Merge master into staging-next

38 files changed, 617 insertions, 255 deletions

diff --git a/pkgs/README.md b/pkgs/README.md
index 5563936dc9d7..837a99f07e7f 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -416,7 +416,6 @@ In the file `pkgs/top-level/all-packages.nix` you can find fetch helpers, these
 
   ```nix
   src = fetchgit {
-    url = "git@github.com:NixOS/nix.git"
     url = "git://github.com/NixOS/nix.git";
     rev = "1f795f9f44607cc5bec70d1300150bfefcef2aae";
     hash = "sha256-7D4m+saJjbSFP5hOwpQq2FGR2rr+psQMTcyb1ZvtXsQ=";
diff --git a/pkgs/applications/audio/amberol/default.nix b/pkgs/applications/audio/amberol/default.nix
index f29ca37341b9..6d6946a24167 100644
--- a/pkgs/applications/audio/amberol/default.nix
+++ b/pkgs/applications/audio/amberol/default.nix
@@ -74,5 +74,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ linsui ];
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
+    mainProgram = "amberol";
   };
 }
diff --git a/pkgs/applications/display-managers/emptty/default.nix b/pkgs/applications/display-managers/emptty/default.nix
index 6e9ed91dec21..2e4650f563ba 100644
--- a/pkgs/applications/display-managers/emptty/default.nix
+++ b/pkgs/applications/display-managers/emptty/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "emptty";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "tvrzna";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-nReExxLbqlbzx1F1vk8qftWafG8umH988egsalSUals=";
+    hash = "sha256-64Ta0k4TzJcQC+RDybHzFUj96ZSRUOeYQ2U9KFjDXjk=";
   };
 
   buildInputs = [ pam libX11 ];
diff --git a/pkgs/applications/misc/dialect/default.nix b/pkgs/applications/misc/dialect/default.nix
index 519f12490f18..8acaca4e26fc 100644
--- a/pkgs/applications/misc/dialect/default.nix
+++ b/pkgs/applications/misc/dialect/default.nix
@@ -77,5 +77,6 @@ python3.pkgs.buildPythonApplication rec {
     maintainers = with maintainers; [ linsui ];
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
+    mainProgram = "dialect";
   };
 }
diff --git a/pkgs/applications/misc/wike/default.nix b/pkgs/applications/misc/wike/default.nix
index 03fe5587e505..c1d3dc2f10f2 100644
--- a/pkgs/applications/misc/wike/default.nix
+++ b/pkgs/applications/misc/wike/default.nix
@@ -70,5 +70,6 @@ python3.pkgs.buildPythonApplication rec {
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ samalws ];
+    mainProgram = "wike";
   };
 }
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index dc1929b9fd1c..145dbd1e2ca4 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -93,11 +93,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.63.162";
+  version = "1.63.165";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    hash = "sha256-kRIYdSBAjBVX3EZQv0OWifD+XIpGAqAVTcrdxGAifEI=";
+    hash = "sha256-UyzOV6sUv7WdwN31TIg35HGchrUSXnvzk3Aba/d8dJc=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/p2p/fragments/default.nix b/pkgs/applications/networking/p2p/fragments/default.nix
index 5034f401a98d..edb31ba66957 100644
--- a/pkgs/applications/networking/p2p/fragments/default.nix
+++ b/pkgs/applications/networking/p2p/fragments/default.nix
@@ -83,5 +83,6 @@ in stdenv.mkDerivation rec {
     maintainers = with maintainers; [ emilytrau ];
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
+    mainProgram = "fragments";
   };
 }
diff --git a/pkgs/applications/networking/p2p/transgui/default.nix b/pkgs/applications/networking/p2p/transgui/default.nix
index 4f3f711d1f2c..707ff45b3498 100644
--- a/pkgs/applications/networking/p2p/transgui/default.nix
+++ b/pkgs/applications/networking/p2p/transgui/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "transgui";
-  version = "unstable-2023-10-19";
+  version = "unstable-2024-02-26";
 
   src = fetchFromGitHub {
     owner = "transmission-remote-gui";
     repo = "transgui";
-    rev = "b1f5c2334edb6659c04863ef4a534ba1e57284f0";
-    hash = "sha256-XCokcA5lINC9B+qwg0vjkymwa16ZNHRKLI829+X7CvE=";
+    rev = "25df397d92fbd53b970ef72a6ffd9f644458f935";
+    hash = "sha256-jQIe2vTDeJM/lhl6alNhEPOqXjyd18x+Kg29+le/dks=";
   };
 
   nativeBuildInputs = [ pkg-config unzip ];
diff --git a/pkgs/build-support/writers/scripts.nix b/pkgs/build-support/writers/scripts.nix
index 8a23e5dd4a66..edc7ede4d5bd 100644
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@@ -1,4 +1,14 @@
-{ pkgs, buildPackages, lib, stdenv, libiconv, mkNugetDeps, mkNugetSource, gixy }:
+{
+  buildPackages,
+  gixy,
+  lib,
+  libiconv,
+  makeBinaryWrapper,
+  mkNugetDeps,
+  mkNugetSource,
+  pkgs,
+  stdenv,
+}:
 let
   inherit (lib)
     concatMapStringsSep
@@ -6,7 +16,6 @@ let
     escapeShellArg
     last
     optionalString
-    stringLength
     strings
     types
     ;
@@ -18,137 +27,285 @@ rec {
   # Examples:
   #   writeBash = makeScriptWriter { interpreter = "${pkgs.bash}/bin/bash"; }
   #   makeScriptWriter { interpreter = "${pkgs.dash}/bin/dash"; } "hello" "echo hello world"
-  makeScriptWriter = { interpreter, check ? "" }: nameOrPath: content:
+  makeScriptWriter = { interpreter, check ? "", makeWrapperArgs ? [], }: nameOrPath: content:
     assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
     assert lib.or (types.path.check content) (types.str.check content);
     let
+      nameIsPath = types.path.check nameOrPath;
       name = last (builtins.split "/" nameOrPath);
-    in
+      path = if nameIsPath then nameOrPath else "/bin/${name}";
+      # The inner derivation which creates the executable under $out/bin (never at $out directly)
+      # This is required in order to support wrapping, as wrapped programs consist of at least two files: the executable and the wrapper.
+      inner =
+        pkgs.runCommandLocal name (
+          {
+            inherit makeWrapperArgs;
+            nativeBuildInputs = [
+              makeBinaryWrapper
+            ];
+            meta.mainProgram = name;
+          }
+          // (
+            if (types.str.check content) then {
+              inherit content interpreter;
+              passAsFile = [ "content" ];
+            } else {
+              inherit interpreter;
+              contentPath = content;
+            }
+          )
+        )
+        ''
+          # On darwin a script cannot be used as an interpreter in a shebang but
+          # there doesn't seem to be a limit to the size of shebang and multiple
+          # arguments to the interpreter are allowed.
+          if [[ -n "${toString pkgs.stdenvNoCC.isDarwin}" ]] && isScript $interpreter
+          then
+            wrapperInterpreterLine=$(head -1 "$interpreter" | tail -c+3)
+            # Get first word from the line (note: xargs echo remove leading spaces)
+            wrapperInterpreter=$(echo "$wrapperInterpreterLine" | xargs echo | cut -d " " -f1)
+
+            if isScript $wrapperInterpreter
+            then
+              echo "error: passed interpreter ($interpreter) is a script which has another script ($wrapperInterpreter) as an interpreter, which is not supported."
