY5wcChbiSzATAcSmHZ6mKBI2sR80="
-, "aarch64-darwin": "sha256-s4s1la165cQ5I296ZCeW3ZIyYapTfRxa20QdZmXvido="
+, "x86_64-linux": "sha256-AxTTTX4rp881dJuNGIF9s09e5yLohTEeM0LHnsQ+/eQ="
+, "x86_64-darwin": "sha256-DKZUB84PbueRfwVAUH9z8N4JxNlK+db+fVH4jPIbDtc="
+, "aarch64-linux": "sha256-q62a5Ggw0Rikhzn0MY24sSurEPW1/nNehfqVzwBAq/k="
+, "aarch64-darwin": "sha256-9961CGekF8N0bVgtNQIxOoWKB2HgUJ3kBek1rSBHJNk="
 }
diff --git a/nixpkgs/pkgs/development/tools/misc/fzf-make/default.nix b/nixpkgs/pkgs/development/tools/misc/fzf-make/default.nix
index 26ff32368dd6..15b21b62b9b3 100644
--- a/nixpkgs/pkgs/development/tools/misc/fzf-make/default.nix
+++ b/nixpkgs/pkgs/development/tools/misc/fzf-make/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fzf-make";
-  version = "0.9.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "kyu08";
     repo = "fzf-make";
     rev = "v${version}";
-    hash = "sha256-nuTy2VhUYgz4OgV3ZI/KcsbTBQOoxumf+IIdM5wDSN4=";
+    hash = "sha256-YsX7PltOw5cDjQv9X5ZRsn5qCzus6QTUva98bd+wngo=";
   };
 
-  cargoHash = "sha256-/qnIhBJ+Ivrnowv1V+BBhcPLTiQV0tqFLPs0yQbKTXs=";
+  cargoHash = "sha256-4YnVvkROjZD+erITzP3O4p/EVw/zjfOYRNmi1ykwtug=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
diff --git a/nixpkgs/pkgs/development/tools/rust/cargo-nextest/default.nix b/nixpkgs/pkgs/development/tools/rust/cargo-nextest/default.nix
index 204cecbb4344..0e808f060823 100644
--- a/nixpkgs/pkgs/development/tools/rust/cargo-nextest/default.nix
+++ b/nixpkgs/pkgs/development/tools/rust/cargo-nextest/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.64";
+  version = "0.9.66";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    hash = "sha256-nP5G6o0/Ce0ywdi3E5R/Pbh14zLn1UzagN+DMBch+cg=";
+    hash = "sha256-MHXQnOUtFIRak05IX6oge3AyRC6M1XHwjpAPWBc8ByQ=";
   };
 
-  cargoHash = "sha256-vrMxIEDsiVAGdznog4pJDQpQmbXW6qsHqBuS1e/0nMo=";
+  cargoHash = "sha256-AqWySq72teaVv6xFmIgcL7uufBQdaFO5DrAIy8mfh34=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/nixpkgs/pkgs/development/tools/rust/cargo-run-bin/default.nix b/nixpkgs/pkgs/development/tools/rust/cargo-run-bin/default.nix
index 91d914422277..facc1566a990 100644
--- a/nixpkgs/pkgs/development/tools/rust/cargo-run-bin/default.nix
+++ b/nixpkgs/pkgs/development/tools/rust/cargo-run-bin/default.nix
@@ -5,14 +5,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-run-bin";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-FPkZk5qKHrRR3V8s04yLgOVOKj+Rln3Cu/VW2bnr2fE=";
+    hash = "sha256-PB44m39TDH1z8N3DrxAlZ/FKOdZmpe+U84tbmBBP9VQ=";
   };
 
-  cargoHash = "sha256-aFHuIEDpGCel1FC7D0hTUmzHbEj7wVarsE0wNZ/3Khw=";
+  cargoHash = "sha256-FMlirUr3c8QhnTmTHvfNPff7PYlWSl83vCGLOLbyaR4=";
 
   # multiple impurities in tests
   doCheck = false;
diff --git a/nixpkgs/pkgs/development/web/deno/default.nix b/nixpkgs/pkgs/development/web/deno/default.nix
index abaf279e7269..5ab831adb2d9 100644
--- a/nixpkgs/pkgs/development/web/deno/default.nix
+++ b/nixpkgs/pkgs/development/web/deno/default.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.38.5";
+  version = "1.39.0";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-gNYyB6KUgi0/kGfyYPuDdPWU0B4Io2TxEBAf/oRSHxs=";
+    hash = "sha256-TiMwbiMIbhbLzTGndl3BpvX63ojydlCeylR9o5E+ZRk=";
   };
 
-  cargoHash = "sha256-soHNk/EY6Db49NtdAHrky9DfEJDKfPcS2L/crkJI/9E=";
+  cargoHash = "sha256-JXghF5lwpO898/BWC8srCN0B/ClF9VpW2C1l2nXcH50=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds
diff --git a/nixpkgs/pkgs/development/web/deno/librusty_v8.nix b/nixpkgs/pkgs/development/web/deno/librusty_v8.nix
index e4d2a2fec707..726a04dea474 100644
--- a/nixpkgs/pkgs/development/web/deno/librusty_v8.nix
+++ b/nixpkgs/pkgs/development/web/deno/librusty_v8.nix
@@ -10,11 +10,11 @@ let
   };
 in
 fetch_librusty_v8 {
-  version = "0.81.0";
+  version = "0.82.0";
   shas = {
-    x86_64-linux = "sha256-e77LYm/sus7EY4eiRuEp6G25djDaT4wSD4FBCxy4vcE=";
-    aarch64-linux = "sha256-wPfUcuT2Z2sy5nLf8xR3QjGQKk6OsM/45jnYv/Hw+Zs=";
-    x86_64-darwin = "sha256-UbnRiywM7b7q3rITZzNeWAuKU+HXXAqVapQ9j5ND6go=";
-    aarch64-darwin = "sha256-42d3VGBv5lW1InfzYfWr6Xj0GpyJ6GWswVNtUa8ID30=";
+    x86_64-linux = "sha256-2nWOAUuzc7tr0KieeugIqI3zaRruvnLWBPn+ZdHTXsM=";
+    aarch64-linux = "sha256-vlc60ZoFtT2Ugp0npT0dep6WWnEBAznR7dYFRaMNAKM=";
+    x86_64-darwin = "sha256-CqyG/JOJe5kWzFJnnkU2Lz4VS/unWe1iucFxm+1HGsU=";
+    aarch64-darwin = "sha256-ps19JZqCpO3pEAMQZOO+l/Iz7u0dIXLnpYIsnOyAxYk=";
   };
 }
diff --git a/nixpkgs/pkgs/development/web/flyctl/default.nix b/nixpkgs/pkgs/development/web/flyctl/default.nix
index b9d804cf3a71..1bac4b232cec 100644
--- a/nixpkgs/pkgs/development/web/flyctl/default.nix
+++ b/nixpkgs/pkgs/development/web/flyctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.1.131";
+  version = "0.1.134";
 
   src = fetchFromGitHub {
     owner = "superfly";
     repo = "flyctl";
     rev = "v${version}";
-    hash = "sha256-q24QQExHsIUkMQBhIdYN9ra6tSPfB21SxXnZzVJIpJk=";
+    hash = "sha256-dkzoSu9Aug1PyYwjVEvoAXPHa4a5tTTd6CaUjs+x9+I=";
   };
 
-  vendorHash = "sha256-UHG0pUJzA3I8uBbll+4fEpwpEvNBxoQYKr8wuupc8NQ=";
+  vendorHash = "sha256-MUsZ/OXPoaHvLLabC0/MvvcYn1VcgDBjiq3kKhyvr6g=";
 
   subPackages = [ "." ];
 
diff --git a/nixpkgs/pkgs/development/web/function-runner/default.nix b/nixpkgs/pkgs/development/web/function-runner/default.nix
index bd2ad2862cd7..7582800e25bd 100644
--- a/nixpkgs/pkgs/development/web/function-runner/default.nix
+++ b/nixpkgs/pkgs/development/web/function-runner/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "function-runner";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "Shopify";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cKlzv9mL6UGXHvYbQR4OcZgdjZLV5Q7EoQbW7Fx8ESo=";
+    sha256 = "sha256-o+fsIBH/vONlb57m3+upKG2Gss6s7yBNATkbKtSHf/0=";
   };
 
-  cargoHash = "sha256-/4/zaeNQ45YYBILxm11qD9rPFZxilA8kLoyWG370Knk=";
+  cargoHash = "sha256-7ACi4orqpmWiaMYmOjICR6/d1kVySzaaCWIoUxqnhpI=";
 
   meta = with lib; {
     description = "A CLI tool which allows you to run Wasm Functions intended for the Shopify Functions infrastructure";
diff --git a/nixpkgs/pkgs/development/web/ihp-new/default.nix b/nixpkgs/pkgs/development/web/ihp-new/default.nix
index 5db350f7c0fb..a11203238441 100644
--- a/nixpkgs/pkgs/development/web/ihp-new/default.nix
+++ b/nixpkgs/pkgs/development/web/ihp-new/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ihp-new";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "digitallyinduced";
     repo = "ihp";
     rev = "v${version}";
-    sha256 = "sha256-o0ZSDaDFgwbXqozHfcXKxW4FeF7JqaGprAh6r7NhvhE";
+    sha256 = "sha256-oQz7ZBrHe6WwYMwnxxUgnYM55CuH5Oxjz6mrLnYbB7U=";
   };
 
   dontConfigure = true;
diff --git a/nixpkgs/pkgs/games/endless-sky/default.nix b/nixpkgs/pkgs/games/endless-sky/default.nix
index ac44390faf56..9a3e86117cef 100644
--- a/nixpkgs/pkgs/games/endless-sky/default.nix
+++ b/nixpkgs/pkgs/games/endless-sky/default.nix
@@ -1,22 +1,39 @@
-{ lib, stdenv, fetchFromGitHub
-, SDL2, libpng, libjpeg, glew, openal, scons, libmad, libuuid
+{ lib
+, stdenv
+, fetchFromGitHub
+, SDL2
+, libpng
+, libjpeg
+, glew
+, openal
+, scons
+, libmad
+, libuuid
 }:
 
 stdenv.mkDerivation rec {
   pname = "endless-sky";
-  version = "0.9.16.1";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "endless-sky";
     repo = "endless-sky";
     rev = "v${version}";
-    sha256 = "sha256-bohljxAtSVqsfnge6t4LF3pC1s1r99v3hNLKTBquC20=";
+    sha256 = "sha256-VTg8H6umq9yMMP274StIJfEZZvUFDILiMKhioam58QE=";
   };
 
   patches = [
     ./fixes.patch
   ];
 
+  postPatch = ''
+    # the trailing slash is important!!
+    # endless sky naively joins the paths with string concatenation
+    # so it's essential that there be a trailing slash on the resources path
+    substituteInPlace source/Files.cpp \
+      --replace '%NIXPKGS_RESOURCES_PATH%' "$out/share/games/endless-sky/"
+  '';
+
   preBuild = ''
     export AR="${stdenv.cc.targetPrefix}gcc-ar"
   '';
@@ -24,7 +41,14 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   buildInputs = [
-    SDL2 libpng libjpeg glew openal scons libmad libuuid
+    SDL2
+    libpng
+    libjpeg
+    glew
+    openal
+    scons
+    libmad
+    libuuid
   ];
 
   prefixKey = "PREFIX=";
@@ -33,9 +57,12 @@ stdenv.mkDerivation rec {
     description = "A sandbox-style space exploration game similar to Elite, Escape Velocity, or Star Control";
     homepage = "https://endless-sky.github.io/";
     license = with licenses; [
-      gpl3Plus cc-by-sa-30 cc-by-sa-40 publicDomain
+      gpl3Plus
+      cc-by-sa-30
+      cc-by-sa-40
+      publicDomain
     ];
-    maintainers = with maintainers; [ lheckemann ];
+    maintainers = with maintainers; [ lheckemann _360ied ];
     platforms = platforms.linux; # Maybe other non-darwin Unix
   };
 }
diff --git a/nixpkgs/pkgs/games/endless-sky/fixes.patch b/nixpkgs/pkgs/games/endless-sky/fixes.patch
index 359e2ee4af3b..b6f330eca442 100644
--- a/nixpkgs/pkgs/games/endless-sky/fixes.patch
+++ b/nixpkgs/pkgs/games/endless-sky/fixes.patch
@@ -12,13 +12,19 @@ index 48fd080..419b40d 100644
  # Install the desktop file:
  env.Install("$DESTDIR$PREFIX/share/applications", "endless-sky.desktop")
 diff --git a/source/Files.cpp b/source/Files.cpp
-index c8c8957..d196459 100644
+index de27023e..4225051f 100644
 --- a/source/Files.cpp
 +++ b/source/Files.cpp
-@@ -114,15 +114,9 @@ void Files::Init(const char * const *argv)
- 	if(resources.back() != '/')
- 		resources += '/';
- #if defined __linux__ || defined __FreeBSD__ || defined __DragonFly__
+@@ -108,32 +108,9 @@ void Files::Init(const char * const *argv)
+ 		resources = str;
+ 		SDL_free(str);
+ 	}
+-#if defined _WIN32
+-	FixWindowsSlashes(resources);
+-#endif
+-	if(resources.back() != '/')
+-		resources += '/';
+-#if defined __linux__ || defined __FreeBSD__ || defined __DragonFly__
 -	// Special case, for Linux: the resource files are not in the same place as
 -	// the executable, but are under the same prefix (/usr or /usr/local).
 -	static const string LOCAL_PATH = "/usr/local/";
@@ -28,9 +34,20 @@ index c8c8957..d196459 100644
 -		resources = LOCAL_PATH + RESOURCE_PATH;
 -	else if(!resources.compare(0, STANDARD_PATH.length(), STANDARD_PATH))
 -		resources = STANDARD_PATH + RESOURCE_PATH;
-+	// Workaround for NixOS. Not sure how to proceed with other OSes, feedback
-+	// is welcome.
-+	resources += "../share/games/endless-sky/";
- #elif defined __APPLE__
- 	// Special case for Mac OS X: the resources are in ../Resources relative to
- 	// the folder the binary is in.
+-#endif
+-	// If the resources are not here, search in the directories containing this
+-	// one. This allows, for example, a Mac app that does not actually have the
+-	// resources embedded within it.
+-	while(!Exists(resources + "credits.txt"))
+-	{
+-		size_t pos = resources.rfind('/', resources.length() - 2);
+-		if(pos == string::npos || pos == 0)
+-			throw runtime_error("Unable to find the resource directories!");
+-		resources.erase(pos + 1);
+-	}
++
++	resources = "%NIXPKGS_RESOURCES_PATH%";
++
+ 	dataPath = resources + "data/";
+ 	imagePath = resources + "images/";
+ 	soundPath = resources + "sounds/";
diff --git a/nixpkgs/pkgs/games/gogui/default.nix b/nixpkgs/pkgs/games/gogui/default.nix
index 212f0af0e8e3..43e1f3397b8f 100644
--- a/nixpkgs/pkgs/games/gogui/default.nix
+++ b/nixpkgs/pkgs/games/gogui/default.nix
@@ -11,7 +11,7 @@
 }:
 
 let
-  version = "1.5.3";
+  version = "1.5.4a";
 in stdenv.mkDerivation {
   pname = "gogui";
   inherit version;
@@ -20,7 +20,7 @@ in stdenv.mkDerivation {
     owner = "Remi-Coulom";
     repo = "gogui";
     rev = "v${version}";
-    hash = "sha256-GezFhNYB542JnAIUeUVa188+SR5mCedwj0hZN8L83UQ=";
+    hash = "sha256-UFhOk2mAnTtxfwEOHquN64YDCRq7nNUqZAPQf77MEEw=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/games/hyperrogue/default.nix b/nixpkgs/pkgs/games/hyperrogue/default.nix
index 30698016a325..8ea692587d0e 100644
--- a/nixpkgs/pkgs/games/hyperrogue/default.nix
+++ b/nixpkgs/pkgs/games/hyperrogue/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hyperrogue";
-  version = "12.1y";
+  version = "12.1z";
 
   src = fetchFromGitHub {
     owner = "zenorogue";
     repo = "hyperrogue";
     rev = "v${version}";
-    sha256 = "sha256-YCjDqpbb3OxJmek8KesCb3uACVCFYIAsaF3U1jO/CU4=";
+    sha256 = "sha256-L9T61fyMURlPtUidbwDnkvI7bb7fobNeyYhDleOCU4Y=";
   };
 
   CXXFLAGS = [
diff --git a/nixpkgs/pkgs/games/vcmi/default.nix b/nixpkgs/pkgs/games/vcmi/default.nix
index ad5aa48c7c5d..2dd27400961d 100644
--- a/nixpkgs/pkgs/games/vcmi/default.nix
+++ b/nixpkgs/pkgs/games/vcmi/default.nix
@@ -27,14 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vcmi";
-  version = "1.3.2";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "vcmi";
     repo = "vcmi";
     rev = version;
-    fetchSubmodules = true;
-    hash = "sha256-dwTQRpu+IrKhuiiw/uYBt8i/BYlQ5XCy/jUhDAo6aa4=";
+    hash = "sha256-MhY3tpKlrIgq6QXZwAkMnObYYpUxsPcysTR5CZH1rhE=";
   };
 
   nativeBuildInputs = [
@@ -63,10 +62,10 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DENABLE_LUA:BOOL=ON"
-    "-DENABLE_ERM:BOOL=OFF"
+    "-DENABLE_ERM:BOOL=ON"
     "-DENABLE_GITVERSION:BOOL=OFF"
     "-DENABLE_PCH:BOOL=OFF"
-    "-DENABLE_TEST:BOOL=OFF"
+    "-DENABLE_TEST:BOOL=OFF" # Tests require HOMM3 data files.
     "-DFORCE_BUNDLED_MINIZIP:BOOL=OFF"
     "-DFORCE_BUNDLED_FL:BOOL=OFF"
     "-DCMAKE_INSTALL_RPATH:STRING=$out/lib/vcmi"
@@ -80,12 +79,10 @@ stdenv.mkDerivation rec {
       --prefix PATH : "${lib.makeBinPath [ innoextract ffmpeg unshield ]}"
   '';
 
-  doCheck = true;
-
   passthru.tests.version = testers.testVersion {
     package = vcmi;
     command = ''
-      XDG_DATA_HOME=$PWD XDG_CACHE_HOME=$PWD XDG_CONFIG_HOME=$PWD \
+      XDG_DATA_HOME="$TMPDIR" XDG_CACHE_HOME="$TMPDIR" XDG_CONFIG_HOME="$TMPDIR" \
         vcmiclient --version
     '';
   };
@@ -93,8 +90,8 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "An open-source engine for Heroes of Might and Magic III";
     homepage = "https://vcmi.eu";
-    changelog = "https://github.com/vcmi/vcmi/blob/${src.rev}/ChangeLog";
-    license = with licenses; [ gpl2Only cc-by-sa-40 ];
+    changelog = "https://github.com/vcmi/vcmi/blob/${src.rev}/ChangeLog.md";
+    license = with licenses; [ gpl2Plus cc-by-sa-40 ];
     maintainers = with maintainers; [ azahi ];
     platforms = platforms.linux;
     mainProgram = "vcmilauncher";
diff --git a/nixpkgs/pkgs/os-specific/linux/gasket/default.nix b/nixpkgs/pkgs/os-specific/linux/gasket/default.nix
index b9aebacca641..c1e81dfa9b71 100644
--- a/nixpkgs/pkgs/os-specific/linux/gasket/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/gasket/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "fcnqCBh04e+w8g079JyuyY2RPu34M+/X+Q8ObE+42i4=";
   };
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "-C"
     "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "M=$(PWD)"
@@ -31,5 +31,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ lib.maintainers.kylehendricks ];
     platforms = platforms.linux;
+    broken = versionOlder kernel.version "5.15";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/iwd/default.nix b/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
index 84813723fb05..bea03fc1e8a2 100644
--- a/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iwd/default.nix
@@ -14,12 +14,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "2.10";
+  version = "2.11";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    hash = "sha256-zePFmcQRFjcH6KToTpBFMQzGY+Eq7jijfn0R/MMKGrw=";
+    hash = "sha256-kE9GBVTKNpgEuE9jQ7k85OhEAN3VWgjmAgifvZfq46I=";
   };
 
