Merge staging-next into staging

55 files changed, 400 insertions, 308 deletions

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 678bd8ea4df9..677abcfe9804 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1522,22 +1522,7 @@ let
         };
       };
 
-      equinusocio.vsc-material-theme = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vsc-material-theme";
-          publisher = "Equinusocio";
-          version = "33.8.0";
-          sha256 = "sha256-+I4AUwsrElT62XNvmuAC2iBfHfjNYY0bmAqzQvfwUYM=";
-        };
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/Equinusocio.vsc-material-theme/changelog";
-          description = "The most epic theme now for Visual Studio Code";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=Equinusocio.vsc-material-theme";
-          homepage = "https://github.com/material-theme/vsc-material-theme";
-          license = lib.licenses.asl20;
-          maintainers = [ lib.maintainers.stunkymonkey ];
-        };
-      };
+      equinusocio.vsc-material-theme = callPackage ./equinusocio.vsc-material-theme { };
 
       esbenp.prettier-vscode = buildVscodeMarketplaceExtension {
         mktplcRef = {
diff --git a/pkgs/applications/editors/vscode/extensions/equinusocio.vsc-material-theme/default.nix b/pkgs/applications/editors/vscode/extensions/equinusocio.vsc-material-theme/default.nix
new file mode 100644
index 000000000000..8f2784c3704d
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/equinusocio.vsc-material-theme/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, vscode-utils
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "vsc-material-theme";
+    publisher = "Equinusocio";
+    version = "34.3.1";
+    sha256 = "sha256-3yxFTMtjJR1b4EzBDfm55HF9chrya5OUF5wN+KHEduE=";
+  };
+
+  # extensions wants to write at the /nix/store path, so we patch it to use the globalStorageUri instead.
+  prePatch = ''
+    substituteInPlace ./build/core/extension-manager.js \
+      --replace-fail "path_1.posix.join(extensionFolderUri.path, env_1.USER_CONFIG_FILE_NAME)" "path_1.posix.join(ExtensionContext.globalStorageUri.fsPath, env_1.USER_CONFIG_FILE_NAME)"
+  '';
+
+  meta = with lib; {
+    changelog = "https://marketplace.visualstudio.com/items/Equinusocio.vsc-material-theme/changelog";
+    description = "The most epic theme now for Visual Studio Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=Equinusocio.vsc-material-theme";
+    homepage = "https://github.com/material-theme/vsc-material-theme";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ stunkymonkey ];
+  };
+}
diff --git a/pkgs/applications/emulators/retroarch/hashes.json b/pkgs/applications/emulators/retroarch/hashes.json
index 8c562d47f644..2f61a0e5eb49 100644
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@@ -65,10 +65,10 @@
         "src": {
             "owner": "libretro",
             "repo": "beetle-pce-fast-libretro",
-            "rev": "d97d9558fe218ea04821788cee1f2c03556e818a",
-            "hash": "sha256-RKKx7Vf5d+VBYe0HVMsSchRtga7LbLiLchM4a80Lfns="
+            "rev": "ad9ad7e7e3b89d322e9f9492f5b04738641ffbe8",
+            "hash": "sha256-UUej94plV/UDsvfh7CPjP6zv99zNw4JT+ZDOl0AKzmc="
         },
-        "version": "unstable-2024-02-16"
+        "version": "unstable-2024-02-23"
     },
     "beetle-pcfx": {
         "fetcher": "fetchFromGitHub",
@@ -287,10 +287,10 @@
         "src": {
             "owner": "libretro",
             "repo": "fbneo",
-            "rev": "484962863ab84189dca218b02197575cd266a537",
-            "hash": "sha256-e1JAEiPISc4Q06HHPox6AVbK/Frrbc7pLNvNmuWojVw="
+            "rev": "226123d45854f23a93f5030471bf82d068f018ad",
+            "hash": "sha256-GTkUgLhnP2KFR6Lo354577qYS5CXjGZ7k7PZ9sTE0Cg="
         },
-        "version": "unstable-2024-02-18"
+        "version": "unstable-2024-02-22"
     },
     "fceumm": {
         "fetcher": "fetchFromGitHub",
diff --git a/pkgs/applications/misc/valent/default.nix b/pkgs/applications/misc/valent/default.nix
index 75318acda6cc..09ec8609712d 100644
--- a/pkgs/applications/misc/valent/default.nix
+++ b/pkgs/applications/misc/valent/default.nix
@@ -21,14 +21,14 @@
 
 stdenv.mkDerivation rec {
   pname = "valent";
-  version = "unstable-2023-11-11";
+  version = "0-unstable-2024-02-12";
 
   src = fetchFromGitHub {
     owner = "andyholmes";
     repo = "valent";
-    rev = "51bca834b1c52a1cc49b79fe79d45dfcd9113c02";
+    rev = "70ef1aa42eb2df5e9c3aa4faa014c8d539450018";
     fetchSubmodules = true;
-    hash = "sha256-jmhio/vS+w37IW81XgV4xfb/6ralMgAlwi3zigr4t20=";
+    hash = "sha256-JdrkAtn21NoX+SI6PNWMdE8HLKhLc3HKFhwKydENkvg=";
   };
 
   nativeBuildInputs = [
@@ -62,9 +62,26 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "An implementation of the KDE Connect protocol, built on GNOME platform libraries";
-    homepage = "https://github.com/andyholmes/valent/";
+    longDescription = ''
+      Note that you have to open firewall ports for other devices
+      to connect to it. Use either:
+      ```nix
+      programs.kdeconnect = {
+        enable = true;
+        package = pkgs.valent;
+      }
+      ```
+      or open corresponding firewall ports directly:
+      ```nix
+      networking.firewall = rec {
+        allowedTCPPortRanges = [ { from = 1714; to = 1764; } ];
+        allowedUDPPortRanges = allowedTCPPortRanges;
+      }
+      ```
+    '';
+    homepage = "https://valent.andyholmes.ca";
     changelog = "https://github.com/andyholmes/valent/blob/${src.rev}/CHANGELOG.md";
-    license = with licenses; [ gpl3Plus cc0 ];
+    license = with licenses; [ gpl3Plus cc0 cc-by-sa-30 ];
     maintainers = with maintainers; [ federicoschonborn aleksana ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/applications/misc/wttrbar/default.nix b/pkgs/applications/misc/wttrbar/default.nix
index 9bd55af10b89..c2f67e83f8a7 100644
--- a/pkgs/applications/misc/wttrbar/default.nix
+++ b/pkgs/applications/misc/wttrbar/default.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wttrbar";
-  version = "0.7.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "bjesus";
     repo = "wttrbar";
     rev = version;
-    hash = "sha256-b5GJNbXv6W4UA7nKYMgoWpfd9J+yWlWij5W0fh52vgs=";
+    hash = "sha256-XgBPZl5msKICIrUJZz2gj/hZjVAv0HpVKa69/KiLwnI=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk_11_0.frameworks; [ Security SystemConfiguration ]);
 
-  cargoHash = "sha256-MCsblCDiCRDEHTfTcE6CyhqDclSbj0TJEf2cX6ISDFo=";
+  cargoHash = "sha256-JGJJ94rzHTQNR6rzFPWnFHH3t0fL1tvMeEN5NMzRtHM=";
 
   meta = {
     description = "A simple but detailed weather indicator for Waybar using wttr.in";
diff --git a/pkgs/applications/misc/xmrig/default.nix b/pkgs/applications/misc/xmrig/default.nix
index ca4011220d34..b0f8562c1728 100644
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@@ -15,13 +15,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "xmrig";
-  version = "6.21.0";
+  version = "6.21.1";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig";
     rev = "v${version}";
-    hash = "sha256-7OHfFo8+MUNSI3vpOIODKQH41jmraHDJOyqfLBp/v9o=";
+    hash = "sha256-xMfNWqr43Gxu+ET8oP9l97+tBsL/b6DNuFU4j9wy0UA=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/cluster/cmctl/default.nix b/pkgs/applications/networking/cluster/cmctl/default.nix
index e871b43a91d5..e23af212b554 100644
--- a/pkgs/applications/networking/cluster/cmctl/default.nix
+++ b/pkgs/applications/networking/cluster/cmctl/default.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "cmctl";
-  version = "1.14.2";
+  version = "1.14.3";
 
   src = fetchFromGitHub {
     owner = "cert-manager";
     repo = "cert-manager";
     rev = "v${version}";
-    hash = "sha256-pq7v7j/w+gDlyjYyrOk86YW76rwxLQQUFwhaPrblCSw=";
+    hash = "sha256-CPHSWGM8zq+Sg0tqdm9kmIyBFpVf1ot40Ud7Mpe1sNI=";
   };
 
   sourceRoot = "${src.name}/cmd/ctl";
 
