Merge remote-tracking branch 'origin/master' into staging

 Conflicts:
	pkgs/tools/networking/ofono/default.nix

83 files changed, 482 insertions, 755 deletions

diff --git a/pkgs/tools/admin/aws-encryption-sdk-cli/default.nix b/pkgs/tools/admin/aws-encryption-sdk-cli/default.nix
index 526730e72228..2bc331cc1874 100644
--- a/pkgs/tools/admin/aws-encryption-sdk-cli/default.nix
+++ b/pkgs/tools/admin/aws-encryption-sdk-cli/default.nix
@@ -1,12 +1,29 @@
 { lib
-, python3Packages
+, python3
 , fetchPypi
 , nix-update-script
 , testers
 , aws-encryption-sdk-cli
 }:
 
-python3Packages.buildPythonApplication rec {
+let
+  localPython = python3.override {
+    self = localPython;
+    packageOverrides = final: prev: {
+      urllib3 = prev.urllib3.overridePythonAttrs (prev: rec {
+        pyproject = true;
+        version = "1.26.18";
+        nativeBuildInputs = with final; [ setuptools ];
+        src = prev.src.override {
+          inherit version;
+          hash = "sha256-+OzBu6VmdBNFfFKauVW/jGe0XbeZ0VkGYmFxnjKFgKA=";
+        };
+      });
+    };
+  };
+in
+
+localPython.pkgs.buildPythonApplication rec {
   pname = "aws-encryption-sdk-cli";
   version = "4.1.0";
 
@@ -15,15 +32,16 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-OCbt0OkDVfpzUIogbsKzaPAle2L6l6N3cmZoS2hEaSM=";
   };
 
-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = with localPython.pkgs; [
     attrs
     aws-encryption-sdk
     base64io
+    urllib3
   ];
 
   doCheck = true;
 
-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs = with localPython.pkgs; [
     mock
     pytest-mock
     pytestCheckHook
diff --git a/pkgs/tools/admin/azure-cli/default.nix b/pkgs/tools/admin/azure-cli/default.nix
index 657ce55e400b..0c447be4e7f2 100644
--- a/pkgs/tools/admin/azure-cli/default.nix
+++ b/pkgs/tools/admin/azure-cli/default.nix
@@ -5,14 +5,14 @@
 }:
 
 let
-  version = "2.54.0";
+  version = "2.55.0";
 
   src = fetchFromGitHub {
     name = "azure-cli-${version}-src";
     owner = "Azure";
     repo = "azure-cli";
     rev = "azure-cli-${version}";
-    hash = "sha256-LbGDPZe4AWl6wnZ5GtiiM4O5EsCHEHX420lBIJJ0+Kk=";
+    hash = "sha256-+4ju+KOQ9LG1nzYnHOZ4mvXf6SazcrIgw/Q2mvetPMc=";
   };
 
   # put packages that needs to be overridden in the py package scope
@@ -288,4 +288,3 @@ py.pkgs.toPythonApplication (py.pkgs.buildAzureCliPackage {
     platforms = platforms.all;
   };
 })
-
diff --git a/pkgs/tools/admin/azure-cli/python-packages.nix b/pkgs/tools/admin/azure-cli/python-packages.nix
index ab7760038732..9893e9e1e29c 100644
--- a/pkgs/tools/admin/azure-cli/python-packages.nix
+++ b/pkgs/tools/admin/azure-cli/python-packages.nix
@@ -106,7 +106,6 @@ let
       azure-mgmt-compute = overrideAzureMgmtPackage super.azure-mgmt-compute "30.3.0" "tar.gz" "sha256-5Sl4Y0D4YqpqIYp61qW+trn7VYM8XKoIUcwzFNBJO2M=";
       azure-mgmt-containerinstance = overrideAzureMgmtPackage super.azure-mgmt-containerinstance "10.1.0" "zip" "sha256-eNQ3rbKFdPRIyDjtXwH5ztN4GWCYBh3rWdn3AxcEwX4=";
       azure-mgmt-containerregistry = overrideAzureMgmtPackage super.azure-mgmt-containerregistry "10.1.0" "zip" "sha256-VrX9YfYNvlA8+eNqHCp35BAeQZzQKakZs7ZZKwT8oYc=";
-      azure-mgmt-containerservice = overrideAzureMgmtPackage super.azure-mgmt-containerservice "27.0.0" "tar.gz" "sha256-IdGo2A65YiMJJ8S18Ji+FfnnylNhs8vFOQpfA91wgNM=";
       azure-mgmt-core = overrideAzureMgmtPackage super.azure-mgmt-core "1.3.2" "zip" "sha256-B/Sv6COlXXBLBI1h7f3BMYwFHtWfJEAyEmNQvpXp1QE=";
       azure-mgmt-cosmosdb = overrideAzureMgmtPackage super.azure-mgmt-cosmosdb "9.3.0" "tar.gz" "sha256-02DisUN2/auBDhPgE9aUvEvYwoQUQC4NYGD/PQZOl/Y=";
       azure-mgmt-databoxedge = overrideAzureMgmtPackage super.azure-mgmt-databoxedge "1.0.0" "zip" "sha256-BAkAYrwejwDC9FMVo7zrD7OzR57BR01xuINC4TSZsIc=";
@@ -164,8 +163,10 @@ let
       azure-mgmt-iotcentral = overrideAzureMgmtPackage super.azure-mgmt-iotcentral "10.0.0b1" "zip"
         "sha256-1CiZuTXYhIb74eGQZUJHHzovYNnnVd3Ydu1UCy2Bu00=";
 
-      azure-mgmt-kusto = overrideAzureMgmtPackage super.azure-mgmt-kusto "0.3.0" "zip"
-        "sha256-nri3eB/UQQ7p4gfNDDmDuvnlhBS1tKGISdCYVuNrrN4=";
+      azure-mgmt-kusto = (overrideAzureMgmtPackage super.azure-mgmt-kusto "0.3.0" "zip"
+        "sha256-nri3eB/UQQ7p4gfNDDmDuvnlhBS1tKGISdCYVuNrrN4=").overridePythonAttrs (attrs: {
+        propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [ self.msrest self.msrestazure ];
+      });
 
       azure-mgmt-devtestlabs = overrideAzureMgmtPackage super.azure-mgmt-devtestlabs "4.0.0" "zip"
         "sha256-WVScTEBo8mRmsQl7V0qOUJn7LNbIvgoAOVsG07KeJ40=r";
diff --git a/pkgs/tools/admin/chamber/default.nix b/pkgs/tools/admin/chamber/default.nix
index 0dca98037997..6e115f6eb6a5 100644
--- a/pkgs/tools/admin/chamber/default.nix
+++ b/pkgs/tools/admin/chamber/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "chamber";
-  version = "2.13.4";
+  version = "2.13.5";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-J6sLDalvUl4SgSyr5DK/tW7DyRa/qdKw6zornz1R2ck=";
+    sha256 = "sha256-uwTEHxaPG1jDeR+84ZrsP6bg5DBsKIeuHeZAtgrsy/s=";
   };
 
   CGO_ENABLED = 0;
diff --git a/pkgs/tools/admin/colmena/default.nix b/pkgs/tools/admin/colmena/default.nix
index ceb544753b21..6cb763c88d1e 100644
--- a/pkgs/tools/admin/colmena/default.nix
+++ b/pkgs/tools/admin/colmena/default.nix
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
 
   passthru = {
     # We guarantee CLI and Nix API stability for the same minor version
-    apiVersion = builtins.concatStringsSep "." (lib.take 2 (lib.splitString "." version));
+    apiVersion = builtins.concatStringsSep "." (lib.take 2 (lib.splitVersion version));
 
     tests.version = testers.testVersion { package = colmena; };
   };
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 13589edd6bdc..29534b092d9f 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -87,7 +87,7 @@ buildGoModule rec {
     homepage = "https://ubuntu.com/lxd";
     changelog = "https://github.com/canonical/lxd/releases/tag/lxd-${version}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ marsam adamcstephens ];
+    maintainers = teams.lxc.members;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/admin/lxd/ui.nix b/pkgs/tools/admin/lxd/ui.nix
index 7e3f1427008e..16fdb4c33175 100644
--- a/pkgs/tools/admin/lxd/ui.nix
+++ b/pkgs/tools/admin/lxd/ui.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     description = "Web user interface for LXD.";
     homepage = "https://github.com/canonical/lxd-ui";
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ jnsgruk ];
+    maintainers = lib.teams.lxc.members;
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/admin/scaleway-cli/default.nix b/pkgs/tools/admin/scaleway-cli/default.nix
index 38fd3fc1e12f..b27c95793ca2 100644
--- a/pkgs/tools/admin/scaleway-cli/default.nix
+++ b/pkgs/tools/admin/scaleway-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "scaleway-cli";
-  version = "2.24.0";
+  version = "2.25.0";
 
   src = fetchFromGitHub {
     owner = "scaleway";
     repo = "scaleway-cli";
     rev = "v${version}";
-    sha256 = "sha256-Q65X2lsR5jyWXxxmkvUA0yG4miD+KUSBGRFXvH4KBGY=";
+    sha256 = "sha256-wx/247ZNbdNdRiGLTfCig1JAjmXZX0aCHbOgelzMcyw=";
   };
 
-  vendorHash = "sha256-mZ2XFZS5tqtRUhdo6AOCY4xSaYgxUEy1OFbyzsbCEnU=";
+  vendorHash = "sha256-FftJsXM9sexRqBKrIeTdWh5Z0eYIK3acDNtptqqILD8=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index 6a0d93483b77..a385cd14da46 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -7,19 +7,19 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.47.0";
+  version = "0.48.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ahy6wiBoOwS3MIrAIg2gIk2gkmphkCJUYAUtqVydA2Q=";
+    hash = "sha256-NINEitFZm1d0foG1P+evLiXXNVNwzK3PMCicksDaBFc=";
   };
 
   # Hash mismatch on across Linux and Darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-qG4z52oVa3sgu8QKX8UbHsk/aSfacgZShX298WUu2oU=";
+  vendorHash = "sha256-EYcOOQBwzXu87q0EfJr7TUypGJW3qtosP3ARLssPOS8=";
 
   subPackages = [ "cmd/trivy" ];
 
diff --git a/pkgs/tools/audio/fmtoy/default.nix b/pkgs/tools/audio/fmtoy/default.nix
deleted file mode 100644
index 69a0f570d3bc..000000000000
--- a/pkgs/tools/audio/fmtoy/default.nix
+++ /dev/null
@@ -1,72 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, unstableGitUpdater
-, dos2unix
-, pkg-config
-, zlib
-, alsa-lib
-, libjack2
-}:
-
-stdenv.mkDerivation rec {
-  pname = "fmtoy";
-  version = "unstable-2022-12-23";
-
-  src = fetchFromGitHub {
-    owner = "vampirefrog";
-    repo = "fmtoy";
-    rev = "78b61b5e9bc0c6874962dc4040456581c9999b36";
-    sha256 = "r5zbr6TCxzDiQvDsLQu/QwNfem1K4Ahaji0yIz/2yl0=";
-  };
-
-  postPatch = ''
-    dos2unix Makefile
-    # Don't hardcode compilers
-    sed -i -e '/CC=/d' -e '/CXX=/d' Makefile
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Remove Linux-only program & its dependencies
-    sed -i -e '/PROGS/ s/fmtoy_jack//' Makefile
-    substituteInPlace Makefile \
-      --replace '$(shell pkg-config alsa jack --cflags)' ""
-  '';
-
-  nativeBuildInputs = [
-    dos2unix
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    pkg-config
-  ];
-
-  buildInputs = [
-    zlib
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    alsa-lib
-    libjack2
-  ];
-
-  enableParallelBuilding = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    for prog in $(grep 'PROGS=' Makefile | cut -d= -f2-); do
-      install -Dm755 $prog $out/bin/$prog
-    done
-
-    runHook postInstall
-  '';
-
-  passthru.updateScript = unstableGitUpdater {
-    url = "https://github.com/vampirefrog/fmtoy.git";
-  };
-
-  meta = with lib; {
-    homepage = "https://github.com/vampirefrog/fmtoy";
-    description = "Tools for FM voices for Yamaha YM chips (OPL, OPM and OPN series)";
-    # Unclear if gpl3Only or gpl3Plus
-    # https://github.com/vampirefrog/fmtoy/issues/1
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ OPNA2608 ];
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/tools/audio/piper/fix-compilation-with-newer-onnxruntime.patch b/pkgs/tools/audio/piper/fix-compilation-with-newer-onnxruntime.patch
deleted file mode 100644
index 9d2e46bb4e91..000000000000
--- a/pkgs/tools/audio/piper/fix-compilation-with-newer-onnxruntime.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff --git a/src/cpp/synthesize.hpp b/src/cpp/synthesize.hpp
-index ef61aef..4c7db7a 100644
---- a/synthesize.hpp
-+++ b/synthesize.hpp
-@@ -119,11 +119,11 @@ void synthesize(SynthesisConfig &synthesisConfig, ModelSession &session,
- 
-   // Clean up
-   for (size_t i = 0; i < outputTensors.size(); i++) {
--    Ort::OrtRelease(outputTensors[i].release());
-+    Ort::detail::OrtRelease(outputTensors[i].release());
-   }
- 
-   for (size_t i = 0; i < inputTensors.size(); i++) {
--    Ort::OrtRelease(inputTensors[i].release());
-+    Ort::detail::OrtRelease(inputTensors[i].release());
-   }
- }
- } // namespace larynx
diff --git a/pkgs/tools/backup/pgbackrest/default.nix b/pkgs/tools/backup/pgbackrest/default.nix
index f4c9fba781fa..50ab894de89e 100644
--- a/pkgs/tools/backup/pgbackrest/default.nix
+++ b/pkgs/tools/backup/pgbackrest/default.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "pgbackrest";
-  version = "2.48";
+  version = "2.49";
 
   src = fetchFromGitHub {
     owner = "pgbackrest";
     repo = "pgbackrest";
     rev = "release/${version}";
-    sha256 = "sha256-RaNF5ufQafZjE2MfOlFOXkot/JEJCQOuiuIYgJolkbU=";
+    sha256 = "sha256-i1IcBNrobhgu+B/ezKFknTiqiZe6LktBxf9YU8JS2Wc=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/compression/bzip3/default.nix b/pkgs/tools/compression/bzip3/default.nix
index 6e21a352d06f..135b253229ad 100644
--- a/pkgs/tools/compression/bzip3/default.nix
+++ b/pkgs/tools/compression/bzip3/default.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bzip3";
-  version = "1.3.2";
+  version = "1.4.0";
 
   outputs = [ "bin" "dev" "out" ];
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "kspalaiologos";
     repo = "bzip3";
     rev = finalAttrs.version;
-    hash = "sha256-nSmKpOwlbxbUN2TJwsS2CFP5UV2ODOKXFHAUsCje7mc=";
+    hash = "sha256-UVCZWcjlueKSGYqdm7oiJ5i7/irkWv7IOyeCWT2r4sk=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/compression/ouch/default.nix b/pkgs/tools/compression/ouch/default.nix
index a1b4131ca703..5321982f189e 100644
--- a/pkgs/tools/compression/ouch/default.nix
+++ b/pkgs/tools/compression/ouch/default.nix
@@ -7,6 +7,7 @@
 , xz
 , zlib
 , zstd
+, stdenv
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,12 +29,19 @@ rustPlatform.buildRustPackage rec {
 
   buildFeatures = [ "zstd/pkg-config" ];
 
