about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/build-helpers/images/dockertools.section.md206
-rw-r--r--doc/build-helpers/trivial-build-helpers.chapter.md13
-rw-r--r--doc/languages-frameworks/beam.section.md2
-rw-r--r--doc/languages-frameworks/haskell.section.md62
-rw-r--r--doc/preface.chapter.md12
-rw-r--r--lib/fileset/internal.nix19
-rwxr-xr-xlib/fileset/tests.sh13
-rw-r--r--maintainers/maintainer-list.nix27
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md7
-rw-r--r--nixos/modules/security/pam.nix3
-rw-r--r--nixos/modules/security/wrappers/wrapper.c7
-rw-r--r--nixos/modules/services/misc/paperless.nix24
-rw-r--r--nixos/modules/services/monitoring/prometheus/exporters.nix1
-rw-r--r--nixos/modules/services/monitoring/prometheus/exporters/restic.nix131
-rw-r--r--nixos/modules/services/monitoring/prometheus/exporters/snmp.nix1
-rw-r--r--nixos/modules/services/web-apps/photoprism.nix3
-rw-r--r--nixos/modules/services/web-apps/youtrack.md30
-rw-r--r--nixos/modules/services/web-apps/youtrack.nix237
-rw-r--r--nixos/modules/system/boot/networkd.nix6
-rw-r--r--nixos/tests/prometheus-exporters.nix40
-rw-r--r--pkgs/applications/audio/bristol/default.nix30
-rw-r--r--pkgs/applications/audio/grandorgue/default.nix31
-rw-r--r--pkgs/applications/audio/polyphone/default.nix5
-rw-r--r--pkgs/applications/emulators/mame/default.nix4
-rw-r--r--pkgs/applications/graphics/lazpaint/default.nix35
-rw-r--r--pkgs/applications/misc/avrdudess/default.nix6
-rw-r--r--pkgs/applications/misc/goldendict-ng/default.nix9
-rw-r--r--pkgs/applications/misc/monitorcontrol/default.nix19
-rw-r--r--pkgs/applications/misc/opencpn/default.nix39
-rw-r--r--pkgs/applications/misc/organicmaps/default.nix4
-rw-r--r--pkgs/applications/misc/prusa-slicer/default.nix4
-rw-r--r--pkgs/applications/misc/pure-maps/default.nix4
-rw-r--r--pkgs/applications/misc/remarkable/restream/default.nix6
-rw-r--r--pkgs/applications/misc/sway-contrib/default.nix21
-rw-r--r--pkgs/applications/misc/tippecanoe/default.nix4
-rw-r--r--pkgs/applications/misc/xcruiser/default.nix14
-rw-r--r--pkgs/applications/networking/browsers/brave/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/cilium/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kubergrunt/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/nerdctl/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/tilt/assets.nix2
-rw-r--r--pkgs/applications/networking/cluster/tilt/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/armcord/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/element/pin.nix10
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix4
-rw-r--r--pkgs/applications/networking/ipfs-cluster/default.nix6
-rw-r--r--pkgs/applications/networking/mailreaders/aerc/default.nix6
-rw-r--r--pkgs/applications/office/jameica/default.nix6
-rw-r--r--pkgs/applications/office/libreoffice/darwin/default.nix1
-rw-r--r--pkgs/applications/office/paperless-ngx/default.nix2
-rw-r--r--pkgs/applications/office/treesheets/default.nix6
-rw-r--r--pkgs/applications/science/biology/igv/default.nix11
-rw-r--r--pkgs/applications/science/logic/lean4/default.nix21
-rw-r--r--pkgs/applications/science/logic/z3/default.nix4
-rw-r--r--pkgs/applications/science/misc/boinc/default.nix4
-rw-r--r--pkgs/applications/science/misc/gplates/default.nix2
-rw-r--r--pkgs/applications/science/misc/root/default.nix12
-rw-r--r--pkgs/applications/science/molecular-dynamics/gromacs/default.nix4
-rw-r--r--pkgs/applications/version-management/forgejo/default.nix8
-rw-r--r--pkgs/applications/version-management/gh/default.nix6
-rw-r--r--pkgs/applications/version-management/git-publish/default.nix4
-rw-r--r--pkgs/applications/version-management/gitea/default.nix4
-rw-r--r--pkgs/applications/virtualization/containerd/default.nix4
-rw-r--r--pkgs/applications/virtualization/docker/compose.nix6
-rw-r--r--pkgs/applications/virtualization/runc/default.nix4
-rw-r--r--pkgs/build-support/fetchgithub/default.nix6
-rw-r--r--pkgs/build-support/testers/hasPkgConfigModules/tester.nix4
-rw-r--r--pkgs/build-support/trivial-builders/default.nix127
-rw-r--r--pkgs/build-support/trivial-builders/test/writeShellApplication.nix152
-rw-r--r--pkgs/by-name/aa/aaaaxy/package.nix6
-rw-r--r--pkgs/by-name/al/alsa-lib-with-plugins/package.nix52
-rw-r--r--pkgs/by-name/am/amazon-ssm-agent/package.nix4
-rw-r--r--pkgs/by-name/as/ast-grep/package.nix6
-rw-r--r--pkgs/by-name/au/authentik/ldap.nix18
-rw-r--r--pkgs/by-name/au/authentik/outposts.nix5
-rw-r--r--pkgs/by-name/au/authentik/package.nix254
-rw-r--r--pkgs/by-name/bi/bitbake-language-server/package.nix4
-rw-r--r--pkgs/by-name/bo/boxed-cpp/package.nix4
-rw-r--r--pkgs/by-name/ca/cargo-xwin/package.nix6
-rw-r--r--pkgs/by-name/co/cosmic-edit/Cargo.lock195
-rw-r--r--pkgs/by-name/co/cosmic-edit/package.nix39
-rw-r--r--pkgs/by-name/ei/eigenlayer/package.nix4
-rw-r--r--pkgs/by-name/ez/eza/package.nix6
-rw-r--r--pkgs/by-name/fo/fortune-kind/package.nix6
-rw-r--r--pkgs/by-name/ga/galerio/package.nix23
-rw-r--r--pkgs/by-name/ge/geist-font/package.nix43
-rw-r--r--pkgs/by-name/in/incus-unwrapped/package.nix17
-rw-r--r--pkgs/by-name/in/invidtui/package.nix6
-rw-r--r--pkgs/by-name/le/legba/package.nix6
-rw-r--r--pkgs/by-name/li/lint-staged/package.nix6
-rw-r--r--pkgs/by-name/ni/nixfmt-rfc-style/date.txt2
-rw-r--r--pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix4
-rw-r--r--pkgs/by-name/no/nomnatong/package.nix4
-rw-r--r--pkgs/by-name/ot/oterm/package.nix4
-rw-r--r--pkgs/by-name/pd/pdfannots2json/package.nix25
-rw-r--r--pkgs/by-name/pr/presenterm/package.nix7
-rw-r--r--pkgs/by-name/pr/prometheus-restic-exporter/package.nix49
-rw-r--r--pkgs/by-name/pu/pupdate/package.nix4
-rw-r--r--pkgs/by-name/re/renode-unstable/package.nix4
-rw-r--r--pkgs/by-name/sh/shopware-cli/package.nix6
-rw-r--r--pkgs/by-name/ti/tigerbeetle/package.nix4
-rw-r--r--pkgs/by-name/ui/uiua/package.nix10
-rw-r--r--pkgs/by-name/ux/uxn/package.nix6
-rw-r--r--pkgs/by-name/wh/whistle/package.nix6
-rw-r--r--pkgs/by-name/xs/xscreensaver/package.nix3
-rw-r--r--pkgs/by-name/yo/youplot/Gemfile2
-rw-r--r--pkgs/by-name/yo/youplot/Gemfile.lock18
-rw-r--r--pkgs/by-name/yo/youplot/gemset.nix34
-rw-r--r--pkgs/by-name/yo/youplot/package.nix19
-rw-r--r--pkgs/by-name/yo/youtrack/package.nix43
-rwxr-xr-xpkgs/by-name/yo/youtrack/update.sh9
-rw-r--r--pkgs/by-name/yo/youtrack_2022_3/package.nix (renamed from pkgs/servers/jetbrains/youtrack.nix)14
-rw-r--r--pkgs/data/fonts/kode-mono/default.nix4
-rw-r--r--pkgs/data/icons/papirus-icon-theme/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/nautilus/default.nix1
-rw-r--r--pkgs/development/compilers/circt/default.nix4
-rw-r--r--pkgs/development/compilers/koka/default.nix63
-rw-r--r--pkgs/development/coq-modules/vscoq-language-server/default.nix32
-rw-r--r--pkgs/development/interpreters/elixir/1.16.nix4
-rw-r--r--pkgs/development/interpreters/lfe/2.1.nix6
-rw-r--r--pkgs/development/interpreters/lfe/generic-builder.nix5
-rw-r--r--pkgs/development/interpreters/php/8.1.nix12
-rw-r--r--pkgs/development/interpreters/spidermonkey/common.nix1
-rw-r--r--pkgs/development/libraries/libcint/default.nix4
-rw-r--r--pkgs/development/libraries/libmilter/default.nix4
-rw-r--r--pkgs/development/libraries/openvdb/default.nix5
-rw-r--r--pkgs/development/libraries/openvino/cmake.patch31
-rw-r--r--pkgs/development/libraries/openvino/default.nix99
-rw-r--r--pkgs/development/libraries/science/astronomy/indilib/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/default.nix5
-rw-r--r--pkgs/development/libraries/waylib/default.nix74
-rw-r--r--pkgs/development/node-packages/main-programs.nix4
-rw-r--r--pkgs/development/ocaml-modules/zipc/default.nix4
-rw-r--r--pkgs/development/python-modules/adjusttext/default.nix16
-rw-r--r--pkgs/development/python-modules/aiortm/default.nix4
-rw-r--r--pkgs/development/python-modules/anthropic/default.nix4
-rw-r--r--pkgs/development/python-modules/appthreat-vulnerability-db/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-batch/default.nix21
-rw-r--r--pkgs/development/python-modules/boto3-stubs/default.nix4
-rw-r--r--pkgs/development/python-modules/botocore-stubs/default.nix4
-rw-r--r--pkgs/development/python-modules/censys/default.nix4
-rw-r--r--pkgs/development/python-modules/clarifai-grpc/default.nix4
-rw-r--r--pkgs/development/python-modules/django-reversion/default.nix4
-rw-r--r--pkgs/development/python-modules/dvc-objects/default.nix4
-rw-r--r--pkgs/development/python-modules/dvc/default.nix4
-rw-r--r--pkgs/development/python-modules/es-client/default.nix12
-rw-r--r--pkgs/development/python-modules/fingerprints/default.nix19
-rw-r--r--pkgs/development/python-modules/georss-client/default.nix16
-rw-r--r--pkgs/development/python-modules/georss-ingv-centro-nazionale-terremoti-client/default.nix14
-rw-r--r--pkgs/development/python-modules/githubkit/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-asset/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-dataproc/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-monitoring/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-redis/default.nix11
-rw-r--r--pkgs/development/python-modules/google-cloud-tasks/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-videointelligence/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix4
-rw-r--r--pkgs/development/python-modules/govee-ble/default.nix18
-rw-r--r--pkgs/development/python-modules/hahomematic/default.nix4
-rw-r--r--pkgs/development/python-modules/litellm/default.nix4
-rw-r--r--pkgs/development/python-modules/losant-rest/default.nix4
-rw-r--r--pkgs/development/python-modules/meshtastic/default.nix4
-rw-r--r--pkgs/development/python-modules/myjwt/default.nix12
-rw-r--r--pkgs/development/python-modules/nipreps-versions/default.nix46
-rw-r--r--pkgs/development/python-modules/niworkflows/default.nix101
-rw-r--r--pkgs/development/python-modules/oelint-parser/default.nix10
-rw-r--r--pkgs/development/python-modules/opower/default.nix4
-rw-r--r--pkgs/development/python-modules/pglast/default.nix4
-rw-r--r--pkgs/development/python-modules/posthog/default.nix4
-rw-r--r--pkgs/development/python-modules/publicsuffixlist/default.nix4
-rw-r--r--pkgs/development/python-modules/pylgnetcast/default.nix4
-rw-r--r--pkgs/development/python-modules/pylutron/default.nix4
-rw-r--r--pkgs/development/python-modules/pytedee-async/default.nix4
-rw-r--r--pkgs/development/python-modules/reconplogger/default.nix4
-rw-r--r--pkgs/development/python-modules/sagemaker/default.nix4
-rw-r--r--pkgs/development/python-modules/scs/default.nix13
-rw-r--r--pkgs/development/python-modules/svgutils/default.nix40
-rw-r--r--pkgs/development/python-modules/tcxreader/default.nix5
-rw-r--r--pkgs/development/python-modules/templateflow/default.nix45
-rw-r--r--pkgs/development/python-modules/tensordict/default.nix4
-rw-r--r--pkgs/development/python-modules/torchrl/default.nix18
-rw-r--r--pkgs/development/python-modules/types-docutils/default.nix4
-rw-r--r--pkgs/development/python-modules/types-setuptools/default.nix4
-rw-r--r--pkgs/development/python-modules/xiaomi-ble/default.nix4
-rw-r--r--pkgs/development/python-modules/zigpy-znp/default.nix2
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix4
-rw-r--r--pkgs/development/tools/buildkit/default.nix4
-rw-r--r--pkgs/development/tools/check-jsonschema/default.nix6
-rw-r--r--pkgs/development/tools/continuous-integration/cirrus-cli/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/woodpecker/common.nix4
-rw-r--r--pkgs/development/tools/detekt/default.nix4
-rw-r--r--pkgs/development/tools/fable/default.nix4
-rw-r--r--pkgs/development/tools/gptcommit/default.nix6
-rw-r--r--pkgs/development/tools/gqlgenc/default.nix4
-rw-r--r--pkgs/development/tools/kdash/default.nix6
-rw-r--r--pkgs/development/tools/kube-linter/default.nix6
-rw-r--r--pkgs/development/tools/misc/act/default.nix6
-rw-r--r--pkgs/development/tools/misc/n98-magerun2/default.nix4
-rw-r--r--pkgs/development/tools/misc/slint-lsp/default.nix6
-rw-r--r--pkgs/development/tools/misc/strace/default.nix8
-rw-r--r--pkgs/development/tools/okteto/default.nix6
-rw-r--r--pkgs/development/tools/purescript/spago/default.nix3
-rw-r--r--pkgs/development/tools/rust/cargo-binstall/default.nix6
-rw-r--r--pkgs/development/tools/symfony-cli/default.nix4
-rw-r--r--pkgs/development/tools/the-way/default.nix6
-rw-r--r--pkgs/development/tools/turso-cli/default.nix4
-rw-r--r--pkgs/development/tools/zed/default.nix6
-rw-r--r--pkgs/development/web/function-runner/default.nix6
-rw-r--r--pkgs/development/web/grails/default.nix4
-rw-r--r--pkgs/games/osu-lazer/bin.nix8
-rw-r--r--pkgs/games/osu-lazer/default.nix4
-rw-r--r--pkgs/games/osu-lazer/deps.nix2
-rw-r--r--pkgs/games/vintagestory/default.nix4
-rw-r--r--pkgs/os-specific/darwin/airbuddy/default.nix15
-rw-r--r--pkgs/os-specific/darwin/aldente/default.nix21
-rw-r--r--pkgs/os-specific/darwin/sketchybar/default.nix4
-rw-r--r--pkgs/os-specific/darwin/yabai/default.nix6
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json12
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.1.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/zen-kernels.nix8
-rw-r--r--pkgs/os-specific/linux/lxc/default.nix2
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix8
-rw-r--r--pkgs/os-specific/linux/zfs/unstable.nix9
-rw-r--r--pkgs/servers/dex/default.nix13
-rw-r--r--pkgs/servers/mastodon/default.nix12
-rw-r--r--pkgs/servers/mastodon/source.nix4
-rw-r--r--pkgs/servers/matrix-synapse/default.nix6
-rw-r--r--pkgs/servers/misc/gobgpd/default.nix4
-rw-r--r--pkgs/servers/monitoring/grafana-agent/default.nix6
-rw-r--r--pkgs/servers/monitoring/telegraf/default.nix6
-rw-r--r--pkgs/servers/nextcloud/default.nix4
-rw-r--r--pkgs/servers/nosql/aerospike/default.nix19
-rw-r--r--pkgs/servers/sabnzbd/default.nix4
-rw-r--r--pkgs/servers/search/meilisearch/Cargo.lock30
-rw-r--r--pkgs/servers/search/meilisearch/default.nix4
-rw-r--r--pkgs/servers/snac2/default.nix4
-rw-r--r--pkgs/servers/sql/mariadb/galera/default.nix4
-rw-r--r--pkgs/servers/xmpp/prosody/default.nix6
-rw-r--r--pkgs/shells/zsh/zinit/default.nix4
-rw-r--r--pkgs/shells/zsh/zsh-forgit/default.nix4
-rw-r--r--pkgs/shells/zsh/zsh-fzf-tab/default.nix6
-rw-r--r--pkgs/tools/admin/fits-cloudctl/default.nix4
-rw-r--r--pkgs/tools/admin/salt/default.nix4
-rw-r--r--pkgs/tools/admin/simplotask/default.nix4
-rw-r--r--pkgs/tools/admin/trivy/default.nix6
-rw-r--r--pkgs/tools/inputmethods/remote-touchpad/default.nix4
-rw-r--r--pkgs/tools/misc/dooit/default.nix4
-rw-r--r--pkgs/tools/misc/fedifetcher/default.nix4
-rw-r--r--pkgs/tools/misc/fzf/default.nix6
-rw-r--r--pkgs/tools/misc/mise/default.nix6
-rw-r--r--pkgs/tools/misc/mutagen-compose/default.nix6
-rw-r--r--pkgs/tools/misc/panoply/default.nix4
-rw-r--r--pkgs/tools/misc/yubico-piv-tool/default.nix4
-rw-r--r--pkgs/tools/networking/gobgp/default.nix4
-rw-r--r--pkgs/tools/networking/grpc_cli/default.nix4
-rw-r--r--pkgs/tools/networking/haproxy/default.nix4
-rw-r--r--pkgs/tools/networking/minio-client/default.nix6
-rw-r--r--pkgs/tools/networking/nbd/default.nix13
-rw-r--r--pkgs/tools/package-management/emplace/default.nix6
-rw-r--r--pkgs/tools/package-management/nfpm/default.nix6
-rw-r--r--pkgs/tools/package-management/pdm/default.nix4
-rw-r--r--pkgs/tools/security/cosign/default.nix6
-rw-r--r--pkgs/tools/security/deepsecrets/default.nix10
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/gotestwaf/default.nix4
-rw-r--r--pkgs/tools/security/grype/default.nix6
-rw-r--r--pkgs/tools/security/kube-bench/default.nix6
-rw-r--r--pkgs/tools/system/automatic-timezoned/default.nix6
-rw-r--r--pkgs/tools/system/zram-generator/Cargo.lock4
-rw-r--r--pkgs/tools/text/nltk_data/default.nix5
-rw-r--r--pkgs/top-level/all-packages.nix14
-rw-r--r--pkgs/top-level/coq-packages.nix1
-rw-r--r--pkgs/top-level/php-packages.nix3
-rw-r--r--pkgs/top-level/python-packages.nix11
-rw-r--r--pkgs/top-level/qt6-packages.nix2
278 files changed, 2908 insertions, 1102 deletions
diff --git a/doc/build-helpers/images/dockertools.section.md b/doc/build-helpers/images/dockertools.section.md
index b09766524043..677b429ba3c0 100644
--- a/doc/build-helpers/images/dockertools.section.md
+++ b/doc/build-helpers/images/dockertools.section.md
@@ -880,25 +880,211 @@ $ nix run nixpkgs#nix-prefetch-docker -- --help
 
 ## exportImage {#ssec-pkgs-dockerTools-exportImage}
 
-This function is analogous to the `docker export` command, in that it can be used to flatten a Docker image that contains multiple layers. It is in fact the result of the merge of all the layers of the image. As such, the result is suitable for being imported in Docker with `docker import`.
+This function is similar to the `docker container export` command, which means it can be used to export an image's filesystem as an uncompressed tarball archive.
+The difference is that `docker container export` is applied to containers, but `dockerTools.exportImage` applies to Docker images.
+The resulting archive will not contain any image metadata (such as command to run with `docker container run`), only the filesystem contents.
 
-> **_NOTE:_** Using this function requires the `kvm` device to be available.
+You can use this function to import an archive in Docker with `docker image import`.
+See [](#ex-dockerTools-exportImage-importingDocker) to understand how to do that.
 
-The parameters of `exportImage` are the following:
+:::{.caution}
+`exportImage` works by unpacking the given image inside a VM.
+Because of this, using this function requires the `kvm` device to be available, see [`system-features`](https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-system-features).
+:::
+
+### Inputs {#ssec-pkgs-dockerTools-exportImage-inputs}
+
+`exportImage` expects an argument with the following attributes:
+
+`fromImage` (Attribute Set or String)
+
+: The repository tarball of the image whose filesystem will be exported.
+  It must be a valid Docker image, such as one exported by `docker image save`, or another image built with the `dockerTools` utility functions.
+
+  If `name` is not specified, `fromImage` must be an Attribute Set corresponding to a derivation, i.e. it can't be a path to a tarball.
+  If `name` is specified, `fromImage` can be either an Attribute Set corresponding to a derivation or simply a path to a tarball.
+
+  See [](#ex-dockerTools-exportImage-naming) and [](#ex-dockerTools-exportImage-fromImagePath) to understand the connection between `fromImage`, `name`, and the name used for the output of `exportImage`.
+
+`fromImageName` (String or Null; _optional_)
+
+: Used to specify the image within the repository tarball in case it contains multiple images.
+  A value of `null` means that `exportImage` will use the first image available in the repository.
+
+  :::{.note}
+  This must be used with `fromImageTag`. Using only `fromImageName` without `fromImageTag` will make `exportImage` use the first image available in the repository.
+  :::
+
+  _Default value:_ `null`.
+
+`fromImageTag` (String or Null; _optional_)
+
+: Used to specify the image within the repository tarball in case it contains multiple images.
+  A value of `null` means that `exportImage` will use the first image available in the repository.
+
+  :::{.note}
+  This must be used with `fromImageName`. Using only `fromImageTag` without `fromImageName` will make `exportImage` use the first image available in the repository
+  :::
+
+  _Default value:_ `null`.
+
+`diskSize` (Number; _optional_)
+
+: Controls the disk size (in megabytes) of the VM used to unpack the image.
+
+  _Default value:_ 1024.
+
+`name` (String; _optional_)
+
+: The name used for the output in the Nix store path.
+
+  _Default value:_ the value of `fromImage.name`.
+
+### Examples {#ssec-pkgs-dockerTools-exportImage-examples}
+
+:::{.example #ex-dockerTools-exportImage-hello}
+# Exporting a Docker image with `dockerTools.exportImage`
+
+This example first builds a layered image with [`dockerTools.buildLayeredImage`](#ssec-pkgs-dockerTools-buildLayeredImage), and then exports its filesystem with `dockerTools.exportImage`.
+
+```nix
+{ dockerTools, hello }:
+dockerTools.exportImage {
+  name = "hello";
+  fromImage = dockerTools.buildLayeredImage {
+    name = "hello";
+    contents = [ hello ];
+  };
+}
+```
+
+When building the package above, we can see the layers of the Docker image being unpacked to produce the final output:
+
+```shell
+$ nix-build
+(some output removed for clarity)
+Unpacking base image...
+From-image name or tag wasn't set. Reading the first ID.
+Unpacking layer 5731199219418f175d1580dbca05677e69144425b2d9ecb60f416cd57ca3ca42/layer.tar
+tar: Removing leading `/' from member names
+Unpacking layer e2897bf34bb78c4a65736510204282d9f7ca258ba048c183d665bd0f3d24c5ec/layer.tar
+tar: Removing leading `/' from member names
+Unpacking layer 420aa5876dca4128cd5256da7dea0948e30ef5971712f82601718cdb0a6b4cda/layer.tar
+tar: Removing leading `/' from member names
+Unpacking layer ea5f4e620e7906c8ecbc506b5e6f46420e68d4b842c3303260d5eb621b5942e5/layer.tar
+tar: Removing leading `/' from member names
+Unpacking layer 65807b9abe8ab753fa97da8fb74a21fcd4725cc51e1b679c7973c97acd47ebcf/layer.tar
+tar: Removing leading `/' from member names
+Unpacking layer b7da2076b60ebc0ea6824ef641978332b8ac908d47b2d07ff31b9cc362245605/layer.tar
+Executing post-mount steps...
+Packing raw image...
+[    1.660036] reboot: Power down
+/nix/store/x6a5m7c6zdpqz1d8j7cnzpx9glzzvd2h-hello
+```
+
+The following command lists some of the contents of the output to verify that the structure of the archive is as expected:
+
+```shell
+$ tar --exclude '*/share/*' --exclude 'nix/store/*/*' -tvf /nix/store/x6a5m7c6zdpqz1d8j7cnzpx9glzzvd2h-hello
+drwxr-xr-x root/0            0 1979-12-31 16:00 ./
+drwxr-xr-x root/0            0 1979-12-31 16:00 ./bin/
+lrwxrwxrwx root/0            0 1979-12-31 16:00 ./bin/hello -> /nix/store/h92a9jd0lhhniv2q417hpwszd4jhys7q-hello-2.12.1/bin/hello
+dr-xr-xr-x root/0            0 1979-12-31 16:00 ./nix/
+dr-xr-xr-x root/0            0 1979-12-31 16:00 ./nix/store/
+dr-xr-xr-x root/0            0 1979-12-31 16:00 ./nix/store/05zbwhz8a7i2v79r9j21pl6m6cj0xi8k-libunistring-1.1/
+dr-xr-xr-x root/0            0 1979-12-31 16:00 ./nix/store/ayg5rhjhi9ic73hqw33mjqjxwv59ndym-xgcc-13.2.0-libgcc/
+dr-xr-xr-x root/0            0 1979-12-31 16:00 ./nix/store/h92a9jd0lhhniv2q417hpwszd4jhys7q-hello-2.12.1/
+dr-xr-xr-x root/0            0 1979-12-31 16:00 ./nix/store/m59xdgkgnjbk8kk6k6vbxmqnf82mk9s0-libidn2-2.3.4/
+dr-xr-xr-x root/0            0 1979-12-31 16:00 ./nix/store/p3jshbwxiwifm1py0yq544fmdyy98j8a-glibc-2.38-27/
+drwxr-xr-x root/0            0 1979-12-31 16:00 ./share/
+```
+:::
+
+:::{.example #ex-dockerTools-exportImage-importingDocker}
+# Importing an archive built with `dockerTools.exportImage` in Docker
+
+We will use the same package from [](#ex-dockerTools-exportImage-hello) and import it into Docker.
 
 ```nix
-exportImage {
-  fromImage = someLayeredImage;
-  fromImageName = null;
-  fromImageTag = null;
+{ dockerTools, hello }:
+dockerTools.exportImage {
+  name = "hello";
+  fromImage = dockerTools.buildLayeredImage {
+    name = "hello";
+    contents = [ hello ];
+  };
+}
+```
+
+Building and importing it into Docker:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/x6a5m7c6zdpqz1d8j7cnzpx9glzzvd2h-hello
+$ docker image import /nix/store/x6a5m7c6zdpqz1d8j7cnzpx9glzzvd2h-hello
+sha256:1d42dba415e9b298ea0decf6497fbce954de9b4fcb2984f91e307c8fedc1f52f
+$ docker image ls
+REPOSITORY                              TAG                IMAGE ID       CREATED         SIZE
+<none>                                  <none>             1d42dba415e9   4 seconds ago   32.6MB
+```
+:::
+
+:::{.example #ex-dockerTools-exportImage-naming}
+# Exploring output naming with `dockerTools.exportImage`
+
+`exportImage` does not require a `name` attribute if `fromImage` is a derivation, which means that the following works:
 
-  name = someLayeredImage.name;
+```nix
+{ dockerTools, hello }:
+dockerTools.exportImage {
+  fromImage = dockerTools.buildLayeredImage {
+    name = "hello";
+    contents = [ hello ];
+  };
 }
 ```
 
-The parameters relative to the base image have the same synopsis as described in [buildImage](#ssec-pkgs-dockerTools-buildImage), except that `fromImage` is the only required argument in this case.
+However, since [`dockerTools.buildLayeredImage`](#ssec-pkgs-dockerTools-buildLayeredImage)'s output ends with `.tar.gz`, the output of `exportImage` will also end with `.tar.gz`, even though the archive created with `exportImage` is uncompressed:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/by3f40xvc4l6bkis74l0fj4zsy0djgkn-hello.tar.gz
+$ file /nix/store/by3f40xvc4l6bkis74l0fj4zsy0djgkn-hello.tar.gz
+/nix/store/by3f40xvc4l6bkis74l0fj4zsy0djgkn-hello.tar.gz: POSIX tar archive (GNU)
+```
+
+If the archive was actually compressed, the output of file would've mentioned that fact.
+Because of this, it may be important to set a proper `name` attribute when using `exportImage` with other functions from `dockerTools`.
+:::
+
+:::{.example #ex-dockerTools-exportImage-fromImagePath}
+# Using `dockerTools.exportImage` with a path as `fromImage`
+
+It is possible to use a path as the value of the `fromImage` attribute when calling `dockerTools.exportImage`.
+However, when doing so, a `name` attribute **MUST** be specified, or you'll encounter an error when evaluating the Nix code.
+
+For this example, we'll assume a Docker tarball image named `image.tar.gz` exists in the same directory where our package is defined:
 
-The `name` argument is the name of the derivation output, which defaults to `fromImage.name`.
+```nix
+{ dockerTools }:
+dockerTools.exportImage {
+  name = "filesystem.tar";
+  fromImage = ./image.tar.gz;
+}
+```
+
+Building this will give us the expected output:
+
+```shell
+$ nix-build
+(output removed for clarity)
+/nix/store/w13l8h3nlkg0zv56k7rj0ai0l2zlf7ss-filesystem.tar
+```
+
+If you don't specify a `name` attribute, you'll encounter an evaluation error and the package won't build.
+:::
 
 ## Environment Helpers {#ssec-pkgs-dockerTools-helpers}
 
diff --git a/doc/build-helpers/trivial-build-helpers.chapter.md b/doc/build-helpers/trivial-build-helpers.chapter.md
index 4648c7985542..384e25035060 100644
--- a/doc/build-helpers/trivial-build-helpers.chapter.md
+++ b/doc/build-helpers/trivial-build-helpers.chapter.md
@@ -502,9 +502,14 @@ concatScript "my-file" [ file1 file2 ]
 
 ## `writeShellApplication` {#trivial-builder-writeShellApplication}
 
-This can be used to easily produce a shell script that has some dependencies (`runtimeInputs`). It automatically sets the `PATH` of the script to contain all of the listed inputs, sets some sanity shellopts (`errexit`, `nounset`, `pipefail`), and checks the resulting script with [`shellcheck`](https://github.com/koalaman/shellcheck).
+`writeShellApplication` is similar to `writeShellScriptBin` and `writeScriptBin` but supports runtime dependencies with `runtimeInputs`.
+Writes an executable shell script to `/nix/store/<store path>/bin/<name>` and checks its syntax with [`shellcheck`](https://github.com/koalaman/shellcheck) and the `bash`'s `-n` option.
+Some basic Bash options are set by default (`errexit`, `nounset`, and `pipefail`), but can be overridden with `bashOptions`.
 
-For example, look at the following code:
+Extra arguments may be passed to `stdenv.mkDerivation` by setting `derivationArgs`; note that variables set in this manner will be set when the shell script is _built,_ not when it's run.
+Runtime environment variables can be set with the `runtimeEnv` argument.
+
+For example, the following shell application can refer to `curl` directly, rather than needing to write `${curl}/bin/curl`:
 
 ```nix
 writeShellApplication {
@@ -518,10 +523,6 @@ writeShellApplication {
 }
 ```
 
-Unlike with normal `writeShellScriptBin`, there is no need to manually write out `${curl}/bin/curl`, setting the PATH
-was handled by `writeShellApplication`. Moreover, the script is being checked with `shellcheck` for more strict
-validation.
-
 ## `symlinkJoin` {#trivial-builder-symlinkJoin}
 
 This can be used to put many derivations into the same directory structure. It works by creating a new derivation and adding symlinks to each of the paths listed. It expects two arguments, `name`, and `paths`. `name` is the name used in the Nix store path for the created derivation. `paths` is a list of paths that will be symlinked. These paths can be to Nix store derivations or any other subdirectory contained within.
diff --git a/doc/languages-frameworks/beam.section.md b/doc/languages-frameworks/beam.section.md
index 1e83d4b93c7c..992149090c63 100644
--- a/doc/languages-frameworks/beam.section.md
+++ b/doc/languages-frameworks/beam.section.md
@@ -216,7 +216,7 @@ in packages.mixRelease {
 Setup will require the following steps:
 
 - Move your secrets to runtime environment variables. For more information refer to the [runtime.exs docs](https://hexdocs.pm/mix/Mix.Tasks.Release.html#module-runtime-configuration). On a fresh Phoenix build that would mean that both `DATABASE_URL` and `SECRET_KEY` need to be moved to `runtime.exs`.
-- `cd assets` and `nix-shell -p node2nix --run node2nix --development` will generate a Nix expression containing your frontend dependencies
+- `cd assets` and `nix-shell -p node2nix --run "node2nix --development"` will generate a Nix expression containing your frontend dependencies
 - commit and push those changes
 - you can now `nix-build .`
 - To run the release, set the `RELEASE_TMP` environment variable to a directory that your program has write access to. It will be used to store the BEAM settings.
diff --git a/doc/languages-frameworks/haskell.section.md b/doc/languages-frameworks/haskell.section.md
index 0edf0b6f019f..bec72cb3c0d3 100644
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@@ -1229,10 +1229,12 @@ in
   in
 
   {
-    haskell = lib.recursiveUpdate prev.haskell {
-      compiler.${ghcName} = prev.haskell.compiler.${ghcName}.override {
-        # Unfortunately, the GHC setting is named differently for historical reasons
-        enableProfiledLibs = enableProfiling;
+    haskell = prev.haskell // {
+      compiler = prev.haskell.compiler // {
+        ${ghcName} = prev.haskell.compiler.${ghcName}.override {
+          # Unfortunately, the GHC setting is named differently for historical reasons
+          enableProfiledLibs = enableProfiling;
+        };
       };
     };
   })
@@ -1244,31 +1246,33 @@ in
   in
 
   {
-    haskell = lib.recursiveUpdate prev.haskell {
-      packages.${ghcName} = prev.haskell.packages.${ghcName}.override {
-        overrides = hfinal: hprev: {
-          mkDerivation = args: hprev.mkDerivation (args // {
-            # Since we are forcing our ideas upon mkDerivation, this change will
-            # affect every package in the package set.
-            enableLibraryProfiling = enableProfiling;
-
-            # To actually use profiling on an executable, executable profiling
-            # needs to be enabled for the executable you want to profile. You
-            # can either do this globally or…
-            enableExecutableProfiling = enableProfiling;
-          });
-
-          # …only for the package that contains an executable you want to profile.
-          # That saves on unnecessary rebuilds for packages that you only depend
-          # on for their library, but also contain executables (e.g. pandoc).
-          my-executable = haskellLib.enableExecutableProfiling hprev.my-executable;
-
-          # If you are disabling profiling to save on build time, but want to
-          # retain the ability to substitute from the binary cache. Drop the
-          # override for mkDerivation above and instead have an override like
-          # this for the specific packages you are building locally and want
-          # to make cheaper to build.
-          my-library = haskellLib.disableLibraryProfiling hprev.my-library;
+    haskell = prev.haskell // {
+      packages = prev.haskell.packages // {
+        ${ghcName} = prev.haskell.packages.${ghcName}.override {
+          overrides = hfinal: hprev: {
+            mkDerivation = args: hprev.mkDerivation (args // {
+              # Since we are forcing our ideas upon mkDerivation, this change will
+              # affect every package in the package set.
+              enableLibraryProfiling = enableProfiling;
+
+              # To actually use profiling on an executable, executable profiling
+              # needs to be enabled for the executable you want to profile. You
+              # can either do this globally or…
+              enableExecutableProfiling = enableProfiling;
+            });
+
+            # …only for the package that contains an executable you want to profile.
+            # That saves on unnecessary rebuilds for packages that you only depend
+            # on for their library, but also contain executables (e.g. pandoc).
+            my-executable = haskellLib.enableExecutableProfiling hprev.my-executable;
+
+            # If you are disabling profiling to save on build time, but want to
+            # retain the ability to substitute from the binary cache. Drop the
+            # override for mkDerivation above and instead have an override like
+            # this for the specific packages you are building locally and want
+            # to make cheaper to build.
+            my-library = haskellLib.disableLibraryProfiling hprev.my-library;
+          };
         };
       };
     };
diff --git a/doc/preface.chapter.md b/doc/preface.chapter.md
index 93cd1a00b4f2..e6a0905c5a95 100644
--- a/doc/preface.chapter.md
+++ b/doc/preface.chapter.md
@@ -27,18 +27,18 @@ With these expressions the Nix package manager can build binary packages.
 Packages, including the Nix packages collection, are distributed through
 [channels](https://nixos.org/nix/manual/#sec-channels). The collection is
 distributed for users of Nix on non-NixOS distributions through the channel
-`nixpkgs`. Users of NixOS generally use one of the `nixos-*` channels, e.g.
-`nixos-22.11`, which includes all packages and modules for the stable NixOS
+`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
+e.g. `nixos-22.11`, which includes all packages and modules for the stable NixOS
 22.11. Stable NixOS releases are generally only given
 security updates. More up to date packages and modules are available via the
 `nixos-unstable` channel.
 
-Both `nixos-unstable` and `nixpkgs` follow the `master` branch of the Nixpkgs
-repository, although both do lag the `master` branch by generally
+Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
+nixpkgs repository, although both do lag the `master` branch by generally
 [a couple of days](https://status.nixos.org/). Updates to a channel are
 distributed as soon as all tests for that channel pass, e.g.
 [this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
-shows the status of tests for the `nixpkgs` channel.
+shows the status of tests for the `nixpkgs-unstable` channel.
 
 The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
 which also builds binary packages from the Nix expressions in Nixpkgs for
@@ -46,5 +46,5 @@ which also builds binary packages from the Nix expressions in Nixpkgs for
 The binaries are made available via a [binary cache](https://cache.nixos.org).
 
 The current Nix expressions of the channels are available in the
-[`nixpkgs`](https://github.com/NixOS/nixpkgs) repository in branches
+[nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
 that correspond to the channel names (e.g. `nixos-22.11-small`).
diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index 4059d2e24426..f4fcc83e1012 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -5,6 +5,7 @@ let
     isAttrs
     isPath
     isString
+    nixVersion
     pathExists
     readDir
     split
@@ -17,6 +18,7 @@ let
     attrNames
     attrValues
     mapAttrs
+    optionalAttrs
     zipAttrsWith
     ;
 
@@ -56,6 +58,7 @@ let
     substring
     stringLength
     hasSuffix
+    versionAtLeast
     ;
 
   inherit (lib.trivial)
@@ -840,6 +843,10 @@ rec {
   # https://github.com/NixOS/nix/commit/55cefd41d63368d4286568e2956afd535cb44018
   _fetchGitSubmodulesMinver = "2.4";
 
+  # Support for `builtins.fetchGit` with `shallow = true` was introduced in 2.4
+  # https://github.com/NixOS/nix/commit/d1165d8791f559352ff6aa7348e1293b2873db1c
+  _fetchGitShallowMinver = "2.4";
+
   # Mirrors the contents of a Nix store path relative to a local path as a file set.
   # Some notes:
   # - The store path is read at evaluation time.
@@ -894,7 +901,17 @@ rec {
           # However a simpler alternative still would be [a builtins.gitLsFiles](https://github.com/NixOS/nix/issues/2944).
           fetchResult = fetchGit ({
             url = path;
-          } // extraFetchGitAttrs);
+          }
+          # In older Nix versions, repositories were always assumed to be deep clones, which made `fetchGit` fail for shallow clones
+          # For newer versions this was fixed, but the `shallow` flag is required.
+          # The only behavioral difference is that for shallow clones, `fetchGit` doesn't return a `revCount`,
+          # which we don't need here, so it's fine to always pass it.
+
+          # Unfortunately this means older Nix versions get a poor error message for shallow repositories, and there's no good way to improve that.
+          # Checking for `.git/shallow` doesn't seem worth it, especially since that's more of an implementation detail,
+          # and would also require more code to handle worktrees where `.git` is a file.
+          // optionalAttrs (versionAtLeast nixVersion _fetchGitShallowMinver) { shallow = true; }
+          // extraFetchGitAttrs);
         in
         # We can identify local working directories by checking for .git,
         # see https://git-scm.com/docs/gitrepository-layout#_description.
diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index e809aef6935a..af8338eb7855 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -1439,6 +1439,19 @@ if [[ -n "$fetchGitSupportsSubmodules" ]]; then
 fi
 rm -rf -- *
 
+# shallow = true is not supported on all Nix versions
+# and older versions don't support shallow clones at all
+if [[ "$(nix-instantiate --eval --expr "$prefixExpression (versionAtLeast builtins.nixVersion _fetchGitShallowMinver)")" == true ]]; then
+    createGitRepo full
+    # Extra commit such that there's a commit that won't be in the shallow clone
+    git -C full commit --allow-empty -q -m extra
+    git clone -q --depth 1 "file://${PWD}/full" shallow
+    cd shallow
+    checkGitTracked
+    cd ..
+    rm -rf -- *
+fi
+
 # Go through all stages of Git files
 # See https://www.git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 281dd59e3dd3..64db85e00369 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -66,6 +66,12 @@
     github = "0b11stan";
     githubId = 27831931;
   };
+  _0nyr = {
+    email = "onyr.maintainer@gmail.com";
+    github = "0nyr";
+    githubId = 47721040;
+    name = "Florian Rascoussier";
+  };
   _0qq = {
     email = "0qqw0qqw@gmail.com";
     github = "0qq";
@@ -4392,6 +4398,15 @@
     githubId = 3179832;
     name = "D. Bohdan";
   };
+  dbrgn = {
+    email = "nix@dbrgn.ch";
+    github = "dbrgn";
+    githubId = 105168;
+    name = "Danilo B.";
+    keys = [{
+      fingerprint = "20EE 002D 778A E197 EF7D  0D2C B993 FF98 A90C 9AB1";
+    }];
+  };
   dbrock = {
     email = "daniel@brockman.se";
     github = "dbrock";
@@ -10107,6 +10122,12 @@
     githubId = 264372;
     name = "Jan van den Berg";
   };
+  koppor = {
+    email = "kopp.dev@gmail.com";
+    github = "koppor";
+    githubId = 1366654;
+    name = "Oliver Kopp";
+  };
   koral = {
     email = "koral@mailoo.org";
     github = "k0ral";
@@ -12407,6 +12428,12 @@
     githubId = 92937;
     name = "Breland Miley";
   };
+  minersebas = {
+    email = "scherthan_sebastian@web.de";
+    github = "MinerSebas";
+    githubId = 66798382;
+    name = "Sebastian Maximilian Scherthan";
+  };
   minijackson = {
     email = "minijackson@riseup.net";
     github = "minijackson";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 7deca72256b9..e26702f7a61d 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -50,6 +50,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [GNS3](https://www.gns3.com/), a network software emulator. Available as [services.gns3-server](#opt-services.gns3-server.enable).
 
+- [pretalx](https://github.com/pretalx/pretalx), a conference planning tool. Available as [services.pretalx](#opt-services.pretalx.enable).
+
 - [rspamd-trainer](https://gitlab.com/onlime/rspamd-trainer), script triggered by a helper which reads mails from a specific mail inbox and feeds them into rspamd for spam/ham training.
 