   # Revert test that's broken on aarch64
diff --git a/nixpkgs/pkgs/os-specific/linux/openvswitch/default.nix b/nixpkgs/pkgs/os-specific/linux/openvswitch/default.nix
index 664adfdc164c..b1944778237d 100644
--- a/nixpkgs/pkgs/os-specific/linux/openvswitch/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/openvswitch/default.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "3.1.1";
-  hash = "sha256-YEiRg6RNO5WlUiQHIhfF9tN6oRvhKnV2JRDO25Ok4gQ=";
+  version = "3.2.1";
+  hash = "sha256-nXdyDJIU60Lx9cvpLuUp3E7MUnaZvvGDm+UKbXJRH0o=";
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/openvswitch/generic.nix b/nixpkgs/pkgs/os-specific/linux/openvswitch/generic.nix
index be4bc90fe428..83749782d274 100644
--- a/nixpkgs/pkgs/os-specific/linux/openvswitch/generic.nix
+++ b/nixpkgs/pkgs/os-specific/linux/openvswitch/generic.nix
@@ -1,5 +1,6 @@
 { version
 , hash
+, updateScriptArgs ? ""
 }:
 
 { lib
@@ -20,6 +21,7 @@
 , sphinxHook
 , util-linux
 , which
+, writeScript
 }:
 
 let
@@ -105,6 +107,10 @@ in stdenv.mkDerivation rec {
     pytest
   ]);
 
+  passthru.updateScript = writeScript "ovs-update.nu" ''
+    ${./update.nu} ${updateScriptArgs}
+  '';
+
   meta = with lib; {
     changelog = "https://www.openvswitch.org/releases/NEWS-${version}.txt";
     description = "A multilayer virtual switch";
diff --git a/nixpkgs/pkgs/os-specific/linux/openvswitch/lts.nix b/nixpkgs/pkgs/os-specific/linux/openvswitch/lts.nix
index 9fb9977c2017..d52aae987085 100644
--- a/nixpkgs/pkgs/os-specific/linux/openvswitch/lts.nix
+++ b/nixpkgs/pkgs/os-specific/linux/openvswitch/lts.nix
@@ -1,4 +1,5 @@
 import ./generic.nix {
-  version = "2.17.6";
-  hash = "sha256-dNqvK+c0iuXdQBe6RbjaxlNB8Vn0+0paecVC/tQQENk=";
+  version = "2.17.8";
+  hash = "sha256-DWAwepAxl90ay7MXPCz++BicaeSHYuZ06O8VeFZac+U=";
+  updateScriptArgs = "--lts=true --regex '2\.17.*'";
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/openvswitch/update.nu b/nixpkgs/pkgs/os-specific/linux/openvswitch/update.nu
new file mode 100755
index 000000000000..5d457dda5f3e
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/openvswitch/update.nu
@@ -0,0 +1,19 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i nu -p nushell common-updater-scripts
+
+def main [--lts: bool = false, --regex: string] {
+  let tags = list-git-tags --url=https://github.com/openvswitch/ovs | lines | sort --natural | str replace v ''
+
+  let latest_tag = if $regex == null { $tags } else { $tags | find --regex $regex } | last
+  let current_version = nix eval --raw -f default.nix $"openvswitch(if $lts {"-lts"}).version" | str trim
+
+  if $latest_tag != $current_version {
+    if $lts {
+      update-source-version openvswitch-lts $latest_tag $"--file=(pwd)/pkgs/os-specific/linux/openvswitch/lts.nix"
+    } else {
+      update-source-version openvswitch $latest_tag $"--file=(pwd)/pkgs/os-specific/linux/openvswitch/default.nix"
+    }
+  }
+
+  {"lts?": $lts, before: $current_version, after: $latest_tag}
+}
diff --git a/nixpkgs/pkgs/servers/asterisk/default.nix b/nixpkgs/pkgs/servers/asterisk/default.nix
index 15dbfc4cba99..4102f60c716f 100644
--- a/nixpkgs/pkgs/servers/asterisk/default.nix
+++ b/nixpkgs/pkgs/servers/asterisk/default.nix
@@ -36,25 +36,6 @@
 }:
 
 let
-  # remove when upgrading to pjsip >2.13
-  pjsip_2_13_patches = [
-    (fetchpatch {
-      name = "CVE-2022-23537.patch";
-      url = "https://github.com/pjsip/pjproject/commit/d8440f4d711a654b511f50f79c0445b26f9dd1e1.patch";
-      sha256 = "sha256-7ueQCHIiJ7MLaWtR4+GmBc/oKaP+jmEajVnEYqiwLRA=";
-    })
-    (fetchpatch {
-      name = "CVE-2022-23547.patch";
-      url = "https://github.com/pjsip/pjproject/commit/bc4812d31a67d5e2f973fbfaf950d6118226cf36.patch";
-      sha256 = "sha256-bpc8e8VAQpfyl5PX96G++6fzkFpw3Or1PJKNPKl7N5k=";
-    })
-    (fetchpatch {
-      name = "CVE-2023-27585.patch";
-      url = "https://github.com/pjsip/pjproject/commit/d1c5e4da5bae7f220bc30719888bb389c905c0c5.patch";
-      hash = "sha256-+yyKKTKG2FnfyLWnc4S80vYtDzmiu9yRmuqb5eIulPg=";
-    })
-  ];
-
   common = { version, sha256, externals, pjsip_patches ? [ ] }: stdenv.mkDerivation {
     inherit version;
     pname = "asterisk"
@@ -161,12 +142,12 @@ let
     };
   };
 
-  pjproject_2_13 = fetchurl
+  pjproject_2_13_1 = fetchurl
     {
-      url = "https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.13/pjproject-2.13.tar.bz2";
-      hash = "sha256-Zj93PUAct13KVR5taOWEbQdKq76wicaBTNHpHC0rICY=";
+      url = "https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.13.1/pjproject-2.13.1.tar.bz2";
+      hash = "sha256-cOBRvO+B9fGt4UVYAHQQwBsc2cUF7Pu1GRsjAF7BE1g=";
     } // {
-    pjsip_patches = pjsip_2_13_patches;
+    pjsip_patches = [ ];
   };
 
   mp3-202 = fetchsvn {
@@ -187,7 +168,7 @@ let
   versions = lib.mapAttrs
     (_: { version, sha256 }:
       let
-        pjsip = pjproject_2_13;
+        pjsip = pjproject_2_13_1;
       in
       common {
         inherit version sha256;
diff --git a/nixpkgs/pkgs/servers/asterisk/versions.json b/nixpkgs/pkgs/servers/asterisk/versions.json
index 1e6e4e4417ef..db902df9a412 100644
--- a/nixpkgs/pkgs/servers/asterisk/versions.json
+++ b/nixpkgs/pkgs/servers/asterisk/versions.json
@@ -1,18 +1,14 @@
 {
-  "asterisk_16": {
-    "sha256": "f8448e8784df7fac019e459bf7c82529d80afe64ae97d73d40e6aa0e4fb39724",
-    "version": "16.30.0"
-  },
   "asterisk_18": {
-    "sha256": "66f0e55d84f9e5bf4e79a56255d35a034448acce00d219c3bf4930b1ebb0e88e",
-    "version": "18.17.1"
-  },
-  "asterisk_19": {
-    "sha256": "f0c56d1f8e39e0427455edfe25d24ff088c756bdc32dd1278c9f7a320815cbaa",
-    "version": "19.8.0"
+    "sha256": "ad7d01f58e5c5266e5b23cc385e6a3d32a656b93c1d4b4fb0082f3300012bd02",
+    "version": "18.20.1"
   },
   "asterisk_20": {
-    "sha256": "df12e47000fbac42bb780bb06172aa8bb8ac26faf77cc9f95184695b0cec69c3",
-    "version": "20.2.1"
+    "sha256": "7d128f2a164e36fae4875058120ff026e7cd73f7701429fee4fa293f4fba4336",
+    "version": "20.5.1"
+  },
+  "asterisk_21": {
+    "sha256": "8e7db886b70e808ade38ad060ccbbb49353031e4c2fa6dc4435bfbd79f082956",
+    "version": "21.0.1"
   }
 }
diff --git a/nixpkgs/pkgs/servers/consul/default.nix b/nixpkgs/pkgs/servers/consul/default.nix
index 2d449c531cc8..dee27e5877dc 100644
--- a/nixpkgs/pkgs/servers/consul/default.nix
+++ b/nixpkgs/pkgs/servers/consul/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.16.3";
+  version = "1.17.0";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    hash = "sha256-XxT+66CNuDeVBoaNhlgET5bJYB/KDCjcO0RDmyI6S9o=";
+    hash = "sha256-fAcgO7r0GrL2GrsX7flezhbQMcg+YBH6Lrn7BW2XMwM=";
   };
 
   passthru.tests.consul = nixosTests.consul;
@@ -26,7 +26,7 @@ buildGoModule rec {
   # has a split module structure in one repo
   subPackages = ["." "connect/certgen"];
 
-  vendorHash = "sha256-WNvdHT915GSTFhZZfoi/MCHAjzBVYkhUiPNPw5GDT4s=";
+  vendorHash = "sha256-xxREyw7xgx9Zp7nua1yq39TioWvRQXOhWqYaK6eJaOc=";
 
   doCheck = false;
 
diff --git a/nixpkgs/pkgs/servers/dendrite/default.nix b/nixpkgs/pkgs/servers/dendrite/default.nix
index 4dfe4b33318c..720b41a9350c 100644
--- a/nixpkgs/pkgs/servers/dendrite/default.nix
+++ b/nixpkgs/pkgs/servers/dendrite/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "matrix-dendrite";
-  version = "0.13.4";
+  version = "0.13.5";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "dendrite";
     rev = "v${version}";
-    hash = "sha256-Hy3QuwAHmZSsjy5A/1mrmrxdtle466HsQtDat3tYS8s=";
+    hash = "sha256-tKywmFSSWc538i7raCrZnFpMDnFMT23hYVoYndnIKJ4=";
   };
 
-  vendorHash = "sha256-M7ogR1ya+sqlWVQpaXlvJy9YwhdM4XBDw8e2ZBPvEGY=";
+  vendorHash = "sha256-eFoXUroJgrstNYjSYsP6o0vTEW2k/+6JjyVn6bb4um8=";
 
   subPackages = [
     # The server
diff --git a/nixpkgs/pkgs/servers/dns/knot-dns/default.nix b/nixpkgs/pkgs/servers/dns/knot-dns/default.nix
index 26c578cd73c3..41da27f2baa1 100644
--- a/nixpkgs/pkgs/servers/dns/knot-dns/default.nix
+++ b/nixpkgs/pkgs/servers/dns/knot-dns/default.nix
@@ -46,7 +46,9 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  CFLAGS = [ "-O2" "-DNDEBUG" ];
+  CFLAGS = [ "-O2" "-DNDEBUG" ]
+    # https://gitlab.nic.cz/knot/knot-dns/-/issues/909
+    ++ lib.optional stdenv.isDarwin "-D__APPLE_USE_RFC_3542";
 
   doCheck = true;
   checkFlags = [ "V=1" ]; # verbose output in case some test fails
diff --git a/nixpkgs/pkgs/servers/home-assistant/default.nix b/nixpkgs/pkgs/servers/home-assistant/default.nix
index 2323db5b085c..29427a31c1be 100644
--- a/nixpkgs/pkgs/servers/home-assistant/default.nix
+++ b/nixpkgs/pkgs/servers/home-assistant/default.nix
@@ -30,6 +30,16 @@ let
     # Override the version of some packages pinned in Home Assistant's setup.py and requirements_all.txt
 
     (self: super: {
+      aioesphomeapi = super.aioesphomeapi.overridePythonAttrs (oldAttrs: rec {
+        version = "19.2.1";
+        src = fetchFromGitHub {
+          owner = "esphome";
+          repo = "aioesphomeapi";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-WSWGO0kI1m6oaImUYZ6m5WKJ+xPs/rtn5wVq1bDr+bE=";
+        };
+      });
+
       # https://github.com/home-assistant/core/pull/101913
       aiohttp = super.aiohttp.overridePythonAttrs (old: rec {
         version = "3.9.1";
diff --git a/nixpkgs/pkgs/servers/http/bozohttpd/default.nix b/nixpkgs/pkgs/servers/http/bozohttpd/default.nix
index 5fd9f350b117..038548bb16fa 100644
--- a/nixpkgs/pkgs/servers/http/bozohttpd/default.nix
+++ b/nixpkgs/pkgs/servers/http/bozohttpd/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   # bozohttpd is developed in-tree in pkgsrc, canonical hashes can be found at:
   # http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/www/bozohttpd/distinfo
   src = fetchurl {
-    url = "http://www.eterna.com.au/${pname}/${pname}-${version}.tar.bz2";
+    url = "http://eterna23.net/${pname}/${pname}-${version}.tar.bz2";
     hash = "sha512-J1uPqzzy5sWXIWgsrpUtuV2lvTsfIGgCQMbPEClGNpP2/soEf77146PnUotAt7LoeypW/YALYS5nmhbySJDltg==";
   };
 
diff --git a/nixpkgs/pkgs/servers/janus-gateway/default.nix b/nixpkgs/pkgs/servers/janus-gateway/default.nix
index d62be801a4ca..a8af63754277 100644
--- a/nixpkgs/pkgs/servers/janus-gateway/default.nix
+++ b/nixpkgs/pkgs/servers/janus-gateway/default.nix
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "janus-gateway";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "meetecho";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YbY7wcd8YHcPo5w4n54gjOtepYLbboLsrLij7oYzhco=";
+    sha256 = "sha256-Bqb4UO4R5CnV8+2OthGrEVORzH+k+zgzI4UsvwRHgk8=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config gengetopt ];
diff --git a/nixpkgs/pkgs/servers/keycloak/default.nix b/nixpkgs/pkgs/servers/keycloak/default.nix
index ba4601d3b360..14c38c848f25 100644
--- a/nixpkgs/pkgs/servers/keycloak/default.nix
+++ b/nixpkgs/pkgs/servers/keycloak/default.nix
@@ -18,11 +18,11 @@ let
   '';
 in stdenv.mkDerivation rec {
   pname = "keycloak";
-  version = "23.0.1";
+  version = "23.0.3";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    hash = "sha256-N3lkJgy0DrHxiKCIYyAI9VOrwnd5au9mXIdZt46mT0s=";
+    hash = "sha256-5K8+pfn1zoXzBWJevZBx+9kZmefs1AvPoshOKP/dkNY=";
   };
 
   nativeBuildInputs = [ makeWrapper jre ];
diff --git a/nixpkgs/pkgs/servers/klipper/default.nix b/nixpkgs/pkgs/servers/klipper/default.nix
index 13fa39fe828c..4726c63e1448 100644
--- a/nixpkgs/pkgs/servers/klipper/default.nix
+++ b/nixpkgs/pkgs/servers/klipper/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "klipper";
-  version = "unstable-2023-11-16";
+  version = "unstable-2023-12-13";
 
   src = fetchFromGitHub {
     owner = "KevinOConnor";
     repo = "klipper";
-    rev = "187cc2f1b89e3870d694f8db6a64b116992106b7";
-    sha256 = "sha256-CmnWgX8MvQs/5jQuAR8+1bKM4VsFXF2pV/jme75WJLY=";
+    rev = "f0753bd3381a86826082d5bf7a349c1f0b9f7e48";
+    sha256 = "sha256-4xaee/7tXmR4/249lxHocana0KoesdH22/7HXWq1xwk=";
   };
 
   sourceRoot = "${src.name}/klippy";
diff --git a/nixpkgs/pkgs/servers/matrix-synapse/matrix-appservice-slack/default.nix b/nixpkgs/pkgs/servers/matrix-synapse/matrix-appservice-slack/default.nix
index 1fc99bb20336..bbfc36ad4268 100644
--- a/nixpkgs/pkgs/servers/matrix-synapse/matrix-appservice-slack/default.nix
+++ b/nixpkgs/pkgs/servers/matrix-synapse/matrix-appservice-slack/default.nix
@@ -11,6 +11,8 @@ let
   data = lib.importJSON ./pin.json;
 in
 mkYarnPackage rec {
+  inherit nodejs;
+
   pname = "matrix-appservice-slack";
   version = data.version;
 