+  preCheck = ''
+    substituteInPlace tests/ui.rs \
+      --replace 'format!(r"/private{path}")' 'path.to_string()'
+  '';
+
   postInstall = ''
     installManPage artifacts/*.1
     installShellCompletion artifacts/ouch.{bash,fish} --zsh artifacts/_ouch
   '';
 
-  env.OUCH_ARTIFACTS_FOLDER = "artifacts";
+  env = { OUCH_ARTIFACTS_FOLDER = "artifacts"; } //
+    # Work around https://github.com/NixOS/nixpkgs/issues/166205.
+    lib.optionalAttrs stdenv.cc.isClang { NIX_LDFLAGS = "-l${stdenv.cc.libcxx.cxxabi.libName}"; };
 
   meta = with lib; {
     description = "A command-line utility for easily compressing and decompressing files and directories";
diff --git a/pkgs/tools/filesystems/bindfs/default.nix b/pkgs/tools/filesystems/bindfs/default.nix
index 8614c03ed906..f7d5ce61d81c 100644
--- a/pkgs/tools/filesystems/bindfs/default.nix
+++ b/pkgs/tools/filesystems/bindfs/default.nix
@@ -7,12 +7,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.17.5";
+  version = "1.17.6";
   pname = "bindfs";
 
   src = fetchurl {
     url = "https://bindfs.org/downloads/bindfs-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Wj2xu7soSOtDqzapI8mVgx0xmAd/2J6VHbXQt55i2mQ=";
+    hash = "sha256-076zzGm7K2gCzFOViOkh/qlz7WGRsTPyAkcZMR0cwYs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/blobfuse/install-adls.patch b/pkgs/tools/filesystems/blobfuse/install-adls.patch
deleted file mode 100644
index e48f4d592f68..000000000000
--- a/pkgs/tools/filesystems/blobfuse/install-adls.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/adls/CMakeLists.txt b/adls/CMakeLists.txt
-index 1fb7146..22e663a 100644
---- a/adls/CMakeLists.txt
-+++ b/adls/CMakeLists.txt
-@@ -50,3 +50,9 @@ if(BUILD_TESTS)
-   string(REGEX REPLACE "([^;]+)" "${CMAKE_CURRENT_SOURCE_DIR}/\\1" AZURE_STORAGE_ADLS_TEST_SOURCES "${AZURE_STORAGE_ADLS_TEST_SOURCES}")
-   set(AZURE_STORAGE_ADLS_TEST_SOURCES ${AZURE_STORAGE_ADLS_TEST_SOURCES} PARENT_SCOPE)
- endif()
-+
-+install(TARGETS azure-storage-adls
-+        ARCHIVE DESTINATION lib
-+        LIBRARY DESTINATION lib
-+        RUNTIME DESTINATION bin)
-+
diff --git a/pkgs/tools/filesystems/davfs2/isdir.patch b/pkgs/tools/filesystems/davfs2/isdir.patch
deleted file mode 100644
index ae69b4460f5a..000000000000
--- a/pkgs/tools/filesystems/davfs2/isdir.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff -ur davfs2-1.4.5-old/src/dav_coda.c davfs2-1.4.5-new/src/dav_coda.c
---- davfs2-1.4.5-old/src/dav_coda.c	2009-06-04 20:30:32.000000000 +0200
-+++ davfs2-1.4.5-new/src/dav_coda.c	2011-02-09 19:51:22.260530572 +0100
-@@ -52,6 +52,10 @@
- #ifdef HAVE_SYS_TYPES_H
- #include <sys/types.h>
- #endif
-+#ifdef HAVE_SYS_STAT_H
-+#include <sys/stat.h>
-+#endif
-+
- 
- #include "defaults.h"
- #include "mount_davfs.h"
-diff -ur davfs2-1.4.5-old/src/dav_fuse.c davfs2-1.4.5-new/src/dav_fuse.c
---- davfs2-1.4.5-old/src/dav_fuse.c	2009-06-30 20:06:44.000000000 +0200
-+++ davfs2-1.4.5-new/src/dav_fuse.c	2011-02-09 19:52:23.938220524 +0100
-@@ -41,6 +41,12 @@
- #ifdef HAVE_UNISTD_H
- #include <unistd.h>
- #endif
-+#ifdef HAVE_SYS_TYPES_H
-+#include <sys/types.h>
-+#endif
-+#ifdef HAVE_SYS_STAT_H
-+#include <sys/stat.h>
-+#endif
- 
- #include "defaults.h"
- #include "mount_davfs.h"
diff --git a/pkgs/tools/filesystems/dwarfs/default.nix b/pkgs/tools/filesystems/dwarfs/default.nix
index e5804f378529..e48a7506db42 100644
--- a/pkgs/tools/filesystems/dwarfs/default.nix
+++ b/pkgs/tools/filesystems/dwarfs/default.nix
@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation rec {
   pname = "dwarfs";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "mhx";
     repo = "dwarfs";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-DcPRrATI2cpLZWAL+sSCoXvJ1R0O3yHqhlJW1aEpDpA=";
+    hash = "sha256-lFJW9rmUhiHyu+unGuONcgbsJg9h9MSvNyECmarRF/M=";
   };
 
   patches = [
diff --git a/pkgs/tools/filesystems/stuffbin/default.nix b/pkgs/tools/filesystems/stuffbin/default.nix
index 2640ba8b8519..b955aa870c0f 100644
--- a/pkgs/tools/filesystems/stuffbin/default.nix
+++ b/pkgs/tools/filesystems/stuffbin/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "stuffbin";
-  version = "1.1.0";
+  version = "1.2.0";
 
   vendorHash = null;
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     owner = "knadh";
     repo = "stuffbin";
     rev = "v${version}";
-    sha256 = "sha256-M72xNh7bKUMLzA+M8bJB++kJ5KCrkboQm1v8BasP3Yo=";
+    sha256 = "sha256-roXjE0t4iwrL2y/G2oePYL2AbTwd9uzQPtgdY14WeZk=";
   };
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
diff --git a/pkgs/tools/games/ajour/default.nix b/pkgs/tools/games/ajour/default.nix
index bf783c7f4776..0f90a794987e 100644
--- a/pkgs/tools/games/ajour/default.nix
+++ b/pkgs/tools/games/ajour/default.nix
@@ -70,6 +70,12 @@ in rustPlatform.buildRustPackage rec {
     libxkbcommon
   ];
 
+  postInstall = ''
+    mkdir -p $out/share
+    cp -r resources/logo $out/share/icons
+    install -Dm444 resources/linux/ajour.desktop -t $out/share/applications
+  '';
+
   fixupPhase = ''
     patchelf --set-rpath "${lib.makeLibraryPath rpathLibs}:$(patchelf --print-rpath $out/bin/ajour)" $out/bin/ajour
     wrapProgram $out/bin/ajour --prefix PATH ":" ${lib.makeBinPath [ zenity kdialog ]}
diff --git a/pkgs/tools/graphics/astc-encoder/default.nix b/pkgs/tools/graphics/astc-encoder/default.nix
index dd7ebc6f3b43..eb0222ba8448 100644
--- a/pkgs/tools/graphics/astc-encoder/default.nix
+++ b/pkgs/tools/graphics/astc-encoder/default.nix
@@ -29,13 +29,13 @@ with rec {
 
 stdenv.mkDerivation rec {
   pname = "astc-encoder";
-  version = "4.6.0";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "ARM-software";
     repo = "astc-encoder";
     rev = version;
-    sha256 = "sha256-COZO4LTrM/kZp85uNGwB9eaF27Xf7NVg4hcshaCJBwI=";
+    sha256 = "sha256-7/GBzqgXh8sU3Pl30eH9Mi24PPIqayQqNuhkMnn5Lq0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/graphics/cuneiform/default.nix b/pkgs/tools/graphics/cuneiform/default.nix
index fa4cb75d174b..9332b25babfb 100644
--- a/pkgs/tools/graphics/cuneiform/default.nix
+++ b/pkgs/tools/graphics/cuneiform/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchurl, cmake, imagemagick }:
+{ lib, stdenv, fetchurl, cmake, imagemagick, testers }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cuneiform";
   version = "1.1.0";
 
@@ -30,10 +30,23 @@ stdenv.mkDerivation {
     rm cuneiform_src/Kern/hhh/tigerh/h/strings.h
   '';
 
+  # make the install path match the rpath
+  postInstall = ''
+    if [[ -d ''${!outputLib}/lib64 ]]; then
+      mv ''${!outputLib}/lib64 ''${!outputLib}/lib
+      ln -s lib ''${!outputLib}/lib64
+    fi
+  '';
+
   buildInputs = [ imagemagick ];
 
   nativeBuildInputs = [ cmake ];
 
+  passthru.tests = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    command = "cuneiform";
+  };
+
   meta = with lib; {
     description = "Multi-language OCR system";
     homepage = "https://launchpad.net/cuneiform-linux";
@@ -42,4 +55,4 @@ stdenv.mkDerivation {
     maintainers = [ maintainers.raskin ];
     mainProgram = "cuneiform";
   };
-}
+})
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
index 52b50b7cbb41..3ca3eba56840 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@@ -13,13 +13,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus-typing-booster";
-  version = "2.24.4";
+  version = "2.24.5";
 
   src = fetchFromGitHub {
     owner = "mike-fabian";
     repo = "ibus-typing-booster";
     rev = version;
-    hash = "sha256-f/KtHm8R1MJORWKmv487hm80MeX2l0Ybd1ZjKHGFq0A=";
+    hash = "sha256-GMkudpQ91Qwyj7wJIl7LTx+v+goCUccxJggCAvEtL30=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook gobject-introspection ];
diff --git a/pkgs/tools/misc/cf-terraforming/default.nix b/pkgs/tools/misc/cf-terraforming/default.nix
index 916f349dc508..e6858863fc4e 100644
--- a/pkgs/tools/misc/cf-terraforming/default.nix
+++ b/pkgs/tools/misc/cf-terraforming/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cf-terraforming";
-  version = "0.15.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cf-terraforming";
     rev = "v${version}";
-    sha256 = "sha256-4thb0AFlSYQ90SkdyTSiFUc6vTRpt6KX2nH/thMuv4o=";
+    sha256 = "sha256-C046oNN+tGvVIakCGJKKQBNHX+L1naaMDIk7tNGNjeQ=";
   };
 
   vendorHash = "sha256-bfxF0qlEbZDczEuFhckqsG00/IzuM18ut/AQ9EMwdh0=";
diff --git a/pkgs/tools/misc/diffoci/default.nix b/pkgs/tools/misc/diffoci/default.nix
index df7cc71140aa..3c7de46e01e8 100644
--- a/pkgs/tools/misc/diffoci/default.nix
+++ b/pkgs/tools/misc/diffoci/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "diffoci";
-  version = "0.1.2";
+  version = "0.1.4";
 
   src = fetchFromGitHub {
     owner = "reproducible-containers";
     repo = "diffoci";
     rev = "v${version}";
-    hash = "sha256-Rrwwo1OCE2gn6MGt5XVddb8bJtoN7iAtxzr2MxyHcwk=";
+    hash = "sha256-BTggky5behIxbVxyDZ09uobw0FBopboE9uUBEVgCgR4=";
   };
 