 - [ollama](https://ollama.ai), server for running large language models locally.
@@ -296,6 +298,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   - Custom themes and other assets that were previously stored in `custom/public/*` now belong in `custom/public/assets/*`
   - New instances of Gitea using MySQL now ignore the `[database].CHARSET` config option and always use the `utf8mb4` charset, existing instances should migrate via the `gitea doctor convert` CLI command.
 
+- The `services.paperless` module no longer uses the previously downloaded NLTK data stored in `/var/cache/paperless/nltk`. This directory can be removed.
+
 - The `hardware.pulseaudio` module now sets permission of pulse user home directory to 755 when running in "systemWide" mode. It fixes [issue 114399](https://github.com/NixOS/nixpkgs/issues/114399).
 
 - The `btrbk` module now automatically selects and provides required compression
@@ -305,5 +309,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - The `mpich` package expression now requires `withPm` to be a list, e.g. `"hydra:gforker"` becomes `[ "hydra" "gforker" ]`.
 
+- YouTrack is bumped to 2023.3. The update is not performed automatically, it requires manual interaction. See the YouTrack section in the manual for details.
+
 - QtMultimedia has changed its default backend to `QT_MEDIA_BACKEND=ffmpeg` (previously `gstreamer` on Linux or `darwin` on MacOS).
   The previous native backends remain available but are now minimally maintained. Refer to [upstream documentation](https://doc.qt.io/qt-6/qtmultimedia-index.html#ffmpeg-as-the-default-backend) for further details about each platform.
+
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 111be7057afc..ffbb558549f6 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -867,9 +867,6 @@ let
           { name = "gnupg"; enable = cfg.gnupg.enable; control = "optional"; modulePath = "${pkgs.pam_gnupg}/lib/security/pam_gnupg.so"; settings = {
             no-autostart = cfg.gnupg.noAutostart;
           }; }
-          { name = "cgfs"; enable = config.virtualisation.lxc.lxcfs.enable; control = "optional"; modulePath = "${pkgs.lxc}/lib/security/pam_cgfs.so"; args = [
-            "-c" "all"
-          ]; }
         ];
       };
     };
diff --git a/nixos/modules/security/wrappers/wrapper.c b/nixos/modules/security/wrappers/wrapper.c
index 3277e7ef6f79..3e126875c687 100644
--- a/nixos/modules/security/wrappers/wrapper.c
+++ b/nixos/modules/security/wrappers/wrapper.c
@@ -172,6 +172,13 @@ static int make_caps_ambient(const char *self_path) {
 int main(int argc, char **argv) {
     ASSERT(argc >= 1);
 
+    // argv[0] goes into a lot of places, to a far greater degree than other elements
+    // of argv. glibc has had buffer overflows relating to argv[0], eg CVE-2023-6246.
+    // Since we expect the wrappers to be invoked from either $PATH or /run/wrappers/bin,
+    // there should be no reason to pass any particularly large values here, so we can
+    // be strict for strictness' sake.
+    ASSERT(strlen(argv[0]) < 512);
+
     int debug = getenv(wrapper_debug) != NULL;
 
     // Drop insecure environment variables explicitly
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 9780a4d72257..1256d8315c8b 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -6,7 +6,6 @@ let
   pkg = cfg.package;
 
   defaultUser = "paperless";
-  nltkDir = "/var/cache/paperless/nltk";
   defaultFont = "${pkgs.liberation_ttf}/share/fonts/truetype/LiberationSerif-Regular.ttf";
 
   # Don't start a redis instance if the user sets a custom redis connection
@@ -17,13 +16,17 @@ let
     PAPERLESS_DATA_DIR = cfg.dataDir;
     PAPERLESS_MEDIA_ROOT = cfg.mediaDir;
     PAPERLESS_CONSUMPTION_DIR = cfg.consumptionDir;
-    PAPERLESS_NLTK_DIR = nltkDir;
     PAPERLESS_THUMBNAIL_FONT_NAME = defaultFont;
     GUNICORN_CMD_ARGS = "--bind=${cfg.address}:${toString cfg.port}";
   } // optionalAttrs (config.time.timeZone != null) {
     PAPERLESS_TIME_ZONE = config.time.timeZone;
   } // optionalAttrs enableRedis {
     PAPERLESS_REDIS = "unix://${redisServer.unixSocket}";
+  } // optionalAttrs (cfg.settings.PAPERLESS_ENABLE_NLTK or true) {
+    PAPERLESS_NLTK_DIR = pkgs.symlinkJoin {
+      name = "paperless_ngx_nltk_data";
+      paths = pkg.nltkData;
+    };
   } // (lib.mapAttrs (_: s:
     if (lib.isAttrs s || lib.isList s) then builtins.toJSON s
     else if lib.isBool s then lib.boolToString s
@@ -292,23 +295,6 @@ in
       };
     };
 
-    # Download NLTK corpus data
-    systemd.services.paperless-download-nltk-data = {
-      wantedBy = [ "paperless-scheduler.service" ];
-      before = [ "paperless-scheduler.service" ];
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-      serviceConfig = defaultServiceConfig // {
-        User = cfg.user;
-        Type = "oneshot";
-        # Enable internet access
-        PrivateNetwork = false;
-        ExecStart = let pythonWithNltk = pkg.python.withPackages (ps: [ ps.nltk ]); in ''
-          ${pythonWithNltk}/bin/python -m nltk.downloader -d '${nltkDir}' punkt snowball_data stopwords
-        '';
-      };
-    };
-
     systemd.services.paperless-consumer = {
       description = "Paperless document consumer";
       # Bind to `paperless-scheduler` so that the consumer never runs
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index 0583b12fe7a3..6be6ba7edf72 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -70,6 +70,7 @@ let
     "pve"
     "py-air-control"
     "redis"
+    "restic"
     "rspamd"
     "rtl_433"
     "sabnzbd"
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/restic.nix b/nixos/modules/services/monitoring/prometheus/exporters/restic.nix
new file mode 100644
index 000000000000..5b32c93a666d
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/restic.nix
@@ -0,0 +1,131 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.restic;
+in
+{
+  port = 9753;
+  extraOpts = {
+    repository = mkOption {
+      type = types.str;
+      description = lib.mdDoc ''
+        URI pointing to the repository to monitor.
+      '';
+      example = "sftp:backup@192.168.1.100:/backups/example";
+    };
+
+    passwordFile = mkOption {
+      type = types.path;
+      description = lib.mdDoc ''
+        File containing the password to the repository.
+      '';
+      example = "/etc/nixos/restic-password";
+    };
+
+    environmentFile = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      description = lib.mdDoc ''
+        File containing the credentials to access the repository, in the
+        format of an EnvironmentFile as described by systemd.exec(5)
+      '';
+    };
+
+    refreshInterval = mkOption {
+      type = types.ints.unsigned;
+      default = 60;
+      description = lib.mdDoc ''
+        Refresh interval for the metrics in seconds.
+        Computing the metrics is an expensive task, keep this value as high as possible.
+      '';
+    };
+
+    rcloneOptions = mkOption {
+      type = with types; attrsOf (oneOf [ str bool ]);
+      default = { };
+      description = lib.mdDoc ''
+        Options to pass to rclone to control its behavior.
+        See <https://rclone.org/docs/#options> for
+        available options. When specifying option names, strip the
+        leading `--`. To set a flag such as
+        `--drive-use-trash`, which does not take a value,
+        set the value to the Boolean `true`.
+      '';
+    };
+
+    rcloneConfig = mkOption {
+      type = with types; attrsOf (oneOf [ str bool ]);
+      default = { };
+      description = lib.mdDoc ''
+        Configuration for the rclone remote being used for backup.
+        See the remote's specific options under rclone's docs at
+        <https://rclone.org/docs/>. When specifying
+        option names, use the "config" name specified in the docs.
+        For example, to set `--b2-hard-delete` for a B2
+        remote, use `hard_delete = true` in the
+        attribute set.
+
+        ::: {.warning}
+        Secrets set in here will be world-readable in the Nix
+        store! Consider using the {option}`rcloneConfigFile`
+        option instead to specify secret values separately. Note that
+        options set here will override those set in the config file.
+        :::
+      '';
+    };
+
+    rcloneConfigFile = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      description = lib.mdDoc ''
+        Path to the file containing rclone configuration. This file
+        must contain configuration for the remote specified in this backup
+        set and also must be readable by root.
+
+        ::: {.caution}
+        Options set in `rcloneConfig` will override those set in this
+        file.
+        :::
+      '';
+    };
+  };
+
+  serviceOpts = {
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-restic-exporter}/bin/restic-exporter.py \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+      EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+    };
+    environment =
+      let
+        rcloneRemoteName = builtins.elemAt (splitString ":" cfg.repository) 1;
+        rcloneAttrToOpt = v: "RCLONE_" + toUpper (builtins.replaceStrings [ "-" ] [ "_" ] v);
+        rcloneAttrToConf = v: "RCLONE_CONFIG_" + toUpper (rcloneRemoteName + "_" + v);
+        toRcloneVal = v: if lib.isBool v then lib.boolToString v else v;
+      in
+      {
+        RESTIC_REPO_URL = cfg.repository;
+        RESTIC_REPO_PASSWORD_FILE = cfg.passwordFile;
+        LISTEN_ADDRESS = cfg.listenAddress;
+        LISTEN_PORT = toString cfg.port;
+        REFRESH_INTERVAL = toString cfg.refreshInterval;
+      }
+      // (mapAttrs'
+        (name: value:
+          nameValuePair (rcloneAttrToOpt name) (toRcloneVal value)
+        )
+        cfg.rcloneOptions)
+      // optionalAttrs (cfg.rcloneConfigFile != null) {
+        RCLONE_CONFIG = cfg.rcloneConfigFile;
+      }
+      // (mapAttrs'
+        (name: value:
+          nameValuePair (rcloneAttrToConf name) (toRcloneVal value)
+        )
+        cfg.rcloneConfig);
+  };
+}
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix b/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
index 840ce493ee81..452cb154bcf6 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
@@ -3,6 +3,7 @@
 with lib;
 
 let
+  logPrefix = "services.prometheus.exporters.snmp";
   cfg = config.services.prometheus.exporters.snmp;
 
   # This ensures that we can deal with string paths, path types and
diff --git a/nixos/modules/services/web-apps/photoprism.nix b/nixos/modules/services/web-apps/photoprism.nix
index e25b03484424..1716840e84e5 100644
--- a/nixos/modules/services/web-apps/photoprism.nix
+++ b/nixos/modules/services/web-apps/photoprism.nix
@@ -18,6 +18,9 @@ let
     in
     pkgs.writeShellScript "manage" ''
       ${setupEnv}
+      eval "$(${config.systemd.package}/bin/systemctl show -pUID,MainPID photoprism.service | ${pkgs.gnused}/bin/sed "s/UID/ServiceUID/")"
+      exec ${pkgs.util-linux}/bin/nsenter \
+        -t $MainPID -m -S $ServiceUID -G $ServiceUID --wdns=${cfg.storagePath} \
       exec ${cfg.package}/bin/photoprism "$@"
     '';
 in
diff --git a/nixos/modules/services/web-apps/youtrack.md b/nixos/modules/services/web-apps/youtrack.md
new file mode 100644
index 000000000000..f33f482ff970
--- /dev/null
+++ b/nixos/modules/services/web-apps/youtrack.md
@@ -0,0 +1,30 @@
+# YouTrack {#module-services-youtrack}
+
+YouTrack is a browser-based bug tracker, issue tracking system and project management software.
+
+## Installation {#module-services-youtrack-installation}
+
+YouTrack exposes a web GUI installer on first login.
+You need a token to access it.
+You can find this token in the log of the `youtrack` service. The log line looks like
+```
+* JetBrains YouTrack 2023.3 Configuration Wizard will be available on [http://127.0.0.1:8090/?wizard_token=somelongtoken] after start
+```
+
+## Upgrade from 2022.3 to 2023.x {#module-services-youtrack-upgrade-2022_3-2023_1}
+
+Starting with YouTrack 2023.1, JetBrains no longer distributes it as as JAR.
+The new distribution with the JetBrains Launcher as a ZIP changed the basic data structure and also some configuration parameters.
+Check out https://www.jetbrains.com/help/youtrack/server/YouTrack-Java-Start-Parameters.html for more information on the new configuration options.
+When upgrading to YouTrack 2023.1 or higher, a migration script will move the old state directory to `/var/lib/youtrack/2022_3` as a backup.
+A one-time manual update is required:
+
+1. Before you update take a backup of your YouTrack instance!
+2. Migrate the options you set in `services.youtrack.extraParams` and `services.youtrack.jvmOpts` to `services.youtrack.generalParameters` and `services.youtrack.environmentalParameters` (see the examples and [the YouTrack docs](https://www.jetbrains.com/help/youtrack/server/2023.3/YouTrack-Java-Start-Parameters.html))
+2. To start the upgrade set `services.youtrack.package = pkgs.youtrack`
+3. YouTrack then starts in upgrade mode, meaning you need to obtain the wizard token as above
+4. Select you want to **Upgrade** YouTrack
+5. As source you select `/var/lib/youtrack/2022_3/teamsysdata/` (adopt if you have a different state path)
+6. Change the data directory location to `/var/lib/youtrack/data/`. The other paths should already be right.
+
+If you migrate a larger YouTrack instance, it might be useful to set `-Dexodus.entityStore.refactoring.forceAll=true` in `services.youtrack.generalParameters` for the first startup of YouTrack 2023.x.
diff --git a/nixos/modules/services/web-apps/youtrack.nix b/nixos/modules/services/web-apps/youtrack.nix
index 79e1d12e0abb..abb4292113b6 100644
--- a/nixos/modules/services/web-apps/youtrack.nix
+++ b/nixos/modules/services/web-apps/youtrack.nix
@@ -1,130 +1,224 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
   cfg = config.services.youtrack;
-
-  extraAttr = concatStringsSep " " (mapAttrsToList (k: v: "-D${k}=${v}") (stdParams // cfg.extraParams));
-  mergeAttrList = lib.foldl' lib.mergeAttrs {};
-
-  stdParams = mergeAttrList [
-    (optionalAttrs (cfg.baseUrl != null) {
-      "jetbrains.youtrack.baseUrl" = cfg.baseUrl;
-    })
-    {
-    "java.aws.headless" = "true";
-    "jetbrains.youtrack.disableBrowser" = "true";
-    }
-  ];
 in
 {
-  options.services.youtrack = {
+  imports = [
+    (lib.mkRenamedOptionModule [ "services" "youtrack" "baseUrl" ] [ "services" "youtrack" "environmentalParameters" "base-url" ])
+    (lib.mkRenamedOptionModule [ "services" "youtrack" "port" ] [ "services" "youtrack" "environmentalParameters" "listen-port" ])
+    (lib.mkRemovedOptionModule [ "services" "youtrack" "maxMemory" ] "Please instead use `services.youtrack.generalParameters`.")
+    (lib.mkRemovedOptionModule [ "services" "youtrack" "maxMetaspaceSize" ] "Please instead use `services.youtrack.generalParameters`.")
+  ];
 
-    enable = mkEnableOption (lib.mdDoc "YouTrack service");
+  options.services.youtrack = {
+    enable = lib.mkEnableOption (lib.mdDoc "YouTrack service");
 
-    address = mkOption {
+    address = lib.mkOption {
       description = lib.mdDoc ''
         The interface youtrack will listen on.
       '';
       default = "127.0.0.1";
-      type = types.str;
+      type = lib.types.str;
     };
 
-    baseUrl = mkOption {
-      description = lib.mdDoc ''
-        Base URL for youtrack. Will be auto-detected and stored in database.
-      '';
-      type = types.nullOr types.str;
-      default = null;
-    };
-
-    extraParams = mkOption {
+    extraParams = lib.mkOption {
       default = {};
       description = lib.mdDoc ''
-        Extra parameters to pass to youtrack. See
+        Extra parameters to pass to youtrack.
+        Use to configure YouTrack 2022.x, deprecated with YouTrack 2023.x. Use `services.youtrack.generalParameters`.
         https://www.jetbrains.com/help/youtrack/standalone/YouTrack-Java-Start-Parameters.html
         for more information.
       '';
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           "jetbrains.youtrack.overrideRootPassword" = "tortuga";
         }
       '';
-      type = types.attrsOf types.str;
+      type = lib.types.attrsOf lib.types.str;
+      visible = false;
     };
 
-    package = mkPackageOption pkgs "youtrack" { };
-
-    port = mkOption {
+    package = lib.mkOption {
       description = lib.mdDoc ''
-        The port youtrack will listen on.
+        Package to use.
       '';
-      default = 8080;
-      type = types.port;
+      type = lib.types.package;
+      default = null;
+      relatedPackages = [ "youtrack_2022_3" "youtrack" ];
     };
 
-    statePath = mkOption {
+
+    statePath = lib.mkOption {
       description = lib.mdDoc ''
-        Where to keep the youtrack database.
+        Path were the YouTrack state is stored.
+        To this path the base version (e.g. 2023_1) of the used package will be appended.
       '';
-      type = types.path;
+      type = lib.types.path;
       default = "/var/lib/youtrack";
     };
 
-    virtualHost = mkOption {
+    virtualHost = lib.mkOption {
       description = lib.mdDoc ''
         Name of the nginx virtual host to use and setup.
         If null, do not setup anything.
       '';
       default = null;
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
     };
 
-    jvmOpts = mkOption {
+    jvmOpts = lib.mkOption {
       description = lib.mdDoc ''
         Extra options to pass to the JVM.
+        Only has a use with YouTrack 2022.x, deprecated with YouTrack 2023.x. Use `serivces.youtrack.generalParameters`.
         See https://www.jetbrains.com/help/youtrack/standalone/Configure-JVM-Options.html
         for more information.
       '';
-      type = types.separatedString " ";
-      example = "-XX:MetaspaceSize=250m";
+      type = lib.types.separatedString " ";
+      example = "--J-XX:MetaspaceSize=250m";
       default = "";
+      visible = false;
     };
 
-    maxMemory = mkOption {
+    autoUpgrade = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = lib.mdDoc "Whether YouTrack should auto upgrade it without showing the upgrade dialog.";
+    };
+
+    generalParameters = lib.mkOption {
+      type = with lib.types; listOf str;
       description = lib.mdDoc ''
-        Maximum Java heap size
+        General configuration parameters and other JVM options.
+        Only has an effect for YouTrack 2023.x.
+        See https://www.jetbrains.com/help/youtrack/server/2023.3/youtrack-java-start-parameters.html#general-parameters
+        for more information.
       '';
-      type = types.str;
-      default = "1g";
+      example = lib.literalExpression ''
+        [
+          "-Djetbrains.youtrack.admin.restore=true"
+          "-Xmx1024m"
+        ];
+      '';
+      default = [];
     };
 
-    maxMetaspaceSize = mkOption {
+    environmentalParameters = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = with lib.types; attrsOf (oneOf [ int str port ]);
+        options = {
+          listen-address = lib.mkOption {
+            type = lib.types.str;
+            default = "0.0.0.0";
+            description = lib.mdDoc "The interface YouTrack will listen on.";
+          };
+          listen-port = lib.mkOption {
+            type = lib.types.port;
+            default = 8080;
+            description = lib.mdDoc "The port YouTrack will listen on.";
+          };
+        };
+      };
       description = lib.mdDoc ''
-        Maximum java Metaspace memory.
+        Environmental configuration parameters, set imperatively. The values doesn't get removed, when removed in Nix.
+        Only has an effect for YouTrack 2023.x.
+        See https://www.jetbrains.com/help/youtrack/server/2023.3/youtrack-java-start-parameters.html#environmental-parameters
+        for more information.
+      '';
+      example = lib.literalExpression ''
+        {
+          secure-mode = "tls";
+        }
       '';
-      type = types.str;
-      default = "350m";
+      default = {};
     };
   };
 
-  config = mkIf cfg.enable {
-
-    systemd.services.youtrack = {
-      environment.HOME = cfg.statePath;
-      environment.YOUTRACK_JVM_OPTS = "${extraAttr}";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [ unixtools.hostname ];
-      serviceConfig = {
-        Type = "simple";
-        User = "youtrack";
-        Group = "youtrack";
-        Restart = "on-failure";
-        ExecStart = ''${cfg.package}/bin/youtrack --J-Xmx${cfg.maxMemory} --J-XX:MaxMetaspaceSize=${cfg.maxMetaspaceSize} ${cfg.jvmOpts} ${cfg.address}:${toString cfg.port}'';
+  config = lib.mkIf cfg.enable {
+    warnings = lib.optional (lib.versions.major cfg.package.version <= "2022")
+      "YouTrack 2022.x is deprecated. See https://nixos.org/manual/nixos/unstable/index.html#module-services-youtrack for details on how to upgrade."
+    ++ lib.optional (cfg.extraParams != "" && (lib.versions.major cfg.package.version >= "2023"))
+      "'services.youtrack.extraParams' is deprecated and has no effect on YouTrack 2023.x and newer. Please migrate to 'services.youtrack.generalParameters'"
+    ++ lib.optional (cfg.jvmOpts != "" && (lib.versions.major cfg.package.version >= "2023"))
+      "'services.youtrack.jvmOpts' is deprecated and has no effect on YouTrack 2023.x and newer. Please migrate to 'services.youtrack.generalParameters'";
+
+    # XXX: Drop all version feature switches at the point when we consider YT 2022.3 as outdated.
+    services.youtrack.package = lib.mkDefault (
+      if lib.versionAtLeast config.system.stateVersion "24.11" then pkgs.youtrack
+      else pkgs.youtrack_2022_3
+    );
+
+    services.youtrack.generalParameters = lib.optional (lib.versions.major cfg.package.version >= "2023")
+      "-Ddisable.configuration.wizard.on.upgrade=${lib.boolToString cfg.autoUpgrade}"
+      ++ (lib.mapAttrsToList (k: v: "-D${k}=${v}") cfg.extraParams);
+
+    systemd.services.youtrack = let
+      service_jar = let
+        mergeAttrList = lib.foldl' lib.mergeAttrs {};
+        stdParams = mergeAttrList [
+          (lib.optionalAttrs (cfg.environmentalParameters ? base-url && cfg.environmentalParameters.base-url != null) {
+            "jetbrains.youtrack.baseUrl" = cfg.environmentalParameters.base-url;
+          })
+          {
+          "java.aws.headless" = "true";
+          "jetbrains.youtrack.disableBrowser" = "true";
+          }
+        ];
+        extraAttr = lib.concatStringsSep " " (lib.mapAttrsToList (k: v: "-D${k}=${v}") (stdParams // cfg.extraParams));
+      in {
+        environment.HOME = cfg.statePath;
+        environment.YOUTRACK_JVM_OPTS = "${extraAttr}";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        path = with pkgs; [ unixtools.hostname ];
+        serviceConfig = {
+          Type = "simple";
+          User = "youtrack";
+          Group = "youtrack";
+          Restart = "on-failure";
+          ExecStart = ''${cfg.package}/bin/youtrack ${cfg.jvmOpts} ${cfg.environmentalParameters.listen-address}:${toString cfg.environmentalParameters.listen-port}'';
+        };
       };
-    };
+      service_zip = let
+        jvmoptions = pkgs.writeTextFile {
+          name = "youtrack.jvmoptions";
+          text = (lib.concatStringsSep "\n" cfg.generalParameters);
+        };
+
+        package = cfg.package.override {
+          statePath = cfg.statePath;
+        };
+      in {
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        path = with pkgs; [ unixtools.hostname ];
+        preStart = ''
+          # This detects old (i.e. <= 2022.3) installations that were not migrated yet
+          # and migrates them to the new state directory style
+          if [[ -d ${cfg.statePath}/teamsysdata ]] && [[ ! -d ${cfg.statePath}/2022_3 ]]
+          then
+            mkdir -p ${cfg.statePath}/2022_3
+            mv ${cfg.statePath}/teamsysdata ${cfg.statePath}/2022_3
+            mv ${cfg.statePath}/.youtrack ${cfg.statePath}/2022_3
+          fi
+          mkdir -p ${cfg.statePath}/{backups,conf,data,logs,temp}
+          ${pkgs.coreutils}/bin/ln -fs ${jvmoptions} ${cfg.statePath}/conf/youtrack.jvmoptions
+          ${package}/bin/youtrack configure ${lib.concatStringsSep " " (lib.mapAttrsToList (name: value: "--${name}=${toString value}") cfg.environmentalParameters )}
+        '';
+        serviceConfig = lib.mkMerge [
+          {
+            Type = "simple";
+            User = "youtrack";
+            Group = "youtrack";
+            Restart = "on-failure";
+            ExecStart = "${package}/bin/youtrack run";
+          }
+          (lib.mkIf (cfg.statePath == "/var/lib/youtrack") {
+            StateDirectory = "youtrack";
+          })
+        ];
+      };
+    in if (lib.versions.major cfg.package.version >= "2023") then service_zip else service_jar;
 
     users.users.youtrack = {
       description = "Youtrack service user";
@@ -136,7 +230,7 @@ in
 
     users.groups.youtrack = {};
 
-    services.nginx = mkIf (cfg.virtualHost != null) {
+    services.nginx = lib.mkIf (cfg.virtualHost != null) {
       upstreams.youtrack.servers."${cfg.address}:${toString cfg.port}" = {};
       virtualHosts.${cfg.virtualHost}.locations = {
         "/" = {
@@ -166,9 +260,10 @@ in
             proxy_set_header X-Forwarded-Proto $scheme;
           '';
         };
-
       };
     };
-
   };
+
+  meta.doc = ./youtrack.md;
+  meta.maintainers = [ lib.maintainers.leona ];
 }
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index f236a4c005ad..a7399bd55e77 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -2989,15 +2989,9 @@ let
 
       systemd.services.systemd-networkd = {
         wantedBy = [ "initrd.target" ];
-        # These before and conflicts lines can be removed when this PR makes it into a release:
-        # https://github.com/systemd/systemd/pull/27791
-        before = ["initrd-switch-root.target"];
-        conflicts = ["initrd-switch-root.target"];
       };
       systemd.sockets.systemd-networkd = {
         wantedBy = [ "initrd.target" ];
-        before = ["initrd-switch-root.target"];
-        conflicts = ["initrd-switch-root.target"];
       };
 
       systemd.services.systemd-network-generator.wantedBy = [ "sysinit.target" ];
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 0f8e355b2f4c..7e74f27174ec 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1177,6 +1177,39 @@ let
       '';
     };
 
+    restic =
+      let
+        repository = "rest:http://127.0.0.1:8000";
+        passwordFile = pkgs.writeText "restic-test-password" "test-password";
+      in
+      {
+        exporterConfig = {
+          enable = true;
+          inherit repository passwordFile;
+        };
+        metricProvider = {
+          services.restic.server = {
+            enable = true;
+            extraFlags = [ "--no-auth" ];
+          };
+          environment.systemPackages = [ pkgs.restic ];
+        };
+        exporterTest = ''
+          # prometheus-restic-exporter.service fails without initialised repository
+          systemctl("stop prometheus-restic-exporter.service")
+
+          # Initialise the repository
+          wait_for_unit("restic-rest-server.service")
+          wait_for_open_port(8000)
+          succeed("restic init --repo ${repository} --password-file ${passwordFile}")
+
+          systemctl("start prometheus-restic-exporter.service")
+          wait_for_unit("prometheus-restic-exporter.service")
+          wait_for_open_port(9753)
+          wait_until_succeeds("curl -sSf localhost:9753/metrics | grep 'restic_check_success 1.0'")
+        '';
+      };
+
     rspamd = {
       exporterConfig = {
         enable = true;
@@ -1684,7 +1717,12 @@ mapAttrs
       testScript = ''
         ${nodeName}.start()
         ${concatStringsSep "\n" (map (line:
-          if (builtins.substring 0 1 line == " " || builtins.substring 0 1 line == ")")
+          if builtins.any (b: b) [
+            (builtins.match "^[[:space:]]*$" line != null)
+            (builtins.substring 0 1 line == "#")
+            (builtins.substring 0 1 line == " ")
+            (builtins.substring 0 1 line == ")")
+          ]
           then line
           else "${nodeName}.${line}"
         ) (splitString "\n" (removeSuffix "\n" testConfig.exporterTest)))}
diff --git a/pkgs/applications/audio/bristol/default.nix b/pkgs/applications/audio/bristol/default.nix
index 39227fd06522..fc50691155ec 100644
--- a/pkgs/applications/audio/bristol/default.nix
+++ b/pkgs/applications/audio/bristol/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchurl, alsa-lib, libjack2, pkg-config, libpulseaudio, xorg }:
+{ lib, stdenv, fetchurl, alsa-lib, libjack2, pkg-config, libpulseaudio, xorg, copyDesktopItems, makeDesktopItem }:
 
-stdenv.mkDerivation  rec {
+stdenv.mkDerivation rec {
   pname = "bristol";
   version = "0.60.11";
 
@@ -9,9 +9,13 @@ stdenv.mkDerivation  rec {
     sha256 = "1fi2m4gmvxdi260821y09lxsimq82yv4k5bbgk3kyc3x1nyhn7vx";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config copyDesktopItems ];
   buildInputs = [
-    alsa-lib libjack2 libpulseaudio xorg.libX11 xorg.libXext
+    alsa-lib
+    libjack2
+    libpulseaudio
+    xorg.libX11
+    xorg.libXext
     xorg.xorgproto
   ];
 
@@ -30,11 +34,27 @@ stdenv.mkDerivation  rec {
     sed -e "s@\`which brighton\`@$out/bin/brighton@g" -i bin/startBristol
   '';
 
+  postInstall = ''
+    mkdir -p $out/share/icons/hicolor/scalable/apps/
+    ln -s $out/share/bristol/bitmaps/bicon.svg $out/share/icons/hicolor/scalable/apps/
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Bristol";
+      exec = "bristol";
+      icon = "bicon";
+      desktopName = "Bristol";
+      comment = "Graphical user interface for the Bristol synthesizer emulator";
+      categories = [ "AudioVideo" ];
+    })
+  ];
+
   meta = with lib; {
     description = "A range of synthesiser, electric piano and organ emulations";
     homepage = "https://bristol.sourceforge.net";
     license = licenses.gpl3;
-    platforms = ["x86_64-linux" "i686-linux"];
+    platforms = [ "x86_64-linux" "i686-linux" ];
     maintainers = [ maintainers.goibhniu ];
   };
 }
diff --git a/pkgs/applications/audio/grandorgue/default.nix b/pkgs/applications/audio/grandorgue/default.nix
index 9856b81c92b8..6ca3f39a9dc0 100644
--- a/pkgs/applications/audio/grandorgue/default.nix
+++ b/pkgs/applications/audio/grandorgue/default.nix
@@ -1,18 +1,34 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, fftwFloat, alsa-lib
-, zlib, wavpack, wxGTK32, udev, jackaudioSupport ? false, libjack2
-, imagemagick, libicns, makeWrapper, Cocoa
-, includeDemo ? true }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, fftwFloat
+, alsa-lib
+, zlib
+, wavpack
+, wxGTK32
+, udev
+, jackaudioSupport ? false
+, libjack2
+, imagemagick
+, libicns
+, yaml-cpp
+, makeWrapper
+, Cocoa
+, includeDemo ? true
+}:
 
 stdenv.mkDerivation rec {
   pname = "grandorgue";
-  version = "3.11.0";
+  version = "3.14.0";
 
   src = fetchFromGitHub {
     owner = "GrandOrgue";
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    sha256 = "sha256-l1KqER/vkNwgKLXIFUzHnYLw2ivGNP7hRiKhIOzn7pw=";
+    hash = "sha256-kPz11V2yNmBe80egNLYxh/m2B1nDca3C5sGbEnrkqnw=";
   };
 
   postPatch = ''
@@ -24,7 +40,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkg-config imagemagick libicns makeWrapper ];
 
-  buildInputs = [ fftwFloat zlib wavpack wxGTK32 ]
+  buildInputs = [ fftwFloat zlib wavpack wxGTK32 yaml-cpp ]
     ++ lib.optionals stdenv.isLinux [ alsa-lib udev ]
     ++ lib.optionals stdenv.isDarwin [ Cocoa ]
     ++ lib.optional jackaudioSupport libjack2;
@@ -53,5 +69,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.puzzlewolf ];
+    mainProgram = "GrandOrgue";
   };
 }
diff --git a/pkgs/applications/audio/polyphone/default.nix b/pkgs/applications/audio/polyphone/default.nix
index f7008bf66bba..0e73861aa0f4 100644
--- a/pkgs/applications/audio/polyphone/default.nix
+++ b/pkgs/applications/audio/polyphone/default.nix
@@ -29,8 +29,13 @@ mkDerivation rec {
   '';
 
   installPhase = ''
+    runHook preInstall
     install -d $out/bin
     install -m755 bin/polyphone $out/bin/
+
+    install -Dm444 ./contrib/com.polyphone_soundfonts.polyphone.desktop -t $out/share/applications/
+    install -Dm444 ./contrib/polyphone.svg -t $out/share/icons/hicolor/scalable/apps/
+    runHook postInstall
   '';
 
   qmakeFlags = [
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index 6a17905ccb29..c12135370d6c 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -38,14 +38,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mame";
-  version = "0.261";
+  version = "0.262";
   srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;
 
   src = fetchFromGitHub {
     owner = "mamedev";
     repo = "mame";
     rev = "mame${srcVersion}";
-    hash = "sha256-Tbsu4dYOBGwsPW94W0xN2+t4vqb1cWI7J1C2l6WU3qI=";
+    hash = "sha256-avVHtnmKPUq+mMtxyaqSaGyrdsi5LXF1YS8JAb2QvBo=";
   };
 
   outputs = [ "out" "tools" ];
diff --git a/pkgs/applications/graphics/lazpaint/default.nix b/pkgs/applications/graphics/lazpaint/default.nix
index 91562bb5d49e..d2d799dadaf6 100644
--- a/pkgs/applications/graphics/lazpaint/default.nix
+++ b/pkgs/applications/graphics/lazpaint/default.nix
@@ -1,30 +1,30 @@
 { lib, stdenv, fetchFromGitHub, lazarus, fpc, pango, cairo, glib
-, atk, gtk2, libX11, gdk-pixbuf, busybox, python3, makeWrapper }:
-
-with stdenv;
+, atk, gtk2, libX11, gdk-pixbuf, busybox, python3
+, makeWrapper
+}:
 
 let
   bgrabitmap = fetchFromGitHub {
     owner = "bgrabitmap";
     repo = "bgrabitmap";
-    rev = "v11.5.3";
-    sha256 = "sha256-qjBD9TVZQy1tKWHFWkuu6vdLjASzQb3+HRy0FLdd9a8=";
+    rev = "2814b069d55f726b9f3b4774d85d00dd72be9c05";
+    hash = "sha256-YibwdhlgjgI30gqYsKchgDPlOSpBiDBDJNlUDFMygGs=";
   };
   bgracontrols = fetchFromGitHub {
     owner = "bgrabitmap";
     repo = "bgracontrols";
-    rev = "v7.6";
-    sha256 = "sha256-btg9DMdYg+C8h0H7MU+uoo2Kb4OeLHoxFYHAv7LbLBA=";
+    rev = "v8.0";
+    hash = "sha256-5L05eGVN+xncd0/0XLFN6EL2ux4aAOsiU0BMoy0dKgg=";
   };
 in stdenv.mkDerivation rec {
   pname = "lazpaint";
-  version = "7.2.2";
+  version = "7.2.2-unstable-2024-01-20";
 
   src = fetchFromGitHub {
     owner = "bgrabitmap";
     repo = "lazpaint";
-    rev = "v${version}";
-    sha256 = "sha256-J6s0GnGJ7twEYW5+B72bB3EX4AYvLnhSPLbdhZWzlkw=";
+    rev = "fe54c2e2561c51218a5a2755842ce3fc2e0ebb35";
+    hash = "sha256-LaOTJiS+COJUlyJiN9H2kEKwv5lbJqOHsUXOnb+IQFA=";
   };
 
   nativeBuildInputs = [ lazarus fpc makeWrapper ];
@@ -49,23 +49,16 @@ in stdenv.mkDerivation rec {
       lazpaint/lazpaint.lpi
   '';
 
-  installPhase = ''
-    # Reuse existing install script
-    substituteInPlace Makefile --replace "/bin/bash" $BASH
-    cd lazpaint/release/debian
-    substituteInPlace makedeb.sh --replace "rm -rf" "ls"
-    patchShebangs ./makedeb.sh
-    PATH=$PATH:${busybox}/bin ./makedeb.sh
-    cp -r staging/usr $out
-
+  postBuild = ''
     # Python is needed for scripts
-    makeWrapper $out/share/lazpaint/lazpaint $out/bin/lazpaint \
+    wrapProgram $out/bin/lazpaint \
       --prefix PATH : ${lib.makeBinPath [ python3 ]}
   '';
 
   meta = with lib; {
     description = "Image editor like PaintBrush or Paint.Net";
-    homepage = "https://sourceforge.net/projects/lazpaint/";
+    homepage = "https://lazpaint.github.io";
+    downloadPage = "https://github.com/bgrabitmap/lazpaint/";
     license = licenses.gpl3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/applications/misc/avrdudess/default.nix b/pkgs/applications/misc/avrdudess/default.nix
index 1a59729ae9a7..4133fd8e5a29 100644
--- a/pkgs/applications/misc/avrdudess/default.nix
+++ b/pkgs/applications/misc/avrdudess/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation {
   pname = "avrdudess";
-  version = "2.15";
+  version = "2.16";
 
   src = fetchurl {
-    url = "https://github.com/ZakKemble/AVRDUDESS/releases/download/v2.15/AVRDUDESS-2.15-portable.zip";
-    sha256 = "sha256-TILveSFlZOzkd7XpW6haWZzrWTb7f/GMoj+fHNEJYLA=";
+    url = "https://github.com/ZakKemble/AVRDUDESS/releases/download/v2.16/AVRDUDESS-2.16-portable.zip";
+    sha256 = "sha256-Ow6WYdQfEDldI9q9CTpd13wtLZGTEkcHxz0Zg7QIZIs=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/misc/goldendict-ng/default.nix b/pkgs/applications/misc/goldendict-ng/default.nix
index fcae98b53078..5d86aece035d 100644
--- a/pkgs/applications/misc/goldendict-ng/default.nix
+++ b/pkgs/applications/misc/goldendict-ng/default.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "goldendict-ng";
-  version = "23.09.10";
+  version = "24.01.22";
 
   src = fetchFromGitHub {
     owner = "xiaoyifang";
     repo = "goldendict-ng";
-    rev = "v${finalAttrs.version}-WhiteDew.54c8bd56";
-    hash = "sha256-X9xqodCqHjppz1zIHLnb87NiDE4FWlXiQufhDu/rJq4=";
+    rev = "v${finalAttrs.version}-LoongYear.3dddb3be";
+    hash = "sha256-+OiZEkhNV06fZXPXv9zDzgJS5M3isHlcOXee3p/ejpw=";
   };
 
   nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook wrapGAppsHook ];
@@ -49,6 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     qt5compat
     qtmultimedia
     qtspeech
+    qtwayland
     libvorbis
     tomlplusplus
     fmt
@@ -86,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "An advanced multi-dictionary lookup program";
     platforms = platforms.linux;
     mainProgram = "goldendict";
-    maintainers = with maintainers; [ slbtty ];
+    maintainers = with maintainers; [ slbtty michojel ];
     license = licenses.gpl3Plus;
   };
 })
diff --git a/pkgs/applications/misc/monitorcontrol/default.nix b/pkgs/applications/misc/monitorcontrol/default.nix
index f9002b10b063..6c3a1ccec34e 100644
--- a/pkgs/applications/misc/monitorcontrol/default.nix
+++ b/pkgs/applications/misc/monitorcontrol/default.nix
@@ -1,19 +1,28 @@
-{ lib, fetchurl, stdenv, undmg }:
+{ lib, fetchurl, stdenv, _7zz }:
 
 # This cannot be built from source due to the problematic nature of XCode - so
 # this is what it's like when doves cry?
 
 stdenv.mkDerivation rec {
   pname = "MonitorControl";
-  version = "4.1.0";
+  version = "4.2.0";
 
   src = fetchurl {
     url =
       "https://github.com/MonitorControl/${pname}/releases/download/v${version}/MonitorControl.${version}.dmg";
-    sha256 = "iaxM9j78Sq1EH5TCY240N+D5bG6quk2dZj8T7nt9ATo=";
+    sha256 = "Q96uK6wVe1D2uLvWL+pFR6LcmrU7cgmr2Y5tPvvTDgI=";
   };
 
-  nativeBuildInputs = [ undmg ];
+  # MonitorControl.${version}.dmg is APFS formatted, unpack with 7zz
+  unpackCmd = ''
+    runHook preUnpack
+
+    7zz x $src
+
+    runHook postUnpack
+  '';
+
+  nativeBuildInputs = [ _7zz ];
 
   sourceRoot = "MonitorControl.app";
 