+              exit 1
+            fi
+
+            # This should work as long as wrapperInterpreter is a shell, which is
+            # the case for programs wrapped with makeWrapper, like
+            # python3.withPackages etc.
+            interpreterLine="$wrapperInterpreterLine $interpreter"
+          else
+            interpreterLine=$interpreter
+          fi
+
+          echo "#! $interpreterLine" > $out
+          cat "$contentPath" >> $out
+          ${optionalString (check != "") ''
+            ${check} $out
+          ''}
+          chmod +x $out
+
+          # Relocate executable
+          # Wrap it if makeWrapperArgs are specified
+          mv $out tmp
+            mkdir -p $out/$(dirname "${path}")
+            mv tmp $out/${path}
+          if [ -n "''${makeWrapperArgs+''${makeWrapperArgs[@]}}" ]; then
+              wrapProgram $out/${path} ''${makeWrapperArgs[@]}
+          fi
+        '';
+      in
+        if nameIsPath
+        then inner
+        # In case nameOrPath is a name, the user intends the executable to be located at $out.
+        # This is achieved by creating a separate derivation containing a symlink at $out linking to ${inner}/bin/${name}.
+        # This breaks the override pattern.
+        # In case this turns out to be a problem, we can still add more magic
+        else pkgs.runCommandLocal name {} ''
+          ln -s ${inner}/bin/${name} $out
+        '';
 
-    pkgs.runCommandLocal name (
-      lib.optionalAttrs (nameOrPath == "/bin/${name}") {
-        meta.mainProgram = name;
-      }
-      // (
-        if (types.str.check content) then {
-          inherit content interpreter;
-          passAsFile = [ "content" ];
-        } else {
-          inherit interpreter;
-          contentPath = content;
-        }
-      )
-    )
-    ''
-      # On darwin a script cannot be used as an interpreter in a shebang but
-      # there doesn't seem to be a limit to the size of shebang and multiple
-      # arguments to the interpreter are allowed.
-      if [[ -n "${toString pkgs.stdenvNoCC.isDarwin}" ]] && isScript $interpreter
-      then
-        wrapperInterpreterLine=$(head -1 "$interpreter" | tail -c+3)
-        # Get first word from the line (note: xargs echo remove leading spaces)
-        wrapperInterpreter=$(echo "$wrapperInterpreterLine" | xargs echo | cut -d " " -f1)
-
-        if isScript $wrapperInterpreter
-        then
-          echo "error: passed interpreter ($interpreter) is a script which has another script ($wrapperInterpreter) as an interpreter, which is not supported."
-          exit 1
-        fi
-
-        # This should work as long as wrapperInterpreter is a shell, which is
-        # the case for programs wrapped with makeWrapper, like
-        # python3.withPackages etc.
-        interpreterLine="$wrapperInterpreterLine $interpreter"
-      else
-        interpreterLine=$interpreter
-      fi
-
-      echo "#! $interpreterLine" > $out
-      cat "$contentPath" >> $out
-      ${optionalString (check != "") ''
-        ${check} $out
-      ''}
-      chmod +x $out
-      ${optionalString (types.path.check nameOrPath) ''
-        mv $out tmp
-        mkdir -p $out/$(dirname "${nameOrPath}")
-        mv tmp $out/${nameOrPath}
-      ''}
-    '';
 
   # Base implementation for compiled executables.
   # Takes a compile script, which in turn takes the name as an argument.
   #
   # Examples:
   #   writeSimpleC = makeBinWriter { compileScript = name: "gcc -o $out $contentPath"; }
-  makeBinWriter = { compileScript, strip ? true }: nameOrPath: content:
+  makeBinWriter = { compileScript, strip ? true, makeWrapperArgs ? [] }: nameOrPath: content:
     assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
     assert lib.or (types.path.check content) (types.str.check content);
     let
+      nameIsPath = types.path.check nameOrPath;
       name = last (builtins.split "/" nameOrPath);
+      path = if nameIsPath then nameOrPath else "/bin/${name}";
+      # The inner derivation which creates the executable under $out/bin (never at $out directly)
+      # This is required in order to support wrapping, as wrapped programs consist of at least two files: the executable and the wrapper.
+      inner =
+        pkgs.runCommandLocal name (
+          {
+            inherit makeWrapperArgs;
+            nativeBuildInputs = [
+              makeBinaryWrapper
+            ];
+            meta.mainProgram = name;
+          }
+          // (
+            if (types.str.check content) then {
+            inherit content;
+            passAsFile = [ "content" ];
+          } else {
+            contentPath = content;
+                  }
+          )
+        )
+        ''
+          ${compileScript}
+          ${lib.optionalString strip
+              "${lib.getBin buildPackages.bintools-unwrapped}/bin/${buildPackages.bintools-unwrapped.targetPrefix}strip -S $out"}
+          # Sometimes binaries produced for darwin (e. g. by GHC) won't be valid
+          # mach-o executables from the get-go, but need to be corrected somehow
+          # which is done by fixupPhase.
+          ${lib.optionalString pkgs.stdenvNoCC.hostPlatform.isDarwin "fixupPhase"}
+          mv $out tmp
+          mkdir -p $out/$(dirname "${path}")
+          mv tmp $out/${path}
+          if [ -n "''${makeWrapperArgs+''${makeWrapperArgs[@]}}" ]; then
+            wrapProgram $out/${path} ''${makeWrapperArgs[@]}
+          fi
+        '';
     in
-    pkgs.runCommand name ((if (types.str.check content) then {
-      inherit content;
-      passAsFile = [ "content" ];
-    } else {
-      contentPath = content;
-    }) // lib.optionalAttrs (nameOrPath == "/bin/${name}") {
-      meta.mainProgram = name;
-    }) ''
-      ${compileScript}
-      ${lib.optionalString strip
-          "${lib.getBin buildPackages.bintools-unwrapped}/bin/${buildPackages.bintools-unwrapped.targetPrefix}strip -S $out"}
-      # Sometimes binaries produced for darwin (e. g. by GHC) won't be valid
-      # mach-o executables from the get-go, but need to be corrected somehow
-      # which is done by fixupPhase.
-      ${lib.optionalString pkgs.stdenvNoCC.hostPlatform.isDarwin "fixupPhase"}
-      ${optionalString (types.path.check nameOrPath) ''
-        mv $out tmp
-        mkdir -p $out/$(dirname "${nameOrPath}")
-        mv tmp $out/${nameOrPath}
-      ''}
-    '';
+      if nameIsPath
+      then inner
+      # In case nameOrPath is a name, the user intends the executable to be located at $out.
+      # This is achieved by creating a separate derivation containing a symlink at $out linking to ${inner}/bin/${name}.
+      # This breaks the override pattern.
