about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/hooks/meson.section.md26
-rw-r--r--doc/hooks/ninja.section.md2
-rw-r--r--maintainers/maintainer-list.nix7
-rw-r--r--maintainers/scripts/luarocks-packages.csv21
-rwxr-xr-xmaintainers/scripts/update-luarocks-packages2
-rw-r--r--nixos/doc/manual/release-notes/rl-2311.section.md12
-rw-r--r--nixos/modules/installer/tools/nixos-generate-config.pl14
-rw-r--r--nixos/modules/services/desktops/pipewire/pipewire.nix17
-rw-r--r--nixos/modules/services/networking/ircd-hybrid/builder.sh2
-rw-r--r--nixos/modules/services/web-servers/jboss/builder.sh2
-rw-r--r--nixos/modules/tasks/filesystems/bcachefs.nix51
-rw-r--r--pkgs/applications/audio/fluidsynth/default.nix16
-rw-r--r--pkgs/applications/audio/mpg123/default.nix4
-rw-r--r--pkgs/applications/audio/paulstretch/default.nix3
-rw-r--r--pkgs/applications/editors/neovim/tests/default.nix2
-rw-r--r--pkgs/applications/editors/neovim/wrapper.nix56
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/graphics/autotrace/default.nix3
-rw-r--r--pkgs/applications/kde/marble.nix4
-rw-r--r--pkgs/applications/misc/adobe-reader/builder.sh2
-rw-r--r--pkgs/applications/misc/volnoti/default.nix2
-rw-r--r--pkgs/applications/networking/browsers/firefox-bin/default.nix21
-rw-r--r--pkgs/applications/networking/localproxy/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/neomutt/default.nix3
-rw-r--r--pkgs/applications/networking/p2p/freenet/default.nix3
-rw-r--r--pkgs/applications/science/logic/vampire/default.nix4
-rw-r--r--pkgs/applications/version-management/hub/default.nix6
-rw-r--r--pkgs/applications/video/kodi/unwrapped.nix2
-rw-r--r--pkgs/build-support/binary-cache/default.nix13
-rw-r--r--pkgs/build-support/binary-cache/make-binary-cache.py2
-rw-r--r--pkgs/build-support/cc-wrapper/cc-wrapper.sh2
-rw-r--r--pkgs/build-support/closure-info.nix14
-rw-r--r--pkgs/build-support/fetchbzr/builder.sh2
-rw-r--r--pkgs/build-support/fetchcvs/builder.sh2
-rw-r--r--pkgs/build-support/fetchdarcs/builder.sh2
-rw-r--r--pkgs/build-support/fetchdocker/fetchdocker-builder.sh2
-rw-r--r--pkgs/build-support/fetchfossil/builder.sh2
-rw-r--r--pkgs/build-support/fetchgit/builder.sh2
-rw-r--r--pkgs/build-support/fetchhg/builder.sh2
-rw-r--r--pkgs/build-support/fetchipfs/builder.sh2
-rw-r--r--pkgs/build-support/fetchmtn/builder.sh2
-rw-r--r--pkgs/build-support/fetchsvn/builder.sh2
-rw-r--r--pkgs/build-support/fetchsvnssh/builder.sh2
-rw-r--r--pkgs/build-support/fetchurl/builder.sh2
-rw-r--r--pkgs/build-support/references-by-popularity/default.nix13
-rw-r--r--pkgs/build-support/rust/build-rust-package/default.nix3
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.py20
-rw-r--r--pkgs/build-support/setup-hooks/auto-patchelf.sh4
-rw-r--r--pkgs/by-name/ar/arrpc/package.nix3
-rw-r--r--pkgs/by-name/ju/justbuild/package.nix6
-rw-r--r--pkgs/data/misc/shared-mime-info/default.nix10
-rw-r--r--pkgs/data/misc/shared-mime-info/fix-clang-warnings.patch31
-rw-r--r--pkgs/desktops/gnustep/make/builder.sh2
-rwxr-xr-xpkgs/development/compilers/aspectj/builder.sh2
-rw-r--r--pkgs/development/compilers/binaryen/default.nix4
-rw-r--r--pkgs/development/compilers/chicken/4/fetchegg/builder.sh2
-rw-r--r--pkgs/development/compilers/emscripten/default.nix9
-rwxr-xr-xpkgs/development/compilers/fpc/binary-builder-darwin.sh2
-rwxr-xr-xpkgs/development/compilers/fpc/binary-builder.sh2
-rw-r--r--pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch85
-rw-r--r--pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch84
-rw-r--r--pkgs/development/compilers/gcc/patches/default.nix4
-rw-r--r--pkgs/development/compilers/ios-cross-compile/9.2_builder.sh2
-rw-r--r--pkgs/development/compilers/llvm/16/lld/add-table-base.patch190
-rw-r--r--pkgs/development/compilers/llvm/16/lld/default.nix1
-rw-r--r--pkgs/development/compilers/ocaml/builder.sh2
-rw-r--r--pkgs/development/compilers/rust/1_73.nix (renamed from pkgs/development/compilers/rust/1_72.nix)31
-rwxr-xr-xpkgs/development/compilers/rust/print-hashes.sh1
-rw-r--r--pkgs/development/compilers/rust/rustc.nix20
-rw-r--r--pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix7
-rw-r--r--pkgs/development/interpreters/guile/2.2.nix6
-rw-r--r--pkgs/development/interpreters/guile/3.0.nix7
-rw-r--r--pkgs/development/interpreters/nelua/default.nix6
-rw-r--r--pkgs/development/interpreters/python/default.nix4
-rw-r--r--pkgs/development/interpreters/python/hooks/default.nix5
-rw-r--r--pkgs/development/interpreters/python/hooks/sphinx-hook.sh2
-rw-r--r--pkgs/development/interpreters/python/mk-python-derivation.nix7
-rw-r--r--pkgs/development/interpreters/ruby/rubygems/default.nix4
-rw-r--r--pkgs/development/libraries/Xaw3d/default.nix6
-rw-r--r--pkgs/development/libraries/audio/game-music-emu/default.nix5
-rw-r--r--pkgs/development/libraries/audio/libopenmpt/default.nix4
-rw-r--r--pkgs/development/libraries/audio/lilv/default.nix41
-rw-r--r--pkgs/development/libraries/audio/lilv/lilv-pkgconfig.patch6
-rw-r--r--pkgs/development/libraries/audiofile/default.nix3
-rw-r--r--pkgs/development/libraries/check/default.nix3
-rw-r--r--pkgs/development/libraries/glibc/2.38-master.patch.gzbin32759 -> 35936 bytes
-rw-r--r--pkgs/development/libraries/glibc/common.nix4
-rw-r--r--pkgs/development/libraries/glibc/default.nix4
-rw-r--r--pkgs/development/libraries/glibc/locales-builder.sh2
-rw-r--r--pkgs/development/libraries/gnu-config/default.nix8
-rw-r--r--pkgs/development/libraries/gtk-sharp/builder.sh2
-rw-r--r--pkgs/development/libraries/imlib2/default.nix34
-rw-r--r--pkgs/development/libraries/jbig2dec/default.nix14
-rw-r--r--pkgs/development/libraries/kde-frameworks/baloo.nix15
-rw-r--r--pkgs/development/libraries/kde-frameworks/fetch.sh2
-rw-r--r--pkgs/development/libraries/kde-frameworks/kio/default.nix6
-rw-r--r--pkgs/development/libraries/kde-frameworks/srcs.nix664
-rw-r--r--pkgs/development/libraries/libglvnd/default.nix6
-rw-r--r--pkgs/development/libraries/libical/default.nix5
-rw-r--r--pkgs/development/libraries/libimagequant/Cargo.lock53
-rw-r--r--pkgs/development/libraries/libimagequant/default.nix4
-rw-r--r--pkgs/development/libraries/libiscsi/default.nix5
-rw-r--r--pkgs/development/libraries/libuv/default.nix12
-rw-r--r--pkgs/development/libraries/libva/default.nix4
-rw-r--r--pkgs/development/libraries/libvterm-neovim/default.nix6
-rw-r--r--pkgs/development/libraries/mesa/default.nix4
-rw-r--r--pkgs/development/libraries/onnxruntime/default.nix6
-rw-r--r--pkgs/development/libraries/opencore-amr/default.nix6
-rw-r--r--pkgs/development/libraries/opencv/3.x.nix4
-rw-r--r--pkgs/development/libraries/opencv/4.x.nix6
-rw-r--r--pkgs/development/libraries/openjpeg/default.nix4
-rw-r--r--pkgs/development/libraries/openssl/default.nix31
-rw-r--r--pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch13
-rw-r--r--pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch27
-rw-r--r--pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch30
-rw-r--r--pkgs/development/libraries/pipewire/0090-pipewire-config-template-paths.patch50
-rw-r--r--pkgs/development/libraries/pipewire/0095-spa-data-dir.patch12
-rw-r--r--pkgs/development/libraries/pipewire/default.nix37
-rw-r--r--pkgs/development/libraries/protobuf/21.nix6
-rw-r--r--pkgs/development/libraries/protobuf/23.nix6
-rw-r--r--pkgs/development/libraries/protobuf/24.nix6
-rw-r--r--pkgs/development/libraries/protobuf/3.21.nix6
-rw-r--r--pkgs/development/libraries/protobuf/3.23.nix6
-rw-r--r--pkgs/development/libraries/protobuf/3.24.nix6
-rw-r--r--pkgs/development/libraries/protobuf/generic.nix (renamed from pkgs/development/libraries/protobuf/generic-v3-cmake.nix)18
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix3
-rw-r--r--pkgs/development/libraries/qt-5/5.15/modules1
-rw-r--r--pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch79
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs-generated.json165
-rw-r--r--pkgs/development/libraries/qt-5/5.15/srcs.nix52
-rw-r--r--pkgs/development/libraries/rapidfuzz-cpp/default.nix4
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/libraries/science/math/openblas/default.nix13
-rw-r--r--pkgs/development/libraries/webrtc-audio-processing/default.nix2
-rw-r--r--pkgs/development/libraries/wtk/builder.sh2
-rw-r--r--pkgs/development/libraries/zeromq/4.x.nix17
-rw-r--r--pkgs/development/lua-modules/aliases.nix3
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix931
-rw-r--r--pkgs/development/lua-modules/overrides.nix46
-rw-r--r--pkgs/development/perl-modules/generic/builder.sh2
-rw-r--r--pkgs/development/python-modules/boto3/default.nix4
-rw-r--r--pkgs/development/python-modules/botocore/default.nix4
-rw-r--r--pkgs/development/python-modules/markdown-macros/default.nix4
-rw-r--r--pkgs/development/python-modules/pillow/default.nix4
-rw-r--r--pkgs/development/python-modules/protobuf/3.nix90
-rw-r--r--pkgs/development/python-modules/protobuf/default.nix24
-rw-r--r--pkgs/development/python-modules/psycopg2/default.nix18
-rw-r--r--pkgs/development/python-modules/pybind11/default.nix16
-rw-r--r--pkgs/development/python-modules/pympler/default.nix3
-rw-r--r--pkgs/development/python-modules/rapidfuzz/default.nix4
-rw-r--r--pkgs/development/python-modules/rocket-errbot/default.nix4
-rw-r--r--pkgs/development/python-modules/s3transfer/default.nix5
-rw-r--r--pkgs/development/python-modules/sqlalchemy-migrate/default.nix3
-rw-r--r--pkgs/development/python-modules/sqlalchemy/default.nix4
-rw-r--r--pkgs/development/python-modules/udatetime/default.nix6
-rw-r--r--pkgs/development/python-modules/uvloop/default.nix64
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/boot/builder.sh2
-rw-r--r--pkgs/development/tools/build-managers/meson/default.nix13
-rw-r--r--pkgs/development/tools/build-managers/meson/setup-hook.sh31
-rw-r--r--pkgs/development/tools/misc/automake/builder.sh2
-rw-r--r--pkgs/development/tools/misc/indent/default.nix2
-rw-r--r--pkgs/development/tools/misc/lttng-ust/default.nix4
-rw-r--r--pkgs/development/tools/misc/luarocks/luarocks-nix.nix6
-rw-r--r--pkgs/development/tools/parsing/antlr/builder.sh2
-rw-r--r--pkgs/development/tools/rust/maturin/default.nix6
-rw-r--r--pkgs/development/web/nodejs/nodejs.nix7
-rw-r--r--pkgs/development/web/nodejs/v14.nix16
-rw-r--r--pkgs/development/web/nodejs/v16.nix14
-rw-r--r--pkgs/games/orthorobot/default.nix4
-rw-r--r--pkgs/games/steam/fhsenv.nix2
-rw-r--r--pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh2
-rw-r--r--pkgs/misc/openrussian-cli/default.nix1
-rw-r--r--pkgs/os-specific/darwin/DarwinTools/default.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix7
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libm/missing-declarations.patch292
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix4
-rw-r--r--pkgs/os-specific/linux/fuse/common.nix5
-rw-r--r--pkgs/os-specific/linux/fuse/default.nix6
-rw-r--r--pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch5
-rw-r--r--pkgs/os-specific/linux/fuse/fuse3-install.patch22
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel-headers/default.nix5
-rw-r--r--pkgs/os-specific/linux/kernel-headers/revert-af_packet-flex.patch31
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix23
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix9
-rw-r--r--pkgs/os-specific/linux/numatop/default.nix6
-rwxr-xr-xpkgs/os-specific/linux/nvidia-x11/builder.sh2
-rw-r--r--pkgs/os-specific/linux/opengl/xorg-sys/builder.sh2
-rw-r--r--pkgs/os-specific/linux/pam_p11/default.nix4
-rw-r--r--pkgs/os-specific/linux/shadow/default.nix4
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix8
-rw-r--r--pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch277
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix1
-rw-r--r--pkgs/servers/http/tomcat/axis2/builder.sh2
-rw-r--r--pkgs/servers/redpanda/server.nix4
-rw-r--r--pkgs/servers/x11/xorg/builder.sh2
-rw-r--r--pkgs/servers/x11/xorg/default.nix12
-rw-r--r--pkgs/servers/x11/xorg/tarballs.list4
-rw-r--r--pkgs/stdenv/adapters.nix13
-rw-r--r--pkgs/stdenv/darwin/default.nix58
-rw-r--r--pkgs/stdenv/generic/default-builder.sh4
-rw-r--r--pkgs/stdenv/generic/setup.sh17
-rw-r--r--pkgs/test/simple/builder.sh2
-rw-r--r--pkgs/tools/admin/awscli/default.nix33
-rw-r--r--pkgs/tools/cd-dvd/sacd/default.nix3
-rw-r--r--pkgs/tools/filesystems/bcachefs-tools/default.nix23
-rw-r--r--pkgs/tools/misc/expect/default.nix15
-rw-r--r--pkgs/tools/misc/expect/fix-darwin-clang16.patch31
-rw-r--r--pkgs/tools/misc/xvfb-run/default.nix2
-rw-r--r--pkgs/tools/networking/curl/default.nix11
-rw-r--r--pkgs/tools/networking/dnsmasq/default.nix5
-rw-r--r--pkgs/tools/networking/networkmanager/default.nix4
-rw-r--r--pkgs/tools/package-management/ciel/default.nix2
-rw-r--r--pkgs/tools/security/certmgr/default.nix4
-rw-r--r--pkgs/tools/security/ibm-sw-tpm2/default.nix19
-rw-r--r--pkgs/tools/video/mjpegtools/c++-17-fixes.patch44
-rw-r--r--pkgs/tools/video/mjpegtools/default.nix4
-rw-r--r--pkgs/tools/wayland/chayang/default.nix2
-rw-r--r--pkgs/top-level/aliases.nix3
-rw-r--r--pkgs/top-level/all-packages.nix125
-rw-r--r--pkgs/top-level/darwin-packages.nix10
-rw-r--r--pkgs/top-level/linux-kernels.nix12
-rw-r--r--pkgs/top-level/python-packages.nix10
226 files changed, 3149 insertions, 1896 deletions
diff --git a/doc/hooks/meson.section.md b/doc/hooks/meson.section.md
index fd7779e6468f..93e7019c311b 100644
--- a/doc/hooks/meson.section.md
+++ b/doc/hooks/meson.section.md
@@ -1,16 +1,28 @@
 # Meson {#meson}
 
-Overrides the configure phase to run meson to generate Ninja files. To run these files, you should accompany Meson with ninja. By default, `enableParallelBuilding` is enabled as Meson supports parallel building almost everywhere.
+Overrides the configure, check, and install phases to run `meson setup`, `meson test`, and `meson install`.
+
+Meson is a meta-build system so you will need a secondary build system to run the generated build files in build phase. In Nixpkgs context, you will want to accompany Meson with ninja, which provides a [setup hook](#ninja) registering a ninja-based build phase.
+
+By default, `enableParallelBuilding` is enabled as Meson supports parallel building almost everywhere.
 
 ## Variables controlling Meson {#variables-controlling-meson}
 
 ### `mesonFlags` {#mesonflags}
 
-Controls the flags passed to meson.
+Controls the flags passed to `meson setup`.
+
+### `mesonCheckFlags` {#mesoncheckflags}
+
+Controls the flags passed to `meson test`.
+
+### `mesonInstallFlags` {#mesoninstallflags}
+
+Controls the flags passed to `meson install`.
 
 ### `mesonBuildType` {#mesonbuildtype}
 
-Which [`--buildtype`](https://mesonbuild.com/Builtin-options.html#core-options) to pass to Meson. We default to `plain`.
+Which [`--buildtype`](https://mesonbuild.com/Builtin-options.html#core-options) to pass to `meson setup`. We default to `plain`.
 
 ### `mesonAutoFeatures` {#mesonautofeatures}
 
@@ -23,3 +35,11 @@ What value to set [`-Dwrap_mode=`](https://mesonbuild.com/Builtin-options.html#c
 ### `dontUseMesonConfigure` {#dontusemesonconfigure}
 
 Disables using Meson’s `configurePhase`.
+
+### `dontUseMesonCheck` {#dontusemesoncheck}
+
+Disables using Meson’s `checkPhase`.
+
+### `dontUseMesonInstall` {#dontusemesoninstall}
+
+Disables using Meson’s `installPhase`.
diff --git a/doc/hooks/ninja.section.md b/doc/hooks/ninja.section.md
index 4b0e33feb5c3..bbc948108804 100644
--- a/doc/hooks/ninja.section.md
+++ b/doc/hooks/ninja.section.md
@@ -1,3 +1,5 @@
 # ninja {#ninja}
 
 Overrides the build, install, and check phase to run ninja instead of make. You can disable this behavior with the `dontUseNinjaBuild`, `dontUseNinjaInstall`, and `dontUseNinjaCheck`, respectively. Parallel building is enabled by default in Ninja.
+
+Note that if the [Meson setup hook](#meson) is also active, Ninja's install and check phases will be disabled in favor of Meson's.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index de345f0e8bf2..1e0715f58c87 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -19361,6 +19361,13 @@
       fingerprint = "FD0A C425 9EF5 4084 F99F 9B47 2ACC 9749 7C68 FAD4";
     }];
   };
+  YellowOnion = {
+    name = "Daniel Hill";
+    email = "daniel@gluo.nz";
+    github   = "YellowOnion";
+    githubId = 364160;
+    matrix = "@woobilicious:matrix.org";
+  };
   yesbox = {
     email = "jesper.geertsen.jonsson@gmail.com";
     github = "yesbox";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index f03ef4fa09c9..2277a51dfbcb 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -1,9 +1,9 @@
 name,src,ref,server,version,luaversion,maintainers
 alt-getopt,,,,,,arobyn
 bit32,,,,5.3.0-1,5.1,lblasc
-argparse,https://github.com/luarocks/argparse.git,,,,,
-basexx,https://github.com/teto/basexx.git,,,,,
-binaryheap,https://github.com/Tieske/binaryheap.lua,,,,,vcunat
+argparse,,,,,,
+basexx,,,,,,
+binaryheap,,,,,,vcunat
 busted,,,,,,
 cassowary,,,,,,marsam alerque
 cldr,,,,,,alerque
@@ -12,8 +12,7 @@ cosmo,,,,,,marsam
 coxpcall,,,,1.17.0-1,,
 cqueues,,,,,,vcunat
 cyan,,,,,,
-cyrussasl,https://github.com/JorjBauer/lua-cyrussasl.git,,,,,
-digestif,https://github.com/astoff/digestif.git,,,0.2-1,5.3,
+digestif,https://github.com/astoff/digestif.git,,,,5.3,
 dkjson,,,,,,
 fennel,,,,,,misterio77
 ferris.nvim,,,,,,mrcjkb
@@ -25,7 +24,7 @@ http,,,,0.3-0,,vcunat
 inspect,,,,,,
 jsregexp,,,,,,
 ldbus,,,http://luarocks.org/dev,,,
-ldoc,https://github.com/stevedonovan/LDoc.git,,,,,
+ldoc,,,,,,
 lgi,,,,,,
 linenoise,https://github.com/hoelzro/lua-linenoise.git,,,,,
 ljsyscall,,,,,5.1,lblasc
@@ -41,7 +40,7 @@ lrexlib-posix,,,,,,
 lua-cjson,,,,,,
 lua-cmsgpack,,,,,,
 lua-curl,,,,,,
-lua-iconv,,,,,,
+lua-ffi-zlib,,,,,,
 lua-lsp,,,,,,
 lua-messagepack,,,,,,
 lua-protobuf,,,,,,lockejan
@@ -83,29 +82,29 @@ luaunit,,,,,,lockejan
 luautf8,,,,,,pstn
 luazip,,,,,,
 lua-yajl,,,,,,pstn
+lua-iconv,,,,7.0.0,,
 luuid,,,,,,
 luv,,,,1.44.2-1,,
 lush.nvim,https://github.com/rktjmp/lush.nvim,,,,,teto
 lyaml,,,,,,lblasc
-magick,,,,,,donovanglover
+magick,,,,,5.1,donovanglover
 markdown,,,,,,
 mediator_lua,,,,,,
 middleclass,,,,,,
 mpack,,,,,,
 moonscript,https://github.com/leafo/moonscript.git,dev-1,,,,arobyn
-nui-nvim,,,,,,mrcjkb
+nui.nvim,,,,,,mrcjkb
 nvim-client,https://github.com/neovim/lua-client.git,,,,,
 nvim-cmp,https://github.com/hrsh7th/nvim-cmp,,,,,
 penlight,https://github.com/lunarmodules/Penlight.git,,,,,alerque
 plenary.nvim,https://github.com/nvim-lua/plenary.nvim.git,,,,5.1,
 rapidjson,https://github.com/xpol/lua-rapidjson.git,,,,,
 rest.nvim,,,,,5.1,teto
-readline,,,,,,
 say,https://github.com/Olivine-Labs/say.git,,,,,
 serpent,,,,,,lockejan
 sqlite,,,,,,
 std._debug,https://github.com/lua-stdlib/_debug.git,,,,,
-std.normalize,https://github.com/lua-stdlib/normalize.git,,,,,
+std.normalize,,,,,,
 stdlib,,,,41.2.2,,vyp
 teal-language-server,,,http://luarocks.org/dev,,,
 telescope.nvim,,,,,5.1,
diff --git a/maintainers/scripts/update-luarocks-packages b/maintainers/scripts/update-luarocks-packages
index 32c2b44260b3..8045c46782cc 100755
--- a/maintainers/scripts/update-luarocks-packages
+++ b/maintainers/scripts/update-luarocks-packages
@@ -103,7 +103,7 @@ class LuaEditor(pluginupdate.Editor):
             header2 = textwrap.dedent(
                 # header2 = inspect.cleandoc(
                 """
-                { self, stdenv, lib, fetchurl, fetchgit, callPackage, ... } @ args:
+				{ stdenv, lib, fetchurl, fetchgit, callPackage, ... }:
                 final: prev:
                 {
             """
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 9e2afe5fd201..7e85084a7d2d 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -240,6 +240,18 @@
 
 - `fileSystems.<name>.autoResize` now uses `systemd-growfs` to resize the file system online in stage 2. This means that `f2fs` and `ext2` can no longer be auto resized, while `xfs` and `btrfs` now can be.
 
+- `fuse3` has been updated from 3.11.0 to 3.16.2; see [ChangeLog.rst](https://github.com/libfuse/libfuse/blob/fuse-3.16.2/ChangeLog.rst#libfuse-3162-2023-10-10) for an overview of the changes.
+
+  Unsupported mount options are no longer silently accepted [(since 3.15.0)](https://github.com/libfuse/libfuse/blob/fuse-3.16.2/ChangeLog.rst#libfuse-3150-2023-06-09). The [affected mount options](https://github.com/libfuse/libfuse/commit/dba6b3983af34f30de01cf532dff0b66f0ed6045) are: `atime`, `diratime`, `lazytime`, `nolazytime`, `relatime`, `norelatime`, `strictatime`.
+
+  For example,
+
+  ```bash
+  $ sshfs 127.0.0.1:/home/test/testdir /home/test/sshfs_mnt -o atime`
+  ```
+
+  would previously terminate successfully with the mount point established, now it outputs the error message ``fuse: unknown option(s): `-o atime'`` and terminates with exit status 1.
+
 - `nixos-rebuild {switch,boot,test,dry-activate}` now runs the system activation inside `systemd-run`, creating an ephemeral systemd service and protecting the system switch against issues like network disconnections during remote (e.g. SSH) sessions. This has the side effect of running the switch in an isolated environment, that could possible break post-switch scripts that depends on things like environment variables being set. If you want to opt-out from this behavior for now, you may set the `NIXOS_SWITCH_USE_DIRTY_ENV` environment variable before running `nixos-rebuild`. However, keep in mind that this option will be removed in the future.
 
 - The `services.vaultwarden.config` option default value was changed to make Vaultwarden only listen on localhost, following the [secure defaults for most NixOS services](https://github.com/NixOS/nixpkgs/issues/100192).
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 85180bf2d1b4..164c868a9f09 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -257,6 +257,7 @@ foreach my $path (glob "/sys/class/{block,mmc_host}/*") {
 
 # Add bcache module, if needed.
 my @bcacheDevices = glob("/dev/bcache*");
+@bcacheDevices = grep(!qr#dev/bcachefs.*#, @bcacheDevices);
 if (scalar @bcacheDevices > 0) {
     push @initrdAvailableKernelModules, "bcache";
 }
@@ -467,6 +468,19 @@ EOF
     # boot.tmp.useTmpfs option in configuration.nix (managed declaratively).
     next if ($mountPoint eq "/tmp" && $fsType eq "tmpfs");
 
+    # This should work for single and multi-device systems.
+    # still needs subvolume support
+    if ($fsType eq "bcachefs") {
+        my ($status, @info) = runCommand("bcachefs fs usage $rootDir$mountPoint");
+        my $UUID = $info[0];
+
+        if ($status == 0 && $UUID =~ /^Filesystem:[ \t\n]*([0-9a-z-]+)/) {
+            $stableDevPath = "UUID=$1";
+        } else {
+            print STDERR "warning: can't find bcachefs mount UUID falling back to device-path";
+        }
+    }
+
     # Emit the filesystem.
     $fileSystems .= <<EOF;
   fileSystems.\"$mountPoint\" =
diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
index ae695baf42c6..07ca2727cf48 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -115,8 +115,7 @@ in {
     environment.systemPackages = [ cfg.package ]
                                  ++ lib.optional cfg.jack.enable jack-libs;
 
-    systemd.packages = [ cfg.package ]
-                       ++ lib.optional cfg.pulse.enable cfg.package.pulse;
+    systemd.packages = [ cfg.package ];
 
     # PipeWire depends on DBUS but doesn't list it. Without this booting
     # into a terminal results in the service crashing with an error.
@@ -130,9 +129,13 @@ in {
     systemd.user.sockets.pipewire.enable = !cfg.systemWide;
     systemd.user.services.pipewire.enable = !cfg.systemWide;
 
+    # Mask pw-pulse if it's not wanted
+    systemd.user.services.pipewire-pulse.enable = cfg.pulse.enable;
+    systemd.user.sockets.pipewire-pulse.enable = cfg.pulse.enable;
+
     systemd.sockets.pipewire.wantedBy = lib.mkIf cfg.socketActivation [ "sockets.target" ];
     systemd.user.sockets.pipewire.wantedBy = lib.mkIf cfg.socketActivation [ "sockets.target" ];
-    systemd.user.sockets.pipewire-pulse.wantedBy = lib.mkIf (cfg.socketActivation && cfg.pulse.enable) ["sockets.target"];
+    systemd.user.sockets.pipewire-pulse.wantedBy = lib.mkIf cfg.socketActivation [ "sockets.target" ];
 
     services.udev.packages = [ cfg.package ];
 
@@ -140,14 +143,14 @@ in {
     environment.etc."alsa/conf.d/49-pipewire-modules.conf" = mkIf cfg.alsa.enable {
       text = ''
         pcm_type.pipewire {
-          libs.native = ${cfg.package.lib}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;
+          libs.native = ${cfg.package}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;
           ${optionalString enable32BitAlsaPlugins
-            "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire.lib}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;"}
+            "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;"}
         }
         ctl_type.pipewire {
-          libs.native = ${cfg.package.lib}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;
+          libs.native = ${cfg.package}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;
           ${optionalString enable32BitAlsaPlugins
-            "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire.lib}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;"}
+            "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;"}
         }
       '';
     };
diff --git a/nixos/modules/services/networking/ircd-hybrid/builder.sh b/nixos/modules/services/networking/ircd-hybrid/builder.sh
index d9d2e4264dfd..07a3788abf7d 100644
--- a/nixos/modules/services/networking/ircd-hybrid/builder.sh
+++ b/nixos/modules/services/networking/ircd-hybrid/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 doSub() {
diff --git a/nixos/modules/services/web-servers/jboss/builder.sh b/nixos/modules/services/web-servers/jboss/builder.sh
index ac573089cd5a..8c49b87db060 100644
--- a/nixos/modules/services/web-servers/jboss/builder.sh
+++ b/nixos/modules/services/web-servers/jboss/builder.sh
@@ -1,6 +1,6 @@
 set -e
 
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 mkdir -p $out/bin
diff --git a/nixos/modules/tasks/filesystems/bcachefs.nix b/nixos/modules/tasks/filesystems/bcachefs.nix
index 19ef188ce783..ed56983bb899 100644
--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@@ -6,23 +6,39 @@ let
 
   bootFs = filterAttrs (n: fs: (fs.fsType == "bcachefs") && (utils.fsNeededForBoot fs)) config.fileSystems;
 
-  mountCommand = pkgs.runCommand "mount.bcachefs" {} ''
-    mkdir -p $out/bin
-    cat > $out/bin/mount.bcachefs <<EOF
-    #!/bin/sh
-    exec "/bin/bcachefs" mount "\$@"
-    EOF
-    chmod +x $out/bin/mount.bcachefs
-  '';
-
   commonFunctions = ''
     prompt() {
         local name="$1"
         printf "enter passphrase for $name: "
     }
+
     tryUnlock() {
         local name="$1"
         local path="$2"
+        local success=false
+        local target
+        local uuid=$(echo -n $path | sed -e 's,UUID=\(.*\),\1,g')
+
+        printf "waiting for device to appear $path"
+        for try in $(seq 10); do
+          if [ -e $path ]; then
+              success=true
+              break
+          else
+              target=$(blkid --uuid $uuid)
+              if [ $? == 0 ]; then
+                 success=true
+                 break
+              fi
+          fi
+          echo -n "."
+          sleep 1
+        done
+        printf "\n"
+        if [ $success == true ]; then
+            path=$target
+        fi
+
         if bcachefs unlock -c $path > /dev/null 2> /dev/null; then    # test for encryption
             prompt $name
             until bcachefs unlock $path 2> /dev/null; do              # repeat until successfully unlocked
@@ -30,6 +46,8 @@ let
                 prompt $name
             done
             printf "unlocking successful.\n"
+        else
+            echo "Cannot unlock device $uuid with path $path" >&2
         fi
     }
   '';
@@ -51,28 +69,25 @@ in
 {
   config = mkIf (elem "bcachefs" config.boot.supportedFilesystems) (mkMerge [
     {
-      # We do not want to include bachefs in the fsPackages for systemd-initrd
-      # because we provide the unwrapped version of mount.bcachefs
-      # through the extraBin option, which will make it available for use.
-      system.fsPackages = lib.optional (!config.boot.initrd.systemd.enable) pkgs.bcachefs-tools;
-      environment.systemPackages = lib.optional (config.boot.initrd.systemd.enable) pkgs.bcachefs-tools;
+      # needed for systemd-remount-fs
+      system.fsPackages = [ pkgs.bcachefs-tools ];
 
       # use kernel package with bcachefs support until it's in mainline
+      # TODO replace with requireKernelConfig
       boot.kernelPackages = pkgs.linuxPackages_testing_bcachefs;
     }
 
     (mkIf ((elem "bcachefs" config.boot.initrd.supportedFilesystems) || (bootFs != {})) {
       # chacha20 and poly1305 are required only for decryption attempts
       boot.initrd.availableKernelModules = [ "bcachefs" "sha256" "chacha20" "poly1305" ];
-
       boot.initrd.systemd.extraBin = {
+        # do we need this? boot/systemd.nix:566 & boot/systemd/initrd.nix:357
         "bcachefs" = "${pkgs.bcachefs-tools}/bin/bcachefs";
-        "mount.bcachefs" = "${mountCommand}/bin/mount.bcachefs";
+        "mount.bcachefs" = "${pkgs.bcachefs-tools}/bin/mount.bcachefs";
       };
-
       boot.initrd.extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable) ''
         copy_bin_and_libs ${pkgs.bcachefs-tools}/bin/bcachefs
-        copy_bin_and_libs ${mountCommand}/bin/mount.bcachefs
+        copy_bin_and_libs ${pkgs.bcachefs-tools}/bin/mount.bcachefs
       '';
       boot.initrd.extraUtilsCommandsTest = ''
         $out/bin/bcachefs version
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index 503e72dfe0e3..34329fb2ea84 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -1,29 +1,19 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, buildPackages, pkg-config, cmake
+{ stdenv, lib, fetchFromGitHub, buildPackages, pkg-config, cmake
 , alsa-lib, glib, libjack2, libsndfile, libpulseaudio
 , AppKit, AudioUnit, CoreAudio, CoreMIDI, CoreServices
 }:
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    sha256 = "sha256-RqhlpvMbRSwdcY2uuFAdJnihN3aObcLVMuvCZ294dgo=";
+    hash = "sha256-3qLmo9Ibl44v6Jj5Ix17ixwqfPt3ITTXUqBETF5pzE4=";
   };
 
-  patches = [
-    # Fixes bad CMAKE_INSTALL_PREFIX + CMAKE_INSTALL_LIBDIR concatenation for Darwin install name dir
-    # Remove when PR merged & in release
-    (fetchpatch {
-      name = "0001-Fix-incorrect-way-of-turning-CMAKE_INSTALL_LIBDIR-absolute.patch";
-      url = "https://github.com/FluidSynth/fluidsynth/pull/1261/commits/03cd38dd909fc24aa39553d869afbb4024416de8.patch";
-      hash = "sha256-nV+MbFttnbNBO4zWnPLpnnEuoiESkV9BGFlUS9tQQfk=";
-    })
-  ];
-
   outputs = [ "out" "dev" "man" ];
 
   nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 348dcfb5986f..94ee6ad53e69 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.31.3";
+  version = "1.32.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-HKd9Omml/4RbegU294P+5VThBBE5prl49q/hT1gUrRo=";
+    hash = "sha256-LZkTpX1O6PSXoYLG6CWCYCQJeCpPtIHpif7r9ENYZ7Q=";
   };
 
   outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";
diff --git a/pkgs/applications/audio/paulstretch/default.nix b/pkgs/applications/audio/paulstretch/default.nix
index 5e781a9f5115..d85b543baed4 100644
--- a/pkgs/applications/audio/paulstretch/default.nix
+++ b/pkgs/applications/audio/paulstretch/default.nix
@@ -30,8 +30,9 @@ stdenv.mkDerivation {
   ];
 
   patches = [
+    # https://github.com/paulnasca/paulstretch_cpp/pull/12
     (fetchpatch {
-      url = "https://github.com/paulnasca/paulstretch_cpp/pull/12.patch";
+      url = "https://github.com/paulnasca/paulstretch_cpp/commit/d8671b36135fe66839b11eadcacb474cc8dae0d1.patch";
       sha256 = "0lx1rfrs53afkiz1drp456asqgj5yv6hx3lkc01165cv1jsbw6q4";
     })
   ];
diff --git a/pkgs/applications/editors/neovim/tests/default.nix b/pkgs/applications/editors/neovim/tests/default.nix
index f1c38d2915dc..a7e0e4c77057 100644
--- a/pkgs/applications/editors/neovim/tests/default.nix
+++ b/pkgs/applications/editors/neovim/tests/default.nix
@@ -212,7 +212,7 @@ rec {
 
   # having no RC generated should autodisable init.vim wrapping
   nvim_autowrap = runTest nvim_via_override ''
-      ! grep "-u" ${nvimShouldntWrap}/bin/nvim
+      ! grep ${nvimShouldntWrap}/bin/nvim
   '';
 
 
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index 0fbb54df01ac..d61a2fe5e5a8 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -7,8 +7,10 @@
 , neovimUtils
 , vimUtils
 , perl
+, lndir
 }:
-neovim:
+
+neovim-unwrapped:
 
 let
   wrapper = {
@@ -62,7 +64,7 @@ let
     # wrapper with most arguments we need, excluding those that cause problems to
     # generate rplugin.vim, but still required for the final wrapper.
     finalMakeWrapperArgs =
-      [ "${neovim}/bin/nvim" "${placeholder "out"}/bin/nvim" ]
+      [ "${neovim-unwrapped}/bin/nvim" "${placeholder "out"}/bin/nvim" ]
       ++ [ "--set" "NVIM_SYSTEM_RPLUGIN_MANIFEST" "${placeholder "out"}/rplugin.vim" ]
       ++ lib.optionals wrapRc [ "--add-flags" "-u ${writeText "init.vim" neovimRcContent}" ]
       ++ commonWrapperArgs
@@ -72,36 +74,45 @@ let
   in
   assert withPython2 -> throw "Python2 support has been removed from the neovim wrapper, please remove withPython2 and python2Env.";
 
-  symlinkJoin {
-      name = "neovim-${lib.getVersion neovim}${extraName}";
+  stdenv.mkDerivation (finalAttrs: {
+      name = "neovim-${lib.getVersion neovim-unwrapped}${extraName}";
+
+      __structuredAttrs = true;
+      dontUnpack = true;
+      inherit viAlias vimAlias withNodeJs withPython3 withPerl;
+      inherit wrapRc providerLuaRc packpathDirs;
+      inherit python3Env rubyEnv;
+      withRuby = rubyEnv != null;
+      inherit wrapperArgs;
+
       # Remove the symlinks created by symlinkJoin which we need to perform
       # extra actions upon
       postBuild = lib.optionalString stdenv.isLinux ''
         rm $out/share/applications/nvim.desktop
-        substitute ${neovim}/share/applications/nvim.desktop $out/share/applications/nvim.desktop \
+        substitute ${neovim-unwrapped}/share/applications/nvim.desktop $out/share/applications/nvim.desktop \
           --replace 'Name=Neovim' 'Name=Neovim wrapper'
       ''
-      + lib.optionalString withPython3 ''
+      + lib.optionalString finalAttrs.withPython3 ''
         makeWrapper ${python3Env.interpreter} $out/bin/nvim-python3 --unset PYTHONPATH
       ''
-      + lib.optionalString (rubyEnv != null) ''
-        ln -s ${rubyEnv}/bin/neovim-ruby-host $out/bin/nvim-ruby
+      + lib.optionalString (finalAttrs.rubyEnv != null) ''
+        ln -s ${finalAttrs.rubyEnv}/bin/neovim-ruby-host $out/bin/nvim-ruby
       ''
-      + lib.optionalString withNodeJs ''
+      + lib.optionalString finalAttrs.withNodeJs ''
         ln -s ${nodePackages.neovim}/bin/neovim-node-host $out/bin/nvim-node
       ''
-      + lib.optionalString withPerl ''
+      + lib.optionalString finalAttrs.withPerl ''
         ln -s ${perlEnv}/bin/perl $out/bin/nvim-perl
       ''
-      + lib.optionalString vimAlias ''
+      + lib.optionalString finalAttrs.vimAlias ''
         ln -s $out/bin/nvim $out/bin/vim
       ''
-      + lib.optionalString viAlias ''
+      + lib.optionalString finalAttrs.viAlias ''
         ln -s $out/bin/nvim $out/bin/vi
       ''
       + lib.optionalString (manifestRc != null) (let
         manifestWrapperArgs =
-          [ "${neovim}/bin/nvim" "${placeholder "out"}/bin/nvim-wrapper" ] ++ commonWrapperArgs;
+          [ "${neovim-unwrapped}/bin/nvim" "${placeholder "out"}/bin/nvim-wrapper" ] ++ commonWrapperArgs;
       in ''
         echo "Generating remote plugin manifest"
         export NVIM_RPLUGIN_MANIFEST=$out/rplugin.vim
@@ -139,26 +150,33 @@ let
         makeWrapper ${lib.escapeShellArgs finalMakeWrapperArgs} ${wrapperArgsStr}
       '';
 