@@ -27,7 +36,7 @@ stdenv.mkDerivation rec {
     longDescription = "Controls your external display brightness and volume and shows native OSD. Use menulet sliders or the keyboard, including native Apple keys!";
     homepage = "https://github.com/MonitorControl/MonitorControl#readme";
     license = licenses.mit;
-    maintainers = with maintainers; [ cbleslie ];
+    maintainers = with maintainers; [ cbleslie cottand ];
     platforms = platforms.darwin;
   };
 }
diff --git a/pkgs/applications/misc/opencpn/default.nix b/pkgs/applications/misc/opencpn/default.nix
index 313f61e28ce0..89d656798008 100644
--- a/pkgs/applications/misc/opencpn/default.nix
+++ b/pkgs/applications/misc/opencpn/default.nix
@@ -7,15 +7,17 @@
 , cmake
 , curl
 , dbus
+, elfutils
 , fetchFromGitHub
-, fetchpatch
 , flac
 , gtk3
+, glew
+, gtest
 , jasper
+, lame
 , libGLU
 , libarchive
 , libdatrie
-, libelf
 , libepoxy
 , libexif
 , libogg
@@ -30,10 +32,13 @@
 , libxkbcommon
 , lsb-release
 , lz4
+, libmpg123
 , makeWrapper
 , pcre
+, pcre2
 , pkg-config
 , portaudio
+, rapidjson
 , sqlite
 , tinyxml
 , udev
@@ -42,31 +47,25 @@
 , xorg
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "opencpn";
-  version = "5.6.2";
+  version = "5.8.4";
 
   src = fetchFromGitHub {
     owner = "OpenCPN";
     repo = "OpenCPN";
-    rev = "Release_${version}";
-    hash = "sha256-sNZYf/2gtjRrrGPuazVnKTgcuIQpKPazhexqlK21T4g=";
+    rev = "Release_${finalAttrs.version}";
+    hash = "sha256-axRI3sssj2Q6IBfIeyvOa494b0EgKFP+lFL/QrGIybQ=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/OpenCPN/OpenCPN/commit/30fa16850ba97d3df0622273947e3e3975b8e6c0.patch";
-      sha256 = "sha256-Sb4FE9QJA5kMJi52/x1Az6rMTS3WSURPx4QAhcv2j9E=";
-    })
-  ];
-
   postPatch = lib.optionalString stdenv.isDarwin ''
-    sed -i '/fixup_bundle/d' CMakeLists.txt
+    sed -i '/fixup_bundle/d; /NO_DEFAULT_PATH/d' CMakeLists.txt
   '';
 
   nativeBuildInputs = [
     cmake
     pkg-config
+    gtest
   ] ++ lib.optionals stdenv.isLinux [
     lsb-release
   ] ++ lib.optionals stdenv.isDarwin [
@@ -80,15 +79,14 @@ stdenv.mkDerivation rec {
     dbus
     flac
   ] ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
-    # gtk3 propagates AppKit from the 10.12 SDK
     AppKit
   ] ++ [
     gtk3
+    glew
     jasper
     libGLU
     libarchive
     libdatrie
-    libelf
     libepoxy
     libexif
     libogg
@@ -100,19 +98,24 @@ stdenv.mkDerivation rec {
     libvorbis
     libxkbcommon
     lz4
+    libmpg123
     pcre
+    pcre2
     portaudio
+    rapidjson
     sqlite
     tinyxml
     wxGTK32
   ] ++ lib.optionals stdenv.isLinux [
     alsa-utils
+    elfutils
     libselinux
     libsepol
-    udev
     util-linux
     xorg.libXdmcp
     xorg.libXtst
+  ] ++ lib.optionals stdenv.isDarwin [
+    lame
   ];
 
   cmakeFlags = [ "-DOCPN_BUNDLE_DOCS=true" ];
@@ -136,4 +139,4 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     homepage = "https://opencpn.org/";
   };
-}
+})
diff --git a/pkgs/applications/misc/organicmaps/default.nix b/pkgs/applications/misc/organicmaps/default.nix
index 3d18c951c671..ec6fbca5d1d0 100644
--- a/pkgs/applications/misc/organicmaps/default.nix
+++ b/pkgs/applications/misc/organicmaps/default.nix
@@ -29,13 +29,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "organicmaps";
-  version = "2023.12.20-4";
+  version = "2024.01.09-5";
 
   src = fetchFromGitHub {
     owner = "organicmaps";
     repo = "organicmaps";
     rev = "${version}-android";
-    hash = "sha256-9yQMBP5Jta6P/FmYL6Ek3MzU1DKtVEwlwYAkNxC5pn4=";
+    hash = "sha256-VIznPMr+XKIobR4eFUVx880MND+EGAHKCYAkdDfgLDA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/prusa-slicer/default.nix b/pkgs/applications/misc/prusa-slicer/default.nix
index ab13a68d60e5..724bfcc4ecce 100644
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@@ -9,6 +9,7 @@
 , cereal
 , cgal
 , curl
+, darwin
 , dbus
 , eigen
 , expat
@@ -111,6 +112,8 @@ stdenv.mkDerivation (finalAttrs: {
     catch2
   ] ++ lib.optionals withSystemd [
     systemd
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk_11_0.frameworks.CoreWLAN
   ];
 
   separateDebugInfo = true;
@@ -190,6 +193,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/prusa3d/PrusaSlicer";
     license = licenses.agpl3;
     maintainers = with maintainers; [ moredread tweber tmarkus ];
+    platforms = platforms.unix;
   } // lib.optionalAttrs (stdenv.isDarwin) {
     mainProgram = "PrusaSlicer";
   };
diff --git a/pkgs/applications/misc/pure-maps/default.nix b/pkgs/applications/misc/pure-maps/default.nix
index 0220778277c1..d1bfe4132583 100644
--- a/pkgs/applications/misc/pure-maps/default.nix
+++ b/pkgs/applications/misc/pure-maps/default.nix
@@ -6,13 +6,13 @@
 
 mkDerivation rec {
   pname = "pure-maps";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "rinigus";
     repo = "pure-maps";
     rev = version;
-    hash = "sha256-07Jk5ufYbBAa/UY1B0IoyuOAVt15rGCxCRXu3OeYyWU=";
+    hash = "sha256-AZt0JcNegHkUkWy+NW5CNLZfxjjFyKWBrhLJgSTv3to=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/remarkable/restream/default.nix b/pkgs/applications/misc/remarkable/restream/default.nix
index 9af70769e3d9..c5958aff724c 100644
--- a/pkgs/applications/misc/remarkable/restream/default.nix
+++ b/pkgs/applications/misc/remarkable/restream/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "restream";
-  version = "1.2.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "rien";
     repo = pname;
-    rev = version;
-    sha256 = "0vyj0kng8c9inv2rbw1qdr43ic15s5x8fvk9mbw0vpc6g723x99g";
+    rev = "v${version}";
+    hash = "sha256-AXHKOfdIM3LsHF6u3M/lMhhcuPZADoEal7de3zlx7L4=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/misc/sway-contrib/default.nix b/pkgs/applications/misc/sway-contrib/default.nix
index df5ad07b1c5a..4ddca21774e0 100644
--- a/pkgs/applications/misc/sway-contrib/default.nix
+++ b/pkgs/applications/misc/sway-contrib/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv
+{ lib, stdenvNoCC
 , fetchFromGitHub
 , coreutils
 , makeWrapper
@@ -15,12 +15,12 @@
 }:
 
 let
-  version = "unstable-2023-06-30";
+  version = "0-unstable-2024-01-20";
   src = fetchFromGitHub {
     owner = "OctopusET";
     repo = "sway-contrib";
-    rev = "7e138bfc112872b79ac9fd766bc57c0f125b96d4";
-    hash = "sha256-u4sw1NeAhl4FJCG2YOeY45SHoN7tw6cSJwEL5iqr0uQ=";
+    rev = "b7825b218e677c65f6849be061b93bd5654991bf";
+    hash = "sha256-ZTfItJ77mrNSzXFVcj7OV/6zYBElBj+1LcLLHxBFypk=";
   };
 
   meta = with lib; {
@@ -31,7 +31,7 @@ let
 in
 {
 
-grimshot = stdenv.mkDerivation rec {
+grimshot = stdenvNoCC.mkDerivation {
   inherit version src;
 
   pname = "grimshot";
@@ -70,7 +70,7 @@ grimshot = stdenv.mkDerivation rec {
     fi
   '';
 
-  meta = with lib; {
+  meta = with lib; meta // {
     description = "A helper for screenshots within sway";
     maintainers = with maintainers; [ evils ];
     mainProgram = "grimshot";
@@ -78,11 +78,12 @@ grimshot = stdenv.mkDerivation rec {
 };
 
 
-inactive-windows-transparency = python3Packages.buildPythonApplication rec {
-  inherit version src;
-
+inactive-windows-transparency = let
   # long name is long
   lname = "inactive-windows-transparency";
+in python3Packages.buildPythonApplication {
+  inherit version src;
+
   pname = "sway-${lname}";
 
   format = "other";
@@ -95,7 +96,7 @@ inactive-windows-transparency = python3Packages.buildPythonApplication rec {
     install -Dm 0755 $src/${lname}.py $out/bin/${lname}.py
   '';
 
-  meta = with lib; {
+  meta = with lib; meta // {
     description = "It makes inactive sway windows transparent";
     mainProgram = "${lname}.py";
     maintainers = with maintainers; [
diff --git a/pkgs/applications/misc/tippecanoe/default.nix b/pkgs/applications/misc/tippecanoe/default.nix
index 19afb4fba29c..af730d0dd9a5 100644
--- a/pkgs/applications/misc/tippecanoe/default.nix
+++ b/pkgs/applications/misc/tippecanoe/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tippecanoe";
-  version = "2.41.2";
+  version = "2.41.3";
 
   src = fetchFromGitHub {
     owner = "felt";
     repo = "tippecanoe";
     rev = finalAttrs.version;
-    hash = "sha256-d5+0/+4NaW7BBYsRZ3WK8BJYVpUZUmwtvzjfBhS9lcc=";
+    hash = "sha256-yHX0hQbuPFaosBR/N7TmQKOHnd2LG6kkfGUBlaSkA8E=";
   };
 
   buildInputs = [ sqlite zlib ];
diff --git a/pkgs/applications/misc/xcruiser/default.nix b/pkgs/applications/misc/xcruiser/default.nix
index 7e3a391eb5bb..8144a66fb2ff 100644
--- a/pkgs/applications/misc/xcruiser/default.nix
+++ b/pkgs/applications/misc/xcruiser/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, gccmakedep, imake, libXt, libXaw, libXpm, libXext }:
+{ lib, stdenv, fetchurl, gccmakedep, imake, libXt, libXaw, libXpm, libXext, copyDesktopItems, makeDesktopItem }:
 
 stdenv.mkDerivation rec {
   pname = "xcruiser";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1r8whva38xizqdh7jmn6wcmfmsndc67pkw22wzfzr6rq0vf6hywi";
   };
 
-  nativeBuildInputs = [ gccmakedep imake ];
+  nativeBuildInputs = [ gccmakedep imake copyDesktopItems ];
   buildInputs = [ libXt libXaw libXpm libXext ];
 
   makeFlags = [
@@ -19,6 +19,16 @@ stdenv.mkDerivation rec {
     "XAPPLOADDIR=${placeholder "out"}/etc/X11/app-defaults"
   ];
 
+  desktopItems = [
+    (makeDesktopItem {
+      name = "XCruiser";
+      exec = "xcruiser";
+      desktopName = "XCruiser";
+      comment = "filesystem visualization utility";
+      categories = [ "Utility" ];
+    })
+  ];
+
   meta = with lib; {
     description = "Filesystem visualization utility";
     longDescription = ''
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 9ded680d513d..7e84255957e6 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -92,11 +92,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.62.153";
+  version = "1.62.156";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    hash = "sha256-7ifBFWKsegXe0zBdVQO2BiKoBd2zhYX8RYiYcs8v0bg=";
+    hash = "sha256-U+MjXuF3rv5N4juKeIzUfnSNVLx1LGn+Ws+b5p252Qk=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/cluster/cilium/default.nix b/pkgs/applications/networking/cluster/cilium/default.nix
index 17cb6980054d..52d5f222fe9f 100644
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.15.20";
+  version = "0.15.21";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-uwHy1Wdf9/BXfPgBFc0Lkd3tewqY/+MjqaFnb8dFnH0=";
+    hash = "sha256-jagNtaR7YAOdvy/yJrIRQfr8UQTrEoVrPLaGklt8mUk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/kubergrunt/default.nix b/pkgs/applications/networking/cluster/kubergrunt/default.nix
index f872fa74f5df..e5a5e1ba9f4b 100644
--- a/pkgs/applications/networking/cluster/kubergrunt/default.nix
+++ b/pkgs/applications/networking/cluster/kubergrunt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubergrunt";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = "kubergrunt";
     rev = "v${version}";
-    sha256 = "sha256-bPZZzvbHynW0FtfmE78agBDADmCyBS2a4E/K+tJHkQY=";
+    sha256 = "sha256-r2lx+R/TQxD/miCJK3V//N3gKiCrg/mneT9BS+ZqRiU=";
   };
 
   vendorHash = "sha256-K24y41qpuyBHqljUAtNQu3H8BNqznxYOsvEVo+57OtY=";
diff --git a/pkgs/applications/networking/cluster/nerdctl/default.nix b/pkgs/applications/networking/cluster/nerdctl/default.nix
index ee9defe2eeca..84d27a186c12 100644
--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "nerdctl";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-6YMDGvNl1uNMWR1xTPRjYGwaKXC5c4oUy88VRY2Bedw=";
+    hash = "sha256-Y76H/88/esziIermnzfOS48FLBRnVBN8u4C381n184M=";
   };
 
-  vendorHash = "sha256-tXLuOZUoMhVfhhYxnxNw+nYofhEFMKI1b94lVPySd3E=";
+  vendorHash = "sha256-oiBgZQtqFwq189h/Bb4CrFhs4RDYUoEEOjrccujGclU=";
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/tilt/assets.nix b/pkgs/applications/networking/cluster/tilt/assets.nix
index 0f98bbdb10db..6bc70de3213f 100644
--- a/pkgs/applications/networking/cluster/tilt/assets.nix
+++ b/pkgs/applications/networking/cluster/tilt/assets.nix
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation rec {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/web/yarn.lock";
-    hash = "sha256-UTxglGn3eIgahZg4kxolg2f2MTReCL4r/GyWNg4105E=";
+    hash = "sha256-0JpoAQKRmU7P1bzYNR/vqtPjOOSw8wSlNjXl2f6uBrw=";
   };
 
   configurePhase = ''
diff --git a/pkgs/applications/networking/cluster/tilt/default.nix b/pkgs/applications/networking/cluster/tilt/default.nix
index 646f0c9a0a3d..819d3dbc5095 100644
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@@ -5,13 +5,13 @@ let args = rec {
       /* Do not use "dev" as a version. If you do, Tilt will consider itself
         running in development environment and try to serve assets from the
         source tree, which is not there once build completes.  */
-      version = "0.33.6";
+      version = "0.33.10";
 
       src = fetchFromGitHub {
         owner = "tilt-dev";
         repo = "tilt";
         rev = "v${version}";
-        hash = "sha256-WtE8ExUKFRtdYeg0+My/DB+L/qT+J1EaKHKChNjC5oI=";
+        hash = "sha256-LPb2tC3xIGhjiLYkTU+NBIUoqiicO2ORM6Nt1eTnwQs=";
       };
     };
 
diff --git a/pkgs/applications/networking/instant-messengers/armcord/default.nix b/pkgs/applications/networking/instant-messengers/armcord/default.nix
index 40287b90580e..c52ed6fe5cc5 100644
--- a/pkgs/applications/networking/instant-messengers/armcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/armcord/default.nix
@@ -38,7 +38,7 @@
 
 stdenv.mkDerivation rec {
   pname = "armcord";
-  version = "3.2.5";
+  version = "3.2.6";
 
   src =
     let
@@ -47,11 +47,11 @@ stdenv.mkDerivation rec {
       {
         x86_64-linux = fetchurl {
           url = "${base}/v${version}/ArmCord_${version}_amd64.deb";
-          hash = "sha256-6zlYm4xuYpG+Bgsq5S+B/Zt9TRB2GZnueKAg2ywYLE4=";
+          hash = "sha256-9AcxqCxhLAjYclaw6lri06R0PgQQeRHTbLJLEdhDCWU=";
         };
         aarch64-linux = fetchurl {
           url = "${base}/v${version}/ArmCord_${version}_arm64.deb";
-          hash = "sha256-HJu1lRa3zOTohsPMe23puHxg1VMWNR2aOjDQJqc4TqE=";
+          hash = "sha256-/uk2slpNF1sSTW6z319Yg9yx/s45fJPvJQJpY11ULVw=";
         };
       }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index e92ce49adcfa..fd5ec61bf07d 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -4,7 +4,7 @@ let
     if stdenv.isLinux then {
       stable = "0.0.42";
       ptb = "0.0.66";
-      canary = "0.0.257";
+      canary = "0.0.265";
       development = "0.0.11";
     } else {
       stable = "0.0.292";
@@ -25,7 +25,7 @@ let
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-2AUCTWKEB4cy2tFfnJMn8Ywz1B8a3H6yhkVIcB0fLME=";
+        hash = "sha256-uIo12mTFyvCyxazquLu2YlAbCqzQSBIY6O5AmC9hMpE=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
diff --git a/pkgs/applications/networking/instant-messengers/element/pin.nix b/pkgs/applications/networking/instant-messengers/element/pin.nix
index 830c7080925a..9a10c2eddba8 100644
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@@ -1,9 +1,9 @@
 {
-  "version" = "1.11.55";
+  "version" = "1.11.57";
   "hashes" = {
-    "desktopSrcHash" = "sha256-Gk6RjhU0vJymz2KmaNJgnuGcSVyJo53iWR3naOx49X4=";
-    "desktopYarnHash" = "0v3j54a2ixik424za0iwj4sf60g934480jyp5lblhg7z8y5xqks8";
-    "webSrcHash" = "sha256-dAfPYw3qqj+xY3ZaACsT/Vtp57mag6PJtquxqXZ6F1Q=";
-    "webYarnHash" = "1aqhdk9mgz5hq7iawjclzfd78wi64kygkklwg6sp6qfv1ayi6b51";
+    "desktopSrcHash" = "sha256-U1Koq+YrTQnbJAQmMuBioU6lxtw3oH9U3W3iMIDbibY=";
+    "desktopYarnHash" = "03kx7g1fhm4qn6iq450156fgw1x6bf0sngmqhd2hrhp699mjxs5s";
+    "webSrcHash" = "sha256-ZoB6ALNUDYh8nYUYsPNeiCaXn3qvg3NRJzDRJaHT4oU=";
+    "webYarnHash" = "0vznx306p3racnq5xv27ywvlrdxql9x8i3fl77i5vlc8g7crpc3m";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
index 53a515c5bd00..c392151620dc 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix {} rec {
   pname = "signal-desktop-beta";
   dir = "Signal Beta";
-  version = "6.44.0-beta.1";
+  version = "6.47.0-beta.1";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-SW/br1k7lO0hQngST0qV9Qol1hA9f1NZe86A5uyYhcI=";
+  hash = "sha256-9vbdWdV8dVFyxDMGLvE/uQKeSl+ze5agI5QYZMr84/w=";
 }
diff --git a/pkgs/applications/networking/ipfs-cluster/default.nix b/pkgs/applications/networking/ipfs-cluster/default.nix
index cecb3ce3b03b..19a1b38eed42 100644
--- a/pkgs/applications/networking/ipfs-cluster/default.nix
+++ b/pkgs/applications/networking/ipfs-cluster/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "ipfs-cluster";
-  version = "1.0.7";
+  version = "1.0.8";
 
-  vendorHash = "sha256-/Kjm/hM+lKsZ6fzStDyOitp7Vtt7Vb8ak7E/W0lbW20=";
+  vendorHash = "sha256-uwDXUy9mh/DvLuwj8Htm55wla5/JjvZH5ztJbqnox+U=";
 
   src = fetchFromGitHub {
     owner = "ipfs-cluster";
     repo = "ipfs-cluster";
     rev = "v${version}";
-    hash = "sha256-eBbbD77nnjcumhrsixAlI09B1ZAxK5IOHoBeJGgj+TY=";
+    hash = "sha256-qZUoYJjw3Qac7Kmg5PfNWTDM8Ra3rqrbjScLbK6FRx4=";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/mailreaders/aerc/default.nix b/pkgs/applications/networking/mailreaders/aerc/default.nix
index 4ca892d13125..2c776a05d053 100644
--- a/pkgs/applications/networking/mailreaders/aerc/default.nix
+++ b/pkgs/applications/networking/mailreaders/aerc/default.nix
@@ -12,17 +12,17 @@
 
 buildGoModule rec {
   pname = "aerc";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromSourcehut {
     owner = "~rjarry";
     repo = "aerc";
     rev = version;
-    hash = "sha256-vmr2U0bz6A7aMZZBtOitA5gKQpXKuNhYxRCmholHYa8=";
+    hash = "sha256-XpVUUAtm6o4DXIouTKRX/8mLERb/4nA+VUGeB21mfjE=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-j/wTmlVcyVI4gnjbi7KLzk5rdnZtZLrdSNbihtQJxRY=";
+  vendorHash = "sha256-rycAGqZhO48bPTFO2y2J1d16oon24sEEUns4EayWDvg=";
 
   nativeBuildInputs = [
     scdoc
diff --git a/pkgs/applications/office/jameica/default.nix b/pkgs/applications/office/jameica/default.nix
index 8fe04cf43ed9..655de5227bb0 100644
--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@@ -1,8 +1,8 @@
 { lib, stdenv, fetchFromGitHub, makeDesktopItem, makeWrapper, wrapGAppsHook, ant, jdk, jre, gtk2, glib, xorg, Cocoa }:
 
 let
-  _version = "2.10.2";
-  _build = "484";
+  _version = "2.10.4";
+  _build = "487";
   version = "${_version}-${_build}";
 
   swtSystem =
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "willuhn";
     repo = "jameica";
     rev = "V_${builtins.replaceStrings ["."] ["_"] _version}_BUILD_${_build}";
-    sha256 = "1x9sybknzsfxp9z0pvw9dx80732ynyap57y03p7xwwjbcrnjla57";
+    hash = "sha256-MSVSd5DyVL+dcfTDv1M99hxickPwT2Pt6QGNsu6DGZI=";
   };
 
   dontWrapGApps = true;
diff --git a/pkgs/applications/office/libreoffice/darwin/default.nix b/pkgs/applications/office/libreoffice/darwin/default.nix
index 3f69a7fd54e9..0cec562106ab 100644
--- a/pkgs/applications/office/libreoffice/darwin/default.nix
+++ b/pkgs/applications/office/libreoffice/darwin/default.nix
@@ -75,6 +75,7 @@ stdenvNoCC.mkDerivation {
     homepage = "https://libreoffice.org/";
     license = licenses.lgpl3;
     maintainers = with maintainers; [ tricktron ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = [ "x86_64-darwin" "aarch64-darwin" ];
   };
 }
diff --git a/pkgs/applications/office/paperless-ngx/default.nix b/pkgs/applications/office/paperless-ngx/default.nix
index afe241222068..94b4ac77b68a 100644
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@@ -18,6 +18,7 @@
 , xcbuild
 , pango
 , pkg-config
+, nltk-data
 }:
 
 let
@@ -293,6 +294,7 @@ python.pkgs.buildPythonApplication rec {
 
   passthru = {
     inherit python path frontend;
+    nltkData = with nltk-data; [ punkt snowball_data stopwords ];
     tests = { inherit (nixosTests) paperless; };
   };
 
diff --git a/pkgs/applications/office/treesheets/default.nix b/pkgs/applications/office/treesheets/default.nix
index db967e7c0435..1fda91523a5e 100644
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "treesheets";
-  version = "unstable-2024-01-26";
+  version = "unstable-2024-01-30";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "treesheets";
-    rev = "a1705796a8e1eddd63cc847f4c4c71634c5c7eb8";
-    sha256 = "bF24E+30u/8//vAwjXrnUqybieIUlEDYyvI5sHnLkco=";
+    rev = "f11a3418cb6e403898be215f3efcc2fcb7bc0f19";
+    sha256 = "FOeRfNPX1ER1ZMUWy+4b67XfrATPPZntfhywjaGgDpo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/biology/igv/default.nix b/pkgs/applications/science/biology/igv/default.nix
index f7be7119b85d..be663628a426 100644
--- a/pkgs/applications/science/biology/igv/default.nix
+++ b/pkgs/applications/science/biology/igv/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchzip, jdk11, wrapGAppsHook }:
+{ lib, stdenv, fetchzip, jdk17, testers, wrapGAppsHook, igv }:
 
 stdenv.mkDerivation rec {
   pname = "igv";
@@ -13,10 +13,10 @@ stdenv.mkDerivation rec {
     cp -Rv * $out/share/
 
     sed -i "s#prefix=.*#prefix=$out/share#g" $out/share/igv.sh
-    sed -i 's#java#${jdk11}/bin/java#g' $out/share/igv.sh
+    sed -i 's#java#${jdk17}/bin/java#g' $out/share/igv.sh
 
     sed -i "s#prefix=.*#prefix=$out/share#g" $out/share/igvtools
-    sed -i 's#java#${jdk11}/bin/java#g' $out/share/igvtools
+    sed -i 's#java#${jdk17}/bin/java#g' $out/share/igvtools
 
     ln -s $out/share/igv.sh $out/bin/igv
     ln -s $out/share/igvtools $out/bin/igvtools
@@ -26,6 +26,11 @@ stdenv.mkDerivation rec {
   '';
   nativeBuildInputs = [ wrapGAppsHook ];
 
+  passthru.tests.version = testers.testVersion {
+    package = igv;
+  };
+
+
   meta = with lib; {
     homepage = "https://www.broadinstitute.org/igv/";
     description = "A visualization tool for interactive exploration of genomic datasets";
diff --git a/pkgs/applications/science/logic/lean4/default.nix b/pkgs/applications/science/logic/lean4/default.nix
index 092489f84456..97336c06b806 100644
--- a/pkgs/applications/science/logic/lean4/default.nix
+++ b/pkgs/applications/science/logic/lean4/default.nix
@@ -5,22 +5,23 @@
 , git
 , gmp
 , perl
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "lean4";
-  version = "4.4.0";
+  version = "4.5.0";
 
   src = fetchFromGitHub {
     owner = "leanprover";
     repo = "lean4";
-    rev = "v${version}";
-    hash = "sha256-lU67wjl6yJP2r97lHYxrJqn+JhqMcBIbz/+qlCgY3/o=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-KTCTk4Fpbmm7FsUo03tAvenC6HuB3zJGax6iGTwLaXM=";
   };
 
   postPatch = ''
     substituteInPlace src/CMakeLists.txt \
-      --replace 'set(GIT_SHA1 "")' 'set(GIT_SHA1 "${src.rev}")'
+      --replace 'set(GIT_SHA1 "")' 'set(GIT_SHA1 "${finalAttrs.src.rev}")'
 
     # Remove tests that fails in sandbox.
     # It expects `sourceRoot` to be a git repository.
@@ -54,13 +55,19 @@ stdenv.mkDerivation rec {
     NIX_LDFLAGS = "-l${stdenv.cc.libcxx.cxxabi.libName}";
   };
 
+  passthru.tests = {
+    version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
   meta = with lib; {
     description = "Automatic and interactive theorem prover";
     homepage = "https://leanprover.github.io/";
-    changelog = "https://github.com/leanprover/lean4/blob/${src.rev}/RELEASES.md";
+    changelog = "https://github.com/leanprover/lean4/blob/${finalAttrs.src.rev}/RELEASES.md";
     license = licenses.asl20;
     platforms = platforms.all;
     maintainers = with maintainers; [ marsam ];
     mainProgram = "lean";
   };
-}
+})
diff --git a/pkgs/applications/science/logic/z3/default.nix b/pkgs/applications/science/logic/z3/default.nix
index 9ede6a922da6..b247599a0813 100644
--- a/pkgs/applications/science/logic/z3/default.nix
+++ b/pkgs/applications/science/logic/z3/default.nix
@@ -89,8 +89,8 @@ let common = { version, sha256, patches ? [ ], tag ? "z3" }:
 in
 {
   z3_4_12 = common {
-    version = "4.12.4";
-    sha256 = "sha256-cxl7D47dRn+uMVOHbF0avj5+ZFWjaJ7lXj/8l6r9q2I=";
+    version = "4.12.5";
+    sha256 = "sha256-Qj9w5s02OSMQ2qA7HG7xNqQGaUacA1d4zbOHynq5k+A=";
   };
   z3_4_11 = common {
     version = "4.11.2";
diff --git a/pkgs/applications/science/misc/boinc/default.nix b/pkgs/applications/science/misc/boinc/default.nix
index 45209881f7a9..b2a76f5fb252 100644
--- a/pkgs/applications/science/misc/boinc/default.nix
+++ b/pkgs/applications/science/misc/boinc/default.nix
@@ -27,14 +27,14 @@
 
 stdenv.mkDerivation rec {
   pname = "boinc";
-  version = "7.24.2";
+  version = "7.24.3";
 
   src = fetchFromGitHub {
     name = "${pname}-${version}-src";
     owner = "BOINC";
     repo = "boinc";
     rev = "client_release/${lib.versions.majorMinor version}/${version}";
-    hash = "sha256-Aaoqf53wagCkzkZUs7mVbE2Z2P6GvxiQYxPrL6ahGqA=";
+    hash = "sha256-0gyCO5t8t0SbOCBClVVu+C2VpBlxsnoRHBRYgI8nNO4=";
   };
 
   nativeBuildInputs = [ libtool automake autoconf m4 pkg-config ];
diff --git a/pkgs/applications/science/misc/gplates/default.nix b/pkgs/applications/science/misc/gplates/default.nix
index e6cebbc53b73..283a14e99650 100644
--- a/pkgs/applications/science/misc/gplates/default.nix
+++ b/pkgs/applications/science/misc/gplates/default.nix
@@ -12,6 +12,7 @@
 , gmp
 , libGL
 , libGLU
+, libSM
 , mpfr
 , proj
 , python3
@@ -58,6 +59,7 @@ in mkDerivation rec {
     gmp
     libGL
     libGLU
+    libSM
     mpfr
     proj
     python
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index ee3610c5f6f6..c5534c18d7bb 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -2,7 +2,6 @@
 , lib
 , callPackage
 , fetchurl
-, fetchpatch
 , makeWrapper
 , cmake
 , coreutils
@@ -58,7 +57,7 @@
 
 stdenv.mkDerivation rec {
   pname = "root";
-  version = "6.30.02";
+  version = "6.30.04";
 
   passthru = {
     tests = import ./tests { inherit callPackage; };
@@ -66,7 +65,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    hash = "sha256-eWWkVtGtHuDV/kdpv1qP7Cka9oTtk9sPMICpw2JDUYM=";
+    hash = "sha256-K0GAtpjznMZdkQhNgzqIRRWzJbxfZzyOOavoGLAl2Mw=";
   };
 
   nativeBuildInputs = [ makeWrapper cmake pkg-config git ];
@@ -110,13 +109,6 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./sw_vers.patch
-
-    # Fix for builtin_llvm=OFF
-    # https://github.com/root-project/root/pull/14238
-    (fetchpatch {
-      url = "https://github.com/root-project/root/commit/1477d3adebf27a19f3a8b85f21c27a0a5649c7ff.diff";
-      hash = "sha256-g+FqXBTWXA7t7F/rMarnmOK2014oCNnNJbHhjH+Tvjw=";
-    })
   ];
 
   preConfigure = ''
diff --git a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
index 1daeeb81410a..80eee27eb2d9 100644
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@@ -40,8 +40,8 @@ let
       }
     else
       {
-        version = "2023.3";
-        hash = "sha256-Tsj40MevdrE/j9FtuOLBIOdJ3kOa6VVNn2U/gS140cs=";
+        version = "2024";
+        hash = "sha256-BNIm1SBmqLw6QuANYhPec3tOwpLiZwMGWST/AZVoAeI=";
       };
 
 in stdenv.mkDerivation rec {
diff --git a/pkgs/applications/version-management/forgejo/default.nix b/pkgs/applications/version-management/forgejo/default.nix
index 823928576b93..07ce100f2a9a 100644
--- a/pkgs/applications/version-management/forgejo/default.nix
+++ b/pkgs/applications/version-management/forgejo/default.nix
@@ -24,7 +24,7 @@ let
     pname = "forgejo-frontend";
     inherit (forgejo) src version;
 
-    npmDepsHash = "sha256-nXQew6PR5z+FGzmD15WBclnOYxzNZxTmHypuzh5+7Ew=";
+    npmDepsHash = "sha256-I7eq9PB2Od7aaji+VrZj05VVCsGtCiXEMy88xrA8Ktg=";
 
     patches = [
       ./package-json-npm-build-frontend.patch
@@ -39,17 +39,17 @@ let
 in
 buildGoModule rec {
   pname = "forgejo";
-  version = "1.21.4-0";
+  version = "1.21.5-0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "forgejo";
     repo = "forgejo";
     rev = "v${version}";
-    hash = "sha256-m5y9lg1XAyOWA9jyeieGhzgJ9FaNorS45GCJPwMftXI=";
+    hash = "sha256-SmNmMlO9bEccrk0oWm7VnBaIRGJgTQ5hOSIn6DRiYqk=";
   };
 
-  vendorHash = "sha256-eL3wxoRjxpkv012SqqifNLN9IOez5TbfGfZRgEX0AEM=";
+  vendorHash = "sha256-5BznZiPZCwFEl74JVf7ujFtzsTyG6AcKvQG0LdaMKe4=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/version-management/gh/default.nix b/pkgs/applications/version-management/gh/default.nix
index aae3cbfafe27..33d968c53757 100644
--- a/pkgs/applications/version-management/gh/default.nix
+++ b/pkgs/applications/version-management/gh/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.42.1";
+  version = "2.43.1";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-5kTBOWdL31UfFDp8XC+lc2vJrXZ0PBJafXyczMPn59o=";
+    hash = "sha256-FPKYp3tdYXncHjfo6E6tRnEG9AQ0RU6FaezwMlTOCtA=";
   };
 
-  vendorHash = "sha256-XBoC1sHfxInkamSHNm7Vb3AKCgIch6uYx0jJWqN7PN8=";
+  vendorHash = "sha256-r1zcwBz/mJOv1RU4Ilgg73yH37xu7a/BmqgAkiODq0I=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/version-management/git-publish/default.nix b/pkgs/applications/version-management/git-publish/default.nix
index 94949396ee9f..d84c5f096b8c 100644
--- a/pkgs/applications/version-management/git-publish/default.nix
+++ b/pkgs/applications/version-management/git-publish/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, python, perl, fetchFromGitHub, installShellFiles }:
 stdenv.mkDerivation rec {
   pname = "git-publish";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "stefanha";
     repo = "git-publish";
     rev = "v${version}";
-    sha256 = "14rz5kli6sz171cvdc46z3z0nnpd57rliwr6nn6vjjc49yyfwgl4";
+    hash = "sha256-jjpbr+ZqG4U8/z0PurnXR+IUKQkG3QB8YqhDkH8uu2Y=";
   };
 
   nativeBuildInputs = [ perl installShellFiles ];
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index 66f2f4e82ef3..09114d2275e7 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -20,12 +20,12 @@
 
 buildGoModule rec {
   pname = "gitea";
-  version = "1.21.4";
+  version = "1.21.5";
 
   # not fetching directly from the git repo, because that lacks several vendor files for the web UI
   src = fetchurl {
     url = "https://dl.gitea.com/gitea/${version}/gitea-src-${version}.tar.gz";
-    hash = "sha256-bkRI2m7aHrQH5wQbm4MoygrF5da7j4i8Qd/aoMJbhS0=";
+    hash = "sha256-VnJF6CSssQYs8yIKmXvxYHh2CfLiJhuKtjRdqKIQGxw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index 09e50b4fb9eb..9c194c45b991 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "1.7.12";
+  version = "1.7.13";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    hash = "sha256-o3ZqSE7ahUAihY/tqXdNgKzs64h0DBxrZaxjSF9smcs=";
+    hash = "sha256-y3CYDZbA2QjIn1vyq/p1F1pAVxQHi/0a6hGWZCRWzyk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index 44b9a150a1a0..f6f2e5f5a843 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.24.3";
+  version = "2.24.5";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    hash = "sha256-B6hJXm4SABYTIFPd9unTNkDtQxeMPBk98/2Q1TQedEA=";
+    hash = "sha256-mn6HkGLQM5kx6yzV4IK+GTV6pCoIm1CNjQ8AZLv3sMw=";
   };
 
   postPatch = ''
@@ -16,7 +16,7 @@ buildGoModule rec {
     rm -rf e2e/
   '';
 
-  vendorHash = "sha256-ymNd8DMkttSiF167RSIWQbL8RHPYXp4D8ctFoSPC0io=";
+  vendorHash = "sha256-KR+4OZKabshnGpkPq8vtEutvQUE+3jVwAlfAwFVlscU=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 
diff --git a/pkgs/applications/virtualization/runc/default.nix b/pkgs/applications/virtualization/runc/default.nix
index 38ec1e6244da..71ff22032cb5 100644
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "runc";
-  version = "1.1.11";
+  version = "1.1.12";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
     rev = "v${version}";
-    hash = "sha256-3LZWidINg15Aqoswml/BY7ZmLvz0XsbtYV5Cx8h5lpM=";
+    hash = "sha256-N77CU5XiGYIdwQNPFyluXjseTeaYuNJ//OsEUS0g/v0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/build-support/fetchgithub/default.nix b/pkgs/build-support/fetchgithub/default.nix
index 37f7dcfa3006..4ce3c6e84d76 100644
--- a/pkgs/build-support/fetchgithub/default.nix
+++ b/pkgs/build-support/fetchgithub/default.nix
@@ -28,7 +28,11 @@ let
   useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit || (sparseCheckout != []);
   # We prefer fetchzip in cases we don't need submodules as the hash
   # is more stable in that case.
-  fetcher = if useFetchGit then fetchgit else fetchzip.override { withUnzip = false; };
+  fetcher =
+    if useFetchGit then fetchgit
+    # fetchzip may not be overridable when using external tools, for example nix-prefetch
+    else if fetchzip ? override then fetchzip.override { withUnzip = false; }
+    else fetchzip;
   privateAttrs = lib.optionalAttrs private {
     netrcPhase = ''
       if [ -z "''$${varBase}USERNAME" -o -z "''$${varBase}PASSWORD" ]; then
diff --git a/pkgs/build-support/testers/hasPkgConfigModules/tester.nix b/pkgs/build-support/testers/hasPkgConfigModules/tester.nix
index 137739a1b48a..bbcc4f0c0f71 100644
--- a/pkgs/build-support/testers/hasPkgConfigModules/tester.nix
+++ b/pkgs/build-support/testers/hasPkgConfigModules/tester.nix
@@ -34,7 +34,7 @@ runCommand testName {
     for moduleName in $moduleNames; do
       echo "checking pkg-config module $moduleName in $buildInputs"
       set +e
-      version="$(pkg-config --modversion $moduleName)"
+      version="$($PKG_CONFIG --modversion $moduleName)"
       r=$?
       set -e
       if [[ $r = 0 ]]; then
@@ -42,7 +42,7 @@ runCommand testName {
         printf '%s\t%s\n' "$moduleName" "$version" >> "$out"
       else
         echo "These modules were available in the input propagation closure:"
-        pkg-config --list-all
+        $PKG_CONFIG --list-all
         echo "❌ pkg-config module $moduleName was not found"
         false
       fi
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 9643c9ba048e..a38231bdcaa3 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -152,19 +152,21 @@ rec {
     , meta ? { }
     , allowSubstitutes ? false
     , preferLocalBuild ? true
+    , derivationArgs ? { } # Extra arguments to pass to `stdenv.mkDerivation`
     }:
     let
       matches = builtins.match "/bin/([^/]+)" destination;
     in
     runCommand name
-      {
+      ({
         inherit text executable checkPhase allowSubstitutes preferLocalBuild;
-        passAsFile = [ "text" ];
+        passAsFile = [ "text" ]
+          ++ derivationArgs.passAsFile or [ ];
         meta = lib.optionalAttrs (executable && matches != null)
           {
             mainProgram = lib.head matches;
-          } // meta;
-      }
+          } // meta // derivationArgs.meta or {};
+      } // removeAttrs derivationArgs [ "passAsFile" "meta" ])
       ''
         target=$out${lib.escapeShellArg destination}
         mkdir -p "$(dirname "$target")"
@@ -238,53 +240,94 @@ rec {
       meta.mainProgram = name;
     };
 
-  /*
-    Similar to writeShellScriptBin and writeScriptBin.
-    Writes an executable Shell script to /nix/store/<store path>/bin/<name> and
-    checks its syntax with shellcheck and the shell's -n option.
-    Individual checks can be foregone by putting them in the excludeShellChecks
-    list, e.g. [ "SC2016" ].
-    Automatically includes sane set of shellopts (errexit, nounset, pipefail)
-    and handles creation of PATH based on runtimeInputs
-
-    Note that the checkPhase uses stdenv.shell for the test run of the script,
-    while the generated shebang uses runtimeShell. If, for whatever reason,
-    those were to mismatch you might lose fidelity in the default checks.
-
-    Example:
-
-    Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
-
-
-    writeShellApplication {
-      name = "my-file";
-      runtimeInputs = [ curl w3m ];
-      text = ''
-        curl -s 'https://nixos.org' | w3m -dump -T text/html
-       '';
-    }
-
-  */
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
   writeShellApplication =
-    { name
-    , text
-    , runtimeInputs ? [ ]
-    , meta ? { }
-    , checkPhase ? null
-    , excludeShellChecks ? [ ]
+    {
+      /*
+         The name of the script to write.
+
+         Type: String
+       */
+      name,
+      /*
+         The shell script's text, not including a shebang.
+
+         Type: String
+       */
+      text,
+      /*
+         Inputs to add to the shell script's `$PATH` at runtime.
+
+         Type: [String|Derivation]
+       */
+      runtimeInputs ? [ ],
+      /*
+         Extra environment variables to set at runtime.
+
+         Type: AttrSet
+       */
+      runtimeEnv ? null,
+      /*
+         `stdenv.mkDerivation`'s `meta` argument.
+
+         Type: AttrSet
+       */
+      meta ? { },
+      /*
+         The `checkPhase` to run. Defaults to `shellcheck` on supported
+         platforms and `bash -n`.
+
+         The script path will be given as `$target` in the `checkPhase`.
+
+         Type: String
+       */
+      checkPhase ? null,
+      /*
+         Checks to exclude when running `shellcheck`, e.g. `[ "SC2016" ]`.
+
+         See <https://www.shellcheck.net/wiki/> for a list of checks.
+
+         Type: [String]
+       */
+      excludeShellChecks ? [ ],
+      /*
+         Bash options to activate with `set -o` at the start of the script.
+
+         Defaults to `[ "errexit" "nounset" "pipefail" ]`.
+
+         Type: [String]
+       */
+      bashOptions ? [ "errexit" "nounset" "pipefail" ],
+      /* Extra arguments to pass to `stdenv.mkDerivation`.
+
+         :::{.caution}
+         Certain derivation attributes are used internally,
+         overriding those could cause problems.
+         :::
+
+         Type: AttrSet
+       */
+      derivationArgs ? { },
     }:
     writeTextFile {
-      inherit name meta;
+      inherit name meta derivationArgs;
       executable = true;
       destination = "/bin/${name}";
       allowSubstitutes = true;
       preferLocalBuild = false;
       text = ''
         #!${runtimeShell}
-        set -o errexit
-        set -o nounset
-        set -o pipefail
-      '' + lib.optionalString (runtimeInputs != [ ]) ''
+        ${lib.concatMapStringsSep "\n" (option: "set -o ${option}") bashOptions}
+      '' + lib.optionalString (runtimeEnv != null)
+        (lib.concatStrings
+          (lib.mapAttrsToList
+            (name: value: ''
+              ${lib.toShellVar name value}
+              export ${name}
+            '')
+            runtimeEnv))
+      + lib.optionalString (runtimeInputs != [ ]) ''
 
         export PATH="${lib.makeBinPath runtimeInputs}:$PATH"
       '' + ''
diff --git a/pkgs/build-support/trivial-builders/test/writeShellApplication.nix b/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
index 6ce6f0720fcf..c50f5a4d283f 100644
--- a/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
+++ b/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
@@ -1,29 +1,141 @@
-/*
-  Run with:
+# Run with:
+# nix-build -A tests.trivial-builders.writeShellApplication
+{ writeShellApplication
+, writeTextFile
+, runCommand
+, lib
+, linkFarm
+, diffutils
+, hello
+}:
+let
+  checkShellApplication = args@{name, expected, ...}:
+    let
+      writeShellApplicationArgs = builtins.removeAttrs args ["expected"];
+      script = writeShellApplication writeShellApplicationArgs;
+      executable = lib.getExe script;
+      expected' = writeTextFile {
+        name = "${name}-expected";
+        text = expected;
+      };
+      actual = "${name}-actual";
+    in
+    runCommand name { } ''
+      echo "Running test executable ${name}"
+      ${executable} > ${actual}
+      echo "Got output from test executable:"
+      cat ${actual}
+      echo "Checking test output against expected output:"
+      ${diffutils}/bin/diff --color --unified ${expected'} ${actual}
+      touch $out
+    '';
+in
+linkFarm "writeShellApplication-tests" {
+  test-meta =
+    let
+      script = writeShellApplication {
+        name = "test-meta";
+        text = "";
+        meta.description = "A test for the `writeShellApplication` `meta` argument.";
+      };
+    in
+    assert script.meta.mainProgram == "test-meta";
+    assert script.meta.description == "A test for the `writeShellApplication` `meta` argument.";
+    script;
 
-      cd nixpkgs
-      nix-build -A tests.trivial-builders.writeShellApplication
-*/
+  test-runtime-inputs =
+    checkShellApplication {
+      name = "test-runtime-inputs";
+      text = ''
+        hello
+      '';
+      runtimeInputs = [ hello ];
+      expected = "Hello, world!\n";
+    };
 
-{ lib, writeShellApplication, runCommand }:
-let
-  pkg = writeShellApplication {
-    name = "test-script";
+  test-runtime-env =
+    checkShellApplication {
+      name = "test-runtime-env";
+      runtimeEnv = {
+        MY_COOL_ENV_VAR = "my-cool-env-value";
+        MY_OTHER_COOL_ENV_VAR = "my-other-cool-env-value";
+        # Check that we can serialize a bunch of different types:
+        BOOL = true;
+        INT = 1;
+        LIST = [1 2 3];
+        MAP = {
+          a = "a";
+          b = "b";
+        };
+      };
+      text = ''
+        echo "$MY_COOL_ENV_VAR"
+        echo "$MY_OTHER_COOL_ENV_VAR"
+      '';
+      expected = ''
+        my-cool-env-value
+        my-other-cool-env-value
+      '';
+    };
+
+  test-check-phase =
+    checkShellApplication {
+      name = "test-check-phase";
+      text = "";
+      checkPhase = ''
+        echo "echo -n hello" > $target
+      '';
+      expected = "hello";
+    };
+
+  test-argument-forwarding =
+    checkShellApplication {
+      name = "test-argument-forwarding";
+      text = "";
+      derivationArgs.MY_BUILD_TIME_VARIABLE = "puppy";
+      derivationArgs.postCheck = ''
+        if [[ "$MY_BUILD_TIME_VARIABLE" != puppy ]]; then
+          echo "\$MY_BUILD_TIME_VARIABLE is not set to 'puppy'!"
+          exit 1
+        fi
+      '';
+      meta.description = "A test checking that `writeShellApplication` forwards extra arguments to `stdenv.mkDerivation`.";
+      expected = "";
+    };
+
+  test-exclude-shell-checks = writeShellApplication {
+    name = "test-exclude-shell-checks";
     excludeShellChecks = [ "SC2016" ];
     text = ''
-      echo -e '#!/usr/bin/env bash\n' \
-       'echo "$SHELL"' > /tmp/something.sh  # this line would normally
-                                            # ...cause shellcheck error
+      # Triggers SC2016: Expressions don't expand in single quotes, use double
+      # quotes for that.
+      echo '$SHELL'
     '';
   };
-in
-  assert pkg.meta.mainProgram == "test-script";
-  runCommand "test-writeShellApplication" { } ''
 