+      # In case this turns out to be a problem, we can still add more magic
+      else pkgs.runCommandLocal name {} ''
+        ln -s ${inner}/bin/${name} $out
+      '';
 
   # Like writeScript but the first line is a shebang to bash
   #
-  # Example:
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
   #   writeBash "example" ''
   #     echo hello world
   #   ''
-  writeBash = makeScriptWriter {
-    interpreter = "${lib.getExe pkgs.bash}";
-  };
+  #
+  # Example with arguments:
+  #   writeBash "example"
+  #     {
+  #       makeWrapperArgs = [
+  #         "--prefix" "PATH" ":" "${pkgs.hello}/bin"
+  #       ];
+  #     }
+  #     ''
+  #       hello
+  #     ''
+  writeBash = name: argsOrScript:
+    if lib.isAttrs argsOrScript && ! lib.isDerivation argsOrScript
+    then makeScriptWriter (argsOrScript // { interpreter = "${lib.getExe pkgs.bash}"; }) name
+    else makeScriptWriter { interpreter = "${lib.getExe pkgs.bash}"; } name argsOrScript;
 
   # Like writeScriptBin but the first line is a shebang to bash
+  #
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
+  #   writeBashBin "example" ''
+  #     echo hello world
+  #   ''
+  #
+  # Example with arguments:
+  #  writeBashBin "example"
+  #    {
+  #      makeWrapperArgs = [
+  #        "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #      ];
+  #    }
+  #    ''
+  #      hello
+  #    ''
   writeBashBin = name:
     writeBash "/bin/${name}";
 
   # Like writeScript but the first line is a shebang to dash
   #
-  # Example:
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
   #   writeDash "example" ''
   #     echo hello world
   #   ''
-  writeDash = makeScriptWriter {
-    interpreter = "${lib.getExe pkgs.dash}";
-  };
+  #
+  # Example with arguments:
+  #   writeDash "example"
+  #     {
+  #       makeWrapperArgs = [
+  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #       ];
+  #     }
+  #     ''
+  #       hello
+  #     ''
+  writeDash = name: argsOrScript:
+    if lib.isAttrs argsOrScript && ! lib.isDerivation argsOrScript
+    then makeScriptWriter (argsOrScript // { interpreter = "${lib.getExe pkgs.dash}"; }) name
+    else makeScriptWriter { interpreter = "${lib.getExe pkgs.dash}"; } name argsOrScript;
 
   # Like writeScriptBin but the first line is a shebang to dash
+  #
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
+  #   writeDashBin "example" ''
+  #     echo hello world
+  #   ''
+  #
+  # Example with arguments:
+  #  writeDashBin "example"
+  #    {
+  #      makeWrapperArgs = [
+  #        "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #      ];
+  #    }
+  #    ''
+  #      hello
+  #    ''
   writeDashBin = name:
     writeDash "/bin/${name}";
 
   # Like writeScript but the first line is a shebang to fish
   #
-  # Example:
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
   #   writeFish "example" ''
   #     echo hello world
   #   ''
-  writeFish = makeScriptWriter {
-    interpreter = "${lib.getExe pkgs.fish} --no-config";
-    check = "${lib.getExe pkgs.fish} --no-config --no-execute";  # syntax check only
-  };
+  #
+  # Example with arguments:
+  #   writeFish "example"
+  #     {
+  #       makeWrapperArgs = [
+  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #       ];
+  #     }
+  #     ''
+  #       hello
+  #     ''
+  writeFish = name: argsOrScript:
+    if lib.isAttrs argsOrScript && ! lib.isDerivation argsOrScript
+    then makeScriptWriter (argsOrScript // {
+      interpreter = "${lib.getExe pkgs.fish} --no-config";
+      check = "${lib.getExe pkgs.fish} --no-config --no-execute";  # syntax check only
+    }) name
+    else makeScriptWriter {
+      interpreter = "${lib.getExe pkgs.fish} --no-config";
+      check = "${lib.getExe pkgs.fish} --no-config --no-execute";  # syntax check only
+    } name argsOrScript;
 
   # Like writeScriptBin but the first line is a shebang to fish
+  #
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
+  #   writeFishBin "example" ''
+  #     echo hello world
+  #   ''
+  #
+  # Example with arguments:
+  #   writeFishBin "example"
+  #     {
+  #       makeWrapperArgs = [
+  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #       ];
+  #     }
+  #     ''
+  #       hello
+  #     ''
   writeFishBin = name:
     writeFish "/bin/${name}";
 
@@ -162,11 +319,12 @@ rec {
   #     main = launchMissiles
   #   '';
   writeHaskell = name: {
-    libraries ? [],
     ghc ? pkgs.ghc,
     ghcArgs ? [],
+    libraries ? [],
+    makeWrapperArgs ? [],
+    strip ? true,
     threadedRuntime ? true,
-    strip ? true
   }:
     let
       appendIfNotSet = el: list: if elem el list then list else list ++ [ el ];
@@ -178,7 +336,7 @@ rec {
         ${(ghc.withPackages (_: libraries ))}/bin/ghc ${lib.escapeShellArgs ghcArgs'} tmp.hs
         mv tmp $out
       '';
-      inherit strip;
+      inherit makeWrapperArgs strip;
     } name;
 
   # writeHaskellBin takes the same arguments as writeHaskell but outputs a directory (like writeScriptBin)
@@ -187,36 +345,72 @@ rec {
 
   # Like writeScript but the first line is a shebang to nu
   #
-  # Example:
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
   #   writeNu "example" ''
   #     echo hello world
   #   ''
-  writeNu = makeScriptWriter {
-    interpreter = "${lib.getExe pkgs.nushell} --no-config-file";
-  };
+  #
+  # Example with arguments:
+  #   writeNu "example"
+  #     {
+  #       makeWrapperArgs = [
+  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #       ];
+  #     }
+  #     ''
+  #       hello
+  #     ''
+  writeNu = name: argsOrScript:
+    if lib.isAttrs argsOrScript && ! lib.isDerivation argsOrScript
+    then makeScriptWriter (argsOrScript // { interpreter = "${lib.getExe pkgs.nushell} --no-config-file"; }) name
+    else makeScriptWriter { interpreter = "${lib.getExe pkgs.nushell} --no-config-file"; } name argsOrScript;
+
 
   # Like writeScriptBin but the first line is a shebang to nu
+  #
+  # Can be called with or without extra arguments.
+  #
+  # Example without arguments:
+  #   writeNuBin "example" ''
+  #     echo hello world
+  #   ''
+  #
+  # Example with arguments:
+  #   writeNuBin "example"
+  #     {
+  #       makeWrapperArgs = [
+  #         "--prefix", "PATH", ":", "${pkgs.hello}/bin",
+  #       ];
+  #     }
+  #    ''
+  #      hello
+  #    ''
   writeNuBin = name:
     writeNu "/bin/${name}";
 
   # makeRubyWriter takes ruby and compatible rubyPackages and produces ruby script writer,
   # If any libraries are specified, ruby.withPackages is used as interpreter, otherwise the "bare" ruby is used.
-  makeRubyWriter = ruby: rubyPackages: buildRubyPackages: name: { libraries ? [], }:
-  makeScriptWriter {
-    interpreter =
-      if libraries == []
-      then "${ruby}/bin/ruby"
-      else "${(ruby.withPackages (ps: libraries))}/bin/ruby";
-    # Rubocop doesnt seem to like running in this fashion.
-    #check = (writeDash "rubocop.sh" ''
-    #  exec ${lib.getExe buildRubyPackages.rubocop} "$1"
-    #'');
-  } name;
+  makeRubyWriter = ruby: rubyPackages: buildRubyPackages: name: { libraries ? [], ... } @ args:
+  makeScriptWriter (
+    (builtins.removeAttrs args ["libraries"])
+    // {
+      interpreter =
+        if libraries == []
+        then "${ruby}/bin/ruby"
+        else "${(ruby.withPackages (ps: libraries))}/bin/ruby";
+      # Rubocop doesn't seem to like running in this fashion.