diff --git a/nixpkgs/pkgs/servers/nextcloud/packages/26.json b/nixpkgs/pkgs/servers/nextcloud/packages/26.json
index 634c6c10115c..279ab29934ad 100644
--- a/nixpkgs/pkgs/servers/nextcloud/packages/26.json
+++ b/nixpkgs/pkgs/servers/nextcloud/packages/26.json
@@ -1,8 +1,8 @@
 {
   "bookmarks": {
-    "sha256": "14dkyqm04d4ix114jbcgbx10zvkv4qlx4n56chpqz0w1y7x8idpd",
-    "url": "https://github.com/nextcloud/bookmarks/releases/download/v13.1.1/bookmarks-13.1.1.tar.gz",
-    "version": "13.1.1",
+    "sha256": "04yngkmsjq6zj5qih86ybfr2cybqsz3gb5dasm6yhmkvd1ar5s39",
+    "url": "https://github.com/nextcloud/bookmarks/releases/download/v13.1.2/bookmarks-13.1.2.tar.gz",
+    "version": "13.1.2",
     "description": "- 📂 Sort bookmarks into folders\n- 🏷 Add tags and personal notes\n- 🔍 Full-text search\n- 📲 Synchronize with all your browsers and devices\n- 👪 Share bookmarks with other users and publicly\n- ☠ Find broken links\n- ⚛ Generate RSS feeds of your collections\n- 📔 Read archived versions of your links in case they are depublished\n- 💬 Create new bookmarks directly from within Nextcloud Talk\n- 💼 Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n   - intl: *\n   - mbstring: *\n - when using MySQL, use at least v8.0",
     "homepage": "https://github.com/nextcloud/bookmarks",
     "licenses": [
@@ -30,9 +30,9 @@
     ]
   },
   "cookbook": {
-    "sha256": "07yj41khwhpsfjwfxgs6xyjhvvavmyby457fh68kx8npinl8n0x4",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.10.4/cookbook-0.10.4.tar.gz",
-    "version": "0.10.4",
+    "sha256": "06d1rhvcwxzi8hl99nz3hg32fznv0q5m06cwjy3gc81j53qz0ksc",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.10.5/cookbook-0.10.5.tar.gz",
+    "version": "0.10.5",
     "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
     "homepage": "https://github.com/nextcloud/cookbook/",
     "licenses": [
@@ -180,9 +180,9 @@
     ]
   },
   "notify_push": {
-    "sha256": "0lwyy1pnyfw464vab1v5k8q0rgarrj5w12cf1nsywjaafb8y1ym0",
-    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.5/notify_push-v0.6.5.tar.gz",
-    "version": "0.6.5",
+    "sha256": "1by9qw9bsf48cyczhfxpz9ifrg2dayvcn26m309dicqgjqkz91hd",
+    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.6/notify_push-v0.6.6.tar.gz",
+    "version": "0.6.6",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
     "homepage": "",
     "licenses": [
@@ -199,6 +199,16 @@
       "apache"
     ]
   },
+  "phonetrack": {
+    "sha256": "1p15vw7c5c1h08czyxi1r6svjd5hjmnc0i6is4vl3xq2kfjmcyyx",
+    "url": "https://github.com/julien-nc/phonetrack/releases/download/v0.7.6/phonetrack-0.7.6.tar.gz",
+    "version": "0.7.6",
+    "description": "# PhoneTrack Nextcloud application\n\n📱 PhoneTrack is a Nextcloud application to track and store mobile device's locations.\n\n🗺 It receives information from mobile phone's logging apps and displays it dynamically on a map.\n\n🌍 Help us to translate this app on [PhoneTrack Crowdin project](https://crowdin.com/project/phonetrack).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CONTRIBUTING.md).\n\nHow to use PhoneTrack :\n\n* Create a tracking session.\n* Give the logging link\\* to the mobile devices. Choose the [logging method](https://gitlab.com/eneiluj/phonetrack-oc/wikis/userdoc#logging-methods) you prefer.\n* Watch the session's devices location in real time (or not) in PhoneTrack or share it with public pages.\n\n(\\*) Don't forget to set the device name in the link (rather than in the logging app settings). Replace \"yourname\" with the desired device name. Setting the device name in logging app settings only works with Owntracks, Traccar and OpenGTS.\n\nOn PhoneTrack main page, while watching a session, you can :\n\n* 📍 Display location history\n* ⛛ Filter points\n* ✎ Manually edit/add/delete points\n* ✎ Edit devices (rename, change colour/shape, move to another session)\n* ⛶ Define geofencing zones for devices\n* ⚇ Define proximity alerts for device pairs\n* 🖧 Share a session to other Nextcloud users or with a public link (read-only)\n* 🔗 Generate public share links with optional restrictions (filters, device name, last positions only, geofencing simplification)\n* 🖫 Import/export a session in GPX format (one file with one track per device or one file per device)\n* 🗠 Display sessions statistics\n* 🔒 [Reserve a device name](https://gitlab.com/eneiluj/phonetrack-oc/wikis/userdoc#device-name-reservation) to make sure only authorised user can log with this name\n* 🗓 Toggle session auto export and auto purge (daily/weekly/monthly)\n* ◔ Choose what to do when point number quota is reached (block logging or delete oldest point)\n\nPublic page and public filtered page work like main page except there is only one session displayed, everything is read-only and there is no need to be logged in.\n\nThis app is tested on Nextcloud 17 with Firefox 57+ and Chromium.\n\nThis app is compatible with theming colours and accessibility themes !\n\nThis app is under development.\n\n## Install\n\nSee the [AdminDoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc) for installation details.\n\nCheck [CHANGELOG](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CHANGELOG.md#change-log) file to see what's new and what's coming in next release.\n\nCheck [AUTHORS](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/AUTHORS.md#authors) file to see complete list of authors.\n\n## Known issues\n\n* PhoneTrack **now works** with Nextcloud group restriction activated. See [admindoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc#issue-with-phonetrack-restricted-to-some-groups-in-nextcloud).\n\nAny feedback will be appreciated.\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
+    "homepage": "https://github.com/julien-nc/phonetrack-oc",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "polls": {
     "sha256": "1dmws4ybv3pzxz5g9c7ghblx0nfal2ssmsg7hjcs1n4xcjc6585p",
     "url": "https://github.com/nextcloud/polls/releases/download/v5.4.2/polls.tar.gz",
diff --git a/nixpkgs/pkgs/servers/nextcloud/packages/27.json b/nixpkgs/pkgs/servers/nextcloud/packages/27.json
index c46ed0023161..939aa9088ce6 100644
--- a/nixpkgs/pkgs/servers/nextcloud/packages/27.json
+++ b/nixpkgs/pkgs/servers/nextcloud/packages/27.json
@@ -1,8 +1,8 @@
 {
   "bookmarks": {
-    "sha256": "14dkyqm04d4ix114jbcgbx10zvkv4qlx4n56chpqz0w1y7x8idpd",
-    "url": "https://github.com/nextcloud/bookmarks/releases/download/v13.1.1/bookmarks-13.1.1.tar.gz",
-    "version": "13.1.1",
+    "sha256": "04yngkmsjq6zj5qih86ybfr2cybqsz3gb5dasm6yhmkvd1ar5s39",
+    "url": "https://github.com/nextcloud/bookmarks/releases/download/v13.1.2/bookmarks-13.1.2.tar.gz",
+    "version": "13.1.2",
     "description": "- 📂 Sort bookmarks into folders\n- 🏷 Add tags and personal notes\n- 🔍 Full-text search\n- 📲 Synchronize with all your browsers and devices\n- 👪 Share bookmarks with other users and publicly\n- ☠ Find broken links\n- ⚛ Generate RSS feeds of your collections\n- 📔 Read archived versions of your links in case they are depublished\n- 💬 Create new bookmarks directly from within Nextcloud Talk\n- 💼 Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n   - intl: *\n   - mbstring: *\n - when using MySQL, use at least v8.0",
     "homepage": "https://github.com/nextcloud/bookmarks",
     "licenses": [
@@ -30,9 +30,9 @@
     ]
   },
   "cookbook": {
-    "sha256": "07yj41khwhpsfjwfxgs6xyjhvvavmyby457fh68kx8npinl8n0x4",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.10.4/cookbook-0.10.4.tar.gz",
-    "version": "0.10.4",
+    "sha256": "06d1rhvcwxzi8hl99nz3hg32fznv0q5m06cwjy3gc81j53qz0ksc",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.10.5/cookbook-0.10.5.tar.gz",
+    "version": "0.10.5",
     "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
     "homepage": "https://github.com/nextcloud/cookbook/",
     "licenses": [
@@ -130,8 +130,8 @@
     ]
   },
   "maps": {
-    "sha256": "1gyxg5xp4mpdrw8630nqcf5yk8cs7a0kvfik2q01p05d533phc4d",
-    "url": "https://github.com/nextcloud/maps/releases/download/v1.2.0/maps-1.2.0.tar.gz",
+    "sha256": "049hrp79fj1bp9nk9isjrk427k238974x7gsj68jplxfrgq3sdkz",
+    "url": "https://github.com/nextcloud/maps/releases/download/v1.2.0-2-nightly/maps-1.2.0-2-nightly.tar.gz",
     "version": "1.2.0",
     "description": "**The whole world fits inside your cloud!**\n\n- **🗺 Beautiful map:** Using [OpenStreetMap](https://www.openstreetmap.org) and [Leaflet](https://leafletjs.com), you can choose between standard map, satellite, topographical, dark mode or even watercolor! 🎨\n- **⭐ Favorites:** Save your favorite places, privately! Sync with [GNOME Maps](https://github.com/nextcloud/maps/issues/30) and mobile apps is planned.\n- **🧭 Routing:** Possible using either [OSRM](http://project-osrm.org), [GraphHopper](https://www.graphhopper.com) or [Mapbox](https://www.mapbox.com).\n- **🖼 Photos on the map:** No more boring slideshows, just show directly where you were!\n- **🙋 Contacts on the map:** See where your friends live and plan your next visit.\n- **📱 Devices:** Lost your phone? Check the map!\n- **〰 Tracks:** Load GPS tracks or past trips. Recording with [PhoneTrack](https://f-droid.org/en/packages/net.eneiluj.nextcloud.phonetrack/) or [OwnTracks](https://owntracks.org) is planned.",
     "homepage": "https://github.com/nextcloud/maps",
@@ -180,9 +180,9 @@
     ]
   },
   "notify_push": {
-    "sha256": "0lwyy1pnyfw464vab1v5k8q0rgarrj5w12cf1nsywjaafb8y1ym0",
-    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.5/notify_push-v0.6.5.tar.gz",
-    "version": "0.6.5",
+    "sha256": "1by9qw9bsf48cyczhfxpz9ifrg2dayvcn26m309dicqgjqkz91hd",
+    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.6/notify_push-v0.6.6.tar.gz",
+    "version": "0.6.6",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
     "homepage": "",
     "licenses": [
@@ -199,6 +199,16 @@
       "apache"
     ]
   },
+  "phonetrack": {
+    "sha256": "1xvdmb2wlcldv8lk4jb8akhi80w26m2jpazfcz641frjm333kxch",
+    "url": "https://github.com/julien-nc/phonetrack/releases/download/v0.7.7/phonetrack-0.7.7.tar.gz",
+    "version": "0.7.7",
+    "description": "# PhoneTrack Nextcloud application\n\n📱 PhoneTrack is a Nextcloud application to track and store mobile device's locations.\n\n🗺 It receives information from mobile phone's logging apps and displays it dynamically on a map.\n\n🌍 Help us to translate this app on [PhoneTrack Crowdin project](https://crowdin.com/project/phonetrack).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CONTRIBUTING.md).\n\nHow to use PhoneTrack :\n\n* Create a tracking session.\n* Give the logging link\\* to the mobile devices. Choose the [logging method](https://gitlab.com/eneiluj/phonetrack-oc/wikis/userdoc#logging-methods) you prefer.\n* Watch the session's devices location in real time (or not) in PhoneTrack or share it with public pages.\n\n(\\*) Don't forget to set the device name in the link (rather than in the logging app settings). Replace \"yourname\" with the desired device name. Setting the device name in logging app settings only works with Owntracks, Traccar and OpenGTS.\n\nOn PhoneTrack main page, while watching a session, you can :\n\n* 📍 Display location history\n* ⛛ Filter points\n* ✎ Manually edit/add/delete points\n* ✎ Edit devices (rename, change colour/shape, move to another session)\n* ⛶ Define geofencing zones for devices\n* ⚇ Define proximity alerts for device pairs\n* 🖧 Share a session to other Nextcloud users or with a public link (read-only)\n* 🔗 Generate public share links with optional restrictions (filters, device name, last positions only, geofencing simplification)\n* 🖫 Import/export a session in GPX format (one file with one track per device or one file per device)\n* 🗠 Display sessions statistics\n* 🔒 [Reserve a device name](https://gitlab.com/eneiluj/phonetrack-oc/wikis/userdoc#device-name-reservation) to make sure only authorised user can log with this name\n* 🗓 Toggle session auto export and auto purge (daily/weekly/monthly)\n* ◔ Choose what to do when point number quota is reached (block logging or delete oldest point)\n\nPublic page and public filtered page work like main page except there is only one session displayed, everything is read-only and there is no need to be logged in.\n\nThis app is tested on Nextcloud 17 with Firefox 57+ and Chromium.\n\nThis app is compatible with theming colours and accessibility themes !\n\nThis app is under development.\n\n## Install\n\nSee the [AdminDoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc) for installation details.\n\nCheck [CHANGELOG](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CHANGELOG.md#change-log) file to see what's new and what's coming in next release.\n\nCheck [AUTHORS](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/AUTHORS.md#authors) file to see complete list of authors.\n\n## Known issues\n\n* PhoneTrack **now works** with Nextcloud group restriction activated. See [admindoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc#issue-with-phonetrack-restricted-to-some-groups-in-nextcloud).\n\nAny feedback will be appreciated.\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
+    "homepage": "https://github.com/julien-nc/phonetrack-oc",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "polls": {
     "sha256": "1dmws4ybv3pzxz5g9c7ghblx0nfal2ssmsg7hjcs1n4xcjc6585p",
     "url": "https://github.com/nextcloud/polls/releases/download/v5.4.2/polls.tar.gz",
diff --git a/nixpkgs/pkgs/servers/nextcloud/packages/28.json b/nixpkgs/pkgs/servers/nextcloud/packages/28.json
index e3c12fcd7ffe..75fb6778d6da 100644
--- a/nixpkgs/pkgs/servers/nextcloud/packages/28.json
+++ b/nixpkgs/pkgs/servers/nextcloud/packages/28.json
@@ -29,6 +29,16 @@
       "agpl"
     ]
   },
+  "cookbook": {
+    "sha256": "0wd4vwfp4i8hfrlqfzac517iqfhzxy1sv0ryb96489q9fvbcvlnp",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.0/cookbook-0.11.0.tar.gz",
+    "version": "0.11.0",
+    "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
+    "homepage": "https://github.com/nextcloud/cookbook/",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "cospend": {
     "sha256": "0v61wdrf4wxjx2xv81599k9k855iyhazxnh4shqvglfb01fi8qhn",
     "url": "https://github.com/julien-nc/cospend-nc/releases/download/v1.5.12/cospend-1.5.12.tar.gz",
@@ -60,9 +70,9 @@
     ]
   },
   "groupfolders": {
-    "sha256": "11dkz7v39qyaxihnjhgy79yx8vjx4a0bdh1ccj67h0wqchxb8kdm",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v16.0.0/groupfolders-v16.0.0.tar.gz",
-    "version": "16.0.0",
+    "sha256": "024qll51hdsky6iad0acf3c00ny9k9mc303r2v4g4h53qx2gksys",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v16.0.1/groupfolders-v16.0.1.tar.gz",
+    "version": "16.0.1",
     "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.",
     "homepage": "https://github.com/nextcloud/groupfolders",
     "licenses": [
@@ -110,15 +120,35 @@
     ]
   },
   "notify_push": {
-    "sha256": "0lwyy1pnyfw464vab1v5k8q0rgarrj5w12cf1nsywjaafb8y1ym0",
-    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.5/notify_push-v0.6.5.tar.gz",
-    "version": "0.6.5",
+    "sha256": "1by9qw9bsf48cyczhfxpz9ifrg2dayvcn26m309dicqgjqkz91hd",
+    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.6/notify_push-v0.6.6.tar.gz",
+    "version": "0.6.6",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
     "homepage": "",
     "licenses": [
       "agpl"
     ]
   },
+  "onlyoffice": {
+    "sha256": "14vqyr7yq95kiwkb2q25qa5kxfx0mri12bbyy2fpm94kk2y2km37",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.0.0/onlyoffice.tar.gz",
+    "version": "9.0.0",
+    "description": "ONLYOFFICE connector allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
+    "homepage": "https://www.onlyoffice.com",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "phonetrack": {
+    "sha256": "1xvdmb2wlcldv8lk4jb8akhi80w26m2jpazfcz641frjm333kxch",
+    "url": "https://github.com/julien-nc/phonetrack/releases/download/v0.7.7/phonetrack-0.7.7.tar.gz",
+    "version": "0.7.7",
+    "description": "# PhoneTrack Nextcloud application\n\n📱 PhoneTrack is a Nextcloud application to track and store mobile device's locations.\n\n🗺 It receives information from mobile phone's logging apps and displays it dynamically on a map.\n\n🌍 Help us to translate this app on [PhoneTrack Crowdin project](https://crowdin.com/project/phonetrack).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CONTRIBUTING.md).\n\nHow to use PhoneTrack :\n\n* Create a tracking session.\n* Give the logging link\\* to the mobile devices. Choose the [logging method](https://gitlab.com/eneiluj/phonetrack-oc/wikis/userdoc#logging-methods) you prefer.\n* Watch the session's devices location in real time (or not) in PhoneTrack or share it with public pages.\n\n(\\*) Don't forget to set the device name in the link (rather than in the logging app settings). Replace \"yourname\" with the desired device name. Setting the device name in logging app settings only works with Owntracks, Traccar and OpenGTS.\n\nOn PhoneTrack main page, while watching a session, you can :\n\n* 📍 Display location history\n* ⛛ Filter points\n* ✎ Manually edit/add/delete points\n* ✎ Edit devices (rename, change colour/shape, move to another session)\n* ⛶ Define geofencing zones for devices\n* ⚇ Define proximity alerts for device pairs\n* 🖧 Share a session to other Nextcloud users or with a public link (read-only)\n* 🔗 Generate public share links with optional restrictions (filters, device name, last positions only, geofencing simplification)\n* 🖫 Import/export a session in GPX format (one file with one track per device or one file per device)\n* 🗠 Display sessions statistics\n* 🔒 [Reserve a device name](https://gitlab.com/eneiluj/phonetrack-oc/wikis/userdoc#device-name-reservation) to make sure only authorised user can log with this name\n* 🗓 Toggle session auto export and auto purge (daily/weekly/monthly)\n* ◔ Choose what to do when point number quota is reached (block logging or delete oldest point)\n\nPublic page and public filtered page work like main page except there is only one session displayed, everything is read-only and there is no need to be logged in.\n\nThis app is tested on Nextcloud 17 with Firefox 57+ and Chromium.\n\nThis app is compatible with theming colours and accessibility themes !\n\nThis app is under development.\n\n## Install\n\nSee the [AdminDoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc) for installation details.\n\nCheck [CHANGELOG](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CHANGELOG.md#change-log) file to see what's new and what's coming in next release.\n\nCheck [AUTHORS](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/AUTHORS.md#authors) file to see complete list of authors.\n\n## Known issues\n\n* PhoneTrack **now works** with Nextcloud group restriction activated. See [admindoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc#issue-with-phonetrack-restricted-to-some-groups-in-nextcloud).\n\nAny feedback will be appreciated.\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
+    "homepage": "https://github.com/julien-nc/phonetrack-oc",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "polls": {
     "sha256": "1jsxgnn6vvbn1v0x8k2zf95pdqlrg6pxrvn32sms8sfzgq3lbn7m",
     "url": "https://github.com/nextcloud/polls/releases/download/v6.0.1/polls.tar.gz",
diff --git a/nixpkgs/pkgs/servers/nextcloud/packages/nextcloud-apps.json b/nixpkgs/pkgs/servers/nextcloud/packages/nextcloud-apps.json
index 8b6f49c524c5..6b5fa0c04446 100644
--- a/nixpkgs/pkgs/servers/nextcloud/packages/nextcloud-apps.json
+++ b/nixpkgs/pkgs/servers/nextcloud/packages/nextcloud-apps.json
@@ -19,6 +19,7 @@
 , "notes": "agpl3Plus"
 , "notify_push": "agpl3Plus"
 , "onlyoffice": "asl20"
+, "phonetrack": "agpl3Plus"
 , "polls": "agpl3Plus"
 , "previewgenerator": "agpl3Plus"
 , "qownnotesapi": "agpl3Plus"
diff --git a/nixpkgs/pkgs/servers/samba/4.x.nix b/nixpkgs/pkgs/servers/samba/4.x.nix
index 30cd068fb853..89889ee7b3a2 100644
--- a/nixpkgs/pkgs/servers/samba/4.x.nix
+++ b/nixpkgs/pkgs/servers/samba/4.x.nix
@@ -61,11 +61,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "samba";
-  version = "4.19.2";
+  version = "4.19.3";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
-    hash = "sha256-nmPwUF4cYx8dsLepNJpR6SXAJsoDrz/V2BIii7WX05M=";
+    hash = "sha256-KAVTuQ8TGxlAWA3yk2U8npvYkGIB9d725ejBYPC/rJY=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/nixpkgs/pkgs/servers/x11/xorg/xwayland.nix b/nixpkgs/pkgs/servers/x11/xorg/xwayland.nix
index 9bfc745ff51a..facde1667747 100644
--- a/nixpkgs/pkgs/servers/x11/xorg/xwayland.nix
+++ b/nixpkgs/pkgs/servers/x11/xorg/xwayland.nix
@@ -45,11 +45,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xwayland";
-  version = "23.2.2";
+  version = "23.2.3";
 
   src = fetchurl {
     url = "mirror://xorg/individual/xserver/${pname}-${version}.tar.xz";
-    sha256 = "sha256-n3wJONKkHpQf+gT5nDXl2yvNPuwDSv6NNdXIEKIusKg=";
+    sha256 = "sha256-652apyMsR0EsiDXsFal8V18DVjcmx4d1T/DAGb0H4wI=";
   };
 
   depsBuildBuild = [
diff --git a/nixpkgs/pkgs/shells/nushell/default.nix b/nixpkgs/pkgs/shells/nushell/default.nix
index 4a7da71db2a7..901ac8fc2746 100644
--- a/nixpkgs/pkgs/shells/nushell/default.nix
+++ b/nixpkgs/pkgs/shells/nushell/default.nix
@@ -22,7 +22,7 @@
 }:
 
 let
-  version = "0.88.0";
+  version = "0.88.1";
 in
 
 rustPlatform.buildRustPackage {
@@ -33,10 +33,10 @@ rustPlatform.buildRustPackage {
     owner = "nushell";
     repo = "nushell";
     rev = version;
-    hash = "sha256-kqN/R5SD+vMJV039/YZvO9OIfjqIRGTZVcTrqBkl+9E=";
+    hash = "sha256-UuKXonAEMX57pZwP37N1FuUtkRE+3xB6Oj30yxSpJk4=";
   };
 