-    echo Testing if writeShellApplication builds without shellcheck error...
-
-    target=${lib.getExe pkg}
+  test-bash-options-pipefail = checkShellApplication {
+    name = "test-bash-options-pipefail";
+    text = ''
+      touch my-test-file
+      echo puppy | grep doggy | sed 's/doggy/puppy/g'
+      #            ^^^^^^^^^^ This will fail.
+      true
+    '';
+    # Don't use `pipefail`:
+    bashOptions = ["errexit" "nounset"];
+    expected = "";
+  };
 
-    touch $out
-  ''
+  test-bash-options-nounset = checkShellApplication {
+    name = "test-bash-options-nounset";
+    text = ''
+      echo -n "$someUndefinedVariable"
+    '';
+    # Don't use `nounset`:
+    bashOptions = [];
+    # Don't warn about the undefined variable at build time:
+    excludeShellChecks = [ "SC2154" ];
+    expected = "";
+  };
 
+}
diff --git a/pkgs/by-name/aa/aaaaxy/package.nix b/pkgs/by-name/aa/aaaaxy/package.nix
index 415711d50278..e84f74714e5d 100644
--- a/pkgs/by-name/aa/aaaaxy/package.nix
+++ b/pkgs/by-name/aa/aaaaxy/package.nix
@@ -20,17 +20,17 @@
 
 buildGoModule rec {
   pname = "aaaaxy";
-  version = "1.4.137";
+  version = "1.4.160";
 
   src = fetchFromGitHub {
     owner = "divVerent";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-noKAf+Xd6yW45+0gtKBlRwCKNGCg7YBbWswOP7clv+M=";
+    hash = "sha256-BI3qnt/u0BXEHJ1E7jUh6jAUXxJZAUX+5Joih1g0JAU=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-ig5ai28PR3VJUoVGexlfP2OMYmKI0qltTot4zIqfdO4=";
+  vendorHash = "sha256-m6nSWw+KluP0X3mB18m7OEFzeRFw/XS4JiqARqGopvQ=";
 
   buildInputs = [
     alsa-lib
diff --git a/pkgs/by-name/al/alsa-lib-with-plugins/package.nix b/pkgs/by-name/al/alsa-lib-with-plugins/package.nix
new file mode 100644
index 000000000000..4388884f75a6
--- /dev/null
+++ b/pkgs/by-name/al/alsa-lib-with-plugins/package.nix
@@ -0,0 +1,52 @@
+{ lib
+, pkgs
+, alsa-lib
+, plugins ? [ pkgs.alsa-plugins ]
+, lndir
+, symlinkJoin
+, runCommand
+}:
+let
+  merged = symlinkJoin { name = "alsa-plugins-merged"; paths = plugins; };
+in
+runCommand "${alsa-lib.pname}-${alsa-lib.version}" {
+  meta = with lib; {
+    description = "wrapper to ease access to ALSA plugins";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ gm6k ];
+  };
+  outputs = alsa-lib.outputs;
+} (
+    (
+      lib.concatMapStringsSep "\n" (
+        output: ''
+          mkdir ${builtins.placeholder output}
+          ${lndir}/bin/lndir ${lib.attrByPath [output] null alsa-lib} \
+            ${builtins.placeholder output}
+        ''
+      ) alsa-lib.outputs
+    ) + ''
+    cp -r ${merged}/lib/alsa-lib $out/lib
+    (
+      echo $out | wc -c
+      echo ${alsa-lib} | wc -c
+    ) | xargs echo | grep -q "^\(.*\) \1$" || (
+      echo cannot binary patch
+      exit 1
+    )
+    rm $out/lib/libasound.la
+    rm $out/lib/libasound.so.?.?.?
+    rm $dev/lib/pkgconfig/alsa.pc
+    rm $dev/nix-support/propagated-build-inputs
+    cp ${alsa-lib}/lib/libasound.la $out/lib
+    cp ${alsa-lib}/lib/libasound.so.?.?.? $out/lib
+    cp ${alsa-lib.dev}/lib/pkgconfig/alsa.pc $dev/lib/pkgconfig
+    cp ${alsa-lib.dev}/nix-support/propagated-build-inputs $dev/nix-support
+    sed -i \
+        $out/lib/libasound.la \
+        $out/lib/libasound.so.?.?.? \
+        $dev/lib/pkgconfig/alsa.pc \
+        $dev/nix-support/propagated-build-inputs \
+      -e "s@${alsa-lib}@$out@g"
+  ''
+)
diff --git a/pkgs/by-name/am/amazon-ssm-agent/package.nix b/pkgs/by-name/am/amazon-ssm-agent/package.nix
index 7c8ff4336fdf..f508e2d2e8f5 100644
--- a/pkgs/by-name/am/amazon-ssm-agent/package.nix
+++ b/pkgs/by-name/am/amazon-ssm-agent/package.nix
@@ -42,13 +42,13 @@ let
 in
 buildGoModule rec {
   pname = "amazon-ssm-agent";
-  version = "3.2.2143.0";
+  version = "3.2.2222.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-ssm-agent";
     rev = "refs/tags/${version}";
-    hash = "sha256-RE17XoioTVlqASpHl6y7ykbK9sYqUIF05ROnXf05NrU=";
+    hash = "sha256-0mXf7n+Cd5t3xAB/84ejdCzcZviBLODBPkJah1X63+0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/as/ast-grep/package.nix b/pkgs/by-name/as/ast-grep/package.nix
index cbc30af9e69a..67afe28bc346 100644
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ast-grep";
-  version = "0.17.0";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     rev = version;
-    hash = "sha256-/lWvFYSE4gFbVPlJMROGcb86mVviGdh1tFAY74qTTX4=";
+    hash = "sha256-hr6VAqBsv3szVClR93y5ickkrNKjvl6BfzqKA3zc6vM=";
   };
 
-  cargoHash = "sha256-r1vfh2JtBjWFgXrijlFxPyRr8LRAIogiA2TZHI5MJRM=";
+  cargoHash = "sha256-ttJMtaQfVnFj4/wUz4fn8X/EmUwW+usqhmWhy4Y0AB8=";
 
   # Work around https://github.com/NixOS/nixpkgs/issues/166205.
   env = lib.optionalAttrs stdenv.cc.isClang {
diff --git a/pkgs/by-name/au/authentik/ldap.nix b/pkgs/by-name/au/authentik/ldap.nix
new file mode 100644
index 000000000000..1745e5556d3c
--- /dev/null
+++ b/pkgs/by-name/au/authentik/ldap.nix
@@ -0,0 +1,18 @@
+{ lib, buildGoModule, authentik }:
+
+buildGoModule {
+  pname = "authentik-ldap-outpost";
+  inherit (authentik) version src;
+
+  vendorHash = "sha256-74rSuZrO5c7mjhHh0iQlJEkOslsFrcDb1aRXXC4RsUM=";
+
+  CGO_ENABLED = 0;
+
+  subPackages = [ "cmd/ldap" ];
+
+  meta = authentik.meta // {
+    description = "The authentik ldap outpost. Needed for the extendal ldap API.";
+    homepage = "https://goauthentik.io/docs/providers/ldap/";
+    mainProgram = "ldap";
+  };
+}
diff --git a/pkgs/by-name/au/authentik/outposts.nix b/pkgs/by-name/au/authentik/outposts.nix
new file mode 100644
index 000000000000..05649628b3e8
--- /dev/null
+++ b/pkgs/by-name/au/authentik/outposts.nix
@@ -0,0 +1,5 @@
+{ callPackage }:
+
+{
+  ldap = callPackage ./ldap.nix { };
+}
diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix
new file mode 100644
index 000000000000..a4de19b066d7
--- /dev/null
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -0,0 +1,254 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, buildNpmPackage
+, buildGoModule
+, runCommand
+, openapi-generator-cli
+, nodejs
+, python3
+, codespell
+, makeWrapper }:
+
+let
+  version = "2023.10.7";
+
+  src = fetchFromGitHub {
+    owner = "goauthentik";
+    repo = "authentik";
+    rev = "version/${version}";
+    hash = "sha256-+1IdXRt28UZ2KTa0zsmjneNUOcutP99UUwqcYyVyqTI=";
+  };
+
+  meta = with lib; {
+    description = "The authentication glue you need";
+    changelog = "https://github.com/goauthentik/authentik/releases/tag/version%2F${version}";
+    homepage = "https://goauthentik.io/";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jvanbruegge ];
+  };
+
+  website = buildNpmPackage {
+    pname = "authentik-website";
+    inherit version src meta;
+    npmDepsHash = "sha256-4dgFxEvMnp+35nSQNsEchtN1qoS5X2KzEbLPvMnyR+k=";
+
+    NODE_ENV = "production";
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
+    postPatch = ''
+      cd website
+    '';
+
+    installPhase = ''
+      cp -r help $out
+    '';
+
+    npmInstallFlags = [ "--include=dev" ];
+    npmBuildScript = "build-docs-only";
+  };
+
+  clientapi = stdenvNoCC.mkDerivation {
+    pname = "authentik-client-api";
+    inherit version src meta;
+
+    postPatch = ''
+      rm Makefile
+
+      substituteInPlace ./scripts/api-ts-config.yaml \
+        --replace-fail '/local' "$(pwd)/"
+    '';
+
+    nativeBuildInputs = [ openapi-generator-cli ];
+    buildPhase = ''
+      runHook preBuild
+      openapi-generator-cli generate -i ./schema.yml \
+      -g typescript-fetch -o $out \
+      -c ./scripts/api-ts-config.yaml \
+        --additional-properties=npmVersion=${nodejs.pkgs.npm.version} \
+        --git-repo-id authentik --git-user-id goauthentik
+      runHook postBuild
+    '';
+  };
+
+  webui = buildNpmPackage {
+    pname = "authentik-webui";
+    inherit version meta;
+
+    src = runCommand "authentik-webui-source" {} ''
+      mkdir -p $out/web/node_modules/@goauthentik/
+      cp -r ${src}/web $out/
+      ln -s ${src}/website $out/
+      ln -s ${clientapi} $out/web/node_modules/@goauthentik/api
+    '';
+    npmDepsHash = "sha256-5aCKlArtoEijGqeYiY3zoV0Qo7/Xt5hSXbmy2uYZpok=";
+
+    postPatch = ''
+      cd web
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir $out
+      cp -r dist $out/dist
+      cp -r authentik $out/authentik
+      runHook postInstall
+    '';
+
+    NODE_ENV = "production";
+    NODE_OPTIONS = "--openssl-legacy-provider";
+
+    npmInstallFlags = [ "--include=dev" ];
+  };
+
+  python = python3.override {
+    self = python;
+    packageOverrides = final: prev: {
+      authentik-django = prev.buildPythonPackage {
+        pname = "authentik-django";
+        inherit version src meta;
+        pyproject = true;
+
+        postPatch = ''
+          substituteInPlace authentik/root/settings.py \
+            --replace-fail 'Path(__file__).absolute().parent.parent.parent' "\"$out\""
+          substituteInPlace authentik/lib/default.yml \
+            --replace-fail '/blueprints' "$out/blueprints"
+          substituteInPlace pyproject.toml \
+            --replace-fail 'dumb-init = "*"' "" \
+            --replace-fail 'djangorestframework-guardian' 'djangorestframework-guardian2'
+        '';
+
+        nativeBuildInputs = [ prev.poetry-core ];
+
+        propagatedBuildInputs = with prev; [
+          argon2-cffi
+          celery
+          channels
+          channels-redis
+          colorama
+          dacite
+          daphne
+          deepmerge
+          defusedxml
+          django
+          django-filter
+          django-guardian
+          django-model-utils
+          django-prometheus
+          django-redis
+          djangorestframework
+          djangorestframework-guardian2
+          docker
+          drf-spectacular
+          duo-client
+          facebook-sdk
+          flower
+          geoip2
+          gunicorn
+          httptools
+          kubernetes
+          ldap3
+          lxml
+          opencontainers
+          packaging
+          paramiko
+          psycopg
+          pycryptodome
+          pydantic
+          pydantic-scim
+          pyjwt
+          pyyaml
+          requests-oauthlib
+          sentry-sdk
+          structlog
+          swagger-spec-validator
+          twilio
+          twisted
+          ua-parser
+          urllib3
+          uvicorn
+          uvloop
+          watchdog
+          webauthn
+          websockets
+          wsproto
+          xmlsec
+          zxcvbn
+          jsonpatch
+        ] ++ [
+          codespell
+        ];
+
+        postInstall = ''
+          mkdir -p $out/web $out/website
+          cp -r lifecycle manage.py $out/${prev.python.sitePackages}/
+          cp -r blueprints $out/
+          cp -r ${webui}/dist ${webui}/authentik $out/web/
+          cp -r ${website} $out/website/help
+          ln -s $out/${prev.python.sitePackages}/lifecycle $out/lifecycle
+        '';
+      };
+    };
+  };
+
+  inherit (python.pkgs) authentik-django;
+
+  proxy = buildGoModule {
+    pname = "authentik-proxy";
+    inherit version src meta;
+
+    postPatch = ''
+      substituteInPlace internal/gounicorn/gounicorn.go \
+        --replace-fail './lifecycle' "${authentik-django}/lifecycle"
+      substituteInPlace web/static.go \
+        --replace-fail './web' "${authentik-django}/web"
+      substituteInPlace internal/web/static.go \
+        --replace-fail './web' "${authentik-django}/web"
+    '';
+
+    CGO_ENABLED = 0;
+
+    vendorHash = "sha256-74rSuZrO5c7mjhHh0iQlJEkOslsFrcDb1aRXXC4RsUM=";
+
+    postInstall = ''
+      mv $out/bin/server $out/bin/authentik
+    '';
+
+    subPackages = [ "cmd/server" ];
+  };
+
+in stdenvNoCC.mkDerivation {
+  pname = "authentik";
+  inherit src version;
+
+  postPatch = ''
+    rm Makefile
+    patchShebangs lifecycle/ak
+
+    # This causes issues in systemd services
+    substituteInPlace lifecycle/ak \
+      --replace-fail 'printf' '>&2 printf' \
+      --replace-fail '> /dev/stderr' ""
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp -r lifecycle/ak $out/bin/
+
+    wrapProgram $out/bin/ak \
+      --prefix PATH : ${lib.makeBinPath [ (python.withPackages (ps: [ps.authentik-django])) proxy ]} \
+      --set TMPDIR /dev/shm \
+      --set PYTHONDONTWRITEBYTECODE 1 \
+      --set PYTHONUNBUFFERED 1
+    runHook postInstall
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  meta = meta // {
+    mainProgram = "ak";
+  };
+}
diff --git a/pkgs/by-name/bi/bitbake-language-server/package.nix b/pkgs/by-name/bi/bitbake-language-server/package.nix
index 97cc8a63fc66..68b536d1319c 100644
--- a/pkgs/by-name/bi/bitbake-language-server/package.nix
+++ b/pkgs/by-name/bi/bitbake-language-server/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "bitbake-language-server";
-  version = "0.0.7";
+  version = "0.0.8";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Freed-Wu";
     repo = pname;
     rev = version;
-    hash = "sha256-FQKZtrzfjEkAIyzrJvI7qiB4gV2yAH9w1fwO6oLPhNc=";
+    hash = "sha256-WJpa2LP95vrJG/OjiLSx8zEPO5ZOw66M5s3r2dufQJA=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/bo/boxed-cpp/package.nix b/pkgs/by-name/bo/boxed-cpp/package.nix
index c5a5dacd4875..3475f29868d2 100644
--- a/pkgs/by-name/bo/boxed-cpp/package.nix
+++ b/pkgs/by-name/bo/boxed-cpp/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (final: {
   pname = "boxed-cpp";
-  version = "1.2.0";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "contour-terminal";
     repo = "boxed-cpp";
     rev = "v${final.version}";
-    hash = "sha256-Su0FdDi1JVoXd7rJ1SG4cQg2G/+mW5iU1892ee6mRl8=";
+    hash = "sha256-/zC9DV2nFY1ipqsM1p/WMdSf/nZkhlqJ2Ce/FzGWGGI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ca/cargo-xwin/package.nix b/pkgs/by-name/ca/cargo-xwin/package.nix
index 274ab5ef77ec..b361b2a808ac 100644
--- a/pkgs/by-name/ca/cargo-xwin/package.nix
+++ b/pkgs/by-name/ca/cargo-xwin/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-xwin";
-  version = "0.16.3";
+  version = "0.16.4";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-xwin";
     rev = "v${version}";
-    hash = "sha256-3i/XlCuHjVBSH4XZR5M457H+kheKZoJXlwqRwPhSnCM=";
+    hash = "sha256-nJgy9KoqrCD4NGFOJMN9f1XDyIrZ0a5WHTRX6G/+tnU=";
   };
 
-  cargoHash = "sha256-yKoUcrAZy66qahDvRgOnbJmXuUXDjDBTGt2p5gXjVyI=";
+  cargoHash = "sha256-JCCL/QV1DjmXTY3UChZ4BfA9VSyOTQLIfh6DSF/kIuA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
diff --git a/pkgs/by-name/co/cosmic-edit/Cargo.lock b/pkgs/by-name/co/cosmic-edit/Cargo.lock
index f58cf5af778c..fbfce7d41330 100644
--- a/pkgs/by-name/co/cosmic-edit/Cargo.lock
+++ b/pkgs/by-name/co/cosmic-edit/Cargo.lock
@@ -365,9 +365,9 @@ dependencies = [
 
 [[package]]
 name = "async-io"
-version = "2.2.2"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6afaa937395a620e33dc6a742c593c01aced20aa376ffb0f628121198578ccc7"
+checksum = "fb41eb19024a91746eba0773aa5e16036045bbf45733766661099e182ea6a744"
 dependencies = [
  "async-lock 3.3.0",
  "cfg-if 1.0.0",
@@ -375,8 +375,8 @@ dependencies = [
  "futures-io",
  "futures-lite 2.2.0",
  "parking",
- "polling 3.3.1",
- "rustix 0.38.28",
+ "polling 3.3.2",
+ "rustix 0.38.30",
  "slab",
  "tracing",
  "windows-sys 0.52.0",
@@ -415,7 +415,7 @@ dependencies = [
  "cfg-if 1.0.0",
  "event-listener 3.1.0",
  "futures-lite 1.13.0",
- "rustix 0.38.28",
+ "rustix 0.38.30",
  "windows-sys 0.48.0",
 ]
 
@@ -436,13 +436,13 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e47d90f65a225c4527103a8d747001fc56e375203592b25ad103e1ca13124c5"
 dependencies = [
- "async-io 2.2.2",
+ "async-io 2.3.0",
  "async-lock 2.8.0",
  "atomic-waker",
  "cfg-if 1.0.0",
  "futures-core",
  "futures-io",
- "rustix 0.38.28",
+ "rustix 0.38.30",
  "signal-hook-registry",
  "slab",
  "windows-sys 0.48.0",
@@ -488,7 +488,7 @@ name = "atomicwrites"
 version = "0.4.2"
 source = "git+https://github.com/jackpot51/rust-atomicwrites#043ab4859d53ffd3d55334685303d8df39c9f768"
 dependencies = [
- "rustix 0.38.28",
+ "rustix 0.38.30",
  "tempfile",
  "windows-sys 0.48.0",
 ]
@@ -585,9 +585,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.1"
+version = "2.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
+checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
 dependencies = [
  "serde",
 ]
@@ -998,7 +998,7 @@ dependencies = [
 [[package]]
 name = "cosmic-config"
 version = "0.1.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "atomicwrites",
  "cosmic-config-derive",
@@ -1013,7 +1013,7 @@ dependencies = [
 [[package]]
 name = "cosmic-config-derive"
 version = "0.1.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "quote",
  "syn 1.0.109",
@@ -1031,7 +1031,6 @@ dependencies = [
  "i18n-embed",
  "i18n-embed-fl",
  "ignore",
- "lazy_static",
  "lexical-sort",
  "libcosmic",
  "log",
@@ -1059,9 +1058,9 @@ dependencies = [
 [[package]]
 name = "cosmic-text"
 version = "0.10.0"
-source = "git+https://github.com/pop-os/cosmic-text?branch=refactor#dd4c4cbbe2d5ed5046054b5361a6eeead50e0bb0"
+source = "git+https://github.com/pop-os/cosmic-text#8457e68d984c465f7c5306424a73aa162aff32f2"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "cosmic_undo_2",
  "fontdb",
  "libm",
@@ -1074,6 +1073,7 @@ dependencies = [
  "swash",
  "syntect",
  "sys-locale",
+ "ttf-parser 0.20.0",
  "unicode-bidi",
  "unicode-linebreak",
  "unicode-script",
@@ -1083,7 +1083,7 @@ dependencies = [
 [[package]]
 name = "cosmic-theme"
 version = "0.1.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "almost",
  "cosmic-config",
@@ -1233,7 +1233,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e16e44ab292b1dddfdaf7be62cfd8877df52f2f3fde5858d95bab606be259f20"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "libloading 0.8.1",
  "winapi",
 ]
@@ -1494,7 +1494,7 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97fb1b703ffbc7ebd216eba7900008049a56ace55580ecb2ee7fa801e8d8be87"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "bytemuck",
  "drm-ffi",
  "drm-fourcc",
@@ -1703,9 +1703,9 @@ checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
 
 [[package]]
 name = "fdeflate"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "209098dd6dfc4445aa6111f0e98653ac323eaa4dfd212c9ca3931bf9955c31bd"
+checksum = "4f9bfee30e4dedf0ab8b422f03af778d9612b63f502710fc500a334ebe2de645"
 dependencies = [
  "simd-adler32",
 ]
@@ -2221,9 +2221,9 @@ dependencies = [
 
 [[package]]
 name = "glow"
-version = "0.13.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "886c2a30b160c4c6fec8f987430c26b526b7988ca71f664e6a699ddf6f9601e4"
+checksum = "bd348e04c43b32574f2de31c8bb397d96c9fcfa1371bd4ca6d8bdc464ab121b1"
 dependencies = [
  "js-sys",
  "slotmap",
@@ -2242,8 +2242,8 @@ dependencies = [
 
 [[package]]
 name = "glyphon"
-version = "0.3.0"
-source = "git+https://github.com/jackpot51/glyphon.git?branch=refactor#c28dc99c86b6b598633e6623096b21632f266976"
+version = "0.4.1"
+source = "git+https://github.com/jackpot51/glyphon.git#abb70c0fda8cf1a5dfc314c1c778103d7ba951e6"
 dependencies = [
  "cosmic-text",
  "etagere",
@@ -2268,7 +2268,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fbcd2dba93594b227a1f57ee09b8b9da8892c34d55aa332e034a228d0fe6a171"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "gpu-alloc-types",
 ]
 
@@ -2278,7 +2278,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "98ff03b468aa837d70984d55f5d3f846f6ec31fe34bbb97c4f85219caeee1ca4"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
 ]
 
 [[package]]
@@ -2301,7 +2301,7 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc11df1ace8e7e564511f53af41f3e42ddc95b56fd07b3f4445d2a6048bc682c"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "gpu-descriptor-types",
  "hashbrown 0.14.3",
 ]
@@ -2312,7 +2312,7 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6bf0b36e6f090b7e1d8a4b49c0cb81c1f8376f72198c65dd3ad9ff3556b8b78c"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
 ]
 
 [[package]]
@@ -2494,9 +2494,9 @@ checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
+checksum = "5d3d0e0f38255e7fa3cf31335b3a56f05febd18025f4db5ef7a0cfb4f8da651f"
 
 [[package]]
 name = "hex"
@@ -2612,7 +2612,7 @@ dependencies = [
 [[package]]
 name = "iced"
 version = "0.12.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "iced_accessibility",
  "iced_core",
@@ -2620,14 +2620,14 @@ dependencies = [
  "iced_renderer",
  "iced_widget",
  "iced_winit",
- "image 0.24.7",
+ "image 0.24.8",
  "thiserror",
 ]
 
 [[package]]
 name = "iced_accessibility"
 version = "0.1.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "accesskit",
  "accesskit_winit",
@@ -2636,7 +2636,7 @@ dependencies = [
 [[package]]
 name = "iced_core"
 version = "0.12.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "bitflags 1.3.2",
  "instant",
@@ -2652,7 +2652,7 @@ dependencies = [
 [[package]]
 name = "iced_futures"
 version = "0.12.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "futures",
  "iced_core",
@@ -2665,7 +2665,7 @@ dependencies = [
 [[package]]
 name = "iced_graphics"
 version = "0.12.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "bitflags 1.3.2",
  "bytemuck",
@@ -2673,7 +2673,7 @@ dependencies = [
  "glam",
  "half",
  "iced_core",
- "image 0.24.7",
+ "image 0.24.8",
  "kamadak-exif",
  "log",
  "lyon_path",
@@ -2688,7 +2688,7 @@ dependencies = [
 [[package]]
 name = "iced_renderer"
 version = "0.12.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "iced_graphics",
  "iced_tiny_skia",
@@ -2701,7 +2701,7 @@ dependencies = [
 [[package]]
 name = "iced_runtime"
 version = "0.12.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "iced_core",
  "iced_futures",
@@ -2711,7 +2711,7 @@ dependencies = [
 [[package]]
 name = "iced_style"
 version = "0.12.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "iced_core",
  "once_cell",
@@ -2721,7 +2721,7 @@ dependencies = [
 [[package]]
 name = "iced_tiny_skia"
 version = "0.12.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "bytemuck",
  "cosmic-text",
@@ -2739,7 +2739,7 @@ dependencies = [
 [[package]]
 name = "iced_wgpu"
 version = "0.12.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "bitflags 1.3.2",
  "bytemuck",
@@ -2759,7 +2759,7 @@ dependencies = [
 [[package]]
 name = "iced_widget"
 version = "0.12.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "iced_renderer",
  "iced_runtime",
@@ -2773,7 +2773,7 @@ dependencies = [
 [[package]]
 name = "iced_winit"
 version = "0.12.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "iced_graphics",
  "iced_runtime",
@@ -2840,21 +2840,20 @@ dependencies = [
 
 [[package]]
 name = "image"
-version = "0.24.7"
+version = "0.24.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f3dfdbdd72063086ff443e297b61695500514b1e41095b6fb9a5ab48a70a711"
+checksum = "034bbe799d1909622a74d1193aa50147769440040ff36cb2baa947609b0a4e23"
 dependencies = [
  "bytemuck",
  "byteorder",
  "color_quant",
  "exr",
  "gif 0.12.0",
- "jpeg-decoder 0.3.0",
- "num-rational 0.4.1",
+ "jpeg-decoder 0.3.1",
  "num-traits",
- "png 0.17.10",
+ "png 0.17.11",
  "qoi",
- "tiff 0.9.0",
+ "tiff 0.9.1",
 ]
 
 [[package]]
@@ -2942,7 +2941,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bad00257d07be169d870ab665980b06cdb366d792ad690bf2e76876dc503455"
 dependencies = [
  "hermit-abi",
- "rustix 0.38.28",
+ "rustix 0.38.30",
  "windows-sys 0.52.0",
 ]
 
@@ -2978,9 +2977,9 @@ dependencies = [
 
 [[package]]
 name = "jpeg-decoder"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc0000e42512c92e31c2252315bda326620a4e034105e900c98ec492fa077b3e"
+checksum = "f5d4a7da358eff58addd2877a45865158f0d78c911d43a5784ceb7bbf52833b0"
 dependencies = [
  "rayon",
 ]
@@ -3092,7 +3091,7 @@ checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
 [[package]]
 name = "libcosmic"
 version = "0.1.0"
-source = "git+https://github.com/pop-os/libcosmic#94a1bbdaa5315aa42cf9d5a48be1410968a6e326"
+source = "git+https://github.com/pop-os/libcosmic#4e18199444aecbc60f25a12e8adb91926aa5e653"
 dependencies = [
  "apply",
  "ashpd",
@@ -3166,7 +3165,7 @@ version = "0.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "85c833ca1e66078851dba29046874e38f08b2c883700aa29a03ddd3b23814ee8"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "libc",
  "redox_syscall 0.4.1",
 ]
@@ -3177,7 +3176,7 @@ version = "0.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3af92c55d7d839293953fcd0fda5ecfe93297cfde6ffbdec13b41d99c0ba6607"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "libc",
  "redox_syscall 0.4.1",
 ]
@@ -3205,9 +3204,9 @@ checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.12"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4cd1a83af159aa67994778be9070f0ae1bd732942279cabb14f86f986a21456"
+checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
 
 [[package]]
 name = "locale_config"
@@ -3240,9 +3239,9 @@ checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
 [[package]]
 name = "lru"
-version = "0.11.1"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4a83fb7698b3643a0e34f9ae6f2e8f0178c0fd42f8b59d493aa271ff3a5bf21"
+checksum = "2994eeba8ed550fd9b47a0b38f0242bc3344e496483c6180b69139cc2fa5d1d7"
 dependencies = [
  "hashbrown 0.14.3",
 ]
@@ -3374,7 +3373,7 @@ version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c43f73953f8cbe511f021b58f18c3ce1c3d1ae13fe953293e13345bf83217f25"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "block",
  "core-graphics-types",
  "foreign-types 0.5.0",
@@ -3492,7 +3491,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ae585df4b6514cf8842ac0f1ab4992edc975892704835b549cf818dc0191249e"
 dependencies = [
  "bit-set",
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "codespan-reporting",
  "hexf-parse",
  "indexmap",
@@ -3668,7 +3667,7 @@ version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "cfg-if 1.0.0",
  "libc",
 ]
@@ -3711,7 +3710,7 @@ version = "6.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "crossbeam-channel",
  "filetime",
  "fsevent-sys",
@@ -4303,9 +4302,9 @@ dependencies = [
 
 [[package]]
 name = "pkg-config"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69d3587f8a9e599cc7ec2c00e331f71c4e69a5f9a4b8a6efd5b07466b9736f9a"
+checksum = "2900ede94e305130c13ddd391e0ab7cbaeb783945ae07a279c268cb05109c6cb"
 
 [[package]]
 name = "plist"
@@ -4335,9 +4334,9 @@ dependencies = [
 
 [[package]]
 name = "png"
-version = "0.17.10"
+version = "0.17.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd75bf2d8dd3702b9707cdbc56a5b9ef42cec752eb8b3bafc01234558442aa64"
+checksum = "1f6c3c3e617595665b8ea2ff95a86066be38fb121ff920a9c0eb282abcd1da5a"
 dependencies = [
  "bitflags 1.3.2",
  "crc32fast",
@@ -4364,14 +4363,14 @@ dependencies = [
 
 [[package]]
 name = "polling"
-version = "3.3.1"
+version = "3.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf63fa624ab313c11656b4cda960bfc46c410187ad493c41f6ba2d8c1e991c9e"
+checksum = "545c980a3880efd47b2e262f6a4bb6daad6555cf3367aa9c4e52895f69537a41"
 dependencies = [
  "cfg-if 1.0.0",
  "concurrent-queue",
  "pin-project-lite",
- "rustix 0.38.28",
+ "rustix 0.38.30",
  "tracing",
  "windows-sys 0.52.0",
 ]
@@ -4557,9 +4556,9 @@ checksum = "f2ff9a1f06a88b01621b7ae906ef0211290d1c8a168a15542486a8f61c0833b9"
 
 [[package]]
 name = "rayon"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
+checksum = "fa7237101a77a10773db45d62004a272517633fbcc3df19d96455ede1122e051"
 dependencies = [
  "either",
  "rayon-core",
@@ -4567,9 +4566,9 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
 dependencies = [
  "crossbeam-deque",
  "crossbeam-utils",
@@ -4667,10 +4666,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cadccb3d99a9efb8e5e00c16fbb732cbe400db2ec7fc004697ee7d97d86cf1f4"
 dependencies = [
  "gif 0.12.0",
- "jpeg-decoder 0.3.0",
+ "jpeg-decoder 0.3.1",
  "log",
  "pico-args",
- "png 0.17.10",
+ "png 0.17.11",
  "rgb",
  "svgtypes",
  "tiny-skia 0.11.3",
@@ -4716,7 +4715,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b91f7eff05f748767f183df4320a63d6936e9c6107d97c9e6bdd9784f4289c94"
 dependencies = [
  "base64",
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "serde",
  "serde_derive",
 ]
@@ -4817,14 +4816,14 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.28"
+version = "0.38.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72e572a5e8ca657d7366229cdde4bd14c4eb5499a9573d4d366fe1b599daa316"
+checksum = "322394588aaf33c24007e8bb3238ee3e4c5c09c084ab32bc73890b99ff326bca"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "errno",
  "libc",
- "linux-raw-sys 0.4.12",
+ "linux-raw-sys 0.4.13",
  "windows-sys 0.52.0",
 ]
 
@@ -4844,7 +4843,7 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0ae5692c5beaad6a9e22830deeed7874eae8a4e3ba4076fb48e12c56856222c"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "bytemuck",
  "libm",
  "smallvec",
@@ -5059,9 +5058,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.11.2"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dccd0940a2dcdf68d092b8cbab7dc0ad8fa938bf95787e1b916b0e3d0e8e970"
+checksum = "2593d31f82ead8df961d8bd23a64c2ccf2eb5dd34b0a34bfb4dd54011c72009e"
 
 [[package]]
 name = "smithay-client-toolkit"
@@ -5149,7 +5148,7 @@ dependencies = [
  "objc",
  "raw-window-handle 0.5.2",
  "redox_syscall 0.4.1",
- "rustix 0.38.28",
+ "rustix 0.38.30",
  "tiny-xlib",
  "wasm-bindgen",
  "wayland-backend",
@@ -5344,7 +5343,7 @@ dependencies = [
  "cfg-if 1.0.0",
  "fastrand 2.0.1",
  "redox_syscall 0.4.1",
- "rustix 0.38.28",
+ "rustix 0.38.30",
  "windows-sys 0.52.0",
 ]
 
@@ -5390,12 +5389,12 @@ dependencies = [
 
 [[package]]
 name = "tiff"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d172b0f4d3fba17ba89811858b9d3d97f928aece846475bbda076ca46736211"
+checksum = "ba1310fcea54c6a9a4fd1aad794ecc02c31682f6bfbecdf460bf19533eed1e3e"
 dependencies = [
  "flate2",
- "jpeg-decoder 0.3.0",
+ "jpeg-decoder 0.3.1",
  "weezl",
 ]
 
@@ -5438,7 +5437,7 @@ dependencies = [
  "arrayvec 0.7.4",
  "bytemuck",
  "cfg-if 1.0.0",
- "png 0.17.10",
+ "png 0.17.11",
  "tiny-skia-path 0.8.4",
 ]
 
@@ -5453,7 +5452,7 @@ dependencies = [
  "bytemuck",
  "cfg-if 1.0.0",
  "log",
- "png 0.17.10",
+ "png 0.17.11",
  "tiny-skia-path 0.11.3",
 ]
 
@@ -5703,9 +5702,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-bidi"
-version = "0.3.14"
+version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f2528f27a9eb2b21e69c95319b30bd0efd85d09c379741b0f78ea1d86be2416"
+checksum = "08f95100a766bf4f8f28f90d77e0a5461bbdb219042e7679bebe79004fed8d75"
 
 [[package]]
 name = "unicode-bidi-mirroring"
@@ -6022,7 +6021,7 @@ version = "0.31.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ca7d52347346f5473bf2f56705f360e8440873052e575e55890c4fa57843ed3"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "nix 0.26.4",
  "wayland-backend",
  "wayland-scanner 0.31.0",
@@ -6214,7 +6213,7 @@ checksum = "ef91c1d62d1e9e81c79e600131a258edf75c9531cbdbde09c44a011a47312726"
 dependencies = [
  "arrayvec 0.7.4",
  "bit-vec",
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "codespan-reporting",
  "log",
  "naga",
@@ -6239,7 +6238,7 @@ dependencies = [
  "arrayvec 0.7.4",
  "ash",
  "bit-set",
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "block",
  "core-graphics-types",
  "d3d12",
@@ -6278,7 +6277,7 @@ version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0d5ed5f0edf0de351fe311c53304986315ce866f394a2e6df0c4b3c70774bcdd"
 dependencies = [
- "bitflags 2.4.1",
+ "bitflags 2.4.2",
  "js-sys",
  "web-sys",
 ]
diff --git a/pkgs/by-name/co/cosmic-edit/package.nix b/pkgs/by-name/co/cosmic-edit/package.nix
index 1841d8bfb660..60020d46df45 100644
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@@ -6,27 +6,30 @@
   cmake,
   makeBinaryWrapper,
   cosmic-icons,
+  glib,
+  gtk3,
   just,
   pkg-config,
+  libglvnd,
   libxkbcommon,
-  glib,
-  gtk3,
   libinput,
   fontconfig,
   freetype,
+  mesa,
   wayland,
   xorg,
+  vulkan-loader,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cosmic-edit";
-  version = "0-unstable-2024-01-12";
+  version = "0-unstable-2024-01-19";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
-    rev = "c1944f9c15812ce842c91a77e228cc22a0f49f18";
-    hash = "sha256-wJnBfBQKYmpJBSboGKtlwew17clE60ac2AismIe1XaA=";
+    rev = "b97eb0603bf6c7e168fc6e17aa779af1f105b9ee";
+    hash = "sha256-oprqM3QTewC/L/KOQ4uT81dPLqjP+Kp+wxgkY8l1Nc8=";
   };
 
   cargoLock = {
@@ -34,10 +37,10 @@ rustPlatform.buildRustPackage rec {
     outputHashes = {
       "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
       "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
-      "cosmic-config-0.1.0" = "sha256-GHjoLGF9hFJRpf5i+TwflRnh8N+oWyWZ9fqgRFLXQsw=";
+      "cosmic-config-0.1.0" = "sha256-PR6u2DT+HneMSFszfg0sZK7oLwsOX4YtpUP88KWHy68=";
       "cosmic-syntax-theme-0.1.0" = "sha256-9Vf2s5Ry2hco80EbXOuVLwvOWygRiuaRD4tTImWooSg=";
-      "cosmic-text-0.10.0" = "sha256-PHz5jUecK889E88Y20XUe2adTUO8ElnoV7IIcaohMUw=";
-      "glyphon-0.3.0" = "sha256-JGkNIfj1HjOF8kGxqJPNq/JO+NhZD6XrZ4KmkXEP6Xc=";
+      "cosmic-text-0.10.0" = "sha256-WxT0LPXu17jb0XpuCu2PjlGTV1a0K1HMhl6WpciKMkM=";
+      "glyphon-0.4.1" = "sha256-mwJXi63LTBIVFrFcywr/NeOJKfMjQaQkNl3CSdEgrZc=";
       "sctk-adwaita-0.5.4" = "sha256-yK0F2w/0nxyKrSiHZbx7+aPNY2vlFs7s8nu/COp2KqQ=";
       "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
       "smithay-client-toolkit-0.16.1" = "sha256-z7EZThbh7YmKzAACv181zaEZmWxTrMkFRzP0nfsHK6c=";
@@ -54,13 +57,15 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ just pkg-config makeBinaryWrapper ];
   buildInputs = [
     libxkbcommon
+    glib
+    gtk3
     xorg.libX11
     libinput
+    libglvnd
     fontconfig
     freetype
     wayland
-    glib
-    gtk3
+    vulkan-loader
   ];
 
   dontUseJustBuild = true;
@@ -74,11 +79,23 @@ rustPlatform.buildRustPackage rec {
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-edit"
   ];
 
+  # Force linking to libEGL, which is always dlopen()ed, and to
+  # libwayland-client, which is always dlopen()ed except by the
+  # obscure winit backend.
+  RUSTFLAGS = map (a: "-C link-arg=${a}") [
+    "-Wl,--push-state,--no-as-needed"
+    "-lEGL"
+    "-lwayland-client"
+    "-Wl,--pop-state"
+  ];
+
   # LD_LIBRARY_PATH can be removed once tiny-xlib is bumped above 0.2.2
   postInstall = ''
     wrapProgram "$out/bin/${pname}" \
       --suffix XDG_DATA_DIRS : "${cosmic-icons}/share" \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ xorg.libX11 ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
+        xorg.libX11 xorg.libXcursor xorg.libXi xorg.libXrandr vulkan-loader mesa.drivers
+      ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/ei/eigenlayer/package.nix b/pkgs/by-name/ei/eigenlayer/package.nix
index b8ec1b3679bb..021a37b55cb9 100644
--- a/pkgs/by-name/ei/eigenlayer/package.nix
+++ b/pkgs/by-name/ei/eigenlayer/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "eigenlayer";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "Layr-Labs";
     repo = "eigenlayer-cli";
     rev = "v${version}";
-    hash = "sha256-a+I0lfO8l9xorEnW9rUBPhq+xgAwKVjzIdgQX5al/cY=";
+    hash = "sha256-1S/fSb94umtWsPH9R7tCl8wqNPYnJ+E80pnQdheP+CE=";
   };
 
   vendorHash = "sha256-MWNHoUgnD1V1zeLwoos20eKIUGtFHao/k2yvowInkT0=";
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index 053ca0e8fa2f..3045f9e967ee 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.17.3";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-kjECdZ97v8QOzz+hG0H3q21PWbIWxx2JeIhhLQDZXAY=";
+    hash = "sha256-LUCsn4yCzqb6ASNMzWTxgZVDeoL3wYjjVbTRaI+Uh40=";
   };
 
-  cargoHash = "sha256-KAjLnhEWD2c0A/+5w3eQrCMUfbo/C5KoceV9IbNLMCc=";
+  cargoHash = "sha256-BUVtINvHqjeWM5dmLQpdEiTb4SMVJGtJ61bEaV0N8sg=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/fo/fortune-kind/package.nix b/pkgs/by-name/fo/fortune-kind/package.nix
index 80403d149f30..fc60b98db0eb 100644
--- a/pkgs/by-name/fo/fortune-kind/package.nix
+++ b/pkgs/by-name/fo/fortune-kind/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fortune-kind";
-  version = "0.1.12";
+  version = "0.1.13";
 
   src = fetchFromGitHub {
     owner = "cafkafk";
     repo = "fortune-kind";
     rev = "v${version}";
-    hash = "sha256-1abke8wPvIFTmvEJ83TdfONFPBuJHbgmVHAoKddoTRw=";
+    hash = "sha256-Tpg0Jq2EhkwQuz5ZOtv6Rb5YESSlmzLoJPTxYJNNgac=";
   };
 