-  vendorHash = "sha256-18rsa91PiqZv70EK3K6K1l6N2mIpoVpkX29amKCo5cg=";
+  vendorHash = "sha256-4C35LBxSm6EkcOznQY1hT2vX9bwFfps/q76VqqPKBfI=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/tools/misc/dua/default.nix b/pkgs/tools/misc/dua/default.nix
index 6ed80c30b740..f27acd85d9d4 100644
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dua";
-  version = "2.20.3";
+  version = "2.21.0";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "dua-cli";
     rev = "v${version}";
-    hash = "sha256-9Qt6/LH30nz4oyP+kXhExzKpPcHRRGYkG43Mjl/ZBoc=";
+    hash = "sha256-szpM3PxIMcKJaCinzZltneCSJCDkPGvXOaGqa9hx9IQ=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoHash = "sha256-xBuc+nh3koLn4/wgrvVjWVc9mjX/6ElAN4n9dWxs5fs=";
+  cargoHash = "sha256-/10trywiFX0UvePxlWek1uXTBRVk4saE+n1RJipinaw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Foundation
diff --git a/pkgs/tools/misc/fastfetch/default.nix b/pkgs/tools/misc/fastfetch/default.nix
index adab3390de1d..53be29dcfa3c 100644
--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@@ -43,13 +43,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.2.3";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-JaD0R1vfHoWMhipMtTW0dlggR7RbD2evHfHrjoZJBmk=";
+    hash = "sha256-jZeecymhjbXYE05zRF2dWHBS3hhRm1BmLB906YAlp+A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/glasgow/0001-Relax-Amaranth-git-dependency.patch b/pkgs/tools/misc/glasgow/0001-Relax-Amaranth-git-dependency.patch
deleted file mode 100644
index 3d4f674ff2c4..000000000000
--- a/pkgs/tools/misc/glasgow/0001-Relax-Amaranth-git-dependency.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 95d86c080a559d9c9f0498fb93d43d3fef377080 Mon Sep 17 00:00:00 2001
-From: Jack Leightcap <jack@leightcap.com>
-Date: Sat, 13 May 2023 17:28:54 -0400
-Subject: [PATCH] Relax Amaranth git dependency
-
-Signed-off-by: Jack Leightcap <jack@leightcap.com>
----
- software/pyproject.toml | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/software/pyproject.toml b/software/pyproject.toml
-index 6d1e2f1..6dfcc9e 100644
---- a/software/pyproject.toml
-+++ b/software/pyproject.toml
-@@ -20,8 +20,8 @@ classifiers = [
- ]
- 
- dependencies = [
--  "amaranth @ git+https://github.com/amaranth-lang/amaranth.git",
--  "fx2>=0.11",
-+  "amaranth",
-+  "fx2",
-   "libusb1>=1.8.1",
-   "aiohttp~=3.8",
-   "pyvcd",
--- 
-2.38.4
-
diff --git a/pkgs/tools/misc/gti/default.nix b/pkgs/tools/misc/gti/default.nix
index b60abc97e92c..9e396f33e6a1 100644
--- a/pkgs/tools/misc/gti/default.nix
+++ b/pkgs/tools/misc/gti/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gti";
-  version = "1.8.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "rwos";
     repo = "gti";
     rev = "v${version}";
-    sha256 = "sha256-x6ncvnZPPrVcQYwtwkSenW+ri0L6FpuDa7U7uYUqiyk=";
+    sha256 = "sha256-DUDCFcaB38Xkp3lLfEhjGC0j430dphXFBVhGzm7/Bp0=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/hdf5/bin-mv.patch b/pkgs/tools/misc/hdf5/bin-mv.patch
deleted file mode 100644
index 45649977e566..000000000000
--- a/pkgs/tools/misc/hdf5/bin-mv.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff -rc hdf5-1.8.5/configure hdf5-1.8.5-new/configure
-*** hdf5-1.8.5/configure	2010-06-04 20:26:04.000000000 +0200
---- hdf5-1.8.5-new/configure	2010-08-02 10:30:26.000000000 +0200
-***************
-*** 30587,30598 ****
-    sed 's/#define /#define H5_/' <src/H5config.h |\
-      sed 's/#undef /#undef H5_/' >pubconf
-    if test ! -f src/H5pubconf.h; then
-!     /bin/mv -f pubconf src/H5pubconf.h
-    elif (diff pubconf src/H5pubconf.h >/dev/null); then
-      rm -f pubconf
-      echo "src/H5pubconf.h is unchanged"
-    else
-!     /bin/mv -f pubconf src/H5pubconf.h
-    fi
-    echo "Post process src/libhdf5.settings"
-    sed '/^#/d' < src/libhdf5.settings > libhdf5.settings.TMP
---- 30587,30598 ----
-    sed 's/#define /#define H5_/' <src/H5config.h |\
-      sed 's/#undef /#undef H5_/' >pubconf
-    if test ! -f src/H5pubconf.h; then
-!     mv -f pubconf src/H5pubconf.h
-    elif (diff pubconf src/H5pubconf.h >/dev/null); then
-      rm -f pubconf
-      echo "src/H5pubconf.h is unchanged"
-    else
-!     mv -f pubconf src/H5pubconf.h
-    fi
-    echo "Post process src/libhdf5.settings"
-    sed '/^#/d' < src/libhdf5.settings > libhdf5.settings.TMP
diff --git a/pkgs/tools/misc/nb/default.nix b/pkgs/tools/misc/nb/default.nix
index 56513d35c779..d9d7110e77ce 100644
--- a/pkgs/tools/misc/nb/default.nix
+++ b/pkgs/tools/misc/nb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nb";
-  version = "7.8.0";
+  version = "7.9.0";
 
   src = fetchFromGitHub {
     owner = "xwmx";
     repo = "nb";
     rev = version;
-    sha256 = "sha256-8TOEPPtwxbTlm5nGMjOmH8lvsDu0vNgvxaUOgKS1l/g=";
+    sha256 = "sha256-5pKRZfLEFoB9abQdUTETMJhhgDFqlH/URipUv3cLnxQ=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/tools/misc/opentelemetry-collector/default.nix b/pkgs/tools/misc/opentelemetry-collector/default.nix
index 092d591b88a8..b078361bf057 100644
--- a/pkgs/tools/misc/opentelemetry-collector/default.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/default.nix
@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "opentelemetry-collector";
-  version = "0.90.0";
+  version = "0.90.1";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-collector";
     rev = "v${version}";
-    hash = "sha256-FL0lNlofXHTdn5o6g4FHNYauzJkjCKTrspSXP9slp/A=";
+    hash = "sha256-JKcYvJtuN38VrhcVFHRc0CKTH+x8HShs1/Ui0iN1jNo=";
   };
   # there is a nested go.mod
   sourceRoot = "${src.name}/cmd/otelcorecol";
-  vendorHash = "sha256-6Vr4Nk4mp505H3oAznAQ2mJl6qYFbHyO5MqgYeinnf8=";
+  vendorHash = "sha256-vaWOUc4CwiCDqe1szrBcgbHXQH/OkGTN0iqh+3CKPLQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/parallel/default.nix b/pkgs/tools/misc/parallel/default.nix
index a2aee41eff75..8a724c0b8698 100644
--- a/pkgs/tools/misc/parallel/default.nix
+++ b/pkgs/tools/misc/parallel/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "parallel";
-  version = "20231022";
+  version = "20231122";
 
   src = fetchurl {
     url = "mirror://gnu/parallel/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-k/K5TxhQeYpLXdoiva6G2ramVl41JYYOCORvJWPzJow=";
+    sha256 = "sha256-giyc+KoXFSCthn2xPvE0Jmab0WTIG5AKPby1VmEb6uI=";
   };
 
   outputs = [ "out" "man" "doc" ];
diff --git a/pkgs/tools/misc/pls/default.nix b/pkgs/tools/misc/pls/default.nix
deleted file mode 100644
index c6d6d2e52835..000000000000
--- a/pkgs/tools/misc/pls/default.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{ lib, python3, fetchFromGitHub }:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "pls";
-  version = "5.4.0";
-  format = "pyproject";
-
-  src = fetchFromGitHub {
-    owner = "dhruvkb";
-    repo = "pls";
-    rev = version;
-    sha256 = "sha256-h93Kz+ETdHfnzypa8JjMvbzA1o/KS1UuTG8/vhEt7Vo=";
-  };
-
-  nativeBuildInputs = [ python3.pkgs.poetry-core ];
-
-  propagatedBuildInputs = with python3.pkgs; [
-    pyyaml
-    requests
-    rich
-  ];
-
-  nativeCheckInputs = with python3.pkgs; [
-    freezegun
-    jsonschema
-    pytestCheckHook
-  ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'rich = "^12.5.1"' 'rich = "*"' \
-  '';
-
-  pytestFlagsArray = [ "tests/" "--ignore=tests/e2e" ];
-
-  pythonImportsCheck = [ "pls" ];
-
-  meta = with lib; {
-    homepage = "https://dhruvkb.github.io/pls/";
-    description = "Prettier and powerful ls";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ arjan-s ];
-  };
-}
diff --git a/pkgs/tools/misc/svu/default.nix b/pkgs/tools/misc/svu/default.nix
index 352f4d0ab721..0fafaffc153b 100644
--- a/pkgs/tools/misc/svu/default.nix
+++ b/pkgs/tools/misc/svu/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "svu";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "caarlos0";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-FmSBh2XxwxmIbX2TILnk+YUYbMQQbOb89uvnpl4b+7Y=";
+    sha256 = "sha256-MztFramrNqxYmdTRf857HOC7H66dLvezG6LL9njxWUs=";
   };
 
   vendorHash = "sha256-+e1oL08KvBSNaRepGR2SBBrEDJaGxl5V9rOBysGEfQs=";
diff --git a/pkgs/tools/misc/yubico-piv-tool/default.nix b/pkgs/tools/misc/yubico-piv-tool/default.nix
index eee35ea8c9d4..61d76205a6d6 100644
--- a/pkgs/tools/misc/yubico-piv-tool/default.nix
+++ b/pkgs/tools/misc/yubico-piv-tool/default.nix
@@ -1,38 +1,53 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitHub
 , pkg-config
 , openssl
 , check
 , pcsclite
 , PCSC
 , gengetopt
+, help2man
 , cmake
+, zlib
 , withApplePCSC ? stdenv.isDarwin
-, gitUpdater
+, nix-update-script
 , testers
-, yubico-piv-tool
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "yubico-piv-tool";
-  version = "2.3.1";
+  version = "2.4.1";
 
-  src = fetchurl {
-    url = "https://developers.yubico.com/yubico-piv-tool/Releases/yubico-piv-tool-${version}.tar.gz";
-    hash = "sha256-2ona/YthhapjU0Z1P53bKa8pvEq9kt2B832dZWC11k4=";
+  outputs = [ "out" "dev" "man" ];
+
+  src = fetchFromGitHub {
+    owner = "Yubico";
+    repo = "yubico-piv-tool";
+    rev = "refs/tags/yubico-piv-tool-${finalAttrs.version}";
+    hash = "sha256-KprY5BX7Fi/qWRT1pda9g8fqnmDB1Bh7oFM7sCwViuw=";
   };
 
   postPatch = ''
     substituteInPlace CMakeLists.txt --replace "-Werror" ""
   '';
 
-  nativeBuildInputs = [ pkg-config cmake gengetopt ];
-  buildInputs = [ openssl check ]
-    ++ (if withApplePCSC then [ PCSC ] else [ pcsclite ]);
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    gengetopt
+    help2man
+  ];
+
+  buildInputs = [
+    openssl
+    check
+    zlib.dev
+  ]
+  ++ (if withApplePCSC then [ PCSC ] else [ pcsclite ]);
 
   cmakeFlags = [
-    "-DGENERATE_MAN_PAGES=OFF" # Use the man page generated at release time
+    "-DGENERATE_MAN_PAGES=ON"
     "-DCMAKE_INSTALL_BINDIR=bin"
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
     "-DCMAKE_INSTALL_MANDIR=share/man"
@@ -42,13 +57,11 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--with-backend=${if withApplePCSC then "macscard" else "pcsc"}" ];
 