-    paths = [ neovim ];
+    buildPhase = ''
+      runHook preBuild
+      mkdir -p $out
+      for i in ${neovim-unwrapped}; do
+        lndir -silent $i $out
+      done
+      runHook postBuild
+    '';
 
     preferLocalBuild = true;
 
-    nativeBuildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper lndir ];
     passthru = {
       inherit providerLuaRc packpathDirs;
-      unwrapped = neovim;
+      unwrapped = neovim-unwrapped;
       initRc = neovimRcContent;
 
       tests = callPackage ./tests {
       };
     };
 
-    meta = neovim.meta // {
+    meta = neovim-unwrapped.meta // {
       # To prevent builds on hydra
       hydraPlatforms = [];
       # prefer wrapper over the package
-      priority = (neovim.meta.priority or 0) - 1;
+      priority = (neovim-unwrapped.meta.priority or 0) - 1;
     };
-  };
+  });
 in
   lib.makeOverridable wrapper
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 0179dabe3945..83d61b37bfc6 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.1897";
+  version = "9.0.2048";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-ywxJ9evXWbqZ6o6EqDIQWK16J05McAdvPl0Y9cW5Zvc=";
+    hash = "sha256-zR2iPiD4/gf5BnxYoe3cx2ebGWE1P2bY4Cg15gveFgg=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/graphics/autotrace/default.nix b/pkgs/applications/graphics/autotrace/default.nix
index 96a53b5efbac..e611a56a6624 100644
--- a/pkgs/applications/graphics/autotrace/default.nix
+++ b/pkgs/applications/graphics/autotrace/default.nix
@@ -26,8 +26,9 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
+      # https://github.com/autotrace/autotrace/pull/105
       name = "imagemagick7-support.patch";
-      url = "https://github.com/autotrace/autotrace/pull/105.patch";
+      url = "https://github.com/autotrace/autotrace/compare/170488e1871d50aad7a800b901e33ded7d31773a...c26a2a059926c595a00839c8d9961e9381206579.patch";
       hash = "sha256-Q82LRF/BsJ/Ii2s+7yaYHs9agMKYVYIMnbwqz8P92s0=";
     })
   ];
diff --git a/pkgs/applications/kde/marble.nix b/pkgs/applications/kde/marble.nix
index f36d91df5978..78fc52996dc5 100644
--- a/pkgs/applications/kde/marble.nix
+++ b/pkgs/applications/kde/marble.nix
@@ -2,7 +2,7 @@
 , extra-cmake-modules, kdoctools
 , qtscript, qtsvg, qtquickcontrols, qtwebengine
 , krunner, shared-mime-info, kparts, knewstuff
-, gpsd, perl, protobuf3_21
+, gpsd, perl, protobuf_21
 }:
 
 mkDerivation {
@@ -15,7 +15,7 @@ mkDerivation {
   outputs = [ "out" "dev" ];
   nativeBuildInputs = [ extra-cmake-modules kdoctools perl ];
   propagatedBuildInputs = [
-    protobuf3_21 qtscript qtsvg qtquickcontrols qtwebengine shared-mime-info krunner kparts
+    protobuf_21 qtscript qtsvg qtquickcontrols qtwebengine shared-mime-info krunner kparts
     knewstuff gpsd
   ];
   preConfigure = ''
diff --git a/pkgs/applications/misc/adobe-reader/builder.sh b/pkgs/applications/misc/adobe-reader/builder.sh
index 6047c0826430..4291da80576d 100644
--- a/pkgs/applications/misc/adobe-reader/builder.sh
+++ b/pkgs/applications/misc/adobe-reader/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 echo "unpacking $src..."
diff --git a/pkgs/applications/misc/volnoti/default.nix b/pkgs/applications/misc/volnoti/default.nix
index d70918f2e7ce..b54df7e95168 100644
--- a/pkgs/applications/misc/volnoti/default.nix
+++ b/pkgs/applications/misc/volnoti/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     # Fix dbus interface headers. See
     # https://github.com/davidbrazdil/volnoti/pull/10
     (fetchpatch {
-      url = "https://github.com/davidbrazdil/volnoti/pull/10.patch";
+      url = "https://github.com/davidbrazdil/volnoti/commit/623ad8ea5c3ac8720d00a2ced4b6163aae38c119.patch";
       sha256 = "046zfdjmvhb7jrsgh04vfgi35sgy1zkrhd3bzdby3nvds1wslfam";
     })
   ];
diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
index 8130f9f77584..56d21187ebb2 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -20,7 +20,6 @@
 , runtimeShell
 , systemLocale ? config.i18n.defaultLocale or "en_US"
 , patchelfUnstable  # have to use patchelfUnstable to support --no-clobber-old-sections
-, makeWrapper
 }:
 
 let
@@ -58,20 +57,6 @@ let
   source = lib.findFirst (sourceMatches mozLocale) defaultSource sources;
 
   pname = "firefox-${channel}-bin-unwrapped";
-
-  # FIXME: workaround for not being able to pass flags to patchelf
-  # Remove after https://github.com/NixOS/nixpkgs/pull/256525
-  wrappedPatchelf = stdenv.mkDerivation {
-    pname = "patchelf-wrapped";
-    inherit (patchelfUnstable) version;
-
-    nativeBuildInputs = [ makeWrapper ];
-
-    buildCommand = ''
-      mkdir -p $out/bin
-      makeWrapper ${patchelfUnstable}/bin/patchelf $out/bin/patchelf --append-flags "--no-clobber-old-sections"
-    '';
-  };
 in
 
 stdenv.mkDerivation {
@@ -79,7 +64,7 @@ stdenv.mkDerivation {
 
   src = fetchurl { inherit (source) url sha256; };
 
-  nativeBuildInputs = [ wrapGAppsHook autoPatchelfHook wrappedPatchelf ];
+  nativeBuildInputs = [ wrapGAppsHook autoPatchelfHook patchelfUnstable ];
   buildInputs = [
     gtk3
     adwaita-icon-theme
@@ -93,8 +78,10 @@ stdenv.mkDerivation {
     pciutils
   ];
   appendRunpaths = [
-    "${pipewire.lib}/lib"
+    "${pipewire}/lib"
   ];
+  # Firefox uses "relrhack" to manually process relocations from a fixed offset
+  patchelfFlags = [ "--no-clobber-old-sections" ];
 
   installPhase =
     ''
diff --git a/pkgs/applications/networking/localproxy/default.nix b/pkgs/applications/networking/localproxy/default.nix
index 019da4695124..719b730817b4 100644
--- a/pkgs/applications/networking/localproxy/default.nix
+++ b/pkgs/applications/networking/localproxy/default.nix
@@ -3,14 +3,14 @@
 , fetchFromGitHub
 , cmake
 , openssl
-, protobuf3_21
+, protobuf_21
 , catch2
 , boost181
 , icu
 }:
 let
   boost = boost181.override { enableStatic = true; };
-  protobuf = protobuf3_21.override { enableShared = false; };
+  protobuf = protobuf_21.override { enableShared = false; };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "localproxy";
diff --git a/pkgs/applications/networking/mailreaders/neomutt/default.nix b/pkgs/applications/networking/mailreaders/neomutt/default.nix
index 9ac8c83dc5e7..8d0bc45c4a02 100644
--- a/pkgs/applications/networking/mailreaders/neomutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/neomutt/default.nix
@@ -20,8 +20,9 @@ stdenv.mkDerivation rec {
     # https://github.com/neomutt/neomutt/issues/3773#issuecomment-1493295144
     ./fix-open-very-large-mailbox.patch
     (fetchpatch {
+      # https://github.com/neomutt/neomutt/pull/3933
       name = "disable-incorrect-tests.patch";
-      url = "https://github.com/neomutt/neomutt/pull/3933.patch";
+      url = "https://github.com/neomutt/neomutt/compare/f624551b86cdb53224b5b48304a808ca2815111e...a9a1d99e6c0fdf367188125451300fa89d3e801a.patch";
       hash = "sha256-Plei063T8XyXF4/7/nAb6/4OyXz72vBAXHwls9WL1vM=";
       excludes = [".github/workflows/macos.yml"];
     })
diff --git a/pkgs/applications/networking/p2p/freenet/default.nix b/pkgs/applications/networking/p2p/freenet/default.nix
index 8a46b5a476c1..3ca23647251a 100644
--- a/pkgs/applications/networking/p2p/freenet/default.nix
+++ b/pkgs/applications/networking/p2p/freenet/default.nix
@@ -16,8 +16,9 @@ let
 
   patches = [
     # gradle 7 support
+    # https://github.com/freenet/fred/pull/827
     (fetchpatch {
-      url = "https://github.com/freenet/fred/pull/827.patch";
+      url = "https://github.com/freenet/fred/commit/8991303493f2c0d9933f645337f0a7a5a979e70a.patch";
       sha256 = "sha256-T1zymxRTADVhhwp2TyB+BC/J4gZsT/CUuMrT4COlpTY=";
     })
   ];
diff --git a/pkgs/applications/science/logic/vampire/default.nix b/pkgs/applications/science/logic/vampire/default.nix
index 253c88705aea..a3c1aa3f131d 100644
--- a/pkgs/applications/science/logic/vampire/default.nix
+++ b/pkgs/applications/science/logic/vampire/default.nix
@@ -19,13 +19,13 @@ stdenv.mkDerivation rec {
     # https://github.com/vprover/vampire/pull/54
     (fetchpatch {
       name = "fix-apple-cygwin-defines.patch";
-      url = "https://github.com/vprover/vampire/pull/54.patch";
+      url = "https://github.com/vprover/vampire/commit/b4bddd3bcac6a7688742da75c369b7b3213f6d1c.patch";
       sha256 = "0i6nrc50wlg1dqxq38lkpx4rmfb3lf7s8f95l4jkvqp0nxa20cza";
     })
     # https://github.com/vprover/vampire/pull/55
     (fetchpatch {
       name = "fix-wait-any.patch";
-      url = "https://github.com/vprover/vampire/pull/55.patch";
+      url = "https://github.com/vprover/vampire/commit/6da10eabb333aec54cdf13833ea33cb851159543.patch";
       sha256 = "1pwfpwpl23bqsgkmmvw6bnniyvp5j9v8l3z9s9pllfabnfcrcz9l";
     })
   ];
diff --git a/pkgs/applications/version-management/hub/default.nix b/pkgs/applications/version-management/hub/default.nix
index 0ed9d70c4623..4486c71605da 100644
--- a/pkgs/applications/version-management/hub/default.nix
+++ b/pkgs/applications/version-management/hub/default.nix
@@ -23,13 +23,15 @@ buildGoModule rec {
 
   patches = [
     # Fix `fish` completions
+    # https://github.com/github/hub/pull/3036
     (fetchpatch {
-      url = "https://github.com/github/hub/pull/3036.patch";
+      url = "https://github.com/github/hub/commit/439b7699e79471fc789929bcdea2f30bd719963e.patch";
       hash = "sha256-pR/OkGa2ICR4n1pLNx8E2UTtLeDwFtXxeeTB94KFjC4=";
     })
     # Fix `bash` completions
+    # https://github.com/github/hub/pull/2948
     (fetchpatch {
-      url = "https://github.com/github/hub/pull/2948.patch";
+      url = "https://github.com/github/hub/commit/64b291006f208fc7db1d5be96ff7db5535f1d853.patch";
       hash = "sha256-jGFFIvSKEIpTQY0Wz63cqciUk25MzPHv5Z1ox8l7wmo=";
     })
   ];
diff --git a/pkgs/applications/video/kodi/unwrapped.nix b/pkgs/applications/video/kodi/unwrapped.nix
index bb2c34083515..0f0008bd7a1c 100644
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@@ -116,7 +116,7 @@ in stdenv.mkDerivation {
       # Remove with the next release: https://github.com/xbmc/xbmc/pull/23453
       (fetchpatch {
         name = "Fix fmt10 compat";
-        url = "https://github.com/xbmc/xbmc/pull/23453.patch";
+        url = "https://github.com/xbmc/xbmc/compare/acca69baa2eae65123e78ee2f77249181725ef5d...26c164a28cfd18ceef7a1f2bbba5bf8a4a5a750c.patch";
         hash = "sha256-zMUparbQ8gfgeXj8W3MDmPi5OgLNz/zGCJINU7H6Rx0=";
       })
     ];
diff --git a/pkgs/build-support/binary-cache/default.nix b/pkgs/build-support/binary-cache/default.nix
index 27f9ad962899..8c610c512276 100644
--- a/pkgs/build-support/binary-cache/default.nix
+++ b/pkgs/build-support/binary-cache/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages }:
+{ lib, stdenv, coreutils, jq, python3, nix, xz }:
 
 # This function is for creating a flat-file binary cache, i.e. the kind created by
 # nix copy --to file:///some/path and usable as a substituter (with the file:// prefix).
@@ -19,15 +19,10 @@ stdenv.mkDerivation {
 
   preferLocalBuild = true;
 
-  PATH = lib.makeBinPath (with buildPackages; [ coreutils jq python3 nix xz ]);
+  nativeBuildInputs = [ coreutils jq python3 nix xz ];
 
-  builder = builtins.toFile "builder" ''
-    . .attrs.sh
-
-    export out=''${outputs[out]}
-
-    mkdir $out
-    mkdir $out/nar
+  buildCommand = ''
+    mkdir -p $out/nar
 
     python ${./make-binary-cache.py}
 
diff --git a/pkgs/build-support/binary-cache/make-binary-cache.py b/pkgs/build-support/binary-cache/make-binary-cache.py
index 16dd8a7e96bc..589d005562b1 100644
--- a/pkgs/build-support/binary-cache/make-binary-cache.py
+++ b/pkgs/build-support/binary-cache/make-binary-cache.py
@@ -3,7 +3,7 @@ import json
 import os
 import subprocess
 
-with open(".attrs.json", "r") as f:
+with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f:
   closures = json.load(f)["closure"]
 
 os.chdir(os.environ["out"])
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 6c43f8cbfa6d..b8d170df01b7 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -246,7 +246,7 @@ if [[ -e @out@/nix-support/cc-wrapper-hook ]]; then
 fi
 
 if (( "${NIX_CC_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
-    responseFile=$(mktemp --tmpdir cc-params.XXXXXX)
+    responseFile=$(mktemp "${TMPDIR:-/tmp}/cc-params.XXXXXX")
     trap 'rm -f -- "$responseFile"' EXIT
     printf "%q\n" \
        ${extraBefore+"${extraBefore[@]}"} \
diff --git a/pkgs/build-support/closure-info.nix b/pkgs/build-support/closure-info.nix
index 6b3ff6fd62b0..f6c31bd786bb 100644
--- a/pkgs/build-support/closure-info.nix
+++ b/pkgs/build-support/closure-info.nix
@@ -4,7 +4,7 @@
 # "nix-store --load-db" and "nix-store --register-validity
 # --hash-given".
 
-{ stdenv, buildPackages }:
+{ stdenv, coreutils, jq }:
 
 { rootPaths }:
 
@@ -19,18 +19,16 @@ stdenv.mkDerivation {
 
   preferLocalBuild = true;
 
-  PATH = "${buildPackages.coreutils}/bin:${buildPackages.jq}/bin";
+  nativeBuildInputs = [ coreutils jq ];
 
-  builder = builtins.toFile "builder"
+  buildCommand =
     ''
-      . .attrs.sh
-
       out=''${outputs[out]}
 
       mkdir $out
 
-      jq -r ".closure | map(.narSize) | add" < .attrs.json > $out/total-nar-size
-      jq -r '.closure | map([.path, .narHash, .narSize, "", (.references | length)] + .references) | add | map("\(.)\n") | add' < .attrs.json | head -n -1 > $out/registration
-      jq -r .closure[].path < .attrs.json > $out/store-paths
+      jq -r ".closure | map(.narSize) | add" < "$NIX_ATTRS_JSON_FILE" > $out/total-nar-size
+      jq -r '.closure | map([.path, .narHash, .narSize, "", (.references | length)] + .references) | add | map("\(.)\n") | add' < "$NIX_ATTRS_JSON_FILE" | head -n -1 > $out/registration
+      jq -r '.closure[].path' < "$NIX_ATTRS_JSON_FILE" > $out/store-paths
     '';
 }
diff --git a/pkgs/build-support/fetchbzr/builder.sh b/pkgs/build-support/fetchbzr/builder.sh
index 991864719a07..4515e0e82f49 100644
--- a/pkgs/build-support/fetchbzr/builder.sh
+++ b/pkgs/build-support/fetchbzr/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source "$stdenv/setup"
 
 echo "exporting \`$url' (revision $rev) into \`$out'"
diff --git a/pkgs/build-support/fetchcvs/builder.sh b/pkgs/build-support/fetchcvs/builder.sh
index 4b49e9676ec0..7e4dde4a64c8 100644
--- a/pkgs/build-support/fetchcvs/builder.sh
+++ b/pkgs/build-support/fetchcvs/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 (echo "#!$SHELL"; \
diff --git a/pkgs/build-support/fetchdarcs/builder.sh b/pkgs/build-support/fetchdarcs/builder.sh
index 75b9066dba6f..39838db255a6 100644
--- a/pkgs/build-support/fetchdarcs/builder.sh
+++ b/pkgs/build-support/fetchdarcs/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 tagtext=""
diff --git a/pkgs/build-support/fetchdocker/fetchdocker-builder.sh b/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
index 4eb70f672d48..489914a2a8b4 100644
--- a/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
+++ b/pkgs/build-support/fetchdocker/fetchdocker-builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source "${stdenv}/setup"
 echo "exporting ${repository}/${imageName} (tag: ${tag}) into ${out}"
 mkdir -p "${out}"
diff --git a/pkgs/build-support/fetchfossil/builder.sh b/pkgs/build-support/fetchfossil/builder.sh
index 36b758ab574e..fe828d0ada9d 100644
--- a/pkgs/build-support/fetchfossil/builder.sh
+++ b/pkgs/build-support/fetchfossil/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 echo "Cloning Fossil $url [$rev] into $out"
 
diff --git a/pkgs/build-support/fetchgit/builder.sh b/pkgs/build-support/fetchgit/builder.sh
index 77f6381b09ab..95176beea8c1 100644
--- a/pkgs/build-support/fetchgit/builder.sh
+++ b/pkgs/build-support/fetchgit/builder.sh
@@ -3,7 +3,7 @@
 # - revision specified and remote has a HEAD
 # - revision specified and remote without HEAD
 #
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 echo "exporting $url (rev $rev) into $out"
diff --git a/pkgs/build-support/fetchhg/builder.sh b/pkgs/build-support/fetchhg/builder.sh
index 1ce294757713..20dfde4b10d4 100644
--- a/pkgs/build-support/fetchhg/builder.sh
+++ b/pkgs/build-support/fetchhg/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 echo "getting $url${rev:+ ($rev)} into $out"
 
diff --git a/pkgs/build-support/fetchipfs/builder.sh b/pkgs/build-support/fetchipfs/builder.sh
index ca77962b5384..1ddd111b1518 100644
--- a/pkgs/build-support/fetchipfs/builder.sh
+++ b/pkgs/build-support/fetchipfs/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 # Curl flags to handle redirects, not use EPSV, handle cookies for
diff --git a/pkgs/build-support/fetchmtn/builder.sh b/pkgs/build-support/fetchmtn/builder.sh
index 1aabd7949ee1..de929fad55a9 100644
--- a/pkgs/build-support/fetchmtn/builder.sh
+++ b/pkgs/build-support/fetchmtn/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 set -x
diff --git a/pkgs/build-support/fetchsvn/builder.sh b/pkgs/build-support/fetchsvn/builder.sh
index aa4d049aba43..e187747f14e6 100644
--- a/pkgs/build-support/fetchsvn/builder.sh
+++ b/pkgs/build-support/fetchsvn/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 echo "exporting $url (r$rev) into $out"
diff --git a/pkgs/build-support/fetchsvnssh/builder.sh b/pkgs/build-support/fetchsvnssh/builder.sh
index 5782151524f7..e553446346de 100644
--- a/pkgs/build-support/fetchsvnssh/builder.sh
+++ b/pkgs/build-support/fetchsvnssh/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 echo "exporting $url (r$rev) into $out"
diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index e8eaba934858..a82728ef1025 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 source $mirrorsFile
diff --git a/pkgs/build-support/references-by-popularity/default.nix b/pkgs/build-support/references-by-popularity/default.nix
index dfc25275f34c..2171c622f000 100644
--- a/pkgs/build-support/references-by-popularity/default.nix
+++ b/pkgs/build-support/references-by-popularity/default.nix
@@ -6,11 +6,8 @@ path: runCommand "closure-paths"
   exportReferencesGraph.graph = path;
   __structuredAttrs = true;
   preferLocalBuild = true;
-  PATH = "${coreutils}/bin:${python3}/bin";
-  builder = builtins.toFile "builder"
-    ''
-      . .attrs.sh
-      python3 ${./closure-graph.py} .attrs.json graph > ''${outputs[out]}
-    '';
-  }
-  ""
+  nativeBuildInputs = [ coreutils python3 ];
+}
+''
+  python3 ${./closure-graph.py} "$NIX_ATTRS_JSON_FILE" graph > ''${outputs[out]}
+''
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 18d8ca56fd1f..0b28121a5b7a 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -156,7 +156,8 @@ stdenv.mkDerivation ((removeAttrs args [ "depsExtraArgs" "cargoUpdateHook" "carg
       # Platforms without host tools from
       # https://doc.rust-lang.org/nightly/rustc/platform-support.html
       "armv7a-darwin"
-      "armv5tel-linux" "armv7a-linux" "m68k-linux" "riscv32-linux"
+      "armv5tel-linux" "armv7a-linux" "m68k-linux" "mipsel-linux"
+      "mips64el-linux" "riscv32-linux"
       "armv6l-netbsd"
       "x86_64-redox"
       "wasm32-wasi"
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.py b/pkgs/build-support/setup-hooks/auto-patchelf.py
index 965384b876fc..261f55854808 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.py
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.py
@@ -174,7 +174,7 @@ class Dependency:
     found: bool = False     # Whether it was found somewhere
 
 
-def auto_patchelf_file(path: Path, runtime_deps: list[Path], append_rpaths: List[Path] = []) -> list[Dependency]:
+def auto_patchelf_file(path: Path, runtime_deps: list[Path], append_rpaths: List[Path] = [], extra_args: List[str] = []) -> list[Dependency]:
     try:
         with open_elf(path) as elf:
 
@@ -213,7 +213,7 @@ def auto_patchelf_file(path: Path, runtime_deps: list[Path], append_rpaths: List
     if file_is_dynamic_executable:
         print("setting interpreter of", path)
         subprocess.run(
-                ["patchelf", "--set-interpreter", interpreter_path.as_posix(), path.as_posix()],
+                ["patchelf", "--set-interpreter", interpreter_path.as_posix(), path.as_posix()] + extra_args,
                 check=True)
         rpath += runtime_deps
 
@@ -250,7 +250,7 @@ def auto_patchelf_file(path: Path, runtime_deps: list[Path], append_rpaths: List
     if rpath:
         print("setting RPATH to:", rpath_str)
         subprocess.run(
-                ["patchelf", "--set-rpath", rpath_str, path.as_posix()],
+                ["patchelf", "--set-rpath", rpath_str, path.as_posix()] + extra_args,
                 check=True)
 
     return dependencies
@@ -262,7 +262,8 @@ def auto_patchelf(
         runtime_deps: List[Path],
         recursive: bool = True,
         ignore_missing: List[str] = [],
-        append_rpaths: List[Path] = []) -> None:
+        append_rpaths: List[Path] = [],
+        extra_args: List[str] = []) -> None:
 
     if not paths_to_patch:
         sys.exit("No paths to patch, stopping.")
@@ -275,7 +276,7 @@ def auto_patchelf(
     dependencies = []
     for path in chain.from_iterable(glob(p, '*', recursive) for p in paths_to_patch):
         if not path.is_symlink() and path.is_file():
-            dependencies += auto_patchelf_file(path, runtime_deps, append_rpaths)
+            dependencies += auto_patchelf_file(path, runtime_deps, append_rpaths, extra_args)
 
     missing = [dep for dep in dependencies if not dep.found]
 
@@ -333,6 +334,12 @@ def main() -> None:
         type=Path,
         help="Paths to append to all runtime paths unconditionally",
     )
+    parser.add_argument(
+        "--extra-args",
+        nargs="*",
+        type=str,
+        help="Extra arguments to pass to patchelf"
+    )
 
     print("automatically fixing dependencies for ELF files")
     args = parser.parse_args()
@@ -344,7 +351,8 @@ def main() -> None:
         args.runtime_dependencies,
         args.recursive,
         args.ignore_missing,
-        append_rpaths=args.append_rpaths)
+        append_rpaths=args.append_rpaths,
+        extra_args=args.extra_args)
 
 
 interpreter_path: Path  = None # type: ignore
diff --git a/pkgs/build-support/setup-hooks/auto-patchelf.sh b/pkgs/build-support/setup-hooks/auto-patchelf.sh
index 0625565606f3..371389df427b 100644
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@@ -63,6 +63,7 @@ autoPatchelf() {
 
     local appendRunpathsArray=($appendRunpaths)
     local runtimeDependenciesArray=($runtimeDependencies)
+    local patchelfFlagsArray=($patchelfFlags)
     @pythonInterpreter@ @autoPatchelfScript@                            \
         ${norecurse:+--no-recurse}                                      \
         --ignore-missing "${ignoreMissingDepsArray[@]}"                 \
@@ -70,7 +71,8 @@ autoPatchelf() {
         --libs "${autoPatchelfLibs[@]}"                                 \
                "${extraAutoPatchelfLibs[@]}"                            \
         --runtime-dependencies "${runtimeDependenciesArray[@]/%//lib}"  \
-        --append-rpaths "${appendRunpathsArray[@]}"
+        --append-rpaths "${appendRunpathsArray[@]}"                     \
+        --extra-args "${patchelfFlagsArray[@]}"
 }
 
 # XXX: This should ultimately use fixupOutputHooks but we currently don't have
diff --git a/pkgs/by-name/ar/arrpc/package.nix b/pkgs/by-name/ar/arrpc/package.nix
index 15ad34b39d7f..eeb4dd4fef25 100644
--- a/pkgs/by-name/ar/arrpc/package.nix
+++ b/pkgs/by-name/ar/arrpc/package.nix
@@ -21,7 +21,8 @@ buildNpmPackage {
   # Remove after next release
   patches = [
     (fetchpatch {
-      url = "https://github.com/OpenAsar/arrpc/pull/50.patch";
+      # https://github.com/OpenAsar/arrpc/pull/50
+      url = "https://github.com/OpenAsar/arrpc/commit/7fa6c90204450eb3952ce9cddfecb0a5ba5e4313.patch";
       hash = "sha256-qFlrbe2a4x811wpmWUcGDe2CPlt9x3HI+/t0P2v4kPc=";
     })
   ];
diff --git a/pkgs/by-name/ju/justbuild/package.nix b/pkgs/by-name/ju/justbuild/package.nix
index 3403edcaaccf..d630bdf22b30 100644
--- a/pkgs/by-name/ju/justbuild/package.nix
+++ b/pkgs/by-name/ju/justbuild/package.nix
@@ -11,7 +11,7 @@
   openssl,
 
   pkg-config,
-  protobuf3_23,
+  protobuf_23,
   grpc,
   pandoc,
   python3,
@@ -87,14 +87,14 @@ stdenv.mkDerivation rec {
     # For future updates: The currently used version can be found in the file
     # etc/repos.json: https://github.com/just-buildsystem/justbuild/blob/master/etc/repos.json
     # under the key .repositories.protobuf
-    protobuf3_23
+    protobuf_23
     python3
   ];
 
   postPatch = ''
     sed -ie 's|\./bin/just-mr.py|${python3}/bin/python3 ./bin/just-mr.py|' bin/bootstrap.py
     sed -ie 's|#!/usr/bin/env python3|#!${python3}/bin/python3|' bin/parallel-bootstrap-traverser.py
-    jq '.repositories.protobuf.pkg_bootstrap.local_path = "${protobuf3_23}"' etc/repos.json > etc/repos.json.patched
+    jq '.repositories.protobuf.pkg_bootstrap.local_path = "${protobuf_23}"' etc/repos.json > etc/repos.json.patched
     mv etc/repos.json.patched etc/repos.json
     jq '.repositories.com_github_grpc_grpc.pkg_bootstrap.local_path = "${grpc}"' etc/repos.json > etc/repos.json.patched
     mv etc/repos.json.patched etc/repos.json
diff --git a/pkgs/data/misc/shared-mime-info/default.nix b/pkgs/data/misc/shared-mime-info/default.nix
index 197793db6c66..8de13f2eaf36 100644
--- a/pkgs/data/misc/shared-mime-info/default.nix
+++ b/pkgs/data/misc/shared-mime-info/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "shared-mime-info";
-  version = "2.2";
+  version = "2.3";
 
   outputs = [ "out" "dev" ];
 
@@ -23,9 +23,15 @@ stdenv.mkDerivation rec {
     owner = "xdg";
     repo = pname;
     rev = version;
-    sha256 = "sha256-QrRe/DcjpTMejHXDSOLbjpJywod8qIjP6/leTZ21rhE=";
+    sha256 = "sha256-cEfknRVtOJykEO9Iqlb0UoiayYtu+ugvmmZqAD5cGnE=";
   };
 
+  patches = [
+    # Submitted upstream at
+    # https://gitlab.freedesktop.org/xdg/shared-mime-info/-/issues/211
+    ./fix-clang-warnings.patch
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/data/misc/shared-mime-info/fix-clang-warnings.patch b/pkgs/data/misc/shared-mime-info/fix-clang-warnings.patch
new file mode 100644
index 000000000000..2d185549c4e6
--- /dev/null
+++ b/pkgs/data/misc/shared-mime-info/fix-clang-warnings.patch
@@ -0,0 +1,31 @@
+diff --git a/meson.build b/meson.build
+index 1780c44..7998a51 100644
+--- a/meson.build
++++ b/meson.build
+@@ -49,12 +49,7 @@ endif
+ ###############################################################################
+ # Dependencies
+ 
+-check_functions = [
+-    'fdatasync',
+-]
+-foreach function : check_functions
+-    config.set('HAVE_'+function.to_upper(), cc.has_function(function))
+-endforeach
++config.set('HAVE_FDATASYNC', cc.has_function('fdatasync', prefix: '#include <unistd.h>'))
+ 
+ 
+ if get_option('build-translations')
+diff --git a/src/update-mime-database.cpp b/src/update-mime-database.cpp
+index 733ba06..4ca6d06 100644
+--- a/src/update-mime-database.cpp
++++ b/src/update-mime-database.cpp
+@@ -2158,7 +2158,7 @@ static void check_in_path_xdg_data(const char *mime_path)
+ 
+ 	env = getenv("XDG_DATA_DIRS");
+ 	if (!env)
+-		env = "/usr/local/share/"PATH_SEPARATOR"/usr/share/";
++		env = "/usr/local/share/" PATH_SEPARATOR "/usr/share/";
+ 	dirs = g_strsplit(env, PATH_SEPARATOR, 0);
+ 	g_return_if_fail(dirs != NULL);
+ 	for (n = 0; dirs[n]; n++)
diff --git a/pkgs/desktops/gnustep/make/builder.sh b/pkgs/desktops/gnustep/make/builder.sh
index 736635ab5026..79ead3f7b729 100644
--- a/pkgs/desktops/gnustep/make/builder.sh
+++ b/pkgs/desktops/gnustep/make/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 providedPreConfigure="$preConfigure";
diff --git a/pkgs/development/compilers/aspectj/builder.sh b/pkgs/development/compilers/aspectj/builder.sh
index 7ea0a40d3748..31ec97942e52 100755
--- a/pkgs/development/compilers/aspectj/builder.sh
+++ b/pkgs/development/compilers/aspectj/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 export JAVA_HOME=$jre
diff --git a/pkgs/development/compilers/binaryen/default.nix b/pkgs/development/compilers/binaryen/default.nix
index 5a139fb29064..dcadf054bc30 100644
--- a/pkgs/development/compilers/binaryen/default.nix
+++ b/pkgs/development/compilers/binaryen/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "binaryen";
-  version = "114";
+  version = "116";
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "binaryen";
     rev = "version_${version}";
-    hash = "sha256-bzHNIQy0AN8mIFGG+638p/MBSqlkWuaOzKGSsMDAPH4=";
+    hash = "sha256-gMwbWiP+YDCVafQMBWhTuJGWmkYtnhEdn/oofKaUT08=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/compilers/chicken/4/fetchegg/builder.sh b/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
index cb56eabc5d78..78535382a7ca 100644
--- a/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
+++ b/pkgs/development/compilers/chicken/4/fetchegg/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 echo "exporting egg ${eggName} (version $version) into $out"
diff --git a/pkgs/development/compilers/emscripten/default.nix b/pkgs/development/compilers/emscripten/default.nix
index 37ccb5f1a02b..436fda2a0521 100644
--- a/pkgs/development/compilers/emscripten/default.nix
+++ b/pkgs/development/compilers/emscripten/default.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "emscripten";
-  version = "3.1.45";
+  version = "3.1.47";
 
   llvmEnv = symlinkJoin {
     name = "emscripten-llvm-${version}";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     name = "emscripten-node-modules-${version}";
     inherit pname version src;
 
-    npmDepsHash = "sha256-kcWAio1fKuwqFCFlupX9KevjWPbv9W/Z/5EPrihQ6ms=";
+    npmDepsHash = "sha256-Qft+//za5ed6Oquxtcdpv7g5oOc2WmWuRJ/CDe+FEiI=";
 
     dontBuild = true;
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "emscripten-core";
     repo = "emscripten";
-    hash = "sha256-yf0Yb/UjaBQpIEPZzzjaUmR+JzKPSJHMkrYLHxDXwOg=";
+    hash = "sha256-cRNkQ+7vUqJLNlf5dieeDcyT1jlBUeVxO8avoUvOPHI=";
     rev = version;
   };
 
@@ -85,6 +85,9 @@ stdenv.mkDerivation rec {
     cp -r . $appdir
     chmod -R +w $appdir
 