-  cargoHash = "sha256-Mdm5E3TUlMIDpL4VaZf/5OZQ6UVU70qicbdAS8seWSI=";
+  cargoHash = "sha256-oc2Coo5bwX6ASRhXJ4KtzDKhPLBe+ApIpTwsOznOASs=";
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optionals (withDefaultFeatures && stdenv.isLinux) [ python3 ]
diff --git a/nixpkgs/pkgs/shells/nushell/plugins/formats.nix b/nixpkgs/pkgs/shells/nushell/plugins/formats.nix
index 3a9ebe9002fc..fbc2c0711614 100644
--- a/nixpkgs/pkgs/shells/nushell/plugins/formats.nix
+++ b/nixpkgs/pkgs/shells/nushell/plugins/formats.nix
@@ -5,14 +5,18 @@
 , pkg-config
 , IOKit
 , Foundation
+, libclang
 , nix-update-script
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nushell_plugin_formats";
   inherit (nushell) version src;
-  cargoHash = "sha256-K1ZKz0635yWE16mPtJwlfwt2QrqnwsbDm1ot5nTr0RI=";
+  cargoHash = "sha256-eGRaYbYB+zHT8rXm6aCrnPVgyDA8ltsg0GOYgghmov0=";
 
+  env = lib.optionalAttrs stdenv.isDarwin {
+    LIBCLANG_PATH = "${libclang.lib}/lib";
+  };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = lib.optionals stdenv.isDarwin [ IOKit Foundation ];
   cargoBuildFlags = [ "--package nu_plugin_formats" ];
diff --git a/nixpkgs/pkgs/shells/nushell/plugins/gstat.nix b/nixpkgs/pkgs/shells/nushell/plugins/gstat.nix
index e72f3b19f8a2..6563a9c295ff 100644
--- a/nixpkgs/pkgs/shells/nushell/plugins/gstat.nix
+++ b/nixpkgs/pkgs/shells/nushell/plugins/gstat.nix
@@ -5,14 +5,18 @@
 , nushell
 , pkg-config
 , Security
+, libclang
 , nix-update-script
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nushell_plugin_gstat";
   inherit (nushell) version src;
-  cargoHash = "sha256-veQfK1eeVi15TCEiTZaaNAxUXc0LgjLgfP3WJ6rWtWQ=";
+  cargoHash = "sha256-Ar5rFPHf+ugZuugVKVRFACYhh3F0JvQtfp6KibPIByw=";
 
+  env = lib.optionalAttrs stdenv.isDarwin {
+    LIBCLANG_PATH = "${libclang.lib}/lib";
+  };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
   cargoBuildFlags = [ "--package nu_plugin_gstat" ];
diff --git a/nixpkgs/pkgs/shells/nushell/plugins/query.nix b/nixpkgs/pkgs/shells/nushell/plugins/query.nix
index 71679cf069ff..274848f8e8fc 100644
--- a/nixpkgs/pkgs/shells/nushell/plugins/query.nix
+++ b/nixpkgs/pkgs/shells/nushell/plugins/query.nix
@@ -4,14 +4,18 @@
 , nushell
 , IOKit
 , CoreFoundation
+, libclang
 , nix-update-script
 }:
 
 rustPlatform.buildRustPackage {
   pname = "nushell_plugin_query";
   inherit (nushell) version src;
-  cargoHash = "sha256-oS6FtCNWi5eL+uTlH5DiFrXvtwrE9GyXNL15cSFbBcU=";
+  cargoHash = "sha256-NVdXbpmGBAcv47jbel2cccoe0m2FInSSOnMWofqtpiM=";
 
+  env = lib.optionalAttrs stdenv.isDarwin {
+    LIBCLANG_PATH = "${libclang.lib}/lib";
+  };
   buildInputs = lib.optionals stdenv.isDarwin [ IOKit CoreFoundation ];
   cargoBuildFlags = [ "--package nu_plugin_query" ];
 
diff --git a/nixpkgs/pkgs/test/cuda/default.nix b/nixpkgs/pkgs/test/cuda/default.nix
index be88bd3820a9..8431e4b9207d 100644
--- a/nixpkgs/pkgs/test/cuda/default.nix
+++ b/nixpkgs/pkgs/test/cuda/default.nix
@@ -27,4 +27,6 @@ rec {
     cuda-library-samples_cudatoolkit_11_3
     cuda-library-samples_cudatoolkit_11_4
     ;
+
+  __attrsFailEvaluation = true;
 }
diff --git a/nixpkgs/pkgs/test/default.nix b/nixpkgs/pkgs/test/default.nix
index 29dc4b5192ec..cfae7a1edd8c 100644
--- a/nixpkgs/pkgs/test/default.nix
+++ b/nixpkgs/pkgs/test/default.nix
@@ -119,11 +119,11 @@ with pkgs;
 
   macOSSierraShared = callPackage ./macos-sierra-shared {};
 
-  cross = callPackage ./cross {};
+  cross = callPackage ./cross {} // { __attrsFailEvaluation = true; };
 
   php = recurseIntoAttrs (callPackages ./php {});
 
-  pkg-config = recurseIntoAttrs (callPackage ../top-level/pkg-config/tests.nix { });
+  pkg-config = recurseIntoAttrs (callPackage ../top-level/pkg-config/tests.nix { }) // { __recurseIntoDerivationForReleaseJobs = true; };
 
   buildRustCrate = callPackage ../build-support/rust/build-rust-crate/test { };
   importCargoLock = callPackage ../build-support/rust/test/import-cargo-lock { };
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/README.md b/nixpkgs/pkgs/test/nixpkgs-check-by-name/README.md
index 146cea0a64ba..19865ca0952b 100644
--- a/nixpkgs/pkgs/test/nixpkgs-check-by-name/README.md
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/README.md
@@ -4,27 +4,14 @@ This directory implements a program to check the [validity](#validity-checks) of
 It is being used by [this GitHub Actions workflow](../../../.github/workflows/check-by-name.yml).
 This is part of the implementation of [RFC 140](https://github.com/NixOS/rfcs/pull/140).
 
-## API
+## Interface
 
-This API may be changed over time if the CI workflow making use of it is adjusted to deal with the change appropriately.
-
-- Command line: `nixpkgs-check-by-name <NIXPKGS>`
-- Arguments:
-  - `<NIXPKGS>`: The path to the Nixpkgs to check
-  - `--version <VERSION>`: The version of the checks to perform.
-
-    Possible values:
-    - `v0` (default)
-    - `v1`
+The interface of the tool is shown with `--help`:
+```
+cargo run -- --help
+```
 
-    See [validation](#validity-checks) for the differences.
-- Exit code:
-  - `0`: If the [validation](#validity-checks) is successful
-  - `1`: If the [validation](#validity-checks) is not successful
-  - `2`: If an unexpected I/O error occurs
-- Standard error:
-  - Informative messages
-  - Detected problems if validation is not successful
+The interface may be changed over time only if the CI workflow making use of it is adjusted to deal with the change appropriately.
 
 ## Validity checks
 
@@ -32,7 +19,7 @@ These checks are performed by this tool:
 
 ### File structure checks
 - `pkgs/by-name` must only contain subdirectories of the form `${shard}/${name}`, called _package directories_.
-- The `name`'s of package directories must be unique when lowercased
+- The `name`'s of package directories must be unique when lowercased.
 - `name` is a string only consisting of the ASCII characters `a-z`, `A-Z`, `0-9`, `-` or `_`.
 - `shard` is the lowercased first two letters of `name`, expressed in Nix: `shard = toLower (substring 0 2 name)`.
 - Each package directory must contain a `package.nix` file and may contain arbitrary other files.
@@ -41,9 +28,21 @@ These checks are performed by this tool:
 - Each package directory must not refer to files outside itself using symlinks or Nix path expressions.
 
 ### Nix evaluation checks
-- `pkgs.${name}` is defined as `callPackage pkgs/by-name/${shard}/${name}/package.nix args` for some `args`.
-  - **Only after --version v1**: If `pkgs.${name}` is not auto-called from `pkgs/by-name`, `args` must not be empty
-- `pkgs.lib.isDerivation pkgs.${name}` is `true`.
+- For each package directory, the `pkgs.${name}` attribute must be defined as `callPackage pkgs/by-name/${shard}/${name}/package.nix args` for some `args`.
+- For each package directory, `pkgs.lib.isDerivation pkgs.${name}` must be `true`.
+
+### Ratchet checks
+
+Furthermore, this tool implements certain [ratchet](https://qntm.org/ratchet) checks.
+This allows gradually phasing out deprecated patterns without breaking the base branch or having to migrate it all at once.
+It works by not allowing new instances of the pattern to be introduced, but allowing already existing instances.
+The existing instances are coming from `<BASE_NIXPKGS>`, which is then checked against `<NIXPKGS>` for new instances.
+Ratchets should be removed eventually once the pattern is not used anymore.
+
+The current ratchets are:
+
+- New manual definitions of `pkgs.${name}` (e.g. in `pkgs/top-level/all-packages.nix`) with `args = { }`
+  (see [nix evaluation checks](#nix-evaluation-checks)) must not be introduced.
 
 ## Development
 
@@ -86,6 +85,10 @@ Tests are declared in [`./tests`](./tests) as subdirectories imitating Nixpkgs w
   allowing the simulation of package overrides to the real [`pkgs/top-level/all-packages.nix`](../../top-level/all-packages.nix`).
   The default is an empty overlay.
 
+- `base` (optional):
+  Contains another subdirectory imitating Nixpkgs with potentially any of the above structures.
+  This is used for [ratchet checks](#ratchet-checks).
+
 - `expected` (optional):
   A file containing the expected standard output.
   The default is expecting an empty standard output.
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/eval.rs b/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/eval.rs
index 161d013374e7..cd8c70472cf2 100644
--- a/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/eval.rs
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/eval.rs
@@ -1,7 +1,7 @@
 use crate::nixpkgs_problem::NixpkgsProblem;
+use crate::ratchet;
 use crate::structure;
 use crate::validation::{self, Validation::Success};
-use crate::Version;
 use std::path::Path;
 
 use anyhow::Context;
@@ -39,11 +39,10 @@ enum AttributeVariant {
 /// of the form `callPackage <package_file> { ... }`.
 /// See the `eval.nix` file for how this is achieved on the Nix side
 pub fn check_values(
-    version: Version,
     nixpkgs_path: &Path,
     package_names: Vec<String>,
-    eval_accessible_paths: Vec<&Path>,
-) -> validation::Result<()> {
+    eval_accessible_paths: &[&Path],
+) -> validation::Result<ratchet::Nixpkgs> {
     // Write the list of packages we need to check into a temporary JSON file.
     // This can then get read by the Nix evaluation.
     let attrs_file = NamedTempFile::new().context("Failed to create a temporary file")?;
@@ -110,47 +109,58 @@ pub fn check_values(
             String::from_utf8_lossy(&result.stdout)
         ))?;
 
-    Ok(validation::sequence_(package_names.iter().map(
-        |package_name| {
-            let relative_package_file = structure::relative_file_for_package(package_name);
+    Ok(
+        validation::sequence(package_names.into_iter().map(|package_name| {
+            let relative_package_file = structure::relative_file_for_package(&package_name);
             let absolute_package_file = nixpkgs_path.join(&relative_package_file);
 
-            if let Some(attribute_info) = actual_files.get(package_name) {
-                let valid = match &attribute_info.variant {
-                    AttributeVariant::AutoCalled => true,
+            if let Some(attribute_info) = actual_files.get(&package_name) {
+                let check_result = if !attribute_info.is_derivation {
+                    NixpkgsProblem::NonDerivation {
+                        relative_package_file: relative_package_file.clone(),
+                        package_name: package_name.clone(),
+                    }
+                    .into()
+                } else {
+                    Success(())
+                };
+
+                let check_result = check_result.and(match &attribute_info.variant {
+                    AttributeVariant::AutoCalled => Success(ratchet::Package {
+                        empty_non_auto_called: ratchet::EmptyNonAutoCalled::Valid,
+                    }),
                     AttributeVariant::CallPackage { path, empty_arg } => {
                         let correct_file = if let Some(call_package_path) = path {
                             absolute_package_file == *call_package_path
                         } else {
                             false
                         };
-                        // Only check for the argument to be non-empty if the version is V1 or
-                        // higher
-                        let non_empty = if version >= Version::V1 {
-                            !empty_arg
-                        } else {
-                            true
-                        };
-                        correct_file && non_empty
-                    }
-                    AttributeVariant::Other => false,
-                };
 
-                if !valid {
-                    NixpkgsProblem::WrongCallPackage {
-                        relative_package_file: relative_package_file.clone(),
-                        package_name: package_name.clone(),
+                        if correct_file {
+                            Success(ratchet::Package {
+                                // Empty arguments for non-auto-called packages are not allowed anymore.
+                                empty_non_auto_called: if *empty_arg {
+                                    ratchet::EmptyNonAutoCalled::Invalid
+                                } else {
+                                    ratchet::EmptyNonAutoCalled::Valid
+                                },
+                            })
+                        } else {
+                            NixpkgsProblem::WrongCallPackage {
+                                relative_package_file: relative_package_file.clone(),
+                                package_name: package_name.clone(),
+                            }
+                            .into()
+                        }
                     }
-                    .into()
-                } else if !attribute_info.is_derivation {
-                    NixpkgsProblem::NonDerivation {
+                    AttributeVariant::Other => NixpkgsProblem::WrongCallPackage {
                         relative_package_file: relative_package_file.clone(),
                         package_name: package_name.clone(),
                     }
-                    .into()
-                } else {
-                    Success(())
-                }
+                    .into(),
+                });
+
+                check_result.map(|value| (package_name.clone(), value))
             } else {
                 NixpkgsProblem::UndefinedAttr {
                     relative_package_file: relative_package_file.clone(),
@@ -158,6 +168,9 @@ pub fn check_values(
                 }
                 .into()
             }
-        },
-    )))
+        }))
+        .map(|elems| ratchet::Nixpkgs {
+            packages: elems.into_iter().collect(),
+        }),
+    )
 }
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/main.rs b/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/main.rs
index 4cabf8f446f5..18c950d0a6eb 100644
--- a/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/main.rs
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/main.rs
@@ -1,5 +1,6 @@
 mod eval;
 mod nixpkgs_problem;
+mod ratchet;
 mod references;
 mod structure;
 mod utils;
@@ -9,37 +10,43 @@ use crate::structure::check_structure;
 use crate::validation::Validation::Failure;
 use crate::validation::Validation::Success;
 use anyhow::Context;
-use clap::{Parser, ValueEnum};
+use clap::Parser;
 use colored::Colorize;
 use std::io;
 use std::path::{Path, PathBuf};
 use std::process::ExitCode;
 
 /// Program to check the validity of pkgs/by-name
+///
+/// This CLI interface may be changed over time if the CI workflow making use of
+/// it is adjusted to deal with the change appropriately.
+///
+/// Exit code:
+/// - `0`: If the validation is successful
+/// - `1`: If the validation is not successful
+/// - `2`: If an unexpected I/O error occurs
+///
+/// Standard error:
+/// - Informative messages
+/// - Detected problems if validation is not successful
 #[derive(Parser, Debug)]
-#[command(about)]
+#[command(about, verbatim_doc_comment)]
 pub struct Args {
-    /// Path to nixpkgs
+    /// Path to the main Nixpkgs to check.
+    /// For PRs, this should be set to a checkout of the PR branch.
     nixpkgs: PathBuf,
-    /// The version of the checks
-    /// Increasing this may cause failures for a Nixpkgs that succeeded before
-    /// TODO: Remove default once Nixpkgs CI passes this argument
-    #[arg(long, value_enum, default_value_t = Version::V0)]
-    version: Version,
-}
 
-/// The version of the checks
-#[derive(Debug, Clone, PartialEq, PartialOrd, ValueEnum)]
-pub enum Version {
-    /// Initial version
-    V0,
-    /// Empty argument check
-    V1,
+    /// Path to the base Nixpkgs to run ratchet checks against.
+    /// For PRs, this should be set to a checkout of the PRs base branch.
+    /// If not specified, no ratchet checks will be performed.
+    /// However, this flag will become required once CI uses it.
+    #[arg(long)]
+    base: Option<PathBuf>,
 }
 
 fn main() -> ExitCode {
     let args = Args::parse();
-    match check_nixpkgs(&args.nixpkgs, args.version, vec![], &mut io::stderr()) {
+    match process(args.base.as_deref(), &args.nixpkgs, &[], &mut io::stderr()) {
         Ok(true) => {
             eprintln!("{}", "Validated successfully".green());
             ExitCode::SUCCESS
@@ -55,10 +62,11 @@ fn main() -> ExitCode {
     }
 }
 