   passthru = {
-    updateScript = gitUpdater {
-      url = "https://github.com/Yubico/yubico-piv-tool.git";
-      rev-prefix = "yubico-piv-tool-";
+    updateScript = nix-update-script {
+      extraArgs = [ "--version-regex" "yubico-piv-tool-([0-9.]+)$" ];
     };
     tests.version = testers.testVersion {
-      inherit version;
-      package = yubico-piv-tool;
+      package = finalAttrs.finalPackage;
       command = "yubico-piv-tool --version";
     };
   };
@@ -72,4 +85,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ viraptor anthonyroussel ];
     mainProgram = "yubico-piv-tool";
   };
-}
+})
diff --git a/pkgs/tools/networking/bsd-finger/default.nix b/pkgs/tools/networking/bsd-finger/default.nix
index 48e64b202c6e..9d4c0267c76a 100644
--- a/pkgs/tools/networking/bsd-finger/default.nix
+++ b/pkgs/tools/networking/bsd-finger/default.nix
@@ -42,6 +42,7 @@ stdenv.mkDerivation rec {
       else "Remote user information server";
     platforms = platforms.linux;
     license = licenses.bsdOriginal;
+    mainProgram = "finger";
   };
 }
 # TODO: multiple outputs (manpage)
diff --git a/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch b/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
deleted file mode 100644
index 088f9b4032d2..000000000000
--- a/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-On darwin, providing SystemConfiguration to curl currently results in a
-reference loop, so we have to disable the check for it and the feature
-which requires it (NAT64).
-
-Patching actual configure script here as we also don't want to require
-autoconf in the bootstrap loop just to regenerate a patched configure.ac.
-
---- a/configure   2021-10-16 00:51:59.000000000 +0100
-+++ b/configure   2021-10-16 01:06:46.000000000 +0100
-@@ -21556,7 +221556,7 @@
-     if test "x$build_for_macos" != xno; then
-       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
- printf "%s\n" "yes" >&6; }
--      LDFLAGS="$LDFLAGS -framework CoreFoundation -framework CoreServices -framework SystemConfiguration"
-+      LDFLAGS="$LDFLAGS -framework CoreFoundation"
-     else
-       { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
- printf "%s\n" "no" >&6; }
-@@ -22211,9 +22211,6 @@
- fi
- 
- 
--if test "$HAVE_GETHOSTBYNAME" != "1"; then
--  as_fn_error $? "couldn't find libraries for gethostbyname()" "$LINENO" 5
--fi
- 
- 
- curl_includes_winsock2="\
-diff --git a/lib/curl_setup.h b/lib/curl_setup.h
-index b43714da7..7674778b7 100644
---- a/lib/curl_setup.h
-+++ b/lib/curl_setup.h
-@@ -250,20 +250,6 @@
- 
- #include <curl/system.h>
- 
--/*
-- * Use getaddrinfo to resolve the IPv4 address literal. If the current network
-- * interface doesn't support IPv4, but supports IPv6, NAT64, and DNS64,
-- * performing this task will result in a synthesized IPv6 address.
-- */
--#if defined(__APPLE__) && !defined(USE_ARES)
--#include <TargetConditionals.h>
--#define USE_RESOLVE_ON_IPS 1
--#  if TARGET_OS_MAC && !(defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE) && \
--     defined(ENABLE_IPV6)
--#    define CURL_MACOS_CALL_COPYPROXIES 1
--#  endif
--#endif
--
- #ifdef USE_LWIPSOCK
- #  include <lwip/init.h>
- #  include <lwip/sockets.h>
diff --git a/pkgs/tools/networking/driftnet/libwebsockets-4.3.0.patch b/pkgs/tools/networking/driftnet/libwebsockets-4.3.0.patch
deleted file mode 100644
index 5e5cfd50af3e..000000000000
--- a/pkgs/tools/networking/driftnet/libwebsockets-4.3.0.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/src/http_display/httpd.c b/src/http_display/httpd.c
-index f4709ef..7921d23 100644
---- a/src/http_display/httpd.c
-+++ b/src/http_display/httpd.c
-@@ -191,7 +191,6 @@ static void * http_server_dispatch(void *arg)
-         LWSMPRO_FILE,                  /* mount type is a directory in a filesystem */
-         1,                                     /* strlen("/"), ie length of the mountpoint */
-         NULL,
--        { NULL, NULL } // sentinel
-     };
-
-     memset(&info, 0, sizeof info);
diff --git a/pkgs/tools/networking/gping/default.nix b/pkgs/tools/networking/gping/default.nix
index 158b2cb275bc..4a31bb1494b7 100644
--- a/pkgs/tools/networking/gping/default.nix
+++ b/pkgs/tools/networking/gping/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gping";
-  version = "1.15.1";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = "gping";
     rev = "gping-v${version}";
-    hash = "sha256-22Nio6yfkL9HWNrI+kk5dGfojTtB/h0sizCWH9w9so8=";
+    hash = "sha256-t9USry3I6tc8EKsfkq28/hPJMbaf0BqqOdzCl3oXd60=";
   };
 
-  cargoHash = "sha256-YfvcCnFXDoZXp/Aug0jVQkilsvSzS+JF90U0QvVFksE=";
+  cargoHash = "sha256-QERmZOyC4U6ZpCkL7ap5MRvPEE2vqK/tD+CrBLg07J0=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
 
diff --git a/pkgs/tools/networking/hping/default.nix b/pkgs/tools/networking/hping/default.nix
index 33663a44d2a9..11a8cad05b9c 100644
--- a/pkgs/tools/networking/hping/default.nix
+++ b/pkgs/tools/networking/hping/default.nix
@@ -28,6 +28,13 @@ stdenv.mkDerivation rec {
   '' + lib.optionalString stdenv.isLinux ''
     sed -i -e 's|#include <net/bpf.h>|#include <pcap/bpf.h>|' \
       libpcap_stuff.c script.c
+  '' + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    substituteInPlace configure --replace 'BYTEORDER=`./byteorder -m`' BYTEORDER=${
+      {
+        littleEndian = "__LITTLE_ENDIAN_BITFIELD";
+        bigEndian = "__BIG_ENDIAN_BITFIELD";
+      }.${stdenv.hostPlatform.parsed.cpu.significantByte.name}}
+    substituteInPlace Makefile.in --replace './hping3 -v' ""
   '';
 
   configureFlags = [ (if withTcl then "TCLSH=${tcl}/bin/tclsh" else "--no-tcl") ];
diff --git a/pkgs/tools/networking/maubot/wrapper.nix b/pkgs/tools/networking/maubot/wrapper.nix
index baa0c29052e9..6f4c577110be 100644
--- a/pkgs/tools/networking/maubot/wrapper.nix
+++ b/pkgs/tools/networking/maubot/wrapper.nix
@@ -39,7 +39,7 @@ let wrapper = { pythonPackages ? (_: [ ]), plugins ? (_: [ ]), baseConfig ? null
             if builtins.isNull (baseConfig.server.override_resource_path or null)
             then "${unwrapped}/${python3.sitePackages}/maubot/management/frontend/build"
             else baseConfig.server.override_resource_path;
-        })})} $out/${python3.sitePackages}/maubot/example-config.yaml
+        })} $out/${python3.sitePackages}/maubot/example-config.yaml
         rm -rf $out/bin
       ''}
       mkdir -p $out/bin
diff --git a/pkgs/tools/networking/mozillavpn/default.nix b/pkgs/tools/networking/mozillavpn/default.nix
index 6888b5aa4ab2..1812dc690e18 100644
--- a/pkgs/tools/networking/mozillavpn/default.nix
+++ b/pkgs/tools/networking/mozillavpn/default.nix
@@ -26,13 +26,13 @@
 
 let
   pname = "mozillavpn";
-  version = "2.16.1";
+  version = "2.19.0";
   src = fetchFromGitHub {
     owner = "mozilla-mobile";
     repo = "mozilla-vpn-client";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-UMWBn3DoEU1fG7qh6F0GOhOqod+grPwp15wSSdP0eCo=";
+    hash = "sha256-aXfxUtGm+vq8U3jYTxYhOP7UXL6ukCJgmGQO2Wsqobo=";
   };
   patches = [ ];
 
@@ -46,19 +46,19 @@ let
     inherit src patches;
     name = "${pname}-${version}-extension-bridge";
     preBuild = "cd extension/bridge";
-    hash = "sha256-1wYTRc+NehiHwAd/2CmsJNv/TV6wH5wXwNiUdjzEUIk=";
+    hash = "sha256-23GTXsbjL8qfGA5NdPlrbdaA8rg8vOZsZCXvevi7Chc=";
   };
   signatureDeps = rustPlatform.fetchCargoTarball {
     inherit src patches;
     name = "${pname}-${version}-signature";
     preBuild = "cd signature";
-    hash = "sha256-oaKkQWMYkAy1c2biVt+GyjHBeYb2XkuRvFrWQJJIdPw=";
+    hash = "sha256-TB172hVIilDTl+y0shNp55if+FhrXjWSaGNF7K6GSH8=";
   };
   qtgleanDeps = rustPlatform.fetchCargoTarball {
     inherit src patches;
     name = "${pname}-${version}-qtglean";
     preBuild = "cd qtglean";
-    hash = "sha256-cqfiOBS8xFC2BbYp6BJWK6NHIU0tILSgu4eo3Ik4YqY=";
+    hash = "sha256-tfQ2ogSDDXNPeygBy+el+71iwcafSfY78hvYPHurKPE=";
   };
 
 in
@@ -110,7 +110,7 @@ stdenv.mkDerivation {
   dontCargoSetupPostUnpack = true;
 
   postPatch = ''
-    substituteInPlace src/apps/vpn/cmake/linux.cmake \
+    substituteInPlace src/cmake/linux.cmake \
       --replace '/etc/xdg/autostart' "$out/etc/xdg/autostart" \
       --replace '/usr/share/dbus-1' "$out/share/dbus-1" \
       --replace '${"$"}{SYSTEMD_UNIT_DIR}' "$out/lib/systemd/system"
diff --git a/pkgs/tools/networking/nexttrace/default.nix b/pkgs/tools/networking/nexttrace/default.nix
index c4f033184ebe..6db79ab5ceac 100644
--- a/pkgs/tools/networking/nexttrace/default.nix
+++ b/pkgs/tools/networking/nexttrace/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "nexttrace";
-  version = "1.2.3.1";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "nxtrace";
     repo = "NTrace-core";
     rev = "v${version}";
-    sha256 = "sha256-uY3Cjemv+iFOrWm7lXzRprIljqHCLWOF6DyDURrH39g=";
+    sha256 = "sha256-UD6+oFXYk5VWD9MZdE3ECnyYJSe7v88D9gkIAj+e7Bw=";
   };
-  vendorHash = "sha256-sugEN7sKBwEKsfX1MBwOiyH1aq1995HL+Yv7Q8XaPAo=";
+  vendorHash = "sha256-2lDkNbsAgEMSKK7ODpjJEL0ZM4N1khzGuio1645Xxqo=";
 
   doCheck = false; # Tests require a network connection.
 
diff --git a/pkgs/tools/networking/ofono/default.nix b/pkgs/tools/networking/ofono/default.nix
index f707b4a150dd..6ef0fc6ec0ad 100644
--- a/pkgs/tools/networking/ofono/default.nix
+++ b/pkgs/tools/networking/ofono/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "ofono";
-  version = "2.1";
+  version = "2.2";
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/tools/networking/photon/destdir.patch b/pkgs/tools/networking/photon/destdir.patch
deleted file mode 100644
index e6cf997f2e7c..000000000000
--- a/pkgs/tools/networking/photon/destdir.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/photon.py.old b/photon.py
-index 92498e4..f7e2c3d 100644
---- a/photon.py.old
-+++ b/photon.py
-@@ -185,7 +185,7 @@ if args.user_agent:
-     user_agents = args.user_agent.split(',')
- else:
-     user_agents = []
--    with open(os.getcwd() + '/core/user-agents.txt', 'r') as uas:
-+    with open('DESTDIR/core/user-agents.txt', 'r') as uas:
-         for agent in uas:
-             user_agents.append(agent.strip('\n'))
- 
-@@ -534,4 +534,4 @@ if args.export:
- if not colors: # if colors are disabled
-     print ('%s Results saved in %s directory' % (good, output_dir))
- else:
--    print ('%s Results saved in \033[;1m%s\033[0m directory' % (good, output_dir))
-\ No newline at end of file
-+    print ('%s Results saved in \033[;1m%s\033[0m directory' % (good, output_dir))
diff --git a/pkgs/tools/networking/sing-box/default.nix b/pkgs/tools/networking/sing-box/default.nix
index d75a49f6c9e6..361eacae4d0e 100644
--- a/pkgs/tools/networking/sing-box/default.nix
+++ b/pkgs/tools/networking/sing-box/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "sing-box";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-5n5AnuJQvw/26X3UWdLvegFhwYzjtS7o0d4cN3c3bfQ=";
+    hash = "sha256-SaWSmc498eLkWddnsHFpR6BPSbX/VHAlq+X4B7JG3Rk=";
   };
 
-  vendorHash = "sha256-UvLZY4vMS6dI6z9kPcSzbB/cW/7rfbrlhcWh51q5sak=";
+  vendorHash = "sha256-Frbv2KD5hJ5HHUdY9mm0aZ9NA5TN1D0am+FhpJZTvr4=";
 
   tags = [
     "with_quic"
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index 64c01b0ffe4f..a2094802712c 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "strongswan";
-  version = "5.9.11"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
+  version = "5.9.12"; # Make sure to also update <nixpkgs/nixos/modules/services/networking/strongswan-swanctl/swanctl-params.nix> when upgrading!
 
   src = fetchFromGitHub {
     owner = "strongswan";
     repo = "strongswan";
     rev = version;
-    hash = "sha256-DjVmDUEEJnf5kaia1f+Yow9g4+l3itOmoXR8/vVSssU=";
+    hash = "sha256-0s6I+ukA5XFAC0aJFKl9hjHDml2gMzXDn977EDxsZZ4=";
   };
 
   dontPatchELF = true;
diff --git a/pkgs/tools/networking/trippy/default.nix b/pkgs/tools/networking/trippy/default.nix
index 9b88ee4b799d..933150aebb9f 100644
--- a/pkgs/tools/networking/trippy/default.nix
+++ b/pkgs/tools/networking/trippy/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "trippy";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "fujiapple852";
     repo = "trippy";
     rev = version;
-    hash = "sha256-2bh4wNP8sQcojjjbx5DQctlkwCTYcPdSkpW4OCOyp9k=";
+    hash = "sha256-Q5WPpCm1RNLlNX8G1U160O2wJz+y+KMScApjx6gIBCg=";
   };
 