+    mkdir -p $appdir/node_modules
+    cp -r ${nodeModules}/* $appdir/node_modules
+
     mkdir -p $out/bin
     for b in em++ em-config emar embuilder.py emcc emcmake emconfigure emmake emranlib emrun emscons emsize; do
       makeWrapper $appdir/$b $out/bin/$b \
diff --git a/pkgs/development/compilers/fpc/binary-builder-darwin.sh b/pkgs/development/compilers/fpc/binary-builder-darwin.sh
index 39db0518281d..8a8600f1f639 100755
--- a/pkgs/development/compilers/fpc/binary-builder-darwin.sh
+++ b/pkgs/development/compilers/fpc/binary-builder-darwin.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 pkgdir=$(pwd)/pkg
diff --git a/pkgs/development/compilers/fpc/binary-builder.sh b/pkgs/development/compilers/fpc/binary-builder.sh
index c471378c275f..568c3094107a 100755
--- a/pkgs/development/compilers/fpc/binary-builder.sh
+++ b/pkgs/development/compilers/fpc/binary-builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 tar xf $src
diff --git a/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch b/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
new file mode 100644
index 000000000000..d938d67a2d06
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
@@ -0,0 +1,85 @@
+From b10785c1be469319a09b10bc69db21159b0599ee Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <siarheit@google.com>
+Date: Fri, 22 Sep 2023 22:41:49 +0100
+Subject: [PATCH] gcc/file-prefix-map.cc: always mangle __FILE__ into invalid
+ store path
+
+Without the change `__FILE__` used in static inline functions in headers
+embed paths to header files into executable images. For local headers
+it's not a problem, but for headers in `/nix/store` this causes `-dev`
+inputs to be retained in runtime closure.
+
+Typical examples are `nix` -> `nlohmann_json` and `pipewire` ->
+`lttng-ust.dev`.
+
+Ideally we would like to use `-fmacro-prefix-map=` feature of `gcc` as:
+
+  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/eeee.eee-nlohmann-json-ver
+  -fmacro-prefix-map=/nix/...
+
+In practice it quickly exhausts argument lengtth limit due to `gcc`
+deficiency: https://gcc.gnu.org/PR111527
+
+Until it;s fixed let's hardcode header mangling if $NIX_STORE variable
+is present in the environment.
+
+Tested as:
+
+    $ printf "# 0 \"/nix/store/01234567890123456789012345678901-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
+    ...
+    .string "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-pppppp-vvvvvvv"
+    ...
+
+Mangled successfully.
+--- a/gcc/file-prefix-map.cc
++++ b/gcc/file-prefix-map.cc
+@@ -60,6 +60,9 @@ add_prefix_map (file_prefix_map *&maps, const char *arg, const char *opt)
+   maps = map;
+ }
+ 
++/* Forward declaration for a $NIX_STORE remap hack below. */
++static file_prefix_map *macro_prefix_maps; /* -fmacro-prefix-map  */
++
+ /* Perform user-specified mapping of filename prefixes.  Return the
+    GC-allocated new name corresponding to FILENAME or FILENAME if no
+    remapping was performed.  */
+@@ -76,7 +79,30 @@ remap_filename (file_prefix_map *maps, const char *filename)
+     if (filename_ncmp (filename, map->old_prefix, map->old_len) == 0)
+       break;
+   if (!map)
+-    return filename;
++    {
++      if (maps == macro_prefix_maps)
++	{
++	  /* Remap all fo $NIX_STORE/.{32} paths to
++	  * equivalent $NIX_STORE/e{32}.
++	  *
++	  * That way we avoid argument parameters explosion
++	  * and still avoid embedding headers into runtime closure:
++	  *   https://gcc.gnu.org/PR111527
++	  */
++	  char * nix_store = getenv("NIX_STORE");
++	  size_t nix_store_len = nix_store ? strlen(nix_store) : 0;
++	  const char * name = filename;
++	  size_t name_len = strlen(name);
++	  if (nix_store && name_len >= nix_store_len + 1 + 32 && memcmp(name, nix_store, nix_store_len) == 0)
++	    {
++	       s = (char *) ggc_alloc_atomic (name_len + 1);
++	       memcpy(s, name, name_len + 1);
++	       memset(s + nix_store_len + 1, 'e', 32);
++	       return s;
++	    }
++	}
++      return filename;
++    }
+   name = filename + map->old_len;
+   name_len = strlen (name) + 1;
+ 
+@@ -90,7 +116,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
+    ignore it in DW_AT_producer (dwarf2out.cc).  */
+ 
+ /* Linked lists of file_prefix_map structures.  */
+-static file_prefix_map *macro_prefix_maps; /* -fmacro-prefix-map  */
+ static file_prefix_map *debug_prefix_maps; /* -fdebug-prefix-map  */
+ static file_prefix_map *profile_prefix_maps; /* -fprofile-prefix-map  */
+ 
diff --git a/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch b/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
new file mode 100644
index 000000000000..57ae2111f020
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
@@ -0,0 +1,84 @@
+From b10785c1be469319a09b10bc69db21159b0599ee Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <siarheit@google.com>
+Date: Fri, 22 Sep 2023 22:41:49 +0100
+Subject: [PATCH] gcc/file-prefix-map.cc: always mangle __FILE__ into invalid
+ store path
+
+Without the change `__FILE__` used in static inline functions in headers
+embed paths to header files into executable images. For local headers
+it's not a problem, but for headers in `/nix/store` this causes `-dev`
+inputs to be retained in runtime closure.
+
+Typical examples are `nix` -> `nlohmann_json` and `pipewire` ->
+`lttng-ust.dev`.
+
+Ideally we would like to use `-fmacro-prefix-map=` feature of `gcc` as:
+
+  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/eeee.eee-nlohmann-json-ver
+  -fmacro-prefix-map=/nix/...
+
+In practice it quickly exhausts argument lengtth limit due to `gcc`
+deficiency: https://gcc.gnu.org/PR111527
+
+Until it;s fixed let's hardcode header mangling if $NIX_STORE variable
+is present in the environment.
+
+Tested as:
+
+    $ printf "# 0 \"/nix/store/01234567890123456789012345678901-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
+    ...
+    .string "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-pppppp-vvvvvvv"
+    ...
+
+Mangled successfully.
+--- a/gcc/file-prefix-map.cc
++++ b/gcc/file-prefix-map.cc
+@@ -69,6 +69,9 @@ add_prefix_map (file_prefix_map *&maps, const char *arg, const char *opt)
+   maps = map;
+ }
+ 
++/* Forward declaration for a $NIX_STORE remap hack below. */
++static file_prefix_map *macro_prefix_maps; /* -fmacro-prefix-map  */
++
+ /* Perform user-specified mapping of filename prefixes.  Return the
+    GC-allocated new name corresponding to FILENAME or FILENAME if no
+    remapping was performed.  */
+@@ -102,6 +105,29 @@ remap_filename (file_prefix_map *maps, const char *filename)
+       break;
+   if (!map)
+     {
++      if (maps == macro_prefix_maps)
++	{
++	  /* Remap all fo $NIX_STORE/.{32} paths to
++	   * equivalent $NIX_STORE/e{32}.
++	   *
++	   * That way we avoid argument parameters explosion
++	   * and still avoid embedding headers into runtime closure:
++	   *   https://gcc.gnu.org/PR111527
++	   */
++	   char * nix_store = getenv("NIX_STORE");
++	   size_t nix_store_len = nix_store ? strlen(nix_store) : 0;
++	   const char * name = realname ? realname : filename;
++	   size_t name_len = strlen(name);
++	   if (nix_store && name_len >= nix_store_len + 1 + 32 && memcmp(name, nix_store, nix_store_len) == 0)
++	     {
++		s = (char *) ggc_alloc_atomic (name_len + 1);
++		memcpy(s, name, name_len + 1);
++		memset(s + nix_store_len + 1, 'e', 32);
++		if (realname != filename)
++		  free (const_cast <char *> (realname));
++		return s;
++	     }
++	}
+       if (realname != filename)
+ 	free (const_cast <char *> (realname));
+       return filename;
+@@ -124,7 +150,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
+    ignore it in DW_AT_producer (gen_command_line_string in opts.cc).  */
+ 
+ /* Linked lists of file_prefix_map structures.  */
+-static file_prefix_map *macro_prefix_maps; /* -fmacro-prefix-map  */
+ static file_prefix_map *debug_prefix_maps; /* -fdebug-prefix-map  */
+ static file_prefix_map *profile_prefix_maps; /* -fprofile-prefix-map  */
+ 
+
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 0afc6586511a..4491c3fde47d 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -63,8 +63,8 @@ in
 ++ optionals (noSysDirs) (
   [(if atLeast12 then ./gcc-12-no-sys-dirs.patch else ./no-sys-dirs.patch)] ++
   ({
-    "13" = [ ./13/no-sys-dirs-riscv.patch ];
-    "12" = [ ./no-sys-dirs-riscv.patch ];
+    "13" = [ ./13/no-sys-dirs-riscv.patch ./13/mangle-NIX_STORE-in-__FILE__.patch ];
+    "12" = [ ./no-sys-dirs-riscv.patch ./12/mangle-NIX_STORE-in-__FILE__.patch ];
     "11" = [ ./no-sys-dirs-riscv.patch ];
     "10" = [ ./no-sys-dirs-riscv.patch ];
     "9"  = [ ./no-sys-dirs-riscv-gcc9.patch ];
diff --git a/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh b/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
index 47459664af0a..4eef8acb0693 100644
--- a/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
+++ b/pkgs/development/compilers/ios-cross-compile/9.2_builder.sh
@@ -1,5 +1,5 @@
 # -*- shell-script -*-
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 function extract
diff --git a/pkgs/development/compilers/llvm/16/lld/add-table-base.patch b/pkgs/development/compilers/llvm/16/lld/add-table-base.patch
new file mode 100644
index 000000000000..15fc903a5e3f
--- /dev/null
+++ b/pkgs/development/compilers/llvm/16/lld/add-table-base.patch
@@ -0,0 +1,190 @@
+From 93adcb770b99351b18553089c164fe3ef2119699 Mon Sep 17 00:00:00 2001
+From: Sam Clegg <sbc@chromium.org>
+Date: Fri, 25 Aug 2023 13:56:16 -0700
+Subject: [PATCH] [lld][WebAssembly] Add `--table-base` setting
+
+This is similar to `--global-base` but determines where to place the
+table segments rather than that data segments.
+
+See https://github.com/emscripten-core/emscripten/issues/20097
+
+Differential Revision: https://reviews.llvm.org/D158892
+---
+ test/wasm/table-base.s | 72 ++++++++++++++++++++++++++++++++++++++
+ wasm/Driver.cpp        | 19 ++++++++--
+ wasm/Options.td        |  5 ++-
+ wasm/Writer.cpp        |  8 -----
+ 4 files changed, 93 insertions(+), 11 deletions(-)
+ create mode 100644 test/wasm/table-base.s
+
+diff --git a/test/wasm/table-base.s b/test/wasm/table-base.s
+new file mode 100644
+index 000000000000000..56fff414fd31d96
+--- /dev/null
++++ b/test/wasm/table-base.s
+@@ -0,0 +1,72 @@
++# RUN: llvm-mc -filetype=obj -triple=wasm32-unknown-unknown %s -o %t.o
++
++# RUN: wasm-ld --export=__table_base -o %t.wasm %t.o
++# RUN: obj2yaml %t.wasm | FileCheck %s  -check-prefix=CHECK-DEFAULT
++
++# RUN: wasm-ld --table-base=100 --export=__table_base -o %t.wasm %t.o
++# RUN: obj2yaml %t.wasm | FileCheck %s  -check-prefix=CHECK-100
++
++.globl _start
++_start:
++  .functype _start () -> ()
++  i32.const _start
++  drop
++  end_function
++
++# CHECK-DEFAULT:       - Type:            TABLE
++# CHECK-DEFAULT-NEXT:    Tables:
++# CHECK-DEFAULT-NEXT:      - Index:           0
++# CHECK-DEFAULT-NEXT:        ElemType:        FUNCREF
++# CHECK-DEFAULT-NEXT:        Limits:
++# CHECK-DEFAULT-NEXT:          Flags:           [ HAS_MAX ]
++# CHECK-DEFAULT-NEXT:          Minimum:         0x2
++# CHECK-DEFAULT-NEXT:          Maximum:         0x2
++
++# CHECK-DEFAULT:       - Type:            GLOBAL
++# CHECK-DEFAULT-NEXT:    Globals:
++# CHECK-DEFAULT-NEXT:      - Index:           0
++# CHECK-DEFAULT-NEXT:        Type:            I32
++# CHECK-DEFAULT-NEXT:        Mutable:         true
++# CHECK-DEFAULT-NEXT:        InitExpr:
++# CHECK-DEFAULT-NEXT:          Opcode:          I32_CONST
++# CHECK-DEFAULT-NEXT:          Value:           66560
++# CHECK-DEFAULT-NEXT:      - Index:           1
++# CHECK-DEFAULT-NEXT:        Type:            I32
++# CHECK-DEFAULT-NEXT:        Mutable:         false
++# CHECK-DEFAULT-NEXT:        InitExpr:
++# CHECK-DEFAULT-NEXT:          Opcode:          I32_CONST
++# CHECK-DEFAULT-NEXT:          Value:           1
++
++# CHECK-DEFAULT:       - Type:            EXPORT
++# CHECK-DEFAULT:           - Name:            __table_base
++# CHECK-DEFAULT-NEXT:        Kind:            GLOBAL
++# CHECK-DEFAULT-NEXT:        Index:           1
++
++# CHECK-100:       - Type:            TABLE
++# CHECK-100-NEXT:    Tables:
++# CHECK-100-NEXT:      - Index:           0
++# CHECK-100-NEXT:        ElemType:        FUNCREF
++# CHECK-100-NEXT:        Limits:
++# CHECK-100-NEXT:          Flags:           [ HAS_MAX ]
++# CHECK-100-NEXT:          Minimum:         0x65
++# CHECK-100-NEXT:          Maximum:         0x65
++
++# CHECK-100:       - Type:            GLOBAL
++# CHECK-100-NEXT:    Globals:
++# CHECK-100-NEXT:      - Index:           0
++# CHECK-100-NEXT:        Type:            I32
++# CHECK-100-NEXT:        Mutable:         true
++# CHECK-100-NEXT:        InitExpr:
++# CHECK-100-NEXT:          Opcode:          I32_CONST
++# CHECK-100-NEXT:          Value:           66560
++# CHECK-100-NEXT:      - Index:           1
++# CHECK-100-NEXT:        Type:            I32
++# CHECK-100-NEXT:        Mutable:         false
++# CHECK-100-NEXT:        InitExpr:
++# CHECK-100-NEXT:          Opcode:          I32_CONST
++# CHECK-100-NEXT:          Value:           100
++
++# CHECK-100:       - Type:            EXPORT
++# CHECK-100:           - Name:            __table_base
++# CHECK-100-NEXT:        Kind:            GLOBAL
++# CHECK-100-NEXT:        Index:           1
+diff --git a/wasm/Driver.cpp b/wasm/Driver.cpp
+index 84304881f5ca34e..c2f5f0185781f36 100644
+--- a/wasm/Driver.cpp
++++ b/wasm/Driver.cpp
+@@ -502,6 +502,7 @@ static void readConfigs(opt::InputArgList &args) {
+ 
+   config->initialMemory = args::getInteger(args, OPT_initial_memory, 0);
+   config->globalBase = args::getInteger(args, OPT_global_base, 0);
++  config->tableBase = args::getInteger(args, OPT_table_base, 0);
+   config->maxMemory = args::getInteger(args, OPT_max_memory, 0);
+   config->zStackSize =
+       args::getZOptionValue(args, OPT_z, "stack-size", WasmPageSize);
+@@ -573,6 +574,17 @@ static void setConfigs() {
+     if (config->exportTable)
+       error("-shared/-pie is incompatible with --export-table");
+     config->importTable = true;
++  } else {
++    // Default table base.  Defaults to 1, reserving 0 for the NULL function
++    // pointer.
++    if (!config->tableBase)
++      config->tableBase = 1;
++    // The default offset for static/global data, for when --global-base is
++    // not specified on the command line.  The precise value of 1024 is
++    // somewhat arbitrary, and pre-dates wasm-ld (Its the value that
++    // emscripten used prior to wasm-ld).
++    if (!config->globalBase && !config->relocatable && !config->stackFirst)
++      config->globalBase = 1024;
+   }
+ 
+   if (config->relocatable) {
+@@ -666,8 +678,11 @@ static void checkOptions(opt::InputArgList &args) {
+     warn("-Bsymbolic is only meaningful when combined with -shared");
+   }
+ 
+-  if (config->globalBase && config->isPic) {
+-    error("--global-base may not be used with -shared/-pie");
++  if (config->isPic) {
++    if (config->globalBase)
++      error("--global-base may not be used with -shared/-pie");
++    if (config->tableBase)
++      error("--table-base may not be used with -shared/-pie");
+   }
+ }
+ 
+diff --git a/wasm/Options.td b/wasm/Options.td
+index 50417d2928e0a34..bb764396bf4df14 100644
+--- a/wasm/Options.td
++++ b/wasm/Options.td
+@@ -191,7 +191,7 @@ def growable_table: FF<"growable-table">,
+   HelpText<"Remove maximum size from function table, allowing table to grow">;
+ 
+ def global_base: JJ<"global-base=">,
+-  HelpText<"Where to start to place global data">;
++  HelpText<"Memory offset at which to place global data (Defaults to 1024)">;
+ 
+ def import_memory: FF<"import-memory">,
+   HelpText<"Import the module's memory from the default module of \"env\" with the name \"memory\".">;
+@@ -224,6 +224,9 @@ def no_entry: FF<"no-entry">,
+ def stack_first: FF<"stack-first">,
+   HelpText<"Place stack at start of linear memory rather than after data">;
+ 
++def table_base: JJ<"table-base=">,
++  HelpText<"Table offset at which to place address taken functions (Defaults to 1)">;
++
+ defm whole_archive: B<"whole-archive",
+     "Force load of all members in a static library",
+     "Do not force load of all members in a static library (default)">;
+diff --git a/wasm/Writer.cpp b/wasm/Writer.cpp
+index f25d358dc5bae6f..0576bf2907e49c4 100644
+--- a/wasm/Writer.cpp
++++ b/wasm/Writer.cpp
+@@ -358,13 +358,6 @@ void Writer::layoutMemory() {
+       memoryPtr = config->globalBase;
+     }
+   } else {
+-    if (!config->globalBase && !config->relocatable && !config->isPic) {
+-      // The default offset for static/global data, for when --global-base is
+-      // not specified on the command line.  The precise value of 1024 is
+-      // somewhat arbitrary, and pre-dates wasm-ld (Its the value that
+-      // emscripten used prior to wasm-ld).
+-      config->globalBase = 1024;
+-    }
+     memoryPtr = config->globalBase;
+   }
+ 
+@@ -1685,7 +1678,6 @@ void Writer::run() {
+   // For PIC code the table base is assigned dynamically by the loader.
+   // For non-PIC, we start at 1 so that accessing table index 0 always traps.
+   if (!config->isPic) {
+-    config->tableBase = 1;
+     if (WasmSym::definedTableBase)
+       WasmSym::definedTableBase->setVA(config->tableBase);
+     if (WasmSym::definedTableBase32)
diff --git a/pkgs/development/compilers/llvm/16/lld/default.nix b/pkgs/development/compilers/llvm/16/lld/default.nix
index cc18aee76a44..84943e8effce 100644
--- a/pkgs/development/compilers/llvm/16/lld/default.nix
+++ b/pkgs/development/compilers/llvm/16/lld/default.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./gnu-install-dirs.patch
+    ./add-table-base.patch
   ];
 
   nativeBuildInputs = [ cmake ninja ];
diff --git a/pkgs/development/compilers/ocaml/builder.sh b/pkgs/development/compilers/ocaml/builder.sh
index 88acc0654cf2..85b26848f4e4 100644
--- a/pkgs/development/compilers/ocaml/builder.sh
+++ b/pkgs/development/compilers/ocaml/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 configureFlags="-prefix $out $configureFlags"
diff --git a/pkgs/development/compilers/rust/1_72.nix b/pkgs/development/compilers/rust/1_73.nix
index f540c229c6ff..37e75e0a7a4f 100644
--- a/pkgs/development/compilers/rust/1_72.nix
+++ b/pkgs/development/compilers/rust/1_73.nix
@@ -20,8 +20,8 @@
 } @ args:
 
 import ./default.nix {
-  rustcVersion = "1.72.1";
-  rustcSha256 = "sha256-f0iEX2pSzbtdY/sFKP1fUg60QydbVfmOMoFZ+GVo+JU=";
+  rustcVersion = "1.73.0";
+  rustcSha256 = "sha256-ltYubR8tId96yKyzuYgkEfnnxwNhc/fy7enh8faxuzo=";
 
   llvmSharedForBuild = pkgsBuildBuild.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
   llvmSharedForHost = pkgsBuildHost.llvmPackages_16.libllvm.override { enableSharedLibraries = true; };
@@ -35,25 +35,24 @@ import ./default.nix {
 
   # Note: the version MUST be one version prior to the version we're
   # building
-  bootstrapVersion = "1.71.1";
+  bootstrapVersion = "1.72.1";
 
   # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
   bootstrapHashes = {
-    i686-unknown-linux-gnu = "ea544e213cdf65194d9650df9d521dd2ed63251e2abe89c8123e336dfe580b21";
-    x86_64-unknown-linux-gnu = "34778d1cda674990dfc0537bc600066046ae9cb5d65a07809f7e7da31d4689c4";
-    x86_64-unknown-linux-musl = "67acc1744293e52f4b49231f3c503e8ad187c477e7b567e27925ec792d946a01";
-    arm-unknown-linux-gnueabihf = "4c88b32849132504fce5b93bebf06dd0fa17988340c7fe97afa661e038dfa258";
-    armv7-unknown-linux-gnueabihf = "8f8556dbd8b0350364c7dc8fda57549934bf3c26c65498dda5842087f5c90d60";
-    aarch64-unknown-linux-gnu = "c7cf230c740a62ea1ca6a4304d955c286aea44e3c6fc960b986a8c2eeea4ec3f";
-    aarch64-unknown-linux-musl = "da87f4ca2534886f1006b2e8abb0dda8db231ce82cc67b4857233ad48a21c87c";
-    x86_64-apple-darwin = "916056603da88336aba68bbeab49711cc8fdb9cfb46a49b04850c0c09761f58c";
-    aarch64-apple-darwin = "f4061b65b31ac75b9b5384c1f518e555f3da23f93bcf64dce252461ee65e9351";
-    powerpc64le-unknown-linux-gnu = "bac57066882366e4628d1ed2bbe4ab19c0b373aaf45582c2da9f639f2f6ea537";
-    riscv64gc-unknown-linux-gnu = "fcb67647b764669f3b4e61235fbdc0eca287229adf9aed8c41ce20ffaad4a3ea";
-    mips64el-unknown-linux-gnuabi64 = "6523efea9cd48c0375bd621460d890c65457a5534fafb2d8b69a37ee1e2a39ed";
+    i686-unknown-linux-gnu = "a2a849a701dfd6643aaaa27e1ed5ac56aea00f7dee26c00d81c520808efd8911";
+    x86_64-unknown-linux-gnu = "4fbd8df2000cf73c632d67a219a7fc153537ceffa2e6474491e3db71fdd5a410";
+    x86_64-unknown-linux-musl = "94eddc044868a944a887d0b0375e393cb3acc6ebc034e3eac2ef2890ec7c0eac";
+    arm-unknown-linux-gnueabihf = "a4d90538882181722d3e7cb8d7f021770e29e6b6d28375452e31a98049600110";
+    armv7-unknown-linux-gnueabihf = "4c8e6b3c705a84d17894d3a1cfe744fb6083dd57c61868e67aac8b8512640ecb";
+    aarch64-unknown-linux-gnu = "190d0473cbe619f163d33a6c4e2ef982abdd4178f73abc3194631cd2d5c8ed8b";
+    aarch64-unknown-linux-musl = "c83778d1a95f6604bc3610a9070e8a8435c60a8bca5117aad71ffab36dea020f";
+    x86_64-apple-darwin = "d01e7e9a7482f88a51b4fd888f06234274b49f51b5476c2d14fd46fd6e99ba9e";
+    aarch64-apple-darwin = "42b0aaf269b6d9c60db13a64a920336d6064ab11d0c7043c9deeb9d4f67b3983";
+    powerpc64le-unknown-linux-gnu = "9310df247efc072f2ca27354a875c4989cf3c29c9e545255a7472895d830163c";
+    riscv64gc-unknown-linux-gnu = "1e08cd3ecd29d5bf247e3f7f4bc97318b439f0443dd9c99c36edcfa717d55101";
   };
 
-  selectRustPackage = pkgs: pkgs.rust_1_72;
+  selectRustPackage = pkgs: pkgs.rust_1_73;
 
   rustcPatches = [ ];
 }
diff --git a/pkgs/development/compilers/rust/print-hashes.sh b/pkgs/development/compilers/rust/print-hashes.sh
index dd2c116a341b..ebf8d900bb3b 100755
--- a/pkgs/development/compilers/rust/print-hashes.sh
+++ b/pkgs/development/compilers/rust/print-hashes.sh
@@ -19,7 +19,6 @@ PLATFORMS=(
   aarch64-apple-darwin
   powerpc64le-unknown-linux-gnu
   riscv64gc-unknown-linux-gnu
-  mips64el-unknown-linux-gnuabi64
 )
 BASEURL=https://static.rust-lang.org/dist
 VERSION=${1:-}
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 0cf5020962cf..91f06ab53f6e 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -66,15 +66,18 @@ in stdenv.mkDerivation rec {
   # We need rust to build rust. If we don't provide it, configure will try to download it.
   # Reference: https://github.com/rust-lang/rust/blob/master/src/bootstrap/configure.py
   configureFlags = let
+    prefixForStdenv = stdenv: "${stdenv.cc}/bin/${stdenv.cc.targetPrefix}";
+    ccPrefixForStdenv = stdenv: "${prefixForStdenv stdenv}${if (stdenv.cc.isClang or false) then "clang" else "cc"}";
+    cxxPrefixForStdenv = stdenv: "${prefixForStdenv stdenv}${if (stdenv.cc.isClang or false) then "clang++" else "c++"}";
     setBuild  = "--set=target.${rust.toRustTarget stdenv.buildPlatform}";
     setHost   = "--set=target.${rust.toRustTarget stdenv.hostPlatform}";
     setTarget = "--set=target.${rust.toRustTarget stdenv.targetPlatform}";
-    ccForBuild  = "${pkgsBuildBuild.targetPackages.stdenv.cc}/bin/${pkgsBuildBuild.targetPackages.stdenv.cc.targetPrefix}cc";
-    cxxForBuild = "${pkgsBuildBuild.targetPackages.stdenv.cc}/bin/${pkgsBuildBuild.targetPackages.stdenv.cc.targetPrefix}c++";
-    ccForHost  = "${pkgsBuildHost.targetPackages.stdenv.cc}/bin/${pkgsBuildHost.targetPackages.stdenv.cc.targetPrefix}cc";
-    cxxForHost = "${pkgsBuildHost.targetPackages.stdenv.cc}/bin/${pkgsBuildHost.targetPackages.stdenv.cc.targetPrefix}c++";
-    ccForTarget  = "${pkgsBuildTarget.targetPackages.stdenv.cc}/bin/${pkgsBuildTarget.targetPackages.stdenv.cc.targetPrefix}cc";
-    cxxForTarget = "${pkgsBuildTarget.targetPackages.stdenv.cc}/bin/${pkgsBuildTarget.targetPackages.stdenv.cc.targetPrefix}c++";
+    ccForBuild  = ccPrefixForStdenv pkgsBuildBuild.targetPackages.stdenv;
+    cxxForBuild  = cxxPrefixForStdenv pkgsBuildBuild.targetPackages.stdenv;
+    ccForHost  = ccPrefixForStdenv pkgsBuildHost.targetPackages.stdenv;
+    cxxForHost  = cxxPrefixForStdenv pkgsBuildHost.targetPackages.stdenv;
+    ccForTarget  = ccPrefixForStdenv pkgsBuildTarget.targetPackages.stdenv;
+    cxxForTarget  = cxxPrefixForStdenv pkgsBuildTarget.targetPackages.stdenv;
   in [
     "--release-channel=stable"
     "--set=build.rustc=${rustc}/bin/rustc"
@@ -272,9 +275,8 @@ in stdenv.mkDerivation rec {
       "i686-freebsd13" "x86_64-freebsd13"
       "x86_64-solaris"
       "aarch64-linux" "armv6l-linux" "armv7l-linux" "i686-linux"
-      "loongarch64-linux" "mipsel-linux" "mips64el-linux"
-      "powerpc64-linux" "powerpc64le-linux" "riscv64-linux"
-      "s390x-linux" "x86_64-linux"
+      "loongarch64-linux" "powerpc64-linux" "powerpc64le-linux"
+      "riscv64-linux" "s390x-linux" "x86_64-linux"
       "aarch64-netbsd" "armv7l-netbsd" "i686-netbsd" "powerpc-netbsd"
       "x86_64-netbsd"
       "i686-openbsd" "x86_64-openbsd"
diff --git a/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix b/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
index f6ba21f37574..3004ef928bce 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
@@ -245,7 +245,9 @@ self: super: {
 
   # Fix ghc-9.6.x build errors.
   libmpd = appendPatch
-    (pkgs.fetchpatch { url = "https://github.com/vimus/libmpd-haskell/pull/138.patch";
+    # https://github.com/vimus/libmpd-haskell/pull/138
+    (pkgs.fetchpatch { url = "https://github.com/vimus/libmpd-haskell/compare/95d3b3bab5858d6d1f0e079d0ab7c2d182336acb...5737096a339edc265a663f51ad9d29baee262694.patch";
+                       name = "vimus-libmpd-haskell-pull-138.patch";
                        sha256 = "sha256-CvvylXyRmoCoRJP2MzRwL0SBbrEzDGqAjXS+4LsLutQ=";
                      })
     super.libmpd;
@@ -255,8 +257,9 @@ self: super: {
     editedCabalFile = null;
     buildDepends = drv.buildDepends or [] ++ [ self.HUnit ];
     patches = [(pkgs.fetchpatch {
+      # https://github.com/jgoerzen/configfile/pull/12
       name = "ConfigFile-pr-12.patch";
-      url = "https://github.com/jgoerzen/configfile/pull/12.patch";
+      url = "https://github.com/jgoerzen/configfile/compare/d0a2e654be0b73eadbf2a50661d00574ad7b6f87...83ee30b43f74d2b6781269072cf5ed0f0e00012f.patch";
       sha256 = "sha256-b7u9GiIAd2xpOrM0MfILHNb6Nt7070lNRIadn2l3DfQ=";
     })];
   }) super.ConfigFile;
diff --git a/pkgs/development/interpreters/guile/2.2.nix b/pkgs/development/interpreters/guile/2.2.nix
index 617658e748b9..918735517ea3 100644
--- a/pkgs/development/interpreters/guile/2.2.nix
+++ b/pkgs/development/interpreters/guile/2.2.nix
@@ -34,9 +34,9 @@ builder rec {
   outputs = [ "out" "dev" "info" ];
   setOutputFlags = false; # $dev gets into the library otherwise
 
-  depsBuildBuild = if stdenv.buildPlatform.isDarwin
-    then [ buildPackages.darwin.apple_sdk_11_0.stdenv.cc ]
-    else [ buildPackages.stdenv.cc ]
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ]
   ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
     pkgsBuildBuild.guile_2_2;
   nativeBuildInputs = [
diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix
index 818377912808..7b45ba50dedf 100644
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@@ -36,10 +36,9 @@ builder rec {
   outputs = [ "out" "dev" "info" ];
   setOutputFlags = false; # $dev gets into the library otherwise
 
-  depsBuildBuild = if stdenv.buildPlatform.isDarwin
-    then [ buildPackages.darwin.apple_sdk_11_0.stdenv.cc ]
-    else [ buildPackages.stdenv.cc ]
-  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
     pkgsBuildBuild.guile_3_0;
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/development/interpreters/nelua/default.nix b/pkgs/development/interpreters/nelua/default.nix
index 8030980b7788..fe4448c2f8d6 100644
--- a/pkgs/development/interpreters/nelua/default.nix
+++ b/pkgs/development/interpreters/nelua/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "nelua";
-  version = "unstable-2023-01-21";
+  version = "unstable-2023-09-16";
 
   src = fetchFromGitHub {
     owner = "edubart";
     repo = "nelua-lang";
-    rev = "d10cc61bc54050b07874a8597f8df20534885105";
-    hash = "sha256-HyNYqhPCQVBJqEcAUUXfvycXE8tWIMIUJJMTIV48ne8=";
+    rev = "596fcca5c77932da8a07c249de59a9dff3099495";
+    hash = "sha256-gXTlAxW7s3VBiC1fGU0aUlGspHlvyY7FC5KLeU2FyGQ=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 2d293bb29a0e..8f775699f482 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -30,10 +30,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "5";
+        patch = "6";
         suffix = "";
       };
-      hash = "sha256-hc0S6c8dbVpF8X96/hzr5+5ijTKCKBxJLoat9jbe+j8=";
+      hash = "sha256-D6t4+n8TP084IQxiYNkNfA1ccZhEZBnOBX7HrC5vXzg=";
     };
   };
 
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index ba51c43822d4..6a05a7fa6ee8 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -227,6 +227,9 @@ in {
   sphinxHook = callPackage ({ makePythonHook, installShellFiles }:
     makePythonHook {
       name = "python${python.pythonVersion}-sphinx-hook";
-      propagatedBuildInputs = [ pythonForBuild.pkgs.sphinx installShellFiles ];
+      propagatedBuildInputs = [ installShellFiles ];
+      substitutions = {
+        sphinxBuild = "${pythonForBuild.pkgs.sphinx}/bin/sphinx-build";
+      };
     } ./sphinx-hook.sh) {};
 }
diff --git a/pkgs/development/interpreters/python/hooks/sphinx-hook.sh b/pkgs/development/interpreters/python/hooks/sphinx-hook.sh
index ca67fa9beabf..0307e83d9479 100644
--- a/pkgs/development/interpreters/python/hooks/sphinx-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/sphinx-hook.sh
@@ -38,7 +38,7 @@ buildSphinxPhase() {
 
     for __builder in "${__sphinxBuilders[@]}"; do
         echo "Executing sphinx-build with ${__builder} builder"
-        sphinx-build -M "${__builder}" "${__sphinxRoot}" ".sphinx/${__builder}" -v
+        @sphinxBuild@ -M "${__builder}" "${__sphinxRoot}" ".sphinx/${__builder}" -v
     done
 
     runHook postBuildSphinx
diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index fbacf6bb2337..81308900f224 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -102,13 +102,14 @@
 
 , disabledTestPaths ? []
 
+# Allow passing in a custom stdenv to buildPython*
+, stdenv ? python.stdenv
+
 , ... } @ attrs:
 
 assert (pyproject != null) -> (format == null);
 
 let
-  inherit (python) stdenv;
-
   format' =
     if pyproject != null then
       if pyproject then
@@ -194,7 +195,7 @@ let
   # Keep extra attributes from `attrs`, e.g., `patchPhase', etc.
   self = toPythonModule (stdenv.mkDerivation ((builtins.removeAttrs attrs [
     "disabled" "checkPhase" "checkInputs" "nativeCheckInputs" "doCheck" "doInstallCheck" "dontWrapPythonPrograms" "catchConflicts" "pyproject" "format"
-    "disabledTestPaths" "outputs"
+    "disabledTestPaths" "outputs" "stdenv"
   ]) // {
 
     name = namePrefix + name_;
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index e40ccb5908db..f0818da2a53d 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.4.20";
+  version = "3.4.21";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-9jKKef7KPnSYgKb3zf1LaulFBJuDpY6pWOJHSpG6Hzs=";
+    hash = "sha256-oIz9sT+ZfKh1HZc3Fg300EQpSfNsG7fZZB/ilcKXEIA=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/Xaw3d/default.nix b/pkgs/development/libraries/Xaw3d/default.nix
index f358a59ad62d..f90be3a751e3 100644
--- a/pkgs/development/libraries/Xaw3d/default.nix
+++ b/pkgs/development/libraries/Xaw3d/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "Xaw3d";
-  version = "1.6.3";
+  version = "1.6.5";
 
   src = fetchurl {
-    url = "https://www.x.org/releases/individual/lib/libXaw3d-${version}.tar.bz2";
-    sha256 = "0i653s8g25cc0mimkwid9366bqkbyhdyjhckx7bw77j20hzrkfid";
+    url = "https://www.x.org/releases/individual/lib/libXaw3d-${version}.tar.xz";
+    sha256 = "sha256-NIHuS2dTuI4YhW6iZcuE8rAznujDu+yWaxVrOLWEGDM=";
   };
   dontUseImakeConfigure = true;
   nativeBuildInputs = [ pkg-config bison flex imake gccmakedep ];
diff --git a/pkgs/development/libraries/audio/game-music-emu/default.nix b/pkgs/development/libraries/audio/game-music-emu/default.nix
index a10aace767be..0f420745baef 100644
--- a/pkgs/development/libraries/audio/game-music-emu/default.nix
+++ b/pkgs/development/libraries/audio/game-music-emu/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, removeReferencesTo }:
+{ lib, stdenv, fetchurl, cmake, removeReferencesTo, zlib }:
 
 stdenv.mkDerivation rec {
   version = "0.6.3";
@@ -8,8 +8,9 @@ stdenv.mkDerivation rec {
     url = "https://bitbucket.org/mpyne/game-music-emu/downloads/${pname}-${version}.tar.xz";
     sha256 = "07857vdkak306d9s5g6fhmjyxk7vijzjhkmqb15s7ihfxx9lx8xb";
   };
-  cmakeFlags = lib.optionals (stdenv.isDarwin || stdenv.hostPlatform.isMusl) [ "-DENABLE_UBSAN=OFF" ];
+  cmakeFlags = [ "-DENABLE_UBSAN=OFF" ];
   nativeBuildInputs = [ cmake removeReferencesTo ];
+  buildInputs = [ zlib ];
 
   # It used to reference it, in the past, but thanks to the postFixup hook, now
   # it doesn't.
diff --git a/pkgs/development/libraries/audio/libopenmpt/default.nix b/pkgs/development/libraries/audio/libopenmpt/default.nix
index bb5a4e0dd53b..b8b89abc8ea7 100644
--- a/pkgs/development/libraries/audio/libopenmpt/default.nix
+++ b/pkgs/development/libraries/audio/libopenmpt/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libopenmpt";
-  version = "0.7.2";
+  version = "0.7.3";
 
   outputs = [ "out" "dev" "bin" ];
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    hash = "sha256-UJFD5aTzsT3Zjq4om/7BtWTt3XG7x8p4ZLgoNeMTMOE=";
+    hash = "sha256-LPg2m3kWsJJk8/FLn7bO81pum+4DKN7E9J2YIRzP1yI=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/audio/lilv/default.nix b/pkgs/development/libraries/audio/lilv/default.nix
index 14b0d4c5e46f..a0869edf4fbd 100644
--- a/pkgs/development/libraries/audio/lilv/default.nix
+++ b/pkgs/development/libraries/audio/lilv/default.nix
@@ -1,4 +1,16 @@
-{ lib, stdenv, fetchurl, lv2, pkg-config, python3, serd, sord, sratom, wafHook
+{ lib
+, stdenv
+, fetchurl
+, lv2
+, meson
+, ninja
+, pkg-config
+, python3
+, libsndfile
+, serd
+, sord
+, sratom
+, gitUpdater
 
 # test derivations
 , pipewire
@@ -6,24 +18,29 @@
 
 stdenv.mkDerivation rec {
   pname = "lilv";
-  version = "0.24.12";
+  version = "0.24.20";
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "man" ];
 
   src = fetchurl {
-    url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-JqN3kIkMnB+DggO0f1sjIDNP6SwCpNJuu+Jmnb12kGE=";
+    url = "https://download.drobilla.net/${pname}-${version}.tar.xz";
+    hash = "sha256-T7CCubiyhuqSu7cb3mt1Ykzsq23wzGOe51oqCWIS7rw=";
   };
 
-  patches = [ ./lilv-pkgconfig.patch ];
-
-  nativeBuildInputs = [ pkg-config python3 wafHook ];
-  buildInputs = [ serd sord sratom ];
+  nativeBuildInputs = [ meson ninja pkg-config python3 ];
+  buildInputs = [ libsndfile serd sord sratom ];
   propagatedBuildInputs = [ lv2 ];
-  dontAddWafCrossFlags = true;
 
-  passthru.tests = {
-    inherit pipewire;
+  mesonFlags = [ "-Ddocs=disabled" ];
+
+  passthru = {
+    tests = {
+      inherit pipewire;
+    };
+    updateScript = gitUpdater {
+      url = "https://gitlab.com/lv2/lilv.git";
+      rev-prefix = "v";
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/audio/lilv/lilv-pkgconfig.patch b/pkgs/development/libraries/audio/lilv/lilv-pkgconfig.patch
deleted file mode 100644
index a5a8c6007e43..000000000000
--- a/pkgs/development/libraries/audio/lilv/lilv-pkgconfig.patch
+++ /dev/null
@@ -1,6 +0,0 @@
---- a/lilv.pc.in
-+++ b/lilv.pc.in
-@@ -9 +9,2 @@ Description: Simple C library for hosting LV2 plugins
--Requires: @LILV_PKG_DEPS@
-+Requires: lv2
-+Requires.private: @LILV_PKG_DEPS@
diff --git a/pkgs/development/libraries/audiofile/default.nix b/pkgs/development/libraries/audiofile/default.nix
index c6d656388d45..f9974e2ca253 100644
--- a/pkgs/development/libraries/audiofile/default.nix
+++ b/pkgs/development/libraries/audiofile/default.nix
@@ -28,6 +28,9 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" ];
 
+  # std::unary_function has been removed in c++17
+  makeFlags = [ "CXXFLAGS=-std=c++11" ];
+
   # Even when statically linking, libstdc++.la is put in dependency_libs here,
   # and hence libstdc++.so passed to the linker, just pass -lstdc++ and let the
   # compiler do what it does best.  (libaudiofile.la is a generated file, so we
diff --git a/pkgs/development/libraries/check/default.nix b/pkgs/development/libraries/check/default.nix
index 8add9c623470..14b4e549264b 100644
--- a/pkgs/development/libraries/check/default.nix
+++ b/pkgs/development/libraries/check/default.nix
@@ -11,6 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "02m25y9m46pb6n46s51av62kpd936lkfv3b13kfpckgvmh5lxpm8";
   };
 
+  # fortify breaks the libcompat vsnprintf implementation
+  hardeningDisable = lib.optionals (stdenv.hostPlatform.isMusl && (stdenv.hostPlatform != stdenv.buildPlatform)) [ "fortify" ];
+
   # Test can randomly fail: https://hydra.nixos.org/build/7243912
   doCheck = false;
 
diff --git a/pkgs/development/libraries/glibc/2.38-master.patch.gz b/pkgs/development/libraries/glibc/2.38-master.patch.gz
index 4eb3c7b2cdb3..6414956807f4 100644
--- a/pkgs/development/libraries/glibc/2.38-master.patch.gz
+++ b/pkgs/development/libraries/glibc/2.38-master.patch.gz
Binary files differdiff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 51d8a4dbe05c..646242de6119 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -44,7 +44,7 @@
 
 let
   version = "2.38";
-  patchSuffix = "-23";
+  patchSuffix = "-27";
   sha256 = "sha256-+4KZiZiyspllRnvBtp0VLpwwfSzzAcnq+0VVt3DvP9I=";
 in
 
@@ -60,7 +60,7 @@ stdenv.mkDerivation ({
     [
       /* No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
           $ git fetch --all -p && git checkout origin/release/2.38/master && git describe
-          glibc-2.38-23-g0e1ef6779a
+          glibc-2.38-27-g750a45a783
           $ git show --minimal --reverse glibc-2.38.. | gzip -9n --rsyncable - > 2.38-master.patch.gz
 