-/// Checks whether the pkgs/by-name structure in Nixpkgs is valid.
+/// Does the actual work. This is the abstraction used both by `main` and the tests.
 ///
 /// # Arguments
-/// - `nixpkgs_path`: The path to the Nixpkgs to check
+/// - `base_nixpkgs`: Path to the base Nixpkgs to run ratchet checks against.
+/// - `main_nixpkgs`: Path to the main Nixpkgs to check.
 /// - `eval_accessible_paths`:
 ///   Extra paths that need to be accessible to evaluate Nixpkgs using `restrict-eval`.
 ///   This is used to allow the tests to access the mock-nixpkgs.nix file
@@ -68,33 +76,30 @@ fn main() -> ExitCode {
 /// - `Err(e)` if an I/O-related error `e` occurred.
 /// - `Ok(false)` if there are problems, all of which will be written to `error_writer`.
 /// - `Ok(true)` if there are no problems
-pub fn check_nixpkgs<W: io::Write>(
-    nixpkgs_path: &Path,
-    version: Version,
-    eval_accessible_paths: Vec<&Path>,
+pub fn process<W: io::Write>(
+    base_nixpkgs: Option<&Path>,
+    main_nixpkgs: &Path,
+    eval_accessible_paths: &[&Path],
     error_writer: &mut W,
 ) -> anyhow::Result<bool> {
-    let nixpkgs_path = nixpkgs_path.canonicalize().context(format!(
-        "Nixpkgs path {} could not be resolved",
-        nixpkgs_path.display()
-    ))?;
-
-    let check_result = if !nixpkgs_path.join(utils::BASE_SUBPATH).exists() {
-        eprintln!(
-            "Given Nixpkgs path does not contain a {} subdirectory, no check necessary.",
-            utils::BASE_SUBPATH
-        );
-        Success(())
-    } else {
-        match check_structure(&nixpkgs_path)? {
-            Failure(errors) => Failure(errors),
-            Success(package_names) =>
-            // Only if we could successfully parse the structure, we do the evaluation checks
-            {
-                eval::check_values(version, &nixpkgs_path, package_names, eval_accessible_paths)?
-            }
+    // Check the main Nixpkgs first
+    let main_result = check_nixpkgs(main_nixpkgs, eval_accessible_paths, error_writer)?;
+    let check_result = main_result.result_map(|nixpkgs_version| {
+        // If the main Nixpkgs doesn't have any problems, run the ratchet checks against the base
+        // Nixpkgs
+        if let Some(base) = base_nixpkgs {
+            check_nixpkgs(base, eval_accessible_paths, error_writer)?.result_map(
+                |base_nixpkgs_version| {
+                    Ok(ratchet::Nixpkgs::compare(
+                        Some(base_nixpkgs_version),
+                        nixpkgs_version,
+                    ))
+                },
+            )
+        } else {
+            Ok(ratchet::Nixpkgs::compare(None, nixpkgs_version))
         }
-    };
+    })?;
 
     match check_result {
         Failure(errors) => {
@@ -103,15 +108,45 @@ pub fn check_nixpkgs<W: io::Write>(
             }
             Ok(false)
         }
-        Success(_) => Ok(true),
+        Success(()) => Ok(true),
     }
 }
 
+/// Checks whether the pkgs/by-name structure in Nixpkgs is valid.
+///
+/// This does not include ratchet checks, see ../README.md#ratchet-checks
+/// Instead a `ratchet::Nixpkgs` value is returned, whose `compare` method allows performing the
+/// ratchet check against another result.
+pub fn check_nixpkgs<W: io::Write>(
+    nixpkgs_path: &Path,
+    eval_accessible_paths: &[&Path],
+    error_writer: &mut W,
+) -> validation::Result<ratchet::Nixpkgs> {
+    Ok({
+        let nixpkgs_path = nixpkgs_path.canonicalize().context(format!(
+            "Nixpkgs path {} could not be resolved",
+            nixpkgs_path.display()
+        ))?;
+
+        if !nixpkgs_path.join(utils::BASE_SUBPATH).exists() {
+            writeln!(
+                error_writer,
+                "Given Nixpkgs path does not contain a {} subdirectory, no check necessary.",
+                utils::BASE_SUBPATH
+            )?;
+            Success(ratchet::Nixpkgs::default())
+        } else {
+            check_structure(&nixpkgs_path)?.result_map(|package_names|
+                // Only if we could successfully parse the structure, we do the evaluation checks
+                eval::check_values(&nixpkgs_path, package_names, eval_accessible_paths))?
+        }
+    })
+}
+
 #[cfg(test)]
 mod tests {
-    use crate::check_nixpkgs;
+    use crate::process;
     use crate::utils;
-    use crate::Version;
     use anyhow::Context;
     use std::fs;
     use std::path::Path;
@@ -197,10 +232,17 @@ mod tests {
     fn test_nixpkgs(name: &str, path: &Path, expected_errors: &str) -> anyhow::Result<()> {
         let extra_nix_path = Path::new("tests/mock-nixpkgs.nix");
 
+        let base_path = path.join("base");
+        let base_nixpkgs = if base_path.exists() {
+            Some(base_path.as_path())
+        } else {
+            None
+        };
+
         // We don't want coloring to mess up the tests
         let writer = temp_env::with_var("NO_COLOR", Some("1"), || -> anyhow::Result<_> {
             let mut writer = vec![];
-            check_nixpkgs(&path, Version::V1, vec![&extra_nix_path], &mut writer)
+            process(base_nixpkgs, &path, &[&extra_nix_path], &mut writer)
                 .context(format!("Failed test case {name}"))?;
             Ok(writer)
         })?;
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/ratchet.rs b/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/ratchet.rs
new file mode 100644
index 000000000000..c12f1ead2540
--- /dev/null
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/ratchet.rs
@@ -0,0 +1,85 @@
+//! This module implements the ratchet checks, see ../README.md#ratchet-checks
+//!
+//! Each type has a `compare` method that validates the ratchet checks for that item.
+
+use crate::nixpkgs_problem::NixpkgsProblem;
+use crate::structure;
+use crate::validation::{self, Validation, Validation::Success};
+use std::collections::HashMap;
+
+/// The ratchet value for the entirety of Nixpkgs.
+#[derive(Default)]
+pub struct Nixpkgs {
+    /// The ratchet values for each package in `pkgs/by-name`
+    pub packages: HashMap<String, Package>,
+}
+
+impl Nixpkgs {
+    /// Validates the ratchet checks for Nixpkgs
+    pub fn compare(optional_from: Option<Self>, to: Self) -> Validation<()> {
+        validation::sequence_(
+            // We only loop over the current attributes,
+            // we don't need to check ones that were removed
+            to.packages.into_iter().map(|(name, attr_to)| {
+                let attr_from = if let Some(from) = &optional_from {
+                    from.packages.get(&name)
+                } else {
+                    // This pretends that if there's no base version to compare against, all
+                    // attributes existed without conforming to the new strictness check for
+                    // backwards compatibility.
+                    // TODO: Remove this case. This is only needed because the `--base`
+                    // argument is still optional, which doesn't need to be once CI is updated
+                    // to pass it.
+                    Some(&Package {
+                        empty_non_auto_called: EmptyNonAutoCalled::Invalid,
+                    })
+                };
+                Package::compare(&name, attr_from, &attr_to)
+            }),
+        )
+    }
+}
+
+/// The ratchet value for a single package in `pkgs/by-name`
+pub struct Package {
+    /// The ratchet value for the check for non-auto-called empty arguments
+    pub empty_non_auto_called: EmptyNonAutoCalled,
+}
+
+impl Package {
+    /// Validates the ratchet checks for a single package defined in `pkgs/by-name`
+    pub fn compare(name: &str, optional_from: Option<&Self>, to: &Self) -> Validation<()> {
+        EmptyNonAutoCalled::compare(
+            name,
+            optional_from.map(|x| &x.empty_non_auto_called),
+            &to.empty_non_auto_called,
+        )
+    }
+}
+
+/// The ratchet value of a single package in `pkgs/by-name`
+/// for the non-auto-called empty argument check of a single.
+///
+/// This checks that packages defined in `pkgs/by-name` cannot be overridden
+/// with an empty second argument like `callPackage ... { }`.
+#[derive(PartialEq, PartialOrd)]
+pub enum EmptyNonAutoCalled {
+    Invalid,
+    Valid,
+}
+
+impl EmptyNonAutoCalled {
+    /// Validates the non-auto-called empty argument ratchet check for a single package defined in `pkgs/by-name`
+    fn compare(name: &str, optional_from: Option<&Self>, to: &Self) -> Validation<()> {
+        let from = optional_from.unwrap_or(&Self::Valid);
+        if to >= from {
+            Success(())
+        } else {
+            NixpkgsProblem::WrongCallPackage {
+                relative_package_file: structure::relative_file_for_package(name),
+                package_name: name.to_owned(),
+            }
+            .into()
+        }
+    }
+}
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/validation.rs b/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/validation.rs
index e72793851521..b14bfb92eb2e 100644
--- a/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/validation.rs
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/src/validation.rs
@@ -58,6 +58,15 @@ impl<A> Validation<A> {
             Success(value) => Success(f(value)),
         }
     }
+
+    /// Map a `Validation<A>` to a `Result<B>` by applying a function `A -> Result<B>`
+    /// only if there is a `Success` value
+    pub fn result_map<B>(self, f: impl FnOnce(A) -> Result<B>) -> Result<B> {
+        match self {
+            Failure(err) => Ok(Failure(err)),
+            Success(value) => f(value),
+        }
+    }
 }
 
 impl Validation<()> {
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/no-by-name/expected b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/no-by-name/expected
new file mode 100644
index 000000000000..ddcb2df46e5f
--- /dev/null
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/no-by-name/expected
@@ -0,0 +1 @@
+Given Nixpkgs path does not contain a pkgs/by-name subdirectory, no check necessary.
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/all-packages.nix b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/all-packages.nix
new file mode 100644
index 000000000000..d369dd7228dc
--- /dev/null
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/all-packages.nix
@@ -0,0 +1,3 @@
+self: super: {
+  nonDerivation = self.callPackage ./pkgs/by-name/no/nonDerivation/package.nix { };
+}
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/base/all-packages.nix b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/base/all-packages.nix
new file mode 100644
index 000000000000..d369dd7228dc
--- /dev/null
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/base/all-packages.nix
@@ -0,0 +1,3 @@
+self: super: {
+  nonDerivation = self.callPackage ./pkgs/by-name/no/nonDerivation/package.nix { };
+}
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/base/default.nix b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/base/default.nix
new file mode 100644
index 000000000000..2875ea6327ef
--- /dev/null
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/base/default.nix
@@ -0,0 +1 @@
+import ../../mock-nixpkgs.nix { root = ./.; }
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/base/pkgs/by-name/no/nonDerivation/package.nix b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/base/pkgs/by-name/no/nonDerivation/package.nix
new file mode 100644
index 000000000000..a1b92efbbadb
--- /dev/null
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/base/pkgs/by-name/no/nonDerivation/package.nix
@@ -0,0 +1 @@
+{ someDrv }: someDrv
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/default.nix b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/default.nix
new file mode 100644
index 000000000000..af25d1450122
--- /dev/null
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/default.nix
@@ -0,0 +1 @@
+import ../mock-nixpkgs.nix { root = ./.; }
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/expected b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/expected
new file mode 100644
index 000000000000..e69de29bb2d1
--- /dev/null
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/expected
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/pkgs/by-name/no/nonDerivation/package.nix b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/pkgs/by-name/no/nonDerivation/package.nix
new file mode 100644
index 000000000000..a1b92efbbadb
--- /dev/null
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg-gradual/pkgs/by-name/no/nonDerivation/package.nix
@@ -0,0 +1 @@
+{ someDrv }: someDrv
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg/base/default.nix b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg/base/default.nix
new file mode 100644
index 000000000000..2875ea6327ef
--- /dev/null
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg/base/default.nix
@@ -0,0 +1 @@
+import ../../mock-nixpkgs.nix { root = ./.; }
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg/base/pkgs/by-name/README.md b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg/base/pkgs/by-name/README.md
new file mode 100644
index 000000000000..b0d2b34e338a
--- /dev/null
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-empty-arg/base/pkgs/by-name/README.md
@@ -0,0 +1 @@
+(this is just here so the directory can get tracked by git)
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-no-call-package/all-packages.nix b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-no-call-package/all-packages.nix
index 4fad280ae1c7..853c3a87db56 100644
--- a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-no-call-package/all-packages.nix
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-no-call-package/all-packages.nix
@@ -1,3 +1,3 @@
 self: super: {
-  nonDerivation = null;
+  nonDerivation = self.someDrv;
 }
diff --git a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-no-file/all-packages.nix b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-no-file/all-packages.nix
index 4c521d2d4468..dc07f69b40ee 100644
--- a/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-no-file/all-packages.nix
+++ b/nixpkgs/pkgs/test/nixpkgs-check-by-name/tests/override-no-file/all-packages.nix
@@ -1,3 +1,3 @@
 self: super: {
-  nonDerivation = self.callPackage ({ }: { }) { };
+  nonDerivation = self.callPackage ({ someDrv }: someDrv) { };
 }
diff --git a/nixpkgs/pkgs/test/release/default.nix b/nixpkgs/pkgs/test/release/default.nix
new file mode 100644
index 000000000000..f112ee6b9212
--- /dev/null
+++ b/nixpkgs/pkgs/test/release/default.nix
@@ -0,0 +1,46 @@
+# Adapted from lib/tests/release.nix
+{ pkgs-path ? ../../..
+, pkgs ? import pkgs-path {}
+, lib ? pkgs.lib
+, nix ? pkgs.nix
+}:
+
+#
+# This verifies that release-attrpaths-superset.nix does not encounter
+# infinite recursion or non-tryEval-able failures.
+#
+pkgs.runCommand "all-attrs-eval-under-tryEval" {
+  nativeBuildInputs = [
+    nix
+    pkgs.gitMinimal
+  ] ++ lib.optional pkgs.stdenv.isLinux pkgs.inotify-tools;
+  strictDeps = true;
+}
+''
+  datadir="${nix}/share"
+  export TEST_ROOT=$(pwd)/test-tmp
+  export HOME=$(mktemp -d)
+  export NIX_BUILD_HOOK=
+  export NIX_CONF_DIR=$TEST_ROOT/etc
+  export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
+  export NIX_LOG_DIR=$TEST_ROOT/var/log/nix
+  export NIX_STATE_DIR=$TEST_ROOT/var/nix
+  export NIX_STORE_DIR=$TEST_ROOT/store
+  export PAGER=cat
+  cacheDir=$TEST_ROOT/binary-cache
+
+  nix-store --init
+
+  cp -r ${pkgs-path + "/lib"} lib
+  cp -r ${pkgs-path + "/pkgs"} pkgs
+  cp -r ${pkgs-path + "/default.nix"} default.nix
+  cp -r ${pkgs-path + "/nixos"} nixos
+  cp -r ${pkgs-path + "/maintainers"} maintainers
+  cp -r ${pkgs-path + "/.version"} .version
+  cp -r ${pkgs-path + "/doc"} doc
+  echo "Running pkgs/top-level/release-attrpaths-superset.nix"
+  nix-instantiate --eval --strict --json pkgs/top-level/release-attrpaths-superset.nix -A names > /dev/null
+
+  mkdir $out
+  echo success > $out/${nix.version}
+''
diff --git a/nixpkgs/pkgs/tools/admin/chamber/default.nix b/nixpkgs/pkgs/tools/admin/chamber/default.nix
index 6e115f6eb6a5..efc49bfde1aa 100644
--- a/nixpkgs/pkgs/tools/admin/chamber/default.nix
+++ b/nixpkgs/pkgs/tools/admin/chamber/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "chamber";
-  version = "2.13.5";
+  version = "2.13.6";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uwTEHxaPG1jDeR+84ZrsP6bg5DBsKIeuHeZAtgrsy/s=";
+    sha256 = "sha256-jaD93q8s2uLb8jIvUBAnT76brDos46Wk06UKXAgHQGs=";
   };
 
   CGO_ENABLED = 0;
diff --git a/nixpkgs/pkgs/tools/admin/fits-cloudctl/default.nix b/nixpkgs/pkgs/tools/admin/fits-cloudctl/default.nix
index 0e4b61489173..ad661b97c68d 100644
--- a/nixpkgs/pkgs/tools/admin/fits-cloudctl/default.nix
+++ b/nixpkgs/pkgs/tools/admin/fits-cloudctl/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "fits-cloudctl";
-  version = "0.12.6";
+  version = "0.12.11";
 
   src = fetchFromGitHub {
     owner = "fi-ts";
     repo = "cloudctl";
     rev = "v${version}";
-    sha256 = "sha256-WecKgLnfasqNp4G9e24EPjSeA9dqiEhl8KjVQ/KbmKk=";
+    sha256 = "sha256-rp5iMp6Ah2JESpY8mdwez25D9GghoIMUqMNst72z2fM=";
   };
 
-  vendorHash = "sha256-f9KJyMu4WD96IPTWSuGfQDZvayEbZ+1KeQj/99Ck/I4=";
+  vendorHash = "sha256-3RowPOLtEDxXFcb2KizuVP3O0uTwkuUQ8UB2AFPaVVE=";
 
   meta = with lib; {
     description = "Command-line client for FI-TS Finance Cloud Native services";
diff --git a/nixpkgs/pkgs/tools/filesystems/bcache-tools/default.nix b/nixpkgs/pkgs/tools/filesystems/bcache-tools/default.nix
index f6dfdd84d8c4..58f6a05992e9 100644
--- a/nixpkgs/pkgs/tools/filesystems/bcache-tools/default.nix
+++ b/nixpkgs/pkgs/tools/filesystems/bcache-tools/default.nix
@@ -35,10 +35,6 @@ stdenv.mkDerivation rec {
     "UDEVLIBDIR=${placeholder "out"}/lib/udev/"
   ];
 
-  preBuild = ''
-    sed -e "s|/bin/sh|${bash}/bin/sh|" -i *.rules
-  '';
-
   preInstall = ''
     mkdir -p "$out/sbin" "$out/lib/udev/rules.d" "$out/share/man/man8"
   '';
diff --git a/nixpkgs/pkgs/tools/misc/cf-terraforming/default.nix b/nixpkgs/pkgs/tools/misc/cf-terraforming/default.nix
index e6858863fc4e..d3c1490d528e 100644
--- a/nixpkgs/pkgs/tools/misc/cf-terraforming/default.nix
+++ b/nixpkgs/pkgs/tools/misc/cf-terraforming/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cf-terraforming";
-  version = "0.16.1";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cf-terraforming";
     rev = "v${version}";
-    sha256 = "sha256-C046oNN+tGvVIakCGJKKQBNHX+L1naaMDIk7tNGNjeQ=";
+    sha256 = "sha256-XFL9BfTpZaIsNeJLT3wEPFBvyO/VxvFjpApjjxvaGKw=";
   };
 
-  vendorHash = "sha256-bfxF0qlEbZDczEuFhckqsG00/IzuM18ut/AQ9EMwdh0=";
+  vendorHash = "sha256-j4J6VAXT+CdU4WkISBunJn6B25CDdaarhFnnLaC4cBE=";
   ldflags = [ "-X github.com/cloudflare/cf-terraforming/internal/app/cf-terraforming/cmd.versionString=${version}" ];
 
   # The test suite insists on downloading a binary release of Terraform from
diff --git a/nixpkgs/pkgs/tools/misc/esphome/default.nix b/nixpkgs/pkgs/tools/misc/esphome/default.nix
index 2b683e73ed0f..6e8c3a91e278 100644
--- a/nixpkgs/pkgs/tools/misc/esphome/default.nix
+++ b/nixpkgs/pkgs/tools/misc/esphome/default.nix
@@ -3,7 +3,7 @@
 , python3Packages
 , fetchFromGitHub
 , platformio
-, esptool_3
+, esptool
 , git
 }:
 