-  cargoHash = "sha256-C8SUceX9RwUyiCknmuRfBqG0vjesS54bZQHwi7krwKo=";
+  cargoHash = "sha256-brvfAZZ3L0loZQowcRfkS7o7ZYQB9hr5o1rgMSWaljU=";
 
   meta = with lib; {
     description = "A network diagnostic tool";
diff --git a/pkgs/tools/networking/wakelan/default.nix b/pkgs/tools/networking/wakelan/default.nix
index 7e9bcc1a70ca..3416b33281d3 100644
--- a/pkgs/tools/networking/wakelan/default.nix
+++ b/pkgs/tools/networking/wakelan/default.nix
@@ -9,6 +9,9 @@ stdenv.mkDerivation rec {
     hash = "sha256-PfXrj4d2SHmatiPPFxjsxvhusML1HTRNjoYEQtzFzW8=";
   };
 
+  # code predates c99
+  env.CFLAGS = "-std=c89";
+
   preInstall = ''
     mkdir -p $out/man/man1 $out/bin
   '';
diff --git a/pkgs/tools/package-management/micromamba/default.nix b/pkgs/tools/package-management/micromamba/default.nix
index 182f58ea9da8..5ff23ec7188d 100644
--- a/pkgs/tools/package-management/micromamba/default.nix
+++ b/pkgs/tools/package-management/micromamba/default.nix
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "micromamba";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "mamba-org";
     repo = "mamba";
     rev = "micromamba-" + version;
-    hash = "sha256-/9CzcnPd1D8jSl/pfl54+8/728r+GCqWFXahl47MJ3g=";
+    hash = "sha256-29SuR4RDW0+yNR1RHlm3I4avy0CjBTGxv1FKxMDZxO0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/security/aflplusplus/qemu-no-etc-install.patch b/pkgs/tools/security/aflplusplus/qemu-no-etc-install.patch
deleted file mode 100644
index 5dfbfd780f1c..000000000000
--- a/pkgs/tools/security/aflplusplus/qemu-no-etc-install.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/Makefile b/Makefile
-index d6b9dc1..ce7c493 100644
---- a/Makefile
-+++ b/Makefile
-@@ -601,7 +601,7 @@ install-localstatedir:
- endif
- 
- 
--install: all $(if $(BUILD_DOCS),install-doc) install-datadir install-localstatedir
-+install: all $(if $(BUILD_DOCS),install-doc) install-datadir
- ifneq ($(TOOLS),)
- 	$(call install-prog,$(subst qemu-ga,qemu-ga$(EXESUF),$(TOOLS)),$(DESTDIR)$(bindir))
- endif
diff --git a/pkgs/tools/security/aws-iam-authenticator/default.nix b/pkgs/tools/security/aws-iam-authenticator/default.nix
index f186c43721f4..0ce5e00e58bb 100644
--- a/pkgs/tools/security/aws-iam-authenticator/default.nix
+++ b/pkgs/tools/security/aws-iam-authenticator/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "aws-iam-authenticator";
-  version = "0.6.12";
+  version = "0.6.13";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-IIlAsxxEYjR7+wdWExdsQAH0x4yOXZ+bVQWwn7mrhRw=";
+    hash = "sha256-ggTxiijZQ5URNgdimrx2MPA3phy+XKvwHzr8YVmfFDo=";
   };
 
-  vendorHash = "sha256-RcZqnyZtonE4qeu+llL1OPGPG93/Rx8ESWM5wapZ1BM=";
+  vendorHash = "sha256-TDsY05jnutNIKx0z6/8vGvsgYCIKBkTxh9mXqk4IR38=";
 
   ldflags = let PKG = "sigs.k8s.io/aws-iam-authenticator"; in [
     "-s"
diff --git a/pkgs/tools/security/cfripper/default.nix b/pkgs/tools/security/cfripper/default.nix
index 440ca40ec68d..080fc8ae3e32 100644
--- a/pkgs/tools/security/cfripper/default.nix
+++ b/pkgs/tools/security/cfripper/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cfripper";
-  version = "1.15.1";
+  version = "1.15.2";
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Gtg4zoMTOW/nrFm7PF4/96VGcMALg2msVZ3E7lGm5KA=";
+    hash = "sha256-SmD3Dq5LicPRe3lWFsq4zqM/yDZ1LsgRwSUA5/RbN9I=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index b1f8cbb81b2a..01773e1330dd 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "9.9.3";
+  version = "9.10.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OlM/gcwHQWfXmKLcDDHh3okvqHIELRL+dRQJ6dOcItc=";
+    hash = "sha256-jHV0kWxmIoznhxo+nj/oY+43Gp0FwMQeyX91IMgFmvY=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-yhPixXldWUhJURZ/lIScIAbhsw/b/JCjYi1+Y5UOnnQ=";
+  vendorHash = "sha256-8clFlEuFD+o8USQlCPriC3BgHk2+U2BdxEwHt4hwI5M=";
 
   subPackages = [
     "apps/cnspec"
diff --git a/pkgs/tools/security/cryptomator/default.nix b/pkgs/tools/security/cryptomator/default.nix
index f910cf8467ed..c80be56319f1 100644
--- a/pkgs/tools/security/cryptomator/default.nix
+++ b/pkgs/tools/security/cryptomator/default.nix
@@ -2,6 +2,7 @@
 , autoPatchelfHook
 , fuse3
 , maven, jdk, makeShellWrapper, glib, wrapGAppsHook
+, libayatana-appindicator
 }:
 
 
@@ -22,15 +23,14 @@ mavenJdk.buildMavenPackage rec {
     hash = "sha256-NMNlDEUpwKUywzhXhxlNX7NiE+6wOov2Yt8nTfbKTNI=";
   };
 
-  mvnParameters = "-Dmaven.test.skip=true";
-  mvnHash = "sha256-jIHMUj7ZQFu4XAvWUywj4f0PbmLHGtU5VRG0ZuKm3mA=";
+  mvnParameters = "-Dmaven.test.skip=true -Plinux";
+  mvnHash = "sha256-cmwU9k7TRRJ07bT1EmY3pIBkvvqmFyE7WJeVL7VFDyc=";
 
   preBuild = ''
     VERSION=${version}
     SEMVER_STR=${version}
   '';
 
-
   # This is based on the instructins in https://github.com/cryptomator/cryptomator/blob/develop/dist/linux/appimage/build.sh
   installPhase = ''
     mkdir -p $out/bin/ $out/share/cryptomator/libs/ $out/share/cryptomator/mods/
@@ -38,8 +38,9 @@ mavenJdk.buildMavenPackage rec {
     cp target/libs/* $out/share/cryptomator/libs/
     cp target/mods/* target/cryptomator-*.jar $out/share/cryptomator/mods/
 
-    makeShellWrapper ${jdk}/bin/java $out/bin/cryptomator \
+    makeShellWrapper ${jdk}/bin/java $out/bin/${pname} \
       --add-flags "--enable-preview" \
+      --add-flags "--enable-native-access=org.cryptomator.jfuse.linux.amd64,org.purejava.appindicator" \
       --add-flags "--class-path '$out/share/cryptomator/libs/*'" \
       --add-flags "--module-path '$out/share/cryptomator/mods'" \
       --add-flags "-Dfile.encoding='utf-8'" \
@@ -49,17 +50,17 @@ mavenJdk.buildMavenPackage rec {
       --add-flags "-Dcryptomator.p12Path='@{userhome}/.config/Cryptomator/key.p12'" \
       --add-flags "-Dcryptomator.ipcSocketPath='@{userhome}/.config/Cryptomator/ipc.socket'" \
       --add-flags "-Dcryptomator.mountPointsDir='@{userhome}/.local/share/Cryptomator/mnt'" \
-      --add-flags "-Dcryptomator.showTrayIcon=false" \
-      --add-flags "-Dcryptomator.buildNumber='nix'" \
+      --add-flags "-Dcryptomator.showTrayIcon=true" \
+      --add-flags "-Dcryptomator.buildNumber='nix-${src.rev}'" \
       --add-flags "-Dcryptomator.appVersion='${version}'" \
-      --add-flags "-Djdk.gtk.version=3" \
+      --add-flags "-Djava.net.useSystemProxies=true" \
       --add-flags "-Xss20m" \
       --add-flags "-Xmx512m" \
-      --add-flags "-Djavafx.embed.singleThread=true " \
-      --add-flags "-Dawt.useSystemAAFontSettings=on" \
+      --add-flags "-Dcryptomator.disableUpdateCheck=true" \
+      --add-flags "-Dcryptomator.integrationsLinux.trayIconsDir='$out/share/icons/hicolor/symbolic/apps'" \
       --add-flags "--module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator" \
       --prefix PATH : "$out/share/cryptomator/libs/:${lib.makeBinPath [ jdk glib ]}" \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ fuse3 ]}" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ fuse3 libayatana-appindicator ]}" \
       --set JAVA_HOME "${jdk.home}"
 
     # install desktop entry and icons
@@ -80,7 +81,7 @@ mavenJdk.buildMavenPackage rec {
     wrapGAppsHook
     jdk
   ];
-  buildInputs = [ fuse3 jdk glib ];
+  buildInputs = [ fuse3 jdk glib libayatana-appindicator ];
 
   meta = with lib; {
     description = "Free client-side encryption for your cloud files";
diff --git a/pkgs/tools/security/dalfox/default.nix b/pkgs/tools/security/dalfox/default.nix
index b6d21b801efc..8c72a93d340f 100644
--- a/pkgs/tools/security/dalfox/default.nix
+++ b/pkgs/tools/security/dalfox/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dalfox";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-AG5CNqkxPQJQ+HN3JGUIgSYxgFigmUqVGn1yAHmo7Mo=";
+    sha256 = "sha256-7wSmPmS8m+rYhYlREzKlPUiUfDvru9zwFFvSCDq6JY8=";
   };
 
-  vendorHash = "sha256-OLT85GOcTnWmU+ZRem2+vY29nzvzXhnmIN2W+U6phPk=";
+  vendorHash = "sha256-W+37EL3e7G+U0EZUDuVqjZpfIf5+HcirH8NVsC+1NvA=";
 
   # Tests require network access
   doCheck = false;
diff --git a/pkgs/tools/security/doppler/default.nix b/pkgs/tools/security/doppler/default.nix
index 272caf42e90e..92b964ad2c95 100644
--- a/pkgs/tools/security/doppler/default.nix
+++ b/pkgs/tools/security/doppler/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "doppler";
-  version = "3.66.3";
+  version = "3.66.5";
 
   src = fetchFromGitHub {
     owner = "dopplerhq";
     repo = "cli";
     rev = version;
-    sha256 = "sha256-zS5nIULnzoOG43nNcVb6MdmKNDcDK75mh3SOMB5BXIY=";
+    sha256 = "sha256-/kcGfTDthm4gp1M4lSeY1x8Q7EWVX2pZVjF2rAbz+Es=";
   };
 
   vendorHash = "sha256-FOmaK6S61fkzybpDx6qfi6m4e2IaqBpavaFhEgIvmqw=";
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index acfbad10cd55..ff1b798a59b3 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-12-02";
+  version = "2023-12-07";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-rITeDc1PQFjV4ZlBK97T+hvIzuWMIoPxBLscqkXiMwc=";
+    hash = "sha256-aN98whcpb3XMXWNFM0ynhcu6CmVdEXNDvtRE98mJSMA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/fscan/default.nix b/pkgs/tools/security/fscan/default.nix
index cda7fb968d3d..00ce9d8ec78e 100644
--- a/pkgs/tools/security/fscan/default.nix
+++ b/pkgs/tools/security/fscan/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fscan";
-  version = "1.8.3";
+  version = "1.8.3-build3";
 
   src = fetchFromGitHub {
     owner = "shadow1ng";
     repo = "fscan";
     rev = version;
-    hash = "sha256-uoM/nMtgIqyzpOoSQKD5k4LXAXoA8G5N4In8tZlngqs=";
+    hash = "sha256-GtOCd8JaR6tx8hoB+P9QXrEnN7Wvmv7jddhc2/8hjvQ=";
   };
 
   vendorHash = "sha256-hvb2IfypwYauF3ubE36u0bTU+l/FWP/CZt6dFd9zc6s=";
@@ -18,7 +18,6 @@ buildGoModule rec {
     homepage = "https://github.com/shadow1ng/fscan";
     license = licenses.mit;
     maintainers = with maintainers; [ Misaka13514 ];
-    platforms = with platforms; unix ++ windows;
     mainProgram = "fscan";
   };
 }
diff --git a/pkgs/tools/security/gnupg/gpgkey2ssh-20.patch b/pkgs/tools/security/gnupg/gpgkey2ssh-20.patch
deleted file mode 100644
index 65804bac7642..000000000000
--- a/pkgs/tools/security/gnupg/gpgkey2ssh-20.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/tools/gpgkey2ssh.c b/tools/gpgkey2ssh.c
-index 903fb5b..d5611dc 100644
---- a/tools/gpgkey2ssh.c
-+++ b/tools/gpgkey2ssh.c
-@@ -268,7 +268,7 @@ main (int argc, char **argv)
-   keyid = argv[1];
- 
-   ret = asprintf (&command,
--		  "gpg --list-keys --with-colons --with-key-data '%s'",
-+		  "@out@/bin/gpg --list-keys --with-colons --with-key-data '%s'",
- 		  keyid);
-   assert (ret > 0);
- 
-
diff --git a/pkgs/tools/security/gotestwaf/default.nix b/pkgs/tools/security/gotestwaf/default.nix
index 8f9d8776687f..78ba5e06e4b9 100644
--- a/pkgs/tools/security/gotestwaf/default.nix
+++ b/pkgs/tools/security/gotestwaf/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gotestwaf";
-  version = "0.4.8";
+  version = "0.4.9";
 