+      #check = (writeDash "rubocop.sh" ''
+      #  exec ${lib.getExe buildRubyPackages.rubocop} "$1"
+      #'');
+    }
+  ) name;
 
   # Like writeScript but the first line is a shebang to ruby
   #
   # Example:
-  #   writeRuby "example" ''
+  #   writeRuby "example" { libraries = [ pkgs.rubyPackages.git ]; } ''
   #    puts "hello world"
   #   ''
   writeRuby = makeRubyWriter pkgs.ruby pkgs.rubyPackages buildPackages.rubyPackages;
@@ -227,17 +421,20 @@ rec {
   # makeLuaWriter takes lua and compatible luaPackages and produces lua script writer,
   # which validates the script with luacheck at build time. If any libraries are specified,
   # lua.withPackages is used as interpreter, otherwise the "bare" lua is used.
-  makeLuaWriter = lua: luaPackages: buildLuaPackages: name: { libraries ? [], }:
-  makeScriptWriter {
-    interpreter = lua.interpreter;
-      # if libraries == []
-      # then lua.interpreter
-      # else (lua.withPackages (ps: libraries)).interpreter
-      # This should support packages! I just cant figure out why some dependency collision happens whenever I try to run this.
-    check = (writeDash "luacheck.sh" ''
-      exec ${buildLuaPackages.luacheck}/bin/luacheck "$1"
-    '');
-  } name;
+  makeLuaWriter = lua: luaPackages: buildLuaPackages: name: { libraries ? [], ... } @ args:
+  makeScriptWriter (
+    (builtins.removeAttrs args ["libraries"])
+    // {
+      interpreter = lua.interpreter;
+        # if libraries == []
+        # then lua.interpreter
+        # else (lua.withPackages (ps: libraries)).interpreter
+        # This should support packages! I just cant figure out why some dependency collision happens whenever I try to run this.
+      check = (writeDash "luacheck.sh" ''
+        exec ${buildLuaPackages.luacheck}/bin/luacheck "$1"
+      '');
+    }
+   ) name;
 
   # writeLua takes a name an attributeset with libraries and some lua source code and
   # returns an executable (should also work with luajit)
@@ -265,9 +462,10 @@ rec {
     writeLua "/bin/${name}";
 
   writeRust = name: {
-      rustc ? pkgs.rustc,
-      rustcArgs ? [],
-      strip ? true
+    makeWrapperArgs ? [],
+    rustc ? pkgs.rustc,
+    rustcArgs ? [],
+    strip ? true,
   }:
   let
     darwinArgs = lib.optionals stdenv.isDarwin [ "-L${lib.getLib libiconv}/lib" ];
@@ -277,7 +475,7 @@ rec {
         cp "$contentPath" tmp.rs
         PATH=${lib.makeBinPath [pkgs.gcc]} ${rustc}/bin/rustc ${lib.escapeShellArgs rustcArgs} ${lib.escapeShellArgs darwinArgs} -o "$out" tmp.rs
       '';
-      inherit strip;
+      inherit makeWrapperArgs strip;
     } name;
 
   writeRustBin = name:
@@ -337,10 +535,13 @@ rec {
   #     use boolean;
   #     print "Howdy!\n" if true;
   #   ''
-  writePerl = name: { libraries ? [] }:
-    makeScriptWriter {
-      interpreter = "${lib.getExe (pkgs.perl.withPackages (p: libraries))}";
-    } name;
+  writePerl = name: { libraries ? [], ... } @ args:
+    makeScriptWriter (
+      (builtins.removeAttrs args ["libraries"])
+      // {
+        interpreter = "${lib.getExe (pkgs.perl.withPackages (p: libraries))}";
+      }
+    ) name;
 
   # writePerlBin takes the same arguments as writePerl but outputs a directory (like writeScriptBin)
   writePerlBin = name:
@@ -349,22 +550,27 @@ rec {
   # makePythonWriter takes python and compatible pythonPackages and produces python script writer,
   # which validates the script with flake8 at build time. If any libraries are specified,
   # python.withPackages is used as interpreter, otherwise the "bare" python is used.
-  makePythonWriter = python: pythonPackages: buildPythonPackages: name: { libraries ? [], flakeIgnore ? [] }:
+  makePythonWriter = python: pythonPackages: buildPythonPackages: name: { libraries ? [], flakeIgnore ? [], ... } @ args:
   let
     ignoreAttribute = optionalString (flakeIgnore != []) "--ignore ${concatMapStringsSep "," escapeShellArg flakeIgnore}";
   in
-  makeScriptWriter {
-    interpreter =
-      if pythonPackages != pkgs.pypy2Packages || pythonPackages != pkgs.pypy3Packages then
-        if libraries == []
-        then python.interpreter
-        else (python.withPackages (ps: libraries)).interpreter
-      else python.interpreter
-    ;
-    check = optionalString python.isPy3k (writeDash "pythoncheck.sh" ''
-      exec ${buildPythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
-    '');
-  } name;
+  makeScriptWriter
+    (
+      (builtins.removeAttrs args ["libraries" "flakeIgnore"])
+      // {
+        interpreter =
+          if pythonPackages != pkgs.pypy2Packages || pythonPackages != pkgs.pypy3Packages then
+            if libraries == []
+            then python.interpreter
+            else (python.withPackages (ps: libraries)).interpreter
+          else python.interpreter
+        ;
+        check = optionalString python.isPy3k (writeDash "pythoncheck.sh" ''
+          exec ${buildPythonPackages.flake8}/bin/flake8 --show-source ${ignoreAttribute} "$1"
+        '');
+      }
+    )
+    name;
 
   # writePyPy2 takes a name an attributeset with libraries and some pypy2 sourcecode and
   # returns an executable
@@ -421,7 +627,7 @@ rec {
     writePyPy3 "/bin/${name}";
 
 
-  makeFSharpWriter = { dotnet-sdk ? pkgs.dotnet-sdk, fsi-flags ? "", libraries ? _: [] }: nameOrPath:
+  makeFSharpWriter = { dotnet-sdk ? pkgs.dotnet-sdk, fsi-flags ? "", libraries ? _: [], ... } @ args: nameOrPath:
   let
     fname = last (builtins.split "/" nameOrPath);
     path = if strings.hasSuffix ".fsx" nameOrPath then nameOrPath else "${nameOrPath}.fsx";
@@ -442,9 +648,12 @@ rec {
       ${lib.getExe dotnet-sdk} fsi --quiet --nologo --readline- ${fsi-flags} "$@" < "$script"
     '';
 
-  in content: makeScriptWriter {
-    interpreter = fsi;
-  } path
+  in content: makeScriptWriter (
+    (builtins.removeAttrs args ["dotnet-sdk" "fsi-flags" "libraries"])
+    // {
+      interpreter = fsi;
+    }
+  ) path
   ''
     #i "nuget: ${nuget-source}/lib"
     ${ content }
@@ -456,5 +665,4 @@ rec {
 
   writeFSharpBin = name:
     writeFSharp "/bin/${name}";
-
 }
diff --git a/pkgs/build-support/writers/test.nix b/pkgs/build-support/writers/test.nix
index 982c550d28e0..df0eb340d9ae 100644
--- a/pkgs/build-support/writers/test.nix
+++ b/pkgs/build-support/writers/test.nix
@@ -1,13 +1,8 @@
-{ glib
-, haskellPackages
+{ haskellPackages
 , lib
 , nodePackages
 , perlPackages
-, pypy2Packages
 , python3Packages
-, pypy3Packages
-, luaPackages
-, rubyPackages
 , runCommand
 , testers
 , writers