@@ -17,7 +17,7 @@ in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
   version = "2023.11.6";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = pname;
@@ -26,6 +26,10 @@ python.pkgs.buildPythonApplication rec {
     hash = "sha256-9LqZlhCt+7p6tnSHFhbnUzkEOJQDsg/Pd/hgd/Il0ZQ=";
   };
 
+  nativeBuildInputs = with python.pkgs; [
+    setuptools
+  ];
+
   postPatch = ''
     # remove all version pinning (E.g tornado==5.1.1 -> tornado)
     sed -i -e "s/==[0-9.]*//" requirements.txt
@@ -70,7 +74,7 @@ python.pkgs.buildPythonApplication rec {
     # platformio is used in esphomeyaml/platformio_api.py
     # esptool is used in esphomeyaml/__main__.py
     # git is used in esphomeyaml/writer.py
-    "--prefix PATH : ${lib.makeBinPath [ platformio esptool_3 git ]}"
+    "--prefix PATH : ${lib.makeBinPath [ platformio esptool git ]}"
     "--set ESPHOME_USE_SUBPROCESS ''"
   ];
 
diff --git a/nixpkgs/pkgs/tools/misc/esptool/3.nix b/nixpkgs/pkgs/tools/misc/esptool/3.nix
deleted file mode 100644
index a0b13ece1646..000000000000
--- a/nixpkgs/pkgs/tools/misc/esptool/3.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{ lib, fetchFromGitHub, fetchpatch, python3 }:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "esptool";
-  version = "3.3.2";
-
-  src = fetchFromGitHub {
-    owner = "espressif";
-    repo = "esptool";
-    rev = "v${version}";
-    hash = "sha256-hpPL9KNPA+S57SJoKnQewBCOybDbKep0t5RKw9a9GjM=";
-  };
-
-  patches = [
-    # https://github.com/espressif/esptool/pull/802
-    (fetchpatch {
-      name = "bitstring-4-compatibility.patch";
-      url = "https://github.com/espressif/esptool/commit/16fa58415be2a7ff059ece40d4545288565d0a23.patch";
-      hash = "sha256-FYa9EvyET4P8VkdyMzJBkdxVYm0tFt2GPnfsjzBnevE=";
-      excludes = [ "setup.py" ];
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace test/test_imagegen.py \
-      --replace "sys.executable, ESPTOOL_PY" "ESPTOOL_PY"
-  '';
-
-  propagatedBuildInputs = with python3.pkgs; [
-    bitstring
-    cryptography
-    ecdsa
-    pyserial
-    reedsolo
-  ];
-
-  # wrapPythonPrograms will overwrite esptool.py with a bash script,
-  # but espefuse.py tries to import it. Since we don't add any binary paths,
-  # use patchPythonScript directly.
-  dontWrapPythonPrograms = true;
-  postFixup = ''
-    buildPythonPath "$out $pythonPath"
-    for f in $out/bin/*.py; do
-        echo "Patching $f"
-        patchPythonScript "$f"
-    done
-  '';
-
-  nativeCheckInputs = with python3.pkgs; [
-    pyelftools
-  ];
-
-  # tests mentioned in `.github/workflows/test_esptool.yml`
-  checkPhase = ''
-    runHook preCheck
-
-    export ESPTOOL_PY=$out/bin/esptool.py
-    ${python3.interpreter} test/test_imagegen.py
-    ${python3.interpreter} test/test_espsecure.py
-    ${python3.interpreter} test/test_merge_bin.py
-    ${python3.interpreter} test/test_modules.py
-
-    runHook postCheck
-  '';
-
-  meta = with lib; {
-    description = "ESP8266 and ESP32 serial bootloader utility";
-    homepage = "https://github.com/espressif/esptool";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ hexa ];
-    platforms = with platforms; linux ++ darwin;
-  };
-}
diff --git a/nixpkgs/pkgs/tools/misc/fw/default.nix b/nixpkgs/pkgs/tools/misc/fw/default.nix
index e43c6ef31be1..54d263fc112f 100644
--- a/nixpkgs/pkgs/tools/misc/fw/default.nix
+++ b/nixpkgs/pkgs/tools/misc/fw/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fw";
-  version = "2.19.0";
+  version = "2.19.1";
 
   src = fetchFromGitHub {
     owner = "brocode";
     repo = "fw";
     rev = "v${version}";
-    hash = "sha256-6+sB/jGkVrpeqfgFdmUdU1/gOapD6fXFG5E3Rsu9rC0=";
+    hash = "sha256-fG1N/3Er7BvXOJTMGooaIMa5I9iNwnH+1om2jcWkI68=";
   };
 
-  cargoHash = "sha256-0/CtJyWr2TbEUOlHLqgPIKwInForcT9x5agw7O/6TYU=";
+  cargoHash = "sha256-1d2uX/A1HZAmAI3d0iet1NkG0IFuJpVnhWxpY0jVVUI=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/nixpkgs/pkgs/tools/misc/fzf/default.nix b/nixpkgs/pkgs/tools/misc/fzf/default.nix
index df10755f14c9..0fd40b8732bd 100644
--- a/nixpkgs/pkgs/tools/misc/fzf/default.nix
+++ b/nixpkgs/pkgs/tools/misc/fzf/default.nix
@@ -8,7 +8,6 @@
 , bc
 , ncurses
 , perl
-, glibcLocales
 , testers
 , fzf
 }:
@@ -19,7 +18,7 @@ let
   # warnings on non-nixos machines
   ourPerl = if !stdenv.isLinux then perl else (
     writeShellScriptBin "perl" ''
-      export LOCALE_ARCHIVE="${glibcLocales}/lib/locale/locale-archive"
+      export PERL_BADLANG=0
       exec ${perl}/bin/perl "$@"
     '');
 in
diff --git a/nixpkgs/pkgs/tools/misc/hexyl/default.nix b/nixpkgs/pkgs/tools/misc/hexyl/default.nix
index d502e84e5607..fa68fb4a2d43 100644
--- a/nixpkgs/pkgs/tools/misc/hexyl/default.nix
+++ b/nixpkgs/pkgs/tools/misc/hexyl/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hexyl";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+jmMy5Hi4EfMh/rBzBs5b+f48OZcR/Tw7IU1uTbwiCo=";
+    hash = "sha256-di7SBuB4LsnqlP3BdMcsSLj4zpyKA/ninVpRyR9AJaI=";
   };
 
-  cargoHash = "sha256-TjJ0645TRlNzduQgxYLZWz+rLFfRv12GuwXBcmNr/h8=";
+  cargoHash = "sha256-fXrdOiCmRgMPJxZIS/SkTkZZkag8ZUhNnMlU4k1m/+0=";
 
   meta = with lib; {
     description = "A command-line hex viewer";
diff --git a/nixpkgs/pkgs/tools/misc/lesspipe/default.nix b/nixpkgs/pkgs/tools/misc/lesspipe/default.nix
index fcd46e0e85fd..f478aaea0519 100644
--- a/nixpkgs/pkgs/tools/misc/lesspipe/default.nix
+++ b/nixpkgs/pkgs/tools/misc/lesspipe/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lesspipe";
-  version = "2.10";
+  version = "2.11";
 
   src = fetchFromGitHub {
     owner = "wofr06";
     repo = "lesspipe";
     rev = "v${version}";
-    sha256 = "sha256-fLDB0rUo1kfPs0Xy2s1gG5ZsRjk1h1yYqjXkQC4qPf0=";
+    hash = "sha256-jJrKiRdrargk0JzcPWxBZGyOpMfTIONHG8HNRecazVo=";
   };
 
   nativeBuildInputs = [ perl makeWrapper ];
diff --git a/nixpkgs/pkgs/tools/networking/chrony/default.nix b/nixpkgs/pkgs/tools/networking/chrony/default.nix
index c188fbb7ccd8..74132e792447 100644
--- a/nixpkgs/pkgs/tools/networking/chrony/default.nix
+++ b/nixpkgs/pkgs/tools/networking/chrony/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "chrony";
-  version = "4.4";
+  version = "4.5";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/chrony/${pname}-${version}.tar.gz";
-    hash = "sha256-6vsH5tr5KxQiAPR4hW3+1u/J6i0Ubu3tXtywm5MScIg=";
+    hash = "sha256-Gf4dn0Zk1EWmmpbHHo/bYLzY3yTHPROG4CKH9zZq1CI=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/nixpkgs/pkgs/tools/networking/quicktun/default.nix b/nixpkgs/pkgs/tools/networking/quicktun/default.nix
index b997aad0c2d6..2c1799387df8 100644
--- a/nixpkgs/pkgs/tools/networking/quicktun/default.nix
+++ b/nixpkgs/pkgs/tools/networking/quicktun/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, libsodium }:
+{ lib, stdenv, fetchFromGitHub, libsodium, nixosTests }:
 
 stdenv.mkDerivation {
   pname = "quicktun";
@@ -22,11 +22,13 @@ stdenv.mkDerivation {
     install -vD out/quicktun* -t $out/bin
   '';
 
+  passthru.tests.quicktun = nixosTests.quicktun;
+
   meta = with lib; {
     broken = stdenv.isDarwin;
     description = "Very simple, yet secure VPN software";
     homepage = "http://wiki.ucis.nl/QuickTun";
-    maintainers = [ ];
+    maintainers = with maintainers; [ h7x4 ];
     platforms = platforms.unix;
     license = licenses.bsd2;
   };
diff --git a/nixpkgs/pkgs/tools/nix/fh/default.nix b/nixpkgs/pkgs/tools/nix/fh/default.nix
index 3ffeeaf23033..16df9471e694 100644
--- a/nixpkgs/pkgs/tools/nix/fh/default.nix
+++ b/nixpkgs/pkgs/tools/nix/fh/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fh";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "DeterminateSystems";
     repo = "fh";
     rev = "v${version}";
-    hash = "sha256-O0WcLEtbb5m3RA3LyWbD++fFt0Bk/pP16yhxRb+cGkM=";
+    hash = "sha256-G2bLYand61E/s652Q+5XSfXdM6XUWixiXRRMd3HvfM4=";
   };
 
-  cargoHash = "sha256-cGBYDwrw4NsbtE5bhETQ+YuBXMy1i7vNQaoTiuHYBXQ=";
+  cargoHash = "sha256-c3XxJQf2uHvj1X/djKyQg2AtrXdROyIVwLeYxFgHDNI=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/nixpkgs/pkgs/tools/security/buttercup-desktop/default.nix b/nixpkgs/pkgs/tools/security/buttercup-desktop/default.nix
index 43220d0ccabc..1692c246df70 100644
--- a/nixpkgs/pkgs/tools/security/buttercup-desktop/default.nix
+++ b/nixpkgs/pkgs/tools/security/buttercup-desktop/default.nix
@@ -2,10 +2,10 @@
 
 let
   pname = "buttercup-desktop";
-  version = "2.21.0";
+  version = "2.24.3";
   src = fetchurl {
     url = "https://github.com/buttercup/buttercup-desktop/releases/download/v${version}/Buttercup-linux-x86_64.AppImage";
-    sha256 = "sha256-OFqaxrYk1vyZigr2FN6okMjBdb2SIevENF49ubbHD8c=";
+    sha256 = "sha256-ZSKsxlxP2jNUxEeF2Lfuj2yW0KqHozjPoioq4t0uzfo=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname src version; };
 
diff --git a/nixpkgs/pkgs/tools/security/exploitdb/default.nix b/nixpkgs/pkgs/tools/security/exploitdb/default.nix
index 6572b0561fad..e441a25520a8 100644
--- a/nixpkgs/pkgs/tools/security/exploitdb/default.nix
+++ b/nixpkgs/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-12-13";
+  version = "2023-12-15";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-DnGHtEF31MN82IrCPcH5HlRdcu6A5XACkOTT3ytzrig=";
+    hash = "sha256-ArPcg66mWu4i/H8KWKkGG/tW0wxwWMyIr4VuQiqpyKo=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/tools/security/fingerprintx/default.nix b/nixpkgs/pkgs/tools/security/fingerprintx/default.nix
index 9055f9002391..f0de7cfaab86 100644
--- a/nixpkgs/pkgs/tools/security/fingerprintx/default.nix
+++ b/nixpkgs/pkgs/tools/security/fingerprintx/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "fingerprintx";
-  version = "1.1.10";
+  version = "1.1.12";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "fingerprintx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WwIIZlO310519aEPpvi3pY2Jn3HRNUZNiwoAyZ4VP1A=";
+    hash = "sha256-jCWWCLLh2mSVvURFw+6eE+wss6/zlGiLBQ4VW2ar+iw=";
   };
 
   vendorHash = "sha256-TMy6FwAFlo+ARvm+RiRqly0xIk4lBCXuZrtdnNSMSxw=";
diff --git a/nixpkgs/pkgs/tools/security/metasploit/Gemfile b/nixpkgs/pkgs/tools/security/metasploit/Gemfile
index 6e3c08b9910e..3f64895d3673 100644
--- a/nixpkgs/pkgs/tools/security/metasploit/Gemfile
+++ b/nixpkgs/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.46"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.47"
diff --git a/nixpkgs/pkgs/tools/security/metasploit/Gemfile.lock b/nixpkgs/pkgs/tools/security/metasploit/Gemfile.lock
index 83abed7e7435..57f922329c23 100644
--- a/nixpkgs/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/nixpkgs/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: f05bef8a949ac002f2a17308a55b7afa84ca5882
-  ref: refs/tags/6.3.46
+  revision: e9a1adf7e1a5edb3f76bd537fe6fa5c75435aec9
+  ref: refs/tags/6.3.47
   specs:
-    metasploit-framework (6.3.46)
+    metasploit-framework (6.3.47)
       actionpack (~> 7.0.0)
       activerecord (~> 7.0.0)
       activesupport (~> 7.0.0)
@@ -35,7 +35,7 @@ GIT
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 2.0.159)
+      metasploit-payloads (= 2.0.161)
       metasploit_data_models
       metasploit_payloads-mettle (= 1.0.26)
       mqtt
@@ -82,7 +82,7 @@ GIT
       rex-zip
       ruby-macho
       ruby-mysql
-      ruby_smb (~> 3.2.0)
+      ruby_smb (~> 3.3.0)
       rubyntlm
       rubyzip
       sinatra
@@ -253,7 +253,7 @@ GEM
       activemodel (~> 7.0)
       activesupport (~> 7.0)
       railties (~> 7.0)
-    metasploit-payloads (2.0.159)
+    metasploit-payloads (2.0.161)
     metasploit_data_models (6.0.3)
       activerecord (~> 7.0)
       activesupport (~> 7.0)
@@ -393,7 +393,7 @@ GEM
     ruby-mysql (4.1.0)
     ruby-rc4 (0.1.5)
     ruby2_keywords (0.0.5)
-    ruby_smb (3.2.8)
+    ruby_smb (3.3.0)
       bindata
       openssl-ccm
       openssl-cmac
@@ -463,4 +463,4 @@ DEPENDENCIES
   metasploit-framework!
 
 BUNDLED WITH
-   2.4.13
+   2.4.22
diff --git a/nixpkgs/pkgs/tools/security/metasploit/default.nix b/nixpkgs/pkgs/tools/security/metasploit/default.nix
index 6ba303d15983..6c30b6a05f8a 100644
--- a/nixpkgs/pkgs/tools/security/metasploit/default.nix
+++ b/nixpkgs/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.3.46";
+  version = "6.3.47";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = "refs/tags/${version}";
-    hash = "sha256-aKQfy4PRl+aOamvlutFX16c3b4qGcVLfOtA+l2bhAOo=";
+    hash = "sha256-I1BpYCS2wLrvAKwqKn0QDOf0SvdsmT58OtiBDXwJkh8=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/tools/security/metasploit/gemset.nix b/nixpkgs/pkgs/tools/security/metasploit/gemset.nix
index ebaf66de9b60..f185105372f4 100644
--- a/nixpkgs/pkgs/tools/security/metasploit/gemset.nix
+++ b/nixpkgs/pkgs/tools/security/metasploit/gemset.nix
@@ -664,12 +664,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "f05bef8a949ac002f2a17308a55b7afa84ca5882";
-      sha256 = "1sh0w5k9fgnh7bgm4wc6i9pkg9ypaz8vmrbbda7fd5yihg5iz938";
+      rev = "e9a1adf7e1a5edb3f76bd537fe6fa5c75435aec9";
+      sha256 = "07wj15y0v0fq79y3x6bcyx5g9rqc21yjlamc03pvmh5n4ih6jl13";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.3.46";
+    version = "6.3.47";
   };
   metasploit-model = {
     groups = ["default"];
@@ -686,10 +686,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1d4jg0wqqqnyk5ba8rpxdz1hd980qmdwpi4fankr036rpm4b79m1";
+      sha256 = "1naxfj3jcr5gfsr5lbkis9ww2mw6c2i97k1zdidajpr91dyj2314";
       type = "gem";
     };
-    version = "2.0.159";
+    version = "2.0.161";
   };
   metasploit_data_models = {
     groups = ["default"];
@@ -1377,10 +1377,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "199szf6px6lxpxbig57xsy6phg7jka0w3psyhmfrp3gdcv7f851w";
+      sha256 = "1xfjl89a46xg1w98ywa2byf23jmhh3xyj4r501hgc7vma1i5gw3v";
       type = "gem";
     };
-    version = "3.2.8";
+    version = "3.3.0";
   };
   rubyntlm = {
     groups = ["default"];
diff --git a/nixpkgs/pkgs/top-level/all-packages.nix b/nixpkgs/pkgs/top-level/all-packages.nix
index de307f75df0e..0b8906ce8a9d 100644
--- a/nixpkgs/pkgs/top-level/all-packages.nix
+++ b/nixpkgs/pkgs/top-level/all-packages.nix
@@ -104,10 +104,10 @@ with pkgs;
 
   ### Evaluating the entire Nixpkgs naively will fail, make failure fast
   AAAAAASomeThingsFailToEvaluate = throw ''
-    Please be informed that this pseudo-package is not the only part of
-    Nixpkgs that fails to evaluate. You should not evaluate entire Nixpkgs
-    without some special measures to handle failing packages, like those taken
-    by Hydra.
+    Please be informed that this pseudo-package is not the only part
+    of Nixpkgs that fails to evaluate. You should not evaluate
+    entire Nixpkgs without some special measures to handle failing
+    packages, like using pkgs/top-level/release-attrpaths.nix.
   '';
 
   tests = callPackages ../test { };
@@ -116,7 +116,7 @@ with pkgs;
     # We don't want nix-env -q to enter this, because all of these are aliases.
     dontRecurseIntoAttrs (
       import ./pkg-config/defaultPkgConfigPackages.nix pkgs
-    );
+    ) // { __attrsFailEvaluation = true; };
 
   ### Nixpkgs maintainer tools
 
@@ -159,6 +159,7 @@ with pkgs;
       system = stdenv.hostPlatform.system;
       callTest = config: config.test.driver;
     };
+    __attrsFailEvaluation = true;
   };
 
   ### BUILD SUPPORT
@@ -902,7 +903,7 @@ with pkgs;
 
   dockerTools = callPackage ../build-support/docker {
     writePython3 = buildPackages.writers.writePython3;
-  };
+  } // { __attrsFailEvaluation = true; };
 
   fakeNss = callPackage ../build-support/fake-nss { };
 