   src = fetchFromGitHub {
     owner = "wallarm";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-5cvyKCzisfuoMPuQpiRnIBCTw2yMdA1yavKNS9OwW58=";
+    hash = "sha256-fBmn+p5uVGnI4lyL12cX4S8eda79k2Y0RPQG9iZQs2Q=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/security/jadx/default.nix b/pkgs/tools/security/jadx/default.nix
index 10f67d5f0b35..a1fbd44b0232 100644
--- a/pkgs/tools/security/jadx/default.nix
+++ b/pkgs/tools/security/jadx/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , gradle
 , jdk
+, quark-engine
 , makeWrapper
 , perl
 , imagemagick
@@ -114,7 +115,9 @@ in stdenv.mkDerivation (finalAttrs: {
     cp -R build/jadx/lib $out
     for prog in jadx jadx-gui; do
       cp build/jadx/bin/$prog $out/bin
-      wrapProgram $out/bin/$prog --set JAVA_HOME ${jdk.home}
+      wrapProgram $out/bin/$prog \
+        --set JAVA_HOME ${jdk.home} \
+        --prefix PATH : "${lib.makeBinPath [ quark-engine ]}"
     done
 
     for size in 16 32 48; do
@@ -153,6 +156,6 @@ in stdenv.mkDerivation (finalAttrs: {
     ];
     license = licenses.asl20;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ delroth ];
+    maintainers = with maintainers; [ delroth emilytrau ];
   };
 })
diff --git a/pkgs/tools/security/nitrokey-app2/default.nix b/pkgs/tools/security/nitrokey-app2/default.nix
index a3e3a82ec234..15e756a7053b 100644
--- a/pkgs/tools/security/nitrokey-app2/default.nix
+++ b/pkgs/tools/security/nitrokey-app2/default.nix
@@ -1,7 +1,6 @@
 { lib
 , python3
 , fetchFromGitHub
-, pynitrokey
 , wrapQtAppsHook
 }:
 
diff --git a/pkgs/tools/security/pynitrokey/default.nix b/pkgs/tools/security/pynitrokey/default.nix
deleted file mode 100644
index 2d1979c1b0c1..000000000000
--- a/pkgs/tools/security/pynitrokey/default.nix
+++ /dev/null
@@ -1,107 +0,0 @@
-{ lib
-, buildPythonApplication
-, fetchPypi
-, pythonRelaxDepsHook
-, installShellFiles
-, libnitrokey
-, flit-core
-, certifi
-, cffi
-, click
-, cryptography
-, ecdsa
-, fido2
-, intelhex
-, nkdfu
-, python-dateutil
-, pyusb
-, requests
-, spsdk
-, tqdm
-, tlv8
-, typing-extensions
-, pyserial
-, protobuf
-, click-aliases
-, semver
-, nethsm
-, importlib-metadata
-}:
-
-let
-  pname = "pynitrokey";
-  version = "0.4.43";
-  mainProgram = "nitropy";
-in
-
-buildPythonApplication {
-  inherit pname version;
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-dYOdokqALDg4Xn7N6Yd0skM/tit+j5+xY73sm9k76hE=";
-  };
-
-  propagatedBuildInputs = [
-    certifi
-    cffi
-    click
-    cryptography
-    ecdsa
-    fido2
-    intelhex
-    nkdfu
-    python-dateutil
-    pyusb
-    requests
-    spsdk
-    tqdm
-    tlv8
-    typing-extensions
-    pyserial
-    protobuf
-    click-aliases
-    semver
-    nethsm
-    importlib-metadata
-  ];
-
-  nativeBuildInputs = [
-    flit-core
-    installShellFiles
-    pythonRelaxDepsHook
-  ];
-
-  pythonRelaxDeps = true;
-
-  # pythonRelaxDepsHook runs in postBuild so cannot be used
-  pypaBuildFlags = [ "--skip-dependency-check" ];
-
-  # libnitrokey is not propagated to users of the pynitrokey Python package.
-  # It is only usable from the wrapped bin/nitropy
-  makeWrapperArgs = [
-    "--set LIBNK_PATH ${lib.makeLibraryPath [ libnitrokey ]}"
-  ];
-
-  # no tests
-  doCheck = false;
-
-  pythonImportsCheck = [ "pynitrokey" ];
-
-  postInstall = ''
-    installShellCompletion --cmd ${mainProgram} \
-      --bash <(_NITROPY_COMPLETE=bash_source $out/bin/${mainProgram}) \
-      --zsh <(_NITROPY_COMPLETE=zsh_source $out/bin/${mainProgram}) \
-      --fish <(_NITROPY_COMPLETE=fish_source $out/bin/${mainProgram})
-  '';
-
-  meta = with lib; {
-    description = "Python client for Nitrokey devices";
-    homepage = "https://github.com/Nitrokey/pynitrokey";
-    changelog = "https://github.com/Nitrokey/pynitrokey/releases/tag/v${version}";
-    license = with licenses; [ asl20 mit ];
-    maintainers = with maintainers; [ frogamic ];
-    inherit mainProgram;
-  };
-}
diff --git a/pkgs/tools/security/rblake2sum/default.nix b/pkgs/tools/security/rblake2sum/default.nix
index a5a4a1bce76c..8f2a86836356 100644
--- a/pkgs/tools/security/rblake2sum/default.nix
+++ b/pkgs/tools/security/rblake2sum/default.nix
@@ -24,5 +24,6 @@ rustPlatform.buildRustPackage {
     homepage = "https://github.com/crev-dev/rblake2sum";
     license = [ licenses.mit ];
     maintainers = with maintainers; [ dpc ];
+    mainProgram = "rblake2sum";
   };
 }
diff --git a/pkgs/tools/security/rblake3sum/default.nix b/pkgs/tools/security/rblake3sum/default.nix
new file mode 100644
index 000000000000..341dcd06fb6a
--- /dev/null
+++ b/pkgs/tools/security/rblake3sum/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, Security
+}:
+rustPlatform.buildRustPackage {
+  pname = "rblake3sum";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "rustshop";
+    repo = "rblake3sum";
+    rev = "6a8e2576ccc05214eacb75b75a9d4cfdf272161c";
+    hash = "sha256-UFk6SJVA58WXhH1CIuT48MEF19yPUe1HD+ekn4LDj8g=";
+  };
+
+  cargoHash = "sha256-SE/Zg/UEV/vhB/VDcn8Y70OUIoxbJBh6H2QgFMkWPc4=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with lib; {
+    description = "A recursive blake3 digest (hash) of a file-system path";
+    homepage = "https://github.com/rustshop/rblake3sum";
+    license = [ licenses.mit ];
+    maintainers = with maintainers; [ dpc ];
+    mainProgram = "rblake3sum";
+  };
+}
diff --git a/pkgs/tools/security/step-kms-plugin/default.nix b/pkgs/tools/security/step-kms-plugin/default.nix
index 66413b1798ac..9e948bf52dd6 100644
--- a/pkgs/tools/security/step-kms-plugin/default.nix
+++ b/pkgs/tools/security/step-kms-plugin/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "step-kms-plugin";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "smallstep";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-pbSv3qTQkeYWtg5HKu9kUIWYw6t6yKKA4GQuiwGEPD8=";
+    hash = "sha256-l0MMcLghhqVVQAdhk0a0nDqYvJbXCV2PFbRtiGQcDn0=";
   };
 
-  vendorHash = "sha256-hb1Nn/+PVhhBByQ8I9MuUEd5di5jEZVMtSpm0+qBXQk=";
+  vendorHash = "sha256-3du8KlM08N5hKmzZWYZdfPOL5R+BspbK6ABF+RSJzHg=";
 
   proxyVendor = true;
 
diff --git a/pkgs/tools/security/vault/vault-bin.nix b/pkgs/tools/security/vault/vault-bin.nix
index ca392d68a96d..e7516cc83d0d 100644
--- a/pkgs/tools/security/vault/vault-bin.nix
+++ b/pkgs/tools/security/vault/vault-bin.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "1.15.2";
+  version = "1.15.3";
 
   src =
     let
@@ -16,11 +16,11 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       sha256 = selectSystem {
-        x86_64-linux = "sha256-aawDrQu8wEZqJ/uyCJjtWcgy8Ut34B5P+odqddE5P3M=";
-        aarch64-linux = "sha256-thLVw//yIgPCAV9CdrRlINLg+cO5aB279I2aboZMF6w=";
-        i686-linux = "sha256-bUhtnQB5YZdDuB4uondln0D3itoTr+1FaqjgTiT76WA=";
-        x86_64-darwin = "sha256-+wZrWwbpibtCla1ydhDnLJsHrVymLzEXVE1KftZ+pOs=";
-        aarch64-darwin = "sha256-2FGiCzIAEyXTqRaKEDZK5d/PWl4EmvJl9NieiOdgOeY=";
+        x86_64-linux = "sha256-rRXpRxuslOvvNgK6W0BG/LWs2sAGGCuSxcbVbsmrtN0=";
+        aarch64-linux = "sha256-vD/S+aZGa+JFRBV9WML9WbhrFpB8FynM62ZJ0zkWtDU=";
+        i686-linux = "sha256-Y9KpL0kZxlgfkBSyXJVSND2hSJ1y+FuXKPK0/P2YX2w=";
+        x86_64-darwin = "sha256-i85GQSJK7dPoLP7XBrz7CiISCG8KbGylL++ecy/CXRY=";
+        aarch64-darwin = "sha256-eZAuUNbigJ/kye8p3yu+Qf+p47IkxKJntR2sGFpM+j8=";
       };
     in
     fetchzip {
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
     description = "A tool for managing secrets, this binary includes the UI";
     homepage = "https://www.vaultproject.io";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.mpl20;
+    license = licenses.bsl11;
     maintainers = with maintainers; teams.serokell.members ++ [ offline psyanticy Chili-Man techknowlogick mkaito ];
     mainProgram = "vault";
     platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ];
diff --git a/pkgs/tools/security/wpscan/Gemfile.lock b/pkgs/tools/security/wpscan/Gemfile.lock
index b233f57a5817..186144a3b1a9 100644
--- a/pkgs/tools/security/wpscan/Gemfile.lock
+++ b/pkgs/tools/security/wpscan/Gemfile.lock
@@ -1,57 +1,57 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (6.1.7.4)
+    activesupport (6.1.7.6)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
       zeitwerk (~> 2.3)
-    addressable (2.8.4)
+    addressable (2.8.5)
       public_suffix (>= 2.0.2, < 6.0)
-    cms_scanner (0.13.8)
-      ethon (>= 0.14, < 0.16)
+    cms_scanner (0.13.9)
+      ethon (>= 0.14, < 0.17)
       get_process_mem (~> 0.2.5)
-      nokogiri (>= 1.11.4, < 1.14.0)
+      nokogiri (>= 1.11.4, < 1.16.0)
       opt_parse_validator (~> 1.9.5)
-      public_suffix (~> 4.0.3)
-      ruby-progressbar (>= 1.10, < 1.12)
-      sys-proctable (~> 1.2.2)
+      public_suffix (>= 4.0.3, < 5.1.0)
+      ruby-progressbar (>= 1.10, < 1.14)
+      sys-proctable (>= 1.2.2, < 1.4.0)
       typhoeus (>= 1.3, < 1.5)
       xmlrpc (~> 0.3)
       yajl-ruby (~> 1.4.1)
     concurrent-ruby (1.2.2)
-    ethon (0.15.0)
+    ethon (0.16.0)
       ffi (>= 1.15.0)
-    ffi (1.15.5)
+    ffi (1.16.3)
     get_process_mem (0.2.7)
       ffi (~> 1.0)
     i18n (1.14.1)
       concurrent-ruby (~> 1.0)
-    mini_portile2 (2.8.2)
-    minitest (5.18.1)
-    nokogiri (1.13.10)
-      mini_portile2 (~> 2.8.0)
+    mini_portile2 (2.8.5)
+    minitest (5.20.0)
+    nokogiri (1.15.5)
+      mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     opt_parse_validator (1.9.5)
       activesupport (>= 5.2, < 6.2.0)
       addressable (>= 2.5, < 2.9)
-    public_suffix (4.0.7)
-    racc (1.7.1)
-    ruby-progressbar (1.11.0)
-    sys-proctable (1.2.7)
+    public_suffix (5.0.4)
+    racc (1.7.3)
+    ruby-progressbar (1.13.0)
+    sys-proctable (1.3.0)
       ffi (~> 1.1)
-    typhoeus (1.4.0)
+    typhoeus (1.4.1)
       ethon (>= 0.9.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     webrick (1.8.1)
-    wpscan (3.8.24)
-      cms_scanner (~> 0.13.8)
-    xmlrpc (0.3.2)
+    wpscan (3.8.25)
+      cms_scanner (~> 0.13.9)
+    xmlrpc (0.3.3)
       webrick
     yajl-ruby (1.4.3)
-    zeitwerk (2.6.8)
+    zeitwerk (2.6.12)
 