@@ -310,4 +305,85 @@ lib.recurseIntoAttrs {
       expected = "hello: world\n";
     };
   };
+
+  wrapping = lib.recurseIntoAttrs {
+    bash-bin = expectSuccessBin (
+      writeBashBin "test-writers-wrapping-bash-bin"
+        {
+          makeWrapperArgs = [
+            "--set"
+            "ThaigerSprint"
+            "Thailand"
+          ];
+        }
+        ''
+          if [[ "$ThaigerSprint" == "Thailand" ]]; then
+            echo "success"
+          fi
+        ''
+    );
+
+    bash = expectSuccess (
+      writeBash "test-writers-wrapping-bash"
+        {
+          makeWrapperArgs = [
+            "--set"
+            "ThaigerSprint"
+            "Thailand"
+          ];
+        }
+        ''
+          if [[ "$ThaigerSprint" == "Thailand" ]]; then
+            echo "success"
+          fi
+        ''
+    );
+
+    python = expectSuccess (
+      writePython3 "test-writers-wrapping-python"
+        {
+          makeWrapperArgs = [
+            "--set"
+            "ThaigerSprint"
+            "Thailand"
+          ];
+        }
+        ''
+          import os
+
+          if os.environ.get("ThaigerSprint") == "Thailand":
+              print("success")
+        ''
+    );
+
+    rust = expectSuccess (
+      writeRust "test-writers-wrapping-rust"
+        {
+          makeWrapperArgs = [
+            "--set"
+            "ThaigerSprint"
+            "Thailand"
+          ];
+        }
+        ''
+          fn main(){
+            if std::env::var("ThaigerSprint").unwrap() == "Thailand" {
+              println!("success")
+            }
+          }
+        ''
+    );
+
+    no-empty-wrapper = let
+      bin = writeBashBin "bin" { makeWrapperArgs = []; } ''true'';
+    in runCommand "run-test-writers-wrapping-no-empty-wrapper" {} ''
+      ls -A ${bin}/bin
+      if [ $(ls -A ${bin}/bin | wc -l) -eq 1 ]; then
+        touch $out
+      else
+        echo "Error: Empty wrapper was created" >&2
+        exit 1
+      fi
+    '';
+  };
 }
diff --git a/pkgs/by-name/fe/feather/package.nix b/pkgs/by-name/fe/feather/package.nix
index adb6e2ffe35f..67b0770d65c7 100644
--- a/pkgs/by-name/fe/feather/package.nix
+++ b/pkgs/by-name/fe/feather/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "feather";
-  version = "2.6.2";
+  version = "2.6.3";
 
   src = fetchFromGitHub {
     owner = "feather-wallet";
     repo = "feather";
     rev = finalAttrs.version;
-    hash = "sha256-23rG+12pAw33rm+jDu9pp8TsumNYh+UbnbeEKs4yB+M=";
+    hash = "sha256-pQnaJbKznK1i8wn7t8ZnxLVu1LV/D47krxZZ0j6Mw6g=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/gx/gxml/package.nix b/pkgs/by-name/gx/gxml/package.nix
new file mode 100644
index 000000000000..7ff34db4327d
--- /dev/null
+++ b/pkgs/by-name/gx/gxml/package.nix
@@ -0,0 +1,60 @@
+{ stdenv
+, lib
+, fetchFromGitLab
+, gobject-introspection
+, meson
+, ninja
+, pkg-config
+, vala
+, glib
+, libgee
+, libxml2
+, gitUpdater
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gxml";
+  version = "0.20.3";
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "gxml";
+    rev = finalAttrs.version;
+    hash = "sha256-GlctGxsLyQ2kPV3oBmusRiouG4PPncBTh3vgxhVaQOo=";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    meson
+    ninja
+    pkg-config
+    vala
+  ];
+
+  propagatedBuildInputs = [
+    glib
+    libgee
+    libxml2
+  ];
+
+  postPatch = ''
+    # https://gitlab.gnome.org/GNOME/gxml/-/merge_requests/24
+    substituteInPlace gxml/gxml.pc.in \
+      --replace-fail "includedir=@prefix@/include" "includedir=${placeholder "dev"}/include"
+  '';
+
+  doCheck = true;
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = with lib; {
+    description = "GXml provides a GObject API for manipulating XML and a Serializable framework from GObject to XML";
+    homepage = "https://gitlab.gnome.org/GNOME/gxml";
+    license = licenses.lgpl21Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jmarmstrong1207 ] ++ teams.gnome.members;
+  };
+})
diff --git a/pkgs/by-name/ne/netclient/package.nix b/pkgs/by-name/ne/netclient/package.nix
index 1fe94d97762f..2a914d03ca8e 100644
--- a/pkgs/by-name/ne/netclient/package.nix
+++ b/pkgs/by-name/ne/netclient/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "netclient";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "gravitl";
     repo = "netclient";
     rev = "v${version}";
-    hash = "sha256-7raWk4Y/ZrSaGKPLrrnD49aDALkZ+Nxycd+px8Eks10=";
+    hash = "sha256-Wglh6tcpanEmXwoRKdAot/l4RS+EbIIHI1etQ9ic7BI=";
   };
 
-  vendorHash = "sha256-lRXZ9iSWQEKWmeQV1ei/G4+HvqhW9U8yUv1Qb/d2jvY=";
+  vendorHash = "sha256-or/0z+RiOkZ2qgEqXNI/LafN+eWAzvLuSZta/QNUI3g=";
 
   buildInputs = lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Cocoa
     ++ lib.optional stdenv.isLinux libX11;
diff --git a/pkgs/by-name/sp/spicetify-cli/package.nix b/pkgs/by-name/sp/spicetify-cli/package.nix
index b7dddb8ad7e7..7016a1a10610 100644
--- a/pkgs/by-name/sp/spicetify-cli/package.nix
+++ b/pkgs/by-name/sp/spicetify-cli/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.33.0";
+  version = "2.33.1";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "spicetify-cli";
     rev = "v${version}";
-    hash = "sha256-1bakWUhB47o37pV6cbfDRdHdqreGKFhU7LFajIM5mhw=";
+    hash = "sha256-nKbdwgxHiI1N2REEI7WrPf54uy4Nm1XU0g5hEjYriEY=";
   };
 
   vendorHash = "sha256-9rYShpUVI3KSY6UgGmoXo899NkUezkAAkTgFPdq094E=";
diff --git a/pkgs/development/interpreters/wasmer/default.nix b/pkgs/development/interpreters/wasmer/default.nix
index f5621cd57d18..0a5e888b06cd 100644
--- a/pkgs/development/interpreters/wasmer/default.nix
+++ b/pkgs/development/interpreters/wasmer/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmer";
-  version = "4.2.5";
+  version = "4.2.6";
 
   src = fetchFromGitHub {
     owner = "wasmerio";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-zCaN0F6a8qkZkOmHMU0D70KaY4H8pUXElJbyvOCjogc=";
+    hash = "sha256-FSplJAVdy/b0HXvW1qny052I7Fm9EA83/XqmgEvneeg=";
   };
 
-  cargoHash = "sha256-ugysqLQlnSzm0W4zW6LPSn6KjwpAtJZGEkzk/nWahWg=";
+  cargoHash = "sha256-OYHPudXGsDLVx6XKTsJTxqG5cbOAD25sd5KJDyU9lvY=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/development/python-modules/albumentations/default.nix b/pkgs/development/python-modules/albumentations/default.nix
index e2104641b78d..6c13bebebdfe 100644
--- a/pkgs/development/python-modules/albumentations/default.nix
+++ b/pkgs/development/python-modules/albumentations/default.nix
@@ -1,12 +1,14 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , numpy
 , opencv4
 , pyyaml
 , qudida
 , scikit-image