          To compare the archive contents zdiff can be used.
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index 1c822bf1ed01..e3fdfc6a2937 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -145,7 +145,7 @@ in
       ln -sf $out/lib/libpthread.so.0 $out/lib/libpthread.so
       ln -sf $out/lib/librt.so.1 $out/lib/librt.so
       ln -sf $out/lib/libdl.so.2 $out/lib/libdl.so
-      ln -sf $out/lib/libutil.so.1 $out/lib/libutil.so
+      test -f $out/lib/libutil.so.1 && ln -sf $out/lib/libutil.so.1 $out/lib/libutil.so
       touch $out/lib/libpthread.a
 
       # Put libraries for static linking in a separate output.  Note
@@ -154,6 +154,8 @@ in
       mkdir -p $static/lib
       mv $out/lib/*.a $static/lib
       mv $static/lib/lib*_nonshared.a $out/lib
+      # If libutil.so.1 is missing, libutil.a is required.
+      test -f $out/lib/libutil.so.1 || mv $static/lib/libutil.a $out/lib
       # Some of *.a files are linker scripts where moving broke the paths.
       sed "/^GROUP/s|$out/lib/lib|$static/lib/lib|g" \
         -i "$static"/lib/*.a
diff --git a/pkgs/development/libraries/glibc/locales-builder.sh b/pkgs/development/libraries/glibc/locales-builder.sh
index d91f936c937b..27894b09b91c 100644
--- a/pkgs/development/libraries/glibc/locales-builder.sh
+++ b/pkgs/development/libraries/glibc/locales-builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 # Glibc cannot have itself in its RPATH.
 export NIX_NO_SELF_RPATH=1
 
diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index 2b088eb459ad..0315f39c6059 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -6,22 +6,22 @@
 # files.
 
 let
-  rev = "d4e37b5868ef910e3e52744c34408084bb13051c";
+  rev = "28ea239c53a2d5d8800c472bc2452eaa16e37af2";
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
     name = "config.guess-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
-    sha256 = "191czpnbc1nxrygg8fd3839y1f4m9x43rp57vgrsas6p07zzh3c1";
+    hash = "sha256-7CV3YUJSMm+InfHel7mkV8A6mpSBEEhWPCEaRElti6M=";
   };
   configSub = fetchurl {
     name = "config.sub-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
-    sha256 = "0148p54gw10p6sk2rn3gi9vvqm89rk8kcvl9335ckayhanx31381";
+    hash = "sha256-Rlxf5nx9NrcugIgScWRF1NONS5RzTKjTaoY50SMjh4s=";
   };
 in stdenv.mkDerivation {
   pname = "gnu-config";
-  version = "2023-07-31";
+  version = "2023-09-19";
 
   unpackPhase = ''
     runHook preUnpack
diff --git a/pkgs/development/libraries/gtk-sharp/builder.sh b/pkgs/development/libraries/gtk-sharp/builder.sh
index 73914495d6d4..45e640e2a708 100644
--- a/pkgs/development/libraries/gtk-sharp/builder.sh
+++ b/pkgs/development/libraries/gtk-sharp/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 genericBuild
diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index f85ec4d96b39..ab237d9dca00 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -22,6 +22,8 @@
 , enlightenment
 , xorg
 , testers
+
+, gitUpdater
 }:
 
 let
@@ -29,11 +31,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "imlib2";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/enlightenment/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-lf9dTMF92fk0wuetFRw2DzCIgKCnhJpspDt8e5pLshY=";
+    hash = "sha256-jCTS0YnE1a5gLb8vwPuxF6qSPqtsiDBB8P7spOjGd04=";
   };
 
   buildInputs = [
@@ -59,19 +61,25 @@ stdenv.mkDerivation (finalAttrs: {
 
   outputs = [ "bin" "out" "dev" ];
 
-  passthru.tests = {
-    inherit
-      libcaca
-      diffoscopeMinimal
-      feh
-      icewm
-      openbox
-      fluxbox
-      enlightenment;
+  passthru = {
+    tests = {
+      inherit
+        libcaca
+        diffoscopeMinimal
+        feh
+        icewm
+        openbox
+        fluxbox
+        enlightenment;
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    };
+    updateScript = gitUpdater {
+      # No nicer place to find latest release.
+      url = "https://git.enlightenment.org/old/legacy-imlib2.git";
+      rev-prefix = "v";
+    };
   };
 
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-
   meta = with lib; {
     description = "Image manipulation library";
 
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index a00399497e22..f89152820698 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -1,19 +1,23 @@
-{ lib, stdenv, fetchurl, python3, autoreconfHook }:
+{ lib, stdenv, fetchurl, python3, autoconf, automake, libtool }:
 
 stdenv.mkDerivation rec {
   pname = "jbig2dec";
-  version = "0.19";
+  version = "0.20";
 
   src = fetchurl {
-    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs9533/${pname}-${version}.tar.gz";
-    sha256 = "0dwa24kjqyg9hmm40fh048sdxfpnasz43l2rm8wlkw1qbdlpd517";
+    url = "https://github.com/ArtifexSoftware/jbig2dec/archive/${version}/jbig2dec-${version}.tar.gz";
+    hash = "sha256-qXBTaaZjOrpTJpNFDsgCxWI5fhuCRmLegJ7ekvZ6/yE=";
   };
 
   postPatch = ''
     patchShebangs test_jbig2dec.py
   '';
 
-  nativeBuildInputs = [ autoreconfHook ];
+  preConfigure = ''
+    ./autogen.sh
+  '';
+
+  nativeBuildInputs = [ autoconf automake libtool ];
 
   nativeCheckInputs = [ python3 ];
   doCheck = true;
diff --git a/pkgs/development/libraries/kde-frameworks/baloo.nix b/pkgs/development/libraries/kde-frameworks/baloo.nix
index 3543fef66337..2a264d47c24c 100644
--- a/pkgs/development/libraries/kde-frameworks/baloo.nix
+++ b/pkgs/development/libraries/kde-frameworks/baloo.nix
@@ -25,21 +25,6 @@ mkDerivation {
   outputs = [ "out" "dev" ];
   propagatedBuildInputs = [ kcoreaddons kfilemetadata qtbase ];
 
-  # baloo suffers from issues when running on btrfs as well as with certain LVM/dm-crypt setups
-  # where the device id will change on reboot causing baloo to reindex all the files and then having
-  # duplicate files. A patch has been proposed that addresses this, which has not been accepted yet.
-  # However, without this patch, people tend to disable baloo rather than dealing with the constant
-  # reindexing.
-  #
-  # https://bugs.kde.org/show_bug.cgi?id=402154
-  patches = [
-    (fetchpatch {
-      url = "https://bugsfiles.kde.org/attachment.cgi?id=159031";
-      hash = "sha256-hCtNXUpRhIP94f7gpwTGWWh1h/7JRRJaRASIwHWQjnY=";
-      name = "use_fsid.patch";
-    })
-  ];
-
   # kde-baloo.service uses `ExecCondition=@KDE_INSTALL_FULL_BINDIR@/kde-systemd-start-condition ...`
   # which comes from the "plasma-workspace" derivation, but KDE_INSTALL_* all point at the "baloo" one
   # (`${lib.getBin pkgs.plasma-workspace}` would cause infinite recursion)
diff --git a/pkgs/development/libraries/kde-frameworks/fetch.sh b/pkgs/development/libraries/kde-frameworks/fetch.sh
index c72caa6d585d..9899a98e25ef 100644
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.110/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.111/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/kde-frameworks/kio/default.nix b/pkgs/development/libraries/kde-frameworks/kio/default.nix
index 03e233c28799..8815683aef65 100644
--- a/pkgs/development/libraries/kde-frameworks/kio/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/kio/default.nix
@@ -29,12 +29,6 @@ mkDerivation {
   separateDebugInfo = true;
   patches = [
     ./0001-Remove-impure-smbd-search-path.patch
-
-    # Fix a crash when saving files.
-    (fetchpatch {
-      url = "https://invent.kde.org/frameworks/kio/-/commit/48322f44323a1fc09305d66d9093fe6c3780709e.patch";
-      hash = "sha256-4NxI2mD/TdthvrzgatCAlM6VN3N38i3IJUHh0Bs8Fjk=";
-    })
  ];
   meta = {
     homepage = "https://api.kde.org/frameworks/kio/html/";
diff --git a/pkgs/development/libraries/kde-frameworks/srcs.nix b/pkgs/development/libraries/kde-frameworks/srcs.nix
index 1fd8a2ba15a0..68782e43811d 100644
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -4,667 +4,667 @@
 
 {
   attica = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/attica-5.110.0.tar.xz";
-      sha256 = "1lp7y0r3npv93kcw1fkgl8c2njbs6y4m8cg32b60pyjahfqspxd6";
-      name = "attica-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/attica-5.111.0.tar.xz";
+      sha256 = "0gdp7w585l3669rd10lkc5vman1pbv8agh5zh1zwzg83bj32hxl4";
+      name = "attica-5.111.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/baloo-5.110.0.tar.xz";
-      sha256 = "0bg2nyp7zp1mka7ng8bwcd0hrbglrdiz7xw43r9q8wycr9qmva1n";
-      name = "baloo-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/baloo-5.111.0.tar.xz";
+      sha256 = "04gqw22kdk4q18jlddhjpmgnxyayan18ndf7bswv633nyxrck32g";
+      name = "baloo-5.111.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/bluez-qt-5.110.0.tar.xz";
-      sha256 = "1xvr85i0lkdpca64dzd7wqasc7acpzvh2kawl9nrfkrn96vrm0cz";
-      name = "bluez-qt-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/bluez-qt-5.111.0.tar.xz";
+      sha256 = "0sz3kicjwy1zn868dng11r7ic4rn2ji542ijcykzfalpaa3apjy0";
+      name = "bluez-qt-5.111.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/breeze-icons-5.110.0.tar.xz";
-      sha256 = "1m5z8g7rvilvwfn65yazci51i83ixv7fc5sh2v5vgxrlmhbysg0s";
-      name = "breeze-icons-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/breeze-icons-5.111.0.tar.xz";
+      sha256 = "1vrsbgfcigsi3gc61lgv58ns0n7vgn85vzmn3n8hz8vmbx60wmsc";
+      name = "breeze-icons-5.111.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/extra-cmake-modules-5.110.0.tar.xz";
-      sha256 = "0f347y8q3ckgfq4skh2q69n67v3w9k680db0br4f43i37vdzaikp";
-      name = "extra-cmake-modules-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/extra-cmake-modules-5.111.0.tar.xz";
+      sha256 = "16pamdxfsfbw56rg4h9akhhddz694hbz1lrm9bkb89v7z8fkqpam";
+      name = "extra-cmake-modules-5.111.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/frameworkintegration-5.110.0.tar.xz";
-      sha256 = "0ghl5p01g3jdj75wzyjwq4b0l0p98r0vkkf6zj6d3lbax207z0sq";
-      name = "frameworkintegration-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/frameworkintegration-5.111.0.tar.xz";
+      sha256 = "0q8ia4pw8zdcx5hcqsar46jrss5agxqmb4zfg3pyxn5la5j75bv1";
+      name = "frameworkintegration-5.111.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kactivities-5.110.0.tar.xz";
-      sha256 = "1c1456jc3s7cl2l3kmkgprgngip0j9c7ssd0b0fvjd41dwhzhra5";
-      name = "kactivities-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kactivities-5.111.0.tar.xz";
+      sha256 = "0320wl4kq3if3wzzr0y9vq8m2ghk8rgga22k9yli9ax5y8fj9dam";
+      name = "kactivities-5.111.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kactivities-stats-5.110.0.tar.xz";
-      sha256 = "1agqsdgbmglrzpg9w4df9qdg4hf8g1nnnkq7adp6cxsj3x8c8zx4";
-      name = "kactivities-stats-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kactivities-stats-5.111.0.tar.xz";
+      sha256 = "1mxdylx0g43rvlbwgclr6alvfnc5hgr6w4s0hh4icj565mcg8vdd";
+      name = "kactivities-stats-5.111.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kapidox-5.110.0.tar.xz";
-      sha256 = "1qi2mcslw0gsxc6p5q78lhg3if01j8dhxf0ypwb8njsfjcr45d24";
-      name = "kapidox-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kapidox-5.111.0.tar.xz";
+      sha256 = "0s14siybjgwmgcydh0q1jyl0c2s4sh67wi0r0vi63k0ngkw2psbz";
+      name = "kapidox-5.111.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/karchive-5.110.0.tar.xz";
-      sha256 = "1pqc0j4xkhwc6gdgg1q7pl3hjnrscwz8vbdz8jbvpaz51cy5iipw";
-      name = "karchive-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/karchive-5.111.0.tar.xz";
+      sha256 = "0bfdqbv4z1jhb0m26bz9glcphqg54pg6nb6ni518wy42514ks3p0";
+      name = "karchive-5.111.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kauth-5.110.0.tar.xz";
-      sha256 = "1yymmyvhqgrwdpy5c2narh6d0ac41mw9ifrhckcyr22kdyrmgcz1";
-      name = "kauth-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kauth-5.111.0.tar.xz";
+      sha256 = "1cxvhfakc1vi2rhnscfr5rmffqkkqfim66pg51p91mqxb3x83k75";
+      name = "kauth-5.111.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kbookmarks-5.110.0.tar.xz";
-      sha256 = "1k04mcfciv3gq4qw5gkpq7189wfxxlr427h4827m3hs3ysbgc4vh";
-      name = "kbookmarks-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kbookmarks-5.111.0.tar.xz";
+      sha256 = "1670i8v6p2j2znckqz29vazsp7l8169h3rpgjw5fshr2rxjyifhv";
+      name = "kbookmarks-5.111.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcalendarcore-5.110.0.tar.xz";
-      sha256 = "19zb1g4lbiqy4vcay6hbjx9ak5r00frfn1hahpc544q9l0dznl52";
-      name = "kcalendarcore-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcalendarcore-5.111.0.tar.xz";
+      sha256 = "18da625xrqxxs29xbd52mbvl3jkg3qlwv7jr3wbwn7s2hxqc4v26";
+      name = "kcalendarcore-5.111.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcmutils-5.110.0.tar.xz";
-      sha256 = "0ccgrd757ww890nvajw1s9yvq6iikp316q123rfminrc0mlrpzaq";
-      name = "kcmutils-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcmutils-5.111.0.tar.xz";
+      sha256 = "09nd5jb4mh8laap9r7haxs7m9ym0hymg301yp5g3alw65aaqiy70";
+      name = "kcmutils-5.111.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcodecs-5.110.0.tar.xz";
-      sha256 = "1i15q8kg1dn72sxg9djvg9h4mhqh9rgvnsf3bz0pjd5jbwqqyv1v";
-      name = "kcodecs-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcodecs-5.111.0.tar.xz";
+      sha256 = "1d564s2m926hi9k3j89xi9p7g4vlqsz5apncdlsdi9wjj774b4w6";
+      name = "kcodecs-5.111.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcompletion-5.110.0.tar.xz";
-      sha256 = "0a9l6p9kfg074wxz0r9dn43baibrbzbh80x60rds2jaf3yjg212g";
-      name = "kcompletion-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcompletion-5.111.0.tar.xz";
+      sha256 = "1fig1xxfbsc8sbwr57yxi6z8kfaj7mqrlpjn8j0f6xcxpq9i4zak";
+      name = "kcompletion-5.111.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kconfig-5.110.0.tar.xz";
-      sha256 = "1i9idh0rh8ryry5gf22wwgzd15y14jymxjdxbkgx13kqpfyqhaxd";
-      name = "kconfig-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kconfig-5.111.0.tar.xz";
+      sha256 = "0d812hn21g93v4mixpp8vsr6dq7qkscabj2zzw2gs4bk9anpkh4s";
+      name = "kconfig-5.111.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kconfigwidgets-5.110.0.tar.xz";
-      sha256 = "04mlw41xdps7qgnmmccqgs7jc5iipx2vqp9bd91l3sz4p90wj3sg";
-      name = "kconfigwidgets-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kconfigwidgets-5.111.0.tar.xz";
+      sha256 = "1zh1fzrvwidfda9yl873r0k7mlx84jax8p6iib67p58ggwsjxpv3";
+      name = "kconfigwidgets-5.111.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcontacts-5.110.0.tar.xz";
-      sha256 = "0gib8nlis59kbhydqvf6alwxvy4db94r2p3vpbcdy48gc4i06344";
-      name = "kcontacts-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcontacts-5.111.0.tar.xz";
+      sha256 = "0s3yzv1p6nac8y25kdn986121iavkar5rvkpasw9vj6n6l5rg8s9";
+      name = "kcontacts-5.111.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcoreaddons-5.110.0.tar.xz";
-      sha256 = "0xcd2ph62a7kbm8camp1vnsxlaq1kmqm9hw9gyphcdh0rh6fi3bf";
-      name = "kcoreaddons-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcoreaddons-5.111.0.tar.xz";
+      sha256 = "0vi5fziv4kpndqan1fpyymqz6dc8qs0y7hj7grfzh7hbckxfgm6v";
+      name = "kcoreaddons-5.111.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kcrash-5.110.0.tar.xz";
-      sha256 = "15j70r6afc0lyg41047r27l089gkq8fh39w9iyvhv0h8hfxxah6g";
-      name = "kcrash-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kcrash-5.111.0.tar.xz";
+      sha256 = "0cbwnnf01c5bq59b7qmi27shrqaxnlkmcd62gk4g7wjy8fl9h8fw";
+      name = "kcrash-5.111.0.tar.xz";
     };
   };
   kdav = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kdav-5.110.0.tar.xz";
-      sha256 = "0qz5iq9fi1vk1z7w4wdh7kxrc06vnyrvs7n0llyrjaprzjn8yx6a";
-      name = "kdav-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kdav-5.111.0.tar.xz";
+      sha256 = "0nhlmd5dygd663cb7sb5qsyn8v9dfxg8sbrs15cz0ch31ak1zww8";
+      name = "kdav-5.111.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kdbusaddons-5.110.0.tar.xz";
-      sha256 = "0ilzk67h5cxrjf78hw505pvbqvd2lkjk3m0g188pcw0sdg10xb8h";
-      name = "kdbusaddons-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kdbusaddons-5.111.0.tar.xz";
+      sha256 = "1d8q1a7b7isvi18ism6l3gakyh4skp4gv1wyb9x75kbn369g5ab1";
+      name = "kdbusaddons-5.111.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kdeclarative-5.110.0.tar.xz";
-      sha256 = "1vcqdi4lji97wm5vil2p1g7wi6rwrz0g6aiqf1nzi026fpsc8njj";
-      name = "kdeclarative-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kdeclarative-5.111.0.tar.xz";
+      sha256 = "0bjkf3k0fsrx6v58qf388q1zqsinaxjzsmh02lsh5slv5arnbnhw";
+      name = "kdeclarative-5.111.0.tar.xz";
     };
   };
   kded = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kded-5.110.0.tar.xz";
-      sha256 = "1n8hzkwhqrx4mb7ahqnkga01zslcp82ya22hppfapldy83bfrgyl";
-      name = "kded-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kded-5.111.0.tar.xz";
+      sha256 = "1b8kzsawk277p5bsfcfyvrzfrhvd1lcf6sk9gi8bvaw7i0dw8f57";
+      name = "kded-5.111.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kdelibs4support-5.110.0.tar.xz";
-      sha256 = "119hhc0f862kzr5flrlpg9b8xlcl1qxa5xkccad0hpba76pk2af4";
-      name = "kdelibs4support-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kdelibs4support-5.111.0.tar.xz";
+      sha256 = "1y6lj6gxcyd4rha03dxw9jvff5gd88ijm8wqc0ggssgc0hpv7fif";
+      name = "kdelibs4support-5.111.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kdesignerplugin-5.110.0.tar.xz";
-      sha256 = "146i8n9rrajh03x180z48qi8dn31dywsz052bhbn4yw61ag4w4nc";
-      name = "kdesignerplugin-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kdesignerplugin-5.111.0.tar.xz";
+      sha256 = "1qmsxz5zm9xsv0w6ksh33mib2swmi57pnndi74zhc7w6qvia8lj2";
+      name = "kdesignerplugin-5.111.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kdesu-5.110.0.tar.xz";
-      sha256 = "0ll5k4lpn1v4bc365w2ky0qszikfz2r589ni8iyk109qdqciyrr9";
-      name = "kdesu-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kdesu-5.111.0.tar.xz";
+      sha256 = "0y51rc5ckfa84a5d4422n89zznpdzr6493malw7n09nsrs0qcby6";
+      name = "kdesu-5.111.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kdewebkit-5.110.0.tar.xz";
-      sha256 = "0p09lby7csx3j513lm91k247iwxby423cz7da51n20qncan8g65v";
-      name = "kdewebkit-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kdewebkit-5.111.0.tar.xz";
+      sha256 = "1zh5i32bpb53bx2rq89fbn0nvqkbsl9kbp5azzc7bws1ksv2mzqd";
+      name = "kdewebkit-5.111.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kdnssd-5.110.0.tar.xz";
-      sha256 = "0xmahgn572ah8ji4d4afalcl7r2krn971ix5jwcqgrj57m5haj45";
-      name = "kdnssd-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kdnssd-5.111.0.tar.xz";
+      sha256 = "0ssdz7g88p0nk38pp1svjnlfffsnwhrzcy5k3fa3z6142albxsh0";
+      name = "kdnssd-5.111.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kdoctools-5.110.0.tar.xz";
-      sha256 = "1g05gppc6qzkag1x18anymbwdswpg32w6jh12x9jfj79vcp7wg4j";
-      name = "kdoctools-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kdoctools-5.111.0.tar.xz";
+      sha256 = "1gjf239f252g7bfji1378c48gzm5rz3gv6jd5g0ayrs0ixm15a9r";
+      name = "kdoctools-5.111.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kemoticons-5.110.0.tar.xz";
-      sha256 = "1r1d3kw6wzw63kq9wy4ic2b9hcnmm4rs7v9f1z9jhq9m1jp0zy12";
-      name = "kemoticons-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kemoticons-5.111.0.tar.xz";
+      sha256 = "1aja459hsfnzlqlkdrfrfglwrh2mfpwq6pypbh46l2qycn1p1xzk";
+      name = "kemoticons-5.111.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kfilemetadata-5.110.0.tar.xz";
-      sha256 = "07ma48iq5vpnj391shm3s9an3rqhxskfziw6pksmzxxnga0whbl9";
-      name = "kfilemetadata-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kfilemetadata-5.111.0.tar.xz";
+      sha256 = "1ivdv6cyzi8qazy4ingdbc7n7iyjr17dlyyf30sxzp8x82cxqilg";
+      name = "kfilemetadata-5.111.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kglobalaccel-5.110.0.tar.xz";
-      sha256 = "1iw22vyrk07pzcsh41cvfp8i8589jm1yqn1cx1ad5rmryzsjalzp";
-      name = "kglobalaccel-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kglobalaccel-5.111.0.tar.xz";
+      sha256 = "10kviky0iddjpc96qa77g5gm8pzq6lmqwyzg2w7yx88pgly8gbbz";
+      name = "kglobalaccel-5.111.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kguiaddons-5.110.0.tar.xz";
-      sha256 = "0ajmxj8nhis6f4hwd64s9qfw3hbip80xrdy3d1wksykbq7g5b89c";
-      name = "kguiaddons-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kguiaddons-5.111.0.tar.xz";
+      sha256 = "1icr0s56i9js9zciacvraf101f4k1mgvjmw3nxwfpdjabzyv1ppp";
+      name = "kguiaddons-5.111.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kholidays-5.110.0.tar.xz";
-      sha256 = "0zikajmic93wqgy9865pf61sdlnsyzzf2jal7bj25is7a1mk8mjc";
-      name = "kholidays-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kholidays-5.111.0.tar.xz";
+      sha256 = "0xqj36psgk6m75d5138w1flllq5x4prw3ybchxxs6krk562bj32p";
+      name = "kholidays-5.111.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/khtml-5.110.0.tar.xz";
-      sha256 = "17d87vjim32mn0s1d9zl9342aamqg4xmi6xh6d8ghrgms3vqc7in";
-      name = "khtml-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/khtml-5.111.0.tar.xz";
+      sha256 = "0zspwy2yn1vqjn1vl12ym9qx76x0z1lpi6rbrcjv307z7krfrfzx";
+      name = "khtml-5.111.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/ki18n-5.110.0.tar.xz";
-      sha256 = "03qks9kncvazq2wz3myrjgz5m0gjxm80m1ayv9vjndyyc74a9smw";
-      name = "ki18n-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/ki18n-5.111.0.tar.xz";
+      sha256 = "09yzhmf167jpa9nzpvxc1c7la5l43z5igarhi64134cwr2yjf2jd";
+      name = "ki18n-5.111.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kiconthemes-5.110.0.tar.xz";
-      sha256 = "0bb6r7jaknjyhyjhdrlji320qgb7cgxshcgab0209zk8dl8a510d";
-      name = "kiconthemes-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kiconthemes-5.111.0.tar.xz";
+      sha256 = "07dv2h7d3vjipia8cwbbb5n13bwpfp2clz27ya8vrccy46q6wvx5";
+      name = "kiconthemes-5.111.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kidletime-5.110.0.tar.xz";
-      sha256 = "0hc30778d1k0vm4qsp58cf3d5bnws328qxazm8d5a6kxdc7izz44";
-      name = "kidletime-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kidletime-5.111.0.tar.xz";
+      sha256 = "1m0amd3mrsz685zjfr0livzw324j3z4h561vp7758krv70rz72iv";
+      name = "kidletime-5.111.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kimageformats-5.110.0.tar.xz";
-      sha256 = "0ivks2c2kgd26pr0n0b4x3hb7dmmq52vlp7f6ny14qpvm3cgnscd";
-      name = "kimageformats-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kimageformats-5.111.0.tar.xz";
+      sha256 = "17d69dgcq4qk6qjgb3l6hngv2qg26nxbca0mwwjb8hc8ixc9cym2";
+      name = "kimageformats-5.111.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kinit-5.110.0.tar.xz";
-      sha256 = "0ps2299hf02yvgs971cb4bljbmdbcvcmm2xqz6q0h8asjkpkilv5";
-      name = "kinit-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kinit-5.111.0.tar.xz";
+      sha256 = "1wp9zqi2rn4idy9jpmj66jb33y6lrscjlmwaz4xbdxhjqfqdxr9q";
+      name = "kinit-5.111.0.tar.xz";
     };
   };
   kio = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kio-5.110.0.tar.xz";
-      sha256 = "0sy91zlk60q5jligxp870srfc6fhd3fyk5yamkg266yfvyy9m3r2";
-      name = "kio-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kio-5.111.0.tar.xz";
+      sha256 = "0ifhmywhsp9kv51ihss9gwjlml6lk7i2xdxzqgc81k9bjiqd5gsi";
+      name = "kio-5.111.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kirigami2-5.110.0.tar.xz";
-      sha256 = "13j9z0nha3wq97apgkj43bayqijpgy6a2l7f9iryww054aqdjggx";
-      name = "kirigami2-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kirigami2-5.111.0.tar.xz";
+      sha256 = "04d6vcpivq48lnwx7l61lnana717z86q1wxbsyw2vmr4x8rn0m10";
+      name = "kirigami2-5.111.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kitemmodels-5.110.0.tar.xz";
-      sha256 = "06gym33644npci4crhykyfyp2v74pya72kdzmqh4lkzp252pyfhj";
-      name = "kitemmodels-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kitemmodels-5.111.0.tar.xz";
+      sha256 = "1i4wacyl1r0dy8r0sindrh6p2lxs97vxbriwzzf4hzgw3n0indjm";
+      name = "kitemmodels-5.111.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kitemviews-5.110.0.tar.xz";
-      sha256 = "1nqbypn0crbaqa8x19z0fh8mqbr8wbf8nc8wg0irzp32js9vcqyp";
-      name = "kitemviews-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kitemviews-5.111.0.tar.xz";
+      sha256 = "10yim2c1af7n4ivcj9nvwxplnh8jk9h6ljsq53ph5asac2sys7yv";
+      name = "kitemviews-5.111.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kjobwidgets-5.110.0.tar.xz";
-      sha256 = "1bl7igakmh1ipiamigs5s8fj6fy905b3j1dqgq9hxdxk59k1r1h2";
-      name = "kjobwidgets-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kjobwidgets-5.111.0.tar.xz";
+      sha256 = "08dvz4bl1bhad42q87850v274l4fdqfvxplhm22nvl3ba3iz93va";
+      name = "kjobwidgets-5.111.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kjs-5.110.0.tar.xz";
-      sha256 = "0xlkdi7qs75ipf87h8m7bvjn4l28y5qy20hvag1gc370fxz54v15";
-      name = "kjs-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kjs-5.111.0.tar.xz";
+      sha256 = "08yg66c7fg8fbkj4wg118haw6lskfy1l336ygfn650s1kaspz50g";
+      name = "kjs-5.111.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kjsembed-5.110.0.tar.xz";
-      sha256 = "1ynmj8ac9g9amjz0ljz3wf7sjsrwmz1kfi26r36rpqlf9mmkzfqm";
-      name = "kjsembed-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kjsembed-5.111.0.tar.xz";
+      sha256 = "0x1fb1baas932ygpyabpy0gb7mk2kbdszg4rpkcb69k34m8lg8g2";
+      name = "kjsembed-5.111.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kmediaplayer-5.110.0.tar.xz";
-      sha256 = "1jhh3gsbibi2hrhswg1nz1mdxn2wir5p9cvqpcqv7k8vm6rb82z3";
-      name = "kmediaplayer-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kmediaplayer-5.111.0.tar.xz";
+      sha256 = "0shr58j52ac2aman381cl8c0si0mvrym60qfqr9rhjk9d7xasiza";
+      name = "kmediaplayer-5.111.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/knewstuff-5.110.0.tar.xz";
-      sha256 = "0qld8ijy7z60qdlwa9vaq905xgzyvh5zw6ymngs00axl33m9bbbl";
-      name = "knewstuff-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/knewstuff-5.111.0.tar.xz";
+      sha256 = "0shvp6jgwyn96ggcgd2780sm44xl4w2jyb2apncjp36z0rw7sx35";
+      name = "knewstuff-5.111.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/knotifications-5.110.0.tar.xz";
-      sha256 = "0zm3d36v9dgqb3pdwpj962wpngfhq08q9x9rj99f88g9dlnmy6gm";
-      name = "knotifications-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/knotifications-5.111.0.tar.xz";
+      sha256 = "0v5dyd0ginnrm0n4hxxyzqbxrnj32svq9qz15swjmp36v4saaf8d";
+      name = "knotifications-5.111.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/knotifyconfig-5.110.0.tar.xz";
-      sha256 = "1651rh0av8lqp8rmb3djizsb8ypihkabprgppla3af2xf446n7wp";
-      name = "knotifyconfig-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/knotifyconfig-5.111.0.tar.xz";
+      sha256 = "0p24iajm8i5mvxfwk8wx3g95vg5rk0j217f2q3bixvivjkb336wl";
+      name = "knotifyconfig-5.111.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kpackage-5.110.0.tar.xz";
-      sha256 = "1jd85m7pxzah9d6b3zi2nswvsinx85brkiq142vic5l0rm6l89id";
-      name = "kpackage-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kpackage-5.111.0.tar.xz";
+      sha256 = "1pfg4bbr9jbw5pyb9hql4f200ccr7w6l2ynsy68l9f3kkz6i2csp";
+      name = "kpackage-5.111.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kparts-5.110.0.tar.xz";
-      sha256 = "13av8v2kggbvyv8nxganjb88q38g3gbykbkwrigywc3767p838r3";
-      name = "kparts-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kparts-5.111.0.tar.xz";
+      sha256 = "1vk062faaym2xc6lyh11yg2p0wvh9qab01wsz9pzf5jzphyd6dq1";
+      name = "kparts-5.111.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kpeople-5.110.0.tar.xz";
-      sha256 = "10drcfjcw00qhdlsficxb07hnnsd93smcig8argznpgwd61f807p";
-      name = "kpeople-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kpeople-5.111.0.tar.xz";
+      sha256 = "07sy2yrkbzh1rwmg6kl028wwhlxb328j2dv0jph7k6xy1drqz5r9";
+      name = "kpeople-5.111.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kplotting-5.110.0.tar.xz";
-      sha256 = "1fbzy9k0gx1468qsdd1c8fqaml3c01yy0m6n205y3ymkca78hdbk";
-      name = "kplotting-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kplotting-5.111.0.tar.xz";
+      sha256 = "17j4xwzc70bac50hifmg21fk8xfylpf9xfzfcn6ak339g91ll9ck";
+      name = "kplotting-5.111.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kpty-5.110.0.tar.xz";
-      sha256 = "1cx9wszi9zlay0vb9wz9hgbmbq006xgssnzzrmby4q4s6bhb92ps";
-      name = "kpty-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kpty-5.111.0.tar.xz";
+      sha256 = "04qwpxccl70a7a99fkjl33l3mf02qrhsqc9bkjmk06z08k52ys3q";
+      name = "kpty-5.111.0.tar.xz";
     };
   };
   kquickcharts = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kquickcharts-5.110.0.tar.xz";
-      sha256 = "0s8xnsmhx2m6wn7fmmddzwnwc2yr3kvy85vd65m3avfw073rgj5v";
-      name = "kquickcharts-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kquickcharts-5.111.0.tar.xz";
+      sha256 = "09sp58ln9sy1qmpl0hcz29cfaz7ljjhn3rwv679c7r54qpq5mqjv";
+      name = "kquickcharts-5.111.0.tar.xz";
     };
   };
   kross = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kross-5.110.0.tar.xz";
-      sha256 = "169zsxrmbdv5xn6s0wmf1l2a3qghn88hgl714i0cnymq5ixy25x5";
-      name = "kross-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kross-5.111.0.tar.xz";
+      sha256 = "0h5nfipj7bxj9lga8gdgkc0an2imgmx0c0lg2wpf1k4104m8hd9d";
+      name = "kross-5.111.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/krunner-5.110.0.tar.xz";
-      sha256 = "0q3jhq2cswnqj5rdkxhizlv06rsxsm38ipxhcsw6p8zqabi1i351";
-      name = "krunner-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/krunner-5.111.0.tar.xz";
+      sha256 = "1j1238vnmczffxcrjrrvmvlwbkd6qsmixd0wn45p2z0ff671fp49";
+      name = "krunner-5.111.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kservice-5.110.0.tar.xz";
-      sha256 = "0rin6v96mcmw53dzw8sw56g7188623d1k4vs18bv44l86gixdhgg";
-      name = "kservice-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kservice-5.111.0.tar.xz";
+      sha256 = "04ifmp21x94jsfk0pxy67xa9vddhbvikc96gjbzxxy61pvmbgl3c";
+      name = "kservice-5.111.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/ktexteditor-5.110.0.tar.xz";
-      sha256 = "0iwzw51km3mr8kdva14mxz9bvcfcf09v5igah2axkjaxazxyigla";
-      name = "ktexteditor-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/ktexteditor-5.111.0.tar.xz";
+      sha256 = "0af31frnnz8ckqz40r5k7ngkqa6frvas70n6va3ci03zs1qkli18";
+      name = "ktexteditor-5.111.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/ktextwidgets-5.110.0.tar.xz";
-      sha256 = "0cr7n58mak928dysyqhsr1pj0w90amikx9jav4gs4lzb4m4rjp7q";
-      name = "ktextwidgets-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/ktextwidgets-5.111.0.tar.xz";
+      sha256 = "1a8iz01w9vnbzlcpyqvy7j862pdj4x95b80binzp4y4mf1jxjkyw";
+      name = "ktextwidgets-5.111.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kunitconversion-5.110.0.tar.xz";
-      sha256 = "083w0gz157j2g8qzm03yq3qwq58wafcq26qcc2ly2fksyyxkzzda";
-      name = "kunitconversion-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kunitconversion-5.111.0.tar.xz";
+      sha256 = "0893q177371i881k1fypq8ykv7pwzy7p8kbafxw1xrcsfz664h05";
+      name = "kunitconversion-5.111.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kwallet-5.110.0.tar.xz";
-      sha256 = "0mg5y8cvzvs7w3yy5xnpsps2b6m476l5ilw5kvarrjjpq7ybnkqz";
-      name = "kwallet-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kwallet-5.111.0.tar.xz";
+      sha256 = "1gwpvmpi9m7dm620arrh6q25fhpdv2jv3flv6fmbvkmviidwcs9i";
+      name = "kwallet-5.111.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kwayland-5.110.0.tar.xz";
-      sha256 = "0ggxvywvqfhhhb5370n90dyw0mjwkp3i7rgv58nyqsmby0g08r85";
-      name = "kwayland-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kwayland-5.111.0.tar.xz";
+      sha256 = "0119jhdq6v70ccmh0dc26bc5kx2baz5678n1n7shss60h1wlcsbk";
+      name = "kwayland-5.111.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kwidgetsaddons-5.110.0.tar.xz";
-      sha256 = "1cyphs0r5j2v93pwi9mbn6xd928lnhb0zmyfj5pywdx9n7lv0x6a";
-      name = "kwidgetsaddons-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kwidgetsaddons-5.111.0.tar.xz";
+      sha256 = "0s8dsngxi8qrvgvckmxj5dhjawikkjvhbxlsaqw3fz8y8ax7jrjf";
+      name = "kwidgetsaddons-5.111.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kwindowsystem-5.110.0.tar.xz";
-      sha256 = "0l3aknr3zqz9zwqlyhnr8n53bcfb22rm38vdiv0l5vpwjbjn0270";
-      name = "kwindowsystem-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kwindowsystem-5.111.0.tar.xz";
+      sha256 = "1774xj96yzn7ddksd62qv5agzlml244a0gcr20i07wqv5kvblkrl";
+      name = "kwindowsystem-5.111.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/kxmlgui-5.110.0.tar.xz";
-      sha256 = "1j8v52ix9sv7q76cvl2gnpjs602ri57kgfh21bvqd88gf2xnwxjq";
-      name = "kxmlgui-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/kxmlgui-5.111.0.tar.xz";
+      sha256 = "13g8qan7k144zcjjp53ck5480v6gc1vvxwahgdvg95fvw8nqd4jm";
+      name = "kxmlgui-5.111.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/portingAids/kxmlrpcclient-5.110.0.tar.xz";
-      sha256 = "0fzd9amj2j4bw54q8fbgczqf785s6siqr1a8wbqf56wyyhki5psx";
-      name = "kxmlrpcclient-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/portingAids/kxmlrpcclient-5.111.0.tar.xz";
+      sha256 = "1s9gdp2sns4ivrgggf9sd0i9c9mbhbd9x9l2jiki5pmsbcwm6jvq";
+      name = "kxmlrpcclient-5.111.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/modemmanager-qt-5.110.0.tar.xz";
-      sha256 = "08q43arx9q81rqwhczzcn4cyl5glalwzjncb120a2cihida2m71v";
-      name = "modemmanager-qt-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/modemmanager-qt-5.111.0.tar.xz";
+      sha256 = "17917rd1i9k50ciagyij5i3j7kr3mi017zjs35c6b41sbpa4wfh2";
+      name = "modemmanager-qt-5.111.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/networkmanager-qt-5.110.0.tar.xz";
-      sha256 = "1bnlvpfhw6l64rgaxx9zkxd5wmwvyal5xmv31vxzf92ig6sgjdqq";
-      name = "networkmanager-qt-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/networkmanager-qt-5.111.0.tar.xz";
+      sha256 = "0bknnfaxjk3pp77s58vghvmdh3zl251nai3vlqk9ydyy55bc9vdq";
+      name = "networkmanager-qt-5.111.0.tar.xz";
     };
   };
   oxygen-icons5 = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/oxygen-icons5-5.110.0.tar.xz";
-      sha256 = "1dmig458gbl0ypb99kj514nwl5gbjpfvixw9lipgc2wwnn1nkia2";
-      name = "oxygen-icons5-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/oxygen-icons5-5.111.0.tar.xz";
+      sha256 = "1bp4hhd14cyl3qibp2k9ifn0gdzn0kdlcdnhwzw78wimn6rnkg7s";
+      name = "oxygen-icons5-5.111.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/plasma-framework-5.110.0.tar.xz";
-      sha256 = "0jfln8lrzmcnkqhl8pij5w6mdj6g25rwc332f07g9465y9ap07cf";
-      name = "plasma-framework-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/plasma-framework-5.111.0.tar.xz";
+      sha256 = "0zhcyf03z633a9j4swzggmvad8q5zhgp95z8b59327nbpzbg5yvv";
+      name = "plasma-framework-5.111.0.tar.xz";
     };
   };
   prison = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/prison-5.110.0.tar.xz";
-      sha256 = "019a3z18gq7nb3ahf5dd3b5fixzyfklg60dk2w4win2w19s70wb7";
-      name = "prison-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/prison-5.111.0.tar.xz";
+      sha256 = "1zyynvzldy98dkyan846h1gswisikfwvv23w8w6rchg6s8hzh9gc";
+      name = "prison-5.111.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/purpose-5.110.0.tar.xz";
-      sha256 = "0nl6qh7j5c3ijnq0qw1a5jmj1x5nb9hlssjjn8fdvfr7q6z67rsc";
-      name = "purpose-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/purpose-5.111.0.tar.xz";
+      sha256 = "1aggccqz6pk2cpp6l0r37yzp8hs88bliadfi25z8lm0xvmbih79i";
+      name = "purpose-5.111.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/qqc2-desktop-style-5.110.0.tar.xz";
-      sha256 = "04pyhlr89azw0kyjxfpx6phxljck8yiflcszd4xkgiw3n9rjyg3g";
-      name = "qqc2-desktop-style-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/qqc2-desktop-style-5.111.0.tar.xz";
+      sha256 = "1i051h8igjv58y12p0shcpg3frdhr18mmbz8xvyyksd2b158d0bc";
+      name = "qqc2-desktop-style-5.111.0.tar.xz";
     };
   };
   solid = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/solid-5.110.0.tar.xz";
-      sha256 = "1k64cqlws7nxki21cwg197avfnxsxpw3isry5p7bqyfmq45ydcvd";
-      name = "solid-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/solid-5.111.0.tar.xz";
+      sha256 = "1wqr322lqxm3cnrr69cz9dhd0b7ka53q59hqzvv0017zms72nzdr";
+      name = "solid-5.111.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/sonnet-5.110.0.tar.xz";
-      sha256 = "16qk63yy1y03z4rlc08qzr7mmds1yz0k9x1ws2nzp47khkza250i";
-      name = "sonnet-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/sonnet-5.111.0.tar.xz";
+      sha256 = "0dbaq0rdma81mla0j5zf88sb3435zzjhvw8qsiys01ciy1523v3h";
+      name = "sonnet-5.111.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/syndication-5.110.0.tar.xz";
-      sha256 = "0dsd05ckfv9fdnrbgprriba7lbbfs2z9qv869pcr4n7pn7x778sd";
-      name = "syndication-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/syndication-5.111.0.tar.xz";
+      sha256 = "10a4jx93l3hjhwl007gby3wx6lwpf61zsai843hzbb676rznv1s2";
+      name = "syndication-5.111.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/syntax-highlighting-5.110.0.tar.xz";
-      sha256 = "0gbmgan0cy4xhjcf10g0lffhwvkhhpcgbnk190xlzl4chnmpq9w5";
-      name = "syntax-highlighting-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/syntax-highlighting-5.111.0.tar.xz";
+      sha256 = "0rsq8bq40g11qwil0zmfadksvqh74vgwik1p3z7r49w9pz96m9n0";
+      name = "syntax-highlighting-5.111.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.110.0";
+    version = "5.111.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.110/threadweaver-5.110.0.tar.xz";
-      sha256 = "085y4m7z0rybsvpqzl2sjwnf8yjm4lnc3n49idj2c0psm8v5ksm0";
-      name = "threadweaver-5.110.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.111/threadweaver-5.111.0.tar.xz";
+      sha256 = "0rmpdns5jvdd227crs7cl3f1qlmkva1qizypx8nb7wyk73mnq6wb";
+      name = "threadweaver-5.111.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/libglvnd/default.nix b/pkgs/development/libraries/libglvnd/default.nix
index fa9562947f81..b7ccb7085fb2 100644
--- a/pkgs/development/libraries/libglvnd/default.nix
+++ b/pkgs/development/libraries/libglvnd/default.nix
@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libglvnd";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "glvnd";
     repo = "libglvnd";
     rev = "v${version}";
-    sha256 = "sha256-p/vLxagN9nCYw1JpUmZetgctQbrp3Wo33OVFrtvmnjQ=";
+    sha256 = "sha256-2U9JtpGyP4lbxtVJeP5GUgh5XthloPvFIw28+nldYx8=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config python3 addOpenGLRunpath ];
@@ -69,6 +69,8 @@ stdenv.mkDerivation rec {
     changelog = "https://gitlab.freedesktop.org/glvnd/libglvnd/-/tags/v${version}";
     license = with licenses; [ mit bsd1 bsd3 gpl3Only asl20 ];
     platforms = platforms.unix;
+    # https://gitlab.freedesktop.org/glvnd/libglvnd/-/issues/212
+    badPlatforms = [ lib.systems.inspect.platformPatterns.isStatic ];
     maintainers = with maintainers; [ primeos ];
   };
 }
diff --git a/pkgs/development/libraries/libical/default.nix b/pkgs/development/libraries/libical/default.nix
index 2cb8642ca87e..bd7a7a61eb52 100644
--- a/pkgs/development/libraries/libical/default.nix
+++ b/pkgs/development/libraries/libical/default.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libical";
-  version = "3.0.16";
+  version = "3.0.17";
 