-  vendorHash = "sha256-HHlZkxXEJIP3u2rB4+B8Z9vcGwzRT5dtjf5Hu1WVroI=";
+  vendorHash = "sha256-CBX/U9v2ubmPveXUeWbogHDyWVAtU0pyOWAlnRsMs4c=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
index c5c33573c921..8e0a72251ca3 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helm-unittest";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-8rGYFoBhNPJnsZsRXJ7Z9a/KOV4d2ZIVLSdYCpf3IMs=";
+    hash = "sha256-51Cx8V0cvuyBLFVmOWpA8X/kpDR67Q5EYZct44ED/ys=";
   };
 
-  vendorHash = "sha256-wD4FxJ/+8iw2qAz+s0G/8/PKt7X0MZn+roWtc/wTWmw=";
+  vendorHash = "sha256-6tXQ2fbn1ZzImx8luxetXHNj3gIUt217rjXJPxMpjTw=";
 
   # NOTE: Remove the install and upgrade hooks.
   postPatch = ''
diff --git a/pkgs/applications/networking/cluster/linkerd/edge.nix b/pkgs/applications/networking/cluster/linkerd/edge.nix
index 3feed7bf8e4b..88cd474392a0 100644
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "edge";
-  version = "24.2.3";
-  sha256 = "0l1sa8xzqddvyzlzddcb9nbvxlj06dm5l6fb0f6fw9ay0d8qm22k";
+  version = "24.2.4";
+  sha256 = "0hh2sfjvqz085hl2dpsa9zgr3dwpyc85gcbx0c7lzpjg411bxmim";
   vendorHash = "sha256-g1e1uY43fUC2srKK9erVFlJDSwWrEvq4ni0PgeCFaOg=";
 }
diff --git a/pkgs/applications/networking/discordo/default.nix b/pkgs/applications/networking/discordo/default.nix
index adc7a7f5dc01..3130765ee991 100644
--- a/pkgs/applications/networking/discordo/default.nix
+++ b/pkgs/applications/networking/discordo/default.nix
@@ -3,16 +3,16 @@
 
 buildGoModule rec {
   pname = "discordo";
-  version = "unstable-2024-02-21";
+  version = "unstable-2024-02-25";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = pname;
-    rev = "3486f6ced9db8eb865641632e50daa2550a55ef8";
-    hash = "sha256-iSc9WiX0xu9X1GCSPEnf99OpTaKVlNN7sGp+f1S89SM=";
+    rev = "6e683a6526279a8c0f9f8a03be776d62214a4d13";
+    hash = "sha256-sPNJkzVulgbm3OdJWSj6i2YOKin9VO0L3aS2c0alwBE=";
   };
 
-  vendorHash = "sha256-89WJZuqUnYGT2eTWcfxdouwc2kZ15Lt38EyLP/DLSWI=";
+  vendorHash = "sha256-dBJYTe8aZtNuBwmcpXb3OEHoLVCa/GbGExLIRc8cVbo=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index ae7eb2021fe1..e5b05f211f62 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -20,12 +20,12 @@
 
 buildGoModule rec {
   pname = "gitea";
-  version = "1.21.6";
+  version = "1.21.7";
 
   # not fetching directly from the git repo, because that lacks several vendor files for the web UI
   src = fetchurl {
     url = "https://dl.gitea.com/gitea/${version}/gitea-src-${version}.tar.gz";
-    hash = "sha256-tixWipiVHugacTzBurdgfiLnKyVDDcqCPlysj2DoWjg=";
+    hash = "sha256-d/3BPOSez7M2Xh2x9H2KsDIZ69PHinHIzQ6ekt/yWas=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/version-management/legit-web/default.nix b/pkgs/applications/version-management/legit-web/default.nix
index a14b7c22bd4b..3c42284702d2 100644
--- a/pkgs/applications/version-management/legit-web/default.nix
+++ b/pkgs/applications/version-management/legit-web/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "legit";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     repo = "legit";
     owner = "icyphox";
     rev = "v${version}";
-    hash = "sha256-Y0lfbe4xBCj80z07mLFIiX+shvntYAHiW2Uw7h94jrE=";
+    hash = "sha256-TBq1ILBhojMIxnLj108L0zLmFsZD/ET9w5cSbqk8+XM=";
   };
 
-  vendorHash = "sha256-RAUSYCtP4rcJ2zIBXfPAEZWD1VSfr3d4MrmUMiPpjK8=";
+  vendorHash = "sha256-IeWgmUNkBU3W6ayfRkzMO/0XHNqm5zy5lLUNePzv+ug=";
 
   postInstall = ''
     mkdir -p $out/lib/legit/templates
diff --git a/pkgs/applications/video/shotcut/default.nix b/pkgs/applications/video/shotcut/default.nix
index dce78f3cdf90..ca3c0599a626 100644
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@@ -20,13 +20,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "shotcut";
-  version = "24.01.31";
+  version = "24.02.19";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "shotcut";
     rev = "v${version}";
-    hash = "sha256-3Itlv9Jc4xl9pB4WDUwc3f7iP7NHyZ6yr5NZuH8M2Jo=";
+    hash = "sha256-fjm2gqbuLKj6YyAZGgbfWUd+JOM9/Fhvpfz0E+TaqY0=";
   };
 
   nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook ];
diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix
index cff31a759a2b..d3ebd6a7f29e 100644
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@@ -154,9 +154,14 @@ edk2.mkDerivation projectDscPath (finalAttrs: {
     )
   '';
 
+  # TODO: Usage of -bios OVMF.fd is discouraged: https://lists.katacontainers.io/pipermail/kata-dev/2021-January/001650.html
+  # We should remove the isx86-specifc block here once we're ready to update nixpkgs to stop using that and update the
+  # release notes accordingly.
   postInstall = ''
     mkdir -vp $fd/FV
     mv -v $out/FV/${fwPrefix}_{CODE,VARS}.fd $fd/FV
+  '' + lib.optionalString stdenv.hostPlatform.isx86 ''
+    mv -v $out/FV/${fwPrefix}.fd $fd/FV
   '' + lib.optionalString msVarsTemplate ''
     mv -v $out/FV/${fwPrefix}_VARS.ms.fd $fd/FV
     ln -sv $fd/FV/${fwPrefix}_CODE{,.ms}.fd
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 343b00148055..9b6bb0a48be3 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -120,7 +120,7 @@ rec {
       ];
 
       postPatch = ''
-        patchShebangs hack/make.sh hack/make/
+        patchShebangs hack/make.sh hack/make/ hack/with-go-mod.sh
       '';
 
       buildPhase = ''
@@ -306,4 +306,18 @@ rec {
     tiniRev = "v0.19.0";
     tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };
+
+  docker_25 = callPackage dockerGen rec {
+    version = "25.0.3";
+    cliRev = "v${version}";
+    cliHash = "sha256-Jvb0plV1O/UzrcpzN4zH5OulmTVF+p9UQQQ9xqkiObQ=";
+    mobyRev = "v${version}";
+    mobyHash = "sha256-cDlRVdQNzH/X2SJUYHK1QLUHlKQtSyRYCVbz3wPx1ZM=";
+    runcRev = "v1.1.12";
+    runcHash = "sha256-N77CU5XiGYIdwQNPFyluXjseTeaYuNJ//OsEUS0g/v0=";
+    containerdRev = "v1.7.13";
+    containerdHash = "sha256-y3CYDZbA2QjIn1vyq/p1F1pAVxQHi/0a6hGWZCRWzyk=";
+    tiniRev = "v0.19.0";
+    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
+  };
 }
diff --git a/pkgs/applications/window-managers/hyprwm/hyprshade/default.nix b/pkgs/applications/window-managers/hyprwm/hyprshade/default.nix
index 5f9cedd9e05e..cea8c7c414cf 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprshade/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprshade/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "hyprshade";
-  version = "3.0.2";
+  version = "3.0.3";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "loqusion";
     repo = "hyprshade";
     rev = "refs/tags/${version}";
-    hash = "sha256-E5FNVzmzxzqhIZ4i8PwiKB8q4LwpsV961Bc77kSym8A=";
+    hash = "sha256-vX1Cc170ifevn1aji5s0MI7G0zktPuvSpAbYpGPMudA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/window-managers/i3/status-rust.nix b/pkgs/applications/window-managers/i3/status-rust.nix
index 06c3de8cd3fa..74635d158829 100644
--- a/pkgs/applications/window-managers/i3/status-rust.nix
+++ b/pkgs/applications/window-managers/i3/status-rust.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "i3status-rust";
-  version = "0.32.3";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "greshake";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-CldVak1BQ4VhRt24hHdog5O3crkQBZBkRWNT7uYUw4Y=";
+    hash = "sha256-DIEWmXqs4yNIJsBBhH7khOY6RJQ9qRoSTIHN/aeBuA4=";
   };
 