 PLATFORMS
   ruby
@@ -60,4 +60,4 @@ DEPENDENCIES
   wpscan
 
 BUNDLED WITH
-   2.4.13
+   2.4.22
diff --git a/pkgs/tools/security/wpscan/gemset.nix b/pkgs/tools/security/wpscan/gemset.nix
index 5cae455dd014..abe19a29bf8f 100644
--- a/pkgs/tools/security/wpscan/gemset.nix
+++ b/pkgs/tools/security/wpscan/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0s465919p6fcgcsqin8w8hay2m598dvnzks490hbsb0p68sdz69m";
+      sha256 = "1nhrdih0rk46i0s6x7nqhbypmj1hf23zl5gfl9xasb6k4r2a1dxk";
       type = "gem";
     };
-    version = "6.1.7.4";
+    version = "6.1.7.6";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -16,10 +16,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15s8van7r2ad3dq6i03l3z4hqnvxcq75a3h72kxvf9an53sqma20";
+      sha256 = "05r1fwy487klqkya7vzia8hnklcxy4vr92m9dmni3prfwk6zpw33";
       type = "gem";
     };
-    version = "2.8.4";
+    version = "2.8.5";
   };
   cms_scanner = {
     dependencies = ["ethon" "get_process_mem" "nokogiri" "opt_parse_validator" "public_suffix" "ruby-progressbar" "sys-proctable" "typhoeus" "xmlrpc" "yajl-ruby"];
@@ -27,10 +27,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15d7djrrkrcwznglgkr4y80jbsbxaf071qhjnn4i1c4n7nszwwfj";
+      sha256 = "0p3vdkkd04r31d503z5v0480xlq1fhiw77icbk5s17y6dwfacydy";
       type = "gem";
     };
-    version = "0.13.8";
+    version = "0.13.9";
   };
   concurrent-ruby = {
     groups = ["default"];
@@ -48,20 +48,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kd7c61f28f810fgxg480j7457nlvqarza9c2ra0zhav0dd80288";
+      sha256 = "17ix0mijpsy3y0c6ywrk5ibarmvqzjsirjyprpsy3hwax8fdm85v";
       type = "gem";
     };
-    version = "0.15.0";
+    version = "0.16.0";
   };
   ffi = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1862ydmclzy1a0cjbvm8dz7847d9rch495ib0zb64y84d3xd4bkg";
+      sha256 = "1yvii03hcgqj30maavddqamqy50h7y6xcn2wcyq72wn823zl4ckd";
       type = "gem";
     };
-    version = "1.15.5";
+    version = "1.16.3";
   };
   get_process_mem = {
     dependencies = ["ffi"];
@@ -90,20 +90,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0z7f38iq37h376n9xbl4gajdrnwzq284c9v1py4imw3gri2d5cj6";
+      sha256 = "1kl9c3kdchjabrihdqfmcplk3lq4cw1rr9f378y6q22qwy5dndvs";
       type = "gem";
     };
-    version = "2.8.2";
+    version = "2.8.5";
   };
   minitest = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kg9wh7jlc9zsr3hkhpzkbn0ynf4np5ap9m2d8xdrb8shy0y6pmb";
+      sha256 = "0bkmfi9mb49m0fkdhl2g38i3xxa02d411gg0m8x0gvbwfmmg5ym3";
       type = "gem";
     };
-    version = "5.18.1";
+    version = "5.20.0";
   };
   nokogiri = {
     dependencies = ["mini_portile2" "racc"];
@@ -111,10 +111,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0n79k78c5vdcyl0m3y3l5x9kxl6xf5lgriwi2vd665qmdkr01vnk";
+      sha256 = "004ip9x9281fxhpipwi8di1sb1dnabscq9dy1p3cxgdwbniqqi12";
       type = "gem";
     };
-    version = "1.13.10";
+    version = "1.15.5";
   };
   opt_parse_validator = {
     dependencies = ["activesupport" "addressable"];
@@ -132,30 +132,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1f3knlwfwm05sfbaihrxm4g772b79032q14c16q4b38z8bi63qcb";
+      sha256 = "1bni4qjrsh2q49pnmmd6if4iv3ak36bd2cckrs6npl111n769k9m";
       type = "gem";
     };
-    version = "4.0.7";
+    version = "5.0.4";
   };
   racc = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11v3l46mwnlzlc371wr3x6yylpgafgwdf0q7hc7c1lzx6r414r5g";
+      sha256 = "01b9662zd2x9bp4rdjfid07h09zxj7kvn7f5fghbqhzc625ap1dp";
       type = "gem";
     };
-    version = "1.7.1";
+    version = "1.7.3";
   };
   ruby-progressbar = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "02nmaw7yx9kl7rbaan5pl8x5nn0y4j5954mzrkzi9i3dhsrps4nc";
+      sha256 = "0cwvyb7j47m7wihpfaq7rc47zwwx9k4v7iqd9s1xch5nm53rrz40";
       type = "gem";
     };
-    version = "1.11.0";
+    version = "1.13.0";
   };
   sys-proctable = {
     dependencies = ["ffi"];
@@ -163,10 +163,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "121ix0bl19pawhljs17sfgddkd0hgxlhchsz9kxw14ipmskjq9ah";
+      sha256 = "0m3fj6j1qpfszqnsvr6wpak0d9vw5ggylaqkalhl3m50kbbimxii";
       type = "gem";
     };
-    version = "1.2.7";
+    version = "1.3.0";
   };
   typhoeus = {
     dependencies = ["ethon"];
@@ -174,10 +174,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1m22yrkmbj81rzhlny81j427qdvz57yk5wbcf3km0nf3bl6qiygz";
+      sha256 = "0z7gamf6s83wy0yqms3bi4srirn3fc0lc7n65lqanidxcj1xn5qw";
       type = "gem";
     };
-    version = "1.4.0";
+    version = "1.4.1";
   };
   tzinfo = {
     dependencies = ["concurrent-ruby"];
@@ -206,10 +206,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qh7x5sjx1i9h8zrp86qz126brxbqx0c3wxc8vn7fpln0y78nw9q";
+      sha256 = "1x04asq0aznbm6m79jlsv7mjbhq755759s4bi3qbyrv5rwpy7hji";
       type = "gem";
     };
-    version = "3.8.24";
+    version = "3.8.25";
   };
   xmlrpc = {
     dependencies = ["webrick"];
@@ -217,10 +217,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xa79ry3976ylap38cr5g6q3m81plm611flqd3dwgnmgbkycb6jp";
+      sha256 = "0fwfnccagsjrbvrav5nbk3zracj9zncr7i375nn20jd4cfy4cggc";
       type = "gem";
     };
-    version = "0.3.2";
+    version = "0.3.3";
   };
   yajl-ruby = {
     groups = ["default"];
@@ -237,9 +237,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ck6bj7wa73dkdh13735jl06k6cfny98glxjkas82aivlmyzqqbk";
+      sha256 = "1gir0if4nryl1jhwi28669gjwhxb7gzrm1fcc8xzsch3bnbi47jn";
       type = "gem";
     };
-    version = "2.6.8";
+    version = "2.6.12";
   };
 }
diff --git a/pkgs/tools/system/skeema/default.nix b/pkgs/tools/system/skeema/default.nix
index 1d5c7c4886a9..38d6c4d1f75a 100644
--- a/pkgs/tools/system/skeema/default.nix
+++ b/pkgs/tools/system/skeema/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "skeema";
-  version = "1.11.0";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "skeema";
     repo = "skeema";
     rev = "v${version}";
-    hash = "sha256-BXjcn9oakTvaWPYIsAsjYRwQ1aKhZ4PAV2AkxSVOF/I=";
+    hash = "sha256-S7eMqaz8BZ80AwIrVmX+rnEgIwEdy8q65FIy6Mac4CY=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/text/d2/default.nix b/pkgs/tools/text/d2/default.nix
index bca032d6ddf9..4e426085374d 100644
--- a/pkgs/tools/text/d2/default.nix
+++ b/pkgs/tools/text/d2/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "d2";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "terrastruct";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bp45tkV7f6rGDAmhle/e3cHIqa7nPakANvk4QxetLts=";
+    hash = "sha256-4kSnwJTS+am9ATlUPsWLGccHXFQqrEcK0GtaqqW7fdQ=";
   };
 
-  vendorHash = "sha256-QMptNFCoJouI555WkA+4TJhaEzQgJJmca3jVpM3neeI=";
+  vendorHash = "sha256-BEYww1wsf9nxE48TNvyFkddF0TwQg7e5BoolvvKewYg=";
 
   excludedPackages = [ "./e2etests" ];
 
diff --git a/pkgs/tools/text/enscript/0001-use-system-getopt.patch b/pkgs/tools/text/enscript/0001-use-system-getopt.patch
new file mode 100644
index 000000000000..0ae8776f361e
--- /dev/null
+++ b/pkgs/tools/text/enscript/0001-use-system-getopt.patch
@@ -0,0 +1,68 @@
+From 4c5cbf6db71cf2981fc836ed370c82149748d8ea Mon Sep 17 00:00:00 2001
+From: annalee <150648636+a-n-n-a-l-e-e@users.noreply.github.com>
+Date: Wed, 6 Dec 2023 22:57:19 +0000
+Subject: [PATCH] use system getopt
+
+the file compat/getopt.h also needs to be removed otherwise it will
+create conflicts with the system includes
+---
+ compat/Makefile.am | 4 ++--
+ compat/Makefile.in | 6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/compat/Makefile.am b/compat/Makefile.am
+index aefc06f..23aaf81 100644
+--- a/compat/Makefile.am
++++ b/compat/Makefile.am
+@@ -25,7 +25,7 @@
+ AUTOMAKE_OPTIONS = no-dependencies
+ 
+ noinst_LIBRARIES = libcompat.a
+-libcompat_a_SOURCES = getopt.c getopt1.c xalloc.c regex.c
++libcompat_a_SOURCES = xalloc.c regex.c
+ libcompat_a_LIBADD = @LIBOBJS@ @ALLOCA@
+ libcompat_a_DEPENDENCIES = @LIBOBJS@ @ALLOCA@
+ 
+@@ -34,7 +34,7 @@ libcompat_a_SOURCES_windelta =	\
+ 	+../w32/getpwd.c	\
+ 	+../w32/getuid.c
+ 
+-noinst_HEADERS = getopt.h regex.h xalloc.h
++noinst_HEADERS = regex.h xalloc.h
+ 
+ EXTRA_DIST = ChangeLog.old strerror.c memmove.c memcpy.c strtol.c	\
+ 	strtoul.c gettext.h
+diff --git a/compat/Makefile.in b/compat/Makefile.in
+index edfc620..dee05d7 100644
+--- a/compat/Makefile.in
++++ b/compat/Makefile.in
+@@ -137,7 +137,7 @@ am__v_AR_ = $(am__v_AR_@AM_DEFAULT_V@)
+ am__v_AR_0 = @echo "  AR      " $@;
+ am__v_AR_1 = 
+ libcompat_a_AR = $(AR) $(ARFLAGS)
+-am_libcompat_a_OBJECTS = getopt.$(OBJEXT) getopt1.$(OBJEXT) \
++am_libcompat_a_OBJECTS = \
+ 	xalloc.$(OBJEXT) regex.$(OBJEXT)
+ libcompat_a_OBJECTS = $(am_libcompat_a_OBJECTS)
+ AM_V_P = $(am__v_P_@AM_V@)
+@@ -326,7 +326,7 @@ top_builddir = @top_builddir@
+ top_srcdir = @top_srcdir@
+ AUTOMAKE_OPTIONS = no-dependencies
+ noinst_LIBRARIES = libcompat.a
+-libcompat_a_SOURCES = getopt.c getopt1.c xalloc.c regex.c
++libcompat_a_SOURCES = xalloc.c regex.c
+ libcompat_a_LIBADD = @LIBOBJS@ @ALLOCA@
+ libcompat_a_DEPENDENCIES = @LIBOBJS@ @ALLOCA@
+ libcompat_a_SOURCES_windelta = \
+@@ -334,7 +334,7 @@ libcompat_a_SOURCES_windelta = \
+ 	+../w32/getpwd.c	\
+ 	+../w32/getuid.c
+ 
+-noinst_HEADERS = getopt.h regex.h xalloc.h
++noinst_HEADERS = regex.h xalloc.h
+ EXTRA_DIST = ChangeLog.old strerror.c memmove.c memcpy.c strtol.c	\
+ 	strtoul.c gettext.h
+ 
+-- 
+2.42.0
+
diff --git a/pkgs/tools/text/enscript/default.nix b/pkgs/tools/text/enscript/default.nix
index 1299ef78679c..e5aeb75ca626 100644
--- a/pkgs/tools/text/enscript/default.nix
+++ b/pkgs/tools/text/enscript/default.nix
@@ -9,12 +9,20 @@ stdenv.mkDerivation rec {
     sha256 = "1fy0ymvzrrvs889zanxcaxjfcxarm2d3k43c9frmbl1ld7dblmkd";
   };
 