-  cargoHash = "sha256-SRPhALRGkFZDl23Om/obg1Crd9yNXroN7F/7agobuqw=";
+  cargoHash = "sha256-hxbvsAQsZWUAgj8QAlcxqBA5YagLO3/vz9lQGJMHUjw=";
 
   nativeBuildInputs = [ makeBinaryWrapper installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
diff --git a/pkgs/by-name/ga/galerio/package.nix b/pkgs/by-name/ga/galerio/package.nix
new file mode 100644
index 000000000000..aa1075f81a75
--- /dev/null
+++ b/pkgs/by-name/ga/galerio/package.nix
@@ -0,0 +1,23 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "galerio";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "dbrgn";
+    repo = "galerio";
+    rev = "v${version}";
+    hash = "sha256-JR/YfMUs5IHBRr3uYqHXLNcr23YHyDvgH2y/1ip+2Y8=";
+  };
+
+  cargoHash = "sha256-nYaCN09LP/2MfNRY8oZKtjzFCBFCeRF1IZ2ZBmbHg7I=";
+
+  meta = with lib; {
+    description = " A simple generator for self-contained HTML flexbox galleries";
+    homepage = "https://github.com/dbrgn/galerio";
+    maintainers = with maintainers; [ dbrgn ];
+    license = with licenses; [ asl20 mit ];
+    mainProgram = "galerio";
+  };
+}
diff --git a/pkgs/by-name/ge/geist-font/package.nix b/pkgs/by-name/ge/geist-font/package.nix
new file mode 100644
index 000000000000..34dd5dae26b8
--- /dev/null
+++ b/pkgs/by-name/ge/geist-font/package.nix
@@ -0,0 +1,43 @@
+{ lib
+, stdenvNoCC
+, fetchzip
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "geist-font";
+  version = "1.1.0";
+
+  srcs = [
+    (fetchzip {
+      name = "geist-mono";
+      url = "https://github.com/vercel/geist-font/releases/download/${version}/Geist.Mono.zip";
+      stripRoot = false;
+      hash = "sha256-8I4O2+bJAlUiDIhbyXzAcwXP5qpmHoh4IfrFio7IZN8=";
+    })
+    (fetchzip {
+      name = "geist-sans";
+      url = "https://github.com/vercel/geist-font/releases/download/${version}/Geist.zip";
+      stripRoot = false;
+      hash = "sha256-nSN+Ql5hTd230w/u6VZyAZaPtFSaHGmMc6T1fgGTCME=";
+    })
+  ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 geist-{mono,sans}/*/*.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Font family created by Vercel in collaboration with Basement Studio";
+    homepage = "https://vercel.com/font";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ eclairevoyant x0ba ];
+    platforms = lib.platforms.all;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+  };
+}
diff --git a/pkgs/by-name/in/incus-unwrapped/package.nix b/pkgs/by-name/in/incus-unwrapped/package.nix
index 925a485a0723..d415e873f574 100644
--- a/pkgs/by-name/in/incus-unwrapped/package.nix
+++ b/pkgs/by-name/in/incus-unwrapped/package.nix
@@ -1,7 +1,6 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
-, fetchpatch
 , acl
 , cowsql
 , hwdata
@@ -17,24 +16,16 @@
 
 buildGoModule rec {
   pname = "incus-unwrapped";
-  version = "0.4.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "incus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-crWepf5j3Gd1lhya2DGIh/to7l+AnjKJPR+qUd9WOzw=";
+    hash = "sha256-3eWkQT2P69ZfN62H9B4WLnmlUOGkpzRR0rctgchP+6A=";
   };
 
-  vendorHash = "sha256-YfUvkN1qUS3FFKb1wysg40WcJA8fT9SGDChSdT+xnkc=";
-
-  patches = [
-    # remove with > 0.4.0
-    (fetchpatch {
-      url = "https://github.com/lxc/incus/commit/c0200b455a1468685d762649120ce7e2bb25adc9.patch";
-      hash = "sha256-4fiSv6GcsKpdLh3iNbw3AGuDzcw1EadUvxtSjxRjtTA=";
-    })
-  ];
+  vendorHash = "sha256-2ZJU7WshN4UIbJv55bFeo9qiAQ/wxu182mnz7pE60xA=";
 
   postPatch = ''
     substituteInPlace internal/usbid/load.go \
@@ -108,7 +99,7 @@ buildGoModule rec {
   meta = {
     description = "Powerful system container and virtual machine manager";
     homepage = "https://linuxcontainers.org/incus";
-    changelog = "https://github.com/lxc/incus/releases/tag/incus-${version}";
+    changelog = "https://github.com/lxc/incus/releases/tag/v${version}";
     license = lib.licenses.asl20;
     maintainers = lib.teams.lxc.members;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/in/invidtui/package.nix b/pkgs/by-name/in/invidtui/package.nix
index a0def40e132c..81402026b127 100644
--- a/pkgs/by-name/in/invidtui/package.nix
+++ b/pkgs/by-name/in/invidtui/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "invidtui";
-  version = "0.3.7";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "darkhz";
     repo = "invidtui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bzstO6xaVdu7u1vBgwUjnJ9CEep0UHT73FbybBRd8y8=";
+    hash = "sha256-m2ygORf6GIJZXYYJKy6i12wDEkxQywtYdCutHeiyNYY=";
   };
 
-  vendorHash = "sha256-F0Iyy8H6ZRYiAlMdYGQS2p2hFN9ICmfTiRP/F9kpW7c=";
+  vendorHash = "sha256-HQ6JHXiqawDwSV48/Czbao4opnuz1LqIBdcObrkCfNs=";
 
   doCheck = true;
 
diff --git a/pkgs/by-name/le/legba/package.nix b/pkgs/by-name/le/legba/package.nix
index c4f52fcc0902..01586e05723a 100644
--- a/pkgs/by-name/le/legba/package.nix
+++ b/pkgs/by-name/le/legba/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "legba";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "evilsocket";
     repo = "legba";
     rev = "v${version}";
-    hash = "sha256-7HDW5M0lsKbcQw3p/CYmUeX2xE4BZXUSNqa9Ab/ZP0I=";
+    hash = "sha256-yevQEbDuVaSsSfA3ug9rDeWtGjMvS+uD7qHguRVt4sg=";
   };
 
-  cargoHash = "sha256-rkqwc8BILW/OIHa95skkG4IDlBfH3qX1ROJgcn8f2W0=";
+  cargoHash = "sha256-UBt4FP5zW+dijneHNaFJ80Ui5R+m+8aSwHTcqKDeEVg=";
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ openssl.dev samba ];
diff --git a/pkgs/by-name/li/lint-staged/package.nix b/pkgs/by-name/li/lint-staged/package.nix
index e2faec3d3fdb..11b5d7e0a5b5 100644
--- a/pkgs/by-name/li/lint-staged/package.nix
+++ b/pkgs/by-name/li/lint-staged/package.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "15.2.0";
+  version = "15.2.1";
 
   src = fetchFromGitHub {
     owner = "okonet";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-Vziz8pV3pd1Rp6X6mHzyD22Z3q5LJJTXQ8kFuHpVgKc=";
+    hash = "sha256-CYPDrzEu592gGeZkBYNGwGooRwQyKEj46hnxtBVQDT4=";
   };
 
-  npmDepsHash = "sha256-BKgncl53MKFDASXo6I2Vn3v54iTL/h9gykJ3PWNUGQU=";
+  npmDepsHash = "sha256-m7VIEuCVDPd+ZgI8DJa01f/q9uYCzRtVbdfcipBRTmY=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
index c024acd63a04..b3c1f63a9286 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
+++ b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
@@ -1 +1 @@
-2024-01-15
+2024-01-31
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
index 1604555b3b72..ac96818227ce 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
+++ b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
@@ -8,8 +8,8 @@ mkDerivation {
   pname = "nixfmt";
   version = "0.5.0";
   src = fetchzip {
-    url = "https://github.com/piegamesde/nixfmt/archive/1eff7a84ac82fbebb5f586244f1c80e1fcc4f494.tar.gz";
-    sha256 = "1pg876sr58h7v087kbjsnfr4pzvqpwzibl06w2468qs1sywmd283";
+    url = "https://github.com/piegamesde/nixfmt/archive/d6930fd0c62c4d7ec9e4a814adc3d2f590d96271.tar.gz";
+    sha256 = "1ijrdzdwricv4asmy296j7gzvhambv96nlxi3qrxb4lj1by6a34m";
   };
   isLibrary = true;
   isExecutable = true;
diff --git a/pkgs/by-name/no/nomnatong/package.nix b/pkgs/by-name/no/nomnatong/package.nix
index fbbb0ad2897f..d3b9aef7ee15 100644
--- a/pkgs/by-name/no/nomnatong/package.nix
+++ b/pkgs/by-name/no/nomnatong/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "nomnatong";
-  version = "5.08";
+  version = "5.09";
 
   src = fetchFromGitHub {
     owner = "nomfoundation";
     repo = "font";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-WtAxnTFrgXdG2T1vqfRc31tNKbZagDSO9lycKxn8dKg=";
+    hash = "sha256-WkDvneCWuAS0/D+WUhd1F6dqpIuSAMK598mSRbNf6/8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ot/oterm/package.nix b/pkgs/by-name/ot/oterm/package.nix
index 34f79d96d949..bb4e829b3397 100644
--- a/pkgs/by-name/ot/oterm/package.nix
+++ b/pkgs/by-name/ot/oterm/package.nix
@@ -5,13 +5,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "oterm";
-  version = "0.1.21";
+  version = "0.1.22";
   pyproject = true;
   src = fetchFromGitHub {
     owner = "ggozad";
     repo = "oterm";
     rev = "refs/tags/${version}";
-    hash = "sha256-S6v7VDIGPu6UDbDe0H3LWF6IN0Z6ENmiCDxz+GuCibI=";
+    hash = "sha256-hRbPlRuwM3NspTNd3mPhVxPJl8zA9qyFwDGNKH3Slag=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/pd/pdfannots2json/package.nix b/pkgs/by-name/pd/pdfannots2json/package.nix
new file mode 100644
index 000000000000..01c30fe1fb52
--- /dev/null
+++ b/pkgs/by-name/pd/pdfannots2json/package.nix
@@ -0,0 +1,25 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+let
+  pname = "pdfannots2json";
+  version = "1.0.16";
+in
+  buildGoModule {
+    inherit pname version;
+
+    src = fetchFromGitHub {
+      owner = "mgmeyers";
+      repo = "pdfannots2json";
+      rev = "refs/tags/${version}";
+      sha256 = "sha256-qk4OSws/6SevN/Q0lsyxw+fZkm2uy1WwOYYL7CB7QUk=";
+    };
+
+    vendorHash = null;
+
+    meta = with lib; {
+      homepage = "https://github.com/mgmeyers/pdfannots2json";
+      license = licenses.agpl3;
+      description = "A tool to convert PDF annotations to JSON";
+      maintainers = with maintainers; [ _0nyr ];
+    };
+  }
diff --git a/pkgs/by-name/pr/presenterm/package.nix b/pkgs/by-name/pr/presenterm/package.nix
index 37ba6f817d30..f637a77b4ff0 100644
--- a/pkgs/by-name/pr/presenterm/package.nix
+++ b/pkgs/by-name/pr/presenterm/package.nix
@@ -24,7 +24,9 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-bufFiyqRsn4eG57bKn42p5cyX+Z7oiz/USZvg9YOvHA=";
 
-  buildFeatures = [ "sixel" ];
+  # Crashes at runtime on darwin with:
+  # Library not loaded: .../out/lib/libsixel.1.dylib
+  buildFeatures = lib.optionals (!stdenv.isDarwin) [ "sixel" ];
 
   # Skip test that currently doesn't work
   checkFlags = [ "--skip=execute::test::shell_code_execution" ];
@@ -41,8 +43,5 @@ rustPlatform.buildRustPackage rec {
     license = licenses.bsd2;
     maintainers = with maintainers; [ mikaelfangel ];
     mainProgram = "presenterm";
-    # Crashes at runtime on darwin with:
-    # Library not loaded: .../out/lib/libsixel.1.dylib
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/by-name/pr/prometheus-restic-exporter/package.nix b/pkgs/by-name/pr/prometheus-restic-exporter/package.nix
new file mode 100644
index 000000000000..4e3736a573b6
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus-restic-exporter/package.nix
@@ -0,0 +1,49 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, python3
+, restic
+, nixosTests
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "prometheus-restic-exporter";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "ngosang";
+    repo = "restic-exporter";
+    rev = version;
+    hash = "sha256-Qwhlecginl5+V+iddN/vIHfJA1kQOZtscECsoD4LJPE=";
+  };
+
+  buildInputs = [
+    (python3.withPackages (ps: [ ps.prometheus-client ]))
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m0755 restic-exporter.py $out/bin/restic-exporter.py
+
+    substituteInPlace $out/bin/restic-exporter.py --replace \"restic\" \"${lib.makeBinPath [ restic ]}/restic\"
+
+    patchShebangs $out/bin/restic-exporter.py
+
+    runHook postInstall
+  '';
+
+  passthru.tests = {
+    restic-exporter = nixosTests.prometheus-exporters.restic;
+  };
+
+  meta = with lib; {
+    description = "Prometheus exporter for the Restic backup system";
+    homepage = "https://github.com/ngosang/restic-exporter";
+    changelog = "https://github.com/ngosang/restic-exporter/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ minersebas ];
+    mainProgram = "restic-exporter.py";
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/pu/pupdate/package.nix b/pkgs/by-name/pu/pupdate/package.nix
index 0f1968270cab..01a1a99bac5d 100644
--- a/pkgs/by-name/pu/pupdate/package.nix
+++ b/pkgs/by-name/pu/pupdate/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule rec {
   pname = "pupdate";
-  version = "3.1.0";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "mattpannella";
     repo = "${pname}";
     rev = "${version}";
-    hash = "sha256-wIYqEtbQZsj9gq5KaLhd+sEnrKHBHzA9jWR+9dGDQ0s=";
+    hash = "sha256-9u1CKxWohGj7Gm3BrC2tpoQAY1r3cpP8OIePo+g7ETo=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index b733a10bd7ba..4b63b039cd85 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -7,10 +7,10 @@
   inherit buildUnstable;
 }).overrideAttrs (finalAttrs: _: {
   pname = "renode-unstable";
-  version = "1.14.0+20240106git1b3952c2c";
+  version = "1.14.0+20240119git1a0826937";
 
   src = fetchurl {
     url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
-    hash = "sha256-tDo/01jYoq1Qg8h0BS4BQSPh3rsINpe72eMk9UBWgR0=";
+    hash = "sha256-bv5+6DVzBFt5XeKcLJFpUHB5T1RKCNi/CuXXpIn6e9k=";
   };
 })
diff --git a/pkgs/by-name/sh/shopware-cli/package.nix b/pkgs/by-name/sh/shopware-cli/package.nix
index de0313512fff..471a90c0ab29 100644
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.4.18";
+  version = "0.4.22";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     rev = version;
-    hash = "sha256-LOmGxH/czICSii8AkoXi1cQPL+MErV92iUZtJc2eg64=";
+    hash = "sha256-P93wxAApV2iWXSQGXsCPjmvj2gGMwbKw6+yMgiainb4=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
   nativeCheckInputs = [ git dart-sass ];
 
-  vendorHash = "sha256-KMNPw2B4fLaOdSIFHBIAKXUtnu0sMwksJg3RUZKLDsE=";
+  vendorHash = "sha256-FalN3qhw2o9NvSIfEU4juevPAsxQoksNjL3eATf0umU=";
 
   postInstall = ''
     export HOME="$(mktemp -d)"
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index 4984c9af96b7..f496c549087b 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.14.176";
+  version = "0.14.177";
 
   src = fetchFromGitHub {
     owner = "tigerbeetle";
     repo = "tigerbeetle";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-prvTE6fingEIzXk++FYP0J9dA9xeophU0LLcknmS2ZI=";
+    hash = "sha256-oMsDHz/yOWtS1XhJcXR74pA3YvPzANUdRAy7tjNO5lc=";
   };
 
   nativeBuildInputs = [ custom_zig_hook ];
diff --git a/pkgs/by-name/ui/uiua/package.nix b/pkgs/by-name/ui/uiua/package.nix
index 09fbbcf7ae7b..8b11104cb9a0 100644
--- a/pkgs/by-name/ui/uiua/package.nix
+++ b/pkgs/by-name/ui/uiua/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uiua";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "uiua-lang";
     repo = "uiua";
     rev = version;
-    hash = "sha256-cBwQdArVRiXH8TmgBSPpcB5oNu3Q/+Us9Azzw0lV5Vs=";
+    hash = "sha256-JilYPIeJbVf9wgGpLTy8pbMwFRrW7Od+8y0tWwAXU84=";
   };
 
-  cargoHash = "sha256-7cgKiEqklvUw64a6+lbHA9t6QWiTquYVi0evXkONEag=";
+  cargoHash = "sha256-oXO2TBdKmVIpZD0jLI1CK9b48r3SwdeygcJoUG6HGXo=";
 
   nativeBuildInputs = lib.optionals stdenv.isDarwin [
     rustPlatform.bindgenHook
@@ -42,9 +42,9 @@ rustPlatform.buildRustPackage rec {
   buildFeatures = lib.optional audioSupport "audio";
 
   passthru.tests.run = runCommand "uiua-test-run" { nativeBuildInputs = [ uiua ]; } ''
-    uiua init;
+    uiua init
     diff -U3 --color=auto <(uiua run main.ua) <(echo '"Hello, World!"')
-    touch $out;
+    touch $out
   '';
 
   meta = {
diff --git a/pkgs/by-name/ux/uxn/package.nix b/pkgs/by-name/ux/uxn/package.nix
index 4933591ba3f9..2bc851ff764b 100644
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uxn";
-  version = "unstable-2024-01-15";
+  version = "unstable-2024-01-21";
 
   src = fetchFromSourcehut {
     owner = "~rabbits";
     repo = "uxn";
-    rev = "8212ca5edb55a28976515a73fcb454f18eb44a09";
-    hash = "sha256-K/qTKSGt/sFHt0lfUbwa/Y2XlWst30q1aKvsm4sjrLc=";
+    rev = "3e1183285a94a0930c9b09fd4fa73ac3a5d24fda";
+    hash = "sha256-hhxcj/jVBOm7E63Z9sS3SnFjexQEXVtw3QU5n/4hkVI=";
   };
 
   outputs = [ "out" "projects" ];
diff --git a/pkgs/by-name/wh/whistle/package.nix b/pkgs/by-name/wh/whistle/package.nix
index 4d205d60bf2f..3cf9fc45dc9c 100644
--- a/pkgs/by-name/wh/whistle/package.nix
+++ b/pkgs/by-name/wh/whistle/package.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "whistle";
-  version = "2.9.63";
+  version = "2.9.64";
 
   src = fetchFromGitHub {
     owner = "avwo";
     repo = "whistle";
     rev = "v${version}";
-    hash = "sha256-Dp3bW31INOVMCAculPsGHmzkQiWawfo5k9ALs21C1mc=";
+    hash = "sha256-dK9oaTm4l170COZ8Gm6Suc821DPUYg8euIo6l+EQYEo=";
   };
 
-  npmDepsHash = "sha256-Qqtp0SukzkuG1DGMcKP4eLXGfWHMZY9TcyP280wkk0g=";
+  npmDepsHash = "sha256-0YnWmCI0UVQPegwHEKiCmow5LA4kjQVKctWRwHW0Ufg=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/xs/xscreensaver/package.nix b/pkgs/by-name/xs/xscreensaver/package.nix
index ba946305425f..54129c938e5e 100644
--- a/pkgs/by-name/xs/xscreensaver/package.nix
+++ b/pkgs/by-name/xs/xscreensaver/package.nix
@@ -22,6 +22,7 @@
 , makeWrapper
 , pam
 , perlPackages
+, xorg
 , pkg-config
 , systemd
 , forceInstallAllHacks ? true
@@ -102,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
     for bin in $out/bin/*; do
       wrapProgram "$bin" \
         --prefix PATH : "$out/libexec/xscreensaver" \
-        --prefix PATH : "${lib.makeBinPath [ coreutils perlPackages.perl ]}" \
+        --prefix PATH : "${lib.makeBinPath [ coreutils perlPackages.perl xorg.appres ]}" \
         --prefix PERL5LIB ':' $PERL5LIB
     done
   ''
diff --git a/pkgs/by-name/yo/youplot/Gemfile b/pkgs/by-name/yo/youplot/Gemfile
new file mode 100644
index 000000000000..ee3c0e5fc346
--- /dev/null
+++ b/pkgs/by-name/yo/youplot/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'youplot'
diff --git a/pkgs/by-name/yo/youplot/Gemfile.lock b/pkgs/by-name/yo/youplot/Gemfile.lock
new file mode 100644
index 000000000000..17b8b43dfa2e
--- /dev/null
+++ b/pkgs/by-name/yo/youplot/Gemfile.lock
@@ -0,0 +1,18 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    enumerable-statistics (2.0.7)
+    unicode_plot (0.0.5)
+      enumerable-statistics (>= 2.0.1)
+    youplot (0.4.5)
+      unicode_plot (>= 0.0.5)
+
+PLATFORMS
+  arm64-darwin-22
+  ruby
+
+DEPENDENCIES
+  youplot
+
+BUNDLED WITH
+   2.5.3
diff --git a/pkgs/by-name/yo/youplot/gemset.nix b/pkgs/by-name/yo/youplot/gemset.nix
new file mode 100644
index 000000000000..ae8439540912
--- /dev/null
+++ b/pkgs/by-name/yo/youplot/gemset.nix
@@ -0,0 +1,34 @@
+{
+  enumerable-statistics = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dlnfncz0lbyczakgdlys44pksj6h447npj665xk41b36y0lbf7f";
+      type = "gem";
+    };
+    version = "2.0.7";
+  };
+  unicode_plot = {
+    dependencies = ["enumerable-statistics"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fzpg1zizf19xgfzqw6lmb38xir423wwxb2mjsb3nym6phvn5kli";
+      type = "gem";
+    };
+    version = "0.0.5";
+  };
+  youplot = {
+    dependencies = ["unicode_plot"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0imy65wjkgdkpqfympbz8lp2ih866538vk55fwz9a909ib9sbdri";
+      type = "gem";
+    };
+    version = "0.4.5";
+  };
+}
diff --git a/pkgs/by-name/yo/youplot/package.nix b/pkgs/by-name/yo/youplot/package.nix
new file mode 100644
index 000000000000..d858c8764e83
--- /dev/null
+++ b/pkgs/by-name/yo/youplot/package.nix
@@ -0,0 +1,19 @@
+{ lib, bundlerApp, bundlerUpdateScript }:
+
+bundlerApp {
+  pname = "youplot";
+  gemdir = ./.;
+
+  exes = [ "uplot" ];
+
+  passthru.updateScript = bundlerUpdateScript "youplot";
+
+  meta = with lib; {
+    description = "A command line tool that draws plots on the terminal";
+    homepage    = "https://github.com/red-data-tools/YouPlot";
+    mainProgram = "uplot";
+    license     = licenses.mit;
+    maintainers = with maintainers; [ purcell ];
+    platforms   = platforms.unix;
+  };
+}
diff --git a/pkgs/by-name/yo/youtrack/package.nix b/pkgs/by-name/yo/youtrack/package.nix
new file mode 100644
index 000000000000..d07e85bfb88c
--- /dev/null
+++ b/pkgs/by-name/yo/youtrack/package.nix
@@ -0,0 +1,43 @@
+{ lib, stdenvNoCC, fetchzip, makeBinaryWrapper, jdk17_headless, gawk, statePath ? "/var/lib/youtrack" }:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "youtrack";
+  version = "2023.3.23390";
+
+  src = fetchzip {
+    url = "https://download.jetbrains.com/charisma/youtrack-${finalAttrs.version}.zip";
+    hash = "sha256-p3ZjClVku7EjQSd9wwx0iJ+5DqooaKragdNzj0f8OO8=";
+  };
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -r * $out
+    makeWrapper $out/bin/youtrack.sh $out/bin/youtrack \
+      --prefix PATH : "${lib.makeBinPath [ gawk ]}" \
+      --set JRE_HOME ${jdk17_headless}
+    rm -rf $out/internal/java
+    mv $out/conf $out/conf.orig
+    ln -s ${statePath}/backups $out/backups
+    ln -s ${statePath}/conf $out/conf
+    ln -s ${statePath}/data $out/data
+    ln -s ${statePath}/logs $out/logs
+    ln -s ${statePath}/temp $out/temp
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Issue tracking and project management tool for developers";
+    maintainers = lib.teams.serokell.members ++ [ lib.maintainers.leona ];
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    # https://www.jetbrains.com/youtrack/buy/license.html
+    license = lib.licenses.unfree;
+  };
+})
diff --git a/pkgs/by-name/yo/youtrack/update.sh b/pkgs/by-name/yo/youtrack/update.sh
new file mode 100755
index 000000000000..c1ffb8b2bfbf
--- /dev/null
+++ b/pkgs/by-name/yo/youtrack/update.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl xq-xml common-updater-scripts
+
+set -eu -o pipefail
+
+version="$(curl https://www.jetbrains.com/youtrack/update.xml | \
+    xq -x "/products/product[@name='YouTrack']/channel/build/@version")"
+
+update-source-version youtrack "$version"
diff --git a/pkgs/servers/jetbrains/youtrack.nix b/pkgs/by-name/yo/youtrack_2022_3/package.nix
index 31b4a457ec86..388c536bf15d 100644
--- a/pkgs/servers/jetbrains/youtrack.nix
+++ b/pkgs/by-name/yo/youtrack_2022_3/package.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, makeWrapper, jdk17, gawk }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "youtrack";
   version = "2022.3.65371";
 
   jar = fetchurl {
-    url = "https://download.jetbrains.com/charisma/${pname}-${version}.jar";
+    url = "https://download.jetbrains.com/charisma/youtrack-${finalAttrs.version}.jar";
     sha256 = "sha256-NQKWmKEq5ljUXd64zY27Nj8TU+uLdA37chbFVdmwjNs=";
   };
 
@@ -22,11 +22,11 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Issue tracking and project management tool for developers";
-    maintainers = teams.serokell.members;
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    maintainers = lib.teams.serokell.members ++ [ lib.maintainers.leona ];
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     # https://www.jetbrains.com/youtrack/buy/license.html
-    license = licenses.unfree;
+    license = lib.licenses.unfree;
   };
-}
+})
diff --git a/pkgs/data/fonts/kode-mono/default.nix b/pkgs/data/fonts/kode-mono/default.nix
index 8bd90a4db0b6..8a4617989398 100644
--- a/pkgs/data/fonts/kode-mono/default.nix
+++ b/pkgs/data/fonts/kode-mono/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kode-mono";
-  version = "1.204";
+  version = "1.205";
 
   src = fetchzip {
     url = "https://github.com/isaozler/kode-mono/releases/download/${finalAttrs.version}/kode-mono-fonts.zip";
-    hash = "sha256-0mAE06963HaBKBKBvTnt8q7QAY1FakEGUx1wAqOZVH4=";
+    hash = "sha256-DRe2Qi+Unhr5ebQdTG6QgvQEUTNOdnosFbQC8kpHNYU=";
     stripRoot = false;
   };
 
diff --git a/pkgs/data/icons/papirus-icon-theme/default.nix b/pkgs/data/icons/papirus-icon-theme/default.nix
index e940bc7d52be..4a39dfe473c8 100644
--- a/pkgs/data/icons/papirus-icon-theme/default.nix
+++ b/pkgs/data/icons/papirus-icon-theme/default.nix
@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "papirus-icon-theme";
-  version = "20231201";
+  version = "20240201";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = pname;
     rev = version;
-    hash = "sha256-nLc2nt8YI193loMHjzzEwgvb+tdNrVTZskqssX2oFrU=";
+    hash = "sha256-hAmtvib6wENEAGQdK242wwDqF3Ddu4YR00KPaWR8JMo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/gnome/core/nautilus/default.nix b/pkgs/desktops/gnome/core/nautilus/default.nix
index 6c96c54f86b5..7e2d44249376 100644
--- a/pkgs/desktops/gnome/core/nautilus/default.nix
+++ b/pkgs/desktops/gnome/core/nautilus/default.nix
@@ -130,5 +130,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = teams.gnome.members;
+    mainProgram = "nautilus";
   };
 })
diff --git a/pkgs/development/compilers/circt/default.nix b/pkgs/development/compilers/circt/default.nix
index 6f83e9960ddc..dfda406ab9b6 100644
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@@ -17,12 +17,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.63.0";
+  version = "1.64.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    sha256 = "sha256-ln56E66AHga80TkeiVd3A3WobdTe1UnE7o5t6+tmR0Q=";
+    sha256 = "sha256-tZ8IQa01hYVJZdUKPd0rMGfAScuhZPzpwP51WWXERGw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/compilers/koka/default.nix b/pkgs/development/compilers/koka/default.nix
index aec856e47d68..e3462c826c76 100644
--- a/pkgs/development/compilers/koka/default.nix
+++ b/pkgs/development/compilers/koka/default.nix
@@ -1,15 +1,42 @@
-{ stdenv, pkgsHostTarget, cmake, makeWrapper, mkDerivation, fetchFromGitHub
-, alex, array, base, bytestring, cond, containers, directory, extra
-, filepath, hpack, hspec, hspec-core, isocline, json, lib, mtl
-, parsec, process, regex-compat, text, time }:
+{ stdenv
+, pkgsHostTarget
+, cmake
+, makeWrapper
+, mkDerivation
+, fetchFromGitHub
+, alex
+, lib
+, hpack
+, aeson
+, array
+, async
+, base
+, bytestring
+, co-log-core
+, cond
+, containers
+, directory
+, FloatingHex
+, isocline
+, lens
+, lsp
+, mtl
+, network
+, network-simple
+, parsec
+, process
+, text
+, text-rope
+, time
+}:
 
 let
-  version = "2.4.2";
+  version = "3.0.4";
   src = fetchFromGitHub {
     owner = "koka-lang";
     repo = "koka";
     rev = "v${version}";
-    sha256 = "sha256-sVjaIzOxNuBtDswpDl5gLB10Sw945TQAf2ywrKumqqk=";
+    sha256 = "sha256-U8BW1Aq9t3je0YDV8NkE0MzdnjwXBJQbmekh5ufOs3k=";
     fetchSubmodules = true;
   };
   kklib = stdenv.mkDerivation {
@@ -38,8 +65,28 @@ mkDerivation rec {
   isExecutable = true;
   libraryToolDepends = [ hpack ];
   executableHaskellDepends = [
-    array base bytestring cond containers directory isocline mtl
-    parsec process text time kklib
+    aeson
+    array
+    async
+    base
+    bytestring
+    co-log-core
+    cond
+    containers
+    directory
+    FloatingHex
+    isocline
+    lens
+    lsp
+    mtl
+    network
+    network-simple
+    parsec
+    process
+    text
+    text-rope
+    time
+    kklib
   ];
   executableToolDepends = [ alex makeWrapper ];
   postInstall = ''
diff --git a/pkgs/development/coq-modules/vscoq-language-server/default.nix b/pkgs/development/coq-modules/vscoq-language-server/default.nix
new file mode 100644
index 000000000000..e70094b994eb
--- /dev/null
+++ b/pkgs/development/coq-modules/vscoq-language-server/default.nix
@@ -0,0 +1,32 @@
+{ metaFetch, mkCoqDerivation, coq, lib, glib, gnome, wrapGAppsHook,
+  version ? null }:
+
+let ocamlPackages = coq.ocamlPackages;
+    defaultVersion = lib.switch coq.coq-version [
+      { case = "8.18"; out = "2.0.3+coq8.18"; }
+    ] null;
+    location = { domain = "github.com"; owner = "coq-community"; repo = "vscoq"; };
+    fetch = metaFetch ({
+      release."2.0.3+coq8.18".sha256 = "sha256-VXhHCP6Ni5/OcsgoI1EbJfYCpXzwkuR8kbbKrl6dfjU=";
+      release."2.0.3+coq8.18".rev = "v2.0.3+coq8.18";
+      inherit location; });
+    fetched = fetch (if version != null then version else defaultVersion);
+in
+ocamlPackages.buildDunePackage {
+  pname = "vscoq-language-server";
+  inherit (fetched) version;
+  src = "${fetched.src}/language-server";
+  buildInputs =
+    [ coq glib gnome.adwaita-icon-theme wrapGAppsHook ] ++
+    (with ocamlPackages; [ findlib
+      lablgtk3-sourceview3 yojson zarith ppx_inline_test
+      ppx_assert ppx_sexp_conv ppx_deriving ppx_import sexplib
+      ppx_yojson_conv lsp sel ]);
+
+  meta = with lib; {
+    description = "Language server for the vscoq vscode/codium extension";
+    homepage = "https://github.com/coq-community/vscoq";
+    maintainers = with maintainers; [ cohencyril ];
+    license = licenses.mit;
+  } // optionalAttrs (fetched.broken or false) { coqFilter = true; broken = true; };
+}
diff --git a/pkgs/development/interpreters/elixir/1.16.nix b/pkgs/development/interpreters/elixir/1.16.nix
index 8a320eae7bb2..2f57e371e28b 100644
--- a/pkgs/development/interpreters/elixir/1.16.nix
+++ b/pkgs/development/interpreters/elixir/1.16.nix
@@ -1,7 +1,7 @@
 { mkDerivation }:
 mkDerivation {
-  version = "1.16.0";
-  sha256 = "sha256-nM3TpX18zdjDAFkljsAqwKx/1AQmwDMIQCeL75etTQc=";
+  version = "1.16.1";
+  sha256 = "sha256-rjUt3gCUszCbzGE7BriwH3ptrV81dqNB/d0nVOXrcGI=";
   # https://hexdocs.pm/elixir/1.16.0/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp
   minimumOTPVersion = "24";
   escriptPath = "lib/elixir/scripts/generate_app.escript";
diff --git a/pkgs/development/interpreters/lfe/2.1.nix b/pkgs/development/interpreters/lfe/2.1.nix
index 2dff2ade66c1..f239aa94b78f 100644
--- a/pkgs/development/interpreters/lfe/2.1.nix
+++ b/pkgs/development/interpreters/lfe/2.1.nix
@@ -1,7 +1,7 @@
 { fetchpatch, mkDerivation }:
 
 mkDerivation {
-  version = "2.1.1";
-  sha256 = "sha256-HUOVBzUaU0ixIfPPctwR2TPijxJjcFY3dJ8Z7Ot2bpE=";
-  maximumOTPVersion = "25";
+  version = "2.1.3";
+  hash = "sha256-HUOVBzUaU0ixIfPPctwR2TPijxJjcFY3dJ8Z7Ot2bpE=";
+  maximumOTPVersion = "26";
 }
diff --git a/pkgs/development/interpreters/lfe/generic-builder.nix b/pkgs/development/interpreters/lfe/generic-builder.nix
index 5e6016d4e97e..1589121d998d 100644
--- a/pkgs/development/interpreters/lfe/generic-builder.nix
+++ b/pkgs/development/interpreters/lfe/generic-builder.nix
@@ -3,9 +3,10 @@
 { baseName ? "lfe"
 , version
 , maximumOTPVersion
-, sha256 ? null
+, sha256 ? ""
+, hash ? ""
 , rev ? version
-, src ? fetchFromGitHub { inherit rev sha256; owner = "rvirding"; repo = "lfe"; }
+, src ? fetchFromGitHub { inherit hash rev sha256; owner = "lfe"; repo = "lfe"; }
 , patches ? []
 }:
 
diff --git a/pkgs/development/interpreters/php/8.1.nix b/pkgs/development/interpreters/php/8.1.nix
index 3082f8b85b62..ff76b64d71cf 100644
--- a/pkgs/development/interpreters/php/8.1.nix
+++ b/pkgs/development/interpreters/php/8.1.nix
@@ -1,9 +1,17 @@
-{ callPackage, ... }@_args:
+{ callPackage, fetchpatch, ... }@_args:
 
 let
-  base = callPackage ./generic.nix (_args // {
+  base = callPackage ./generic.nix ((removeAttrs _args [ "fetchpatch" ]) // {
     version = "8.1.27";
     hash = "sha256-oV/XPqRPLfMLB9JHhuB9GUiw6j7tC4uEVzXVANwov/E=";
+    extraPatches = [
+      # Fix build with libxml 2.12+.
+      # Patch from https://github.com/php/php-src/commit/0a39890c967aa57225bb6bdf4821aff7a3a3c082
+      (fetchpatch {
+        url = "https://github.com/php/php-src/commit/0a39890c967aa57225bb6bdf4821aff7a3a3c082.patch";
+        hash = "sha256-HvpTL7aXO9gr4glFdhqUWQPrG8TYTlvbNINq33M3zS0=";
+      })
+    ];
   });
 in
 base.withExtensions ({ all, ... }: with all; ([
diff --git a/pkgs/development/interpreters/spidermonkey/common.nix b/pkgs/development/interpreters/spidermonkey/common.nix
index ff9bb39e0a29..46af4ec26bbe 100644
--- a/pkgs/development/interpreters/spidermonkey/common.nix
+++ b/pkgs/development/interpreters/spidermonkey/common.nix
@@ -125,7 +125,6 @@ stdenv.mkDerivation (finalAttrs: rec {
     "--disable-jemalloc"
     "--disable-strip"
     "--disable-tests"
-  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # Spidermonkey seems to use different host/build terminology for cross
     # compilation here.
     "--host=${stdenv.buildPlatform.config}"
diff --git a/pkgs/development/libraries/libcint/default.nix b/pkgs/development/libraries/libcint/default.nix
index 439cd74bca63..caa7e51336a4 100644
--- a/pkgs/development/libraries/libcint/default.nix
+++ b/pkgs/development/libraries/libcint/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcint";
-  version = "6.1.1";
+  version = "6.1.2";
 
   src = fetchFromGitHub {
     owner = "sunqm";
     repo = "libcint";
     rev = "v${version}";
-    hash = "sha256-wV3y+NobV6J+J6I2z3dJdCvTwvfgMspMtAGNpbwfsYk=";
+    hash = "sha256-URJcC0ib87ejrTCglCjhC2tQHNc5TRvo4CQ52N58n+4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libmilter/default.nix b/pkgs/development/libraries/libmilter/default.nix
index 3ff3a4ffa9fb..a06f3d4deca1 100644
--- a/pkgs/development/libraries/libmilter/default.nix
+++ b/pkgs/development/libraries/libmilter/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmilter";
-  version = "8.17.2";
+  version = "8.18.1";
 
   src = fetchurl {
     url = "ftp://ftp.sendmail.org/pub/sendmail/sendmail.${version}.tar.gz";
-    sha256 = "sha256-kPWudMNahICIYZM7oJQgG5AbcMaykDaE3POb2uiloaI=";
+    sha256 = "sha256-y/HzCcOOSAb3zz6tJCYPF9H+j7YyVtE+2zzdGgmPB3A=";
   };
 
   buildPhase = ''
diff --git a/pkgs/development/libraries/openvdb/default.nix b/pkgs/development/libraries/openvdb/default.nix
index 530c57877cf8..c5397b259a30 100644
--- a/pkgs/development/libraries/openvdb/default.nix
+++ b/pkgs/development/libraries/openvdb/default.nix
@@ -20,6 +20,11 @@ stdenv.mkDerivation rec
 
   cmakeFlags = [ "-DOPENVDB_CORE_STATIC=OFF" ];
 
+  # error: aligned deallocation function of type 'void (void *, std::align_val_t) noexcept' is only available on macOS 10.13 or newer
+  env = lib.optionalAttrs (stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13" && lib.versionAtLeast tbb.version "2021.8.0") {
+    NIX_CFLAGS_COMPILE = "-faligned-allocation";
+  };
+
   postFixup = ''
     substituteInPlace $dev/lib/cmake/OpenVDB/FindOpenVDB.cmake \
       --replace \''${OPENVDB_LIBRARYDIR} $out/lib \
diff --git a/pkgs/development/libraries/openvino/cmake.patch b/pkgs/development/libraries/openvino/cmake.patch
deleted file mode 100644
index 0918baba918f..000000000000
--- a/pkgs/development/libraries/openvino/cmake.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/cmake/developer_package/linux_name.cmake b/cmake/developer_package/linux_name.cmake
-index 3e8c775770..2d5e00fb8b 100644
---- a/cmake/developer_package/linux_name.cmake
-+++ b/cmake/developer_package/linux_name.cmake
-@@ -6,25 +6,7 @@ include(target_flags)
- 
- if(LINUX)
-     function(get_linux_name res_var)
--        if(EXISTS "/etc/lsb-release")
--            # linux version detection using cat /etc/lsb-release
--            file(READ "/etc/lsb-release" release_data)
--            set(name_regex "DISTRIB_ID=([^ \n]*)\n")
--            set(version_regex "DISTRIB_RELEASE=([0-9]+(\\.[0-9]+)?)")
--        else()
--            execute_process(COMMAND find -L /etc/ -maxdepth 1 -type f -name *-release -exec cat {} \;
--                            OUTPUT_VARIABLE release_data
--                            RESULT_VARIABLE result)
--            string(REPLACE "Red Hat" "CentOS" release_data "${release_data}")
--            set(name_regex "NAME=\"([^ \"\n]*).*\"\n")
--            set(version_regex "VERSION=\"([0-9]+(\\.[0-9]+)?)[^\n]*\"")
--        endif()
--
--        string(REGEX MATCH ${name_regex} name ${release_data})
--        set(os_name ${CMAKE_MATCH_1})
--
--        string(REGEX MATCH ${version_regex} version ${release_data})
--        set(os_name "${os_name} ${CMAKE_MATCH_1}")
-+        set(os_name "NixOS @version@")
- 
-         if(os_name)
-             set(${res_var} ${os_name} PARENT_SCOPE)
diff --git a/pkgs/development/libraries/openvino/default.nix b/pkgs/development/libraries/openvino/default.nix
index 26fac012948d..186e1048823a 100644
--- a/pkgs/development/libraries/openvino/default.nix
+++ b/pkgs/development/libraries/openvino/default.nix
@@ -1,8 +1,8 @@
 { lib
-, stdenv
+, gcc12Stdenv
 , fetchFromGitHub
+, fetchpatch2
 , fetchurl
-, substituteAll
 , cudaSupport ? opencv.cudaSupport or false
 
 # build
@@ -14,45 +14,62 @@
 , pkg-config
 , python
 , shellcheck
+, sphinx
 
 # runtime
+, flatbuffers
 , libusb1
 , libxml2
 , ocl-icd
 , opencv
 , protobuf
 , pugixml
+, snappy
 , tbb
 , cudaPackages
 }:
 
 let
+  inherit (lib)
+    cmakeBool
+  ;
+
+  stdenv = gcc12Stdenv;
+
   # See GNA_VERSION in cmake/dependencies.cmake
-  gna_version = "03.05.00.1906";
+  gna_version = "03.05.00.2116";
   gna = fetchurl {
     url = "https://storage.openvinotoolkit.org/dependencies/gna/gna_${gna_version}.zip";
-    hash = "sha256-SlvobZwCaw4Qr6wqV/x8mddisw49UGq7OjOA+8/icm4=";
+    hash = "sha256-lgNQVncCvaFydqxMBg11JPt8587XhQBL2GHIH/K/4sU=";
   };
 
   tbbbind_version = "2_5";
   tbbbind = fetchurl {
-    url = "https://storage.openvinotoolkit.org/dependencies/thirdparty/linux/tbbbind_${tbbbind_version}_static_lin_v3.tgz";
-    hash = "sha256-053rJiwGmBteLS48WT6fyb5izk/rkd1OZI6SdTZZprM=";
+    url = "https://storage.openvinotoolkit.org/dependencies/thirdparty/linux/tbbbind_${tbbbind_version}_static_lin_v4.tgz";
+    hash = "sha256-Tr8wJGUweV8Gb7lhbmcHxrF756ZdKdNRi1eKdp3VTuo=";
   };
 in
 
 stdenv.mkDerivation rec {
   pname = "openvino";
-  version = "2023.0.0";
+  version = "2023.3.0";
 
   src = fetchFromGitHub {
     owner = "openvinotoolkit";
     repo = "openvino";
     rev = "refs/tags/${version}";
     fetchSubmodules = true;
-    hash = "sha256-z88SgAZ0UX9X7BhBA7/NU/UhVLltb6ANKolruU8YiZQ=";
+    hash = "sha256-dXlQhar5gz+1iLmDYXUY0jZKh4rJ+khRpoZQphJXfcU=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "enable-js-toggle.patch";
+      url = "https://github.com/openvinotoolkit/openvino/commit/0a8f1383826d949c497fe3d05fef9ad2b662fa7e.patch";
+      hash = "sha256-mQYunouPo3tRlD5Yp4EUth324ccNnVX8zmjPHvJBYKw=";
+    })
+  ];
+
   outputs = [
     "out"
     "python"
@@ -71,17 +88,11 @@ stdenv.mkDerivation rec {
       setuptools
     ]))
     shellcheck
+    sphinx
   ] ++ lib.optionals cudaSupport [
     cudaPackages.cuda_nvcc
   ];
 