 , scipy
+, deepdiff
 , pytestCheckHook
 , pythonOlder
 , pythonRelaxDepsHook
@@ -14,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "albumentations";
-  version = "1.3.1";
-  format = "setuptools";
+  version = "1.4.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pqODiP5UbFaAcejIL0FEmOhsntA8CLWOeoizHPeiRMY=";
+    hash = "sha256-ZJ+KFIlveIs1bsxwCDxPuRvtq0/04rOa0heoJOGJ3tA=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +34,11 @@ buildPythonPackage rec {
     "opencv-python"
   ];
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     numpy
     opencv4
     pyyaml
@@ -42,6 +48,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    deepdiff
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix
index 9d3f55bec283..4ada8729cba2 100644
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "apprise";
-  version = "1.7.2";
+  version = "1.7.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-CeFZspAI5sjpPX/8PBXUGcC7rkFiBAX48tNDK3Ki6b8=";
+    hash = "sha256-MeKmOUB7uNJmJJ/Adf8xfp00/1lRxuFr/u/dwq9f6Ew=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/approvaltests/default.nix b/pkgs/development/python-modules/approvaltests/default.nix
index aba858a05dc4..6ea222752d11 100644
--- a/pkgs/development/python-modules/approvaltests/default.nix
+++ b/pkgs/development/python-modules/approvaltests/default.nix
@@ -15,11 +15,12 @@
 , pythonOlder
 , setuptools
 , testfixtures
+, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "approvaltests";
-  version = "11.0.0";
+  version = "11.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +29,7 @@ buildPythonPackage rec {
     owner = "approvals";
     repo = "ApprovalTests.Python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ep95niYin3urtiMFSVY792zpFAcu6MwQN9DA/IJLSQQ=";
+    hash = "sha256-F03qctswG0/y2ZCdHCacHsMiBZFTmEEegYXIIB2UPlc=";
   };
 
   nativeBuildInputs = [
@@ -45,6 +46,7 @@ buildPythonPackage rec {
     pyperclip
     pytest
     testfixtures
+    typing-extensions
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/certauth/default.nix b/pkgs/development/python-modules/certauth/default.nix
index 04a4637bafc9..c69eccf10cd6 100644
--- a/pkgs/development/python-modules/certauth/default.nix
+++ b/pkgs/development/python-modules/certauth/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , pyopenssl
 , tldextract
 , pytestCheckHook
@@ -10,7 +11,7 @@
 buildPythonPackage rec {
   pname = "certauth";
   version = "1.3.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -24,9 +25,13 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "--cov certauth " ""
+      --replace-fail "--cov certauth " ""
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     pyopenssl
     tldextract
@@ -41,6 +46,9 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
+    # https://github.com/ikreymer/certauth/issues/23
+    "test_ca_cert_in_mem"
+    "test_custom_not_before_not_after"
     # Tests want to download Public Suffix List
     "test_file_wildcard"
     "test_file_wildcard_subdomains"
diff --git a/pkgs/development/python-modules/clarabel/default.nix b/pkgs/development/python-modules/clarabel/default.nix
index c3e925323c71..9d196200f842 100644
--- a/pkgs/development/python-modules/clarabel/default.nix
+++ b/pkgs/development/python-modules/clarabel/default.nix
@@ -11,18 +11,18 @@
 
 buildPythonPackage rec {
   pname = "clarabel";
-  version = "0.7.0";
+  version = "0.7.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-udpW9SKAaoR/Ps4I9fIfq3UG7sMUiyJEYZDeUgbdHm8=";
+    hash = "sha256-owqxNfR1xbx4Mp/X31dSkRVeYFW8rwISTrYQuK0XY5Y=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-R/o12m2UqKte4H1pvW9DN0YPDhgNIxt0mXrfBDMzcwM=";
+    hash = "sha256-Tg9K66WIIAZyua8QlKrlUnpRJRmuxe7ihIr2Vqg79NQ=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/ibm-watson/default.nix b/pkgs/development/python-modules/ibm-watson/default.nix
index 522b7b13cc1c..c15ec2005a29 100644
--- a/pkgs/development/python-modules/ibm-watson/default.nix
+++ b/pkgs/development/python-modules/ibm-watson/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "ibm-watson";
-  version = "7.0.1";
+  version = "8.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "watson-developer-cloud";
     repo = "python-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-f/nf9WFiUNDQBkFNMV16EznCw0TN9L4fDIPQ/j4B1Sc=";
+    hash = "sha256-p2LyR7Fxd0Ny6QCypAWIusnINuhWAhWOnRfZ14FKvro=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ipyvue/default.nix b/pkgs/development/python-modules/ipyvue/default.nix
index 2507e7e5fc58..c2211226f078 100644
--- a/pkgs/development/python-modules/ipyvue/default.nix
+++ b/pkgs/development/python-modules/ipyvue/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "ipyvue";
-  version = "1.10.1";
+  version = "1.10.2";
   format = "setuptools";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IGFc6GulFs8Leq2EzGB+TiyRBCMulUzQ7MvzNTCl4dQ=";
+    hash = "sha256-qZc1hvouKWUQ2aJLk1oiokUKzKBXtd6fC6tm7LHDOrQ=";
   };
 
   propagatedBuildInputs = [ ipywidgets ];
diff --git a/pkgs/development/python-modules/mrjob/default.nix b/pkgs/development/python-modules/mrjob/default.nix
index 97cd5fd78e85..0a28d82f74ad 100644
--- a/pkgs/development/python-modules/mrjob/default.nix
+++ b/pkgs/development/python-modules/mrjob/default.nix
@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, pythonAtLeast
 , fetchFromGitHub
 
 # propagates
@@ -25,7 +26,9 @@
 buildPythonPackage rec {
   pname = "mrjob";
   version = "0.7.4";
-  format = "setuptools";
+
+  # https://github.com/Yelp/mrjob/issues/2222
+  disabled = pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "Yelp";
diff --git a/pkgs/development/python-modules/numpyro/default.nix b/pkgs/development/python-modules/numpyro/default.nix
index 90c0db931e4c..a38b43b2d8f9 100644
--- a/pkgs/development/python-modules/numpyro/default.nix
+++ b/pkgs/development/python-modules/numpyro/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "numpyro";
-  version = "0.13.2";
+  version = "0.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit version pname;
-    hash = "sha256-Um8LFVGAlMeOaN9uMwycHJzqEnTaxp8FYXIk+m2VTug=";
+    hash = "sha256-PkPqqchDRz166TnBg+ENsU4ju0KwrR3pCuFaRRF23kg=";
   };
 
   propagatedBuildInputs = [
@@ -62,9 +62,6 @@ buildPythonPackage rec {
     "test_zero_inflated_logits_probs_agree"
     # NameError: unbound axis name: _provenance
     "test_model_transformation"
-    # Using deprecated (removed in jax==0.4.24) jax.core.safe_map
-    # https://github.com/pyro-ppl/numpyro/issues/1733
-    "test_beta_bernoulli"
   ];
 