-  cargoHash = "sha256-gWBmzpgZcsO4u8kXSqtr4FIYvshXpxWbECg/tcyl9Ok=";
+  cargoHash = "sha256-5946aMSndBkXCY0jjnhPc5x9wFOC1zjJNkFkMFFOuxo=";
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 
diff --git a/pkgs/by-name/an/ansel/package.nix b/pkgs/by-name/an/ansel/package.nix
index f4ee5d5ff048..82cafc40bd74 100644
--- a/pkgs/by-name/an/ansel/package.nix
+++ b/pkgs/by-name/an/ansel/package.nix
@@ -77,13 +77,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "unstable-2024-01-05";
+  version = "unstable-2024-02-23";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
     repo = "ansel";
-    rev = "e2c4a0a60cd80f741dd3d3c6ab72be9ac11234fb";
-    hash = "sha256-Kg020MHy9fn1drCk+66f25twqczvD/5evutDODqOjYM=";
+    rev = "61eb388760d130476415a51e19f94b199a1088fe";
+    hash = "sha256-68EX5rnOlBHXZnMlXjQk+ZXFIwR5ZFc1Wyg8EzCKaUg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/games/itch/butler.nix b/pkgs/by-name/bu/butler/package.nix
index cbd6b8aef936..cbd6b8aef936 100644
--- a/pkgs/games/itch/butler.nix
+++ b/pkgs/by-name/bu/butler/package.nix
diff --git a/pkgs/games/itch/default.nix b/pkgs/by-name/it/itch/package.nix
index 897d8f3941c4..3ba0c6cb4350 100644
--- a/pkgs/games/itch/default.nix
+++ b/pkgs/by-name/it/itch/package.nix
@@ -11,27 +11,27 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "itch";
-  version = "26.1.2";
+  version = "26.1.3";
 
   # TODO: Using kitch instead of itch, revert when possible
   src = fetchzip {
-    url = "https://broth.itch.ovh/k${pname}/linux-amd64/${version}/archive/default#.zip";
+    url = "https://broth.itch.ovh/kitch/linux-amd64/${version}/archive/default#.zip";
     stripRoot = false;
-    sha256 = "sha256-thXe+glpltSiKNGIRgvOZQZPJWfDHWo3dLdziyp2BM4=";
+    hash = "sha256-FHwbzLPMzIpyg6KyYTq6/rSNRH76dytwb9D5f9vNKkU=";
   };
 
   itch-setup = fetchzip {
     url = "https://broth.itch.ovh/itch-setup/linux-amd64/1.26.0/itch-setup.zip";
     stripRoot = false;
-    sha256 = "sha256-5MP6X33Jfu97o5R1n6Og64Bv4ZMxVM0A8lXeQug+bNA=";
+    hash = "sha256-5MP6X33Jfu97o5R1n6Og64Bv4ZMxVM0A8lXeQug+bNA=";
   };
 
   icons = let sparseCheckout = "/release/images/itch-icons"; in
     fetchFromGitHub {
         owner = "itchio";
-        repo = pname;
+        repo = "itch";
         rev = "v${version}-canary";
-        sha256 = "sha256-veZiKs9qHge+gCEpJ119bAT56ssXJAH3HBcYkEHqBFg=";
+        hash = "sha256-0AMyDZ5oI7/pSvudoEqXnMZJtpcKVlUSR6YVm+s4xv0=";
         sparseCheckout = [ sparseCheckout ];
       } + sparseCheckout;
 
@@ -39,11 +39,11 @@ stdenvNoCC.mkDerivation rec {
 
   desktopItems = [
     (makeDesktopItem {
-      name = pname;
+      name = "itch";
       exec = "itch %U";
-      tryExec = pname;
-      icon = pname;
-      desktopName = pname;
+      tryExec = "itch";
+      icon = "itch";
+      desktopName = "itch";
       mimeTypes = [ "x-scheme-handler/itchio" "x-scheme-handler/itch" ];
       comment = "Install and play itch.io games easily";
       categories = [ "Game" ];
@@ -58,8 +58,8 @@ stdenvNoCC.mkDerivation rec {
     substituteInPlace ./resources/app/package.json \
       --replace "kitch" "itch"
 
-    mkdir -p $out/bin $out/share/${pname}/resources/app
-    cp -r resources/app "$out/share/${pname}/resources/"
+    mkdir -p $out/bin $out/share/itch/resources/app
+    cp -r resources/app "$out/share/itch/resources/"
 
     install -Dm644 LICENSE -t "$out/share/licenses/$pkgname/"
     install -Dm644 LICENSES.chromium.html -t "$out/share/licenses/$pkgname/"
@@ -76,9 +76,9 @@ stdenvNoCC.mkDerivation rec {
   '';
 
   postFixup = ''
-    makeWrapper ${steam-run}/bin/steam-run $out/bin/${pname} \
+    makeWrapper ${steam-run}/bin/steam-run $out/bin/itch \
       --add-flags ${electron}/bin/electron \
-      --add-flags $out/share/${pname}/resources/app \
+      --add-flags $out/share/itch/resources/app \
       --set BROTH_USE_LOCAL butler,itch-setup \
       --prefix PATH : ${butler}/bin/:${itch-setup}
   '';
@@ -90,5 +90,6 @@ stdenvNoCC.mkDerivation rec {
     platforms = platforms.linux;
     sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
     maintainers = with maintainers; [ pasqui23 ];
+    mainProgram = "itch";
   };
 }
diff --git a/pkgs/by-name/ja/jasper/package.nix b/pkgs/by-name/ja/jasper/package.nix
index 72a8a9aff709..42cce508a545 100644
--- a/pkgs/by-name/ja/jasper/package.nix
+++ b/pkgs/by-name/ja/jasper/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jasper";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "jasper-software";
     repo = "jasper";
     rev = "version-${finalAttrs.version}";
-    hash = "sha256-aDeexQ+JmxRIjYAUH+x/J/Z847JasKWQNYYEpu78sHw=";
+    hash = "sha256-SE3zB+8zZuuT+W6QYTuQhM+dBgYuFzYK4a7QaquGB60=";
   };
 
   outputs = [ "out" "doc" "man" ];
diff --git a/pkgs/by-name/li/libgrapheme/package.nix b/pkgs/by-name/li/libgrapheme/package.nix
new file mode 100644
index 000000000000..1aaed5f1a604
--- /dev/null
+++ b/pkgs/by-name/li/libgrapheme/package.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchurl, buildPackages }:
+
+stdenv.mkDerivation rec {
+  pname = "libgrapheme";
+  version = "2.0.2";
+
+  src = fetchurl {
+    url = "https://dl.suckless.org/libgrapheme/libgrapheme-${version}.tar.gz";
+    hash = "sha256-pou93edr1Vul1kEWzl5CoT3wRcgcCFLemrYIlqoUMSU=";
+  };
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  makeFlags = [ "AR:=$(AR)" "CC:=$(CC)" "RANLIB:=$(RANLIB)" "BUILD_CC=$(CC_FOR_BUILD)" ];
+
+  installFlags = [ "PREFIX=$(out)" "LDCONFIG=" ];
+
+  meta = with lib; {
+    description = "Unicode string library";
+    homepage = "https://libs.suckless.org/libgrapheme/";
+    license = licenses.isc;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ sikmir ];
+  };
+}
diff --git a/pkgs/applications/networking/browsers/telescope/default.nix b/pkgs/by-name/te/telescope/package.nix
index 92124531691d..610a93ce84cc 100644
--- a/pkgs/applications/networking/browsers/telescope/default.nix
+++ b/pkgs/by-name/te/telescope/package.nix
@@ -4,6 +4,7 @@
 , pkg-config
 , bison
 , libevent
+, libgrapheme
 , libressl
 , ncurses
 , autoreconfHook
@@ -13,15 +14,20 @@
 
 stdenv.mkDerivation rec {
   pname = "telescope";
-  version = "0.8.1";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "omar-polo";
     repo = pname;
     rev = version;
-    sha256 = "sha256-9gZeBAC7AGU5vb+692npjKbbqFEAr9iGLu1u68EJ0W8=";
+    hash = "sha256-eGntAAaKSwusm3e0zDXZmV9D5uX/uThPvQ5OjPNsxZ8=";
   };
 