-  patches = [
-    (substituteAll {
-      src = ./cmake.patch;
-      inherit (lib) version;
-    })
-  ];
-
   postPatch = ''
     mkdir -p temp/gna_${gna_version}
     pushd temp/
@@ -100,30 +111,35 @@ stdenv.mkDerivation rec {
   dontUseCmakeBuildDir = true;
 
   cmakeFlags = [
-    "-DCMAKE_PREFIX_PATH:PATH=${placeholder "out"}"
+    "-Wno-dev"
     "-DCMAKE_MODULE_PATH:PATH=${placeholder "out"}/lib/cmake"
-    "-DENABLE_LTO:BOOL=ON"
-    # protobuf
-    "-DENABLE_SYSTEM_PROTOBUF:BOOL=OFF"
-    "-DProtobuf_LIBRARIES=${protobuf}/lib/libprotobuf${stdenv.hostPlatform.extensions.sharedLibrary}"
-    # tbb
-    "-DENABLE_SYSTEM_TBB:BOOL=ON"
-    # opencv
-    "-DENABLE_OPENCV:BOOL=ON"
+    "-DCMAKE_PREFIX_PATH:PATH=${placeholder "out"}"
     "-DOpenCV_DIR=${opencv}/lib/cmake/opencv4/"
-    # pugixml
-    "-DENABLE_SYSTEM_PUGIXML:BOOL=ON"
-    # onednn
-    "-DENABLE_ONEDNN_FOR_GPU:BOOL=OFF"
-    # intel gna
-    "-DENABLE_INTEL_GNA:BOOL=ON"
-    # python
-    "-DENABLE_PYTHON:BOOL=ON"
-    # tests
-    "-DENABLE_CPPLINT:BOOL=OFF"
-    "-DBUILD_TESTING:BOOL=OFF"
-    "-DENABLE_SAMPLES:BOOL=OFF"
-    (lib.cmakeBool "CMAKE_VERBOSE_MAKEFILE" true)
+    "-DProtobuf_LIBRARIES=${protobuf}/lib/libprotobuf${stdenv.hostPlatform.extensions.sharedLibrary}"
+
+    (cmakeBool "CMAKE_VERBOSE_MAKEFILE" true)
+    (cmakeBool "NCC_SYLE" false)
+    (cmakeBool "BUILD_TESTING" false)
+    (cmakeBool "ENABLE_CPPLINT" false)
+    (cmakeBool "ENABLE_TESTING" false)
+    (cmakeBool "ENABLE_SAMPLES" false)
+
+    # features
+    (cmakeBool "ENABLE_INTEL_CPU" true)
+    (cmakeBool "ENABLE_INTEL_GNA" true)
+    (cmakeBool "ENABLE_JS" false)
+    (cmakeBool "ENABLE_LTO" true)
+    (cmakeBool "ENABLE_ONEDNN_FOR_GPU" false)
+    (cmakeBool "ENABLE_OPENCV" true)
+    (cmakeBool "ENABLE_PYTHON" true)
+
+    # system libs
+    (cmakeBool "ENABLE_SYSTEM_FLATBUFFERS" true)
+    (cmakeBool "ENABLE_SYSTEM_OPENCL" true)
+    (cmakeBool "ENABLE_SYSTEM_PROTOBUF" false)
+    (cmakeBool "ENABLE_SYSTEM_PUGIXML" true)
+    (cmakeBool "ENABLE_SYSTEM_SNAPPY" true)
+    (cmakeBool "ENABLE_SYSTEM_TBB" true)
   ];
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isAarch64 "-Wno-narrowing";
@@ -133,12 +149,13 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    flatbuffers
     libusb1
     libxml2
     ocl-icd
     opencv.cxxdev
-    protobuf
     pugixml
+    snappy
     tbb
   ] ++ lib.optionals cudaSupport [
     cudaPackages.cuda_cudart
@@ -147,11 +164,9 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   postInstall = ''
-    pushd $out/python/python${lib.versions.majorMinor python.version}
     mkdir -p $python
-    mv ./* $python/
-    popd
-    rm -r $out/python
+    mv $out/python/* $python/
+    rmdir $out/python
   '';
 
   postFixup = ''
diff --git a/pkgs/development/libraries/science/astronomy/indilib/default.nix b/pkgs/development/libraries/science/astronomy/indilib/default.nix
index 3fae85187deb..c38842f128c7 100644
--- a/pkgs/development/libraries/science/astronomy/indilib/default.nix
+++ b/pkgs/development/libraries/science/astronomy/indilib/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "indilib";
-  version = "2.0.5";
+  version = "2.0.6";
 
   src = fetchFromGitHub {
     owner = "indilib";
     repo = "indi";
     rev = "v${version}";
-    hash = "sha256-n1zj1U26l30JYr5Tio5zwv8v/e2cjEeIRGsyncMtt9I=";
+    hash = "sha256-3MeF2G/rr//c7cgGzqDzmqoNKvR+7Kkbid1g8znKPkg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index eb4d975a6e01..952fc28eae4c 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -5,8 +5,6 @@
 
 # uses readline & ncurses for a better interactive experience if set to true
 , interactive ? false
-# TODO: can be removed since 3.36 since it is the default now.
-, enableDeserialize ? false
 
 , gitUpdater
 }:
@@ -54,9 +52,6 @@ stdenv.mkDerivation rec {
     "-DSQLITE_SECURE_DELETE"
     "-DSQLITE_MAX_VARIABLE_NUMBER=250000"
     "-DSQLITE_MAX_EXPR_DEPTH=10000"
-  ] ++ lib.optionals enableDeserialize [
-    # Can be removed in v3.36+, as this will become the default
-    "-DSQLITE_ENABLE_DESERIALIZE"
   ]);
 
   # Test for features which may not be available at compile time
diff --git a/pkgs/development/libraries/waylib/default.nix b/pkgs/development/libraries/waylib/default.nix
new file mode 100644
index 000000000000..9aa211ffd3e0
--- /dev/null
+++ b/pkgs/development/libraries/waylib/default.nix
@@ -0,0 +1,74 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, pkg-config
+, wayland-scanner
+, wrapQtAppsHook
+, qtbase
+, qtquick3d
+, qwlroots
+, wayland
+, wayland-protocols
+, wlr-protocols
+, pixman
+, libdrm
+, nixos-artwork
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "waylib";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "vioken";
+    repo = "waylib";
+    rev = finalAttrs.version;
+    hash = "sha256-3IdrChuXQyQGhJ/7kTqmkV0PyuSNP53Y0Po01Fc9Qi0=";
+  };
+
+  postPatch = ''
+    substituteInPlace examples/tinywl/OutputDelegate.qml \
+      --replace "/usr/share/wallpapers/deepin/desktop.jpg" \
+                "${nixos-artwork.wallpapers.simple-blue}/share/backgrounds/nixos/nix-wallpaper-simple-blue.png"
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wayland-scanner
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qtbase
+    qtquick3d
+    wayland
+    wayland-protocols
+    wlr-protocols
+    pixman
+    libdrm
+  ];
+
+  propagatedBuildInputs = [
+    qwlroots
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "INSTALL_TINYWL" true)
+  ];
+
+  strictDeps = true;
+
+  outputs = [ "out" "dev" "bin" ];
+
+  meta = {
+    description = "A wrapper for wlroots based on Qt";
+    homepage = "https://github.com/vioken/waylib";
+    license = with lib.licenses; [ gpl3Only lgpl3Only asl20 ];
+    outputsToInstall = [ "out" ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ rewine ];
+  };
+})
+
diff --git a/pkgs/development/node-packages/main-programs.nix b/pkgs/development/node-packages/main-programs.nix
index 5f2c214a4965..77ce87da7aab 100644
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@@ -45,8 +45,12 @@
   poor-mans-t-sql-formatter-cli = "sqlformat";
   postcss-cli = "postcss";
   prettier = "prettier";
+  pulp = "pulp";
+  purescript-language-server = "purescript-language-server";
   purescript-psa = "psa";
   purs-tidy = "purs-tidy";
+  purty = "purty";
+  pscid = "pscid";
   remod-cli = "remod";
   svelte-language-server = "svelteserver";
   teck-programmer = "teck-firmware-upgrade";
diff --git a/pkgs/development/ocaml-modules/zipc/default.nix b/pkgs/development/ocaml-modules/zipc/default.nix
index a4b22de3e94b..a31d2644e668 100644
--- a/pkgs/development/ocaml-modules/zipc/default.nix
+++ b/pkgs/development/ocaml-modules/zipc/default.nix
@@ -7,11 +7,11 @@ lib.throwIfNot (lib.versionAtLeast ocaml.version "4.14")
 
 stdenv.mkDerivation rec {
   pname = "ocaml${ocaml.version}-zipc";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchurl {
     url = "https://erratique.ch/software/zipc/releases/zipc-${version}.tbz";
-    hash = "sha256-vU4AGW1MjQ31xjwvyRKSn1AwS0X6gjLvaJGYKqzFRpk=";
+    hash = "sha256-YQqkCURwrJgFH0+zgfket25zJQ4w+Tcc1mTSrDuWRt0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/python-modules/adjusttext/default.nix b/pkgs/development/python-modules/adjusttext/default.nix
index d8d82edb8a31..a97353baa987 100644
--- a/pkgs/development/python-modules/adjusttext/default.nix
+++ b/pkgs/development/python-modules/adjusttext/default.nix
@@ -4,27 +4,34 @@
 , matplotlib
 , numpy
 , packaging
+, pythonOlder
+, scipy
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "adjusttext";
-  version = "0.8.1";
-  format = "setuptools";
+  version = "1.0.4";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "Phlya";
-    repo = pname;
-    rev = "refs/tags/${version}";
+    repo = "adjusttext";
+    rev = "refs/tags/v${version}";
     hash = "sha256-Lhl6ykx5ynf+pBub5tBUaALm1w/88jbuSXPigE216NY=";
   };
 
   nativeBuildInputs = [
     packaging
+    setuptools
   ];
 
   propagatedBuildInputs = [
     matplotlib
     numpy
+    scipy
   ];
 
   # Project has no tests
@@ -37,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Iteratively adjust text position in matplotlib plots to minimize overlaps";
     homepage = "https://github.com/Phlya/adjustText";
+    changelog = "https://github.com/Phlya/adjustText/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ samuela ];
   };
diff --git a/pkgs/development/python-modules/aiortm/default.nix b/pkgs/development/python-modules/aiortm/default.nix
index 532d07396919..e1e4f7fabaf7 100644
--- a/pkgs/development/python-modules/aiortm/default.nix
+++ b/pkgs/development/python-modules/aiortm/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "aiortm";
-  version = "0.8.9";
+  version = "0.8.10";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiortm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bHFQd/jD5S+2YHr+f8W9WxDw69i59gzzptwDUS0UWAY=";
+    hash = "sha256-WkVuuvWWdj2McdXl+XwYukUcloehelFIi6QL5LSkfLk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/anthropic/default.nix b/pkgs/development/python-modules/anthropic/default.nix
index 9bd84551bf62..5dcd191aacdc 100644
--- a/pkgs/development/python-modules/anthropic/default.nix
+++ b/pkgs/development/python-modules/anthropic/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "anthropic";
-  version = "0.12.0";
+  version = "0.14.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "anthropics";
     repo = "anthropic-sdk-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MwZc+uGNjALNnGTzZwxDd/o/htbn/IFotdkh/066yM4=";
+    hash = "sha256-LnY9YoDOVIRqSRQQ/3ggUvlOf0p1351HOjqzRZSLsME=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index eab09e7f426a..5101f0fcc0d0 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "5.6.0";
+  version = "5.6.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "AppThreat";
     repo = "vulnerability-db";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tRC+w9HyXuN6eWbNaccK0xtcOnJpuErcHaB7+lvTiQI=";
+    hash = "sha256-BkJ1hA4SXuXYkJnSNaZ/JeX+PHdJylfwKkRzQsBxc24=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/azure-batch/default.nix b/pkgs/development/python-modules/azure-batch/default.nix
index 2ca6a6d743ca..041d79b5ebd0 100644
--- a/pkgs/development/python-modules/azure-batch/default.nix
+++ b/pkgs/development/python-modules/azure-batch/default.nix
@@ -1,29 +1,31 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, msrest
-, azure-common
 , msrestazure
+, azure-common
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "azure-batch";
-  version = "14.0.0";
-  format = "setuptools";
+  version = "14.1.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    extension = "zip";
-    hash = "sha256-FlsembhvghAkxProX7NIadQHqg67DKS5b7JthZwmyTQ=";
+    hash = "sha256-lhayyqYpx0ABItaF1VfrzQF5famImQgxj5pUdIQ5es0=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
-    msrest
-    msrestazure
     azure-common
+    msrestazure
   ];
 
   # Module has no tests
@@ -35,7 +37,8 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "This is the Microsoft Azure Batch Client Library";
-    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    homepage = "https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/batch/azure-batch";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-batch_${version}/sdk/batch/azure-batch/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ maxwilson ];
   };
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 60f5bf153ffe..33ffd9a3d705 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -365,14 +365,14 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.30";
+  version = "1.34.32";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-M45Yil5lhIS4ewhKNwPLW1s16xCJLma+HhXp5zDahQ0=";
+    hash = "sha256-B38TsIVoYr7a+5K4SZuWBiTQb2hFlb5wH63lGo6WFe0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 04ff8bffdbb6..e790e8cea5b2 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.34.30";
+  version = "1.34.32";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-RroNjY+0CSfro3a1xjvJXoLkddwTYMR6SalPIxJCOOk=";
+    hash = "sha256-l4yXuMArX/o3JqUFLlcVrsxSxkCnWoCIs6WEU8KwVLI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/censys/default.nix b/pkgs/development/python-modules/censys/default.nix
index f4b1f97f8cfa..901f70dddd2e 100644
--- a/pkgs/development/python-modules/censys/default.nix
+++ b/pkgs/development/python-modules/censys/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "censys";
-  version = "2.2.10";
+  version = "2.2.11";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "censys";
     repo = "censys-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rjLTEaHSBB6igffNGt4qJZeSyIn1Cc1ZGEGfEoMj7OQ=";
+    hash = "sha256-/aB8rsyymNTXJLsf/IkA6o7M/mzyao10cl7kbxHEzGc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/clarifai-grpc/default.nix b/pkgs/development/python-modules/clarifai-grpc/default.nix
index fec7e49c412c..ea3bf5c530d3 100644
--- a/pkgs/development/python-modules/clarifai-grpc/default.nix
+++ b/pkgs/development/python-modules/clarifai-grpc/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "clarifai-grpc";
-  version = "10.0.9";
+  version = "10.0.10";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Clarifai";
     repo = "clarifai-python-grpc";
     rev = "refs/tags/${version}";
-    hash = "sha256-SDGkAlIUCfz4G1TyGjSd4M5Syl8sw/aeUHT6J5V7RKg=";
+    hash = "sha256-IcMnzfkq4eSXh2KsxSog64RQbJhXkEWjma6LNkzDX0Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django-reversion/default.nix b/pkgs/development/python-modules/django-reversion/default.nix
index 7eaa9c3a7189..35d54194f07d 100644
--- a/pkgs/development/python-modules/django-reversion/default.nix
+++ b/pkgs/development/python-modules/django-reversion/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "django-reversion";
-  version = "5.0.10";
+  version = "5.0.12";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
 src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wYdJpnwdtBZ8yszDY5XF/mB48xKGloPC89IUBR5aayk=";
+    hash = "sha256-wEfMmanxukqubbicOsJDR41t6Y7Ipgxwc/zIddicXNs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dvc-objects/default.nix b/pkgs/development/python-modules/dvc-objects/default.nix
index 34848b020c63..778bcf39fa27 100644
--- a/pkgs/development/python-modules/dvc-objects/default.nix
+++ b/pkgs/development/python-modules/dvc-objects/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-objects";
-  version = "3.0.3";
+  version = "3.0.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvc-objects";
     rev = "refs/tags/${version}";
-    hash = "sha256-JQ3UDUOpuxPavXkoJqbS0T7y3kpwuJ8NvqAl3DahoLU=";
+    hash = "sha256-os4MzxB4IuqJ9EsKZXGzOU23Qf6LLLiV6SLaNpMlEp8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/dvc/default.nix b/pkgs/development/python-modules/dvc/default.nix
index ec46ef9edfc8..b4cad5f2b206 100644
--- a/pkgs/development/python-modules/dvc/default.nix
+++ b/pkgs/development/python-modules/dvc/default.nix
@@ -58,7 +58,7 @@
 
 buildPythonPackage rec {
   pname = "dvc";
-  version = "3.42.0";
+  version = "3.43.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -67,7 +67,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvc";
     rev = "refs/tags/${version}";
-    hash = "sha256-NTviaNhGe3hisP32Ccp1wHTrKXHZZP7gJFwDy7BlI/M=";
+    hash = "sha256-i9hIsn5rybDaWSzAFKazwB5wgpL0DAyUrqnxqCGLiR0=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/es-client/default.nix b/pkgs/development/python-modules/es-client/default.nix
index 7c72732f7499..96282cb54c6d 100644
--- a/pkgs/development/python-modules/es-client/default.nix
+++ b/pkgs/development/python-modules/es-client/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , certifi
 , click
+, ecs-logging
 , elastic-transport
 , elasticsearch8
 , fetchFromGitHub
@@ -19,8 +20,8 @@
 
 buildPythonPackage rec {
   pname = "es-client";
-  version = "8.11.0";
-  format = "pyproject";
+  version = "8.12.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -28,7 +29,7 @@ buildPythonPackage rec {
     owner = "untergeek";
     repo = "es_client";
     rev = "refs/tags/v${version}";
-    hash = "sha256-VsHpWe37/CZvGm3PqVq4mJCBA9juvOD9FLmDeW8OjiM=";
+    hash = "sha256-kskUPewMEp37OwLtopJFtbC8Nxa07qgImLejYyiUJao=";
   };
 
   pythonRelaxDeps = true;
@@ -41,6 +42,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     certifi
     click
+    ecs-logging
     elastic-transport
     elasticsearch8
     pyyaml
@@ -62,7 +64,11 @@ buildPythonPackage rec {
   disabledTests = [
     # Tests require network access
     "test_bad_version_raises"
+    "test_basic_operation"
+    "test_basic_operation"
     "test_client_info"
+    "test_logging_options_ecs"
+    "test_logging_options_json"
     "test_multiple_hosts_raises"
     "test_non_dict_passed"
     "test_skip_version_check"
diff --git a/pkgs/development/python-modules/fingerprints/default.nix b/pkgs/development/python-modules/fingerprints/default.nix
index 00c2efe7e3f3..a4e3be44b06f 100644
--- a/pkgs/development/python-modules/fingerprints/default.nix
+++ b/pkgs/development/python-modules/fingerprints/default.nix
@@ -1,21 +1,30 @@
 { lib
-, fetchFromGitHub
 , buildPythonPackage
+, fetchFromGitHub
 , normality
 , pytestCheckHook
+, pythonOlder
+, setuptools
 }:
+
 buildPythonPackage rec {
   pname = "fingerprints";
-  version = "1.1.0";
-  format = "setuptools";
+  version = "1.2.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "alephdata";
     repo = "fingerprints";
     rev = version;
-    hash = "sha256-rptBM08dvivfglPvl3PZd9V/7u2SHbJ/BxfVHNGMt3A=";
+    hash = "sha256-U2UslCy1OagVTtllCKsEBX4zI/qIczbxs2Cxzy+/Xys=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     normality
   ];
@@ -32,6 +41,6 @@ buildPythonPackage rec {
     description = "A library to generate entity fingerprints";
     homepage = "https://github.com/alephdata/fingerprints";
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/georss-client/default.nix b/pkgs/development/python-modules/georss-client/default.nix
index d6529cbf9fec..51d895456da3 100644
--- a/pkgs/development/python-modules/georss-client/default.nix
+++ b/pkgs/development/python-modules/georss-client/default.nix
@@ -6,23 +6,28 @@
 , pytestCheckHook
 , pythonOlder
 , requests
+, setuptools
 , xmltodict
 }:
 
 buildPythonPackage rec {
   pname = "georss-client";
-  version = "0.15";
-  format = "setuptools";
+  version = "0.17";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "exxamalte";
     repo = "python-georss-client";
-    rev = "v${version}";
-    hash = "sha256-D1ggfEDU+vlFmi1USwdHj1due0PrCQCpKF4zaarHCFs=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-DvQifO/jirpacWZccK4WPxnm/iYs1qT5nAYQUDoleO4=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     haversine
     xmltodict
@@ -41,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for accessing GeoRSS feeds";
     homepage = "https://github.com/exxamalte/python-georss-client";
+    changelog = "https://github.com/exxamalte/python-georss-client/releases/tag/v${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/georss-ingv-centro-nazionale-terremoti-client/default.nix b/pkgs/development/python-modules/georss-ingv-centro-nazionale-terremoti-client/default.nix
index 273b67acfb7c..e74f3670f223 100644
--- a/pkgs/development/python-modules/georss-ingv-centro-nazionale-terremoti-client/default.nix
+++ b/pkgs/development/python-modules/georss-ingv-centro-nazionale-terremoti-client/default.nix
@@ -4,22 +4,27 @@
 , georss-client
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "georss-ingv-centro-nazionale-terremoti-client";
-  version = "0.6";
-  format = "setuptools";
+  version = "0.7";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "exxamalte";
     repo = "python-georss-ingv-centro-nazionale-terremoti-client";
-    rev = "v${version}";
-    hash = "sha256-zqjo70NzpUt5zNEar0P1sl/gMb+ZcS+7GX7QGuFjMYY=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-J72yd1D4mKCOsBRLMUXKnxmjr6g0IQApTTrWjklczN8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     georss-client
   ];
@@ -35,6 +40,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for accessing the INGV Centro Nazionale Terremoti GeoRSS feed";
     homepage = "https://github.com/exxamalte/python-georss-ingv-centro-nazionale-terremoti-client";
+    changelog = "https://github.com/exxamalte/python-georss-ingv-centro-nazionale-terremoti-client/releases/tag/v${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/githubkit/default.nix b/pkgs/development/python-modules/githubkit/default.nix
index 8d8fd8cd6e32..3b7340e43596 100644
--- a/pkgs/development/python-modules/githubkit/default.nix
+++ b/pkgs/development/python-modules/githubkit/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "githubkit";
-  version = "0.11.0";
+  version = "0.11.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "yanyongyu";
     repo = "githubkit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-o7u/C9Ylw903Hat4xZdb0YYVtXKSu2WljD9uiLQeFIU=";
+    hash = "sha256-nPXs6thXAshDojgHSNyEeBN/jNJkfFECSuY5f51Zozo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/google-cloud-asset/default.nix b/pkgs/development/python-modules/google-cloud-asset/default.nix
index a2e1e852da70..4d090d6e738e 100644
--- a/pkgs/development/python-modules/google-cloud-asset/default.nix
+++ b/pkgs/development/python-modules/google-cloud-asset/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-asset";
-  version = "3.23.0";
+  version = "3.24.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ILg5PCstA6KwOsQZYkkE8xvFAbs6na24uUx8B5T7w1M=";
+    hash = "sha256-A9Ov5a6lpcJ+6diVEjFlLKMwROuSKO/lZOuGxN6Nn7U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-dataproc/default.nix b/pkgs/development/python-modules/google-cloud-dataproc/default.nix
index 3b0fff422ce1..41c8122f9857 100644
--- a/pkgs/development/python-modules/google-cloud-dataproc/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dataproc/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-dataproc";
-  version = "5.8.0";
+  version = "5.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sDQS3WPLhNwLsIRM2emp7vQOHQ1xlkllkFLMzw0+ldc=";
+    hash = "sha256-flH5yQBbxfG8sjYnFx3pzWJGpEd1EYpIzGMoYSgKdt8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-monitoring/default.nix b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
index 63060d008efd..c0cff664760a 100644
--- a/pkgs/development/python-modules/google-cloud-monitoring/default.nix
+++ b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-monitoring";
-  version = "2.18.0";
+  version = "2.19.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Bswdf7dcXlC1S8wASUHqSyCnqfCe1+bnU1FP2MQ2CWo=";
+    hash = "sha256-zhtDkpuJ4NH1lOFYmw+oO+R/H9gP6L+ud/4fdzIknwY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-redis/default.nix b/pkgs/development/python-modules/google-cloud-redis/default.nix
index 228545f62da4..451535149511 100644
--- a/pkgs/development/python-modules/google-cloud-redis/default.nix
+++ b/pkgs/development/python-modules/google-cloud-redis/default.nix
@@ -7,20 +7,25 @@
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "google-cloud-redis";
-  version = "2.14.0";
-  format = "setuptools";
+  version = "2.15.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TzuRWGGdQrsmOLidvLiC80e9t9VVu8LUNhq2Ikk0Pco=";
+    hash = "sha256-EyThUipPk96q5TuJDMKugFSGXDdWi0vOH5EzP2zzcyI=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     google-api-core
     proto-plus
diff --git a/pkgs/development/python-modules/google-cloud-tasks/default.nix b/pkgs/development/python-modules/google-cloud-tasks/default.nix
index 6aca5ab49226..bc6cf42b27c7 100644
--- a/pkgs/development/python-modules/google-cloud-tasks/default.nix
+++ b/pkgs/development/python-modules/google-cloud-tasks/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-tasks";
-  version = "2.15.1";
+  version = "2.16.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wkk3hefFhfDvL7iSFbOZqzTLaVBJPydSItjt5P4/zxY=";
+    hash = "sha256-oybkbzeqE4sW6RN5P7AFJV3rahTCykwJndQ8uAmhiCE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
index ef0a5971ebbb..e8ac6fa628f5 100644
--- a/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
+++ b/pkgs/development/python-modules/google-cloud-videointelligence/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-videointelligence";
-  version = "2.12.0";
+  version = "2.13.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SwGUkyzSYEGZuIBbwQhpLmoqJZ9Hd1FrnLyXi4hx4pU=";
+    hash = "sha256-ODRF08xxjUrj6PMzfTlcYLqGrgV71OA0VHT44ktQZ4k=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
index d4c285c3f34e..87372d653845 100644
--- a/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-websecurityscanner/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-websecurityscanner";
-  version = "1.13.0";
+  version = "1.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vktbTjzNYMa8otEGGq36fYOKcNuNasWql4SBWbk84Iw=";
+    hash = "sha256-tb8BCpQtEj/0/dGSqTf+c0V0NwGZYx8y0oEHpoJWqhM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/govee-ble/default.nix b/pkgs/development/python-modules/govee-ble/default.nix
index 6b5b23c6a8a8..5499af7a1f95 100644
--- a/pkgs/development/python-modules/govee-ble/default.nix
+++ b/pkgs/development/python-modules/govee-ble/default.nix
@@ -12,18 +12,23 @@
 
 buildPythonPackage rec {
   pname = "govee-ble";
-  version = "0.27.3";
-  format = "pyproject";
+  version = "0.31.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
-    repo = pname;
+    repo = "govee-ble";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yMKZe2hEkBm9c/5QuFNQMVPsdHTx9lnEVysRlbntiVY=";
+    hash = "sha256-g4tOu4nrJx1DVk2KLfF6HIEM7vTkfBg2fd7R1j+Xwrk=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=govee_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -39,11 +44,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=govee_ble --cov-report=term-missing:skip-covered" ""
-  '';
-
   pythonImportsCheck = [
     "govee_ble"
   ];
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 3f9a30f878b3..a0ab0eefe58e 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2024.1.10";
+  version = "2024.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = "hahomematic";
     rev = "refs/tags/${version}";
-    hash = "sha256-IBROclNIkOedf2WxNUqz7+3izGEH08R7acrmnvm42Og=";
+    hash = "sha256-/cs1wyz3v9dLMAAgd0ipC7Z56ZzFQEBq8oqvousgr+U=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index 7b649888b2d5..248fa5c47607 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -15,7 +15,7 @@
 , httpx
 }:
 let
-  version = "1.20.1";
+  version = "1.20.9";
 in
 buildPythonPackage rec {
   pname = "litellm";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "BerriAI";
     repo = "litellm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8CqYONNa6STq9GPkf2VIkZgbPorLxnIxmzEAFBaw2sM=";
+    hash = "sha256-Sb5vfaKFUjBWfR/SPHLJLPD/EpoEwW56xKqgbUgM0K4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/losant-rest/default.nix b/pkgs/development/python-modules/losant-rest/default.nix
index fbc65794da26..6587f99d8118 100644
--- a/pkgs/development/python-modules/losant-rest/default.nix
+++ b/pkgs/development/python-modules/losant-rest/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "losant-rest";
-  version = "1.19.3";
+  version = "1.19.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Losant";
     repo = "losant-rest-python";
     rev = "v${version}";
-    hash = "sha256-Ppy7vOA7ix76nvzVEP+BkL8dsoN0oXNX/5IZyhXDoSw=";
+    hash = "sha256-aVOviCeYi/oj1Xv7I0d4U+JBU0w3wbjORXOim/g5S7U=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/meshtastic/default.nix b/pkgs/development/python-modules/meshtastic/default.nix
index 9dcc2d4a3a56..534623abccdd 100644
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "meshtastic";
-  version = "2.2.19";
+  version = "2.2.20";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "meshtastic";
     repo = "Meshtastic-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-5VXvh0W3llSnpIalg1e+JyFgmlTV5J2x4VC/j2+9Xb8=";
+    hash = "sha256-0q8omX306iM3p52u39Dc7m6oxAPo9Fs6CEVicYdIMT4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/myjwt/default.nix b/pkgs/development/python-modules/myjwt/default.nix
index a54ab560a235..c310c7efe1a1 100644
--- a/pkgs/development/python-modules/myjwt/default.nix
+++ b/pkgs/development/python-modules/myjwt/default.nix
@@ -12,6 +12,7 @@
 , pytest-mock
 , pytestCheckHook
 , pythonOlder
+, pythonRelaxDepsHook
 , questionary
 , requests
 , requests-mock
@@ -20,7 +21,7 @@
 buildPythonPackage rec {
   pname = "myjwt";
   version = "1.6.1";
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -33,12 +34,17 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "1.6.0" "${version}" \
-      --replace 'cryptography = "^39.0.2"' 'cryptography = "^39.0.0"'
+      --replace-warn "1.6.0" "${version}"
   '';
 
+  pythonRelaxDeps = [
+    "cryptography"
+    "questionary"
+  ];
+
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nipreps-versions/default.nix b/pkgs/development/python-modules/nipreps-versions/default.nix
new file mode 100644
index 000000000000..1c54ab9d905e
--- /dev/null
+++ b/pkgs/development/python-modules/nipreps-versions/default.nix
@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, flit-scm
+, packaging
+, setuptools-scm
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "nipreps-versions";
+  version = "1.0.4";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "nipreps";
+    repo = "version-schemes";
+    rev = "refs/tags/${version}";
+    hash = "sha256-B2wtLurzgk59kTooH51a2dewK7aEyA0dAm64Wp+tqhM=";
+  };
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    flit-scm
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    packaging
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "nipreps_versions" ];
+
+  meta = with lib; {
+    description = "Setuptools_scm plugin for nipreps version schemes";
+    homepage = "https://github.com/nipreps/version-schemes";
+    changelog = "https://github.com/nipreps/version-schemes/blob/${src.rev}/CHANGES.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
diff --git a/pkgs/development/python-modules/niworkflows/default.nix b/pkgs/development/python-modules/niworkflows/default.nix
new file mode 100644
index 000000000000..494a834c937a
--- /dev/null
+++ b/pkgs/development/python-modules/niworkflows/default.nix
@@ -0,0 +1,101 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, hatch-vcs
+, hatchling
+, pytestCheckHook
+, attrs
+, importlib-resources
+, jinja2
+, looseversion
+, matplotlib
+, nibabel
+, nilearn
+, nipype
+, nitransforms
+, numpy
+, packaging
+, pandas
+, pybids
+, pyyaml
+, scikit-image
+, scipy
+, seaborn
+, svgutils
+, templateflow
+, traits
+, transforms3d
+}:
+
+buildPythonPackage rec {
+  pname = "niworkflows";
+  version = "1.10.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "nipreps";
+    repo = "niworkflows";
+    rev = "refs/tags/${version}";
+    hash = "sha256-wQPk9imDvomg+NTWk+VeW1TE2QlvMyi1YYVVaznhktU=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace '"traits < 6.4"' '"traits"'
+  '';
+
+  nativeBuildInputs = [
+    hatch-vcs
+    hatchling
+  ];
+
+  propagatedBuildInputs = [
+    attrs
+    importlib-resources
+    jinja2
+    looseversion
+    matplotlib
+    nibabel
+    nilearn
+    nipype
+    nitransforms
+    numpy
+    packaging
+    pandas
+    pybids
+    pyyaml
+    scikit-image
+    scipy
+    seaborn
+    svgutils
+    templateflow
+    traits
+    transforms3d
+  ];
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  preCheck = ''export HOME=$(mktemp -d)'';
+  pytestFlagsArray = [ "niworkflows" ];
+  # try to download data:
+  disabledTests = [
+    "test_GenerateCifti"
+    "ROIsPlot"
+    "ROIsPlot2"
+    "test_SimpleShowMaskRPT"
+    "test_cifti_surfaces_plot"
+    "niworkflows.utils.misc.get_template_specs"
+    "niworkflows.interfaces.cifti._prepare_cifti"
+  ];
+  disabledTestPaths = [ "niworkflows/tests/test_registration.py" ];
+
+  pythonImportsCheck = [ "niworkflows" ];
+
+  meta = with lib; {
+    description = "Common workflows for MRI (anatomical, functional, diffusion, etc.)";
+    homepage = "https://github.com/nipreps/niworkflows";
+    changelog = "https://github.com/nipreps/niworkflows/blob/${src.rev}/CHANGES.rst";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index 3b9afa0d6c93..c646e355cc0d 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -2,23 +2,27 @@
 , nix-update-script
 , fetchPypi
 , buildPythonPackage
+, deprecated
 , regex
 , pip
 }:
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "2.13.11";
+  version = "3.0.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "oelint_parser";
-    hash = "sha256-Hr+2S4AGx0W+rrMFdAlN7/OcDTFYivZVYknD/sHWMDs=";
+    hash = "sha256-8Gagk3ijAlmIp0MQwuJ2REIUcoTlvdNcCK9k2RY8DOA=";
   };
 
   buildInputs = [ pip ];
-  propagatedBuildInputs = [ regex ];
+  propagatedBuildInputs = [
+    deprecated
+    regex
+  ];
   pythonImportsCheck = [ "oelint_parser" ];
 
   # Fail to run inside the code the build.
diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index 9c35a3c5491f..6e5225d17337 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "opower";
-  version = "0.2.0";
+  version = "0.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "opower";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OT+QCbHQbL3vCfPuyzxBKqUJ2EtFn+PslrKGlrC6Ip8=";
+    hash = "sha256-YqNHjGJ0BkF8/1LVDqbw9QoJgPgwbA1sIPJUuP4TTJY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pglast/default.nix b/pkgs/development/python-modules/pglast/default.nix
index f3d86a0cac92..4a3e4794bd77 100644
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pglast";
-  version = "6.1";
+  version = "6.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XdQQsknvZ4Nlmlsh/Lnp0bGjaduqaoH8IKPTOqBWhrU=";
+    hash = "sha256-mGP7o52Wun6AdE2jMAJBmLR10EmN50qzbMzB06BFXMg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index 993427596d40..82bb7ffd57e4 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -14,7 +14,7 @@
 }:
 let
   pname = "posthog";
-  version = "3.3.3";
+  version = "3.3.4";
 in
 buildPythonPackage {
   inherit pname version;
@@ -24,7 +24,7 @@ buildPythonPackage {
     owner = "PostHog";
     repo = "posthog-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-60SnWjxgTZrN6H/LQg2Oj9Es6YluAyladLHqrNL2dQY=";
+    hash = "sha256-xw6mbcEuW3bt5XmJ7ADE34Pm7MEOqJM08NBde8yqeBg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 6b3f3401def6..d456ac3fd96d 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "0.10.0.20240127";
+  version = "0.10.0.20240201";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6IpNJsLj4IlMXoEneM9FeYcW6K0Vq5/97fPK5jZMFYQ=";
+    hash = "sha256-8IAfr55UWsstyyoFr5KJWAtU1LnAguEAwUSWts/iK1o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pylgnetcast/default.nix b/pkgs/development/python-modules/pylgnetcast/default.nix
index 1e18c9f93aea..f4811bf02dfc 100644
--- a/pkgs/development/python-modules/pylgnetcast/default.nix
+++ b/pkgs/development/python-modules/pylgnetcast/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pylgnetcast";
-  version = "0.3.8";
+  version = "0.3.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "Drafteed";
     repo = "python-lgnetcast";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UxZ4XM7n0Ryd4D967fXPTA4sqTrZwS8Tj/Q8kNGdk8Q=";
+    hash = "sha256-5lzLknuGLQryLCc4YQJn8AGuWTiSM90+8UTQ/WYfASM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pylutron/default.nix b/pkgs/development/python-modules/pylutron/default.nix
index b55696d840f9..f217b46179f9 100644
--- a/pkgs/development/python-modules/pylutron/default.nix
+++ b/pkgs/development/python-modules/pylutron/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "pylutron";
-  version = "0.2.10";
+  version = "0.2.11";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DKwjBQXC7O/8bFxq5shJJxRV3HYgBeS7tJXg4m3vQMY=";
+    hash = "sha256-9M7bCZD3zGZM62ID0yB/neKkF+6UW8x5m2y5vj/mYes=";
   };
 
   # Project has no tests
diff --git a/pkgs/development/python-modules/pytedee-async/default.nix b/pkgs/development/python-modules/pytedee-async/default.nix
index 6269df577501..f4ce2c7bcd89 100644
--- a/pkgs/development/python-modules/pytedee-async/default.nix
+++ b/pkgs/development/python-modules/pytedee-async/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pytedee-async";
-  version = "0.2.12";
+  version = "0.2.13";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "zweckj";
     repo = "pytedee_async";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eepN5Urr9fp1780iy3Z4sot+hXvMCxMGodYBdRdDj9Y=";
+    hash = "sha256-3W+eqkniDMoDKeute5w1QyklOc/aren/Q8txBEI/4ys=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/reconplogger/default.nix b/pkgs/development/python-modules/reconplogger/default.nix
index 1cbec5068537..29f3c8b649aa 100644
--- a/pkgs/development/python-modules/reconplogger/default.nix
+++ b/pkgs/development/python-modules/reconplogger/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "reconplogger";
-  version = "4.14.0";
+  version = "4.15.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "omni-us";
     repo = "reconplogger";
     rev = "refs/tags/v${version}";
-    hash = "sha256-VQX0Hdw4aXszkWicpCQ9/X7edHyOTqN7OtzPZROS9Z0=";
+    hash = "sha256-0+YOrMqyDK6uAni2h5b6P850veIkUiifX6aHzCnRHD0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index 34c0f37435e7..0710b82176e8 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "sagemaker";
-  version = "2.205.0";
+  version = "2.206.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "aws";
     repo = "sagemaker-python-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TqPTzmJZa6ntxEIv/M9m6pvk9g0CcJW0PPyUJtwHNpk=";
+    hash = "sha256-aKLv8bXH1lq6yBeFsR2odtTo4sbaHlSyeSUnKdIzW9Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/scs/default.nix b/pkgs/development/python-modules/scs/default.nix
index 5e95bed4cbdb..c1ca83ed4ba1 100644
--- a/pkgs/development/python-modules/scs/default.nix
+++ b/pkgs/development/python-modules/scs/default.nix
@@ -41,6 +41,13 @@ buildPythonPackage rec {
       url = "https://github.com/bodono/scs-python/commit/dd17e2e5282ebe85f2df8a7c6b25cfdeb894970d.patch";
       hash = "sha256-vSeSJeeu5Wx3RXPyB39YTo0RU8HtAojrUw85Q76/QzA=";
     })
+    # fix test_solve_random_cone_prob on linux after scipy 1.12 update
+    # https://github.com/bodono/scs-python/pull/82
+    (fetchpatch {
+      name = "scipy-1.12-fix.patch";
+      url = "https://github.com/bodono/scs-python/commit/4baf4effdc2ce7ac2dd1beaf864f1a5292eb06c6.patch";
+      hash = "sha256-U/F5MakwYZN5hCaeAkcCG38WQxX9mXy9OvhyEQqN038=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -62,12 +69,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
   pythonImportsCheck = [ "scs" ];
-  disabledTests = lib.lists.optional (stdenv.system == "x86_64-linux") [
-    # `test/test_scs_rand.py` hang on "x86_64-linux" (https://github.com/NixOS/nixpkgs/pull/244532#pullrequestreview-1598095858)
-    "test_feasible"
-    "test_infeasibl"
-    "test_unbounded"
-  ];
 
   meta = with lib; {
     description = "Python interface for SCS: Splitting Conic Solver";
diff --git a/pkgs/development/python-modules/svgutils/default.nix b/pkgs/development/python-modules/svgutils/default.nix
new file mode 100644
index 000000000000..ea2c7c547e43
--- /dev/null
+++ b/pkgs/development/python-modules/svgutils/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, lxml
+, matplotlib
+, pytestCheckHook
+, nose
+}:
+
+buildPythonPackage rec {
+  pname = "svgutils";
+  version = "0.3.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "btel";
+    repo = "svg_utils";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ITvZx+3HMbTyaRmCb7tR0LKqCxGjqDdV9/2taziUD0c=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedBuildInputs = [
+    lxml
+    matplotlib
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook nose ];
+
+  pythonImportsCheck = [ "svgutils" ];
+
+  meta = with lib; {
+    description = "Python tools to create and manipulate SVG files";
+    homepage = "https://github.com/btel/svg_utils";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
diff --git a/pkgs/development/python-modules/tcxreader/default.nix b/pkgs/development/python-modules/tcxreader/default.nix
index 1334708fc7f7..7509b02e94e2 100644
--- a/pkgs/development/python-modules/tcxreader/default.nix
+++ b/pkgs/development/python-modules/tcxreader/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "tcxreader";
-  version = "0.4.6";
+  version = "0.4.9";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "alenrajsp";
     repo = "tcxreader";
     rev = "refs/tags/v${version}";
-    hash = "sha256-J7yzJfJr2EK/0hZLVgk+Poqr/vY/9bsgA6cePTQ45U0=";
+    hash = "sha256-N/YsH1P8F9bSuzTgrYNU6xEO/yldXNIXMN0pQgIesfc=";
   };
 
   nativeBuildInputs = [
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A reader for Garmin’s TCX file format";
     homepage = "https://github.com/alenrajsp/tcxreader";
+    changelog = "https://github.com/alenrajsp/tcxreader/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ firefly-cpp ];
   };
diff --git a/pkgs/development/python-modules/templateflow/default.nix b/pkgs/development/python-modules/templateflow/default.nix
new file mode 100644
index 000000000000..c879b7064d0f
--- /dev/null
+++ b/pkgs/development/python-modules/templateflow/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, setuptools-scm
+, nipreps-versions
+, pybids
+, requests
+, tqdm
+}:
+
+buildPythonPackage rec {
+  pname = "templateflow";
+  version = "23.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "templateflow";
+    repo = "python-client";
+    rev = "refs/tags/${version}";
+    hash = "sha256-8AdXC1IFGfYZ5cvCAyBz0tD3zia+KBILX0tL9IcO2NA=";
+  };
+
+  nativeBuildInputs = [ setuptools-scm ];
+  propagatedBuildInputs = [
+    nipreps-versions
+    pybids
+    requests
+    tqdm
+  ];
+
+  doCheck = false;  # most tests try to download data
+  #pythonImportsCheck = [ "templateflow" ];  # touches $HOME/.cache, hence needs https://github.com/NixOS/nixpkgs/pull/120300
+
+  meta = with lib; {
+    homepage = "https://templateflow.org/python-client";
+    description = "Python API to query TemplateFlow via pyBIDS";
+    changelog = "https://github.com/templateflow/python-client/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
diff --git a/pkgs/development/python-modules/tensordict/default.nix b/pkgs/development/python-modules/tensordict/default.nix
index c6a563bf55e5..1c5bad17e8a0 100644
--- a/pkgs/development/python-modules/tensordict/default.nix
+++ b/pkgs/development/python-modules/tensordict/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "tensordict";
-  version = "0.2.1";
+  version = "0.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "pytorch";
     repo = "tensordict";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+Osoz1632F/dEkG/o8RUqCIDok2Qc9Qdak+CCr9m26g=";
+    hash = "sha256-XTFUzPs/fqX3DPtu/qSE1hY+7r/HToPVPaTyVRzDT/E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/torchrl/default.nix b/pkgs/development/python-modules/torchrl/default.nix
index bbf1fccd76ba..371a178ab5c9 100644
--- a/pkgs/development/python-modules/torchrl/default.nix
+++ b/pkgs/development/python-modules/torchrl/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, fetchpatch
 , ninja
 , setuptools
 , wheel
@@ -32,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "torchrl";
-  version = "0.2.1";
+  version = "0.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -41,17 +40,9 @@ buildPythonPackage rec {
     owner = "pytorch";
     repo = "rl";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Y3WbSMGXS6fb4RyXk2SAKHT6RencGTZXM3tc65AQx74=";
+    hash = "sha256-ngl/gbNm+62W6UFNo8GOhSaIuK9FERDxGBCr++7B4gw=";
   };
 