   outputs = [ "out" "dev" ]; # "devdoc" ];
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "libical";
     repo = "libical";
     rev = "v${version}";
-    sha256 = "sha256-3D/0leI3LLKDFOXkKSrmMamLoaXdi/2Z4iPUXqgwtg8=";
+    sha256 = "sha256-GqPCjI40kkqNv9zTnLdJgZVBxS4eZRHl+k/BN9vGnDo=";
   };
 
   strictDeps = true;
@@ -105,6 +105,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/libical/libical";
     description = "An Open Source implementation of the iCalendar protocols";
+    changelog = "https://github.com/libical/libical/raw/v${version}/ReleaseNotes.txt";
     license = licenses.mpl20;
     platforms = platforms.unix;
   };
diff --git a/pkgs/development/libraries/libimagequant/Cargo.lock b/pkgs/development/libraries/libimagequant/Cargo.lock
index 8823a070b81b..fdad112994ac 100644
--- a/pkgs/development/libraries/libimagequant/Cargo.lock
+++ b/pkgs/development/libraries/libimagequant/Cargo.lock
@@ -76,16 +76,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "crossbeam-channel"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
-]
-
-[[package]]
 name = "crossbeam-deque"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -135,9 +125,9 @@ dependencies = [
 
 [[package]]
 name = "flate2"
-version = "1.0.27"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010"
+checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -153,18 +143,11 @@ dependencies = [
 ]
 
 [[package]]
-name = "hermit-abi"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
-
-[[package]]
 name = "imagequant"
-version = "4.2.1"
+version = "4.2.2"
 dependencies = [
  "arrayvec",
  "lodepng",
- "num_cpus",
  "once_cell",
  "rayon",
  "rgb",
@@ -173,7 +156,7 @@ dependencies = [
 
 [[package]]
 name = "imagequant-sys"
-version = "4.0.2"
+version = "4.0.3"
 dependencies = [
  "bitflags",
  "imagequant",
@@ -182,15 +165,15 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.147"
+version = "0.2.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
 
 [[package]]
 name = "lodepng"
-version = "3.7.2"
+version = "3.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0ad39f75bbaa4b10bb6f2316543632a8046a5bcf9c785488d79720b21f044f8"
+checksum = "a3cdccd0cf57a5d456f0656ebcff72c2e19503287e1afbf3b84382812adc0606"
 dependencies = [
  "crc32fast",
  "fallible_collections",
@@ -218,16 +201,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "num_cpus"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
-dependencies = [
- "hermit-abi",
- "libc",
-]
-
-[[package]]
 name = "once_cell"
 version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -235,9 +208,9 @@ checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "rayon"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b"
+checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
 dependencies = [
  "either",
  "rayon-core",
@@ -245,14 +218,12 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d"
+checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
 dependencies = [
- "crossbeam-channel",
  "crossbeam-deque",
  "crossbeam-utils",
- "num_cpus",
 ]
 
 [[package]]
diff --git a/pkgs/development/libraries/libimagequant/default.nix b/pkgs/development/libraries/libimagequant/default.nix
index 5792170b9f09..0ac6e89e23ea 100644
--- a/pkgs/development/libraries/libimagequant/default.nix
+++ b/pkgs/development/libraries/libimagequant/default.nix
@@ -5,13 +5,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "libimagequant";
-  version = "4.2.1";
+  version = "4.2.2";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
     repo = pname;
     rev = version;
-    hash = "sha256-a5TztgNFRV9BVERpHI33ZEYwfOR46F9FzmbquzwGq3k=";
+    hash = "sha256-cZgnJOmj+xJDcewsxH2Jp5AAnFZKVuYxKPtoGeN03g4=";
   };
 
   cargoLock = {
diff --git a/pkgs/development/libraries/libiscsi/default.nix b/pkgs/development/libraries/libiscsi/default.nix
index 806a9729c574..826593b9d66c 100644
--- a/pkgs/development/libraries/libiscsi/default.nix
+++ b/pkgs/development/libraries/libiscsi/default.nix
@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
     sha256 = "0ajrkkg5awmi8m4b3mha7h07ylg18k252qprvk1sgq0qbyd66zy7";
   };
 
+  postPatch = ''
+    substituteInPlace lib/socket.c \
+      --replace "void iscsi_decrement_iface_rr() {" "void iscsi_decrement_iface_rr(void) {"
+  '';
+
   nativeBuildInputs = [ autoreconfHook ];
 
   # This problem is gone on libiscsi master.
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 7be9bee23a25..9d3ec125248e 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , autoconf
 , automake
 , libtool
@@ -33,6 +34,15 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-Lrsyh4qd3OkTw1cSPfahzfSGNt6+pRN1X21iiv1SsFo=";
   };
 
+  patches = [
+    # Disable io_uring close on selected kernels. Remove on next release
+    # https://github.com/libuv/libuv/pull/4141
+    (fetchpatch {
+      url = "https://github.com/libuv/libuv/commit/c811169f91b2101f7302e96de3d2dc366ade3a25.patch";
+      hash = "sha256-7vk6XGXwJcwYUQPqIJ3JPd/fPIGrjE5WRDSJCMQfKeU=";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
 
   postPatch = let
@@ -113,7 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "A multi-platform support library with a focus on asynchronous I/O";
     homepage    = "https://libuv.org/";
     changelog   = "https://github.com/libuv/libuv/blob/v${finalAttrs.version}/ChangeLog";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ marsam ];
     platforms   = platforms.all;
     license     = with licenses; [ mit isc bsd2 bsd3 cc-by-40 ];
   };
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index 7796ec251582..43fe69af2b0e 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.19.0";
+  version = "2.20.0";
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "libva";
     rev    = version;
-    sha256 = "sha256-M6mAHvGl4d9EqdkDBSxSbpZUCUcrkpnf+hfo16L3eHs=";
+    sha256 = "sha256-ENAsytjqvS8xHZyZLPih3bzBgQ1f/j+s3dWZs1GTWHs=";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/libvterm-neovim/default.nix b/pkgs/development/libraries/libvterm-neovim/default.nix
index 27ce41d20f62..0e92d28046aa 100644
--- a/pkgs/development/libraries/libvterm-neovim/default.nix
+++ b/pkgs/development/libraries/libvterm-neovim/default.nix
@@ -8,11 +8,11 @@
 stdenv.mkDerivation rec {
   pname = "libvterm-neovim";
   # Releases are not tagged, look at commit history to find latest release
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchurl {
-    url = "https://www.leonerd.org.uk/code/libvterm/libvterm-${version}.tar.gz";
-    sha256 = "sha256-ketQiAafTm7atp4UxCEvbaAZLmVpWVbcBIAWoNq4vPY=";
+    url = "https://launchpad.net/libvterm/trunk/v${lib.versions.majorMinor version}/+download/libvterm-${version}.tar.gz";
+    hash = "sha256-CRVvQ90hKL00fL7r5Q2aVx0yxk4M8Y0hEZeUav9yJuA=";
   };
 
   nativeBuildInputs = [ perl libtool ];
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index ea0059e34b61..8e1447c31fa3 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -223,6 +223,7 @@ self = stdenv.mkDerivation {
     libffi libvdpau libelf libXvMC
     libpthreadstubs openssl /*or another sha1 provider*/
     zstd libunwind
+    python3Packages.python # for shebang
   ] ++ lib.optionals haveWayland [ wayland wayland-protocols ]
     ++ lib.optionals stdenv.isLinux [ libomxil-bellagio libva-minimal udev lm_sensors ]
     ++ lib.optionals enableOpenCL [ libclc llvmPackages.clang llvmPackages.clang-unwrapped rustc rust-bindgen' spirv-llvm-translator' ]
@@ -320,6 +321,9 @@ self = stdenv.mkDerivation {
       fi
     done
 
+    # Don't depend on build python
+    patchShebangs --host --update $out/bin/*
+
     # NAR doesn't support hard links, so convert them to symlinks to save space.
     jdupes --hard-links --link-soft --recurse "$drivers"
 
diff --git a/pkgs/development/libraries/onnxruntime/default.nix b/pkgs/development/libraries/onnxruntime/default.nix
index 4a9ee61f5614..5252875b27e9 100644
--- a/pkgs/development/libraries/onnxruntime/default.nix
+++ b/pkgs/development/libraries/onnxruntime/default.nix
@@ -17,7 +17,7 @@
 , microsoft-gsl
 , iconv
 , gtest
-, protobuf3_21
+, protobuf_21
 , pythonSupport ? true
 }:
 
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
     python3Packages.python
-    protobuf3_21
+    protobuf_21
   ] ++ lib.optionals pythonSupport (with python3Packages; [
     setuptools
     wheel
@@ -177,7 +177,7 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
     tests = lib.optionalAttrs pythonSupport {
       python = python3Packages.onnxruntime;
     };
diff --git a/pkgs/development/libraries/opencore-amr/default.nix b/pkgs/development/libraries/opencore-amr/default.nix
index 26b2715658bb..38a50b75027b 100644
--- a/pkgs/development/libraries/opencore-amr/default.nix
+++ b/pkgs/development/libraries/opencore-amr/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "opencore-amr";
-  version = "0.1.5";
+  version = "0.1.6";
   src = fetchurl {
-    url = "https://vorboss.dl.sourceforge.net/project/opencore-amr/opencore-amr/opencore-amr-${version}.tar.gz";
-    sha256 = "0hfk9khz3by0119h3jdwgdfd7jgkdbzxnmh1wssvylgnsnwnq01c";
+    url = "mirror://sourceforge/opencore-amr/opencore-amr/opencore-amr-${version}.tar.gz";
+    hash = "sha256-SD60BhCI4rNLNY5HVAtdSVqWzUaONhBQ+uYVsYCdxKE=";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 037192d871e7..7e928a98c53d 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -2,7 +2,7 @@
 , fetchFromGitHub
 , fetchpatch
 , cmake, pkg-config, unzip, zlib, pcre, hdf5
-, glog, boost, gflags, protobuf3_21
+, glog, boost, gflags, protobuf_21
 , config
 
 , enableJPEG      ? true, libjpeg
@@ -186,7 +186,7 @@ stdenv.mkDerivation {
 
   buildInputs =
        [ zlib pcre hdf5 glog boost gflags ]
-    ++ lib.optional useSystemProtobuf protobuf3_21
+    ++ lib.optional useSystemProtobuf protobuf_21
     ++ lib.optional enablePython pythonPackages.python
     ++ lib.optional enableGtk2 gtk2
     ++ lib.optional enableGtk3 gtk3
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 68099a57c63f..6268a2c02e5d 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -11,7 +11,7 @@
 , hdf5
 , boost
 , gflags
-, protobuf3_21
+, protobuf_21
 , config
 , ocl-icd
 , buildPackages
@@ -317,7 +317,7 @@ stdenv.mkDerivation {
     echo '"(build info elided)"' > modules/core/version_string.inc
   '';
 
-  buildInputs = [ zlib pcre boost gflags protobuf3_21 ]
+  buildInputs = [ zlib pcre boost gflags protobuf_21 ]
     ++ lib.optional enablePython pythonPackages.python
     ++ lib.optional (stdenv.buildPlatform == stdenv.hostPlatform) hdf5
     ++ lib.optional enableGtk2 gtk2
@@ -369,7 +369,7 @@ stdenv.mkDerivation {
     "-DOPENCV_GENERATE_PKGCONFIG=ON"
     "-DWITH_OPENMP=ON"
     "-DBUILD_PROTOBUF=OFF"
-    "-DProtobuf_PROTOC_EXECUTABLE=${lib.getExe buildPackages.protobuf3_21}"
+    "-DProtobuf_PROTOC_EXECUTABLE=${lib.getExe buildPackages.protobuf_21}"
     "-DPROTOBUF_UPDATE_FILES=ON"
     "-DOPENCV_ENABLE_NONFREE=${printEnabled enableUnfree}"
     "-DBUILD_TESTS=${printEnabled runAccuracyTests}"
diff --git a/pkgs/development/libraries/openjpeg/default.nix b/pkgs/development/libraries/openjpeg/default.nix
index 50098de03ddf..d528e2fc0302 100644
--- a/pkgs/development/libraries/openjpeg/default.nix
+++ b/pkgs/development/libraries/openjpeg/default.nix
@@ -25,8 +25,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     # modernise cmake files, also fixes them for multiple outputs
+    # https://github.com/uclouvain/openjpeg/pull/1424
     (fetchpatch {
-      url = "https://github.com/uclouvain/openjpeg/pull/1424.patch";
+      name = "uclouvain-openjpeg-pull-1424.patch";
+      url = "https://github.com/uclouvain/openjpeg/compare/52927287402a9f7353de8854c88f931051211e2f...9d4f70cfe99626f82f9c8dcbf45f07709e3511b2.patch";
       sha256 = "sha256-CxVRt1u4HVOMUjWiZ2plmZC29t/zshCpSY+N4Wlrlvg=";
     })
     # fix cmake files cross compilation
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 2b0d778ef3d7..9ae20a0e2e46 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -18,14 +18,14 @@
 # files.
 
 let
-  common = { version, sha256, patches ? [], withDocs ? false, extraMeta ? {} }:
+  common = { version, hash, patches ? [], withDocs ? false, extraMeta ? {} }:
    stdenv.mkDerivation (finalAttrs: {
     pname = "openssl";
     inherit version;
 
     src = fetchurl {
       url = "https://www.openssl.org/source/${finalAttrs.pname}-${version}.tar.gz";
-      inherit sha256;
+      inherit hash;
     };
 
     inherit patches;
@@ -222,6 +222,7 @@ let
       description = "A cryptographic library that implements the SSL and TLS protocols";
       license = licenses.openssl;
       mainProgram = "openssl";
+      maintainers = with maintainers; [ thillux ];
       pkgConfigModules = [
         "libcrypto"
         "libssl"
@@ -238,7 +239,7 @@ in {
   # and backport this to stable release (23.05).
   openssl_1_1 = common {
     version = "1.1.1w";
-    sha256 = "sha256-zzCYlQy02FOtlcCEHx+cbT3BAtzPys1SHZOSUgi3asg=";
+    hash = "sha256-zzCYlQy02FOtlcCEHx+cbT3BAtzPys1SHZOSUgi3asg=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
@@ -256,7 +257,29 @@ in {
 
   openssl_3 = common {
     version = "3.0.11";
-    sha256 = "sha256-s0JdO7SiIY0Gl+tB9/wM3t4BbtGcpJ0Wi3jo2UeIf1U=";
+    hash = "sha256-s0JdO7SiIY0Gl+tB9/wM3t4BbtGcpJ0Wi3jo2UeIf1U=";
+    patches = [
+      ./3.0/nix-ssl-cert-file.patch
+
+      # openssl will only compile in KTLS if the current kernel supports it.
+      # This patch disables build-time detection.
+      ./3.0/openssl-disable-kernel-detection.patch
+
+      (if stdenv.hostPlatform.isDarwin
+       then ./use-etc-ssl-certs-darwin.patch
+       else ./use-etc-ssl-certs.patch)
+    ];
+
+    withDocs = true;
+
+    extraMeta = with lib; {
+      license = licenses.asl20;
+    };
+  };
+
+  openssl_3_1 = common {
+    version = "3.1.3";
+    hash = "sha256-8DFqLr2J5/I1KXZEVFhon4AwIJN4jEZmkvsqGIsurPY=";
     patches = [
       ./3.0/nix-ssl-cert-file.patch
 
diff --git a/pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch b/pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch
deleted file mode 100644
index fab89c4ffd93..000000000000
--- a/pkgs/development/libraries/pipewire/0040-alsa-profiles-use-libdir.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 99a4b2d1..d4a4cda7 100644
---- a/meson.build
-+++ b/meson.build
-@@ -55,7 +55,7 @@ endif
- 
- spa_plugindir = pipewire_libdir / spa_name
- 
--alsadatadir = pipewire_datadir / 'alsa-card-profile' / 'mixer'
-+alsadatadir = pipewire_libdir / '..' / 'share' / 'alsa-card-profile' / 'mixer'
- 
- pipewire_headers_dir = pipewire_name / 'pipewire'
- 
diff --git a/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch b/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch
deleted file mode 100644
index 230f1b30394a..000000000000
--- a/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff --git a/meson_options.txt b/meson_options.txt
-index 961ae2a76..692b84dfd 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -179,6 +179,9 @@ option('udev',
- option('udevrulesdir',
-        type : 'string',
-        description : 'Directory for udev rules (defaults to /lib/udev/rules.d)')
-+option('pipewire_pulse_prefix',
-+       type : 'string',
-+       description: 'Install directory for the pipewire-pulse daemon')
- option('systemd-system-unit-dir',
-        type : 'string',
-        description : 'Directory for system systemd units (defaults to /usr/lib/systemd/system)')
-diff --git a/src/daemon/systemd/user/meson.build b/src/daemon/systemd/user/meson.build
-index d17f3794f..34afe4f1a 100644
---- a/src/daemon/systemd/user/meson.build
-+++ b/src/daemon/systemd/user/meson.build
-@@ -9,7 +9,7 @@ install_data(
- 
- systemd_config = configuration_data()
- systemd_config.set('PW_BINARY', pipewire_bindir / 'pipewire')
--systemd_config.set('PW_PULSE_BINARY', pipewire_bindir / 'pipewire-pulse')
-+systemd_config.set('PW_PULSE_BINARY', get_option('pipewire_pulse_prefix') / 'bin/pipewire-pulse')
- 
- configure_file(input : 'pipewire.service.in',
-                output : 'pipewire.service',
diff --git a/pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch b/pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch
deleted file mode 100644
index b8d8fcb0f905..000000000000
--- a/pkgs/development/libraries/pipewire/0080-pipewire-config-dir.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff --git a/meson.build b/meson.build
-index b6b4553b..f21c29d8 100644
---- a/meson.build
-+++ b/meson.build
-@@ -37,7 +37,10 @@ pipewire_localedir = prefix / get_option('localedir')
- pipewire_sysconfdir = prefix / get_option('sysconfdir')
- 
- pipewire_configdir = pipewire_sysconfdir / 'pipewire'
--pipewire_confdatadir = pipewire_datadir / 'pipewire'
-+pipewire_confdatadir = get_option('pipewire_confdata_dir')
-+if pipewire_confdatadir == ''
-+  pipewire_confdatadir = pipewire_datadir / 'pipewire'
-+endif
- modules_install_dir = pipewire_libdir / pipewire_name
- 
- if host_machine.system() == 'linux'
-diff --git a/meson_options.txt b/meson_options.txt
-index 9bc33fcd..e4bd2dc1 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -61,6 +61,9 @@ option('jack-devel',
- option('libjack-path',
-        description: 'Where to install the libjack.so library',
-        type: 'string')
-+option('pipewire_confdata_dir',
-+       type: 'string',
-+       description: 'Directory for pipewire default configuration (defaults to /usr/share/pipewire)')
- option('spa-plugins',
-        description: 'Enable spa plugins integration',
-        type: 'feature',
diff --git a/pkgs/development/libraries/pipewire/0090-pipewire-config-template-paths.patch b/pkgs/development/libraries/pipewire/0090-pipewire-config-template-paths.patch
deleted file mode 100644
index ca7d351257bf..000000000000
--- a/pkgs/development/libraries/pipewire/0090-pipewire-config-template-paths.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-diff --git a/src/daemon/minimal.conf.in b/src/daemon/minimal.conf.in
-index 9c885a38f..c474eb45d 100644
---- a/src/daemon/minimal.conf.in
-+++ b/src/daemon/minimal.conf.in
-@@ -111,7 +111,7 @@ context.modules = [
-             # access.allowed to list an array of paths of allowed
-             # apps.
-             #access.allowed = [
--            #    @session_manager_path@
-+            #    <session_manager_path>
-             #]
- 
-             # An array of rejected paths.
-@@ -359,5 +359,5 @@ context.exec = [
-     # It can be interesting to start another daemon here that listens
-     # on another address with the -a option (eg. -a tcp:4713).
-     #
--    #@pulse_comment@{ path = "@pipewire_path@" args = "-c pipewire-pulse.conf" }
-+    #@pulse_comment@{ path = "<pipewire_path>" args = "-c pipewire-pulse.conf" }
- ]
-diff --git a/src/daemon/pipewire.conf.in b/src/daemon/pipewire.conf.in
-index 697bf094d..3a7b54ddd 100644
---- a/src/daemon/pipewire.conf.in
-+++ b/src/daemon/pipewire.conf.in
-@@ -142,7 +142,7 @@ context.modules = [
-             # access.allowed to list an array of paths of allowed
-             # apps.
-             #access.allowed = [
--            #    @session_manager_path@
-+            #    <session_manager_path>
-             #]
- 
-             # An array of rejected paths.
-@@ -294,7 +294,7 @@ context.exec = [
-     # but it is better to start it as a systemd service.
-     # Run the session manager with -h for options.
-     #
--    @sm_comment@{ path = "@session_manager_path@" args = "@session_manager_args@"
-+    @sm_comment@{ path = "<session_manager_path>" args = "@session_manager_args@"
-     @sm_comment@  condition = [ { exec.session-manager = null } { exec.session-manager = true } ] }
-     #
-     # You can optionally start the pulseaudio-server here as well
-@@ -302,6 +302,6 @@ context.exec = [
-     # It can be interesting to start another daemon here that listens
-     # on another address with the -a option (eg. -a tcp:4713).
-     #
--    @pulse_comment@{ path = "@pipewire_path@" args = "-c pipewire-pulse.conf"
-+    @pulse_comment@{ path = "<pipewire_path>" args = "-c pipewire-pulse.conf"
-     @pulse_comment@  condition = [ { exec.pipewire-pulse = null } { exec.pipewire-pulse = true } ] }
- ]
diff --git a/pkgs/development/libraries/pipewire/0095-spa-data-dir.patch b/pkgs/development/libraries/pipewire/0095-spa-data-dir.patch
deleted file mode 100644
index d8241a809f65..000000000000
--- a/pkgs/development/libraries/pipewire/0095-spa-data-dir.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 56599ebd1..3bed2d3e3 100644
---- a/meson.build
-+++ b/meson.build
-@@ -54,7 +54,7 @@ else
- endif
- 
- spa_plugindir = pipewire_libdir / spa_name
--spa_datadir = pipewire_datadir / spa_name
-+spa_datadir = pipewire_libdir / spa_name
- 
- alsadatadir = pipewire_datadir / 'alsa-card-profile' / 'mixer'
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 1e66d1573fc5..05741652f465 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -70,6 +70,7 @@
 , tinycompress
 , ffadoSupport ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
 , ffado
+, libselinux
 }:
 
 # Bluetooth codec only makes sense if general bluetooth enabled
@@ -80,12 +81,10 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.80";
+    version = "0.3.83";
 
     outputs = [
       "out"
-      "lib"
-      "pulse"
       "jack"
       "dev"
       "doc"
@@ -98,30 +97,14 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-6Ka83Bqd/nsfp8rv0GTBerpGP226MeZvC5u/j62FzP0=";
+      sha256 = "sha256-12g8/zLTCQkBtgwE6zt3yEDwcHCr2LQXJCjB1nqbmB0=";
     };
 
     patches = [
-      # Break up a dependency cycle between outputs.
-      ./0040-alsa-profiles-use-libdir.patch
-      # Change the path of the pipewire-pulse binary in the service definition.
-      ./0050-pipewire-pulse-path.patch
       # Load libjack from a known location
       ./0060-libjack-path.patch
       # Move installed tests into their own output.
       ./0070-installed-tests-path.patch
-      # Add option for changing the config install directory
-      ./0080-pipewire-config-dir.patch
-      # Remove output paths from the comments in the config templates to break dependency cycles
-      ./0090-pipewire-config-template-paths.patch
-      # Place SPA data files in lib output to avoid dependency cycles
-      ./0095-spa-data-dir.patch
-
-      # backport fix for building with webrtc-audio-processing 0.3 on platforms where we don't have 1.x
-      (fetchpatch {
-        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/1f1c308c9766312e684f0b53fc2d1422c7414d31.patch";
-        hash = "sha256-ECM7/84G99yzXsg5A2DkFnXFGJSV9lz3vD0IRSzR8vU=";
-      })
     ];
 
     strictDeps = true;
@@ -142,6 +125,7 @@ let
       glib
       libjack2
       libusb1
+      libselinux
       libsndfile
       lilv
       ncurses
@@ -174,9 +158,7 @@ let
       "-Dudevrulesdir=lib/udev/rules.d"
       "-Dinstalled_tests=enabled"
       "-Dinstalled_test_prefix=${placeholder "installedTests"}"
-      "-Dpipewire_pulse_prefix=${placeholder "pulse"}"
       "-Dlibjack-path=${placeholder "jack"}/lib"
-      "-Dlibv4l2-path=${placeholder "out"}/lib"
       "-Dlibcamera=${mesonEnableFeature libcameraSupport}"
       "-Dlibffado=${mesonEnableFeature ffadoSupport}"
       "-Droc=${mesonEnableFeature rocSupport}"
@@ -185,7 +167,6 @@ let
       "-Dgstreamer=${mesonEnableFeature gstreamerSupport}"
       "-Dsystemd-system-service=${mesonEnableFeature enableSystemd}"
       "-Dudev=${mesonEnableFeature (!enableSystemd)}"
-      "-Dudevrulesdir=${placeholder "out"}/lib/udev/rules.d"
       "-Dffmpeg=${mesonEnableFeature ffmpegSupport}"
       "-Dbluez5=${mesonEnableFeature bluezSupport}"
       "-Dbluez5-backend-hsp-native=${mesonEnableFeature nativeHspSupport}"
@@ -198,7 +179,6 @@ let
       "-Dbluez5-codec-lc3=${mesonEnableFeature bluezSupport}"
       "-Dbluez5-codec-ldac=${mesonEnableFeature ldacbtSupport}"
       "-Dsysconfdir=/etc"
-      "-Dpipewire_confdata_dir=${placeholder "lib"}/share/pipewire"
       "-Draop=${mesonEnableFeature raopSupport}"
       "-Dsession-managers="
       "-Dvulkan=enabled"
@@ -222,15 +202,6 @@ let
     '';
 
     postInstall = ''
-      ${lib.optionalString enableSystemd ''
-        moveToOutput "share/systemd/user/pipewire-pulse.*" "$pulse"
-        moveToOutput "lib/systemd/user/pipewire-pulse.*" "$pulse"
-      ''}
-
-      rm $out/bin/pipewire-pulse
-      mkdir -p $pulse/bin
-      ln -sf $out/bin/pipewire $pulse/bin/pipewire-pulse
-
       moveToOutput "bin/pw-jack" "$jack"
     '';
 
diff --git a/pkgs/development/libraries/protobuf/21.nix b/pkgs/development/libraries/protobuf/21.nix
new file mode 100644
index 000000000000..09a8c81b3d13
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/21.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix ({
+  version = "21.12";
+  hash = "sha256-VZQEFHq17UsTH5CZZOcJBKiScGV2xPJ/e6gkkVliRCU=";
+} // args)
diff --git a/pkgs/development/libraries/protobuf/23.nix b/pkgs/development/libraries/protobuf/23.nix
new file mode 100644
index 000000000000..abb2cc2f4460
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/23.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix ({
+  version = "23.4";
+  hash = "sha256-eI+mrsZAOLEsdyTC3B+K+GjD3r16CmPx1KJ2KhCwFdg=";
+} // args)
diff --git a/pkgs/development/libraries/protobuf/24.nix b/pkgs/development/libraries/protobuf/24.nix
new file mode 100644
index 000000000000..6741b8afe52e
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/24.nix
@@ -0,0 +1,6 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix ({
+  version = "24.4";
+  hash = "sha256-I+Xtq4GOs++f/RlVff9MZuolXrMLmrZ2z6mkBayqQ2s=";
+} // args)
diff --git a/pkgs/development/libraries/protobuf/3.21.nix b/pkgs/development/libraries/protobuf/3.21.nix
deleted file mode 100644
index fe85be8cf022..000000000000
--- a/pkgs/development/libraries/protobuf/3.21.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ callPackage, ... } @ args:
-
-callPackage ./generic-v3-cmake.nix ({
-  version = "3.21.12";
-  sha256 = "sha256-VZQEFHq17UsTH5CZZOcJBKiScGV2xPJ/e6gkkVliRCU=";
-} // args)
diff --git a/pkgs/development/libraries/protobuf/3.23.nix b/pkgs/development/libraries/protobuf/3.23.nix
deleted file mode 100644
index 2d658d57419b..000000000000
--- a/pkgs/development/libraries/protobuf/3.23.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ callPackage, ... } @ args:
-
-callPackage ./generic-v3-cmake.nix ({
-  version = "3.23.4";
-  sha256 = "sha256-eI+mrsZAOLEsdyTC3B+K+GjD3r16CmPx1KJ2KhCwFdg=";
-} // args)
diff --git a/pkgs/development/libraries/protobuf/3.24.nix b/pkgs/development/libraries/protobuf/3.24.nix
deleted file mode 100644
index 60ad747194df..000000000000
--- a/pkgs/development/libraries/protobuf/3.24.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ callPackage, ... } @ args:
-
-callPackage ./generic-v3-cmake.nix ({
-  version = "3.24.3";
-  sha256 = "sha256-wXGQW/o674DeLXX2IlyZskl5OrBcSRptOMoJqLQGm94=";
-} // args)
diff --git a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix b/pkgs/development/libraries/protobuf/generic.nix
index dd31aba434ce..adf271a6dc47 100644
--- a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
+++ b/pkgs/development/libraries/protobuf/generic.nix
@@ -11,7 +11,7 @@
 , gtest
 , zlib
 , version
-, sha256
+, hash
 
   # downstream dependencies
 , python3
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "protocolbuffers";
     repo = "protobuf";
     rev = "v${version}";
-    inherit sha256;
+    inherit hash;
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
@@ -37,12 +37,12 @@ stdenv.mkDerivation (finalAttrs: {
       --replace 'tmpnam(b)' '"'$TMPDIR'/foo"'
   '';
 
-  patches = lib.optionals (lib.versionOlder version "3.22") [
+  patches = lib.optionals (lib.versionOlder version "22") [
     # fix protobuf-targets.cmake installation paths, and allow for CMAKE_INSTALL_LIBDIR to be absolute
     # https://github.com/protocolbuffers/protobuf/pull/10090
     (fetchpatch {
       url = "https://github.com/protocolbuffers/protobuf/commit/a7324f88e92bc16b57f3683403b6c993bf68070b.patch";
-      sha256 = "sha256-SmwaUjOjjZulg/wgNmR/F5b8rhYA2wkKAjHIOxjcQdQ=";
+      hash = "sha256-SmwaUjOjjZulg/wgNmR/F5b8rhYA2wkKAjHIOxjcQdQ=";
     })
   ] ++ lib.optionals stdenv.hostPlatform.isStatic [
     ./static-executables-have-no-rpath.patch
@@ -71,23 +71,23 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  cmakeDir = if lib.versionOlder version "3.22" then "../cmake" else null;
+  cmakeDir = if lib.versionOlder version "22" then "../cmake" else null;
   cmakeFlags = [
     "-Dprotobuf_USE_EXTERNAL_GTEST=ON"
     "-Dprotobuf_ABSL_PROVIDER=package"
   ] ++ lib.optionals enableShared [
     "-Dprotobuf_BUILD_SHARED_LIBS=ON"
   ]
-  # Tests fail to build on 32-bit platforms; fixed in 3.22
+  # Tests fail to build on 32-bit platforms; fixed in 22.x
   # https://github.com/protocolbuffers/protobuf/issues/10418
-  ++ lib.optionals (stdenv.targetPlatform.is32bit && lib.versionOlder version "3.22") [
+  ++ lib.optionals (stdenv.targetPlatform.is32bit && lib.versionOlder version "22") [
     "-Dprotobuf_BUILD_TESTS=OFF"
   ];
 