   # TODO: remove when tensorflow-probability gets fixed.
diff --git a/pkgs/development/python-modules/requests-ratelimiter/default.nix b/pkgs/development/python-modules/requests-ratelimiter/default.nix
index dbd142e378bd..af5304341b28 100644
--- a/pkgs/development/python-modules/requests-ratelimiter/default.nix
+++ b/pkgs/development/python-modules/requests-ratelimiter/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "requests-ratelimiter";
-  version = "0.5.0";
+  version = "0.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "JWCook";
     repo = "requests-ratelimiter";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JdxyBLrxXXb2KJ89qWl7yXP0fIafgnAguPGsN5iit8Y=";
+    hash = "sha256-ctCD+vlV90KCO7DdPUZJipBC/lz6NXx0gYuHHrs22IY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/azure-static-sites-client/versions.json b/pkgs/development/tools/azure-static-sites-client/versions.json
index 535157f6a506..ba6a02a9fc1d 100644
--- a/pkgs/development/tools/azure-static-sites-client/versions.json
+++ b/pkgs/development/tools/azure-static-sites-client/versions.json
@@ -1,58 +1,58 @@
 [
   {
     "version": "latest",
-    "buildId": "1.0.025891",
-    "publishDate": "2024-02-02T19:23:37.1915908Z",
+    "buildId": "1.0.026164",
+    "publishDate": "2024-02-29T20:38:30.619614Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/linux/StaticSitesClient",
-        "sha": "798b4032d1b6cd3f7057a6b7510c502dd69fa8cb4d27d47433542e8e80e9f87c"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.026164/linux/StaticSitesClient",
+        "sha": "7b2d674a63fb0cb1ee39b84348260755c872a2922d03c0ee55eea1c8eb385524"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/windows/StaticSitesClient.exe",
-        "sha": "097f9633c12b55e85e4ea9c053576a94b4f5847ce3a5a7671112c881878cfc4b"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.026164/windows/StaticSitesClient.exe",
+        "sha": "57f8db0e48c772f4eadd9cbab1996354ecdf193f0d123df02dfa4a7eb6398a15"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/macOS/StaticSitesClient",
-        "sha": "142310370774f91526c5d08ebde2f0b224b4f7f88bb6e514d25c1ef6f04fd8c8"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.026164/macOS/StaticSitesClient",
+        "sha": "fd0e8fe34ba0776c1fc44a8e66017b3abe33b044f429a95e6863919e920bf555"
       }
     }
   },
   {
     "version": "stable",
-    "buildId": "1.0.025891",
-    "publishDate": "2024-02-02T19:23:37.1915908Z",
+    "buildId": "1.0.026164",
+    "publishDate": "2024-02-29T20:38:30.619614Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/linux/StaticSitesClient",
-        "sha": "798b4032d1b6cd3f7057a6b7510c502dd69fa8cb4d27d47433542e8e80e9f87c"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.026164/linux/StaticSitesClient",
+        "sha": "7b2d674a63fb0cb1ee39b84348260755c872a2922d03c0ee55eea1c8eb385524"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/windows/StaticSitesClient.exe",
-        "sha": "097f9633c12b55e85e4ea9c053576a94b4f5847ce3a5a7671112c881878cfc4b"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.026164/windows/StaticSitesClient.exe",
+        "sha": "57f8db0e48c772f4eadd9cbab1996354ecdf193f0d123df02dfa4a7eb6398a15"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/macOS/StaticSitesClient",
-        "sha": "142310370774f91526c5d08ebde2f0b224b4f7f88bb6e514d25c1ef6f04fd8c8"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.026164/macOS/StaticSitesClient",
+        "sha": "fd0e8fe34ba0776c1fc44a8e66017b3abe33b044f429a95e6863919e920bf555"
       }
     }
   },
   {
     "version": "backup",
-    "buildId": "1.0.025241",
-    "publishDate": "2023-11-30T02:51:40.8356813Z",
+    "buildId": "1.0.025891",
+    "publishDate": "2024-02-02T19:23:37.1915908Z",
     "files": {
       "linux-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/linux/StaticSitesClient",
-        "sha": "e4ccb44c516e03e6dcc2a26a35ffd4c84a61dfea581990dd5c0edb7c12662db0"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/linux/StaticSitesClient",
+        "sha": "798b4032d1b6cd3f7057a6b7510c502dd69fa8cb4d27d47433542e8e80e9f87c"
       },
       "win-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/windows/StaticSitesClient.exe",
-        "sha": "4146ac01a488910d6ea066e1c46505048b0c9af2e74ef273c4236b387796712d"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/windows/StaticSitesClient.exe",
+        "sha": "097f9633c12b55e85e4ea9c053576a94b4f5847ce3a5a7671112c881878cfc4b"
       },
       "osx-x64": {
-        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025241/macOS/StaticSitesClient",
-        "sha": "05b213d7861454368d2c9801b0ccc75cfd13cb48f8e121fffaa2ab7e9b5671cd"
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.025891/macOS/StaticSitesClient",
+        "sha": "142310370774f91526c5d08ebde2f0b224b4f7f88bb6e514d25c1ef6f04fd8c8"
       }
     }
   }
diff --git a/pkgs/development/tools/go-jet/default.nix b/pkgs/development/tools/go-jet/default.nix
index aea629bebefe..0f8fa8337b9e 100644
--- a/pkgs/development/tools/go-jet/default.nix
+++ b/pkgs/development/tools/go-jet/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-jet";
-  version = "2.10.1";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "jet";
     rev = "v${version}";
-    sha256 = "sha256-G/yKS4YFKOVkuoqT/Qh12ul43dKo4W23EIyCgmeaUoo=";
+    sha256 = "sha256-xtWDfBryNQp3MSp5EjsbyIdEx4+KoqBe3Q6MukuYVRE=";
   };
 
-  vendorHash = "sha256-AwrtLTzKqKjFf5fV3JWYWyaqzHJjMNrYuSXhHXyV5HE=";
+  vendorHash = "sha256-z0NMG+fvbGe3KGxO9+3NLoptZ4wfWi0ls7SK+9miCWg=";
 
   subPackages = [ "cmd/jet" ];
 
diff --git a/pkgs/games/vassal/default.nix b/pkgs/games/vassal/default.nix
index 8395c4ac5fff..216fda688284 100644
--- a/pkgs/games/vassal/default.nix
+++ b/pkgs/games/vassal/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "VASSAL";
-  version = "3.7.8";
+  version = "3.7.9";
 
   src = fetchzip {
     url = "https://github.com/vassalengine/vassal/releases/download/${version}/${pname}-${version}-linux.tar.bz2";
-    sha256 = "sha256-KZIfgCOZbirstKotQhfcNvJdf3wP1L1o9Wt33ddFrfM=";
+    sha256 = "sha256-RvP0HhndYRrRX7ag2nwmsOoNPKXXWJXfmfZqAWSZuv8=";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 1de00b4bae8a..132f46bf649d 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -33,25 +33,23 @@ rec {
   stable = if stdenv.hostPlatform.system == "i686-linux" then legacy_390 else latest;
 
   production = generic {
+    version = "535.154.05";
+    sha256_64bit = "sha256-fpUGXKprgt6SYRDxSCemGXLrEsIA6GOinp+0eGbqqJg=";
+    sha256_aarch64 = "sha256-G0/GiObf/BZMkzzET8HQjdIcvCSqB1uhsinro2HLK9k=";