-  patches = [
-    (fetchpatch {  # https://github.com/pytorch/rl/pull/1828
-      name = "pyproject.toml-remove-unknown-properties";
-      url = "https://github.com/pytorch/rl/commit/c390cf602fc79cb37d5f7bda6e44b5e9546ecda0.patch";
-      hash = "sha256-cUBBvKJ8vIHprcGzMojkUxcOrrmNPIoIBfLwHXWkjOc=";
-    })
-  ];
-
   nativeBuildInputs = [
     ninja
     setuptools
@@ -103,11 +94,6 @@ buildPythonPackage rec {
     rm -rf torchrl
 
     export XDG_RUNTIME_DIR=$(mktemp -d)
-  ''
-  # Otherwise, tochrl will try to use unpackaged torchsnapshot.
-  # TODO: This should be the default from next release so remove when updating from 0.2.1
-  + ''
-    export CKPT_BACKEND="torch"
   '';
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/types-docutils/default.nix b/pkgs/development/python-modules/types-docutils/default.nix
index 61184260dde2..13cd4f61f93c 100644
--- a/pkgs/development/python-modules/types-docutils/default.nix
+++ b/pkgs/development/python-modules/types-docutils/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-docutils";
-  version = "0.20.0.20240126";
+  version = "0.20.0.20240201";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zFp+7UY6CZH44K/7/een2JoxopbmhzLLOzHPLLRO6o0=";
+    hash = "sha256-ukv9T/bdGWQLp6tdk5ADk6ZYl4gPNlCZeWSpQ/Tnmms=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/types-setuptools/default.nix b/pkgs/development/python-modules/types-setuptools/default.nix
index d98aea408b94..0b7e0d91b2a6 100644
--- a/pkgs/development/python-modules/types-setuptools/default.nix
+++ b/pkgs/development/python-modules/types-setuptools/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-setuptools";
-  version = "68.2.0.2";
+  version = "69.0.0.20240115";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ce/DgK1cf3jjC8oVRvcGRpVozyYITPq3Ps+D3qHShEY=";
+    hash = "sha256-GpyGOJn0DL4gU9DNHQDd7wMwtJIzVGfQGPc8H+yUYqM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/xiaomi-ble/default.nix b/pkgs/development/python-modules/xiaomi-ble/default.nix
index bdc50db359fd..9128df5b033a 100644
--- a/pkgs/development/python-modules/xiaomi-ble/default.nix
+++ b/pkgs/development/python-modules/xiaomi-ble/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "xiaomi-ble";
-  version = "0.23.1";
+  version = "0.24.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-JH+QXCfQ1hMakJcN/QhhNQcfQRl+hBF2Xtc/TwaJxGw=";
+    hash = "sha256-G+8nLRunxS4+cId6jbWpzwULCsPNyX+iXiusmR8niVU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/zigpy-znp/default.nix b/pkgs/development/python-modules/zigpy-znp/default.nix
index 94fa9cdb0d38..4378570f77f9 100644
--- a/pkgs/development/python-modules/zigpy-znp/default.nix
+++ b/pkgs/development/python-modules/zigpy-znp/default.nix
@@ -8,6 +8,7 @@
 , pytest-mock
 , pytest-rerunfailures
 , pytest-timeout
+, pytest-xdist
 , pytestCheckHook
 , pythonOlder
 , setuptools
@@ -53,6 +54,7 @@ buildPythonPackage rec {
     pytest-mock
     pytest-rerunfailures
     pytest-timeout
+    pytest-xdist
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index f96f0a9759de..fde655201a81 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.2";
+  version = "3.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-z/kt7nkPcEFRZ3w68PQ3g28VPnIXzPE2jJQPp6aG+JM=";
+    hash = "sha256-zrrWPe2rc9knv6PitDokDvXa23rPDt1nr3tqPqP/fYs=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/buildkit/default.nix b/pkgs/development/tools/buildkit/default.nix
index 8898ff89f371..19f418b543a1 100644
--- a/pkgs/development/tools/buildkit/default.nix
+++ b/pkgs/development/tools/buildkit/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "buildkit";
-  version = "0.12.4";
+  version = "0.12.5";
 
   src = fetchFromGitHub {
     owner = "moby";
     repo = "buildkit";
     rev = "v${version}";
-    hash = "sha256-nQvrd2W9xWWGTlwN5Q2E3rs67OUxZ4bIp+rK2W2PUww=";
+    hash = "sha256-LESaOrUxV/BHGW9JSZfTXpbedp1aegPFWu9/tRx2ArM=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/check-jsonschema/default.nix b/pkgs/development/tools/check-jsonschema/default.nix
index 3731e3e7e5f3..3591e5a2515f 100644
--- a/pkgs/development/tools/check-jsonschema/default.nix
+++ b/pkgs/development/tools/check-jsonschema/default.nix
@@ -4,7 +4,7 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "check-jsonschema";
-  version = "0.27.3";
+  version = "0.27.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -12,8 +12,8 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "python-jsonschema";
     repo = "check-jsonschema";
-    rev = version;
-    hash = "sha256-WXvhlkU1dRNKhW3sMakd644W56xv8keMjSZL4MrQEc8=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xOLS2AQlVrL9b7VVCbnDyjHhQYmcD2DvPmEs+nn7Gm4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
index 7d29216602b7..4972f2cd90b1 100644
--- a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cirrus-cli";
-  version = "0.109.0";
+  version = "0.110.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yXgBQMpBPAaLnAnirkLJzotW14wRnL9Pn3MM6Tsiny8=";
+    sha256 = "sha256-5BMaOuiXz8SMfaB7qFvCyboGFKxzenkEVwj25Qh4MKw=";
   };
 
   vendorHash = "sha256-xJnBMSfYwx6uHuMjyR9IWGHwt3fNajDr6DW8o+J+lj8=";
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/common.nix b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
index d28e7252d2cf..bad183d98125 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker/common.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 let
-  version = "2.2.2";
-  srcHash = "sha256-Ld75U7ItpBgoLKPLNQF0Kb5PFg2O5vdm26aNs/HYfcw=";
+  version = "2.3.0";
+  srcHash = "sha256-r5TV5WJW2klSlrOG6EjfUgLyHhMI+BMUTY/2JIUgd0Q=";
   # The tarball contains vendored dependencies
   vendorHash = null;
 in
diff --git a/pkgs/development/tools/detekt/default.nix b/pkgs/development/tools/detekt/default.nix
index 091fef564756..ff643693daec 100644
--- a/pkgs/development/tools/detekt/default.nix
+++ b/pkgs/development/tools/detekt/default.nix
@@ -1,13 +1,13 @@
 { detekt, lib, stdenv, fetchurl, makeWrapper, jre_headless, testers }:
 stdenv.mkDerivation rec {
   pname = "detekt";
-  version = "1.23.4";
+  version = "1.23.5";
 
   jarfilename = "${pname}-${version}-executable.jar";
 
   src = fetchurl {
     url = "https://github.com/detekt/detekt/releases/download/v${version}/detekt-cli-${version}-all.jar";
-    sha256 = "sha256-Kx6I0pe7Qz4JMZeBRVdka6wfoL9uQgZjCUGInZJeAOA=";
+    sha256 = "sha256-Pz+MaZimJMCjtGPy7coi6SSE7IdAQhtp2u8YV4s7KLY=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/fable/default.nix b/pkgs/development/tools/fable/default.nix
index 30bf14f4fcf4..10447afe20f3 100644
--- a/pkgs/development/tools/fable/default.nix
+++ b/pkgs/development/tools/fable/default.nix
@@ -2,9 +2,9 @@
 
 buildDotnetGlobalTool {
   pname = "fable";
-  version = "4.10.0";
+  version = "4.11.0";
 
-  nugetSha256 = "sha256-qSnPb+qjF10gzP8LSvvqnAXa0tedvOMHCrVd8zTtZl0=";
+  nugetSha256 = "sha256-AOsCthGk4YiTcKjIdCE1nnADWLqfd80vPFMmo9YLGUA=";
   passthru.updateScript = ./update.sh;
 
   meta = with lib; {
diff --git a/pkgs/development/tools/gptcommit/default.nix b/pkgs/development/tools/gptcommit/default.nix
index 3b7892022b85..19d18edf1c42 100644
--- a/pkgs/development/tools/gptcommit/default.nix
+++ b/pkgs/development/tools/gptcommit/default.nix
@@ -11,7 +11,7 @@
 
 let
   pname = "gptcommit";
-  version = "0.5.14";
+  version = "0.5.16";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "zurawiki";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-xjaFr1y2Fd7IWbJlegnIsfS5/oMJYd6QTnwp7IK17xM=";
+    hash = "sha256-JhMkK2zw3VL9o7j8DJmjY/im+GyCjfV2TJI3GDo8T8c=";
   };
 
-  cargoHash = "sha256-VZrlEJi/UPQTGFiSpZs+Do+69CY3zdqGkAnUxMYvvaw=";
+  cargoHash = "sha256-ye9MAfG3m24ofV95Kr+KTP4FEqfrsm3aTQ464hG9q08=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/gqlgenc/default.nix b/pkgs/development/tools/gqlgenc/default.nix
index 07ea00756e58..700a305efa46 100644
--- a/pkgs/development/tools/gqlgenc/default.nix
+++ b/pkgs/development/tools/gqlgenc/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gqlgenc";
-  version = "0.16.2";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "yamashou";
     repo = "gqlgenc";
     rev = "v${version}";
-    sha256 = "sha256-XNmCSkgJJ2notrv0Din4jlU9EoHJcznjEUiXQgQ5a7I=";
+    sha256 = "sha256-CkVPbMepkBpCeyRv30S6RTvBSe6BsJuit87x1S9GPMU=";
   };
 
   excludedPackages = [ "example" ];
diff --git a/pkgs/development/tools/kdash/default.nix b/pkgs/development/tools/kdash/default.nix
index c7f4e8b7525f..73746875247d 100644
--- a/pkgs/development/tools/kdash/default.nix
+++ b/pkgs/development/tools/kdash/default.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kdash";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "kdash-rs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Vk0Pf5uF9AANv/vf32ZrICJJTp6QRsR/nFW40xnkImo=";
+    sha256 = "sha256-XY6aBqLHbif3RsytNm7JnDXspICJuhS7SJ+ApwTeqX4=";
   };
 
   nativeBuildInputs = [ perl python3 pkg-config ];
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl xorg.xcbutil ]
     ++ lib.optional stdenv.isDarwin AppKit;
 
-  cargoHash = "sha256-gY4ywjTokEc5Uv4InARH2s3WYiPGYSDDWk2kltyQa+0=";
+  cargoHash = "sha256-ODQf+Fvil+oBJcM38h1HdrcgtJw0b65f5auLuZtUgik=";
 
   meta = with lib; {
     description = "A simple and fast dashboard for Kubernetes";
diff --git a/pkgs/development/tools/kube-linter/default.nix b/pkgs/development/tools/kube-linter/default.nix
index bcacc28214bf..141239c403f2 100644
--- a/pkgs/development/tools/kube-linter/default.nix
+++ b/pkgs/development/tools/kube-linter/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kube-linter";
-  version = "0.6.5";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gygzibpTpdVg1ZenAXIDHXYwAemlr6qkioE+GV52NkE=";
+    sha256 = "sha256-D9QJsYaYvGjDucr0Xedg2LEqfwTxzIQBBNNFZ1m5D/U=";
   };
 
-  vendorHash = "sha256-ZeAAvL5pOvHMAsDBe/0CBeayTsUrPDK5a5rAxHAu64o=";
+  vendorHash = "sha256-ARrMHjR/fOGS8EDMCKiEr3ubWjqDySb/AdX9jNYWOVA=";
 
   ldflags = [
     "-s" "-w" "-X golang.stackrox.io/kube-linter/internal/version.version=${version}"
diff --git a/pkgs/development/tools/misc/act/default.nix b/pkgs/development/tools/misc/act/default.nix
index 5a22531dbcf5..e9f6d070b6f6 100644
--- a/pkgs/development/tools/misc/act/default.nix
+++ b/pkgs/development/tools/misc/act/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "act";
-  version = "0.2.57";
+  version = "0.2.58";
 
   src = fetchFromGitHub {
     owner = "nektos";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-lof3PWscGHQ9ZTF83wGyG0jMebYY2xec+HouQezr2d8=";
+    hash = "sha256-JvkJYjgBdbd3ffgOTMeE6Pe94Ctk19nOd2b2HfckPTU=";
   };
 
-  vendorHash = "sha256-7nvUs1R2jybh+PR/cHml8lR5jU25b2liPKLH47WDVxQ=";
+  vendorHash = "sha256-0Sjj9+YJcIkigvJOXxtDVcUylZmVY/Xv/IYpEBN46Is=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/misc/n98-magerun2/default.nix b/pkgs/development/tools/misc/n98-magerun2/default.nix
index 6aabcbffbb66..c04b3840a437 100644
--- a/pkgs/development/tools/misc/n98-magerun2/default.nix
+++ b/pkgs/development/tools/misc/n98-magerun2/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "n98-magerun2";
-  version = "7.2.0";
+  version = "7.3.1";
 
   src = fetchurl {
     url = "https://github.com/netz98/n98-magerun2/releases/download/${finalAttrs.version}/n98-magerun2.phar";
-    hash = "sha256-w+58TTyoS44Ouaz6KFIJLhSl/UeF1I7cSznlZH6fLXw=";
+    hash = "sha256-5G3sfyw8C3BwRqnK2o3upJTI/pENyaFCiMC4XGOkJT4=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/misc/slint-lsp/default.nix b/pkgs/development/tools/misc/slint-lsp/default.nix
index ac26ead01cff..3fa33bbcb8da 100644
--- a/pkgs/development/tools/misc/slint-lsp/default.nix
+++ b/pkgs/development/tools/misc/slint-lsp/default.nix
@@ -25,14 +25,14 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "slint-lsp";
-  version = "1.3.2";
+  version = "1.4.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-zNTel91c1ECg4z7xIu37GcSWHTxTKtxpGjH3TpiFQ1k=";
+    sha256 = "sha256-ZX8ylDDyOWwEcupNg7u0RvmsKMC4RZNaKPg04PaCo3w=";
   };
 
-  cargoHash = "sha256-pT3z6t1W/DitH/GJJIJhQawslodKzIkCyO0yd9OlvAg=";
+  cargoHash = "sha256-BxiN2/PItU29H8btX5bjwfd9C6p8AEvxJunM8lMu3SI=";
 
   nativeBuildInputs = [ cmake pkg-config fontconfig ];
   buildInputs = rpathLibs ++ [ xorg.libxcb.dev ]
diff --git a/pkgs/development/tools/misc/strace/default.nix b/pkgs/development/tools/misc/strace/default.nix
index 591eaeaa1ae2..d851aa217b5f 100644
--- a/pkgs/development/tools/misc/strace/default.nix
+++ b/pkgs/development/tools/misc/strace/default.nix
@@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, perl, libunwind, buildPackages, gitUpdater }:
+{ lib, stdenv, fetchurl, perl, libunwind, buildPackages, gitUpdater, elfutils }:
 
 stdenv.mkDerivation rec {
   pname = "strace";
-  version = "6.6";
+  version = "6.7";
 
   src = fetchurl {
     url = "https://strace.io/files/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-QhtBhsBrcFFj5k3IXycevc9nZgr4ZnKDFH1ehZ/IqWw=";
+    sha256 = "sha256-IJAgHho/8yhG9P5CHBFjsV9EC7OOMTVdCfgtOUmSKvc=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   # On RISC-V platforms, LLVM's libunwind implementation is unsupported by strace.
   # The build will silently fall back and -k will not work on RISC-V.
-  buildInputs = [ libunwind ]; # support -k
+  buildInputs = [ libunwind elfutils ]; # support -k and -kk
 
   configureFlags = [ "--enable-mpers=check" ];
 
diff --git a/pkgs/development/tools/okteto/default.nix b/pkgs/development/tools/okteto/default.nix
index d5351ed675f0..1c7ba093b6aa 100644
--- a/pkgs/development/tools/okteto/default.nix
+++ b/pkgs/development/tools/okteto/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "okteto";
-  version = "2.24.2";
+  version = "2.25.1";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     rev = version;
-    hash = "sha256-E3+3SPqovw/2zqDsqu9qQ5MFwNQhRIxXiWhZbhLxfuo=";
+    hash = "sha256-HBXp66chq+SzdEb463awolf4Uv0ScHN6MjoziYyh4kA=";
   };
 
-  vendorHash = "sha256-vSvHjQZFLzUIC9u+myI6Xi4YhetVkiQxBIkm5/RoV2U=";
+  vendorHash = "sha256-+Adnveutg8soqK2Zwn2SNq7SEHd/Z91diHbPYHrGVrA=";
 
   postPatch = ''
     # Disable some tests that need file system & network access.
diff --git a/pkgs/development/tools/purescript/spago/default.nix b/pkgs/development/tools/purescript/spago/default.nix
index ada0eb350efa..82d3be2fd469 100644
--- a/pkgs/development/tools/purescript/spago/default.nix
+++ b/pkgs/development/tools/purescript/spago/default.nix
@@ -55,4 +55,7 @@ spago.overrideAttrs (oldAttrs: {
           touch $out
         '';
   };
+  meta = (oldAttrs.meta or {}) // {
+    mainProgram = "spago";
+  };
 })
diff --git a/pkgs/development/tools/rust/cargo-binstall/default.nix b/pkgs/development/tools/rust/cargo-binstall/default.nix
index 1e404f10eedb..bbc02e127761 100644
--- a/pkgs/development/tools/rust/cargo-binstall/default.nix
+++ b/pkgs/development/tools/rust/cargo-binstall/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.5.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     rev = "v${version}";
-    hash = "sha256-QPUZnqELncUCfm995NN0hYDGFZcKrYXskZIaN2ZRtzk=";
+    hash = "sha256-KfzINyLxX07CDCP5wkBwl8bAf4x9AVTl6NiGjGZ7nFg=";
   };
 
-  cargoHash = "sha256-85r0jDBuvfrJq776MSbQT6w60/xWQkC9zLmZwjdanCk=";
+  cargoHash = "sha256-8Fwgs+pP2p5IqLXnFrPT+oOCRjyMIhQa+f63LA4aUOw=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/symfony-cli/default.nix b/pkgs/development/tools/symfony-cli/default.nix
index 75379b5e8203..453b96242638 100644
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@@ -10,14 +10,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.8.4";
+  version = "5.8.6";
   vendorHash = "sha256-ACK0JCaS1MOCgUi2DMEjIcKf/nMCcrdDyIdioBZv7qw=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    hash = "sha256-b6vjJaRSi5qNl4qpOEndqdZkaWxeI/6GnBiBIM2Vwr8=";
+    hash = "sha256-lZ4jPmqPGyWp8xS156XXl6s4ZfNbU4M5xJy25nRL1Bs=";
   };
 
   ldflags = [
diff --git a/pkgs/development/tools/the-way/default.nix b/pkgs/development/tools/the-way/default.nix
index a161728657ac..9418afb6cfa6 100644
--- a/pkgs/development/tools/the-way/default.nix
+++ b/pkgs/development/tools/the-way/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "the-way";
-  version = "0.20.2";
+  version = "0.20.3";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-jUo46NHjgSFOV7fsqh9Ki0QtTGfoaPjQ87/a66zBz1Q=";
+    sha256 = "sha256-/vG5LkQiA8iPP+UV1opLeJwbYfmzqYwpsoMizpGT98o=";
   };
 
-  cargoHash = "sha256-nmVsg8LX3di7ZAvvDuPQ3PXlLjs+L6YFTzwXRAkcxig=";
+  cargoHash = "sha256-iZxV099582LuZ8A3uOsKPyekAQG2cQusLZhW+W1wW/8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/turso-cli/default.nix b/pkgs/development/tools/turso-cli/default.nix
index 4c9da1e13f14..09f96c2d183a 100644
--- a/pkgs/development/tools/turso-cli/default.nix
+++ b/pkgs/development/tools/turso-cli/default.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "turso-cli";
-  version = "0.88.2";
+  version = "0.88.3";
 
   src = fetchFromGitHub {
     owner = "tursodatabase";
     repo = "turso-cli";
     rev = "v${version}";
-    hash = "sha256-9lnqjkDGQRu487Me895h/dyWDIVImQkU9bEiafjTbb8=";
+    hash = "sha256-tPeoLGYJRMXFVI09fupspdQMSMjF2Trdo2GlkoWs7wA=";
   };
 
   vendorHash = "sha256-rTeW2RQhcdwJTAMQELm4cdObJbm8gk/I2Qz3Wk3+zpI=";
diff --git a/pkgs/development/tools/zed/default.nix b/pkgs/development/tools/zed/default.nix
index 68a84d53a502..6164b6d4c624 100644
--- a/pkgs/development/tools/zed/default.nix
+++ b/pkgs/development/tools/zed/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "zed";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "brimdata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-mBJmAV7ax4F61gP8yeiJj/EQyJi3zaex6jT/CKzR3LU=";
+    sha256 = "sha256-xyTHCBvklK8x6V7WsWDYytnVEfLcja78crvs62WJJ9o=";
   };
 
-  vendorHash = "sha256-BWvMy1dc3PzAc3kDTXtI6Y8kjRGLWR+aUleItg5EgRU=";
+  vendorHash = "sha256-m8GOKBwXlNhjEIkkbaIOAGslX4WRVPZ0OknGEG29b4E=";
 
   subPackages = [ "cmd/zed" "cmd/zq" ];
 
diff --git a/pkgs/development/web/function-runner/default.nix b/pkgs/development/web/function-runner/default.nix
index 7582800e25bd..a3526a0c5584 100644
--- a/pkgs/development/web/function-runner/default.nix
+++ b/pkgs/development/web/function-runner/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "function-runner";
-  version = "4.1.0";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "Shopify";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-o+fsIBH/vONlb57m3+upKG2Gss6s7yBNATkbKtSHf/0=";
+    sha256 = "sha256-33UVo7mPD/o3Z/R5PFhosiSLFLLpJ0pHqUbKtX6THJE=";
   };
 
-  cargoHash = "sha256-7ACi4orqpmWiaMYmOjICR6/d1kVySzaaCWIoUxqnhpI=";
+  cargoHash = "sha256-TNbGmqITCk1VKVuO46LxO+zjAG7Laguq7EAruuhJIxk=";
 
   meta = with lib; {
     description = "A CLI tool which allows you to run Wasm Functions intended for the Shopify Functions infrastructure";
diff --git a/pkgs/development/web/grails/default.nix b/pkgs/development/web/grails/default.nix
index 9990cf4553a4..95660e2f3d60 100644
--- a/pkgs/development/web/grails/default.nix
+++ b/pkgs/development/web/grails/default.nix
@@ -11,11 +11,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "grails";
-  version = "6.1.0";
+  version = "6.1.2";
 
   src = fetchurl {
     url = "https://github.com/grails/grails-core/releases/download/v${version}/grails-${version}.zip";
-    sha256 = "sha256-v+AAIDWRAgBXmhX2BecEio4s5dVA77K+YycZY1k9uvg=";
+    sha256 = "sha256-PoiXZuAJbKsyBRVaxwsKSDh1BzPYlgAwe/xC0qfeDgs=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/games/osu-lazer/bin.nix b/pkgs/games/osu-lazer/bin.nix
index 996c6b7f6810..43dafeae5f15 100644
--- a/pkgs/games/osu-lazer/bin.nix
+++ b/pkgs/games/osu-lazer/bin.nix
@@ -7,22 +7,22 @@
 
 let
   pname = "osu-lazer-bin";
-  version = "2024.130.2";
+  version = "2024.131.0";
 
   src = {
     aarch64-darwin = fetchzip {
       url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-      hash = "sha256-XBwnMxBoOYqv9cyiM3OKscQBJmOmfYAOvOpnplaB+Ks=";
+      hash = "sha256-R25TAXU3gUcVKQMo8P+0/vTRzSoFrUdFz11inpch+7A=";
       stripRoot = false;
     };
     x86_64-darwin = fetchzip {
       url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-      hash = "sha256-JeV5PYcLGjRYnX51p5pODVDASX7A6Iit8SpvXeuBVao=";
+      hash = "sha256-w7BK3pm0XrlzOv0oz+ZUfVRufzUCCfevlRL+RDLtoLU=";
       stripRoot = false;
     };
     x86_64-linux = fetchurl {
       url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-      hash = "sha256-4NG/3lHqQVfNa6zME/HD9m/bEkV79Vu64+aMDgCKqw0=";
+      hash = "sha256-aNG6s942iTKyvM1XolMqmMs8XxoRYC/ZddCCJl0OtTE=";
     };
   }.${stdenv.system} or (throw "${pname}-${version}: ${stdenv.system} is unsupported.");
 
diff --git a/pkgs/games/osu-lazer/default.nix b/pkgs/games/osu-lazer/default.nix
index 6c43c641c2c3..cb1a11c330b6 100644
--- a/pkgs/games/osu-lazer/default.nix
+++ b/pkgs/games/osu-lazer/default.nix
@@ -16,13 +16,13 @@
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2024.130.2";
+  version = "2024.131.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     rev = version;
-    hash = "sha256-9KSeCEhjqiB33suQs1jmATsOnBz6NzjSq3/6A8F78VU=";
+    hash = "sha256-fsXs/AzvEQ141y/DPRvg7a7b0K30IfjigbRj0qh88rs=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";
diff --git a/pkgs/games/osu-lazer/deps.nix b/pkgs/games/osu-lazer/deps.nix
index 9b91a58ef479..669463431970 100644
--- a/pkgs/games/osu-lazer/deps.nix
+++ b/pkgs/games/osu-lazer/deps.nix
@@ -137,7 +137,7 @@
   (fetchNuGet { pname = "ppy.ManagedBass.Fx"; version = "2022.1216.0"; sha256 = "1vw573mkligpx9qiqasw1683cqaa1kgnxhlnbdcj9c4320b1pwjm"; })
   (fetchNuGet { pname = "ppy.ManagedBass.Mix"; version = "2022.1216.0"; sha256 = "185bpvgbnd8y20r7vxb1an4pd1aal9b7b5wvmv3knz0qg8j0chd9"; })
   (fetchNuGet { pname = "ppy.ManagedBass.Wasapi"; version = "2022.1216.0"; sha256 = "0h2ncf59sza8whvrwwqi8b6fcrkqrnfgfhd0vnhyw0s98nj74f0z"; })
-  (fetchNuGet { pname = "ppy.osu.Framework"; version = "2024.130.0"; sha256 = "1a2nzkbyllmyvivb1n5sig36ygg19qnc5wi0n4d9kjq113qbcm67"; })
+  (fetchNuGet { pname = "ppy.osu.Framework"; version = "2024.131.0"; sha256 = "0pa80w67nnfp3y25l5a6f6p9x48lj8bw3b24vzi3l8ndgcmnpyxz"; })
   (fetchNuGet { pname = "ppy.osu.Framework.NativeLibs"; version = "2023.1225.0-nativelibs"; sha256 = "008kj91i9486ff2q7fcgb8mmpinskvnmfsqza2m5vafh295y3h7m"; })
   (fetchNuGet { pname = "ppy.osu.Framework.SourceGeneration"; version = "2023.720.0"; sha256 = "001vvxyv483ibid25fdknvij77x0y983mp4psx2lbg3x2al7yxax"; })
   (fetchNuGet { pname = "ppy.osu.Game.Resources"; version = "2024.129.0"; sha256 = "032jpqv86z4sc835063gzbshkdzx3qhnzxlyaggidmbwn6i9fja6"; })
diff --git a/pkgs/games/vintagestory/default.nix b/pkgs/games/vintagestory/default.nix
index 9b06c2b93314..474b5e2ddbac 100644
--- a/pkgs/games/vintagestory/default.nix
+++ b/pkgs/games/vintagestory/default.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vintagestory";
-  version = "1.19.1";
+  version = "1.19.3";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${version}.tar.gz";
-    hash = "sha256-PrsClGSXTah5kkhww7slfkwpo0gJryf6pm61LsCYbiE=";
+    hash = "sha256-ULxwNdQLQCWJqCTiGtT1X/Y32f406FT/UPAJNBYrV/s=";
   };
 
 
diff --git a/pkgs/os-specific/darwin/airbuddy/default.nix b/pkgs/os-specific/darwin/airbuddy/default.nix
index 303311ccb105..374089c5aa1f 100644
--- a/pkgs/os-specific/darwin/airbuddy/default.nix
+++ b/pkgs/os-specific/darwin/airbuddy/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenvNoCC
 , fetchurl
-, undmg
+, _7zz
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -19,18 +19,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   dontBuild = true;
   dontFixup = true;
 
-  nativeBuildInputs = [ undmg ];
+  nativeBuildInputs = [ _7zz ];
 
-  # AirBuddy.dmg is not HFS formatted, default unpackPhase fails
-  # https://discourse.nixos.org/t/help-with-error-only-hfs-file-systems-are-supported-on-ventura
+  # AirBuddy.dmg is APFS formatted, unpack with 7zz
   unpackCmd = ''
-    mnt=$(mktemp -d)
+    runHook preUnpack
 
-    /usr/bin/hdiutil attach -nobrowse -readonly $src -mountpoint $mnt
+    7zz x $src
 
-    shopt -s extglob
-    DEST="$PWD"
-    (cd "$mnt"; cp -a !(Applications) "$DEST/")
+    runHook postUnpack
   '';
 
   sourceRoot = "AirBuddy.app";
diff --git a/pkgs/os-specific/darwin/aldente/default.nix b/pkgs/os-specific/darwin/aldente/default.nix
index a67efd3367d4..e585d8877803 100644
--- a/pkgs/os-specific/darwin/aldente/default.nix
+++ b/pkgs/os-specific/darwin/aldente/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenvNoCC
 , fetchurl
-, undmg
+, _7zz
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -16,24 +16,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   dontBuild = true;
   dontFixup = true;
 
-  nativeBuildInputs = [ undmg ];
+  nativeBuildInputs = [ _7zz ];
 
-  # AlDente.dmg is not HFS formatted, default unpackPhase fails
-  # https://discourse.nixos.org/t/help-with-error-only-hfs-file-systems-are-supported-on-ventura
+  # AlDente.dmg is APFS formatted, unpack with 7zz
   unpackCmd = ''
-    if ! [[ "$curSrc" =~ \.dmg$ ]]; then return 1; fi
-    mnt=$(mktemp -d -t ci-XXXXXXXXXX)
+    runHook preUnpack
 
-    function finish {
-      /usr/bin/hdiutil detach $mnt -force
-    }
-    trap finish EXIT
+    7zz x $src
 
-    /usr/bin/hdiutil attach -nobrowse -readonly $src -mountpoint $mnt
-
-    shopt -s extglob
-    DEST="$PWD"
-    (cd "$mnt"; cp -a !(Applications) "$DEST/")
+    runHook postUnpack
   '';
 
   sourceRoot = "AlDente.app";
diff --git a/pkgs/os-specific/darwin/sketchybar/default.nix b/pkgs/os-specific/darwin/sketchybar/default.nix
index 9b3ef924dd07..1d10749bf95a 100644
--- a/pkgs/os-specific/darwin/sketchybar/default.nix
+++ b/pkgs/os-specific/darwin/sketchybar/default.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sketchybar";
-  version = "2.19.4";
+  version = "2.20.0";
 
   src = fetchFromGitHub {
     owner = "FelixKratz";
     repo = "SketchyBar";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6MqTyCqFv5suQgQ5a9t1mDA2njjFFgk67Kp7xO5OXoA=";
+    hash = "sha256-Nyje2F2OXtojbAGNgGPGdX8SEH75SWWpBKLFULb96n4=";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/darwin/yabai/default.nix b/pkgs/os-specific/darwin/yabai/default.nix
index f5bbf5407d50..54d307290925 100644
--- a/pkgs/os-specific/darwin/yabai/default.nix
+++ b/pkgs/os-specific/darwin/yabai/default.nix
@@ -17,7 +17,7 @@
 
 let
   pname = "yabai";
-  version = "6.0.6";
+  version = "6.0.7";
 
   test-version = testers.testVersion {
     package = yabai;
@@ -53,7 +53,7 @@ in
 
     src = fetchzip {
       url = "https://github.com/koekeishiya/yabai/releases/download/v${version}/yabai-v${version}.tar.gz";
-      hash = "sha256-G4BbYU4mgV8Jap8a872/YtoXU/hwUhFyLXdcuT1jldI=";
+      hash = "sha256-hZMBXSCiTlx/37jt2yLquCQ8AZ2LS3heIFPKolLub1c=";
     };
 
     nativeBuildInputs = [
@@ -89,7 +89,7 @@ in
       owner = "koekeishiya";
       repo = "yabai";
       rev = "v${version}";
-      hash = "sha256-wqGYVUDEDkrLSr0IoAO17wbtwaDeainnkDeR8O8oFqc=";
+      hash = "sha256-vWL2KA+Rhj78I2J1kGItJK+OdvhVo1ts0NoOHIK65Hg=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
index 70f9d7a6c69e..386df843971c 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
@@ -37,7 +37,7 @@ stdenvNoCC.mkDerivation {
     # Bluetooth firmware
     cp -rv "$NIX_BUILD_TOP/bluez-firmware/debian/firmware/broadcom/." "$out/lib/firmware/brcm"
 
-    # brcmfmac43455-stdio.bin is a symlink to the non-existent path: ../cypress/cyfmac43455-stdio.bin.
+    # brcmfmac43455-sdio.bin is a symlink to the non-existent path: ../cypress/cyfmac43455-sdio.bin.
     # See https://github.com/RPi-Distro/firmware-nonfree/issues/26
     ln -s "./cyfmac43455-sdio-standard.bin" "$out/lib/firmware/cypress/cyfmac43455-sdio.bin"
 
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index e7b7317442dc..4df17a1a0e3e 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -8,8 +8,8 @@
         "hash": "sha256:1dfbbydmayfj9npx3z0g38p574pmcx3qgs49dv0npigl48wd9yvq"
     },
     "6.1": {
-        "version": "6.1.75",
-        "hash": "sha256:0mis14ll6xmhw71vfpw1aahi5z207qysha7x316fq4qc6c899lbc"
+        "version": "6.1.76",
+        "hash": "sha256:1zdi4xbk7zyiab7x8z12xqg72zaw3j61slvrbwjfx6pzh47cr005"
     },
     "5.15": {
         "version": "5.15.148",
@@ -28,11 +28,11 @@
         "hash": "sha256:06dy270xw4frnrc9p2qjh8chgp02fr5ll5g2b0lx9xqzlq7y86xr"
     },
     "6.6": {
-        "version": "6.6.14",
-        "hash": "sha256:110mz8fjlg1j9wnhhq2ik5alayhf61adajd8jqmcsqprncnnpsgv"
+        "version": "6.6.15",
+        "hash": "sha256:1ajzby6isqji1xlp660m4qj2i2xs003vsjp1jspziwl7hrzhqadb"
     },
     "6.7": {
-        "version": "6.7.2",
-        "hash": "sha256:0wd6pxh7wy9bzjzwd0rdsdnghpr53qbs722fhg07bi19m8dy8kf3"
+        "version": "6.7.3",
+        "hash": "sha256:0i1bfkawyp917d9v3qa5nqzspzr3ixx7scbfl8x4lms74xjqrw5p"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index aba6462451a9..e4716dfa6d96 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19482";
-    sha256 = "0y9w9jwlhxv88mjr67g64wgypjf3ikc6c5gr8wrvxiawi24kdhca";
+    rev = "19489";
+    sha256 = "1adnk4710iyq87bj48bfxzmzhv5hk0x3fmyz6ydk5af364fl87mk";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index 9b70c577b4e6..bf8148c35c11 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.73-rt22"; # updated by ./update-rt.sh
+  version = "6.1.75-rt23"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "11vyblm4nkjncdi3akcyizw7jkyxsqn2mjixc51f7kgiddq4ibbc";
+    sha256 = "0mis14ll6xmhw71vfpw1aahi5z207qysha7x316fq4qc6c899lbc";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1hl7y2sab21l81nl165b77jhfjhpcc1gvz64fs2yjjp4q2qih4b0";
+      sha256 = "0y88g4acq9vcxb169zficcih1dgq7ssl6v3f9740jr6r4l9ycv1x";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index a1b4e48bb23d..7a3beba7db33 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.7.2"; #zen
+    version = "6.7.3"; #zen
     suffix = "zen1"; #zen
-    sha256 = "0k2hcvq8djjmq4cb1lsaj0rklsbpjbfsg7l3ibj1yz244m05r113"; #zen
+    sha256 = "1qm1vhd1x8gd2klcasp8f0x9hqaci4b5ih1nn9qc7vqash14hxy6"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
     version = "6.7.2"; #lqx
-    suffix = "lqx1"; #lqx
-    sha256 = "0qn401dgcx3488k8kndcyyf5qjwxn7nd7rnyzbm0rkgvvbnzmdv1"; #lqx
+    suffix = "lqx2"; #lqx
+    sha256 = "0w82k39rqps8xwxnp87b16nfh4nmiys8532vrc8akjl1ffj68bqd"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index 518d79b622a6..6724651bbaf7 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -12,7 +12,6 @@
   nix-update-script,
   nixosTests,
   openssl,
-  pam,
   pkg-config,
   systemd,
 }:
@@ -41,7 +40,6 @@ stdenv.mkDerivation rec {
     libseccomp
     libselinux
     openssl
-    pam
     systemd
   ];
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 98ba2ca98e83..01fe26e08bb8 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -61,16 +61,14 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "535.43.23";
+    version = "535.43.24";
     persistencedVersion = "535.98";
     settingsVersion = "535.98";
-    sha256_64bit = "sha256-lnCiXkkRpKBVjvRSnJ5W8k4Mix6qMw1Lo2S0VjdexzI=";
-    openSha256 = "sha256-i74x94a4HCkqIqwInFgqZEFagVlMNZ1/OIztcTR1ReA=";
+    sha256_64bit = "sha256-UbheqrPzSMPFjM3URN/Jr8rpuY12BCFtCvBlxMqXFbo=";
+    openSha256 = "sha256-01UOzUZTCf7pHUc61/qlh98qAiXsYp8Iankev9+wVdI=";
     settingsSha256 = "sha256-jCRfeB1w6/dA27gaz6t5/Qo7On0zbAPIi74LYLel34s=";
     persistencedSha256 = "sha256-WviDU6B50YG8dO64CGvU3xK8WFUX8nvvVYm/fuGyroM=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
-
-    brokenOpen = kernel.kernelAtLeast "6.7";
   };
 
   # data center driver compatible with current default cudaPackages
diff --git a/pkgs/os-specific/linux/zfs/unstable.nix b/pkgs/os-specific/linux/zfs/unstable.nix
index 997cbe18ba7d..691fa523b522 100644
--- a/pkgs/os-specific/linux/zfs/unstable.nix
+++ b/pkgs/os-specific/linux/zfs/unstable.nix
@@ -17,23 +17,24 @@ callPackage ./generic.nix args {
   # check the release notes for compatible kernels
   kernelCompatible =
     if stdenv'.isx86_64 || removeLinuxDRM
-    then kernel.kernelOlder "6.7"
+    then kernel.kernelOlder "6.8"
     else kernel.kernelOlder "6.2";
 
   latestCompatibleLinuxPackages = if stdenv'.isx86_64 || removeLinuxDRM
-    then linuxKernel.packages.linux_6_6
+    then linuxKernel.packages.linux_6_7
     else linuxKernel.packages.linux_6_1;
 
   # this package should point to a version / git revision compatible with the latest kernel release
   # IMPORTANT: Always use a tagged release candidate or commits from the
   # zfs-<version>-staging branch, because this is tested by the OpenZFS
   # maintainers.
-  version = "2.2.2";
+  version = "2.2.3-unstable-2024-01-26";
+  rev = "3425484eb907d489c315cced2a1fdea08ef03fc4";
 
   isUnstable = true;
   tests = [
     nixosTests.zfs.unstable
   ];
 
-  hash = "sha256-CqhETAwhWMhbld5ib3Rz1dxms+GQbLwjEZw/V7U/2nE=";
+  hash = "sha256-P8PIp0qRHm/fxYdxWKVRX9LR5tKZR7fFUSY90QDE/lU=";
 }
diff --git a/pkgs/servers/dex/default.nix b/pkgs/servers/dex/default.nix
index 7db4d836ee1b..16a792f111f0 100644
--- a/pkgs/servers/dex/default.nix
+++ b/pkgs/servers/dex/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests, testers, dex-oidc }:
 
 buildGoModule rec {
   pname = "dex";
@@ -18,7 +18,7 @@ buildGoModule rec {
   ];
 
   ldflags = [
-    "-w" "-s" "-X github.com/dexidp/dex/version.Version=${src.rev}"
+    "-w" "-s" "-X main.version=${src.rev}"
   ];
 
   postInstall = ''
@@ -26,7 +26,14 @@ buildGoModule rec {
     cp -r $src/web $out/share/web
   '';
 