@@ -2160,7 +2161,7 @@ with pkgs;
   vrrtest = callPackage ../tools/video/vrrtest { };
 
   winbox = callPackage ../tools/admin/winbox {
-    wine = wineWowPackages.staging;
+    wine = wineWowPackages.stable;
   };
 
   wtwitch = callPackage ../tools/video/wtwitch { };
@@ -5304,8 +5305,6 @@ with pkgs;
 
   esptool = callPackage ../tools/misc/esptool { };
 
-  esptool_3 = callPackage ../tools/misc/esptool/3.nix { };
-
   esptool-ck = callPackage ../tools/misc/esptool-ck { };
 
   ephemeralpg = callPackage ../development/tools/database/ephemeralpg { };
@@ -9898,8 +9897,6 @@ with pkgs;
 
   kubergrunt = callPackage ../applications/networking/cluster/kubergrunt { };
 
-  kubo = callPackage ../applications/networking/kubo { };
-
   kubo-migrator-all-fs-repo-migrations = callPackage ../applications/networking/kubo-migrator/all-migrations.nix { };
   kubo-migrator-unwrapped = callPackage ../applications/networking/kubo-migrator/unwrapped.nix { };
   kubo-migrator = callPackage ../applications/networking/kubo-migrator { };
@@ -10095,6 +10092,7 @@ with pkgs;
 
   matrix-appservice-slack = callPackage ../servers/matrix-synapse/matrix-appservice-slack {
     matrix-sdk-crypto-nodejs = matrix-sdk-crypto-nodejs-0_1_0-beta_3;
+    nodejs = nodejs_18;
   };
 
   matrix-appservice-discord = callPackage ../servers/matrix-appservice-discord {
@@ -10346,9 +10344,9 @@ with pkgs;
   inherit (callPackages ../build-support/node/fetch-npm-deps { })
     fetchNpmDeps prefetch-npm-deps;
 
-  nodePackages_latest = dontRecurseIntoAttrs nodejs_latest.pkgs;
+  nodePackages_latest = dontRecurseIntoAttrs nodejs_latest.pkgs // { __attrsFailEvaluation = true; };
 
-  nodePackages = dontRecurseIntoAttrs nodejs.pkgs;
+  nodePackages = dontRecurseIntoAttrs nodejs.pkgs // { __attrsFailEvaluation = true; };
 
   node2nix = nodePackages.node2nix;
 
@@ -16253,7 +16251,8 @@ with pkgs;
      # Prefer native-bignum to avoid linking issues with gmp
      else if stdenv.hostPlatform.isStatic
      then haskell.packages.native-bignum.ghc94
-     else haskell.packages.ghc94);
+     else haskell.packages.ghc94)
+  // { __recurseIntoDerivationForReleaseJobs = true; };
 
   # haskellPackages.ghc is build->host (it exposes the compiler used to build the
   # set, similarly to stdenv.cc), but pkgs.ghc should be host->target to be more
@@ -16834,7 +16833,7 @@ with pkgs;
     ocamlPackages = ocaml-ng.ocamlPackages_4_14;
   };
 
-  ocaml-ng = callPackage ./ocaml-packages.nix { };
+  ocaml-ng = callPackage ./ocaml-packages.nix { } // { __attrsFailEvaluation = true; };
   ocaml = ocamlPackages.ocaml;
 
   ocamlPackages = recurseIntoAttrs ocaml-ng.ocamlPackages;
@@ -17618,8 +17617,9 @@ with pkgs;
   inherit (beam.packages.erlang)
     erlang-ls erlfmt elvis-erlang
     rebar rebar3 rebar3WithPlugins
-    fetchHex beamPackages
+    fetchHex
     lfe lfe_2_1;
+  beamPackages = beam.packages.erlang // { __attrsFailEvaluation = true; };
 
   expr = callPackage ../development/interpreters/expr { };
 
@@ -17901,19 +17901,19 @@ with pkgs;
   # List of extensions with overrides to apply to all Python package sets.
   pythonPackagesExtensions = [ ];
   # Python package sets.
-  python27Packages = python27.pkgs;
-  python38Packages = python38.pkgs;
-  python39Packages = python39.pkgs;
-  python310Packages = recurseIntoAttrs python310.pkgs;
-  python311Packages = recurseIntoAttrs python311.pkgs;
-  python312Packages = python312.pkgs;
-  python313Packages = python313.pkgs;
-  pypyPackages = pypy.pkgs;
-  pypy2Packages = pypy2.pkgs;
-  pypy27Packages = pypy27.pkgs;
-  pypy3Packages = pypy3.pkgs;
-  pypy39Packages = pypy39.pkgs;
-  pypy310Packages = pypy310.pkgs;
+  python27Packages = python27.pkgs // { __attrsFailEvaluation = true; };
+  python38Packages = python38.pkgs // { __attrsFailEvaluation = true; };
+  python39Packages = python39.pkgs // { __attrsFailEvaluation = true; };
+  python310Packages = recurseIntoAttrs python310.pkgs // { pythonPackages = python310.pkgs // { __attrsFailEvaluation = true; }; };
+  python311Packages = recurseIntoAttrs python311.pkgs // { pythonPackages = python311.pkgs // { __attrsFailEvaluation = true; }; };
+  python312Packages = python312.pkgs // { __attrsFailEvaluation = true; };
+  python313Packages = python313.pkgs // { __attrsFailEvaluation = true; };
+  pypyPackages = pypy.pkgs // { __attrsFailEvaluation = true; };
+  pypy2Packages = pypy2.pkgs // { __attrsFailEvaluation = true; };
+  pypy27Packages = pypy27.pkgs // { __attrsFailEvaluation = true; };
+  pypy3Packages = pypy3.pkgs // { __attrsFailEvaluation = true; };
+  pypy39Packages = pypy39.pkgs // { __attrsFailEvaluation = true; };
+  pypy310Packages = pypy310.pkgs // { __attrsFailEvaluation = true; };
 
   py3c = callPackage ../development/libraries/py3c { };
 
@@ -24665,9 +24665,9 @@ with pkgs;
       stdenv = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
     });
 
-  libsForQt5 = recurseIntoAttrs (import ./qt5-packages.nix {
+  libsForQt5 = (recurseIntoAttrs (import ./qt5-packages.nix {
     inherit lib __splicedPackages makeScopeWithSplicing' generateSplicesForMkScope pkgsHostTarget;
-  });
+  })) // { __recurseIntoDerivationForReleaseJobs = true; };
 
   # plasma5Packages maps to the Qt5 packages set that is used to build the plasma5 desktop
   plasma5Packages = libsForQt5;
@@ -25982,11 +25982,11 @@ with pkgs;
   };
 
   lispPackages = quicklispPackages //
-    (lispPackagesFor (wrapLisp_old sbcl));
+    (lispPackagesFor (wrapLisp_old sbcl)) // { __attrsFailEvaluation = true; };
 
   quicklispPackagesFor = clwrapper: callPackage ../development/lisp-modules-obsolete/quicklisp-to-nix.nix {
     inherit clwrapper;
-  };
+  } // { __attrsFailEvaluation = true; };
   quicklispPackagesClisp = dontRecurseIntoAttrs (quicklispPackagesFor (wrapLisp_old clisp));
   quicklispPackagesSBCL = dontRecurseIntoAttrs (quicklispPackagesFor (wrapLisp_old sbcl));
   quicklispPackagesECL = dontRecurseIntoAttrs (quicklispPackagesFor (wrapLisp_old ecl));
@@ -25996,7 +25996,8 @@ with pkgs;
   quicklispPackages = quicklispPackagesSBCL;
 
   # Alternative lisp-modules implementation
-  lispPackages_new = callPackage ../development/lisp-modules-new-obsolete/lisp-packages.nix {};
+  lispPackages_new = callPackage ../development/lisp-modules-new-obsolete/lisp-packages.nix {}
+  // { __attrsFailEvaluation = true; };
 
   ## End of DEPRECATED
 
@@ -26142,9 +26143,9 @@ with pkgs;
 
   rstudioServerWrapper = rstudioWrapper.override { rstudio = rstudio-server; };
 
-  rPackages = dontRecurseIntoAttrs (callPackage ../development/r-modules {
+  rPackages = (dontRecurseIntoAttrs (callPackage ../development/r-modules {
     overrides = (config.rPackageOverrides or (_: {})) pkgs;
-  });
+  })) // { __attrsFailEvaluation = true; };
 
   ### SERVERS
 
@@ -27842,10 +27843,6 @@ with pkgs;
 
   fwts = callPackage ../os-specific/linux/fwts { };
 
-  gasket = callPackage ../os-specific/linux/gasket {
-    inherit (linuxPackages) kernel;
-  };
-
   gobi_loader = callPackage ../os-specific/linux/gobi_loader { };
 
   libossp_uuid = callPackage ../development/libraries/libossp-uuid { };
@@ -31385,7 +31382,7 @@ with pkgs;
 
   # This alias should live in aliases.nix but that would cause Hydra not to evaluate/build the packages.
   # If you turn this into "real" alias again, please add it to pkgs/top-level/packages-config.nix again too
-  emacsPackages = emacs.pkgs;
+  emacsPackages = emacs.pkgs // { __recurseIntoDerivationForReleaseJobs = true; };
 
   emptty = callPackage ../applications/display-managers/emptty { };
 
@@ -33818,9 +33815,9 @@ with pkgs;
 
   mop = callPackage ../applications/misc/mop { };
 
-  mopidyPackages = callPackages ../applications/audio/mopidy {
+  mopidyPackages = (callPackages ../applications/audio/mopidy {
     python = python3;
-  };
+  }) // { __attrsFailEvaluation = true; };
 
   inherit (mopidyPackages)
     mopidy
@@ -34727,7 +34724,10 @@ with pkgs;
 
   picosnitch = callPackage ../tools/networking/picosnitch { };
 
-  pidginPackages = recurseIntoAttrs (callPackage ../applications/networking/instant-messengers/pidgin/pidgin-plugins { });
+  pidginPackages =
+    let pidgin-plugins =
+          recurseIntoAttrs (callPackage ../applications/networking/instant-messengers/pidgin/pidgin-plugins { });
+    in pidgin-plugins // { pidginPackages = pidgin-plugins.pidginPackages // { __attrsFailEvaluation = true; }; };
 
   inherit (pidginPackages) pidgin;
 
@@ -40436,8 +40436,6 @@ with pkgs;
 
   hjson = with python3Packages; toPythonApplication hjson;
 
-  hjson-go = callPackage ../development/tools/hjson-go { };
-
   epkowa = callPackage ../misc/drivers/epkowa { };
 
   utsushi = callPackage ../misc/drivers/utsushi { };
diff --git a/nixpkgs/pkgs/top-level/beam-packages.nix b/nixpkgs/pkgs/top-level/beam-packages.nix
index ff9d1f62ab1f..62ab2a63ae74 100644
--- a/nixpkgs/pkgs/top-level/beam-packages.nix
+++ b/nixpkgs/pkgs/top-level/beam-packages.nix
@@ -101,4 +101,6 @@ in
     erlang_25 = self.packagesWith self.interpreters.erlang_25;
     erlang_24 = self.packagesWith self.interpreters.erlang_24;
   } // packagesAliases;
+
+  __attrsFailEvaluation = true;
 }
diff --git a/nixpkgs/pkgs/top-level/coq-packages.nix b/nixpkgs/pkgs/top-level/coq-packages.nix
index cf3817a3d7e4..64cbe925b518 100644
--- a/nixpkgs/pkgs/top-level/coq-packages.nix
+++ b/nixpkgs/pkgs/top-level/coq-packages.nix
@@ -8,7 +8,7 @@ let
   mkCoqPackages' = self: coq:
     let callPackage = self.callPackage; in {
       inherit coq lib;
-      coqPackages = self;
+      coqPackages = self // { coqPackages = self.coqPackages // { recurseForDerivations = false; }; };
 
       metaFetch = import ../build-support/coq/meta-fetch/default.nix
         {inherit lib stdenv fetchzip; };
@@ -190,21 +190,23 @@ in rec {
   coq_8_17 = mkCoq "8.17";
   coq_8_18 = mkCoq "8.18";
 
-  coqPackages_8_5 = mkCoqPackages coq_8_5;
-  coqPackages_8_6 = mkCoqPackages coq_8_6;
-  coqPackages_8_7 = mkCoqPackages coq_8_7;
-  coqPackages_8_8 = mkCoqPackages coq_8_8;
-  coqPackages_8_9 = mkCoqPackages coq_8_9;
-  coqPackages_8_10 = mkCoqPackages coq_8_10;
-  coqPackages_8_11 = mkCoqPackages coq_8_11;
-  coqPackages_8_12 = mkCoqPackages coq_8_12;
-  coqPackages_8_13 = mkCoqPackages coq_8_13;
-  coqPackages_8_14 = mkCoqPackages coq_8_14;
-  coqPackages_8_15 = mkCoqPackages coq_8_15;
-  coqPackages_8_16 = mkCoqPackages coq_8_16;
-  coqPackages_8_17 = mkCoqPackages coq_8_17;
-  coqPackages_8_18 = mkCoqPackages coq_8_18;
-  coqPackages = recurseIntoAttrs coqPackages_8_18;
+  coqPackages_8_5 = mkCoqPackages coq_8_5 // { __attrsFailEvaluation = true; };
+  coqPackages_8_6 = mkCoqPackages coq_8_6 // { __attrsFailEvaluation = true; };
+  coqPackages_8_7 = mkCoqPackages coq_8_7 // { __attrsFailEvaluation = true; };
+  coqPackages_8_8 = mkCoqPackages coq_8_8 // { __attrsFailEvaluation = true; };
+  coqPackages_8_9 = mkCoqPackages coq_8_9 // { __attrsFailEvaluation = true; };
+  coqPackages_8_10 = mkCoqPackages coq_8_10 // { __attrsFailEvaluation = true; };
+  coqPackages_8_11 = mkCoqPackages coq_8_11 // { __attrsFailEvaluation = true; };
+  coqPackages_8_12 = mkCoqPackages coq_8_12 // { __attrsFailEvaluation = true; };
+  coqPackages_8_13 = mkCoqPackages coq_8_13 // { __attrsFailEvaluation = true; };
+  coqPackages_8_14 = mkCoqPackages coq_8_14 // { __attrsFailEvaluation = true; };
+  coqPackages_8_15 = mkCoqPackages coq_8_15 // { __attrsFailEvaluation = true; };
+  coqPackages_8_16 = mkCoqPackages coq_8_16 // { __attrsFailEvaluation = true; };
+  coqPackages_8_17 = mkCoqPackages coq_8_17 // { __attrsFailEvaluation = true; };
+  coqPackages_8_18 = mkCoqPackages coq_8_18 // { __attrsFailEvaluation = true; };
+  coqPackages =
+    let cp = recurseIntoAttrs coqPackages_8_18;
+    in cp // { coqPackages = cp.coqPackages // { __attrsFailEvaluation = true; }; } // { __recurseIntoDerivationForReleaseJobs = true; };
   coq = coqPackages.coq;
 
 }
diff --git a/nixpkgs/pkgs/top-level/cuda-packages.nix b/nixpkgs/pkgs/top-level/cuda-packages.nix
index 19ff558afbc7..d474cf852e55 100644
--- a/nixpkgs/pkgs/top-level/cuda-packages.nix
+++ b/nixpkgs/pkgs/top-level/cuda-packages.nix
@@ -26,6 +26,7 @@
   lib,
   newScope,
   pkgs,
+  __attrsFailEvaluation ? true,
 }:
 let
   inherit (lib)
@@ -118,4 +119,4 @@ let
     fixedPoints.extends composedExtension passthruFunction
   );
 in
-cudaPackages
+cudaPackages // { inherit __attrsFailEvaluation; }
diff --git a/nixpkgs/pkgs/top-level/hare-third-party.nix b/nixpkgs/pkgs/top-level/hare-third-party.nix
index 73ffbc0ea790..ac2dc254e50d 100644
--- a/nixpkgs/pkgs/top-level/hare-third-party.nix
+++ b/nixpkgs/pkgs/top-level/hare-third-party.nix
@@ -5,7 +5,7 @@ let
   inherit (self) callPackage;
 in
 {
-  hare-json = callPackage ../development/hare-packages/hare-json { };
 
-  hare-compress = callPackage ../development/hare-third-party/hare-compress {};
+  hare-compress = callPackage ../development/hare-third-party/hare-compress { };
+  hare-json = callPackage ../development/hare-third-party/hare-json { };
 })
diff --git a/nixpkgs/pkgs/top-level/java-packages.nix b/nixpkgs/pkgs/top-level/java-packages.nix
index 88c95457afee..f2c725bfb4c2 100644
--- a/nixpkgs/pkgs/top-level/java-packages.nix
+++ b/nixpkgs/pkgs/top-level/java-packages.nix
@@ -35,6 +35,7 @@ in {
         else package-darwin;
     in {
       inherit package-linux package-darwin;
+      __attrsFailEvaluation = true;
 
       jdk-hotspot = callPackage package.jdk-hotspot {};
       jre-hotspot = callPackage package.jre-hotspot {};
diff --git a/nixpkgs/pkgs/top-level/linux-kernels.nix b/nixpkgs/pkgs/top-level/linux-kernels.nix
index 27496b910444..41177f9d039b 100644
--- a/nixpkgs/pkgs/top-level/linux-kernels.nix
+++ b/nixpkgs/pkgs/top-level/linux-kernels.nix
@@ -348,6 +348,8 @@ in {
 
     fwts-efi-runtime = callPackage ../os-specific/linux/fwts/module.nix { };
 
+    gasket = callPackage ../os-specific/linux/gasket { };
+
     gcadapter-oc-kmod = callPackage ../os-specific/linux/gcadapter-oc-kmod { };
 
     hyperv-daemons = callPackage ../os-specific/linux/hyperv-daemons { };
@@ -398,7 +400,8 @@ in {
 
     nvidiabl = callPackage ../os-specific/linux/nvidiabl { };
 