+    openSha256 = "sha256-wvRdHguGLxS0mR06P5Qi++pDJBCF8pJ8hr4T8O6TJIo=";
+    settingsSha256 = "sha256-9wqoDEWY4I7weWW05F4igj1Gj9wjHsREFMztfEmqm10=";
+    persistencedSha256 = "sha256-d0Q3Lk80JqkS1B54Mahu2yY/WocOqFFbZVBh+ToGhaE=";
+
+    patches = [ rcu_patch ];
+  };
+
+  latest = selectHighestVersion production (generic {
     version = "550.54.14";
     sha256_64bit = "sha256-jEl/8c/HwxD7h1FJvDD6pP0m0iN7LLps0uiweAFXz+M=";
     sha256_aarch64 = "sha256-sProBhYziFwk9rDAR2SbRiSaO7RMrf+/ZYryj4BkLB0=";
     openSha256 = "sha256-F+9MWtpIQTF18F2CftCJxQ6WwpA8BVmRGEq3FhHLuYw=";
     settingsSha256 = "sha256-m2rNASJp0i0Ez2OuqL+JpgEF0Yd8sYVCyrOoo/ln2a4=";
     persistencedSha256 = "sha256-XaPN8jVTjdag9frLPgBtqvO/goB5zxeGzaTU0CdL6C4=";
-  };
-
-  latest = selectHighestVersion production (generic {
-    version = "545.29.06";
-    sha256_64bit = "sha256-grxVZ2rdQ0FsFG5wxiTI3GrxbMBMcjhoDFajDgBFsXs=";
-    sha256_aarch64 = "sha256-o6ZSjM4gHcotFe+nhFTePPlXm0+RFf64dSIDt+RmeeQ=";
-    openSha256 = "sha256-h4CxaU7EYvBYVbbdjiixBhKf096LyatU6/V6CeY9NKE=";
-    settingsSha256 = "sha256-YBaKpRQWSdXG8Usev8s3GYHCPqL8PpJeF6gpa2droWY=";
-    persistencedSha256 = "sha256-AiYrrOgMagIixu3Ss2rePdoL24CKORFvzgZY3jlNbwM=";
-
-    patches = [ rcu_patch ];
-
-    brokenOpen = kernel.kernelAtLeast "6.7";
   });
 
   beta = selectHighestVersion latest (generic {
diff --git a/pkgs/servers/http/darkhttpd/default.nix b/pkgs/servers/http/darkhttpd/default.nix
index 57e1f8f1635c..a0678299ac9c 100644
--- a/pkgs/servers/http/darkhttpd/default.nix
+++ b/pkgs/servers/http/darkhttpd/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "darkhttpd";
-  version = "1.15";
+  version = "1.16";
 
   src = fetchFromGitHub {
     owner = "emikulic";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-G1lh3nHo2iU/dkiBykl5+DSIC2c6SCqqv42Bw0Frz3A=";
+    sha256 = "sha256-dcNoGU08tu950PlwSghoZwGSaSbP8NJ5qhWUi3bAtZY=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/servers/monitoring/loki/default.nix b/pkgs/servers/monitoring/loki/default.nix
index 65f8c348b13c..2578bb5a0405 100644
--- a/pkgs/servers/monitoring/loki/default.nix
+++ b/pkgs/servers/monitoring/loki/default.nix
@@ -8,14 +8,14 @@
 }:
 
 buildGoModule rec {
-  version = "2.9.4";
+  version = "2.9.5";
   pname = "grafana-loki";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "loki";
     rev = "v${version}";
-    hash = "sha256-uT3rMvSW1eTBhXboA71QeIvuYvc017TxoGG3z3G4K4Y=";
+    hash = "sha256-+X9ODzyIaeizLItUqorDdvgpIOPML+MzgwmyKbes9dA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/servers/monitoring/nagios/default.nix b/pkgs/servers/monitoring/nagios/default.nix
index 442eed82478e..14e60891c08d 100644
--- a/pkgs/servers/monitoring/nagios/default.nix
+++ b/pkgs/servers/monitoring/nagios/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nagios";
-  version = "4.5.0";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "NagiosEnterprises";
     repo = "nagioscore";
     rev = "refs/tags/nagios-${version}";
-    hash = "sha256-km0vB/bopysS7eejDFDKaonXzTzBonIqiw1T+C2lKiQ=";
+    hash = "sha256-+U2k3w3Yr0qZjHwjRpKZVucB3a35PSZr1Sqa8k0ssq8=";
   };
 
   patches = [ ./nagios.patch ];
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index 1a77d0d6b820..b44c34a3ac79 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.21.3";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-M3wLx77Oidrwl0uzJE3NIFiA7GvN8X1xYRSnAFnINGM=";
+    hash = "sha256-CVGxjAgVsGTtUTkowghIh831riKfaTp4cjUjDO+oFG4=";
   };
 
-  vendorHash = "sha256-u7VgZkv9Ajtra9ikeIxJRLZleH+rzs1g2SZO9zj/bes=";
+  vendorHash = "sha256-Q3DlOKaE3fUlRMSfi8Ta9ZyyOE+viiONVUO8x4JACDg=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index 15fd7b88b394..6a8d491480ea 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2024.02.25";
+  version = "2024.03.02";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    hash = "sha256-xaVmK7q10gxN69bGsFEIc01izSbu1m6IyMJWBN6kSzA=";
+    hash = "sha256-LWVU6OZc4hTjYY7Q8zjlR4vMqRc2Y+8QGFST543FR1I=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/security/vaultwarden/default.nix b/pkgs/tools/security/vaultwarden/default.nix
index 3261dc5a923c..5fbe5e22d765 100644
--- a/pkgs/tools/security/vaultwarden/default.nix
+++ b/pkgs/tools/security/vaultwarden/default.nix
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/dani-garcia/vaultwarden";
     changelog = "https://github.com/dani-garcia/vaultwarden/releases/tag/${version}";
     license = licenses.agpl3Only;
-    maintainers = with maintainers; [ SuperSandro2000 ivan ];
+    maintainers = with maintainers; [ dotlambda SuperSandro2000 ];
     mainProgram = "vaultwarden";
   };
 }
diff --git a/pkgs/tools/security/vaultwarden/webvault.nix b/pkgs/tools/security/vaultwarden/webvault.nix
index 2fceb8b05f95..4eaeaa797adb 100644
--- a/pkgs/tools/security/vaultwarden/webvault.nix
+++ b/pkgs/tools/security/vaultwarden/webvault.nix
@@ -69,6 +69,6 @@ in buildNpmPackage rec {
     changelog = "https://github.com/dani-garcia/bw_web_builds/releases/tag/v${version}";
     platforms = platforms.all;
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ dotlambda msteen mic92 ];
+    inherit (vaultwarden.meta) maintainers;
   };
 }
diff --git a/pkgs/tools/text/gtree/default.nix b/pkgs/tools/text/gtree/default.nix
index d27a2857413c..266b807c3f60 100644
--- a/pkgs/tools/text/gtree/default.nix
+++ b/pkgs/tools/text/gtree/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gtree";
-  version = "1.10.8";
+  version = "1.10.9";
 
   src = fetchFromGitHub {
     owner = "ddddddO";
     repo = "gtree";
     rev = "v${version}";
-    hash = "sha256-gxX5Cq5SPDNWtwtuo35RW+N/WE0ZximxDlTi9TnTACM=";
+    hash = "sha256-3OXrKt3rM166JXqFuB+S0BJJkmkHPzJaWDDFeClmdM8=";
   };
 
   vendorHash = "sha256-5biKUOzYaVY+52f0ewvHslAnb+BM0BuqGrU8wwA3t+E=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 90827712d180..9ffaf618bc28 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -35071,12 +35071,12 @@ with pkgs;
 
   slic3r = callPackage ../applications/misc/slic3r { };
 
-  curaengine_stable = disable-warnings-if-gcc13 (callPackage ../applications/misc/curaengine/stable.nix { });
+  curaengine_stable = callPackage ../applications/misc/curaengine/stable.nix { };
 
-  curaengine = disable-warnings-if-gcc13 (callPackage ../applications/misc/curaengine {
+  curaengine = callPackage ../applications/misc/curaengine {
     inherit (python3.pkgs) libarcus;
     protobuf = protobuf_21;
-  });
+  };
 
   cura = libsForQt5.callPackage ../applications/misc/cura { };