-  passthru.tests = { inherit (nixosTests) dex-oidc; };
+  passthru.tests = {
+    inherit (nixosTests) dex-oidc;
+    version = testers.testVersion {
+      package = dex-oidc;
+      command = "dex version";
+      version = "v${version}";
+    };
+  };
 
   meta = with lib; {
     description = "OpenID Connect and OAuth2 identity provider with pluggable connectors";
diff --git a/pkgs/servers/mastodon/default.nix b/pkgs/servers/mastodon/default.nix
index 25b6fc41a07b..dcd2a6dcae35 100644
--- a/pkgs/servers/mastodon/default.nix
+++ b/pkgs/servers/mastodon/default.nix
@@ -22,18 +22,6 @@ stdenv.mkDerivation rec {
     name = "${pname}-gems-${version}";
     inherit version gemset ruby;
     gemdir = src;
-    # This fix (copied from https://github.com/NixOS/nixpkgs/pull/76765) replaces the gem
-    # symlinks with directories, resolving this error when running rake:
-    #   /nix/store/451rhxkggw53h7253izpbq55nrhs7iv0-mastodon-gems-3.0.1/lib/ruby/gems/2.6.0/gems/bundler-1.17.3/lib/bundler/settings.rb:6:in `<module:Bundler>': uninitialized constant Bundler::Settings (NameError)
-    postBuild = ''
-      for gem in "$out"/lib/ruby/gems/*/gems/*; do
-        cp -a "$gem/" "$gem.new"
-        rm "$gem"
-        # needed on macOS, otherwise the mv yields permission denied
-        chmod +w "$gem.new"
-        mv "$gem.new" "$gem"
-      done
-    '';
   };
 
   mastodonModules = stdenv.mkDerivation {
diff --git a/pkgs/servers/mastodon/source.nix b/pkgs/servers/mastodon/source.nix
index 6ccec387514c..06c07c09df5b 100644
--- a/pkgs/servers/mastodon/source.nix
+++ b/pkgs/servers/mastodon/source.nix
@@ -1,7 +1,7 @@
 # This file was generated by pkgs.mastodon.updateScript.
 { fetchFromGitHub, applyPatches, patches ? [] }:
 let
-  version = "4.2.4";
+  version = "4.2.5";
 in
 (
   applyPatches {
@@ -9,7 +9,7 @@ in
       owner = "mastodon";
       repo = "mastodon";
       rev = "v${version}";
-      hash = "sha256-YPGOe9wywRls26PqEbqFeQRg7rcnRBO2NyiNW1fssts=";
+      hash = "sha256-dgC5V/CVE9F1ORTjPWUWc/JVcWCEj/pb4eWpDV0WliY=";
     };
     patches = patches ++ [];
   }) // {
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 9f542ac98e76..b1ad448f0971 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -17,20 +17,20 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.99.0";
+  version = "1.100.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-NS0in7zUkIS+fI5gQEua9y1UXspEHWNCntyZHZCtfPg=";
+    hash = "sha256-6YK/VV0ELvMJoA5ipmoB4S13HqA0UEOnQ6JbQdlkYWU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-FQhHpbp8Rkkqp6Ngly/HP8iWGlWh5CDaztgAwKB/afI=";
+    hash = "sha256-oXIraayA6Dd8aYirRhM9Av8x7bj+WZI6o7dEr9OCtdk=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/misc/gobgpd/default.nix b/pkgs/servers/misc/gobgpd/default.nix
index 60360d26667a..a7b4b05b57cc 100644
--- a/pkgs/servers/misc/gobgpd/default.nix
+++ b/pkgs/servers/misc/gobgpd/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "gobgpd";
-  version = "3.22.0";
+  version = "3.23.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ItzoknejTtVjm0FD+UdpCa+cL0i2uvcffTNIWCjBdVU=";
+    hash = "sha256-PUwYcwWgaV/DQl565fugppc+I/y7z7Ns3P4SspS88ts=";
   };
 
   vendorHash = "sha256-5eB3vFOo3LCsjMnWYFH0yq5+IunwKXp5C34x6NvpFZ8=";
diff --git a/pkgs/servers/monitoring/grafana-agent/default.nix b/pkgs/servers/monitoring/grafana-agent/default.nix
index 571142c886bd..6ddaf2ba07a2 100644
--- a/pkgs/servers/monitoring/grafana-agent/default.nix
+++ b/pkgs/servers/monitoring/grafana-agent/default.nix
@@ -14,16 +14,16 @@
 
 buildGoModule rec {
   pname = "grafana-agent";
-  version = "0.39.1";
+  version = "0.39.2";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "agent";
     rev = "v${version}";
-    hash = "sha256-GUsLscLbDnHBO+BWiuo/qCxrV+mW5XUlLpqj8iWUxzo=";
+    hash = "sha256-KwXkCTKnoXHL2RFpJjjwtIolEpqCM6te5wMk9xQNOqE=";
   };
 
-  vendorHash = "sha256-lC6ESGT0dheATVDjJZxDP8YU4RtJMEfTJSyETDtGzTc=";
+  vendorHash = "sha256-aSHO5SoMem14Fc6DirqtYBVWJQtf5mzCT3T33mMyhkc=";
   proxyVendor = true; # darwin/linux hash mismatch
 
   frontendYarnOfflineCache = fetchYarnDeps {
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 9aa14c96a239..b7c8cb2fcb9e 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.29.3";
+  version = "1.29.4";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -16,10 +16,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-nYD3Mq3G1FpTs/Fmk9dcSYi9oHt3OhDPfQ7dgU9Yc7w=";
+    hash = "sha256-XhGP5q0LbXaTgClZvRFV1Zjpi1mizoyFrzI7vobVaUo=";
   };
 
-  vendorHash = "sha256-dhP0eOf6JP/kbJV09kM4kwKl9jv3wC7AI1bEKyJUcso=";
+  vendorHash = "sha256-DdE2r0M9/6aaq5c3m0AT82TNyIP2vBsaFCRP2um0hao=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index b0c211b3039d..63f7162fc5d6 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -55,8 +55,8 @@ in {
   };
 
   nextcloud28 = generic {
-    version = "28.0.1";
-    hash = "sha256-L4BzW0Qwgicv5qO14yE3lX8fxEjHU0K5S1IAspcl86Q=";
+    version = "28.0.2";
+    hash = "sha256-3jTWuvPszqz90TjoVSDNheHSzmeY2f+keKwX6x76HQg=";
     packages = nextcloud28Packages;
   };
 
diff --git a/pkgs/servers/nosql/aerospike/default.nix b/pkgs/servers/nosql/aerospike/default.nix
index 9c0d034d7b3a..301cb7de1aac 100644
--- a/pkgs/servers/nosql/aerospike/default.nix
+++ b/pkgs/servers/nosql/aerospike/default.nix
@@ -1,32 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, openssl, zlib }:
+{ lib, stdenv, fetchFromGitHub, autoconf, automake, cmake, libtool, openssl, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "aerospike-server";
-  version = "4.2.0.4";
+  version = "7.0.0.3";
 
   src = fetchFromGitHub {
     owner = "aerospike";
     repo = "aerospike-server";
     rev = version;
-    sha256 = "1vqi3xir4l57v62q1ns3713vajxffs6crss8fpvbcs57p7ygx3s7";
+    hash = "sha256-qyVfoOnWIUY1np58HtpVrKNsgiXlvdgffyMGjk+G5qI=";
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ autoconf automake libtool ];
+  nativeBuildInputs = [ autoconf automake cmake libtool ];
   buildInputs = [ openssl zlib ];
 
+  dontUseCmakeConfigure = true;
+
   preBuild = ''
     patchShebangs build/gen_version
     substituteInPlace build/gen_version --replace 'git describe' 'echo ${version}'
-
-    # drop blanket -Werror
-    substituteInPlace make_in/Makefile.in --replace '-Werror' ""
   '';
 
   installPhase = ''
-    mkdir -p $out/bin $out/share/udf
-    cp      target/Linux-x86_64/bin/asd $out/bin/asd
-    cp -dpR modules/lua-core/src        $out/share/udf/lua
+    mkdir -p $out/bin
+    cp target/Linux-x86_64/bin/asd $out/bin/asd
   '';
 
   meta = with lib; {
@@ -35,6 +33,5 @@ stdenv.mkDerivation rec {
     license = licenses.agpl3;
     platforms = [ "x86_64-linux" ];
     maintainers = with maintainers; [ kalbasit ];
-    knownVulnerabilities = [ "CVE-2020-13151" ];
   };
 }
diff --git a/pkgs/servers/sabnzbd/default.nix b/pkgs/servers/sabnzbd/default.nix
index 5601ae2f7d0f..a7035426fdf9 100644
--- a/pkgs/servers/sabnzbd/default.nix
+++ b/pkgs/servers/sabnzbd/default.nix
@@ -47,14 +47,14 @@ let
   ]);
   path = lib.makeBinPath [ coreutils par2cmdline-turbo unrar unzip p7zip util-linux ];
 in stdenv.mkDerivation rec {
-  version = "4.2.1";
+  version = "4.2.2";
   pname = "sabnzbd";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-M9DvwizNeCXkV07dkgiComdjoceUACCuccZb+y9RMdw=";
+    sha256 = "sha256-e5MjsBFUeQ1FMgMIuTDAmAUqf9BaM+ic2qpd1GVZEAw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/search/meilisearch/Cargo.lock b/pkgs/servers/search/meilisearch/Cargo.lock
index 72701288f8b3..acbeed1c710f 100644
--- a/pkgs/servers/search/meilisearch/Cargo.lock
+++ b/pkgs/servers/search/meilisearch/Cargo.lock
@@ -491,7 +491,7 @@ checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
 
 [[package]]
 name = "benchmarks"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "anyhow",
  "bytes",
@@ -1402,7 +1402,7 @@ dependencies = [
 
 [[package]]
 name = "dump"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "anyhow",
  "big_s",
@@ -1634,7 +1634,7 @@ dependencies = [
 
 [[package]]
 name = "file-store"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "faux",
  "tempfile",
@@ -1656,7 +1656,7 @@ dependencies = [
 
 [[package]]
 name = "filter-parser"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "insta",
  "nom",
@@ -1687,7 +1687,7 @@ dependencies = [
 
 [[package]]
 name = "flatten-serde-json"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "criterion",
  "serde_json",
@@ -1805,7 +1805,7 @@ dependencies = [
 
 [[package]]
 name = "fuzzers"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "arbitrary",
  "clap",
@@ -2763,7 +2763,7 @@ dependencies = [
 
 [[package]]
 name = "index-scheduler"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "anyhow",
  "big_s",
@@ -2960,7 +2960,7 @@ dependencies = [
 
 [[package]]
 name = "json-depth-checker"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "criterion",
  "serde_json",
@@ -3472,7 +3472,7 @@ checksum = "490cc448043f947bae3cbee9c203358d62dbee0db12107a74be5c30ccfd09771"
 
 [[package]]
 name = "meili-snap"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "insta",
  "md5",
@@ -3481,7 +3481,7 @@ dependencies = [
 
 [[package]]
 name = "meilisearch"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "actix-cors",
  "actix-http",
@@ -3572,7 +3572,7 @@ dependencies = [
 
 [[package]]
 name = "meilisearch-auth"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "base64 0.21.5",
  "enum-iterator",
@@ -3591,7 +3591,7 @@ dependencies = [
 
 [[package]]
 name = "meilisearch-types"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "actix-web",
  "anyhow",
@@ -3621,7 +3621,7 @@ dependencies = [
 
 [[package]]
 name = "meilitool"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "anyhow",
  "clap",
@@ -3669,7 +3669,7 @@ dependencies = [
 
 [[package]]
 name = "milli"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "arroy",
  "big_s",
@@ -4076,7 +4076,7 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "permissive-json-pointer"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
  "big_s",
  "serde_json",
diff --git a/pkgs/servers/search/meilisearch/default.nix b/pkgs/servers/search/meilisearch/default.nix
index 262a5e9e63e0..45059659b97d 100644
--- a/pkgs/servers/search/meilisearch/default.nix
+++ b/pkgs/servers/search/meilisearch/default.nix
@@ -8,7 +8,7 @@
 , nix-update-script
 }:
 
-let version = "1.6.0";
+let version = "1.6.1";
 in
 rustPlatform.buildRustPackage {
   pname = "meilisearch";
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage {
     owner = "meilisearch";
     repo = "MeiliSearch";
     rev = "refs/tags/v${version}";
-    hash = "sha256-B1psJeGWG0E5oPu+OVAxkdJNblqaBzB/CurpLxdESB8=";
+    hash = "sha256-bA0UWRX16HTB/XCuzRa1C71DxfMJx1fZ/xVZFkxq1SM=";
   };
 
   cargoBuildFlags = [
diff --git a/pkgs/servers/snac2/default.nix b/pkgs/servers/snac2/default.nix
index d0d8e3434722..0d3d17ad7c32 100644
--- a/pkgs/servers/snac2/default.nix
+++ b/pkgs/servers/snac2/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "snac2";
-  version = "2.45";
+  version = "2.46";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "grunfink";
     repo = pname;
     rev = version;
-    hash = "sha256-zSmzG/Ws7/6rXBNqAtKqnWcsPA9jy/TidXlklwGhArc=";
+    hash = "sha256-t2o1aNgVl5dKmwOO9W7mn2uIf/rrbag476y3H3ugCfc=";
   };
 
   buildInputs = [ curl openssl ];
diff --git a/pkgs/servers/sql/mariadb/galera/default.nix b/pkgs/servers/sql/mariadb/galera/default.nix
index 720bb050be25..f934d6a00822 100644
--- a/pkgs/servers/sql/mariadb/galera/default.nix
+++ b/pkgs/servers/sql/mariadb/galera/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mariadb-galera";
-  version = "26.4.16";
+  version = "26.4.17";
 
   src = fetchFromGitHub {
     owner = "codership";
     repo = "galera";
     rev = "release_${version}";
-    hash = "sha256-bRkXux4vpnUGRYO4dYD6IuWsbMglsMf17tBw6qpvbDg=";
+    hash = "sha256-XcaHg0mqCGqP7VYb4jLSxuNxmBXJv2ivA/1spMyT4Tg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/servers/xmpp/prosody/default.nix b/pkgs/servers/xmpp/prosody/default.nix
index dc9df3e18898..2f237c1f2277 100644
--- a/pkgs/servers/xmpp/prosody/default.nix
+++ b/pkgs/servers/xmpp/prosody/default.nix
@@ -40,8 +40,8 @@ stdenv.mkDerivation rec {
   # version.
   communityModules = fetchhg {
     url = "https://hg.prosody.im/prosody-modules";
-    rev = "7c105277a9ca";
-    sha256 = "eiObn5Kw7dS+oxdQiJ8NhSC4P7EvILIOEnMoxCWIFro=";
+    rev = "b109773ce6fe";
+    hash = "sha256-N1vmShDWtWsHD4b1x7UjX6Sj28iPaDeCLSYeDOLLhzo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -84,6 +84,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     homepage = "https://prosody.im";
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ toastal ];
   };
 }
diff --git a/pkgs/shells/zsh/zinit/default.nix b/pkgs/shells/zsh/zinit/default.nix
index 7b41d8505c21..c226b5565451 100644
--- a/pkgs/shells/zsh/zinit/default.nix
+++ b/pkgs/shells/zsh/zinit/default.nix
@@ -2,12 +2,12 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "zinit";
-  version = "3.12.1";
+  version = "3.13.1";
   src = fetchFromGitHub {
     owner = "zdharma-continuum";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-REd997dop9gAosG4QkEKIc3jYIRLeB3MYBPiYMlDGUs=";
+    hash = "sha256-fnBV0LmC/wJm0pOITJ1mhiBqsg2F8AQJWvn0p/Bgo5Q=";
   };
   # adapted from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=zsh-zplugin-git
   dontBuild = true;
diff --git a/pkgs/shells/zsh/zsh-forgit/default.nix b/pkgs/shells/zsh/zsh-forgit/default.nix
index 9ec4277857b1..28847369a9c8 100644
--- a/pkgs/shells/zsh/zsh-forgit/default.nix
+++ b/pkgs/shells/zsh/zsh-forgit/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zsh-forgit";
-  version = "24.01.0";
+  version = "24.02.0";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = "forgit";
     rev = version;
-    sha256 = "sha256-WHhyllOr/PgR+vlrfMQs/3/d3xpmDylT6BlLCu50a2g=";
+    sha256 = "sha256-DoOtrnEJwSxkCZtsVek+3w9RZH7j7LTvdleBC88xyfI=";
   };
 
   strictDeps = true;
diff --git a/pkgs/shells/zsh/zsh-fzf-tab/default.nix b/pkgs/shells/zsh/zsh-fzf-tab/default.nix
index ea8f37cb1c34..89e4fe783b93 100644
--- a/pkgs/shells/zsh/zsh-fzf-tab/default.nix
+++ b/pkgs/shells/zsh/zsh-fzf-tab/default.nix
@@ -4,13 +4,13 @@ let
   INSTALL_PATH="${placeholder "out"}/share/fzf-tab";
 in stdenv.mkDerivation rec {
   pname = "zsh-fzf-tab";
-  version = "unstable-2023-06-11";
+  version = "unstable-2024-02-01";
 
   src = fetchFromGitHub {
     owner = "Aloxaf";
     repo = "fzf-tab";
-    rev = "c2b4aa5ad2532cca91f23908ac7f00efb7ff09c9";
-    hash = "sha256-gvZp8P3quOtcy1Xtt1LAW1cfZ/zCtnAmnWqcwrKel6w=";
+    rev = "b06e7574577cd729c629419a62029d31d0565a7a";
+    hash = "sha256-ilUavAIWmLiMh2PumtErMCpOcR71ZMlQkKhVOTDdHZw=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/admin/fits-cloudctl/default.nix b/pkgs/tools/admin/fits-cloudctl/default.nix
index 3c2a524c004d..c6aa0a2a7080 100644
--- a/pkgs/tools/admin/fits-cloudctl/default.nix
+++ b/pkgs/tools/admin/fits-cloudctl/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "fits-cloudctl";
-  version = "0.12.12";
+  version = "0.12.13";
 
   src = fetchFromGitHub {
     owner = "fi-ts";
     repo = "cloudctl";
     rev = "v${version}";
-    sha256 = "sha256-jNs1I6aVmyHbVghO30r6+gVg0vVLqHpddX1KVX1Xh+s=";
+    sha256 = "sha256-Vb7jBgk052WBnlUgS5lVooi/bY49rRqCWbOO4cPkPx4=";
   };
 
   vendorHash = "sha256-NR5Jw4zCYRg6xc9priCVNH+9wOVWx3bmstc3nkQDmv8=";
diff --git a/pkgs/tools/admin/salt/default.nix b/pkgs/tools/admin/salt/default.nix
index 2c2d9f840180..a08e4c5a812a 100644
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@@ -11,12 +11,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "salt";
-  version = "3006.5";
+  version = "3006.6";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-b5aH8lQt3ICEsXy0fwpMr9SJQBI7o+1XMfaqgf5/lz4=";
+    hash = "sha256-X6tojYa3Dh6ExRtMqlZfNnGVBQaBPDcp1EQIzC9a+8M=";
   };
 
   patches = [
diff --git a/pkgs/tools/admin/simplotask/default.nix b/pkgs/tools/admin/simplotask/default.nix
index f8a4e4462c16..dfceed6a3849 100644
--- a/pkgs/tools/admin/simplotask/default.nix
+++ b/pkgs/tools/admin/simplotask/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "simplotask";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "umputun";
     repo = "spot";
     rev = "v${version}";
-    hash = "sha256-bbn6RLkAAlQeHsaMmb34FFrhaYvouf8rSOJpGdYE7Y4=";
+    hash = "sha256-jyAUovPIWIB4x5IEHyRY9iVmgtjR++0dew6B2dnGI8U=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index c3a8a71947af..9f077c1fd853 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -10,19 +10,19 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.48.3";
+  version = "0.49.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-zWv/4dDzWfR9qbbBaMaHFMId1OVhcOja7lTy3gcm77w=";
+    hash = "sha256-Kx+84kI/8KOOz2p7xGvjOSyMa1Co9u5c0lWOtfi8SVE=";
   };
 
   # Hash mismatch on across Linux and Darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-EOu4VHfrQbIP1vSWF3UkZDMyEIcbjQKjzdch9c6cVg4=";
+  vendorHash = "sha256-Ldv71C4d9/IO1u+eDKKTHc0pjY8lfnIjQZ57IMWv7Qk=";
 
   subPackages = [ "cmd/trivy" ];
 
diff --git a/pkgs/tools/inputmethods/remote-touchpad/default.nix b/pkgs/tools/inputmethods/remote-touchpad/default.nix
index 9d213ca51df2..aef0afc576ab 100644
--- a/pkgs/tools/inputmethods/remote-touchpad/default.nix
+++ b/pkgs/tools/inputmethods/remote-touchpad/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "remote-touchpad";
-  version = "1.4.4";
+  version = "1.4.5";
 
   src = fetchFromGitHub {
     owner = "unrud";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-E2Pa5fhE2AiN2GE7k80nWcrXxHBDvkQtZV43DKhaCGU=";
+    sha256 = "sha256-usJAiGjUGGO4Gb9LMGWR6mG3r8C++llteqn5WpwqqFk=";
   };
 
   buildInputs = [ libXi libXrandr libXt libXtst ];
diff --git a/pkgs/tools/misc/dooit/default.nix b/pkgs/tools/misc/dooit/default.nix
index 7e251e2f339e..1621ea8e5249 100644
--- a/pkgs/tools/misc/dooit/default.nix
+++ b/pkgs/tools/misc/dooit/default.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dooit";
-  version = "2.1.1";
+  version = "2.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kraanzu";
     repo = "dooit";
     rev = "v${version}";
-    hash = "sha256-YfWfh8oDZSG1DdAV+hzchqyNSSqyeNR5SSEa9B5yGY8=";
+    hash = "sha256-GtXRzj+o+FClleh73kqelk0JrSyafZhf847lX1BiS9k=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/misc/fedifetcher/default.nix b/pkgs/tools/misc/fedifetcher/default.nix
index 3a1192d698c1..dbf8c3bce281 100644
--- a/pkgs/tools/misc/fedifetcher/default.nix
+++ b/pkgs/tools/misc/fedifetcher/default.nix
@@ -2,14 +2,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fedifetcher";
-  version = "7.0.1";
+  version = "7.0.3";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "nanos";
     repo = "FediFetcher";
     rev = "v${version}";
-    hash = "sha256-/Au6a93na3meb2j0eR8UCCg+TVW/UqWz3/TkASB94Eg=";
+    hash = "sha256-ADf6ZVqO9v6GQbNWi3NDX5bNmFDX5LMJfM6ePEWwbrQ=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index e3c3a6963bd1..a64246693ee1 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -24,16 +24,16 @@ let
 in
 buildGoModule rec {
   pname = "fzf";
-  version = "0.46.0";
+  version = "0.46.1";
 
   src = fetchFromGitHub {
     owner = "junegunn";
     repo = pname;
     rev = version;
-    hash = "sha256-Lcqe1eVQXOLJWsxsUK0dzZHAA3c1Wps07HFvlaflN5Q=";
+    hash = "sha256-gMSelLwIIYv/vkbdWi4Cw3FEy4lbC8P/5+T+c/e66+c=";
   };
 
-  vendorHash = "sha256-3InzP299GJUizNWyPNpg9+pGA88ggnky56bGV5E+7ck=";
+  vendorHash = "sha256-8ojmIETUyZ3jDhrqkHYnxptRG8vdj0GADYvEpw0wi6w=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/tools/misc/mise/default.nix b/pkgs/tools/misc/mise/default.nix
index 12acc61f9e24..9c0fec19d647 100644
--- a/pkgs/tools/misc/mise/default.nix
+++ b/pkgs/tools/misc/mise/default.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2024.1.30";
+  version = "2024.1.35";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-1MvnxH+6xN7uQAhf2OEO+OjBISUSiTrYtfdulSe8Cxg=";
+    hash = "sha256-U5L66cZXgvKLQKTYIAKWcYVs5IV4OKegKxYvLr83g8k=";
   };
 
-  cargoHash = "sha256-Hm8cpj0tk5bQ4NBHPGf6Fwpwq6zGJEwfE6psDkenxCQ=";
+  cargoHash = "sha256-Hn6uDDA/RJ9d5s3bLsR90Gd8mahYwnBmkkJ3ToGwpyM=";
 
   nativeBuildInputs = [ installShellFiles pkg-config ];
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
diff --git a/pkgs/tools/misc/mutagen-compose/default.nix b/pkgs/tools/misc/mutagen-compose/default.nix
index a9ecae787b95..fe8f2b06505d 100644
--- a/pkgs/tools/misc/mutagen-compose/default.nix
+++ b/pkgs/tools/misc/mutagen-compose/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mutagen-compose";
-  version = "0.17.4";
+  version = "0.17.5";
 
   src = fetchFromGitHub {
     owner = "mutagen-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-arvDV1AlhrXfndoXGd7jn6O9ZAc1+7hq30QpYPLhpJw=";
+    hash = "sha256-EkUaxk+zCm1ta1/vjClZHki/MghLvUkCeiW7hST7WEc=";
   };
 
-  vendorHash = "sha256-wqenEPTRsZvQscXv+/eVEFVk8Fd1/Aj3QcBSZzpkmGA=";
+  vendorHash = "sha256-siLS53YVQfCwqyuvXXvHFtlpr3RQy2GP2/ZV+Tv/Lqc=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/panoply/default.nix b/pkgs/tools/misc/panoply/default.nix
index f3b134f95bef..d0c86c1275f5 100644
--- a/pkgs/tools/misc/panoply/default.nix
+++ b/pkgs/tools/misc/panoply/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "panoply";
-  version = "5.3.1";
+  version = "5.3.2";
 
   src = fetchurl {
     url = "https://www.giss.nasa.gov/tools/panoply/download/PanoplyJ-${version}.tgz";
-    sha256 = "sha256-Fz1IFZwr7Eqqypt50n3qaoRjwfvSoS3kbMhbgzbc1J4=";
+    sha256 = "sha256-+B/k3MqoefD3AVSYuR006eYyNe+njsfiqwBtQ+1YIHA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/yubico-piv-tool/default.nix b/pkgs/tools/misc/yubico-piv-tool/default.nix
index 26288e760ee6..002dbed4fcd6 100644
--- a/pkgs/tools/misc/yubico-piv-tool/default.nix
+++ b/pkgs/tools/misc/yubico-piv-tool/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yubico-piv-tool";
-  version = "2.4.2";
+  version = "2.5.0";
 
   outputs = [ "out" "dev" "man" ];
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Yubico";
     repo = "yubico-piv-tool";
     rev = "refs/tags/yubico-piv-tool-${finalAttrs.version}";
-    hash = "sha256-viTPLg5vakDQEs8ggQro10nNMbQC4CSKEE34d/Ba/V8=";
+    hash = "sha256-KSM/p6PMzgpVtXIR9GjGiP/UqXhbc1xSQ71elbE4JQE=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/gobgp/default.nix b/pkgs/tools/networking/gobgp/default.nix
index c928df2a4bc9..8304f15ba960 100644
--- a/pkgs/tools/networking/gobgp/default.nix
+++ b/pkgs/tools/networking/gobgp/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gobgp";
-  version = "3.22.0";
+  version = "3.23.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${version}";
-    sha256 = "sha256-ItzoknejTtVjm0FD+UdpCa+cL0i2uvcffTNIWCjBdVU=";
+    sha256 = "sha256-PUwYcwWgaV/DQl565fugppc+I/y7z7Ns3P4SspS88ts=";
   };
 
   vendorHash = "sha256-5eB3vFOo3LCsjMnWYFH0yq5+IunwKXp5C34x6NvpFZ8=";
diff --git a/pkgs/tools/networking/grpc_cli/default.nix b/pkgs/tools/networking/grpc_cli/default.nix
index 9ef1d801357f..844d315f5eb5 100644
--- a/pkgs/tools/networking/grpc_cli/default.nix
+++ b/pkgs/tools/networking/grpc_cli/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "grpc_cli";
-  version = "1.60.0";
+  version = "1.61.0";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    hash = "sha256-0mn+nQAgaurd1WomzcLUAYwp88l26qGkP+cP1SSYxsE=";
+    hash = "sha256-NLxcGFQ1F5RLoSFC0XYMjvGXkSWc/vLzgtk5qsOndEo=";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [ automake cmake autoconf ];
diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index 579124a5c90e..ce275eca6783 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -29,11 +29,11 @@ let
   sslPkg = sslPkgs.${sslLibrary};
 in stdenv.mkDerivation (finalAttrs: {
   pname = "haproxy";
-  version = "2.9.3";
+  version = "2.9.4";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
-    hash = "sha256-7VF8ZavYaUVBH2vLGMfsZXpwaTHLeB6igwY7oKdYWMA=";
+    hash = "sha256-nDiSzDwISsTwASXvIqFRzxgUFthKqKN69q9qoDmQlrw=";
   };
 
   buildInputs = [ sslPkg zlib libxcrypt ]
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index dea290a3b49c..a2e53bb79890 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2024-01-18T07-03-39Z";
+  version = "2024-01-28T16-23-14Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-qmJzyiqiW+gGtdZsGKh6774IVLoFu443xnqwCb61hU0=";
+    sha256 = "sha256-1FV7o4kkFEbcEmkV3Kj37vQ6uKZ/GoSnuCp3NNxMGN8=";
   };
 
-  vendorHash = "sha256-rqlPUU9phbsw9cjGvU86DjA3cWhcoxX3kxQ1buLM+hg=";
+  vendorHash = "sha256-wxFhj+oqj5WV/UkPZlmeJHF2WC4oLlZOql1qgSFs+zU=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/networking/nbd/default.nix b/pkgs/tools/networking/nbd/default.nix
index c7cb5632dfe4..ebef277feb21 100644
--- a/pkgs/tools/networking/nbd/default.nix
+++ b/pkgs/tools/networking/nbd/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , glib
 , which
@@ -20,6 +21,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-9cj9D8tXsckmWU0OV/NWQy7ghni+8dQNCI8IMPDL3Qo=";
   };
 
+  patches = [
+    # fix port setting from nbdtab
+    # https://github.com/NetworkBlockDevice/nbd/pull/154
+    (fetchpatch {
+      url = "https://github.com/NetworkBlockDevice/nbd/commit/915444bc0b8a931d32dfb755542f4bd1d37f1449.patch";
+      hash = "sha256-6z+c2cXhY92WPDqRO6AJ5BBf1N38yTgOE1foduIr5Dg=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     which
@@ -38,6 +48,9 @@ stdenv.mkDerivation rec {
     "--sysconfdir=/etc"
   ];
 
+  # ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=implicit-function-declaration";
+
   doCheck = !stdenv.isDarwin;
 
   passthru.tests = {
diff --git a/pkgs/tools/package-management/emplace/default.nix b/pkgs/tools/package-management/emplace/default.nix
index 0a2656e12932..4b440def96c5 100644
--- a/pkgs/tools/package-management/emplace/default.nix
+++ b/pkgs/tools/package-management/emplace/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "emplace";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "tversteeg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5PuSIOXns0FVLgyIw1mk8hZ/tYhikMV860BHTDlji78=";
+    sha256 = "sha256-4huLO2CGKDRjphtAYbcPFLM1bYIppoqZgtxkOoT1JOs=";
   };
 
-  cargoSha256 = "sha256-UbbVjT5JQuVSCgbcelEVaAql4CUnCtO99zHp3Ei31Gs=";
+  cargoHash = "sha256-/q8I1XG96t6296UAvhTOYtWVtJFYX5iIaLya5nfqM/g=";
 
   meta = with lib; {
     description = "Mirror installed software on multiple machines";
diff --git a/pkgs/tools/package-management/nfpm/default.nix b/pkgs/tools/package-management/nfpm/default.nix
index 12facbb5fdba..e37393e41b85 100644
--- a/pkgs/tools/package-management/nfpm/default.nix
+++ b/pkgs/tools/package-management/nfpm/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "nfpm";
-  version = "2.35.2";
+  version = "2.35.3";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ic6SOgIE+g7ccvg163xCwTmz960mWYcxN8ghEdB11To=";
+    hash = "sha256-QoZiI9rMOdQZbMENVcBfUYPAvN9IqfeR0EK11l8+Hzo=";
   };
 
-  vendorHash = "sha256-rIgEctBGff5/pzbPPaDgqZCwmIVDjF98wmLBD17KXTM=";
+  vendorHash = "sha256-WYuhHLq0/OD/JtOEkZsyPEJyjPqEoh9RSfBG0G3E/2w=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/tools/package-management/pdm/default.nix b/pkgs/tools/package-management/pdm/default.nix
index 7395bffd8458..d94aaeae69d9 100644
--- a/pkgs/tools/package-management/pdm/default.nix
+++ b/pkgs/tools/package-management/pdm/default.nix
@@ -32,14 +32,14 @@ in
 with python.pkgs;
 buildPythonApplication rec {
   pname = "pdm";
-  version = "2.12.2";
+  version = "2.12.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-s8pKsQetZbV/4TEuQ2Dh97PXxe2BqEG27Uizd3hi7Vc=";
+    hash = "sha256-U82rcnwUaf3Blu/Y1/+EBKPKke5DwKVxRzbyAg0KXd8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/cosign/default.nix b/pkgs/tools/security/cosign/default.nix
index 0cdf5b0839ea..072b8e4ffb52 100644
--- a/pkgs/tools/security/cosign/default.nix
+++ b/pkgs/tools/security/cosign/default.nix
@@ -13,13 +13,13 @@
 }:
 buildGoModule rec {
   pname = "cosign";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-QZWF0ysZFu3rt8dIXb5uddyDhT2FfWUyder8YR2BtQc=";
+    hash = "sha256-+y79Uml1TvKypbwcWkZZF415qUPPfieP5pKHO+APjPE=";
   };
 
   buildInputs =
@@ -28,7 +28,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
 
-  vendorHash = "sha256-WeNRg3Nw2b6NiV8z7tGZIlWUHZxXuTG7MPF9DgfdmUQ=";
+  vendorHash = "sha256-udMnSdXBjlDQlQRzhhLBDBcHwREkEev0uLIVjT8BbuU=";
 
   subPackages = [
     "cmd/cosign"
diff --git a/pkgs/tools/security/deepsecrets/default.nix b/pkgs/tools/security/deepsecrets/default.nix
index 09c8aac926b8..c509311f3a6d 100644
--- a/pkgs/tools/security/deepsecrets/default.nix
+++ b/pkgs/tools/security/deepsecrets/default.nix
@@ -6,7 +6,7 @@
 python3.pkgs.buildPythonApplication rec {
   pname = "deepsecrets";
   version = "1.0.6";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "avito-tech";
@@ -17,9 +17,9 @@ python3.pkgs.buildPythonApplication rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace 'pyyaml = "^5.4.1"' 'pyyaml = "*"' \
-      --replace 'regex = "^2023.3.23"' 'regex = "*"' \
-      --replace 'mmh3 = "^3.0.0"' 'mmh3 = "*"'
+      --replace-warn 'pyyaml = "^5.4.1"' 'pyyaml = "*"' \
+      --replace-warn 'regex = "^2023.3.23"' 'regex = "*"' \
+      --replace-warn 'mmh3 = "^3.0.0"' 'mmh3 = "*"'
   '';
 
   nativeBuildInputs = with python3.pkgs; [
@@ -30,7 +30,7 @@ python3.pkgs.buildPythonApplication rec {
     dotwiz
     mmh3
     ordered-set
-    pydantic
+    pydantic_1
     pygments
     pyyaml
     regex
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index f83a446e87b5..27d6ce498439 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2024-01-30";
+  version = "2024-02-01";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-QZn4ARk1Z1GMRAGsGd6xyVxYReJWCnNRvL67i+kNAWo=";
+    hash = "sha256-Ypl2OdyOLKGISQZ0A6jM3uwUBGGzHjuwOL7RHQynTow=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/gotestwaf/default.nix b/pkgs/tools/security/gotestwaf/default.nix
index 9f0906f4c8f1..8ed30a7fc78b 100644
--- a/pkgs/tools/security/gotestwaf/default.nix
+++ b/pkgs/tools/security/gotestwaf/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gotestwaf";
-  version = "0.4.10";
+  version = "0.4.11";
 
   src = fetchFromGitHub {
     owner = "wallarm";
     repo = "gotestwaf";
     rev = "refs/tags/v${version}";
-    hash = "sha256-G/1X7kq5n04dYoluvlIswOCE/BvhgZwyXCbPrKIE/SY=";
+    hash = "sha256-xvlzSBvOM09b/m4gI1sbIpIlFJnXQL0G4xet/AL3Yxo=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/security/grype/default.nix b/pkgs/tools/security/grype/default.nix
index 02f796961a09..dc48dd521506 100644
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.74.3";
+  version = "0.74.4";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-p9gyVn3VU30TGqMWCY9OZ7Tcm5JML37oKozLdiW1Tl4=";
+    hash = "sha256-jBBiwsmQDbzay2C6uLM2uzPvTbD+3t8+jyBkEfHwohQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildGoModule rec {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-6ZNRAiSWo6RM8SO1Fq+rKzrRf+vNVNZElRVGfkZljPc=";
+  vendorHash = "sha256-w0dqgyJvn7UZYoUII9jxTuiBOq+HENaQlxfP+rZdpS0=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/security/kube-bench/default.nix b/pkgs/tools/security/kube-bench/default.nix
index f4cb389eb16e..28b90f3d4bae 100644
--- a/pkgs/tools/security/kube-bench/default.nix
+++ b/pkgs/tools/security/kube-bench/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kube-bench";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-yJJEWxz8EWdLi2rhw42QVdG9AcGO0OWnihg153hALNE=";
+    hash = "sha256-EsUjGc7IIu5PK9KaODlQSfmm8jpjuBXvGZPNjSc1824=";
   };
 
-  vendorHash = "sha256-zKw6d3UWs2kb+DCXmLZ09Lw3m8wMhm9QJYkeXJYcFA8=";
+  vendorHash = "sha256-i4k7eworPUvLUustr5U53qizHqUVw8yqGjdPQT6UIf4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index f263ebcc364e..d8d2fb0ccf23 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "1.0.146";
+  version = "1.0.147";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9cAlpLlYnDa0LiikPLPrc///6UZH+NVah+HLDVHoyTs=";
+    sha256 = "sha256-4+Sad0Z1JbkUJWyszo0cK3xTR8HLuR3i74ljWXxPqPw=";
   };
 
-  cargoHash = "sha256-mZf5BBOlqXeC0nb/nTgtHN3ZxNnCuFLr/oMhwOLpbC8=";
+  cargoHash = "sha256-humC32QujjmcSvRioGAciNFCJXwoepAgO9zDGfdUheY=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/tools/system/zram-generator/Cargo.lock b/pkgs/tools/system/zram-generator/Cargo.lock
index 7ce1050dfbdd..a9f1a95f44b0 100644
--- a/pkgs/tools/system/zram-generator/Cargo.lock
+++ b/pkgs/tools/system/zram-generator/Cargo.lock
@@ -127,9 +127,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.152"
+version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
 
 [[package]]
 name = "liboverdrop"
diff --git a/pkgs/tools/text/nltk_data/default.nix b/pkgs/tools/text/nltk_data/default.nix
index 118598083d5d..6445dd8c06e2 100644
--- a/pkgs/tools/text/nltk_data/default.nix
+++ b/pkgs/tools/text/nltk_data/default.nix
@@ -48,6 +48,11 @@ lib.makeScope newScope (self: {
     location = "taggers";
     hash = "sha256-ilTs4HWPUoHxQb4kWEy3wJ6QsE/98+EQya44gtV2inw=";
   });
+  snowball_data = makeNltkDataPackage ({
+    pname = "snowball_data";
+    location = "stemmers";
+    hash = "sha256-Y6LERPtaRbCtWmJCvMAd2xH02xdrevZBFNYvP9N4+3s=";
+  });
   stopwords = makeNltkDataPackage ({
     pname = "stopwords";
     location = "corpora";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 939cd46822ed..e241c19a712f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3363,6 +3363,8 @@ with pkgs;
 
   authelia = callPackage ../servers/authelia { };
 
+  authentik-outposts = recurseIntoAttrs (callPackages ../by-name/au/authentik/outposts.nix { });
+
   autoflake = with python3.pkgs; toPythonApplication autoflake;
 
   autospotting = callPackage ../applications/misc/autospotting { };
@@ -27450,8 +27452,6 @@ with pkgs;
 
   yaws = callPackage ../servers/http/yaws { };
 
-  youtrack = callPackage ../servers/jetbrains/youtrack.nix { };
-
   zabbixFor = version: rec {
     agent = (callPackages ../servers/monitoring/zabbix/agent.nix {}).${version};
     proxy-mysql = (callPackages ../servers/monitoring/zabbix/proxy.nix { mysqlSupport = true; }).${version};
@@ -30803,7 +30803,7 @@ with pkgs;
 
   clapper = callPackage ../applications/video/clapper { };
 
-  claws-mail = disable-warnings-if-gcc13 (callPackage ../applications/networking/mailreaders/claws-mail { });
+  claws-mail = callPackage ../applications/networking/mailreaders/claws-mail { };
 
   cligh = python3Packages.callPackage ../development/tools/github/cligh { };
 
@@ -34321,9 +34321,9 @@ with pkgs;
 
   openbrf = libsForQt5.callPackage ../applications/misc/openbrf { };
 
-  opencpn = darwin.apple_sdk_11_0.callPackage ../applications/misc/opencpn {
+  opencpn = callPackage ../applications/misc/opencpn {
     inherit (darwin) DarwinTools;
-    inherit (darwin.apple_sdk_11_0.frameworks) AppKit;
+    inherit (darwin.apple_sdk.frameworks) AppKit;
   };
 
   openfx = callPackage ../development/libraries/openfx { };
@@ -35315,7 +35315,9 @@ with pkgs;
 
   printrun = callPackage ../applications/misc/printrun { };
 
-  prusa-slicer = darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer { };
+  prusa-slicer = darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer {
+    stdenv = if stdenv.isDarwin then overrideLibcxx darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv;
+  };
 
   super-slicer = darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer/super-slicer.nix { };
 
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index fed85970d9bb..4a79bee73fdf 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -125,6 +125,7 @@ let
       vcfloat = callPackage ../development/coq-modules/vcfloat {};
       Velisarios = callPackage ../development/coq-modules/Velisarios {};
       Verdi = callPackage ../development/coq-modules/Verdi {};
+      vscoq-language-server = callPackage ../development/coq-modules/vscoq-language-server {};
       VST = callPackage ../development/coq-modules/VST ((lib.optionalAttrs
         (lib.versionAtLeast self.coq.version "8.14") {
           compcert = self.compcert.override {
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 751a13b34ce7..c3ff83d20c83 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -370,7 +370,8 @@ lib.makeScope pkgs.newScope (self: with self; {
           configureFlags = [
             "--enable-dom"
           ];
-          patches = lib.optionals (lib.versionOlder php.version "8.2.14") [
+          # Add a PHP lower version bound constraint to avoid applying the patch on older PHP versions.
+          patches = lib.optionals (lib.versionOlder php.version "8.2.14" && lib.versionAtLeast php.version "8.1") [
             # Fix tests with libxml 2.12
             # Part of 8.3.1RC1+, 8.2.14RC1+
             (fetchpatch {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c3253da82ad7..c46adcf249fd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8373,6 +8373,8 @@ self: super: with self; {
 
   ninja = callPackage ../development/python-modules/ninja { inherit (pkgs) ninja; };
 
+  nipreps-versions = callPackage ../development/python-modules/nipreps-versions { };
+
   nipy = callPackage ../development/python-modules/nipy { };
 
   nipype = callPackage ../development/python-modules/nipype {
@@ -8385,6 +8387,8 @@ self: super: with self; {
 
   nitransforms = callPackage ../development/python-modules/nitransforms { };
 
+  niworkflows = callPackage ../development/python-modules/niworkflows { };
+
   nix-kernel = callPackage ../development/python-modules/nix-kernel {
     inherit (pkgs) nix;
   };
@@ -14026,6 +14030,8 @@ self: super: with self; {
 
   svgelements = callPackage ../development/python-modules/svgelements { };
 
+  svgutils = callPackage ../development/python-modules/svgutils { };
+
   svgwrite = callPackage ../development/python-modules/svgwrite { };
 
   sv-ttk = callPackage ../development/python-modules/sv-ttk { };
@@ -14126,8 +14132,7 @@ self: super: with self; {
   tblib = callPackage ../development/python-modules/tblib { };
 
   tblite = callPackage ../development/libraries/science/chemistry/tblite/python.nix {
-    tblite = pkgs.tblite;
-    meson = pkgs.meson;
+    inherit (pkgs) tblite meson simple-dftd3;
   };
 
   tbm-utils = callPackage ../development/python-modules/tbm-utils { };
@@ -14166,6 +14171,8 @@ self: super: with self; {
 
   tempita = callPackage ../development/python-modules/tempita { };
 
+  templateflow = callPackage ../development/python-modules/templateflow { };
+
   tempora = callPackage ../development/python-modules/tempora { };
 
   tenacity = callPackage ../development/python-modules/tenacity { };
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index 665d2a653eee..571a12ef50d6 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -88,6 +88,8 @@ makeScopeWithSplicing' {
   # is, to allow users to choose the right build if needed.
   sddm = callPackage ../applications/display-managers/sddm {};
 
+  waylib = callPackage ../development/libraries/waylib { };
+
   } // lib.optionalAttrs pkgs.config.allowAliases {
     # Convert to a throw on 01-01-2023.
     # Warnings show up in various cli tool outputs, throws do not.