-  # FIXME: investigate.  3.24 and 3.23 have different errors.
+  # FIXME: investigate.  24.x and 23.x have different errors.
   # At least some of it is not reproduced on some other machine; example:
   # https://hydra.nixos.org/build/235677717/nixlog/4/tail
-  doCheck = !(stdenv.isDarwin && lib.versionAtLeast version "3.23");
+  doCheck = !(stdenv.isDarwin && lib.versionAtLeast version "23");
 
   passthru = {
     tests = {
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index e6e6b24360a4..b09c7af54a5b 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -46,7 +46,6 @@ let
       ./qtbase.patch.d/0009-qtbase-qtpluginpath.patch
       ./qtbase.patch.d/0010-qtbase-assert.patch
       ./qtbase.patch.d/0011-fix-header_module.patch
-      ./qtbase.patch.d/9999-backport-dbus-crash.patch
     ];
     qtdeclarative = [
       ./qtdeclarative.patch
@@ -313,7 +312,7 @@ let
         qt3d qtcharts qtconnectivity qtdeclarative qtdoc qtgraphicaleffects
         qtimageformats qtlocation qtmultimedia qtquickcontrols qtquickcontrols2
         qtscript qtsensors qtserialport qtsvg qttools qttranslations
-        qtvirtualkeyboard qtwebchannel qtwebengine qtwebkit qtwebsockets
+        qtvirtualkeyboard qtwebchannel qtwebengine qtwebsockets
         qtwebview qtx11extras qtxmlpatterns qtlottie qtdatavis3d
       ] ++ lib.optional (!stdenv.isDarwin) qtwayland
         ++ lib.optional (stdenv.isDarwin) qtmacextras);
diff --git a/pkgs/development/libraries/qt-5/5.15/modules b/pkgs/development/libraries/qt-5/5.15/modules
index d6ce8822d541..ccc7dbcb8151 100644
--- a/pkgs/development/libraries/qt-5/5.15/modules
+++ b/pkgs/development/libraries/qt-5/5.15/modules
@@ -21,7 +21,6 @@ qtquickcontrols
 qtquickcontrols2
 qtquicktimeline
 qtremoteobjects
-qtscript
 qtscxml
 qtsensors
 qtserialbus
diff --git a/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch b/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch
deleted file mode 100644
index e1aa0119aa2f..000000000000
--- a/pkgs/development/libraries/qt-5/5.15/qtbase.patch.d/9999-backport-dbus-crash.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-commit eb0c6846a5d05d686f0686f0f1ddddcad762ad26 (HEAD -> kde/5.15)
-Author: K900 <me@0upti.me>
-Date:   Mon Aug 14 22:44:02 2023 +0300
-
-    QLibraryPrivate: Actually merge load hints
-
-    Or old and new load hints in mergeLoadHints() instead of just storing
-    new ones. Andjust QLibraryPrivate::setLoadHints() to handle objects
-    with no file name differently and just set load hints directly.
-
-    Mention that load hints are merged once the file name is set
-    in the documentation for QLibrary::setLoadHints().
-
-    Add a regression test into tst_qfactoryloader.
-
-    Update and extend tst_QPluginLoader::loadHints() to take into account
-    load hints merging.
-
-    Fixes: QTBUG-114480
-    Change-Id: I3b9afaec7acde1f5ff992d913f8d7217392c7e00
-    Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
-    Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
-
-diff --git a/src/corelib/plugin/qlibrary.cpp b/src/corelib/plugin/qlibrary.cpp
-index 5d2f024267..45b5a3fe27 100644
---- a/src/corelib/plugin/qlibrary.cpp
-+++ b/src/corelib/plugin/qlibrary.cpp
-@@ -526,7 +526,7 @@ void QLibraryPrivate::mergeLoadHints(QLibrary::LoadHints lh)
-     if (pHnd.loadRelaxed())
-         return;
-
--    loadHintsInt.storeRelaxed(lh);
-+    loadHintsInt.fetchAndOrRelaxed(lh);
- }
-
- QFunctionPointer QLibraryPrivate::resolve(const char *symbol)
-@@ -538,6 +538,13 @@ QFunctionPointer QLibraryPrivate::resolve(const char *symbol)
-
- void QLibraryPrivate::setLoadHints(QLibrary::LoadHints lh)
- {
-+    // Set the load hints directly for a dummy if this object is not associated
-+    // with a file. Such object is not shared between multiple instances.
-+    if (fileName.isEmpty()) {
-+        loadHintsInt.storeRelaxed(lh);
-+        return;
-+    }
-+
-     // this locks a global mutex
-     QMutexLocker lock(&qt_library_mutex);
-     mergeLoadHints(lh);
-@@ -1166,6 +1173,10 @@ QString QLibrary::errorString() const
-     lazy symbol resolution, and will not export external symbols for resolution
-     in other dynamically-loaded libraries.
-
-+    \note Hints can only be cleared when this object is not associated with a
-+    file. Hints can only be added once the file name is set (\a hints will
-+    be or'ed with the old hints).
-+
-     \note Setting this property after the library has been loaded has no effect
-     and loadHints() will not reflect those changes.
-
-diff --git a/src/corelib/plugin/qpluginloader.cpp b/src/corelib/plugin/qpluginloader.cpp
-index 0a63b93762..ceee5d6385 100644
---- a/src/corelib/plugin/qpluginloader.cpp
-+++ b/src/corelib/plugin/qpluginloader.cpp
-@@ -414,10 +414,11 @@ QString QPluginLoader::errorString() const
- void QPluginLoader::setLoadHints(QLibrary::LoadHints loadHints)
- {
-     if (!d) {
--        d = QLibraryPrivate::findOrCreate(QString());   // ugly, but we need a d-ptr
-+        d = QLibraryPrivate::findOrCreate({}, {}, loadHints); // ugly, but we need a d-ptr
-         d->errorString.clear();
-+    } else {
-+        d->setLoadHints(loadHints);
-     }
--    d->setLoadHints(loadHints);
- }
-
- QLibrary::LoadHints QPluginLoader::loadHints() const
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index f67f9d66da7c..817129349718 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,207 +1,202 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "01aa0a9cb22ce5ed2b7ead03ed9cbeb5f978e897",
-    "sha256": "0r1bicsjn4addsf0cw2vkf26kxlf8z1fh65w19gnqmcwkrr8hnja"
+    "rev": "c1f8fa2578d99e07f5e581f26bd532695b9534f9",
+    "sha256": "19wsf9capc8i5157hfp8g735scpcms329ylp0fg86j9qalg7ccwg"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "7a04a93e97390de2d91e89dc907e8240dd5a0c4f",
-    "sha256": "1bqy5cmimnlmgd02zpv0ipf74nx350fk0d4pm2j4pqipq1spq3bh"
+    "rev": "2ed4be9e852d2533b982493a26bf061b245dc106",
+    "sha256": "0v6fwykibl4d20sdh10inaavpzwp5ijpyw8k31078shw3hsgkqxf"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "1170e17043ff51590ccee30447bef1e43a999b0d",
-    "sha256": "0qhlhz7ng35mb5pmva9ivpxq1ib30dz8f1p93yil78cyl9mwqbbi"
+    "rev": "3d30862e761afd5fe8451857bb531b6fb8f63dc3",
+    "sha256": "0sq4dgk88n96wja1wp6j5swxhz8wksf1v4sibywvg7v431nfy82p"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "e24dc54b2b4054413650904288aa7a363eee23a7",
-    "sha256": "0gpg0avl06jbamgk5f9034cfqwyifgv4nyqx49rp0r9wm2m1cgxb"
+    "rev": "ea7a183732c17005f08ca14fd70cdd305c90396d",
+    "sha256": "0lblir4zcnxc2ix9frcsygkhfs5qx7xibpflapmi6d978jjfxjmx"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "7ce22b0633eb9d1eb59854fee4f2f545e1b842e0",
-    "sha256": "0q173ql5xyacwb5lwyrzhgch1bbjq4mmsfwhyssm3a9phqcj083m"
+    "rev": "e17308d5ce83a8b66aeeaaaf16ce16d4ee6b2826",
+    "sha256": "1igna3qdwpaf67lhj0m743cj127hyg73ynjhadhjk3gz34h12r09"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "eeaf42bccd49e8161fbae82d110026d25a5a9a7f",
-    "sha256": "0daa72yizb6v28bci72fw1w8y8al0mhb9k7kxn7vg22fbb3iyksf"
+    "rev": "e33b82889625b6a72e0be91c5023a30d53136a80",
+    "sha256": "17yxmj1xd2q0a2in6aygp88bsg1vivklmzjwi97llbmvcxxvzhfn"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "d366b0aad8454355acac79eddbab445c1108b1e9",
-    "sha256": "15ad1cbfdwnl6lnafgd4chdsl9wnwfcqqnd2m0dwj10n2lsa3nmw"
+    "rev": "d7af24d26b9fbb83bf57b2b7245d280eb78e8b22",
+    "sha256": "1h85cn4qabva8fcr69b35cmy9c7vbk2fz8licw5ca42bq141k4kw"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "3e98cdb2780d052fce3d7a3694596a690cd76aca",
-    "sha256": "15fn0zjfz7jnjgc7m368sna2mvhcp33r85r2kwc9hy7zkp1is6a1"
+    "rev": "1b0e366092bcfae0392592c3b7891f0e47af1018",
+    "sha256": "0fif6gbin3clvy7rfvrs5qdjqvi3ql9yciiwdbm7z0by2kzz1qsg"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "9dfbbfb9971db22d51eb40d6636583df5913be01",
-    "sha256": "1l192k1w5mjw14zq3h3pjb3m0zl56fhgxdjfxhmbncjx0ym98wzr"
+    "rev": "c8af0c56f1765302f8bdf874dfacb11c4e0bf4e3",
+    "sha256": "161wm1pq732nnbx8jbmiv1g1ziqzjwy48dpasy3zgj4i83qyvdas"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "f90bd729eb70d4a0770efed3f9bb1b6dbe67d37c",
-    "sha256": "1vbfmyb51lv3ms0iyizi05jiba688scjwxwvyrr8qnmg4qrjqjd5"
+    "rev": "4b52913503e3713200265cd6bc19b301792dbf96",
+    "sha256": "1n5pafxarhb4rsvr18al4hyc6xmm5nhjkknrnhdldy9vz7w50bgs"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "500ae59f809877e0ada9a68601564882f2733145",
-    "sha256": "0p8vxp5l7iihd1xww94asnb9xv2v94p9whqbljzn6gwr56wvys5l"
+    "rev": "cce7d784237cd2dd4af1abe2757d048e34e02685",
+    "sha256": "1yvxpkfxd44z9z44mfv77lfsbgjlmxz1rilblpp8h276zc5w6l5z"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "5aa33ec870977863c400103db94da452edbaf414",
-    "sha256": "02i3ns2ijiiy0jfad3lxrvvlr38bgarl8246ka0y8aa8by1ih35b"
+    "rev": "b22bf4d0d77c7dafe8b4622f8bb45ac0b9cc9bdd",
+    "sha256": "0gz1par4gkcwwbxh0g1n1lrzyjjmi53gqfmbb222gkf5k8kf0r2i"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "664701dc3acfca37500bc84ba03eed4953b684e9",
-    "sha256": "0nlzjksfzkjhla89warkj7c5h8z2h5ivnhnq1sw2385gfd4q5d8w"
+    "rev": "48a17e88fc1df5b6ae82a9787466226c830bcbf2",
+    "sha256": "0gn4zsf01xr0g8divixk2zpq97dnqs1cdc3q577ijczd2rcs6z4f"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "f65b6a268832fc86e1263a6597f2e369aefecd19",
-    "sha256": "157in9bvnd9q2jigrrl955y7d2gpj308g8mg7k19r1vaz6h4zlm7"
+    "rev": "909b79f4810b8ac62baa3544837793cfb132593b",
+    "sha256": "1bh5418nshzlgc3xf8yg1c0n70xcazr3ya9fdfn1xs3yhxdxcd8h"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "ca5e5fdca44e8e56dafaac2a5bd886cad2a5c0f5",
-    "sha256": "1yrk7kj5dvfcha8w0abvh8xfjn6nbl4njm1r2h2776l3sf46xd4c"
+    "rev": "cc717d0093d796e6bafb65892e6825f146c1d3cd",
+    "sha256": "1cdal8yfjwgl30fh2s5s45hy1mw70n8bfdsbx8q6j4g062dr16zd"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "78d05cfcec57a9e890cb5ddbea604f194e04315d",
-    "sha256": "1vf0gmf6bh3hadrrk0922dbagmvxi1il3pjiyhmz087bm80km1md"
+    "rev": "f587b18db4abd68cb6d4d77fbcec1b94c38d2a51",
+    "sha256": "16b3yaq7i0cs9sw8q5f98g9kzphy3kwy0nw6hzznnzpkmg0pgkv1"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "a0f23c6a1f11bd7c6a8e4fd34f10bdb0a35789fa",
-    "sha256": "0sy2s7xnq2xmqm3lcp439wn6zk6znzja489gh531mmkaj13kiqa9"
+    "rev": "1e3f2196bd45a5ee272b08b1d82cef29aaa89b61",
+    "sha256": "1jshzvsa2nnckakiybh6q7f0wdl5p04b6mymxvjzzphr0q32qn75"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "a3e675872e4b323f89b94b90b66caa945b576b2e",
-    "sha256": "0b6da91fja6w3mphsfydp0plcwmk8nywhd5v8irgc98v1hw114dg"
+    "rev": "736144c5827385000e391e9a55a0f0162b7e8112",
+    "sha256": "1djvj4glxc360my597g81aqjmrhk46447x5s2jj81yiflppvkbny"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "353f50a9851518eb637181c00302cd354e0ae98b",
-    "sha256": "1y269yamhlf46rwcvwzhdqhajyqj41xxf9x0l1nrcr4n07l4mbr8"
+    "rev": "f3c3c2041f4800a7fc1904771f5c6af036167dc9",
+    "sha256": "1xsxhx20spj50jmsqd5f2qa7kmr9rn08c22zkckhrgic73188dpg"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "0ea7cfdfbfa72d467fe542cc48ab3206c177a387",
-    "sha256": "1bvg32cz4x00j9333yas7cmfzx8rlhika4a9vwdikrr5a64awsl9"
+    "rev": "dcc90558d9c0cba41eec7df290943994289b0e87",
+    "sha256": "0xccglsr1c519lyfg58hj6aa34zfyxc4zff360kd84yxmp8r4y9i"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "0472a07a8f39587052216d85a7ed235c531eba2c",
-    "sha256": "1psal4kldwbhfgg0b234dhgm30s5q83g2krcik1p4sifrzgrry3r"
+    "rev": "a2d56960dd76c94a5115b5415be5ee174d377718",
+    "sha256": "03wikwwf329wzml59hw0mqqzqjqfp95k8bvifi21zgrnjfl8rsrr"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "4956b556ccb021e4691f314ab907ea2ebb1ca8a6",
-    "sha256": "0d6w36pvnk616ps7k1ykpk2ahcvn746svwmv3dxvf4capfij96rj"
+    "rev": "b1b4b882dabaa036c3fb73c4a879ba8efbb02ded",
+    "sha256": "07zaziin88y5cq9xy4dsfw2y7njs92qq00mg42350g1s6zqrlbv2"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "d10e7673218fa2b00191a82ad20cd3304a711fa6",
-    "sha256": "0z5dzgdr92yw3y5vx6l9r9kz81r0vvwi264la9r7j20jqb75i2a5"
-  },
-  "qtscript": {
-    "url": "https://invent.kde.org/qt/qt/qtscript.git",
-    "rev": "4f8c35a528586541ea55bb8b3361eaa6749e52b1",
-    "sha256": "01jddzy51ks899mszz35lcdgmpl5czcgh5g9fb84pxdnpgaxrx9b"
+    "rev": "bdc316aca82769b43cb7821c10d80a1ca02b846e",
+    "sha256": "136izb42sdy42lr5amh343f97s59fwf3mv44dg5n8jwg0mg7s67b"
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "7f276be586be79d41213a8dd05ef31144313d440",
-    "sha256": "0yiryqzs44nx5lg54gbs7gf5n2d5chybya71kcv0iwn48dbzy33n"
+    "rev": "e8727aabe55526956295407d27317ec15e12b283",
+    "sha256": "1gyas1prkvnmxlvb90s9qzpy1frk8c4b7n0wnjn0vkfp0cmv3w52"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "45c04582b15a9bb4be01ae99aa7fda1bbba7d0df",
-    "sha256": "0wp9ddna0zidl18707nrqsg8sybaggam0hmm9yxyyfnsr39wms4m"
+    "rev": "a41492b23cde20d1e00427d31e4637d06aea3638",
+    "sha256": "1p9w444bzgixw6a8qarznnr15ayn22k2limsi5mzqanf3j3bd3ml"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "b3081c36baee48b43b6285b4811dc6da451e2390",
-    "sha256": "167bmp5wrp9mflvzhgc2am9nnyw1vb58skdxjn7ag8jq88fhv0zz"
+    "rev": "c41785c9f36560722b917d373ee97eed8cc4089a",
+    "sha256": "05nvzh9lbkbsghpdb3q26nbxgdq5007xak8zxwd3cz9mhqy8xnyc"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "af58a4c62415fbfd997c43422acf93e2e6ab5155",
-    "sha256": "1ihjj7gqjy75ccf4qniilddyiknjklc88mxns6sy8wz3ymr58vfh"
+    "rev": "3380465d5d4977326616c5e57789a81681be650e",
+    "sha256": "06dzraplqhidkngl3sjb3sppqpvc8v8ahrjz06dnsh1dwj8hizh7"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "75142c77cda8ef3a5c1cae69863e963797c667b5",
-    "sha256": "0iaw13vx80yfcchkmrmp6n79i0i6b9rv7k69xxp3wb3l5d3n0ng0"
+    "rev": "3b163bfd46d96bc9ee848dcee49e9cabe6699287",
+    "sha256": "03d4qvxfzwcfgbjdrpq0hvnhbz8bj6diphwiywdp16kvfmp13g9f"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "37b2c764fb599c96fc415049208e871c729217c8",
-    "sha256": "11h0n9k6l4r97x6h1m09nzsblwmmkkj46nl80dnvjimb395d71ri"
+    "rev": "7d6e373c7db9c05ef586db0eb50c87cd894229ad",
+    "sha256": "1aw9xxfjhm14raj7nivrr1ljnqcmibbbjyrx4bawp58mqbq4as4x"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "9f7af2d08eea7c2a2a2bfe7e6a9b73d1b99f5123",
-    "sha256": "1vb6s9zy8nw6gd0kmk77bjvxwpnfbhaifrznp019zccckibzffsg"
+    "rev": "38ae810be3fb4984f75b55a16d3413e35d701af1",
+    "sha256": "0hc65pidlp6lnb3srr2hg3dnas3hdj9cxkp7azcndj3wi36mclwf"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "a680686754d84b91d4cc4252a2fb8af0c58f5f49",
-    "sha256": "1i92mk6f2ldwq12qa4wnlz52zya4nlpjm3r2vy95vkj69xi2bfk3"
+    "rev": "56065158ffc4cd0fd78f9edf4b21b77b969f8dbb",
+    "sha256": "1lyh8hryi6hgw50gz9l6qxjfb72k4a7cg10vw18iffi7yv262g0z"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "72373522141dd3206183eb5fa56ae1c36a6d4c2b",
-    "sha256": "1ndgy8jxn9f7dwg9kydhlbll20qdivfbvdlcxk8qpzilpccd2l3z"
+    "rev": "817378aa10176fd26eed36542bc657e48d9dd42e",
+    "sha256": "0ihgm8y19zlkp3677rp9hnzm56y74djsnpr78yk0mrbcbxv1hpwb"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "d4f650b6c29c621c58bc7b7e7c9ddcbbbc72e3b4",
-    "sha256": "11xqpj36mfyfhcip89i82dyclbkvs77byffax2kscv1kdj3x7w2l"
+    "rev": "4de268cbaf6ff3b633429577f06d3d746a3b202a",
+    "sha256": "1ris6yxd4igrjvjv7bnxkdr402lk1k0djalkbk5s4z8l4qpavn3y"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "74c0625337c8a8de0a465878c7e7d238e8d979ed",
-    "sha256": "0yz2sg8k3l88ngsgyfb6cljh8x5sicww59m447xk7yngxgyaj75m"
+    "rev": "f84887c1aee4ab04af375e639ae965c9ea2186a5",
+    "sha256": "0pn4ly4lyf0db9pfb80q45zssifjg3466hnw7ryxnm4331izvbja"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "13202e8a8c0c6d39026344b5a19a0148592160bc",
-    "sha256": "0gki7hc3684qhqbq7i4wa3w7szy3j6af0yfd50q2mxb1lbxjsdrx"
+    "rev": "ddcff45e8f2ca9f229017b3ded62327d2fb50af2",
+    "sha256": "1ybc94jidzqhrkm0v2daqq0nm34ydqpcgd8q4qhz9abi0ccj17s4"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "89fbe461e7091ae6a4689b7791293a06c9167776",
-    "sha256": "15vkh80rma5l9mrmg41vhxvqxlzqjzl8x20k33xm11lw2kjsszm5"
+    "rev": "d41bb9f4f7ab9d5ff184ef94cf2f6ff7cf01de00",
+    "sha256": "0pc14sd1dzrw599kdjg1309l9hf9ylp0pnyv7i6s2pyfqqq0x85r"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "7e941648610ff4033ae8f9709077edd0595364f0",
-    "sha256": "082w4r674fq7ks5jbh3pj3xb3sqlhn4giy7fy0h3vw170lmcqz0m"
+    "rev": "f078642eb9a440f6aa88f2beaf10f445de1e29bb",
+    "sha256": "0qak3y3qaxs6lf34y8rcp922sqd08nvag0lvl7znxm8d5b7qmnn6"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "5afc77f5347113b607ca0262505f3406e1be5bf4",
-    "sha256": "1a7dm0dxqq817pib1y6m0f09sc2cqd1qkfb9anznsgpmzynvfp6r"
+    "rev": "1bf19cc6a7972d8543485786418b6631459d3469",
+    "sha256": "09a6xacb0zsp44w5zz15lkh6sypy7y1xg7m1fkxj2n26wbdc2p52"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "74f81f0bfe17e5aabcebafcb0cf36f739133554c",
-    "sha256": "1akp4mwvfspxdq5akpyphf6p3ay0z9pzaigiiy198w9q0yvrkgl7"
+    "rev": "5fb2e067a38d3583684310130f5d8aad064f512f",
+    "sha256": "1whfsdmyihnzzy3ijh5wcbsw9ppg3s5nx2insw5yrx36iz0y054d"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "0c1dcfe344c03d48d753aeb58f139bc990f2611c",
-    "sha256": "1cab7y9asivdg9ypwc951pczf4ddgni60l1ajlfsprk48rypr7w1"
+    "rev": "5a1948ddc05bf44017ac12bd5c2b9bc79fbcb9a2",
+    "sha256": "0613zb8lzd1i2g5kbn7h39warx7hn1z5qi28zk8l88ivpn84dx4q"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 6729c7c31af3..130fcd332ba4 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -1,25 +1,18 @@
 { lib, fetchgit, fetchFromGitHub }:
 
 let
-  version = "5.15.10";
-  overrides = {
-    qtscript.version = "5.15.9";
-  };
+  version = "5.15.11";
 
   mk = name: args:
-    let
-      override = overrides.${name} or {};
-    in
     {
-      version = override.version or version;
-      src = override.src or
-        fetchgit {
-          inherit (args) url rev sha256;
-          fetchLFS = false;
-          fetchSubmodules = true;
-          deepClone = false;
-          leaveDotGit = false;
-        };
+      inherit version;
+      src = fetchgit {
+        inherit (args) url rev sha256;
+        fetchLFS = false;
+        fetchSubmodules = true;
+        deepClone = false;
+        leaveDotGit = false;
+      };
     };
 in
 lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
@@ -76,15 +69,26 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)
     hash = "sha256-LPfBCEB5tJOljXpptsNk0sHGtJf/wIRL7fccN79Nh6o=";
   };
 
+  qtscript = rec {
+    version = "5.15.15";
+
+    src = fetchFromGitHub {
+      owner = "qt";
+      repo = "qtscript";
+      rev = "v${version}-lts";
+      hash = "sha256-o2YG1m3LuG9Kq9Bqi1wRa6ceHsivK+hJR7w08NE/kBo=";
+    };
+  };
+
   qtwebengine = rec {
-      version = "5.15.14";
+    version = "5.15.15";
 
-      src = fetchFromGitHub {
-        owner = "qt";
-        repo = "qtwebengine";
-        rev = "v${version}-lts";
-        hash = "sha256-jIoNwRdr0bZ2p0UMp/KDQuwgNjhzzGlb91UGjQgT60Y=";
-        fetchSubmodules = true;
-      };
+    src = fetchFromGitHub {
+      owner = "qt";
+      repo = "qtwebengine";
+      rev = "v${version}-lts";
+      hash = "sha256-AmW3u8D9Y8lXZu0aiuxYXNPzZ5GCXeBQGfAcgFuXAh4=";
+      fetchSubmodules = true;
     };
+  };
 }
diff --git a/pkgs/development/libraries/rapidfuzz-cpp/default.nix b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
index ec9669f3c7d9..2f4a2ee6b1d9 100644
--- a/pkgs/development/libraries/rapidfuzz-cpp/default.nix
+++ b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rapidfuzz-cpp";
-  version = "2.0.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "maxbachmann";
     repo = "rapidfuzz-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gLiITRCxX3nkzrlvU1/ZPxEo2v7q79/MwrnURUjrY28=";
+    hash = "sha256-OeGn3ks+vSHt4Kdzy6kqhpFOtjoHrbPZB1BrV6Ggzz4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index c1483f90c433..9c826aa4ddea 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.50";
+  version = "1.3.55";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-B+znuvQ7TTl2u4rw64ylPywfpr066Yf8Wg0qrdByGRE=";
+    hash = "sha256-d/h6vBqef4pE/6cb1bQboIXAAMRxdAALKHUVW07jOlE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 950402315a9b..3fc533e848db 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -141,7 +141,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "openblas";
-  version = "0.3.21";
+  version = "0.3.24";
 
   outputs = [ "out" "dev" ];
 
@@ -149,18 +149,9 @@ stdenv.mkDerivation rec {
     owner = "xianyi";
     repo = "OpenBLAS";
     rev = "v${version}";
-    sha256 = "sha256-F6cXPqQai4kA5zrsa8E0Q7dD9zZHlwZ+B16EOGNXoXs=";
+    sha256 = "sha256-IuXhrZRB3o7kbnivv/6En/aAeF2F18sQw9pKs1WEJc4=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isLoongArch64 [
-    # https://github.com/xianyi/OpenBLAS/pull/3626
-    (fetchpatch {
-      name = "openblas-0.3.21-fix-loong.patch";
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sci-libs/openblas/files/openblas-0.3.21-fix-loong.patch?id=37ee4c70278eb41181f69e175575b0152b941655";
-      hash = "sha256-iWy11l3wEvzNV08LbhOjnSPj1SjPH8RMnb3ORz7V+gc";
-    })
-  ];
-
   postPatch = ''
     # cc1: error: invalid feature modifier 'sve2' in '-march=armv8.5-a+sve+sve2+bf16'
     substituteInPlace Makefile.arm64 --replace "+sve2+bf16" ""
diff --git a/pkgs/development/libraries/webrtc-audio-processing/default.nix b/pkgs/development/libraries/webrtc-audio-processing/default.nix
index 2c1e15bfbef3..c3f7d2591ac1 100644
--- a/pkgs/development/libraries/webrtc-audio-processing/default.nix
+++ b/pkgs/development/libraries/webrtc-audio-processing/default.nix
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-8CDt4kMt2Owzyv22dqWIcFuHeg4Y3FxB405cLw3FZ+g=";
   };
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/libraries/wtk/builder.sh b/pkgs/development/libraries/wtk/builder.sh
index c3ad173b0933..ca5157c6d71a 100644
--- a/pkgs/development/libraries/wtk/builder.sh
+++ b/pkgs/development/libraries/wtk/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 mkdir unzipped
diff --git a/pkgs/development/libraries/zeromq/4.x.nix b/pkgs/development/libraries/zeromq/4.x.nix
index 9fa429f9a4ca..6a0e173db3a9 100644
--- a/pkgs/development/libraries/zeromq/4.x.nix
+++ b/pkgs/development/libraries/zeromq/4.x.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , asciidoc
 , pkg-config
@@ -11,25 +10,15 @@
 
 stdenv.mkDerivation rec {
   pname = "zeromq";
-  version = "4.3.4";
+  version = "4.3.5";
 
   src = fetchFromGitHub {
     owner = "zeromq";
     repo = "libzmq";
     rev = "v${version}";
-    sha256 = "sha256-epOEyHOswUGVwzz0FLxhow/zISmZHxsIgmpOV8C8bQM=";
+    sha256 = "sha256-q2h5y0Asad+fGB9haO4Vg7a1ffO2JSb7czzlhmT3VmI=";
   };
 
-  patches = [
-    # Backport gcc-13 fix:
-    #   https://github.com/zeromq/libzmq/pull/4480
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/zeromq/libzmq/commit/438d5d88392baffa6c2c5e0737d9de19d6686f0d.patch";
-      hash = "sha256-tSTYSrQzgnfbY/70QhPdOnpEXX05VAYwVYuW8P1LWf0=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake asciidoc pkg-config ];
   buildInputs = [ libsodium ];
 
@@ -41,7 +30,7 @@ stdenv.mkDerivation rec {
     branch = "4";
     homepage = "http://www.zeromq.org";
     description = "The Intelligent Transport Layer";
-    license = licenses.lgpl3Plus;
+    license = licenses.mpl20;
     platforms = platforms.all;
     maintainers = with maintainers; [ fpletz ];
   };
diff --git a/pkgs/development/lua-modules/aliases.nix b/pkgs/development/lua-modules/aliases.nix
index 47a097fd7f79..8f4ed9799c2c 100644
--- a/pkgs/development/lua-modules/aliases.nix
+++ b/pkgs/development/lua-modules/aliases.nix
@@ -39,5 +39,6 @@ let
 in
 
 mapAliases {
-  "lpty" = throw "lpy was removed because broken and unmaintained "; # added 2023-10-14
+  lpty = throw "lpy was removed because broken and unmaintained "; # added 2023-10-14
+  cyrussasl = throw "cyrussasl was removed because broken and unmaintained "; # added 2023-10-18
 }
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index f344bd948515..4484dd3de631 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -5,10 +5,10 @@ nixpkgs$ ./maintainers/scripts/update-luarocks-packages
 You can customize the generated packages in pkgs/development/lua-modules/overrides.nix
 */
 
-{ stdenv, lib, fetchurl, fetchgit, callPackage, ... } @ args:
+{ stdenv, lib, fetchurl, fetchgit, callPackage, ... }:
 final: prev:
 {
-alt-getopt = callPackage({ luaAtLeast, lua, luaOlder, fetchgit, buildLuarocksPackage }:
+alt-getopt = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "alt-getopt";
   version = "0.8.0-1";
@@ -22,12 +22,13 @@ buildLuarocksPackage {
   "date": "2017-01-06T13:50:55+03:00",
   "path": "/nix/store/z72v77cw9188408ynsppwhlzii2dr740-lua-alt-getopt",
   "sha256": "1kq7r5668045diavsqd1j6i9hxdpsk99w8q4zr8cby9y3ws4q6rv",
+  "hash": "sha256-OxtMNB8++cVQ/gQjntLUt3WYopGhYb1VbIUAZEzJB88=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
@@ -40,23 +41,18 @@ buildLuarocksPackage {
   };
 }) {};
 
-argparse = callPackage({ luaOlder, buildLuarocksPackage, luaAtLeast, lua, fetchgit }:
+argparse = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "argparse";
-  version = "scm-2";
-
-  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
-  "url": "https://github.com/luarocks/argparse.git",
-  "rev": "27967d7b52295ea7885671af734332038c132837",
-  "date": "2020-07-08T11:17:50+10:00",
-  "path": "/nix/store/vjm6c826hgvj7h7vqlbgkfpvijsd8yaf-argparse",
-  "sha256": "0idg79d0dfis4qhbkbjlmddq87np75hb2vj41i6prjpvqacvg5v1",
-  "fetchLFS": false,
-  "fetchSubmodules": true,
-  "deepClone": false,
-  "leaveDotGit": false
-}
- '') ["date" "path"]) ;
+  version = "0.7.1-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/argparse-0.7.1-1.rockspec";
+    sha256 = "116iaczq6glzzin6qqa2zn7i22hdyzzsq6mzjiqnz6x1qmi0hig8";
+  }).outPath;
+  src = fetchzip {
+    url    = "https://github.com/luarocks/argparse/archive/0.7.1.zip";
+    sha256 = "0idg79d0dfis4qhbkbjlmddq87np75hb2vj41i6prjpvqacvg5v1";
+  };
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
@@ -68,15 +64,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-basexx = callPackage({ buildLuarocksPackage, lua, fetchurl, luaOlder }:
+basexx = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "basexx";
-  version = "scm-0";
-  rockspecDir = "dist";
-
+  version = "0.4.1-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/basexx-0.4.1-1.rockspec";
+    sha256 = "0kmydxm2wywl18cgj303apsx7hnfd68a9hx9yhq10fj7yfcxzv5f";
+  }).outPath;
   src = fetchurl {
-    url    = "https://github.com/aiq/basexx/archive/master.tar.gz";
-    sha256 = "1x0d24aaj4zld4ifr7mi8zwrym5shsfphmwx5jzw2zg22r6xzlz1";
+    url    = "https://github.com/aiq/basexx/archive/v0.4.1.tar.gz";
+    sha256 = "1rnz6xixxqwy0q6y2hi14rfid4w47h69gfi0rnlq24fz8q2b0qpz";
   };
 
   disabled = (luaOlder "5.1");
@@ -89,11 +87,14 @@ buildLuarocksPackage {
   };
 }) {};
 
-binaryheap = callPackage({ buildLuarocksPackage, lua, fetchurl, luaOlder }:
+binaryheap = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "binaryheap";
   version = "0.4-1";
-
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/binaryheap-0.4-1.rockspec";
+    sha256 = "1ah37lhskmrb26by5ygs7jblx7qnf6mphgw8kwhw0yacvmkcbql4";
+  }).outPath;
   src = fetchurl {
     url    = "https://github.com/Tieske/binaryheap.lua/archive/version_0v4.tar.gz";
     sha256 = "0f5l4nb5s7dycbkgh3rrl7pf0npcf9k6m2gr2bsn09fjyb3bdc8h";
@@ -110,7 +111,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-bit32 = callPackage({ fetchgit, buildLuarocksPackage, lua, luaOlder }:
+bit32 = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "bit32";
   version = "5.3.0-1";
@@ -124,12 +125,13 @@ buildLuarocksPackage {
   "date": "2015-02-17T10:44:04+01:00",
   "path": "/nix/store/9kz7kgjmq0w9plrpha866bmwsgp4rfhn-lua-compat-5.2",
   "sha256": "1ipqlbvb5w394qwhm2f3w6pdrgy8v4q8sps5hh3pqz14dcqwakhj",
+  "hash": "sha256-Ek7FMWskfHwHhEVfjTDZyL/cruHDiQo5Jmnwsvai+MY=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -142,26 +144,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-busted = callPackage({ buildLuarocksPackage, luafilesystem, luasystem, fetchgit, luaOlder, lua-term, say, mediator_lua, penlight, luassert, lua_cliargs, lua, dkjson }:
+busted = callPackage({ buildLuarocksPackage, dkjson, fetchgit, fetchurl, lua, lua-term, luaOlder, lua_cliargs, luafilesystem, luassert, luasystem, mediator_lua, penlight, say }:
 buildLuarocksPackage {
   pname = "busted";
-  version = "2.1.1-1";
+  version = "2.1.2-3";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/busted-2.1.1-1.rockspec";
-    sha256 = "0f9iz3pa2gmb2vccvygp6zdiji7l8bap0vlgqgrcg331qsrkf70h";
+    url    = "mirror://luarocks/busted-2.1.2-3.rockspec";
+    sha256 = "0ll8jzbpp6a9zdbbjglmq30jmx2zvr0rs83jgsjxmlfzzylkry8p";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/busted.git",
-  "rev": "e3ed48759b625f2e37bf02ccc057b2b98108f108",
-  "date": "2022-08-24T17:34:58+03:00",
-  "path": "/nix/store/7g9rxkyhabgx0acwmzl4r4xfh193avpw-busted",
-  "sha256": "0nab0s5lhk0nhh58c4jspv5sj4g7839gb5q145hrlgbsxqncp8wy",
+  "rev": "673cb6bad2ee3876d45e004fcac1c2f8a816344f",
+  "date": "2023-03-20T10:00:33+01:00",
+  "path": "/nix/store/k7xnpg0s36gxk5mb59wx1dj8ikiz92ja-busted",
+  "sha256": "1wsiiiw26yqglqkkailksinzcb9gaffcldrcfhga3zawf2518h8y",
+  "hash": "sha256-HkEUinBc/aEedCw3ypxTLy32bdSTRjUnpg97I3iMUfM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ dkjson lua lua-term lua_cliargs luafilesystem luassert luasystem mediator_lua penlight say ];
@@ -173,7 +176,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-cassowary = callPackage({ buildLuarocksPackage, fetchgit, penlight, luaOlder, lua }:
+cassowary = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, penlight }:
 buildLuarocksPackage {
   pname = "cassowary";
   version = "2.3.2-1";
@@ -187,12 +190,13 @@ buildLuarocksPackage {
   "date": "2022-04-22T11:23:46+03:00",
   "path": "/nix/store/51mb376xh9pnh2krk08ljmy01zhr9y3z-cassowary.lua",
   "sha256": "1lvl40dhzmbqqjrqpjgqlg2kl993fpdy1mpc6d1610zpa9znx1f0",
+  "hash": "sha256-wIVuf1L3g2BCM+zW4Nt1IyU6xaP4yYuzxHjVDxsgdNM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua penlight ];
@@ -205,7 +209,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-cldr = callPackage({ penlight, luaOlder, lua, fetchgit, buildLuarocksPackage }:
+cldr = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, penlight }:
 buildLuarocksPackage {
   pname = "cldr";
   version = "0.3.0-0";
@@ -219,12 +223,13 @@ buildLuarocksPackage {
   "date": "2022-12-06T12:36:06+03:00",
   "path": "/nix/store/3xgwqd2pica8301sbfrw4bmv0xm2wzx5-cldr-lua",
   "sha256": "0hlfb115qhamczzskvckxczf9dpp8cv8h6vz7zgdl2n025ik9dp4",
+  "hash": "sha256-5LY0YxHACtreP38biDZD97bkPuuT7an/Z1VBXEJYjkI=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua penlight ];
@@ -237,7 +242,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-compat53 = callPackage({ lua, luaAtLeast, fetchzip, luaOlder, buildLuarocksPackage }:
+compat53 = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "compat53";
   version = "0.7-1";
@@ -261,7 +266,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-cosmo = callPackage({ buildLuarocksPackage, fetchgit, lpeg }:
+cosmo = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lpeg }:
 buildLuarocksPackage {
   pname = "cosmo";
   version = "16.06.04-1";
@@ -275,12 +280,13 @@ buildLuarocksPackage {
   "date": "2016-06-17T05:39:58-07:00",
   "path": "/nix/store/k3p4xc4cfihp4h8aj6vacr25rpcsjd96-cosmo",
   "sha256": "03b5gwsgxd777970d2h6rx86p7ivqx7bry8xmx2r396g3w85qy2p",
+  "hash": "sha256-V3hcEB/PpJFFrx35vE7HO55rUM8GigZOOue0/jR/ZQ0=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ lpeg ];
 
@@ -292,7 +298,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-coxpcall = callPackage({ buildLuarocksPackage, fetchgit }:
+coxpcall = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "coxpcall";
   version = "1.17.0-1";
@@ -306,12 +312,13 @@ buildLuarocksPackage {
   "date": "2018-02-26T19:53:11-03:00",
   "path": "/nix/store/1q4p5qvr6rlwisyarlgnmk4dx6vp8xdl-coxpcall",
   "sha256": "1k3q1rr2kavkscf99b5njxhibhp6iwhclrjk6nnnp233iwc2jvqi",
+  "hash": "sha256-EW8pGI9jiGutNVNmyiCP5sIVYZe2rJQc03OrKXIOeMw=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
 
   meta = {
@@ -321,7 +328,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-cqueues = callPackage({ fetchurl, buildLuarocksPackage, lua }:
+cqueues = callPackage({ buildLuarocksPackage, fetchurl, lua }:
 buildLuarocksPackage {
   pname = "cqueues";
   version = "20200726.52-0";
@@ -345,7 +352,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-cyan = callPackage({ argparse, buildLuarocksPackage, tl, fetchgit, luafilesystem }:
+cyan = callPackage({ argparse, buildLuarocksPackage, fetchgit, fetchurl, luafilesystem, tl }:
 buildLuarocksPackage {
   pname = "cyan";
   version = "0.3.0-1";
@@ -359,12 +366,13 @@ buildLuarocksPackage {
   "date": "2023-02-19T18:58:20-06:00",
   "path": "/nix/store/smpj81z2a2blb3qfpjwx9n52d50rp39w-cyan",
   "sha256": "0pskargvjn2phgz481b08ndhp3z23s7lqfs8qlwailr7a4f2fc7h",
+  "hash": "sha256-8DAnHFEn06g4xUg7TI8e4o8Lm0VgBUT+g1dYuV9WU18=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ argparse luafilesystem tl ];
 