-    nvidiaPackages = dontRecurseIntoAttrs (lib.makeExtensible (_: callPackage ../os-specific/linux/nvidia-x11 { }));
+    nvidiaPackages = dontRecurseIntoAttrs (lib.makeExtensible (_: callPackage ../os-specific/linux/nvidia-x11 { }))
+    // { __attrsFailEvaluation = true; };
 
     nvidia_x11             = nvidiaPackages.stable;
     nvidia_x11_beta        = nvidiaPackages.beta;
@@ -589,6 +592,7 @@ in {
     linux_6_1 = recurseIntoAttrs (packagesFor kernels.linux_6_1);
     linux_6_5 = recurseIntoAttrs (packagesFor kernels.linux_6_5);
     linux_6_6 = recurseIntoAttrs (packagesFor kernels.linux_6_6);
+    __attrsFailEvaluation = true;
   } // lib.optionalAttrs config.allowAliases {
     linux_4_9 = throw "linux 4.9 was removed because it will reach its end of life within 22.11"; # Added 2022-11-08
     linux_4_14 = throw "linux 4.14 was removed because it will reach its end of life within 23.11"; # Added 2023-10-11
@@ -606,6 +610,7 @@ in {
      linux_rt_5_10 = packagesFor kernels.linux_rt_5_10;
      linux_rt_5_15 = packagesFor kernels.linux_rt_5_15;
      linux_rt_6_1 = packagesFor kernels.linux_rt_6_1;
+     __attrsFailEvaluation = true;
   };
 
   rpiPackages = {
@@ -613,6 +618,7 @@ in {
     linux_rpi2 = packagesFor kernels.linux_rpi2;
     linux_rpi3 = packagesFor kernels.linux_rpi3;
     linux_rpi4 = packagesFor kernels.linux_rpi4;
+     __attrsFailEvaluation = true;
   };
 
   packages = recurseIntoAttrs (vanillaPackages // rtPackages // rpiPackages // {
@@ -641,6 +647,7 @@ in {
     linux_libre = recurseIntoAttrs (packagesFor kernels.linux_libre);
 
     linux_latest_libre = recurseIntoAttrs (packagesFor kernels.linux_latest_libre);
+    __recurseIntoDerivationForReleaseJobs = true;
   } // lib.optionalAttrs config.allowAliases {
     linux_5_18_hardened = throw "linux 5.18 was removed because it has reached its end of life upstream";
     linux_5_19_hardened = throw "linux 5.19 was removed because it has reached its end of life upstream";
@@ -655,7 +662,7 @@ in {
     linux_mptcp = throw "'linux_mptcp' has been moved to https://github.com/teto/mptcp-flake";
     linux_rt_default = packages.linux_rt_5_4;
     linux_rt_latest = packages.linux_rt_6_1;
-  };
+  } // { __attrsFailEvaluation = true; };
 
   manualConfig = callPackage ../os-specific/linux/kernel/manual-config.nix {};
 
diff --git a/nixpkgs/pkgs/top-level/perl-packages.nix b/nixpkgs/pkgs/top-level/perl-packages.nix
index 3070f6af449f..16ac93193ac3 100644
--- a/nixpkgs/pkgs/top-level/perl-packages.nix
+++ b/nixpkgs/pkgs/top-level/perl-packages.nix
@@ -23,7 +23,7 @@ in
 with self; {
 
   inherit perl;
-  perlPackages = self;
+  perlPackages = self // { perlPackages = self.perlPackages // { __attrsFailEvaluation = true; }; };
 
   # Check whether a derivation provides a perl module.
   hasPerlModule = drv: drv ? perlModule ;
diff --git a/nixpkgs/pkgs/top-level/pkg-config/tests.nix b/nixpkgs/pkgs/top-level/pkg-config/tests.nix
index ec1d445c5903..786e2ecc534b 100644
--- a/nixpkgs/pkgs/top-level/pkg-config/tests.nix
+++ b/nixpkgs/pkgs/top-level/pkg-config/tests.nix
@@ -17,5 +17,5 @@ let
   };
 in
 lib.recurseIntoAttrs {
-  defaultPkgConfigPackages = allPkgs.callPackage ./test-defaultPkgConfigPackages.nix { };
+  defaultPkgConfigPackages = allPkgs.callPackage ./test-defaultPkgConfigPackages.nix { } // { __recurseIntoDerivationForReleaseJobs = true; };
 }
diff --git a/nixpkgs/pkgs/top-level/python-packages.nix b/nixpkgs/pkgs/top-level/python-packages.nix
index 678c976932c8..3c40cdc0b7c9 100644
--- a/nixpkgs/pkgs/top-level/python-packages.nix
+++ b/nixpkgs/pkgs/top-level/python-packages.nix
@@ -8592,7 +8592,7 @@ self: super: with self; {
 
   openai-triton = callPackage ../development/python-modules/openai-triton {
     llvm = pkgs.openai-triton-llvm;
-    cudaPackages = pkgs.cudaPackages_12_0;
+    cudaPackages = pkgs.cudaPackages_12_1;
   };
 
   openai-triton-cuda = self.openai-triton.override {
@@ -8754,6 +8754,8 @@ self: super: with self; {
 
   orange-widget-base = callPackage ../development/python-modules/orange-widget-base { };
 
+  oras = callPackage ../development/python-modules/oras { };
+
   orderedmultidict = callPackage ../development/python-modules/orderedmultidict { };
 
   ordered-set = callPackage ../development/python-modules/ordered-set { };
diff --git a/nixpkgs/pkgs/top-level/qt5-packages.nix b/nixpkgs/pkgs/top-level/qt5-packages.nix
index 9acaacea24a4..f38a4c1c4907 100644
--- a/nixpkgs/pkgs/top-level/qt5-packages.nix
+++ b/nixpkgs/pkgs/top-level/qt5-packages.nix
@@ -69,7 +69,9 @@ makeScopeWithSplicing' {
     };
   in (lib.makeOverridable mkMaui attrs);
 
-  noExtraAttrs = set: lib.attrsets.removeAttrs set [ "extend" "override" "overrideScope" "overrideScope'" "overrideDerivation" ];
+  noExtraAttrs = set:
+    lib.attrsets.removeAttrs set [ "extend" "override" "overrideScope" "overrideScope'" "overrideDerivation" ]
+    // { __attrsFailEvaluation = true; };
 
 in (noExtraAttrs (kdeFrameworks // plasmaMobileGear // plasma5 // plasma5.thirdParty // kdeGear // mauiPackages // qt5 // {
 
diff --git a/nixpkgs/pkgs/top-level/release-attrpaths-superset.nix b/nixpkgs/pkgs/top-level/release-attrpaths-superset.nix
new file mode 100644
index 000000000000..673b63a5ac34
--- /dev/null
+++ b/nixpkgs/pkgs/top-level/release-attrpaths-superset.nix
@@ -0,0 +1,192 @@
+# This expression will, as efficiently as possible, dump a
+# *superset* of all attrpaths of derivations which might be
+# part of a release on *any* platform.
+#
+# Both this expression and what ofborg uses (release-outpaths.nix)
+# are essentially single-threaded (under the current cppnix
+# implementation).
+#
+# This expression runs much, much, much faster and uses much, much
+# less memory than the ofborg script by skipping the
+# platform-relevance checks.  The ofborg outpaths.nix script takes
+# half an hour on a 3ghz core and peaks at 60gbytes of memory; this
+# expression runs on the same machine in 44 seconds with peak memory
+# usage of 5gbytes.
+#
+# Once you have the list of attrnames you can split it up into
+# $NUM_CORES batches and run the platform checks separately for each
+# batch, in parallel.
+#
+# To dump the attrnames:
+#
+#   nix-instantiate --eval --strict --json pkgs/top-level/release-attrpaths-superset.nix -A names
+#
+{ lib ? import (path + "/lib")
+, trace ? false
+, enableWarnings ? true
+, checkMeta ? true
+, path ? ./../..
+}:
+let
+
+  # No release package attrpath may have any of these attrnames as
+  # its initial component.
+  #
+  # If you can find a way to remove any of these entries without
+  # causing CI to fail, please do so.
+  #
+  excluded-toplevel-attrs = {
+    # spliced packagesets
+    __splicedPackages = true;
+    pkgsBuildBuild = true;
+    pkgsBuildHost = true;
+    pkgsBuildTarget = true;
+    pkgsHostHost = true;
+    pkgsHostTarget = true;
+    pkgsTargetTarget = true;
+    buildPackages = true;
+    targetPackages = true;
+
+    # cross packagesets
+    pkgsLLVM = true;
+    pkgsMusl = true;
+    pkgsStatic = true;
+    pkgsCross = true;
+    pkgsi686Linux = true;
+  };
+
+  # No release package attrname may have any of these at a component
+  # anywhere in its attrpath.  These are the names of gigantic
+  # top-level attrsets that have leaked into so many sub-packagesets
+  # that it's easier to simply exclude them entirely.
+  #
+  # If you can find a way to remove any of these entries without
+  # causing CI to fail, please do so.
+  #
+  excluded-attrnames-at-any-depth = {
+    lib = true;
+    override = true;
+    __functor = true;
+    __functionArgs = true;
+    newScope = true;
+    scope = true;
+    pkgs = true;
+
+    buildHaskellPackages = true;
+    buildPackages = true;
+    generateOptparseApplicativeCompletions = true;
+
+    callPackage = true;
+    mkDerivation = true;
+    overrideDerivation = true;
+    overrideScope = true;
+    overrideScope' = true;
+
+    # Special case: lib/types.nix leaks into a lot of nixos-related
+    # derivations, and does not eval deeply.
+    type = true;
+  };
+
+  # __attrsFailEvaluation is a temporary workaround to get top-level
+  # eval to succeed (under builtins.tryEval) for the entire
+  # packageset, without deep invasve changes into individual
+  # packages.
+  #
+  # Now that CI has been added, ensuring that top-level eval will
+  # not be broken by any new commits, you should not add any new
+  # occurrences of __attrsFailEvaluation, and should remove them
+  # wherever you are able to (doing so will likely require deep
+  # adjustments within packages).  Once all of the uses of
+  # __attrsFailEvaluation are removed, it will be deleted from the
+  # routine below.  In the meantime,
+  #
+  # The intended semantics are that an attrpath rooted at pkgs is
+  # part of the (unfiltered) release jobset iff all of the following
+  # are true:
+  #
+  # 1. The first component of the attrpath is not in
+  #    `excluded-toplevel-attrs`
+  #
+  # 2. No attrname in the attrpath belongs to the list of forbidden
+  #    attrnames `excluded-attrnames-at-any-depth`
+  #
+  # 3. The attrpath leads to a value for which lib.isDerivation is true
+  #
+  # 4. No proper prefix of the attrpath has __attrsFailEvaluation=true
+  #
+  # 5. Any proper prefix of the attrpath at which lib.isDerivation
+  #    is true also has __recurseIntoDerivationForReleaseJobs=true.
+  #
+  # The last condition is unfortunately necessary because there are
+  # Hydra release jobnames which have proper prefixes which are
+  # attrnames of derivations (!).  We should probably restructure
+  # the job tree so that this is not the case.
+  #
+  justAttrNames = path: value:
+    let
+      attempt =
+        if lib.isDerivation value &&
+           # in some places we have *derivations* with jobsets as subattributes, ugh
+           !(value.__recurseIntoDerivationForReleaseJobs or false) then
+             [ path ]
+
+        # Even wackier case: we have meta.broken==true jobs with
+        # !meta.broken jobs as subattributes with license=unfree, and
+        # check-meta.nix won't throw an "unfree" failure because the
+        # enclosing derivation is marked broken.  Yeah.  Bonkers.
+        # We should just forbid jobsets enclosed by derivations.
+        else if lib.isDerivation value &&
+                !value.meta.available then []
+
+        else if !(lib.isAttrs value) then []
+        else if (value.__attrsFailEvaluation or false) then []
+        else lib.pipe value [
+          (builtins.mapAttrs
+            (name: value:
+              if excluded-attrnames-at-any-depth.${name} or false then [] else
+              (justAttrNames (path ++ [name]) value)))
+          builtins.attrValues
+          builtins.concatLists
+        ];
+
+      seq = builtins.deepSeq attempt attempt;
+      tried = builtins.tryEval seq;
+
+      result =
+        if tried.success
+        then tried.value
+        else if enableWarnings && path != [ "AAAAAASomeThingsFailToEvaluate" ]
+        then lib.warn "tryEval failed at: ${lib.concatStringsSep "." path}" []
+        else [];
+    in
+      if !trace
+      then result
+      else lib.trace "** ${lib.concatStringsSep "." path}" result;
+
+  unfiltered = import ./release-outpaths.nix {
+    inherit checkMeta;
+    attrNamesOnly = true;
+    inherit path;
+  };
+
+  filtered = lib.pipe unfiltered [
+    (pkgs: builtins.removeAttrs pkgs (builtins.attrNames excluded-toplevel-attrs))
+  ];
+
+  paths =
+    [
+      # I am not entirely sure why these three packages end up in
+      # the Hydra jobset.  But they do, and they don't meet the
+      # criteria above, so at the moment they are special-cased.
+      [ "pkgsLLVM" "stdenv" ]
+      [ "pkgsStatic" "stdenv" ]
+      [ "pkgsMusl" "stdenv" ]
+    ] ++ justAttrNames [] filtered;
+
+  names =
+    map (path: (lib.concatStringsSep "." path)) paths;
+
+in
+{
+  inherit paths names;
+}
diff --git a/nixpkgs/pkgs/top-level/release-outpaths.nix b/nixpkgs/pkgs/top-level/release-outpaths.nix
new file mode 100644
index 000000000000..5c433fa542e0
--- /dev/null
+++ b/nixpkgs/pkgs/top-level/release-outpaths.nix
@@ -0,0 +1,87 @@
+#!/usr/bin/env nix-shell
+# When using as a callable script, passing `--argstr path some/path` overrides $PWD.
+#!nix-shell -p nix -i "nix-env -qaP --no-name --out-path --arg checkMeta true -f pkgs/top-level/release-outpaths.nix"
+
+# Vendored from:
+#   https://raw.githubusercontent.com/NixOS/ofborg/74f38efa7ef6f0e8e71ec3bfc675ae4fb57d7491/ofborg/src/outpaths.nix
+{ checkMeta
+, includeBroken ? true  # set this to false to exclude meta.broken packages from the output
+, path ? ./../..
+
+# used by pkgs/top-level/release-attrnames-superset.nix
+, attrNamesOnly ? false
+
+# Set this to `null` to build for builtins.currentSystem only
+, systems ? [
+    "aarch64-linux"
+    "aarch64-darwin"
+    #"i686-linux"  # !!!
+    "x86_64-linux"
+    "x86_64-darwin"
+  ]
+}:
+let
+  lib = import (path + "/lib");
+  hydraJobs = import (path + "/pkgs/top-level/release.nix")
+    # Compromise: accuracy vs. resources needed for evaluation.
+    {
+      inherit attrNamesOnly;
+      supportedSystems =
+        if systems == null
+        then [ builtins.currentSystem ]
+        else systems;
+      nixpkgsArgs = {
+        config = {
+          allowAliases = false;
+          allowBroken = includeBroken;
+          allowUnfree = false;
+          allowInsecurePredicate = x: true;
+          checkMeta = checkMeta;
+
+          handleEvalIssue = reason: errormsg:
+            let
+              fatalErrors = [
+                "unknown-meta"
+                "broken-outputs"
+              ];
+            in
+            if builtins.elem reason fatalErrors
+            then abort errormsg
+            # hydra does not build unfree packages, so tons of them are broken yet not marked meta.broken.
+            else if !includeBroken && builtins.elem reason [ "broken" "unfree" ]
+            then throw "broken"
+            else if builtins.elem reason [ "unsupported" ]
+            then throw "unsupported"
+            else true;
+
+          inHydra = true;
+        };
+      };
+    };
+  recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; };
+
+  # hydraJobs leaves recurseForDerivations as empty attrmaps;
+  # that would break nix-env and we also need to recurse everywhere.
+  tweak = lib.mapAttrs
+    (name: val:
+      if name == "recurseForDerivations" then true
+      else if lib.isAttrs val && val.type or null != "derivation"
+      then recurseIntoAttrs (tweak val)
+      else val
+    );
+
+  # Some of these contain explicit references to platform(s) we want to avoid;
+  # some even (transitively) depend on ~/.nixpkgs/config.nix (!)
+  blacklist = [
+    "tarball"
+    "metrics"
+    "manual"
+    "darwin-tested"
+    "unstable"
+    "stdenvBootstrapTools"
+    "moduleSystem"
+    "lib-tests" # these just confuse the output
+  ];
+
+in
+tweak (builtins.removeAttrs hydraJobs blacklist)
diff --git a/nixpkgs/pkgs/top-level/release-python.nix b/nixpkgs/pkgs/top-level/release-python.nix
index ec5255362bcc..bc54860d45f6 100644
--- a/nixpkgs/pkgs/top-level/release-python.nix
+++ b/nixpkgs/pkgs/top-level/release-python.nix
@@ -29,7 +29,7 @@ let
     let res = builtins.tryEval (
       if isDerivation value then
         value.meta.isBuildPythonPackage or []
-      else if value.recurseForDerivations or false || value.recurseForRelease or false then
+      else if value.recurseForDerivations or false || value.recurseForRelease or false || value.__recurseIntoDerivationForReleaseJobs or false then
         packagePython value
       else
         []);
diff --git a/nixpkgs/pkgs/top-level/release.nix b/nixpkgs/pkgs/top-level/release.nix
index 9b5c60141520..f2b38b4a8964 100644
--- a/nixpkgs/pkgs/top-level/release.nix
+++ b/nixpkgs/pkgs/top-level/release.nix
@@ -37,9 +37,23 @@
       "openssl-1.1.1w"
     ];
   }; }
+
+  # This flag, if set to true, will inhibit the use of `mapTestOn`
+  # and `release-lib.packagePlatforms`.  Generally, it causes the
+  # resulting tree of attributes to *not* have a ".${system}"
+  # suffixed upon every job name like Hydra expects.
+  #
+  # This flag exists mainly for use by
+  # pkgs/top-level/release-attrnames-superset.nix; see that file for
+  # full details.  The exact behavior of this flag may change; it
+  # should be considered an internal implementation detail of
+  # pkgs/top-level/.
+  #
+, attrNamesOnly ? false
 }:
 
-with import ./release-lib.nix { inherit supportedSystems scrubJobs nixpkgsArgs; };
+let release-lib = import ./release-lib.nix { inherit supportedSystems scrubJobs nixpkgsArgs; }; in
+with release-lib;
 
 let
 
@@ -239,9 +253,9 @@ let
   # 'nonPackageAttrs' and jobs pulled in from 'pkgs'.
   # Conflicts usually cause silent job drops like in
   #   https://github.com/NixOS/nixpkgs/pull/182058
-  jobs = lib.attrsets.unionOfDisjoint
-    nonPackageJobs
-    (mapTestOn ((packagePlatforms pkgs) // {
+  jobs = let
+    packagePlatforms = if attrNamesOnly then lib.id else release-lib.packagePlatforms;
+    packageJobs = {
       haskell.compiler = packagePlatforms pkgs.haskell.compiler;
       haskellPackages = packagePlatforms pkgs.haskellPackages;
       # Build selected packages (HLS) for multiple Haskell compilers to rebuild
@@ -275,6 +289,14 @@ let
       darwin = packagePlatforms pkgs.darwin // {
         xcode = {};
       };
-    } ));
+    };
+    mapTestOn-packages =
+      if attrNamesOnly
+      then pkgs // packageJobs
+      else mapTestOn ((packagePlatforms pkgs) // packageJobs);
+  in
+    lib.attrsets.unionOfDisjoint
+      nonPackageJobs
+      mapTestOn-packages;
 
 in jobs
author	Alyssa Ross <hi@alyssa.is>	2023-12-17 17:44:14 +0100
committer	Alyssa Ross <hi@alyssa.is>	2023-12-17 17:44:14 +0100
commit	778336429cc37ad5b0d736336141d09bf227653d (patch)
tree	4aa85bd5d87d5bb5fb2c35ab9313987606abca89 /nixpkgs
parent	6b8e2555ef013b579cda57025b17d662e0f1fe1f (diff)
parent	7d6929828a2d28eda9d37254ff6be3b6819506ca (diff)
download	nixlib-778336429cc37ad5b0d736336141d09bf227653d.tar nixlib-778336429cc37ad5b0d736336141d09bf227653d.tar.gz nixlib-778336429cc37ad5b0d736336141d09bf227653d.tar.bz2 nixlib-778336429cc37ad5b0d736336141d09bf227653d.tar.lz nixlib-778336429cc37ad5b0d736336141d09bf227653d.tar.xz nixlib-778336429cc37ad5b0d736336141d09bf227653d.tar.zst nixlib-778336429cc37ad5b0d736336141d09bf227653d.zip