+  postPatch = ''
+    # Remove bundled libraries
+    rm -r libgrapheme
+  '';
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
@@ -30,6 +36,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libevent
+    libgrapheme
     libressl
     ncurses
   ] ++ lib.optional stdenv.isDarwin memstreamHook;
diff --git a/pkgs/by-name/wi/wiremock/package.nix b/pkgs/by-name/wi/wiremock/package.nix
index 73b6e121b5bc..5f5d4aa00955 100644
--- a/pkgs/by-name/wi/wiremock/package.nix
+++ b/pkgs/by-name/wi/wiremock/package.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wiremock";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchurl {
     url = "mirror://maven/org/wiremock/wiremock-standalone/${version}/wiremock-standalone-${version}.jar";
-    hash = "sha256-SqyPd6eHDzNFn7vzIPOW3l/KtpaiiLC6uMIKqL3GN3s=";
+    hash = "sha256-Btf7oQRmfQnHdl5DawF2xOczDrR/5Po/9NytgqTLkVQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/za/zapzap/package.nix b/pkgs/by-name/za/zapzap/package.nix
index e41a099f4f32..fabde8cd0cd4 100644
--- a/pkgs/by-name/za/zapzap/package.nix
+++ b/pkgs/by-name/za/zapzap/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "zapzap";
-  version = "5.2";
+  version = "5.2.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "zapzap-linux";
     repo = "zapzap";
-    rev = version;
-    hash = "sha256-vG8yDW0+scImPWHyVJs2QkiSWbjPLR9Z01zkOWZi/BI=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Jswt/SWsrrXdJtaT3FAOuOCkrwlpy+lSJa6/gquMiwY=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/data/themes/alacritty-theme/default.nix b/pkgs/data/themes/alacritty-theme/default.nix
index f195597f72c4..d5225cc89937 100644
--- a/pkgs/data/themes/alacritty-theme/default.nix
+++ b/pkgs/data/themes/alacritty-theme/default.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (self: {
   name = "alacritty-theme";
-  version = "unstable-2024-02-11";
+  version = "unstable-2024-02-25";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = "alacritty-theme";
-    rev = "0587019bac748dfb5cc1b768f89c88ad9291b66b";
-    hash = "sha256-WPatWpBCZYFCohUh3U9QzSTFJgtou8+861013jz49Lw=";
+    rev = "07c10441dae4d0490145a0f40178f8846b24e800";
+    hash = "sha256-aZlsKbFcm1bswx7k0cjwhj1MudR0Q0rD8sdHa7kQ0rY=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/data/themes/nordic/default.nix b/pkgs/data/themes/nordic/default.nix
index 1751575e8259..ce17fd9ffd8d 100644
--- a/pkgs/data/themes/nordic/default.nix
+++ b/pkgs/data/themes/nordic/default.nix
@@ -10,70 +10,70 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nordic";
-  version = "2.2.0-unstable-2024-01-20";
+  version = "2.2.0-unstable-2024-02-20";
 
   srcs = [
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "218a1a8679fdb97aa0aa7997fdf8c5344d68fb2f";
-      hash = "sha256-a315U4HsQP1omluTJjq9U76L3ANP7uN831mCY54vZnk=";
+      rev = "58d5a8e10ae068b98a63e6de2791e289f417842d";
+      hash = "sha256-Z3e7DoakK6f+UMBr78gZ+NJPb5vuJCfDgPRYywFDYeg=";
       name = "Nordic";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "59873a54c8524adb36411d17d473eb7b7c910eac";
-      hash = "sha256-RisW5W0onNrtsSPHtFW66OdrQWOQX3uDmLiM+5ckzSY=";
+      rev = "cb7d95bd5438728f30f361a888dfb33b7f6ad28c";
+      hash = "sha256-ZWGmDiXjEt0UuALyw7cjTYgdw9kdJJKc0vkclbZkBvo=";
       name = "Nordic-standard-buttons";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "6e2b8fb8017c34344ec6b70884f09ebb44863efb";
-      hash = "sha256-B4qH8L5r16gaPS1wpiIHPyS3g/g53Xi2C6F0rcZKgWk=";
+      rev = "37b86a30ad3e048f87a689f2813aa28644035fa8";
+      hash = "sha256-+O8+30H6humVQTwgFL3uQkeo5gPYrokpAKbT56PX6YQ=";
       name = "Nordic-darker";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "2160a7bc69f55dd0b9efa64f029344256a4ef086";
-      hash = "sha256-1WdorWByZE4sXTfwsjFxvvSI0qQcAcfFoPXN5fGhEpc=";
+      rev = "926b215d14394ff043f2d2969e730759af7acd86";
+      hash = "sha256-yR0DfmUW1rr38Zbwtr7TUYL6z8vTNyoj0vEhphbZieU=";
       name = "Nordic-darker-standard-buttons";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "63e0844bc04e1500e4b0ef8031cb3812e15e12fb";
-      hash = "sha256-b0Zs2WsD913Ai8wvi7mPraFme93WZXm+7rnwhDvGuZM=";
+      rev = "1ae59d40ba8342fc14f3a55a2fb37446a8d10880";
+      hash = "sha256-tFIXPP5Ohw8atNIqvMtB7sLka+/tw+aSbjMdzKfI9r0=";
       name = "Nordic-bluish-accent";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = pname;
-      rev = "53e44ca5045a57903c0024197fa7a7a267432afb";
-      hash = "sha256-vF2f4PuQP0QkmPT6kR35eWYvQ9xLCYihEsobERURuBk=";
+      rev = "aaaa5dab0517f182a85a75d457da70d22e577b26";
+      hash = "sha256-J/nti2jxQ0VfTbp5WfrE0CN6Pvfg1edplL6/QPKUBzc=";
       name = "Nordic-bluish-accent-standard-buttons";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = "${pname}-polar";
-      rev = "4ec6f09782394d24d4d8cc78ac53c4692ec28985";
-      hash = "sha256-Z50ciafgfTHBahjpcVTapnsU88ioPUZ1RjggNpruJP0=";
+      rev = "733d5ea57c6ecd8209ec0a928029e28b3f54f83d";
+      hash = "sha256-y3ge0DF0SdKFjH+mZdHDpK3YG7Ng3rN0y0Er2WBC6Sc=";
       name = "Nordic-Polar";
     })
 
     (fetchFromGitHub {
       owner = "EliverLara";
       repo = "${pname}-polar";
-      rev = "c6c7ee8e642a9df07f7d69ed048a6ef37a26153c";
-      hash = "sha256-e+B9oUKbPr2MKmaz+l5GTOP4iVmw24vVpS98mAxEekA=";
+      rev = "667dfe4f6e8157f30a4e0ea5dc1d17438520d6cf";
+      hash = "sha256-p7bY1r8Ik+jsIyjR75UFHw8XuiGz5LmT09txBLyZpx4=";
       name = "Nordic-Polar-standard-buttons";
     })
   ];
diff --git a/pkgs/development/interpreters/micropython/default.nix b/pkgs/development/interpreters/micropython/default.nix
index 53d2130d28cc..6437e942ae34 100644
--- a/pkgs/development/interpreters/micropython/default.nix
+++ b/pkgs/development/interpreters/micropython/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "micropython";
-  version = "1.22.1";
+  version = "1.22.2";
 
   src = fetchFromGitHub {
     owner = "micropython";
     repo = "micropython";
     rev = "v${version}";
-    sha256 = "sha256-NU/C0rxiA/DTbUXZG/RTsq7tGgxtLUUilMhsc8DPA7g=";
+    sha256 = "sha256-sdok17HvKub/sI+8cAIIDaLD/3mu8yXXqrTOej8/UfU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/lightgbm/default.nix b/pkgs/development/libraries/lightgbm/default.nix
index 55d04fb4f374..09ac8b8fa863 100644
--- a/pkgs/development/libraries/lightgbm/default.nix
+++ b/pkgs/development/libraries/lightgbm/default.nix
@@ -23,14 +23,14 @@ stdenv.mkDerivation rec {
   #   in \
   #   rWrapper.override{ packages = [ lgbm ]; }"
   pname = lib.optionalString rLibrary "r-" + pnameBase;
-  version = "4.1.0";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = pnameBase;
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-AhXe/Mlor/i0y84wI9jVPKSnyVbSyAV52Y4yiNm7yLQ=";
+    hash = "sha256-hEoGdzC6n8t14ZUFWFrdljEkQRo9qaDGYTamvIAgrbg=";
   };
 
   nativeBuildInputs = [ cmake ]
@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = lib.optionals rLibrary [
     rPackages.data_table
+    rPackages.markdown
     rPackages.rmarkdown
     rPackages.jsonlite
     rPackages.Matrix
@@ -70,6 +71,9 @@ stdenv.mkDerivation rec {
       --replace \
         "install_args <- c(\"CMD\", \"INSTALL\", \"--no-multiarch\", \"--with-keep.source\", tarball)" \
         "install_args <- c(\"CMD\", \"INSTALL\", \"--no-multiarch\", \"--with-keep.source\", \"-l $out/library\", tarball)"
+
+    # Retry this test in next release. Something fails in the setup, so GTEST_FILTER is not enough
+    rm tests/cpp_tests/test_arrow.cpp
   '';
 