@@ -375,51 +383,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-cyrussasl = callPackage({ lua, luaOlder, buildLuarocksPackage, fetchgit }:
-buildLuarocksPackage {
-  pname = "cyrussasl";
-  version = "1.1.0-1";
-
-  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
-  "url": "https://github.com/JorjBauer/lua-cyrussasl",
-  "rev": "78ceec610da76d745d0eff4e21a4fb24832aa72d",
-  "date": "2015-08-21T18:24:54-04:00",
-  "path": "/nix/store/s7n7f80pz8k6lvfav55a5rwy5l45vs4l-lua-cyrussasl",
-  "sha256": "14kzm3vk96k2i1m9f5zvpvq4pnzaf7s91h5g4h4x2bq1mynzw2s1",
-  "fetchLFS": false,
-  "fetchSubmodules": true,
-  "deepClone": false,
-  "leaveDotGit": false
-}
- '') ["date" "path"]) ;
-
-  disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ lua ];
-
-  meta = {
-    homepage = "http://github.com/JorjBauer/lua-cyrussasl";
-    description = "Cyrus SASL library for Lua 5.1+";
-    license.fullName = "BSD";
-  };
-}) {};
-
-digestif = callPackage({ luafilesystem, fetchgit, lpeg, lua, buildLuarocksPackage, luaOlder }:
+digestif = callPackage({ buildLuarocksPackage, fetchgit, lpeg, lua, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "digestif";
   version = "dev-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/astoff/digestif",
-  "rev": "8f8448fa3f27611b32fe6398fe22ef24b8602ec9",
-  "date": "2023-02-24T22:38:11+01:00",
-  "path": "/nix/store/s7wxqcj3k8pgb3m86d8rs2ggpl63jxwn-digestif",
-  "sha256": "0k3srmilrz3ajj76kklksmifkgqrm0y7gr25h0vrrldrf1xp4pk0",
+  "rev": "c0199f9cd86021c0a89662002d7a3411d12fb168",
+  "date": "2023-03-10T15:04:26+01:00",
+  "path": "/nix/store/3s849fwc80lf7pvgsiavqmvc5538cwwd-digestif",
+  "sha256": "0xccrrfwvcj03nnrzs3iwig7y2ahl706h413hkywcplyd5407dv9",
+  "hash": "sha256-abcDSGmeXsb9hCMQaMChUAl/XuRx6J+tHUCyzV3OjHU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.3");
   propagatedBuildInputs = [ lpeg lua luafilesystem ];
@@ -431,7 +412,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-dkjson = callPackage({ buildLuarocksPackage, lua, luaAtLeast, luaOlder, fetchurl }:
+dkjson = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "dkjson";
   version = "2.6-1";
@@ -454,17 +435,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-fennel = callPackage({ luaOlder, buildLuarocksPackage, fetchurl, lua }:
+fennel = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "fennel";
-  version = "1.3.0-1";
+  version = "1.3.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/fennel-1.3.0-1.rockspec";
-    sha256 = "1by78423n8k8i5sz7ji6w5igm8jkmyvd5x1y519hzmknphjqa263";
+    url    = "mirror://luarocks/fennel-1.3.1-1.rockspec";
+    sha256 = "1dsavrsvngwx8vf1l2sj44arvip3bqkhsfh2sdkwa6r9mnw9zx87";
   }).outPath;
   src = fetchurl {
-    url    = "https://fennel-lang.org/downloads/fennel-1.3.0.tar.gz";
-    sha256 = "0m754c74pj10c1qmc4zl89ifjiqcwafn8qagzfpfmcqv6r46pr23";
+    url    = "https://fennel-lang.org/downloads/fennel-1.3.1.tar.gz";
+    sha256 = "1c7iwyc9f3a9k34fjq77zjk0minl3bl3f7wqlj8i1n2x7598nzgx";
   };
 
   disabled = (luaOlder "5.1");
@@ -502,7 +483,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-fifo = callPackage({ fetchzip, lua, buildLuarocksPackage }:
+fifo = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua }:
 buildLuarocksPackage {
   pname = "fifo";
   version = "0.2-0";
@@ -524,7 +505,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-fluent = callPackage({ lua, luaepnf, fetchgit, cldr, buildLuarocksPackage, penlight, luaOlder }:
+fluent = callPackage({ buildLuarocksPackage, cldr, fetchgit, fetchurl, lua, luaOlder, luaepnf, penlight }:
 buildLuarocksPackage {
   pname = "fluent";
   version = "0.2.0-0";
@@ -538,12 +519,13 @@ buildLuarocksPackage {
   "date": "2022-04-16T23:08:20+03:00",
   "path": "/nix/store/flxlnrzg6rx75qikiggmy494npx59p0b-fluent-lua",
   "sha256": "12js8l4hcxhziza0sry0f01kfm8f8m6kx843dmcky36z1y2mccmq",
+  "hash": "sha256-uDJWhQ/fDD9ZbYOgPk1FDlU3A3DAZw3Ujx92BglFWoo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ cldr lua luaepnf penlight ];
@@ -556,23 +538,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-gitsigns-nvim = callPackage({ lua, fetchgit, buildLuarocksPackage }:
+gitsigns-nvim = callPackage({ buildLuarocksPackage, fetchgit, lua }:
 buildLuarocksPackage {
   pname = "gitsigns.nvim";
   version = "scm-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lewis6991/gitsigns.nvim",
-  "rev": "f388995990aba04cfdc7c3ab870c33e280601109",
-  "date": "2023-02-16T11:22:47+00:00",
-  "path": "/nix/store/i4acpc5h3sv909gyppm1qv2vqjq84xs1-gitsigns.nvim",
-  "sha256": "1nm1f1d8c632nfnkiak4j7ynyin379bmhag5qp2p912cd9cjvsgx",
+  "rev": "ff01d34daaed72f271a8ffa088a7e839a60c640f",
+  "date": "2023-10-06T09:04:46+01:00",
+  "path": "/nix/store/2m4fyzkkg6bdbfb4kpjrqgbawvs3khqg-gitsigns.nvim",
+  "sha256": "0clyngmmz0qilnjykqc8n7c5kidspywazwy3axsikgh4x8wzdn17",
+  "hash": "sha256-J9j2OeoEvhl1V8Pzr7i/usVZ2LGI4emlpRGDX+uznjI=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (lua.luaversion != "5.1");
   propagatedBuildInputs = [ lua ];
@@ -584,17 +567,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-haskell-tools-nvim = callPackage({ plenary-nvim, fetchzip, lua, luaOlder, buildLuarocksPackage }:
+haskell-tools-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, plenary-nvim }:
 buildLuarocksPackage {
   pname = "haskell-tools.nvim";
-  version = "2.3.0-1";
+  version = "2.4.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/haskell-tools.nvim-2.3.0-1.rockspec";
-    sha256 = "0jcmb0hzyhq14b2xcwdhwr9a9wbmfaw27vzfzkv52is24mwfr0p0";
+    url    = "mirror://luarocks/haskell-tools.nvim-2.4.0-1.rockspec";
+    sha256 = "1sapapkz3ay9yrljmc1lwxjglv27f1zbh6m014r2z59px4ir61dz";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/haskell-tools.nvim/archive/2.3.0.zip";
-    sha256 = "0lg8g2j9fbikgmhimvz9d0yb63csn85racc09qyszba2kviipr24";
+    url    = "https://github.com/mrcjkb/haskell-tools.nvim/archive/2.4.0.zip";
+    sha256 = "054vfqsccq1qmqmglnppi2n7ksckldx8b5p62y35y0cbcdyh7wz3";
   };
 
   disabled = (luaOlder "5.1");
@@ -607,7 +590,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-http = callPackage({ luaossl, lpeg_patterns, lpeg, binaryheap, compat53, cqueues, bit32, basexx, fetchzip, lua, fifo, luaOlder, buildLuarocksPackage }:
+http = callPackage({ basexx, binaryheap, bit32, buildLuarocksPackage, compat53, cqueues, fetchurl, fetchzip, fifo, lpeg, lpeg_patterns, lua, luaOlder, luaossl }:
 buildLuarocksPackage {
   pname = "http";
   version = "0.3-0";
@@ -631,7 +614,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-inspect = callPackage({ fetchurl, buildLuarocksPackage, lua, luaOlder }:
+inspect = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "inspect";
   version = "3.1.3-0";
@@ -654,7 +637,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-jsregexp = callPackage({ buildLuarocksPackage, lua, luaOlder, fetchgit }:
+jsregexp = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "jsregexp";
   version = "0.0.6-1";
@@ -668,12 +651,13 @@ buildLuarocksPackage {
   "date": "2023-02-12T14:19:03+01:00",
   "path": "/nix/store/aj42wy1yp53w406id33dyxpv1ws23g4b-jsregexp",
   "sha256": "0l7hn5f2jl4n2bpikb72szfzgc192jy3ig5pxx9061j44amyq89m",
+  "hash": "sha256-NSHsqyJEBgNS77e8OLwUKbD33dfirBnvEpZQKVyx8FA=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -685,7 +669,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-ldbus = callPackage({ luaOlder, fetchgit, lua, luaAtLeast, buildLuarocksPackage }:
+ldbus = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "ldbus";
   version = "scm-0";
@@ -699,12 +683,13 @@ buildLuarocksPackage {
   "date": "2021-11-10T23:58:54+11:00",
   "path": "/nix/store/j830jk2hkanz7abkdsbvg2warsyr0a2c-ldbus",
   "sha256": "18q98b98mfvjzbyssf18bpnlx4hsx4s9lwcwia4z9dxiaiw7b77j",
+  "hash": "sha256-8px1eFSxt/SJipxxmjTpGpJO7V0oOK39+nK7itJCCaM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
@@ -716,34 +701,35 @@ buildLuarocksPackage {
   };
 }) {};
 
-ldoc = callPackage({ fetchgit, buildLuarocksPackage, markdown, penlight }:
+ldoc = callPackage({ buildLuarocksPackage, fetchgit, markdown, penlight }:
 buildLuarocksPackage {
   pname = "ldoc";
-  version = "scm-3";
+  version = "dev-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
-  "url": "https://github.com/stevedonovan/LDoc.git",
-  "rev": "01d648f4ad50c3d14f2acadee6acb26beda56990",
-  "date": "2022-11-18T00:01:45+01:00",
-  "path": "/nix/store/m7vvl2b5k69jrb88d0y60f2y4ryazkp9-LDoc",
-  "sha256": "1kl0ba9mnd7nksakzb3vwr0hkkkgyk92v93r2w9xnrq879dhy5mm",
+  "url": "https://github.com/lunarmodules/ldoc.git",
+  "rev": "e4940daf748affb86489b0782ed8abab2e88bebc",
+  "date": "2023-05-13T08:12:31+03:00",
+  "path": "/nix/store/sqhilwlh0glw1dxcx6w98wjkp65amvil-ldoc",
+  "sha256": "0an92jxvhbw2lvg269x6z3874x3wqmbmx52j4gsgxf9ldpizssgd",
+  "hash": "sha256-7Wn94200uf70I1KUXlfFfHRy0PimJyPepoIvuLsUySo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ markdown penlight ];
 
   meta = {
-    homepage = "https://github.com/lunarmodules/LDoc";
+    homepage = "http://lunarmodules.github.io/ldoc";
     description = "A Lua Documentation Tool";
-    license.fullName = "MIT/X11";
+    license.fullName = "MIT <http://opensource.org/licenses/MIT>";
   };
 }) {};
 
-lgi = callPackage({ luaOlder, fetchgit, buildLuarocksPackage, lua }:
+lgi = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lgi";
   version = "0.9.2-1";
@@ -757,12 +743,13 @@ buildLuarocksPackage {
   "date": "2017-10-09T20:55:55+02:00",
   "path": "/nix/store/vh82n8pc8dy5c8nph0vssk99vv7q4qg2-lgi",
   "sha256": "03rbydnj411xpjvwsyvhwy4plm96481d7jax544mvk7apd8sd5jj",
+  "hash": "sha256-UpamUbvqzF0JKV3J0wIiJlV6iedwe823vD0EIm3zKw8=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -774,7 +761,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-linenoise = callPackage({ buildLuarocksPackage, lua, fetchurl, luaOlder }:
+linenoise = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "linenoise";
   version = "0.9-1";
@@ -794,7 +781,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-ljsyscall = callPackage({ lua, fetchurl, buildLuarocksPackage }:
+ljsyscall = callPackage({ buildLuarocksPackage, fetchurl, lua }:
 buildLuarocksPackage {
   pname = "ljsyscall";
   version = "0.12-1";
@@ -818,7 +805,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lmathx = callPackage({ fetchurl, buildLuarocksPackage, lua }:
+lmathx = callPackage({ buildLuarocksPackage, fetchurl, lua }:
 buildLuarocksPackage {
   pname = "lmathx";
   version = "20150624-1";
@@ -841,7 +828,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lmpfrlib = callPackage({ buildLuarocksPackage, fetchurl, luaAtLeast, lua, luaOlder }:
+lmpfrlib = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "lmpfrlib";
   version = "20170112-2";
@@ -851,7 +838,7 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchurl {
     url    = "http://www.circuitwizard.de/lmpfrlib/lmpfrlib.c";
-    sha256 = "00d32cwvk298k3vyrjkdmfjgc69x1fwyks3hs7dqr2514zdhgssm";
+    sha256 = "1bkfwdacj1drzqsfxf352fjppqqwi5d4j084jr9vj9dvjb31rbc1";
   };
 
   disabled = (luaOlder "5.3") || (luaAtLeast "5.5");
@@ -865,7 +852,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-loadkit = callPackage({ luaOlder, lua, buildLuarocksPackage, fetchgit }:
+loadkit = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "loadkit";
   version = "1.1.0-1";
@@ -875,16 +862,17 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/leafo/loadkit.git",
-  "rev": "c6c712dab45f6c568821f9ed7b49c790a44d12e7",
-  "date": "2021-01-07T14:41:10-08:00",
-  "path": "/nix/store/xvwq7b2za8ciww1gjw7vnspg9183xmfa-loadkit",
-  "sha256": "15znriijs7izf9f6vmhr6dnvw3pzr0yr0mh6ah41fmdwjqi7jzcz",
+  "rev": "95b13a36442f59b41ab52df96d52233c4a725dfd",
+  "date": "2023-08-17T11:36:25-07:00",
+  "path": "/nix/store/9xcy2p5pxiq0p17szv8p2lagb6xzb8c8-loadkit",
+  "sha256": "0hivmn5r1scxv3nckm4hqfplq33wiab3ypjwsfdkmp3bdri0dhxs",
+  "hash": "sha256-usMGYm5r3Dqb01xeP5aKfAxMr8OQ1Mns2J3pkIutO0I=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -897,17 +885,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-lpeg = callPackage({ luaOlder, buildLuarocksPackage, fetchurl, lua }:
+lpeg = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lpeg";
-  version = "1.0.2-1";
+  version = "1.1.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lpeg-1.0.2-1.rockspec";
-    sha256 = "08a8p5cwlwpjawk8sczb7bq2whdsng4mmhphahyklf1bkvl2li89";
+    url    = "mirror://luarocks/lpeg-1.1.0-1.rockspec";
+    sha256 = "03af1p00madfhfxjzrsxb0jm0n49ixwadnkdp0vbgs77d2v985jn";
   }).outPath;
   src = fetchurl {
-    url    = "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.2.tar.gz";
-    sha256 = "1zjzl7acvcdavmcg5l7wi12jd4rh95q9pl5aiww7hv0v0mv6bmj8";
+    url    = "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.1.0.tar.gz";
+    sha256 = "0aimsjpcpkh3kk65f0pg1z2bp6d83rn4dg6pgbx1yv14s9kms5ab";
   };
 
   disabled = (luaOlder "5.1");
@@ -921,7 +909,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lpeg_patterns = callPackage({ lpeg, fetchzip, buildLuarocksPackage, lua }:
+lpeg_patterns = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lpeg, lua }:
 buildLuarocksPackage {
   pname = "lpeg_patterns";
   version = "0.5-0";
@@ -943,7 +931,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lpeglabel = callPackage({ fetchurl, lua, luaOlder, buildLuarocksPackage }:
+lpeglabel = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lpeglabel";
   version = "1.6.0-1";
@@ -966,7 +954,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lrexlib-gnu = callPackage({ buildLuarocksPackage, luaOlder, lua, fetchgit }:
+lrexlib-gnu = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lrexlib-gnu";
   version = "2.9.1-1";
@@ -980,12 +968,13 @@ buildLuarocksPackage {
   "date": "2020-08-07T12:10:29+03:00",
   "path": "/nix/store/vnnhcc0r9zhqwshmfzrn0ryai61l6xrd-lrexlib",
   "sha256": "15dsxq0363940rij9za8mc224n9n58i2iqw1z7r1jh3qpkaciw7j",
+  "hash": "sha256-8vDI1Lx4QBny+YHjKCIqNlkiBKtI/SRjBiQNMwDuupU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -997,7 +986,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lrexlib-pcre = callPackage({ lua, luaOlder, buildLuarocksPackage, fetchgit }:
+lrexlib-pcre = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lrexlib-pcre";
   version = "2.9.1-1";
@@ -1011,12 +1000,13 @@ buildLuarocksPackage {
   "date": "2020-08-07T12:10:29+03:00",
   "path": "/nix/store/vnnhcc0r9zhqwshmfzrn0ryai61l6xrd-lrexlib",
   "sha256": "15dsxq0363940rij9za8mc224n9n58i2iqw1z7r1jh3qpkaciw7j",
+  "hash": "sha256-8vDI1Lx4QBny+YHjKCIqNlkiBKtI/SRjBiQNMwDuupU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1029,7 +1019,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lrexlib-posix = callPackage({ lua, luaOlder, buildLuarocksPackage, fetchgit }:
+lrexlib-posix = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lrexlib-posix";
   version = "2.9.1-1";
@@ -1043,12 +1033,13 @@ buildLuarocksPackage {
   "date": "2020-08-07T12:10:29+03:00",
   "path": "/nix/store/vnnhcc0r9zhqwshmfzrn0ryai61l6xrd-lrexlib",
   "sha256": "15dsxq0363940rij9za8mc224n9n58i2iqw1z7r1jh3qpkaciw7j",
+  "hash": "sha256-8vDI1Lx4QBny+YHjKCIqNlkiBKtI/SRjBiQNMwDuupU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1060,7 +1051,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-cjson = callPackage({ luaOlder, fetchgit, lua, buildLuarocksPackage }:
+lua-cjson = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-cjson";
   version = "2.1.0.10-1";
@@ -1074,12 +1065,13 @@ buildLuarocksPackage {
   "date": "2021-12-10T20:19:58+08:00",
   "path": "/nix/store/1ac8lz6smfa8zqfipqfsg749l9rw4ly9-lua-cjson",
   "sha256": "03hdsv7d77mggis58k8fmlpbh1d544m0lfqyl9rpjcqkiqs1qvza",
+  "hash": "sha256-6m8cNI4TM3lzoh47CiohpQW4Lq0OTVR0fK+e087WDQ4=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1091,7 +1083,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-cmsgpack = callPackage({ luaOlder, fetchgit, lua, buildLuarocksPackage }:
+lua-cmsgpack = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-cmsgpack";
   version = "0.4.0-0";
@@ -1105,12 +1097,13 @@ buildLuarocksPackage {
   "date": "2015-06-03T08:39:04+02:00",
   "path": "/nix/store/ksqvl7hbd5s7nb6hjffyic1shldac4z2-lua-cmsgpack",
   "sha256": "0j0ahc9rprgl6dqxybaxggjam2r5i2wqqsd6764n0d7fdpj9fqm0",
+  "hash": "sha256-oGKX5G3uNGCJOaZpjLmIJYuq5HtdLd9xM/TlmxODCkg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1122,7 +1115,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-curl = callPackage({ lua, buildLuarocksPackage, fetchzip, luaOlder, luaAtLeast }:
+lua-curl = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-curl";
   version = "0.3.13-1";
@@ -1145,30 +1138,61 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-iconv = callPackage({ fetchurl, lua, buildLuarocksPackage, luaOlder }:
+lua-ffi-zlib = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
+buildLuarocksPackage {
+  pname = "lua-ffi-zlib";
+  version = "0.6-0";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/lua-ffi-zlib-0.6-0.rockspec";
+    sha256 = "060sac715f1ris13fjv6gwqm0lk6by0a2zhldxd8hdrc0jss8p34";
+  }).outPath;
+  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
+  "url": "https://github.com/hamishforbes/lua-ffi-zlib",
+  "rev": "61e95cb434e4047c8bc65a180c293a05bf754416",
+  "date": "2023-08-11T09:28:16+12:00",
+  "path": "/nix/store/gfyr81q84mgpgwyh28xpzlf34ndjkfwc-lua-ffi-zlib",
+  "sha256": "0r6vima495h0d4f8ibf3fv9b6k7rqnavgvsy78dybslrm7lwsz4p",
+  "hash": "sha256-l3zN6amZ6uUbOl7vt5XF+Uyz0nbDrYgcaQCWRFSN22Q=",
+  "fetchLFS": false,
+  "fetchSubmodules": true,
+  "deepClone": false,
+  "leaveDotGit": false
+}
+ '') ["date" "path" "sha256"]) ;
+
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = {
+    homepage = "https://github.com/hamishforbes/lua-ffi-zlib";
+    description = "A Lua module using LuaJIT's FFI feature to access zlib.";
+  };
+}) {};
+
+lua-iconv = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-iconv";
-  version = "7-3";
+  version = "7.0.0-2";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-iconv-7-3.rockspec";
-    sha256 = "0qh5vsaxd7s31p7a8rl08lwd6zv90wnvp15nll4fcz452kffpp72";
+    url    = "mirror://luarocks/lua-iconv-7.0.0-2.rockspec";
+    sha256 = "1bj512kqcj2cxna7si4648fci51fs4bqvdn592i9cahscsc0kk9g";
   }).outPath;
   src = fetchurl {
-    url    = "https://github.com/downloads/ittner/lua-iconv/lua-iconv-7.tar.gz";
-    sha256 = "02dg5x79fg5mwsycr0fj6w04zykdpiki9xjswkkwzdalqwaikny1";
+    url    = "https://github.com/lunarmodules/lua-iconv/archive/v7.0.0/lua-iconv-7.0.0.tar.gz";
+    sha256 = "0arp0h342hpp4kfdxc69yxspziky4v7c13jbf12yrs8f1lnjzr0x";
   };
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "http://ittner.github.com/lua-iconv/";
+    homepage = "https://github.com/lunarmodules/lua-iconv/";
     description = "Lua binding to the iconv";
     license.fullName = "MIT/X11";
   };
 }) {};
 
-lua-lsp = callPackage({ fetchgit, inspect, lua, lpeglabel, dkjson, luaAtLeast, luaOlder, buildLuarocksPackage }:
+lua-lsp = callPackage({ buildLuarocksPackage, dkjson, fetchgit, fetchurl, inspect, lpeglabel, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-lsp";
   version = "0.1.0-2";
@@ -1182,12 +1206,13 @@ buildLuarocksPackage {
   "date": "2020-10-17T15:07:11-04:00",
   "path": "/nix/store/qn9syhm875k1qardhhsp025cm3dbnqvm-lua-lsp",
   "sha256": "17k3jq61jz6j9bz4vc3hmsfx1s26cfgq1acja8fqyixljklmsbqp",
+  "hash": "sha256-Fy9d6ZS0R48dUpKpgJ9jRujQna5wsE3+StJ8GQyWY54=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ dkjson inspect lpeglabel lua ];
@@ -1199,17 +1224,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-messagepack = callPackage({ buildLuarocksPackage, lua, fetchurl, luaOlder }:
+lua-messagepack = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-messagepack";
-  version = "0.5.2-1";
+  version = "0.5.3-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-messagepack-0.5.2-1.rockspec";
-    sha256 = "15liz6v8hsqgb3xrcd74a71nnjcz79gpc3ak351hk6k4gyjq2rfc";
+    url    = "mirror://luarocks/lua-messagepack-0.5.3-1.rockspec";
+    sha256 = "0sc11ckizivijgdnqvb0xnagrak6d2caxc5j8jz8ad1b2plp50pq";
   }).outPath;
   src = fetchurl {
-    url    = "https://framagit.org/fperrad/lua-MessagePack/raw/releases/lua-messagepack-0.5.2.tar.gz";
-    sha256 = "1jgi944d0vx4zs9lrphys9pw0wrsibip93sh141qjwymrjyjg1nc";
+    url    = "https://framagit.org/fperrad/lua-MessagePack/raw/releases/lua-messagepack-0.5.3.tar.gz";
+    sha256 = "17qdigs2pzi38rfqgs63xh44n1vylb6bcmmbz3sby68f0n9p8kq6";
   };
 
   disabled = (luaOlder "5.1");
@@ -1222,26 +1247,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-protobuf = callPackage({ luaOlder, buildLuarocksPackage, lua, fetchgit }:
+lua-protobuf = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-protobuf";
-  version = "0.4.1-1";
+  version = "0.5.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-protobuf-0.4.1-1.rockspec";
-    sha256 = "0b395lhby26drb8dzf2gn2avlwvxmnaqmqx5m4g3ik7dmmn7p09i";
+    url    = "mirror://luarocks/lua-protobuf-0.5.0-1.rockspec";
+    sha256 = "08z73rsqi7ysdyjcwfqyr8z6i5r43kx5fd8l32wlzv6cx6yvlqc9";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/starwing/lua-protobuf.git",
-  "rev": "2a2b0b95117642ad9470bfe0add7dd6ce82f3869",
-  "date": "2022-11-29T21:34:24+08:00",
-  "path": "/nix/store/8yjzfj6gy8nkz1dxf0bmy8afwiv8gsjr-lua-protobuf",
-  "sha256": "0c1vjji0nj9lznsxw5gbnhab0ibs69298yrsn5yky0hhz8mmx5nr",
+  "rev": "a256c34e12cad643d6ad189bddcbc314da9b0658",
+  "date": "2023-04-30T02:11:27+08:00",
+  "path": "/nix/store/n7ihjh36kp2f80016f9y8xydia2pclzq-lua-protobuf",
+  "sha256": "1kbanbgvmzcfnxq30f8hmirgc1d768lacpjihis9961pc7w96l9n",
+  "hash": "sha256-NlGT+GE3mJR0hFFepigypwX2cqwQOTBwt479ut+yas0=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1254,26 +1280,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-resty-http = callPackage({ lua, fetchgit, luaOlder, buildLuarocksPackage }:
+lua-resty-http = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-resty-http";
-  version = "0.17.0.beta.1-0";
+  version = "0.17.1-0";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-resty-http-0.17.0.beta.1-0.rockspec";
-    sha256 = "1cjl007k43cyrwvj0p58hvp00q4lnd9rq3v3pcvwi5an2pvxnv80";
+    url    = "mirror://luarocks/lua-resty-http-0.17.1-0.rockspec";
+    sha256 = "05gid7c5i459clw707z1jic42s52ap4z66dbr9ims5znaq5s3wdk";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/ledgetech/lua-resty-http",
-  "rev": "8cb73c4cc2118f0c62d9132e3b3b14aa36192e34",
-  "date": "2022-02-11T16:44:50+00:00",
-  "path": "/nix/store/29kr6whllphz0nla5nh1f8q30dgp9vnz-lua-resty-http",
-  "sha256": "0y253dnnx59a5c1nbkcv1p5kq7kdsd5i094i7wzpg5ar6xwvqhjb",
+  "rev": "4ab4269cf442ba52507aa2c718f606054452fcad",
+  "date": "2023-03-22T09:48:56+00:00",
+  "path": "/nix/store/ykd1d5fa56i1c286k58jm233lqvdv2mi-lua-resty-http",
+  "sha256": "0xdhygjqjpfkq1bq8b09fichww57q1z694lz16i3hcc3g4sr4hxg",
+  "hash": "sha256-r0OSNXmDMTiiCZ+SZH7Ap3AOWXQJLIRXwNNdieXzsHU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1285,7 +1312,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-resty-jwt = callPackage({ luaOlder, lua-resty-openssl, fetchgit, lua, buildLuarocksPackage }:
+lua-resty-jwt = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, lua-resty-openssl, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-resty-jwt";
   version = "0.2.3-0";
@@ -1299,12 +1326,13 @@ buildLuarocksPackage {
   "date": "2021-01-20T16:53:57-05:00",
   "path": "/nix/store/z4a8ffxj2i3gbjp0f8r377cdp88lkzl4-lua-resty-jwt",
   "sha256": "07w8r8gqbby06x493qzislig7a3giw0anqr4ivp3g2ms8v9fnng6",
+  "hash": "sha256-5lnr0ka6ijfujiRjqwCPb6jzItXx45FIN8CvhR/KiB8=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua lua-resty-openssl ];
@@ -1316,7 +1344,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-resty-openidc = callPackage({ lua-resty-http, buildLuarocksPackage, fetchgit, lua-resty-session, luaOlder, lua, lua-resty-jwt }:
+lua-resty-openidc = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, lua-resty-http, lua-resty-jwt, lua-resty-session, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-resty-openidc";
   version = "1.7.6-3";
@@ -1330,12 +1358,13 @@ buildLuarocksPackage {
   "date": "2023-01-30T19:06:51+01:00",
   "path": "/nix/store/nyd2jqhlq8gx4chapqyxk2q4dsxgm8hz-lua-resty-openidc",
   "sha256": "15dh9z7y84n840x02xsn2m9h9hdakbbv4p1z7dfz85v5w5i6c86p",
+  "hash": "sha256-1yBmYuFlF/RdOz9csteaqsEEUxVWdwE6IMgS5M9PsJU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua lua-resty-http lua-resty-jwt lua-resty-session ];
@@ -1347,26 +1376,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-resty-openssl = callPackage({ fetchgit, buildLuarocksPackage }:
+lua-resty-openssl = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "lua-resty-openssl";
-  version = "0.8.17-1";
+  version = "0.8.25-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-resty-openssl-0.8.17-1.rockspec";
-    sha256 = "1b4dv9mdb90n0f6982pnjb05rgb12nkn1j66a1ywcs5fqcmj4sb5";
+    url    = "mirror://luarocks/lua-resty-openssl-0.8.25-1.rockspec";
+    sha256 = "0wy0fjb50kpcyk6mkjj364p4lrfxl0b34xnv2n0wib1brk536s1l";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/fffonion/lua-resty-openssl.git",
-  "rev": "dc17f6b2ff3adaa3bcb586f1d09073a4f4f4ec9d",
-  "date": "2023-01-20T01:36:57+08:00",
-  "path": "/nix/store/hh9i8ndb861iplkf9mz6vs2akkyibazn-lua-resty-openssl",
-  "sha256": "14xmxskbw3clqr97y69d311rs6i97vl7dg8pzixsqf4ypgllzvig",
+  "rev": "f9a153288238e9b7e3d5d40144610410a06a83cd",
+  "date": "2023-09-05T15:19:20+08:00",
+  "path": "/nix/store/jnvr2pzvxl2psd5w030m4qnv5dsm8spb-lua-resty-openssl",
+  "sha256": "08fqgdfi0dr3n2lqrbgwa94dd2f6crn1kb0cfpccphknaypaw7dp",
+  "hash": "sha256-tx2urld2wsvYdQysGWxmxonWSFL8rYypsCM3EF172CE=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
 
   meta = {
@@ -1376,39 +1406,39 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-resty-session = callPackage({ buildLuarocksPackage, fetchgit, luaOlder, lua, lua-resty-openssl /*, lua_pack, lua-ffi-zlib */  }:
+lua-resty-session = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, lua-ffi-zlib, lua-resty-openssl, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-resty-session";
-  version = "4.0.3-1";
+  version = "4.0.5-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lua-resty-session-4.0.3-1.rockspec";
-    sha256 = "17q8gf0zjdbfgphvjsnlzw1d6158v4ppiqxap6hjqr0prqa5yyfq";
+    url    = "mirror://luarocks/lua-resty-session-4.0.5-1.rockspec";
+    sha256 = "0h0kqwna46mrraq310qjb7yigxwv13n4czk24xnqr21czxsskzkg";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/bungle/lua-resty-session.git",
-  "rev": "3373d8138930b6d1e255bb80d9127503019301d7",
-  "date": "2023-02-21T20:52:32+02:00",
-  "path": "/nix/store/pdwd03w7505wkv4fw79a3mdlfijk9ngd-lua-resty-session",
-  "sha256": "1d105785jzn9x3by4r0baaffr5xmc2ilgd7z7izcwq9z29pnfv02",
+  "rev": "5f2aed616d16fa7ca04dc40e23d6941740cd634d",
+  "date": "2023-08-16T18:24:43+03:00",
+  "path": "/nix/store/s6i1idv9lx52x7lcl0kc2c9sm9pic4kq-lua-resty-session",
+  "sha256": "08pih1baqhlvsqvcr1zzympmn8v7gskmis6ffhigll37hbzvljcz",
+  "hash": "sha256-n0m6/4JnUPoidM7oWKd+ZyNbb/X/h8w21ptCrFaA8SI=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ lua lua-resty-openssl /* lua_pack lua-ffi-zlib */ ];
+  propagatedBuildInputs = [ lua lua-ffi-zlib lua-resty-openssl ];
 
   meta = {
     homepage = "https://github.com/bungle/lua-resty-session";
     description = "Session Library for OpenResty - Flexible and Secure";
     license.fullName = "BSD";
-    broken = true; # lua_pack and lua-ffi-zlib are unpackaged, causing this package to not evaluate
   };
 }) {};
 
-lua-subprocess = callPackage({ lua, buildLuarocksPackage, fetchgit, luaOlder }:
+lua-subprocess = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "subprocess";
   version = "scm-1";
@@ -1419,12 +1449,13 @@ buildLuarocksPackage {
   "date": "2021-01-09T22:31:54+01:00",
   "path": "/nix/store/3lr7n1k85kbf718wxr51xd40i8dfs5qd-lua-subprocess",
   "sha256": "0p91hda0b0hpgdbff5drcyygaizq086gw8vnvzn0y0fg3mc9if70",
+  "hash": "sha256-4LiYWB3PAQ/s33Yj/gwC+Ef1vGe5FedWexeCBVSDIV0=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1437,7 +1468,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-term = callPackage({ fetchurl, buildLuarocksPackage }:
+lua-term = callPackage({ buildLuarocksPackage, fetchurl }:
 buildLuarocksPackage {
   pname = "lua-term";
   version = "0.7-1";
@@ -1458,7 +1489,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-toml = callPackage({ fetchgit, buildLuarocksPackage, luaOlder, lua }:
+lua-toml = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-toml";
   version = "2.0-1";
@@ -1472,12 +1503,13 @@ buildLuarocksPackage {
   "date": "2017-12-08T16:30:50-08:00",
   "path": "/nix/store/cnpflpyj441c65jhb68hjr2bcvnj9han-lua-toml",
   "sha256": "0lklhgs4n7gbgva5frs39240da1y4nwlx6yxaj3ix6r5lp9sh07b",
+  "hash": "sha256-6wCo06Ulmx6HVN2bTrklPqgGiEhDZ1fUfusdS/SDdFI=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1489,7 +1521,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-yajl = callPackage({ luaOlder, buildLuarocksPackage, lua, fetchgit }:
+lua-yajl = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-yajl";
   version = "2.0-1";
@@ -1503,12 +1535,13 @@ buildLuarocksPackage {
   "date": "2020-11-12T06:22:23-08:00",
   "path": "/nix/store/9acgxpqk52kwn03m5xasn4f6mmsby2r9-lua-yajl",
   "sha256": "1frry90y7vqnw1rd1dfnksilynh0n24gfhkmjd6wwba73prrg0pf",
+  "hash": "sha256-7oKX8x1HLc5Nk3VC94iwAFpPo57WtdBy4Bbv40HyObs=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1521,7 +1554,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua-zlib = callPackage({ fetchgit, buildLuarocksPackage, luaOlder, lua }:
+lua-zlib = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua-zlib";
   version = "1.2-2";
@@ -1535,12 +1568,13 @@ buildLuarocksPackage {
   "date": "2017-10-07T08:26:37-07:00",
   "path": "/nix/store/6hjfczd3xkilkdxidgqzdrwmaiwnlf05-lua-zlib",
   "sha256": "1cv12s5c5lihmf3hb0rz05qf13yihy1bjpb7448v8mkiss6y1s5c",
+  "hash": "sha256-rOjgjdZxVrQRIWdduYKH0Y/gcAE/gwWHqzDSwooWYbM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1553,7 +1587,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lua_cliargs = callPackage({ lua, luaOlder, buildLuarocksPackage, fetchurl }:
+lua_cliargs = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lua_cliargs";
   version = "3.0-2";
@@ -1573,7 +1607,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luabitop = callPackage({ luaAtLeast, lua, fetchgit, buildLuarocksPackage, luaOlder }:
+luabitop = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luabitop";
   version = "1.0.2-3";
@@ -1584,12 +1618,13 @@ buildLuarocksPackage {
   "date": "2021-08-30T10:14:03+02:00",
   "path": "/nix/store/sdnza0zpmlkz9jppnysasbvqy29f4zia-luabitop",
   "sha256": "1b57f99lrjbwsi4m23cq5kpj0dbpxh3xwr0mxs2rzykr2ijpgwrw",
+  "hash": "sha256-PPN3ZRR5+p+F7hVk3gfsdzUg7yyYDVFJ1HzJTFNyp6w=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.3");
   propagatedBuildInputs = [ lua ];
@@ -1601,26 +1636,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-luacheck = callPackage({ argparse, luafilesystem, lua, luaOlder, fetchgit, buildLuarocksPackage }:
+luacheck = callPackage({ argparse, buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "luacheck";
-  version = "1.1.0-1";
+  version = "1.1.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luacheck-1.1.0-1.rockspec";
-    sha256 = "1r8d02x0hw28rd5p2gr7sf503lczjxv6qk1q66b375ibx6smpyza";
+    url    = "mirror://luarocks/luacheck-1.1.1-1.rockspec";
+    sha256 = "11nrryqff2yis5s7jscbyv221p21i9sh924x7g9l3d6ijns8zmba";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/luacheck.git",
-  "rev": "fcbdeacad00e643e0d78c56b9ba6d8b3c7fa584f",
-  "date": "2022-12-19T20:51:56+03:00",
-  "path": "/nix/store/srzi8dfrbb9gby9lc7r4sndzzrpzd7nm-luacheck",
-  "sha256": "0bkbcxadlf0j59lyvadp7hs7l107blkci15i0hrbi72bx18hj99h",
+  "rev": "ababb6d403d634eb74d2c541035e9ede966e710d",
+  "date": "2023-06-10T11:27:25+03:00",
+  "path": "/nix/store/wkrhda7nww45g1waxdv9ghm35mwbvlfq-luacheck",
+  "sha256": "0abd5rfxv667n8d8v3g9cnkyghiwzhj3yk498gr2agd3mfcni7d7",
+  "hash": "sha256-p51omaujPSXyQ4lMPyT8PMLnp2XpjY0asseY3V0ubSk=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ argparse lua luafilesystem ];
@@ -1632,7 +1668,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luacov = callPackage({ luaAtLeast, buildLuarocksPackage, luaOlder, lua, fetchgit }:
+luacov = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luacov";
   version = "0.15.0-1";
@@ -1646,12 +1682,13 @@ buildLuarocksPackage {
   "date": "2021-02-15T18:47:58-03:00",
   "path": "/nix/store/9vm38il9knzx2m66m250qj1fzdfzqg0y-luacov",
   "sha256": "08550nna6qcb5jn6ds1hjm6010y8973wx4qbf9vrvrcn1k2yr6ki",
+  "hash": "sha256-cZrsxQyW5Z13cguTzsdJyIMATJUw6GasLItho6wFpSA=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
@@ -1663,7 +1700,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luadbi = callPackage({ buildLuarocksPackage, lua, luaOlder, fetchgit, luaAtLeast }:
+luadbi = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luadbi";
   version = "0.7.2-1";
@@ -1677,12 +1714,13 @@ buildLuarocksPackage {
   "date": "2019-01-14T09:39:17+00:00",
   "path": "/nix/store/a3qgawila4r4jc2lpdc4mwyzd1gvzazd-luadbi",
   "sha256": "167ivwmczhp98bxzpz3wdxcfj6vi0a10gpi7rdfjs2rbfwkzqvjh",
+  "hash": "sha256-UG78J3crCy1dyyfeB4ICcRvpWG98/Pv7QunCzyrf8Zg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
@@ -1694,7 +1732,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luadbi-mysql = callPackage({ luaOlder, lua, buildLuarocksPackage, fetchgit, luadbi, luaAtLeast }:
+luadbi-mysql = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder, luadbi }:
 buildLuarocksPackage {
   pname = "luadbi-mysql";
   version = "0.7.2-1";
@@ -1708,12 +1746,13 @@ buildLuarocksPackage {
   "date": "2019-01-14T09:39:17+00:00",
   "path": "/nix/store/a3qgawila4r4jc2lpdc4mwyzd1gvzazd-luadbi",
   "sha256": "167ivwmczhp98bxzpz3wdxcfj6vi0a10gpi7rdfjs2rbfwkzqvjh",
+  "hash": "sha256-UG78J3crCy1dyyfeB4ICcRvpWG98/Pv7QunCzyrf8Zg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua luadbi ];
@@ -1725,7 +1764,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luadbi-postgresql = callPackage({ lua, fetchgit, buildLuarocksPackage, luaOlder, luaAtLeast, luadbi }:
+luadbi-postgresql = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder, luadbi }:
 buildLuarocksPackage {
   pname = "luadbi-postgresql";
   version = "0.7.2-1";
@@ -1739,12 +1778,13 @@ buildLuarocksPackage {
   "date": "2019-01-14T09:39:17+00:00",
   "path": "/nix/store/a3qgawila4r4jc2lpdc4mwyzd1gvzazd-luadbi",
   "sha256": "167ivwmczhp98bxzpz3wdxcfj6vi0a10gpi7rdfjs2rbfwkzqvjh",
+  "hash": "sha256-UG78J3crCy1dyyfeB4ICcRvpWG98/Pv7QunCzyrf8Zg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua luadbi ];
@@ -1756,7 +1796,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luadbi-sqlite3 = callPackage({ luaAtLeast, lua, luaOlder, buildLuarocksPackage, fetchgit, luadbi }:
+luadbi-sqlite3 = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder, luadbi }:
 buildLuarocksPackage {
   pname = "luadbi-sqlite3";
   version = "0.7.2-1";
@@ -1770,12 +1810,13 @@ buildLuarocksPackage {
   "date": "2019-01-14T09:39:17+00:00",
   "path": "/nix/store/a3qgawila4r4jc2lpdc4mwyzd1gvzazd-luadbi",
   "sha256": "167ivwmczhp98bxzpz3wdxcfj6vi0a10gpi7rdfjs2rbfwkzqvjh",
+  "hash": "sha256-UG78J3crCy1dyyfeB4ICcRvpWG98/Pv7QunCzyrf8Zg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua luadbi ];
@@ -1787,7 +1828,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaepnf = callPackage({ luaOlder, buildLuarocksPackage, lpeg, luaAtLeast, lua, fetchgit }:
+luaepnf = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lpeg, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luaepnf";
   version = "0.3-2";
@@ -1801,12 +1842,13 @@ buildLuarocksPackage {
   "date": "2015-01-15T16:54:10+01:00",
   "path": "/nix/store/n7gb0z26sl7dzdyy3bx1y3cz3npsna7d-lua-luaepnf",
   "sha256": "1lvsi3fklhvz671jgg0iqn0xbkzn9qjcbf2ks41xxjz3lapjr6c9",
+  "hash": "sha256-iZksr6Ljy94D0VO4xSRO9s/VgcURvCfDMX9DOt2IetM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lpeg lua ];
@@ -1818,7 +1860,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaevent = callPackage({ lua, fetchurl, luaOlder, buildLuarocksPackage }:
+luaevent = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luaevent";
   version = "0.4.6-1";
@@ -1841,7 +1883,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaexpat = callPackage({ buildLuarocksPackage, fetchgit, luaOlder, lua }:
+luaexpat = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luaexpat";
   version = "1.4.1-1";
@@ -1855,12 +1897,13 @@ buildLuarocksPackage {
   "date": "2022-10-04T16:36:23+02:00",
   "path": "/nix/store/dgrdkalikpqdap642qhppha1ajdnsvx0-luaexpat",
   "sha256": "1b4ck23p01ks3hgayan9n33f2kb6jvv63v4ww2mqczc09rqi0q46",
+  "hash": "sha256-hmAQcU6AfYar4JzsYfaWZk3hxrDJKq8eHHoGcIeYjKw=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1873,7 +1916,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaffi = callPackage({ fetchgit, buildLuarocksPackage, lua, luaOlder }:
+luaffi = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luaffi";
   version = "scm-1";
@@ -1887,12 +1930,13 @@ buildLuarocksPackage {
   "date": "2021-03-01T11:46:30-05:00",
   "path": "/nix/store/6dwfn64p3clcsxkq41b307q8izi0fvji-luaffifb",
   "sha256": "0nj76fw3yi57vfn35yvbdmpdbg9gmn5j1gw84ajs9w1j86sc0661",
+  "hash": "sha256-wRjAtEEy8KSlIoi/IIutL73Vbm1r+zKs26dEP7gzR1o=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1904,7 +1948,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luafilesystem = callPackage({ luaOlder, lua, fetchgit, buildLuarocksPackage }:
+luafilesystem = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luafilesystem";
   version = "1.8.0-1";
@@ -1918,44 +1962,46 @@ buildLuarocksPackage {
   "date": "2020-04-22T22:16:42-03:00",
   "path": "/nix/store/qzjav1cmn4zwclpfs0xzykpbv835d84z-luafilesystem",
   "sha256": "16hpwhj6zgkjns3zilcg3lxfijm3cl71v39y9n5lbjk4b9kkwh54",
+  "hash": "sha256-pEA+Z1pkykWLTT6NHQ5lo8roOh2P0fiHtnK+byTkF5o=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "git://github.com/keplerproject/luafilesystem";
+    homepage = "https://github.com/keplerproject/luafilesystem";
     description = "File System Library for the Lua Programming Language";
     maintainers = with lib.maintainers; [ flosse ];
     license.fullName = "MIT/X11";
   };
 }) {};
 