-  preBuild =
-    ''
-      # Fix building on Darwin with GCC.
-      substituteInPlace compat/regex.c --replace \
-         __private_extern__  '__attribute__ ((visibility ("hidden")))'
-    '';
+  patches = [
+    # fix compile failure on macos. use system getopt like linux
+    # requires that compat/getopt.h is also removed
+    # https://savannah.gnu.org/bugs/?64307
+    ./0001-use-system-getopt.patch
+  ];
+
+  postPatch = ''
+    # the delete component of 0001-use-system-getopt.patch
+    rm compat/getopt.h
+    # Fix building on Darwin with GCC.
+    substituteInPlace compat/regex.c --replace \
+       __private_extern__  '__attribute__ ((visibility ("hidden")))'
+  '';
 
   buildInputs = [ gettext ];
 
diff --git a/pkgs/tools/typesetting/tex/catdvi/default.nix b/pkgs/tools/typesetting/tex/catdvi/default.nix
index 924aa57ece99..1958a2f4c073 100644
--- a/pkgs/tools/typesetting/tex/catdvi/default.nix
+++ b/pkgs/tools/typesetting/tex/catdvi/default.nix
@@ -28,6 +28,11 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  # fix implicit-int compile error in test code used in configure script
+  postPatch = ''
+    sed -i 's/^main()/int main()/' configure
+  '';
+
   hardeningDisable = [ "format" ];
 
   outputs = [ "out" ] ++ lib.optional (with stdenv; buildPlatform.canExecute hostPlatform) "dev";
diff --git a/pkgs/tools/typesetting/typstfmt/Cargo.lock b/pkgs/tools/typesetting/typstfmt/Cargo.lock
index 8f560ac59e5d..ecfb8d4030f5 100644
--- a/pkgs/tools/typesetting/typstfmt/Cargo.lock
+++ b/pkgs/tools/typesetting/typstfmt/Cargo.lock
@@ -18,6 +18,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
+name = "bitflags"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
+
+[[package]]
 name = "bstr"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -30,9 +36,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c79ad7fb2dd38f3dabd76b09c6a5a20c038fc0213ef1e9afd30eb777f120f019"
+checksum = "542f33a8835a0884b006a0c3df3dadd99c0c3f296ed26c2fdc8028e01ad6230c"
 dependencies = [
  "memchr",
  "serde",
@@ -46,9 +52,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "comemo"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28a097f142aeb5b03af73595536cd55f5d649fca4d656379aac86b3af133cf92"
+checksum = "bf5705468fa80602ee6a5f9318306e6c428bffd53e43209a78bc05e6e667c6f4"
 dependencies = [
  "comemo-macros",
  "siphasher",
@@ -56,13 +62,13 @@ dependencies = [
 
 [[package]]
 name = "comemo-macros"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "168cc09917f6a014a4cf6ed166d1b541a20a768c60f9cc348f25203ee8312940"
+checksum = "54af6ac68ada2d161fa9cc1ab52676228e340866d094d6542107e74b82acc095"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
@@ -137,16 +143,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
 name = "getrandom"
-version = "0.2.10"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f"
 dependencies = [
  "cfg-if",
  "libc",
@@ -166,28 +166,28 @@ dependencies = [
 
 [[package]]
 name = "globset"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "759c97c1e17c55525b57192c06a267cda0ac5210b222d6b82189a2338fa1c13d"
+checksum = "57da3b9b5b85bd66f31093f8c408b90a74431672542466497dcbdfdc02034be1"
 dependencies = [
  "aho-corasick",
- "bstr 1.7.0",
- "fnv",
+ "bstr 1.8.0",
  "log",
- "regex",
+ "regex-automata 0.4.3",
+ "regex-syntax",
 ]
 
 [[package]]
 name = "hashbrown"
-version = "0.14.2"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f93e7192158dbcda357bdec5fb5788eebf8bbac027f3f33e719d29135ae84156"
+checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
 
 [[package]]
 name = "indexmap"
-version = "2.0.2"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8adf3ddd720272c6ea8bf59463c04e0f93d0bbf7c5439b691bca2987e0270897"
+checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
 dependencies = [
  "equivalent",
  "hashbrown",
@@ -229,9 +229,20 @@ checksum = "baff4b617f7df3d896f97fe922b64817f6cd9a756bb81d40f8883f2f66dcb401"
 
 [[package]]
 name = "libc"
-version = "0.2.149"
+version = "0.2.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
+checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
+
+[[package]]
+name = "libredox"
+version = "0.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85c833ca1e66078851dba29046874e38f08b2c883700aa29a03ddd3b23814ee8"
+dependencies = [
+ "bitflags 2.4.1",
+ "libc",
+ "redox_syscall",
+]
 
 [[package]]
 name = "linked-hash-map"
@@ -281,9 +292,9 @@ checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.69"
+version = "1.0.70"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
+checksum = "39278fbbf5fb4f646ce651690877f89d1c5811a3d4acb27700c1cb3cdb78fd3b"
 dependencies = [
  "unicode-ident",
 ]
@@ -299,21 +310,21 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.2.16"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
 ]
 
 [[package]]
 name = "redox_users"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
+checksum = "a18479200779601e498ada4e8c1e1f50e3ee19deb0259c25825a98b5603b2cb4"
 dependencies = [
  "getrandom",
- "redox_syscall",
+ "libredox",
  "thiserror",
 ]
 
@@ -363,29 +374,29 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.189"
+version = "1.0.193"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e422a44e74ad4001bdc8eede9a4570ab52f71190e9c076d14369f38b9200537"
+checksum = "25dd9975e68d0cb5aa1120c288333fc98731bd1dd12f561e468ea4728c042b89"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.189"
+version = "1.0.193"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e48d1f918009ce3145511378cf68d613e3b3d9137d67272562080d68a2b32d5"
+checksum = "43576ca501357b9b071ac53cdc7da8ef0cbd9493d8df094cd821777ea6e894d3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn",
 ]
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96426c9936fd7a0124915f9185ea1d20aa9445cc9821142f0a73bc9207a2e186"
+checksum = "12022b835073e5b11e90a14f86838ceb1c8fb0325b72416845c487ac0fa95e80"
 dependencies = [
  "serde",
 ]
@@ -421,32 +432,21 @@ dependencies = [
 
 [[package]]
 name = "siphasher"
-version = "0.3.11"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+checksum = "54ac45299ccbd390721be55b412d41931911f654fa99e2cb8bfb57184b2061fe"
 
 [[package]]
 name = "smallvec"
-version = "1.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
-
-[[package]]
-name = "syn"
-version = "1.0.109"
+version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
+checksum = "4dccd0940a2dcdf68d092b8cbab7dc0ad8fa938bf95787e1b916b0e3d0e8e970"
 
 [[package]]
 name = "syn"
-version = "2.0.38"
+version = "2.0.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
+checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -470,7 +470,7 @@ checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn",
 ]
 
 [[package]]
@@ -506,9 +506,9 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.3"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cda73e2f1397b1262d6dfdcef8aafae14d1de7748d66822d3bfeeb6d03e5e4b"
+checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
 dependencies = [
  "serde",
 ]
@@ -545,7 +545,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn",
 ]
 
 [[package]]
@@ -560,20 +560,20 @@ dependencies = [
 
 [[package]]
 name = "tracing-log"
-version = "0.1.3"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ddad33d2d10b1ed7eb9d1f518a5674713876e97e5bb9b7345a7984fbb4f922"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
 dependencies = [
- "lazy_static",
  "log",
+ "once_cell",
  "tracing-core",
 ]
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.17"
+version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30a651bc37f915e81f087d86e62a18eec5f79550c7faff886f7090b4ea757c77"
+checksum = "ad0f048c97dbd9faa9b7df56362b8ebcaa52adb06b498c050d2f4e32f90a7a8b"
 dependencies = [
  "nu-ansi-term",
  "sharded-slab",
@@ -601,7 +601,7 @@ dependencies = [
 
 [[package]]
 name = "typstfmt"
-version = "0.2.6"
+version = "0.2.7"
 dependencies = [
  "confy",
  "lexopt",
@@ -610,7 +610,7 @@ dependencies = [
 
 [[package]]
 name = "typstfmt_lib"
-version = "0.2.6"
+version = "0.2.7"
 dependencies = [
  "globmatch",
  "insta",
@@ -770,9 +770,9 @@ checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
 
 [[package]]
 name = "winnow"
-version = "0.5.17"
+version = "0.5.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3b801d0e0a6726477cc207f60162da452f3a95adb368399bef20a946e06f65c"
+checksum = "b7e87b8dfbe3baffbe687eef2e164e32286eff31a5ee16463ce03d991643ec94"
 dependencies = [
  "memchr",
 ]
diff --git a/pkgs/tools/typesetting/typstfmt/default.nix b/pkgs/tools/typesetting/typstfmt/default.nix
index cec70394e4f9..2305998e94a2 100644
--- a/pkgs/tools/typesetting/typstfmt/default.nix
+++ b/pkgs/tools/typesetting/typstfmt/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typstfmt";
-  version = "0.2.6";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "astrale-sharp";
     repo = "typstfmt";
     rev = version;
-    hash = "sha256-UUVbnxIj7kQVpZvSbbB11i6wAvdTnXVk5cNSNoGBeRM=";
+    hash = "sha256-LBYsTCjZ+U+lgd7Z3H1sBcWwseoHsuepPd66bWgfvhI=";
   };
 
   cargoLock = {
diff --git a/pkgs/tools/virtualization/distrobuilder/default.nix b/pkgs/tools/virtualization/distrobuilder/default.nix
index e6b867139165..da2f1a909156 100644
--- a/pkgs/tools/virtualization/distrobuilder/default.nix
+++ b/pkgs/tools/virtualization/distrobuilder/default.nix
@@ -60,7 +60,7 @@ buildGoModule rec {
     description = "System container image builder for LXC and LXD";
     homepage = "https://github.com/lxc/distrobuilder";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ megheaiulian adamcstephens ];
+    maintainers = lib.teams.lxc.members;
     platforms = lib.platforms.linux;
     mainProgram = "distrobuilder";
   };
diff --git a/pkgs/tools/virtualization/xe-guest-utilities/default.nix b/pkgs/tools/virtualization/xe-guest-utilities/default.nix
index e78b36c9f84f..cea1553e0bc6 100644
--- a/pkgs/tools/virtualization/xe-guest-utilities/default.nix
+++ b/pkgs/tools/virtualization/xe-guest-utilities/default.nix
@@ -6,16 +6,17 @@
 
 buildGoModule rec {
   pname = "xe-guest-utilities";
-  version = "7.30.0";
+  version = "8.3.1";
 
   src = fetchFromGitHub {
     owner = "xenserver";
     repo = "xe-guest-utilities";
     rev = "v${version}";
-    hash = "sha256-gMb8QIUg8t0SiTtUzqeh4XM5hHgCXuf5KlV3OeoU0LI=";
+    hash = "sha256-d0WdezcT44ExeHSnoJ3Dn0u/IRlhWreOZPSVw6Q1h/w=";
   };
 
-  vendorHash = "sha256-zhpDvo8iujE426/gxJY+Pqfv99vLNKHqyMQbbXIKodY=";
+  deleteVendor = true;
+  vendorHash = "sha256-X/BI+ZhoqCGCmJfccyEBVgZc70aRTp3rL5j+rBWG5fE=";
 
   postPatch = ''
     substituteInPlace mk/xen-vcpu-hotplug.rules \
diff --git a/pkgs/tools/wayland/mpvpaper/default.nix b/pkgs/tools/wayland/mpvpaper/default.nix
index 51edcc0ea3a2..91ec1e80267f 100644
--- a/pkgs/tools/wayland/mpvpaper/default.nix
+++ b/pkgs/tools/wayland/mpvpaper/default.nix
@@ -2,7 +2,6 @@
 , lib
 , meson
 , ninja
-, wlroots
 , wayland
 , wayland-protocols
 , wayland-scanner
@@ -17,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mpvpaper";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "GhostNaN";
     repo = pname;
     rev = version;
-    sha256 = "sha256-0LjIwOY2hBUb0nziD3HLP2Ek5+8v3ntssRFD9eQgWkc=";
+    sha256 = "sha256-pJPoI47KKazVT6RfqyftZe+lPe6Kn2cllRSfq0twUpQ=";
   };
 
   strictDeps = true;
@@ -37,7 +36,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    wlroots
     wayland
     wayland-protocols
     egl-wayland
diff --git a/pkgs/tools/wayland/swaysome/default.nix b/pkgs/tools/wayland/swaysome/default.nix
index 4acf4115a048..308592e450f9 100644
--- a/pkgs/tools/wayland/swaysome/default.nix
+++ b/pkgs/tools/wayland/swaysome/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swaysome";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitLab {
     owner = "hyask";
     repo = pname;
     rev = version;
-    sha256 = "sha256-KmGAp0EPnnM+hPRpUGsbt+NU2v5mcPaRUqo0pqUr1L8=";
+    sha256 = "sha256-U5W/9VL1t1/R4ADPxseBV6CMKx04I4vbp7sFmSqRZXk=";
   };
 
-  cargoHash = "sha256-9sOR99CaTyMQoGMKP2Cag6YNxmgEqNPE/kiJPziqB9U=";
+  cargoHash = "sha256-QA3EQsYgjwx8QX50yaxiJyAPDlpYYqiqLiXco1kJmw0=";
 
   meta = with lib; {
     description = "Helper to make sway behave more like awesomewm";
diff --git a/pkgs/tools/wayland/wob/default.nix b/pkgs/tools/wayland/wob/default.nix
index 67f7904192f9..3dc21b64fb11 100644
--- a/pkgs/tools/wayland/wob/default.nix
+++ b/pkgs/tools/wayland/wob/default.nix
@@ -5,6 +5,7 @@
 , meson
 , ninja
 , pkg-config
+, cmocka
 , scdoc
 , wayland-scanner
 , wayland
@@ -14,20 +15,20 @@
 
 stdenv.mkDerivation rec {
   pname = "wob";
-  version = "0.14.2";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "francma";
     repo = pname;
     rev = version;
-    sha256 = "sha256-u4jLVLGcMTgDEgN8jW5d59m3GorJX7Z6+qKhzvbON3k=";
+    sha256 = "sha256-9LFAEo17w861ldMJU+t1oLAKoM6gJc4Em4tSwQDXbKU=";
   };
 
   strictDeps = true;
   depsBuildBuild = [
     pkg-config
   ];
-  nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-scanner ];
+  nativeBuildInputs = [ meson ninja pkg-config cmocka scdoc wayland-scanner ];
   buildInputs = [ inih wayland wayland-protocols ]
     ++ lib.optional stdenv.isLinux libseccomp;