   cmakeFlags = lib.optionals doCheck [ "-DBUILD_CPP_TEST=ON" ]
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index a2257be2f428..d9cba7737271 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "5.6.3";
+  version = "5.6.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "AppThreat";
     repo = "vulnerability-db";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aOHnuZdjXiIqd/SeQdVB1qB7v8DfnEFH0zHctA74MPw=";
+    hash = "sha256-Uq0DXrNQRVhQaPXXGNjbnPhOYoPpa8H3WuDdotCKS8c=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bottleneck/default.nix b/pkgs/development/python-modules/bottleneck/default.nix
index e327e135c48c..677b4a990362 100644
--- a/pkgs/development/python-modules/bottleneck/default.nix
+++ b/pkgs/development/python-modules/bottleneck/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "bottleneck";
-  version = "1.3.7";
+  version = "1.3.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Bottleneck";
     inherit version;
-    hash = "sha256-4UZ+NzrUado0DtD/KDIU1lMcwIv9yiCDNho6pkcGgfg=";
+    hash = "sha256-Z4DYlpabp/U8iZW6kMh8VIvrPbQ13JDGC5oQ7Rq02Gg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/datafusion/default.nix b/pkgs/development/python-modules/datafusion/default.nix
index ed25c032881b..baf905f11fa7 100644
--- a/pkgs/development/python-modules/datafusion/default.nix
+++ b/pkgs/development/python-modules/datafusion/default.nix
@@ -9,6 +9,7 @@
 , protobuf
 , pyarrow
 , Security
+, SystemConfiguration
 }:
 
 let
@@ -31,7 +32,7 @@ in
 
 buildPythonPackage rec {
   pname = "datafusion";
-  version = "25.0.0";
+  version = "35.0.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
@@ -39,13 +40,13 @@ buildPythonPackage rec {
     owner = "apache";
     repo = "arrow-datafusion-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-oC+fp41a9rsdobpvShZ7sDdtYPJQQ7JLg6MFL+4Pksg=";
+    hash = "sha256-43XY7j/8x+7SCY4W8nysaeWax2nvTTHZXMmy3hSz6pI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     name = "datafusion-cargo-deps";
     inherit src pname version;
-    hash = "sha256-0e0ZRgwcS/46mi4c2loAnBA2bsaD+/RiMh7oNg3EvHY=";
+    hash = "sha256-YWAyEMojw0bc/fu5kIZKMNPEgsAIpWqjVNodWXbgTl4=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -53,7 +54,11 @@ buildPythonPackage rec {
     maturinBuildHook
   ];
 
-  buildInputs = [ protobuf ] ++ lib.optionals stdenv.isDarwin [ libiconv Security ];
+  buildInputs = [ protobuf ] ++ lib.optionals stdenv.isDarwin [
+    libiconv
+    Security
+    SystemConfiguration
+  ];
 
   propagatedBuildInputs = [ pyarrow ];
 
diff --git a/pkgs/development/python-modules/ldfparser/default.nix b/pkgs/development/python-modules/ldfparser/default.nix
index f4657dce8458..4b83fb53252e 100644
--- a/pkgs/development/python-modules/ldfparser/default.nix
+++ b/pkgs/development/python-modules/ldfparser/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "ldfparser";
-  version = "0.23.0";
+  version = "0.24.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "c4deszes";
     repo = "ldfparser";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gSjTuMndkzFUDcixJCohuCChhztFXnLpbK/zTOjEBpg=";
+    hash = "sha256-+7L2WCQEDpWPDBPVt4ddoz0U4YkJ9GqQqp0cKj2fAXM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/oslo-db/default.nix b/pkgs/development/python-modules/oslo-db/default.nix
index 0e7a5abedda5..b4dce2cc09b5 100644
--- a/pkgs/development/python-modules/oslo-db/default.nix
+++ b/pkgs/development/python-modules/oslo-db/default.nix
@@ -20,13 +20,13 @@
 
 buildPythonPackage rec {
   pname = "oslo-db";
-  version = "14.1.0";
+  version = "15.0.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "oslo.db";
     inherit version;
-    hash = "sha256-UFilywqwhXaGnle8K5VNdZqMvhklkTMdHPMDMvz62h8=";
+    hash = "sha256-6QJDUgX1xQtw7mNYY8i06lS9Hr4ABpXAZeMN1C2Xb/o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/oslo-serialization/default.nix b/pkgs/development/python-modules/oslo-serialization/default.nix
index 9a3677ccfd6d..1399503c0f9d 100644
--- a/pkgs/development/python-modules/oslo-serialization/default.nix
+++ b/pkgs/development/python-modules/oslo-serialization/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "oslo-serialization";
-  version = "5.3.0";
+  version = "5.4.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "oslo.serialization";
     inherit version;
-    hash = "sha256-IoiY9PM7feq8dCibMrvTAqZZw5z23akEhRD5MPxPdu0=";
+    hash = "sha256-MVyzRl6ZxoXLCRuQNly3Ab7nFA4gS6Pl/C2KILTsbnY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/phx-class-registry/default.nix b/pkgs/development/python-modules/phx-class-registry/default.nix
index 465197a15618..0997f7987ada 100644
--- a/pkgs/development/python-modules/phx-class-registry/default.nix
+++ b/pkgs/development/python-modules/phx-class-registry/default.nix
@@ -29,6 +29,6 @@ buildPythonPackage rec {
     description = "Factory and registry pattern for Python classes";
     homepage = "https://class-registry.readthedocs.io/en/latest/";
     license = licenses.mit;
-    maintainers = with maintainers; [ kevincox ];
+    maintainers = with maintainers; [ hrdinka tomhoule ];
   };
 }
diff --git a/pkgs/development/python-modules/systembridgeconnector/default.nix b/pkgs/development/python-modules/systembridgeconnector/default.nix
index c1b734bcbda9..bb3a714d68a9 100644
--- a/pkgs/development/python-modules/systembridgeconnector/default.nix
+++ b/pkgs/development/python-modules/systembridgeconnector/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "systembridgeconnector";
-  version = "4.0.1";
+  version = "4.0.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "timmo001";
     repo = "system-bridge-connector";
     rev = "refs/tags/${version}";
-    hash = "sha256-dMOhw7e2sCmGItsgGcGxYVCIJM2FBm6IyxIQXPtY+Pg=";
+    hash = "sha256-CbLm2CHofgtaTHuGDexVEKmy8+ovvvGJOO3iiAimLTg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yalexs-ble/default.nix b/pkgs/development/python-modules/yalexs-ble/default.nix
index b32403a6a97d..93a16ea29f9b 100644
--- a/pkgs/development/python-modules/yalexs-ble/default.nix
+++ b/pkgs/development/python-modules/yalexs-ble/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "yalexs-ble";
-  version = "2.4.1";
+  version = "2.4.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-u6Mhqt6DcPiini8EvtqKoVAYUwb31hvWfCNb/sbqvWQ=";
+    hash = "sha256-A/4N3vmFuzg9vaPISs0P3KxRQZSquPpR1zYcYEePkTA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/yalexs/default.nix b/pkgs/development/python-modules/yalexs/default.nix
index 52ffe95c057a..da40d098dfb9 100644
--- a/pkgs/development/python-modules/yalexs/default.nix
+++ b/pkgs/development/python-modules/yalexs/default.nix
@@ -13,22 +13,33 @@
 , pythonOlder
 , requests
 , requests-mock
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "yalexs";
-  version = "1.11.2";
-  format = "setuptools";
+  version = "1.11.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "bdraco";
-    repo = pname;
+    repo = "yalexs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FHaHXbRtgbBrveHPbrPsP+vGIvscot3ilpPFucISces=";
+    hash = "sha256-BO+tgRHQsvRkkueIHa56YABfK5+QqnRlGrRtNHqI1v4=";
   };
 
+  postPatch = ''
+    # Not used requirement
+    substituteInPlace setup.py \
+      --replace-fail '"vol",' ""
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     aiofiles
     aiohttp
@@ -49,12 +60,6 @@ buildPythonPackage rec {
     requests-mock
   ];
 
-  postPatch = ''
-    # Not used requirement
-    substituteInPlace setup.py \
-      --replace '"vol",' ""
-  '';
-
   pythonImportsCheck = [
     "yalexs"
   ];
diff --git a/pkgs/development/tools/backblaze-b2/default.nix b/pkgs/development/tools/backblaze-b2/default.nix
index e82c32940891..708fbb23c80e 100644
--- a/pkgs/development/tools/backblaze-b2/default.nix
+++ b/pkgs/development/tools/backblaze-b2/default.nix
@@ -94,6 +94,6 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/Backblaze/B2_Command_Line_Tool";
     changelog = "https://github.com/Backblaze/B2_Command_Line_Tool/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ hrdinka kevincox tomhoule ];
+    maintainers = with maintainers; [ hrdinka tomhoule ];
   };
 }
diff --git a/pkgs/development/tools/packet-sd/default.nix b/pkgs/development/tools/packet-sd/default.nix
index a1418df2cc3a..5fcd486119fe 100644
--- a/pkgs/development/tools/packet-sd/default.nix
+++ b/pkgs/development/tools/packet-sd/default.nix
@@ -27,6 +27,11 @@ buildGoModule rec {
       url = "https://github.com/packethost/prometheus-packet-sd/commit/a0afc2a4c3f49dc234d0d2c4901df25b4110b3ec.patch";
       hash = "sha256-M5133+r77z21/Ulnbz+9sGbbuY5UpU1+22iY464UVAU=";
     })
+    (fetchpatch2 {
+      # apply chmod to tmpfile, not the outfile, that does not exist at that point
+      url = "https://github.com/packethost/prometheus-packet-sd/commit/41977f11b449677497a93456c499916c68e56334.patch";
+      hash = "sha256-ffXxbwatKBw7G1fdmsZaT7WX4OmYFMJnueL/kEKc1VE=";
+    })
   ];
 
   vendorHash = null;
diff --git a/pkgs/development/tools/rust/cargo-audit/default.nix b/pkgs/development/tools/rust/cargo-audit/default.nix
index 953368575c58..a1268e9fb318 100644
--- a/pkgs/development/tools/rust/cargo-audit/default.nix
+++ b/pkgs/development/tools/rust/cargo-audit/default.nix
@@ -12,14 +12,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-audit";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-NPRtSoITOS9i/v9hgdULVSmLaFbXZZeoO4SdqqANDxk=";
+    hash = "sha256-hzy+AVWGWzWYupllrLSryoi4rXPM0+G6WBlRbf03xA8=";
   };
 
-  cargoHash = "sha256-cQ2ZEZJ7PgNUxzZXR9Of1R5v2wu1b3xOlENu1DZU/rQ=";
+  cargoHash = "sha256-OOkJGdqEHNVbgZZIjQupGaSs4tB52b7kPGLKELUocn4=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/rust/cargo-tally/default.nix b/pkgs/development/tools/rust/cargo-tally/default.nix
index 0d4218198233..cac76677c331 100644
--- a/pkgs/development/tools/rust/cargo-tally/default.nix
+++ b/pkgs/development/tools/rust/cargo-tally/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tally";
-  version = "1.0.38";
+  version = "1.0.39";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-OPl0/HhVMFp4EDEjBDjqVF5LGbz1T+0j/OiF8emHLxc=";
+    hash = "sha256-7YUS+MaUmZ9dopeailASZQdmJiyVLwdXV0agA1upXsE=";
   };
 
-  cargoHash = "sha256-Agdzm2uNJH59S+ok0AG3sYTs6tSEDoBgYEBXvgkNj0U=";
+  cargoHash = "sha256-eEfuFYl949Ps9cstO61j4GTdMHk2SjpRpWxK4onTgfw=";
 
   buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk_11_0.frameworks; [
     DiskArbitration
diff --git a/pkgs/development/tools/rust/probe-rs/default.nix b/pkgs/development/tools/rust/probe-rs/default.nix
index 90ab81e4ddde..cb26888f1b05 100644
--- a/pkgs/development/tools/rust/probe-rs/default.nix
+++ b/pkgs/development/tools/rust/probe-rs/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "probe-rs";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7bWx6ZILqdSDY/q51UP/BuCgMH0F4ePMSnclHeF2DY4=";
+    hash = "sha256-5V7eLnukVAcOSX52myvaTlDbemGp6mDaWrQc3w4P5MI=";
   };
 
-  cargoHash = "sha256-ynmKmXQrUnTcmo0S7FO+l/9EPuzgLCdUOPLuwoG4pbU=";
+  cargoHash = "sha256-sZl4FhaKIMJe7v5AAIM2w7M8Ev7vCht3owkvt0UhOu8=";
 
   cargoBuildFlags = [ "--features=cli" ];
 
diff --git a/pkgs/development/web/bun/default.nix b/pkgs/development/web/bun/default.nix
index 40828aa1909e..916f125dcc49 100644
--- a/pkgs/development/web/bun/default.nix
+++ b/pkgs/development/web/bun/default.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.0.28";
+  version = "1.0.29";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -51,19 +51,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-kw39m8zD1f4uGjs2r/J2j8YbjbKDjZmFWxzf/x81poM=";
+        hash = "sha256-tcrFHzGJkpVDkrEUff6OR4i76E2+dmYIXuwJ3BiNvQc=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-eJr3mWusSNrDqPHV5PwVsfGK4o57XDsBHozpPJE7HsU=";
+        hash = "sha256-ujiVw1Pemlo+OHPj8JtazNzYVziq8a65mYdXcS5ViL4=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64.zip";
-        hash = "sha256-qkVy1w+MrlBplX0CLuW0yufnZ/+ETkJPSm/91KpAR+c=";
+        hash = "sha256-rY9VixMXgn8E2NzZpJg873eADM9ZnJnAkdAVnj91S2o=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-a9upDXwlgmvF99ulUplrscWrsGp/7AsLTfx1FPYY41s=";
+        hash = "sha256-mhDFX6Z1UFGXLqDbUAt8TP/8Ejavzu+WdFGayrtS2Ns=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 2051368a49f6..1868f6b2af1b 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -34,8 +34,7 @@ targetHost=
 remoteSudo=
 verboseScript=
 noFlake=
-# comma separated list of vars to preserve when using sudo
-preservedSudoVars=NIXOS_INSTALL_BOOTLOADER
+installBootloader=
 json=
 
 # log the given argument to stderr
@@ -57,10 +56,10 @@ while [ "$#" -gt 0 ]; do
         ;;
       --install-grub)
         log "$0: --install-grub deprecated, use --install-bootloader instead"
-        export NIXOS_INSTALL_BOOTLOADER=1
+        installBootloader=1
         ;;
       --install-bootloader)
-        export NIXOS_INSTALL_BOOTLOADER=1
+        installBootloader=1
         ;;
       --no-build-nix)
         buildNix=
@@ -157,8 +156,6 @@ while [ "$#" -gt 0 ]; do
     esac
 done
 
-sudoCommand=(sudo --preserve-env="$preservedSudoVars" --)
-
 if [[ -n "$SUDO_USER" ]]; then
     useSudo=1
 fi
@@ -179,7 +176,7 @@ runCmd() {
 buildHostCmd() {
     local c
     if [[ "${useSudo:-x}" = 1 ]]; then
-        c=("${sudoCommand[@]}")
+        c=("sudo")
     else
         c=()
     fi
@@ -196,7 +193,7 @@ buildHostCmd() {
 targetHostCmd() {
     local c
     if [[ "${useSudo:-x}" = 1 ]]; then
-        c=("${sudoCommand[@]}")
+        c=("sudo")
     else
         c=()
     fi
@@ -756,7 +753,7 @@ if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" =
     cmd=(
         "systemd-run"
         "-E" "LOCALE_ARCHIVE" # Will be set to new value early in switch-to-configuration script, but interpreter starts out with old value
-        "-E" "NIXOS_INSTALL_BOOTLOADER"
+        "-E" "NIXOS_INSTALL_BOOTLOADER=$installBootloader"
         "--collect"
         "--no-ask-password"
         "--pty"
@@ -774,14 +771,14 @@ if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" =
     # may be dangerous in remote access (e.g. SSH).
     if [[ -n "$NIXOS_SWITCH_USE_DIRTY_ENV" ]]; then
         log "warning: skipping systemd-run since NIXOS_SWITCH_USE_DIRTY_ENV is set. This environment variable will be ignored in the future"
-        cmd=()
+        cmd=("env" "NIXOS_INSTALL_BOOTLOADER=$installBootloader")
     elif ! targetHostSudoCmd "${cmd[@]}" true; then
         logVerbose "Skipping systemd-run to switch configuration since it is not working in target host."
         cmd=(
             "env"
             "-i"
             "LOCALE_ARCHIVE=$LOCALE_ARCHIVE"
-            "NIXOS_INSTALL_BOOTLOADER=$NIXOS_INSTALL_BOOTLOADER"
+            "NIXOS_INSTALL_BOOTLOADER=$installBootloader"
         )
     else
         logVerbose "Using systemd-run to switch configuration."
diff --git a/pkgs/servers/nosql/mongodb/4.4.nix b/pkgs/servers/nosql/mongodb/4.4.nix
index 25298d55bdd2..933e9136aee0 100644
--- a/pkgs/servers/nosql/mongodb/4.4.nix
+++ b/pkgs/servers/nosql/mongodb/4.4.nix
@@ -6,8 +6,8 @@ let
   };
 in
 buildMongoDB {
-  version = "4.4.27";
-  sha256 = "sha256-HcTI/0igzCR5g8Wai5zKEuK3BjFrpRP/9GwZh5wqmtc=";
+  version = "4.4.28";
+  sha256 = "sha256-aq4dJl2FOTOhQ3bzVj0L/0CE3obE7lCx2ecjGNYC8X4=";
   patches = [
     ./forget-build-dependencies-4-4.patch
     ./fix-build-with-boost-1.79-4_4.patch
diff --git a/pkgs/servers/web-apps/matomo/default.nix b/pkgs/servers/web-apps/matomo/default.nix
index 374c1bff3555..383a8658c521 100644
--- a/pkgs/servers/web-apps/matomo/default.nix
+++ b/pkgs/servers/web-apps/matomo/default.nix
@@ -3,8 +3,8 @@
 let
   versions = {
     matomo = {
-      version = "4.16.0";
-      hash = "sha256-OFZT4195WTWw2XNAyGiNixW6hSNKC3IyBpa5kM9PCVk=";
+      version = "4.16.1";
+      hash = "sha256-cGnsxfpvt7FyhxFcA2/gWWe7CyanVGZVKtCDES3XLdI=";
     };
     matomo_5 = {
       version = "5.0.2";
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index 02c18ac3a092..268cb68b4dc2 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -19,14 +19,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2024.2.0";
+  version = "2024.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-k8caA5Q4QcP7H1Nn5yvFsfExVwipAlFSb/DphkzYNtU=";
+    hash = "sha256-MAyK8Wx/d7lJKEueeL7GhxxKu8EygwjylPGXB2Y3bWM=";
   };
 
   nativeBuildInputs = with python.pkgs; [
diff --git a/pkgs/tools/misc/ollama/default.nix b/pkgs/tools/misc/ollama/default.nix
index 6ce576644d49..32b7f5fcbfc3 100644
--- a/pkgs/tools/misc/ollama/default.nix
+++ b/pkgs/tools/misc/ollama/default.nix
@@ -8,6 +8,7 @@
 , makeWrapper
 , stdenv
 
+, pkgs
 , cmake
 , gcc12
 , clblast
@@ -17,98 +18,21 @@
 , linuxPackages
 , darwin
 
-, enableRocm ? false
-, enableCuda ? false
+  # one of `[ null "rocm" "cuda" ]`
+, acceleration ? null
 }:
 
 let
   pname = "ollama";
-  version = "0.1.24";
+  version = "0.1.26";
 
-  warnIfNotLinux = warning: (lib.warnIfNot stdenv.isLinux warning stdenv.isLinux);
-  gpuWarning = api: "building ollama with ${api} is only supported on linux; falling back to cpu";
-  rocmIsEnabled = enableRocm && (warnIfNotLinux (gpuWarning "rocm"));
-  cudaIsEnabled = enableCuda && (warnIfNotLinux (gpuWarning "cuda"));
-  enableLinuxGpu = rocmIsEnabled || cudaIsEnabled;
-
-  appleFrameworks = darwin.apple_sdk_11_0.frameworks;
-  metalFrameworks = [
-    appleFrameworks.Accelerate
-    appleFrameworks.Metal
-    appleFrameworks.MetalKit
-    appleFrameworks.MetalPerformanceShaders
-  ];
-
-  src = fetchFromGitHub {
-    owner = "jmorganca";
-    repo = "ollama";
-    rev = "v${version}";
-    hash = "sha256-GwZA1QUH8I8m2bGToIcMMaB5MBnioQP4+n1SauUJYP8=";
-    fetchSubmodules = true;
-  };
-  preparePatch = patch: hash: fetchpatch {
-    url = "file://${src}/llm/patches/${patch}";
-    inherit hash;
-    stripLen = 1;
-    extraPrefix = "llm/llama.cpp/";
-  };
-  inherit (lib) licenses platforms maintainers;
-  ollama = {
-    inherit pname version src;
-    vendorHash = "sha256-wXRbfnkbeXPTOalm7SFLvHQ9j46S/yLNbFy+OWNSamQ=";
-
-    nativeBuildInputs = [
-      cmake
-    ] ++ lib.optionals enableLinuxGpu [
-      makeWrapper
-    ] ++ lib.optionals stdenv.isDarwin
-      metalFrameworks;
-
-    patches = [
-      # remove uses of `git` in the `go generate` script
-      # instead use `patch` where necessary
-      ./remove-git.patch
-      # replace a hardcoded use of `g++` with `$CXX`
-      ./replace-gcc.patch
-
-      # ollama's patches of llama.cpp's example server
-      # `ollama/llm/generate/gen_common.sh` -> "apply temporary patches until fix is upstream"
-      (preparePatch "01-cache.diff" "sha256-PC4yN98hFvK+PEITiDihL8ki3bJuLVXrAm0CGf8GPJE=")
-      (preparePatch "02-shutdown.diff" "sha256-cElAp9Z9exxN964vB/YFuBhZoEcoAwGSMCnbh+l/V4Q=")
-    ];
-    postPatch = ''
-      # use a patch from the nix store in the `go generate` script
-      substituteInPlace llm/generate/gen_common.sh \
-        --subst-var-by cmakeIncludePatch '${./cmake-include.patch}'
-      # `ollama/llm/generate/gen_common.sh` -> "avoid duplicate main symbols when we link into the cgo binary"
-      substituteInPlace llm/llama.cpp/examples/server/server.cpp \
-        --replace-fail 'int main(' 'int __main('
-      # replace inaccurate version number with actual release version
-      substituteInPlace version/version.go --replace-fail 0.0.0 '${version}'
-    '';
-    preBuild = ''
-      export OLLAMA_SKIP_PATCHING=true
-      # build llama.cpp libraries for ollama
-      go generate ./...
-    '';
-
-    ldflags = [
-      "-s"
-      "-w"
-      "-X=github.com/jmorganca/ollama/version.Version=${version}"
-      "-X=github.com/jmorganca/ollama/server.mode=release"
-    ];
-
-    meta = {
-      description = "Get up and running with large language models locally";
-      homepage = "https://github.com/jmorganca/ollama";
-      license = licenses.mit;
-      platforms = platforms.unix;
-      mainProgram = "ollama";
-      maintainers = with maintainers; [ abysssol dit7ya elohmeier ];
-    };
-  };
+  validAccel = lib.assertOneOf "ollama.acceleration" acceleration [ null "rocm" "cuda" ];
 
+  warnIfNotLinux = api: (lib.warnIfNot stdenv.isLinux
+    "building ollama with `${api}` is only supported on linux; falling back to cpu"
+    stdenv.isLinux);
+  enableRocm = validAccel && (acceleration == "rocm") && (warnIfNotLinux "rocm");
+  enableCuda = validAccel && (acceleration == "cuda") && (warnIfNotLinux "cuda");
 
   rocmClang = linkFarm "rocm-clang" {
     llvm = rocmPackages.llvm.clang;
@@ -120,10 +44,6 @@ let
       rocmClang
     ];
   };
-  rocmVars = {
-    ROCM_PATH = rocmPath;
-    CLBlast_DIR = "${clblast}/lib/cmake/CLBlast";
-  };
 
   cudaToolkit = buildEnv {
     name = "cuda-toolkit";
@@ -133,50 +53,129 @@ let
       cudaPackages.cuda_cudart
     ];
   };
-  cudaVars = {
-    CUDA_LIB_DIR = "${cudaToolkit}/lib";
-    CUDACXX = "${cudaToolkit}/bin/nvcc";
-    CUDAToolkit_ROOT = cudaToolkit;
-  };
-
-  linuxGpuLibs = {
-    buildInputs = lib.optionals rocmIsEnabled [
-      rocmPackages.clr
-      rocmPackages.hipblas
-      rocmPackages.rocblas
-      rocmPackages.rocsolver
-      rocmPackages.rocsparse
-      libdrm
-    ] ++ lib.optionals cudaIsEnabled [
-      cudaPackages.cuda_cudart
-    ];
-  };
-
-  appleGpuLibs = { buildInputs = metalFrameworks; };
 
-  runtimeLibs = lib.optionals rocmIsEnabled [
+  runtimeLibs = lib.optionals enableRocm [
     rocmPackages.rocm-smi
-  ] ++ lib.optionals cudaIsEnabled [
+  ] ++ lib.optionals enableCuda [
     linuxPackages.nvidia_x11
   ];
-  runtimeLibWrapper = {
-    postFixup = ''
-      mv "$out/bin/${pname}" "$out/bin/.${pname}-unwrapped"
-      makeWrapper "$out/bin/.${pname}-unwrapped" "$out/bin/${pname}" \
-        --suffix LD_LIBRARY_PATH : '${lib.makeLibraryPath runtimeLibs}'
-    '';
-  };
+
+  appleFrameworks = darwin.apple_sdk_11_0.frameworks;
+  metalFrameworks = [
+    appleFrameworks.Accelerate
+    appleFrameworks.Metal
+    appleFrameworks.MetalKit
+    appleFrameworks.MetalPerformanceShaders
+  ];
+
 
   goBuild =
-    if cudaIsEnabled then
+    if enableCuda then
       buildGoModule.override { stdenv = overrideCC stdenv gcc12; }
     else
       buildGoModule;
+
+  src = fetchFromGitHub {
+    owner = "jmorganca";
+    repo = "ollama";
+    rev = "v${version}";
+    hash = "sha256-Kw3tt9ayEMgI2V6OeaOkWfNwqfCL7MDD/nN5iXk5LnY=";
+    fetchSubmodules = true;
+  };
+  preparePatch = patch: hash: fetchpatch {
+    url = "file://${src}/llm/patches/${patch}";
+    inherit hash;
+    stripLen = 1;
+    extraPrefix = "llm/llama.cpp/";
+  };
+  inherit (lib) licenses platforms maintainers;
 in
-goBuild (ollama
-  // (lib.optionalAttrs rocmIsEnabled rocmVars)
-  // (lib.optionalAttrs cudaIsEnabled cudaVars)
-  // (lib.optionalAttrs enableLinuxGpu linuxGpuLibs)
-  // (lib.optionalAttrs enableLinuxGpu runtimeLibWrapper)
+goBuild ((lib.optionalAttrs enableRocm {
+  ROCM_PATH = rocmPath;
+  CLBlast_DIR = "${clblast}/lib/cmake/CLBlast";
+}) // (lib.optionalAttrs enableCuda {
+  CUDA_LIB_DIR = "${cudaToolkit}/lib";
+  CUDACXX = "${cudaToolkit}/bin/nvcc";
+  CUDAToolkit_ROOT = cudaToolkit;
+}) // {
+  inherit pname version src;
+  vendorHash = "sha256-zTrBighPBqZ9hhkEV3UawJZUYyPRay7+P6wkhDtpY7M=";
+
+  nativeBuildInputs = [
+    cmake
+  ] ++ lib.optionals (enableRocm || enableCuda) [
+    makeWrapper
+  ] ++ lib.optionals stdenv.isDarwin
+    metalFrameworks;
+
+  buildInputs = lib.optionals enableRocm [
+    rocmPackages.clr
+    rocmPackages.hipblas
+    rocmPackages.rocblas
+    rocmPackages.rocsolver
+    rocmPackages.rocsparse
+    libdrm
+  ] ++ lib.optionals enableCuda [
+    cudaPackages.cuda_cudart
+  ] ++ lib.optionals stdenv.isDarwin
+    metalFrameworks;
+
+  patches = [
+    # remove uses of `git` in the `go generate` script
+    # instead use `patch` where necessary
+    ./remove-git.patch
+    # replace a hardcoded use of `g++` with `$CXX`
+    ./replace-gcc.patch
+
+    # ollama's patches of llama.cpp's example server
+    # `ollama/llm/generate/gen_common.sh` -> "apply temporary patches until fix is upstream"
+    (preparePatch "01-cache.diff" "sha256-MTTln2G0G8dntihUzEjPM1ruTsApb4ZToBczJb8EG68=")
+    (preparePatch "02-cudaleaks.diff" "sha256-Cu7E9iEcvddPL9mPPI5Z96qmwWigi3f0WgSpPRjGc88=")
+  ];
+  postPatch = ''
+    # use a patch from the nix store in the `go generate` script
+    substituteInPlace llm/generate/gen_common.sh \
+      --subst-var-by cmakeIncludePatch '${./cmake-include.patch}'
+    # `ollama/llm/generate/gen_common.sh` -> "avoid duplicate main symbols when we link into the cgo binary"
+    substituteInPlace llm/llama.cpp/examples/server/server.cpp \
+      --replace-fail 'int main(' 'int __main('
+    # replace inaccurate version number with actual release version
+    substituteInPlace version/version.go --replace-fail 0.0.0 '${version}'
+  '';
+  preBuild = ''
+    export OLLAMA_SKIP_PATCHING=true
+    # build llama.cpp libraries for ollama
+    go generate ./...
+  '';
+  postFixup = ''
+    # the app doesn't appear functional at the moment, so hide it
+    mv "$out/bin/app" "$out/bin/.ollama-app"
+  '' + lib.optionalString (enableRocm || enableCuda) ''
+    # expose runtime libraries necessary to use the gpu
+    mv "$out/bin/ollama" "$out/bin/.ollama-unwrapped"
+    makeWrapper "$out/bin/.ollama-unwrapped" "$out/bin/ollama" \
+      --suffix LD_LIBRARY_PATH : '/run/opengl-driver/lib:${lib.makeLibraryPath runtimeLibs}'
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/jmorganca/ollama/version.Version=${version}"
+    "-X=github.com/jmorganca/ollama/server.mode=release"
+  ];
 
-  // (lib.optionalAttrs stdenv.isDarwin appleGpuLibs))
+  # for now, just test that rocm and cuda build
+  passthru.tests = lib.optionalAttrs stdenv.isLinux {
+    rocm = pkgs.ollama.override { acceleration = "rocm"; };
+    cuda = pkgs.ollama.override { acceleration = "cuda"; };
+  };
+
+  meta = {
+    description = "Get up and running with large language models locally";
+    homepage = "https://github.com/jmorganca/ollama";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    mainProgram = "ollama";
+    maintainers = with maintainers; [ abysssol dit7ya elohmeier ];
+  };
+})
diff --git a/pkgs/tools/security/hcxtools/default.nix b/pkgs/tools/security/hcxtools/default.nix
index df7695276c2a..1d52561e1888 100644
--- a/pkgs/tools/security/hcxtools/default.nix
+++ b/pkgs/tools/security/hcxtools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hcxtools";
-  version = "6.3.2";
+  version = "6.3.4";
 
   src = fetchFromGitHub {
     owner = "ZerBea";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ZEkuWGt2PGkFW1RXCyrUiew92N4ov35mMObHk1xD6uM=";
+    sha256 = "sha256-03NPzSThmUPAEg5dBr2QkwaXPgGeu/lEe9nqhY8EkyA=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/wayland/hyprland-per-window-layout/default.nix b/pkgs/tools/wayland/hyprland-per-window-layout/default.nix
index 81671f46ed5b..03f911e4f899 100644
--- a/pkgs/tools/wayland/hyprland-per-window-layout/default.nix
+++ b/pkgs/tools/wayland/hyprland-per-window-layout/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprland-per-window-layout";
-  version = "2.7";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "coffebar";
     repo = pname;
     rev = version;
-    hash = "sha256-Tci3OR7c8hEWAnFsBlSNZYt7znAxPRDhJV+1q7fw6z8=";
+    hash = "sha256-a1x22+f7VXkPC36/muauac0+mz2Bcr01TFWf+sGHH/g=";
   };
 
-  cargoHash = "sha256-lVNephJ6UfdM6dPnHs+jHG9A79qHEsrm7tcjcDralnY=";
+  cargoHash = "sha256-R79ztYRLokGc4wQnoJeKsY/4EuCGuhdqBhBQVstY2gU=";
 
   meta = with lib; {
     description = "Per window keyboard layout (language) for Hyprland wayland compositor";
diff --git a/pkgs/tools/wayland/wlogout/default.nix b/pkgs/tools/wayland/wlogout/default.nix
index 2be33bee6ac0..96cabcc38e87 100644
--- a/pkgs/tools/wayland/wlogout/default.nix
+++ b/pkgs/tools/wayland/wlogout/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wlogout";
-  version = "1.1.1";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "ArtsyMacaw";
     repo = "wlogout";
     rev = version;
-    sha256 = "cTscfx+erHVFHwwYpN7pADQWt5sq75sQSyXSP/H8kOs=";
+    hash = "sha256-xeTO8MBUrvcVA7WTRY7OhaVGInijuvXsVYEax8JmMZ0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5e2f6504e4b4..71530f1fdf7d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1732,7 +1732,7 @@ with pkgs;
 
   btc-rpc-explorer = callPackage ../tools/misc/btc-rpc-explorer { };
 
-  butler = callPackage ../games/itch/butler.nix {
+  butler = callPackage ../by-name/bu/butler/package.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
     buildGoModule = buildGo120Module;
   };
@@ -3977,8 +3977,6 @@ with pkgs;
 
   ipp-usb = callPackage ../os-specific/linux/ipp-usb { };
 
-  itch = callPackage ../games/itch { };
-
   itchiodl = callPackage ../games/itchiodl { };
 
   itd = callPackage ../applications/misc/itd { };
@@ -13747,8 +13745,6 @@ with pkgs;
 
   teler = callPackage ../tools/security/teler { };
 
-  telescope = callPackage ../applications/networking/browsers/telescope { };
-
   termcolor = callPackage ../development/libraries/termcolor { };
 
   termscp = callPackage ../tools/networking/termscp {
@@ -30890,7 +30886,7 @@ with pkgs;
   dnglab = callPackage ../tools/graphics/dnglab { };
 
   inherit (callPackage ../applications/virtualization/docker {})
-    docker_20_10 docker_24;
+    docker_20_10 docker_24 docker_25;
 
   docker = docker_24;
   docker-client = docker.override { clientOnly = true; };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3bd7e9174ad6..34429a93a025 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2669,7 +2669,7 @@ self: super: with self; {
   datadog = callPackage ../development/python-modules/datadog { };
 
   datafusion = callPackage ../development/python-modules/datafusion {
-    inherit (pkgs.darwin.apple_sdk.frameworks) Security;
+    inherit (pkgs.darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
   datamodeldict = callPackage ../development/python-modules/datamodeldict { };