-lualdap = callPackage({ fetchgit, lua, luaOlder, buildLuarocksPackage }:
+lualdap = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "lualdap";
-  version = "1.3.0-1";
+  version = "1.3.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/lualdap-1.3.0-1.rockspec";
-    sha256 = "0b51sm0fz4kiim20w538v31k9g20wq3msxdkh17drkr60ab25sc8";
+    url    = "mirror://luarocks/lualdap-1.3.1-1.rockspec";
+    sha256 = "0c0j9dmrphg0dil4yhahcqzzyxhrv525g65jsz0q6iqwyx10bqbp";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lualdap/lualdap",
-  "rev": "be380f5d98f779c813a4fb4ae1400262366fc8d4",
-  "date": "2021-06-05T15:49:42+02:00",
-  "path": "/nix/store/99sy73yz6sidqhkl0kwdsd7r853aw38n-lualdap",
-  "sha256": "133d8br5f24z03ni38m0czrqfz0mr0ksdrc1g73rawpmiqarpps8",
+  "rev": "5c21b3e0d97a07b103f63edc7e649018e0453427",
+  "date": "2023-03-15T09:02:07+01:00",
+  "path": "/nix/store/ah7y5wpp3l0v5bk0gwzdvgzfpczb691k-lualdap",
+  "sha256": "1y3ap9si894xjlbrwx3c6bcfg60y80av802rscldg9scvm984jrg",
+  "hash": "sha256-L0uCUt1Mp9co01kAtBVAHpjn2DJsdJ4XlZ0kFHW6avg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -1968,7 +2014,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lualogging = callPackage({ luasocket, buildLuarocksPackage, fetchgit }:
+lualogging = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, luasocket }:
 buildLuarocksPackage {
   pname = "lualogging";
   version = "1.8.2-1";
@@ -1982,12 +2028,13 @@ buildLuarocksPackage {
   "date": "2023-01-27T20:29:41+01:00",
   "path": "/nix/store/pvb3yq11xgqhq6559sjd8rkf1x991rrz-lualogging",
   "sha256": "1mz5iiv9pfikkm4ay7j0q6mk3bmcxylnlg9piwda47xxc1zyb1j4",
+  "hash": "sha256-RIblf2C9H6Iajzc9aqnvrK4xq8FAHq9InTO6m3aM5dc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ luasocket ];
 
@@ -1998,7 +2045,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaossl = callPackage({ buildLuarocksPackage, lua, fetchzip }:
+luaossl = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua }:
 buildLuarocksPackage {
   pname = "luaossl";
   version = "20220711-0";
@@ -2020,7 +2067,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaposix = callPackage({ bit32, lua, luaOlder, fetchzip, luaAtLeast, buildLuarocksPackage }:
+luaposix = callPackage({ bit32, buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luaposix";
   version = "34.1.1-1";
@@ -2044,7 +2091,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luarepl = callPackage({ buildLuarocksPackage, fetchurl, luaOlder, lua }:
+luarepl = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luarepl";
   version = "0.10-1";
@@ -2067,7 +2114,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luarocks-build-rust-mlua = callPackage({ fetchgit, buildLuarocksPackage }:
+luarocks-build-rust-mlua = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "luarocks-build-rust-mlua";
   version = "0.1.2-1";
@@ -2081,41 +2128,44 @@ buildLuarocksPackage {
   "date": "2023-06-29T16:47:41+01:00",
   "path": "/nix/store/n7id28r1m11xd550hayv99xhz96vpdjq-luarocks-build-rust-mlua",
   "sha256": "1zh1p5k7xpczi5db3k0fw0ljw9w0xxk1qjjcfg5rcznqjf48i3x7",
+  "hash": "sha256-p4+IiJPYfpbLc0xKHGbvgCcuKeAOzLFaiZ/dfma5Af4=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
 
   meta = {
     homepage = "https://github.com/khvzak/luarocks-build-rust-mlua";
     description = "A LuaRocks build backend for Lua modules written in Rust using mlua";
+    maintainers = with lib.maintainers; [ mrcjkb ];
     license.fullName = "MIT";
   };
 }) {};
 
-luasec = callPackage({ fetchgit, luaOlder, luasocket, buildLuarocksPackage, lua }:
+luasec = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, luasocket }:
 buildLuarocksPackage {
   pname = "luasec";
-  version = "1.2.0-1";
+  version = "1.3.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luasec-1.2.0-1.rockspec";
-    sha256 = "0zavdkwd701j8zqyzrpn1n5xd242vziq2l79amjdn5mcw81nrsdf";
+    url    = "mirror://luarocks/luasec-1.3.2-1.rockspec";
+    sha256 = "09nqs60cmbq1bi70cdh7v5xjnlsm2mrxv9pmbbvczijvz184jh33";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/brunoos/luasec",
-  "rev": "d9215ee00f6694a228daad50ee85827a4cd13583",
-  "date": "2022-07-30T08:42:53-03:00",
-  "path": "/nix/store/77m3g768a230h77nxiw23ay73aryq1zh-luasec",
-  "sha256": "1rz2lhf243lrsjsyjwxhijhqr88l8l8sndzzv9w4x1j0zpa9sblb",
+  "rev": "4c06287052d68fdbe7429b8f967cdc8ee94aa44a",
+  "date": "2023-08-31T17:09:53-03:00",
+  "path": "/nix/store/wnl78b5l3dxw52slphmi4rmr1cd8bd3r-luasec",
+  "sha256": "0rrdfbnkd8pgqwh3f0iyd5cxy7g1h0568a88m3sq1z7715js4yx3",
+  "hash": "sha256-o3uiZQnn/ID1qAgpZAqA4R3fWWk+Ajcgx++iNu1yLWc=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua luasocket ];
@@ -2128,7 +2178,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luasocket = callPackage({ fetchgit, lua, luaOlder, buildLuarocksPackage }:
+luasocket = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luasocket";
   version = "3.1.0-1";
@@ -2142,12 +2192,13 @@ buildLuarocksPackage {
   "date": "2022-07-27T10:07:00+03:00",
   "path": "/nix/store/r5pqxqjkdwl80nmjkv400mbls7cfymjc-luasocket",
   "sha256": "13hyf9cvny0kxwyg08929kkl31w74j66fj6zg1myyjr9nh5b795h",
+  "hash": "sha256-sKSzCrQpS+9reN9IZ4wkh4dB50wiIfA87xN4u1lyHo4=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -2159,26 +2210,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-luasql-sqlite3 = callPackage({ lua, buildLuarocksPackage, fetchgit, luaOlder }:
+luasql-sqlite3 = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luasql-sqlite3";
-  version = "2.6.0-1";
+  version = "2.6.0-2";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luasql-sqlite3-2.6.0-1.rockspec";
-    sha256 = "0w32znsfcaklcja6avqx7daaxbf0hr2v8g8bmz0fysb3401lmp02";
+    url    = "mirror://luarocks/luasql-sqlite3-2.6.0-2.rockspec";
+    sha256 = "1xpbcpl4qhnzpyyszhdsrxhx2qc1dmndh926lv91xwphw7inwdwg";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/keplerproject/luasql.git",
-  "rev": "e2660cbaeb13cb33d8346bb816c6a526241b3c2d",
-  "date": "2022-10-03T18:44:40-03:00",
-  "path": "/nix/store/mxzq779w3l19bgb424aa4cqdzxczmwr3-luasql",
-  "sha256": "052hc174am05plidilzf36vr736sp8vyydfb12qa8xr6mk74f6d1",
+  "rev": "25bf4ffce9323d28cb6f382f7ec9e8951e3084f9",
+  "date": "2023-07-19T14:20:27-03:00",
+  "path": "/nix/store/949886jxp7sx3yx910lc6d1yf3ym9mx5-luasql",
+  "sha256": "00q73j2nzqsm0vmxjkv83qh1dncmr5dgmkrkyxnb5ggygvcbh7w5",
+  "hash": "sha256-hR+42H7+vbJs9zPP+lrJldkWIB5oT9nrBlXjb4UcBwM=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -2191,7 +2243,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luassert = callPackage({ luaOlder, fetchgit, buildLuarocksPackage, lua, say }:
+luassert = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, say }:
 buildLuarocksPackage {
   pname = "luassert";
   version = "1.9.0-1";
@@ -2205,12 +2257,13 @@ buildLuarocksPackage {
   "date": "2022-08-24T00:00:45+03:00",
   "path": "/nix/store/vfcl25wxps5kvh5prjkkjlj1ga3kgw63-luassert",
   "sha256": "0wlp6qdm9dkwzs8lvnj7zvmid4y12v717ywlhxn2brkbjpvl2dwf",
+  "hash": "sha256-jjdB95Vr5iVsh5T7E84WwZMW6/5H2k2R/ny2VBs2l3I=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua say ];
@@ -2222,7 +2275,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luasystem = callPackage({ buildLuarocksPackage, luaOlder, lua, fetchurl }:
+luasystem = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luasystem";
   version = "0.2.1-0";
@@ -2245,7 +2298,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaunbound = callPackage({ fetchurl, lua, buildLuarocksPackage, luaOlder, luaAtLeast }:
+luaunbound = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luaunbound";
   version = "1.0.0-1";
@@ -2268,7 +2321,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luaunit = callPackage({ buildLuarocksPackage, fetchzip, lua, luaAtLeast, luaOlder }:
+luaunit = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luaunit";
   version = "3.4-1";
@@ -2292,7 +2345,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luautf8 = callPackage({ fetchurl, buildLuarocksPackage, lua, luaOlder }:
+luautf8 = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luautf8";
   version = "0.1.5-2";
@@ -2316,7 +2369,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luazip = callPackage({ luaOlder, luaAtLeast, buildLuarocksPackage, lua, fetchgit }:
+luazip = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luazip";
   version = "1.2.7-1";
@@ -2330,12 +2383,13 @@ buildLuarocksPackage {
   "date": "2017-09-05T14:02:52+03:00",
   "path": "/nix/store/idllj442c0iwnx1cpkrifx2afb7vh821-luazip",
   "sha256": "1jlqzqlds3aa3hnp737fm2awcx0hzmwyd87klv0cv13ny5v9f2x4",
+  "hash": "sha256-pAuXdvF2hM3ApvOg5nn9EHTGlajujHMtHEoN3Sj+mMo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
@@ -2347,23 +2401,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-lush-nvim = callPackage({ buildLuarocksPackage, fetchgit, luaAtLeast, luaOlder, lua }:
+lush-nvim = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "lush.nvim";
   version = "scm-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/rktjmp/lush.nvim",
-  "rev": "b1e8eb1da3fee95ef31515a73c9eff9bf251088d",
-  "date": "2023-01-03T10:45:29+11:00",
-  "path": "/nix/store/wpnvi5bjlp7sl8g2li21qkcd7m1f3d3w-lush.nvim",
-  "sha256": "0q3prq4fm9rpczl7b1lgqnhs0z5jgvpdy0cp45jfpw4bvcy6vkpq",
+  "rev": "966aad1accd47fa11fbe2539234f81f678fef2de",
+  "date": "2023-09-23T12:10:39+10:00",
+  "path": "/nix/store/67046ilc92czfvwc5zdkkxg7iw2xjj45-lush.nvim",
+  "sha256": "0g1xib2k42py9qqccjz11qk52ri0drgdk5rb0ls7wzx4v636k15h",
+  "hash": "sha256-sIRphtmkf340BSuX2V5uIGZRJg7hS8YwTv4KMsWKPTw=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
@@ -2376,7 +2431,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luuid = callPackage({ luaOlder, luaAtLeast, buildLuarocksPackage, fetchurl, lua }:
+luuid = callPackage({ buildLuarocksPackage, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "luuid";
   version = "20120509-2";
@@ -2399,7 +2454,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-luv = callPackage({ luaOlder, buildLuarocksPackage, fetchurl, lua }:
+luv = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "luv";
   version = "1.44.2-1";
@@ -2422,7 +2477,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-lyaml = callPackage({ buildLuarocksPackage, fetchzip, lua, luaOlder, luaAtLeast }:
+lyaml = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "lyaml";
   version = "6.2.8-1";
@@ -2446,7 +2501,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-magick = callPackage({ fetchgit, buildLuarocksPackage, lua }:
+magick = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua }:
 buildLuarocksPackage {
   pname = "magick";
   version = "1.6.0-1";
@@ -2460,24 +2515,26 @@ buildLuarocksPackage {
   "date": "2022-03-10T20:02:11-08:00",
   "path": "/nix/store/fpl99q09zg3qnk4kagxk1djabl1dm47l-magick",
   "sha256": "01b9qsz27f929rz5z7vapqhazxak74sichdwkjwb219nlhrwfncm",
+  "hash": "sha256-lVnHM6Q2BbG4nLxBFjU5U/WvIL5qn19+TiK5I77GaQU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (lua.luaversion != "5.1");
   propagatedBuildInputs = [ lua ];
 
   meta = {
-    homepage = "git://github.com/leafo/magick.git";
+    homepage = "https://github.com/leafo/magick.git";
     description = "Lua bindings to ImageMagick & GraphicsMagick for LuaJIT using FFI";
+    maintainers = with lib.maintainers; [ donovanglover ];
     license.fullName = "MIT";
   };
 }) {};
 
-markdown = callPackage({ buildLuarocksPackage, luaAtLeast, fetchgit, luaOlder, lua }:
+markdown = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "markdown";
   version = "0.33-1";
@@ -2491,12 +2548,13 @@ buildLuarocksPackage {
   "date": "2015-09-27T17:49:28+03:00",
   "path": "/nix/store/akl80hh077hm20bdqj1lksy0fn2285b5-markdown",
   "sha256": "019bk2qprszqncnm8zy6ns6709iq1nwkf7i86nr38f035j4lc11y",
+  "hash": "sha256-PgRGiSwDODSyNSgeN7kNOCZwjLbGf1Qts/jrfLGYKwU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
@@ -2508,7 +2566,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-mediator_lua = callPackage({ luaOlder, lua, fetchurl, buildLuarocksPackage }:
+mediator_lua = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "mediator_lua";
   version = "1.1.2-0";
@@ -2531,7 +2589,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-middleclass = callPackage({ luaOlder, buildLuarocksPackage, fetchurl, lua }:
+middleclass = callPackage({ buildLuarocksPackage, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "middleclass";
   version = "4.1.1-0";
@@ -2554,23 +2612,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-moonscript = callPackage({ lpeg, luaOlder, fetchgit, lua, buildLuarocksPackage, argparse, luafilesystem }:
+moonscript = callPackage({ argparse, buildLuarocksPackage, fetchgit, lpeg, lua, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "moonscript";
   version = "dev-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/leafo/moonscript.git",
-  "rev": "a0108328373d5f3f1aefb98341aa895dd75a1b2a",
-  "date": "2022-11-04T13:38:05-07:00",
-  "path": "/nix/store/js597jw44cdfq154a7bpqba99ninzsqh-moonscript",
-  "sha256": "02ig93c1dzrbs64mz40bkzz3p93fdxm6m0i7gfqwiickybr9wd97",
+  "rev": "fbd8ad48737651114a3d3a672b9f8f8b3a7022b7",
+  "date": "2023-06-23T09:33:37-07:00",
+  "path": "/nix/store/sy1dkcfp3rg7lvazba36sivpk0bs12r5-moonscript",
+  "sha256": "02w6lp5kid73dcd5x71666my7413l05ak0xvva6hp8ixbn6qraqn",
+  "hash": "sha256-FquMjV09oguN2ruDqQqgI5DjqzEmnF4aa+O0OMulhgs=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ argparse lpeg lua luafilesystem ];
@@ -2586,14 +2645,14 @@ buildLuarocksPackage {
 mpack = callPackage({ buildLuarocksPackage, fetchurl }:
 buildLuarocksPackage {
   pname = "mpack";
-  version = "1.0.9-0";
+  version = "1.0.11-0";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/mpack-1.0.9-0.rockspec";
-    sha256 = "1v10kmw3qw559bbm142z40ib26bwvcyi64qjrk0vf8v6n1mx8wcn";
+    url    = "mirror://luarocks/mpack-1.0.11-0.rockspec";
+    sha256 = "0alydkccamxldij7ki42imd37630d9qnqg22pndcgkawfclfqzqa";
   }).outPath;
   src = fetchurl {
-    url    = "https://github.com/libmpack/libmpack-lua/releases/download/1.0.9/libmpack-lua-1.0.9.tar.gz";
-    sha256 = "17lyjmnbychacwahqgs128nb00xky777g7zw5wf20vrzkiq7xl0g";
+    url    = "https://github.com/libmpack/libmpack-lua/releases/download/1.0.11/libmpack-lua-1.0.11.tar.gz";
+    sha256 = "15np7603rijavycvrjgjp12y64zs36390lg2hsnr5av790cfrnd2";
   };
 
 
@@ -2604,7 +2663,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-nui-nvim = callPackage( { fetchgit, buildLuarocksPackage }:
+nui-nvim = callPackage({ buildLuarocksPackage, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "nui.nvim";
   version = "0.2.0-1";
@@ -2618,12 +2677,13 @@ buildLuarocksPackage {
   "date": "2023-07-20T10:45:09+06:00",
   "path": "/nix/store/8zdhjgipjjhi9b1y40r2yk5np4lp39as-nui.nvim",
   "sha256": "14a73dwl56kah9h36b40ir6iylvfs261ysz17qvi9vhp63vjq9cx",
+  "hash": "sha256-nSUs9zAX7hQ3PuFrH4zQblMfTY6ALDNggmqaQnkbR5E=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
 
   meta = {
@@ -2634,7 +2694,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-nvim-client = callPackage({ coxpcall, fetchurl, mpack, lua, luaOlder, luv, buildLuarocksPackage }:
+nvim-client = callPackage({ buildLuarocksPackage, coxpcall, fetchurl, lua, luaOlder, luv, mpack }:
 buildLuarocksPackage {
   pname = "nvim-client";
   version = "0.2.4-1";
@@ -2654,23 +2714,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-nvim-cmp = callPackage({ luaAtLeast, lua, fetchgit, buildLuarocksPackage, luaOlder }:
+nvim-cmp = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "nvim-cmp";
   version = "scm-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/hrsh7th/nvim-cmp",
-  "rev": "7a3b1e76f74934b12fda82158237c6ad8bfd3d40",
-  "date": "2023-02-24T12:23:36+09:00",
-  "path": "/nix/store/s1qark9y2zkbwyl2mzg60z9r0h4hajf4-nvim-cmp",
-  "sha256": "0cy93aj02nkspr83sqsrix12jcnhkl5s2mbpjr5ffhpcrk19vlmx",
+  "rev": "5dce1b778b85c717f6614e3f4da45e9f19f54435",
+  "date": "2023-08-26T15:31:42+00:00",
+  "path": "/nix/store/lvpzc5q7mv66knxh1igvzkrcwkpg8l8q-nvim-cmp",
+  "sha256": "1yl5b680p6vhk1741riiwjnw7a4wn0nimjvcab0ij6mx3kf28rsq",
+  "hash": "sha256-WGck3By9GhnBUmzLGi2wnKjDreQx5kBOmHCbC5BZhfo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua ];
@@ -2682,23 +2743,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-penlight = callPackage({ luafilesystem, luaOlder, fetchgit, buildLuarocksPackage, lua }:
+penlight = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder, luafilesystem }:
 buildLuarocksPackage {
   pname = "penlight";
   version = "dev-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/penlight.git",
-  "rev": "7e67bcb1c4d95e7ca817356533419b4a72049b96",
-  "date": "2022-12-28T23:34:46+01:00",
-  "path": "/nix/store/14kax7nswd7in005cgb0f0r8194s9nsd-penlight",
-  "sha256": "17gcfi8hqpdp8m0f1nr9n5p1mzxxpq2qwf8zkqvjkb7qv1zqabj1",
+  "rev": "dc6d19c5c1e1b4ac55b14df17b7645af6b410140",
+  "date": "2023-09-21T10:51:09+02:00",
+  "path": "/nix/store/vbi0d32mbaqcra3jligv8ajq17m1wxa4-penlight",
+  "sha256": "12ppgby8ldh4zxwcr7cknacbdvk30fi92sgyzh1zbgvym4l44g0c",
+  "hash": "sha256-DDxCKKl+v/UD/P5pkaIDY+62mLKTncx4/wQ2ivx694o=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua luafilesystem ];
@@ -2711,23 +2773,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-plenary-nvim = callPackage({ lua, fetchgit, luaOlder, luaAtLeast, luassert, buildLuarocksPackage }:
+plenary-nvim = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, luaOlder, luassert }:
 buildLuarocksPackage {
   pname = "plenary.nvim";
   version = "scm-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/nvim-lua/plenary.nvim",
-  "rev": "253d34830709d690f013daf2853a9d21ad7accab",
-  "date": "2023-02-19T10:05:49+01:00",
-  "path": "/nix/store/dnzlin3gqpvd35a8c5g5hwg3fl28vxgs-plenary.nvim",
-  "sha256": "17vvl06jc5vrfrv7gljflkqykshhg84wnhbl9br4pm050ywlg4ng",
+  "rev": "50012918b2fc8357b87cff2a7f7f0446e47da174",
+  "date": "2023-10-11T15:43:47+02:00",
+  "path": "/nix/store/jsgaq274w8pbl4pnmpii3izxafpl346g-plenary.nvim",
+  "sha256": "1sn7vpsbwpyndsjyxb4af8fvz4sfhlbavvw6jjsv3h18sdvkh7nd",
+  "hash": "sha256-zR44d9MowLG1lIbvrRaFTpO/HXKKrO6lbtZfvvTdx+o=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
   propagatedBuildInputs = [ lua luassert ];
@@ -2739,7 +2802,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-rapidjson = callPackage({ lua, buildLuarocksPackage, luaOlder, fetchgit }:
+rapidjson = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "rapidjson";
   version = "0.7.1-1";
@@ -2750,12 +2813,13 @@ buildLuarocksPackage {
   "date": "2021-04-09T19:59:20+08:00",
   "path": "/nix/store/65l71ph27pmipgrq8j4whg6n8h2avvs4-lua-rapidjson",
   "sha256": "1a6srvximxlh6gjkaj5y86d1kf06pc4gby2r6wpdw2pdac8k7xyb",
+  "hash": "sha256-y/czEVPtCt4uN1n49Qi7BrgZmkG+SDXlM5D2GvvO2qg=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -2767,44 +2831,21 @@ buildLuarocksPackage {
   };
 }) {};
 
-readline = callPackage({ buildLuarocksPackage, fetchurl, luaAtLeast, luaOlder, lua, luaposix }:
-buildLuarocksPackage {
-  pname = "readline";
-  version = "3.2-0";
-  knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/readline-3.2-0.rockspec";
-    sha256 = "1r0sgisxm4xd1r6i053iibxh30j7j3rcj4wwkd8rzkj8nln20z24";
-  }).outPath;
-  src = fetchurl {
-    url    = "http://www.pjb.com.au/comp/lua/readline-3.2.tar.gz";
-    sha256 = "1mk9algpsvyqwhnq7jlw4cgmfzj30l7n2r6ak4qxgdxgc39f48k4";
-  };
-
-  disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
-  propagatedBuildInputs = [ lua luaposix ];
-
-  meta = {
-    homepage = "http://pjb.com.au/comp/lua/readline.html";
-    description = "Interface to the readline library";
-    license.fullName = "MIT/X11";
-  };
-}) {};
-
-rest-nvim = callPackage({ lua, luaAtLeast, buildLuarocksPackage, luaOlder, fetchzip, plenary-nvim }:
+rest-nvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "rest.nvim";
-  version = "0.1-2";
+  version = "0.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rest.nvim-0.1-2.rockspec";
-    sha256 = "0l8k91483nz75ijgnyfb8r7mynsaps7ikvjkziimf62bv7aks3qh";
+    url    = "mirror://luarocks/rest.nvim-0.2-1.rockspec";
+    sha256 = "1yq8gx585c10j8kybp20swyv9q0i3lm5k0rrv4bgsbwz3ychn0k1";
   }).outPath;
   src = fetchzip {
-    url    = "http://github.com/rest-nvim/rest.nvim/archive/0.1.zip";
-    sha256 = "0yf1a1cjrrzw0wmjgg48g3qn9kfxn7hv38yx88l1sc1r1nsfijrq";
+    url    = "https://github.com/rest-nvim/rest.nvim/archive/0.2.zip";
+    sha256 = "0ycjrrl37z465p71bdkas3q2ky1jmgr2cjnirnskdc6wz14wl09g";
   };
 
-  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
-  propagatedBuildInputs = [ lua plenary-nvim ];
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
 
   meta = {
     homepage = "https://github.com/rest-nvim/rest.nvim";
@@ -2814,23 +2855,24 @@ buildLuarocksPackage {
   };
 }) {};
 
-say = callPackage({ luaOlder, fetchgit, lua, buildLuarocksPackage }:
+say = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "say";
   version = "scm-1";
 
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/lunarmodules/say.git",
-  "rev": "45a3057e68c52b34ab59ef167efeb2340e356661",
-  "date": "2022-08-27T11:00:01+03:00",
-  "path": "/nix/store/324ryi5hlaisnyp4wpd1hvzcfv508i4s-say",
-  "sha256": "178pdsswwnja2f106701xmdxsdijjl5smm28dhhdcmjyb4mn8cr2",
+  "rev": "3e1f783d0aa496eb21d16e85b2235335cb9332df",
+  "date": "2023-08-13T02:37:27+03:00",
+  "path": "/nix/store/5biavac0k8z0xg4rr3bm8z3kdi8mm8c0-say",
+  "sha256": "04dkf0av6n71vmz0h86i5brklvaf9p91lkldn1xldpdr0qqs0x63",
+  "hash": "sha256-w3SgMQa53UZ7sI1OGtJNTm068yrRIAh+3eFYsxVwsxE=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -2842,7 +2884,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-serpent = callPackage({ fetchgit, luaAtLeast, lua, buildLuarocksPackage, luaOlder }:
+serpent = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "serpent";
   version = "0.30-2";
@@ -2856,12 +2898,13 @@ buildLuarocksPackage {
   "date": "2017-09-01T21:35:14-07:00",
   "path": "/nix/store/z6df44n3p07n4bia7s514vgngbkbpnap-serpent",
   "sha256": "0q80yfrgqgr01qprf0hrp284ngb7fbcq1v9rbzmdkhbm9lpgy8v8",
+  "hash": "sha256-aCP/Lk11wdnqXzntgNlyZz1LkLgZApcvDiA//LLzAGE=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
@@ -2874,7 +2917,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-sqlite = callPackage({ fetchgit, buildLuarocksPackage, luv }:
+sqlite = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, luv }:
 buildLuarocksPackage {
   pname = "sqlite";
   version = "v1.2.2-0";
@@ -2888,12 +2931,13 @@ buildLuarocksPackage {
   "date": "2022-06-17T15:57:13+03:00",
   "path": "/nix/store/637s46bsvsxfnzmy6ygig3y0vqmf3r8p-sqlite.lua",
   "sha256": "0ckifx6xxrannn9szacgiiqjsp4rswghxscdl3s411dhas8djj1m",
+  "hash": "sha256-NUjZkFawhUD0oI3pDh/XmVwtcYyPqa+TtVbl3k13cTI=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ luv ];
 
@@ -2904,7 +2948,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-std-_debug = callPackage({ buildLuarocksPackage, lua, luaOlder, fetchgit, luaAtLeast }:
+std-_debug = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "std._debug";
   version = "git-1";
@@ -2915,12 +2959,13 @@ buildLuarocksPackage {
   "date": "2023-01-31T16:39:35-07:00",
   "path": "/nix/store/i24iz2hvnjp18iz9z8kljsy9iv17m2zl-_debug",
   "sha256": "07z5lz3gy8wzzks79r3v68vckj42i3sybhfmqx7h2s58ld2kn5fd",
+  "hash": "sha256-zRU7RaOoaAFPx9XB5fWIgsjJNjJ75HT0/J8j/8an5R8=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua ];
@@ -2932,23 +2977,18 @@ buildLuarocksPackage {
   };
 }) {};
 
-std-normalize = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, std-_debug, luaOlder }:
+std-normalize = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder, std-_debug }:
 buildLuarocksPackage {
   pname = "std.normalize";
-  version = "git-1";
-
-  src = fetchgit ( removeAttrs (builtins.fromJSON ''{
-  "url": "https://github.com/lua-stdlib/normalize.git",
-  "rev": "ccc697998af22d9d7f675e73f4b27c7a52151b5c",
-  "date": "2022-01-02T16:33:35-08:00",
-  "path": "/nix/store/nvyy1ibp43pzaldj6ark02ypqr45wmy1-normalize",
-  "sha256": "1m6x4lp7xzghvagbqjljyqfcpilh76j25b71da6jd304xc9r0ngy",
-  "fetchLFS": false,
-  "fetchSubmodules": true,
-  "deepClone": false,
-  "leaveDotGit": false
-}
- '') ["date" "path"]) ;
+  version = "2.0.3-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/std.normalize-2.0.3-1.rockspec";
+    sha256 = "1l83ikiaw4dch2r69cxpl93b9d4wf54vbjb6fcggnkxxgm0amj3a";
+  }).outPath;
+  src = fetchzip {
+    url    = "http://github.com/lua-stdlib/normalize/archive/v2.0.3.zip";
+    sha256 = "1gyywglxd2y7ck3hk8ap73w0x7hf9irpg6vgs8yc6k9k4c5g3fgi";
+  };
 
   disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
   propagatedBuildInputs = [ lua std-_debug ];
@@ -2960,7 +3000,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-stdlib = callPackage({ buildLuarocksPackage, luaAtLeast, fetchzip, lua, luaOlder }:
+stdlib = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "stdlib";
   version = "41.2.2-1";
@@ -2984,7 +3024,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-teal-language-server = callPackage({ luafilesystem, buildLuarocksPackage, dkjson, cyan, fetchgit }:
+teal-language-server = callPackage({ buildLuarocksPackage, cyan, dkjson, fetchgit, fetchurl, luafilesystem }:
 buildLuarocksPackage {
   pname = "teal-language-server";
   version = "dev-1";
@@ -2998,12 +3038,13 @@ buildLuarocksPackage {
   "date": "2022-12-21T20:33:53-06:00",
   "path": "/nix/store/qyaz38njm8qgyfxca6m6f8i4lkfcfdb0-teal-language-server",
   "sha256": "12nqarykmdvxxci9l6gq2yhn4pjzzqlxyrl2c8svb97hka68wjvx",
+  "hash": "sha256-fUuOjJrwpLU1YoJm3yn+X15ioRf4GZoi6323On1W2Io=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ cyan dkjson luafilesystem ];
 
@@ -3014,17 +3055,17 @@ buildLuarocksPackage {
   };
 }) {};
 
-telescope-manix = callPackage({ telescope-nvim, buildLuarocksPackage, lua, fetchzip, luaOlder }:
+telescope-manix = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, lua, luaOlder, telescope-nvim }:
 buildLuarocksPackage {
   pname = "telescope-manix";
-  version = "0.4.0-1";
+  version = "0.5.0-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/telescope-manix-0.4.0-1.rockspec";
-    sha256 = "1kh3dn4aixydxrq01sbl40v7if8bmpsvv30qf7vig7dvl21aqkrp";
+    url    = "mirror://luarocks/telescope-manix-0.5.0-1.rockspec";
+    sha256 = "0i5q9sr0vn0w6yqg530jx2fx52k9jr7rss4ibl49f1x3wv6sckv1";
   }).outPath;
   src = fetchzip {
-    url    = "https://github.com/mrcjkb/telescope-manix/archive/0.4.0.zip";
-    sha256 = "153fqnk8iymyq309kpfiz3xmlqryj02rji3z7air23bgyjkx0gr8";
+    url    = "https://github.com/mrcjkb/telescope-manix/archive/0.5.0.zip";
+    sha256 = "093vkh822ycnc1pri3zmzzqnz235xxam3z1l67zyyqlc1apbarax";
   };
 
   disabled = (luaOlder "5.1");
@@ -3037,7 +3078,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-telescope-nvim = callPackage({ plenary-nvim, buildLuarocksPackage, lua, fetchgit }:
+telescope-nvim = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, plenary-nvim }:
 buildLuarocksPackage {
   pname = "telescope.nvim";
   version = "scm-1";
@@ -3047,16 +3088,17 @@ buildLuarocksPackage {
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/nvim-telescope/telescope.nvim",
-  "rev": "a3f17d3baf70df58b9d3544ea30abe52a7a832c2",
-  "date": "2023-02-26T13:26:12+01:00",
-  "path": "/nix/store/qyzs7im9nqn04h9w9nii4nv12ysgk1fk-telescope.nvim",
-  "sha256": "136pik53kwl2avjdakwfls10d85jqybl7yd0mbzxc5nry8krav22",
+  "rev": "74ce793a60759e3db0d265174f137fb627430355",
+  "date": "2023-10-11T12:29:23+02:00",
+  "path": "/nix/store/7k50qqgamc2ldxdf54jqs8sy8m8vcfzr-telescope.nvim",
+  "sha256": "1m4v097y8ypjm572k1qqii3z56w4x1dsjxd6gp0z24xqyvd4kpa4",
+  "hash": "sha256-RN1J2va4E/HBfaZ1qVvohJvyR4wYhylOqfJ65E8Cm9Q=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (lua.luaversion != "5.1");
   propagatedBuildInputs = [ lua plenary-nvim ];
@@ -3068,26 +3110,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-tl = callPackage({ compat53, luafilesystem, argparse, buildLuarocksPackage, fetchgit }:
+tl = callPackage({ argparse, buildLuarocksPackage, compat53, fetchgit, fetchurl, luafilesystem }:
 buildLuarocksPackage {
   pname = "tl";
-  version = "0.15.1-1";
+  version = "0.15.2-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/tl-0.15.1-1.rockspec";
-    sha256 = "0f9wr91pxcvx43jp9ma4yb6f0r9yrc2fm437nx7xm0dyh7kac9p6";
+    url    = "mirror://luarocks/tl-0.15.2-1.rockspec";
+    sha256 = "1qisdflgikry0jdqvnzdcqib2svbafp10n0gfwm3fcrzqsdxy0xr";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/teal-language/tl",
-  "rev": "a10fb2c69827c1b0f8e1b8a5c848a06d6da5d3be",
-  "date": "2023-01-23T18:14:26-03:00",
-  "path": "/nix/store/x5p9v443g53sz2c8rvxa465gzfiv47wb-tl",
-  "sha256": "0hql1274wxji54cadalv4j3k82vd9xasvi119cdnm16mh85ir70s",
+  "rev": "d2fc36b5ff9a52d7265e63eb74cce70fd1cdbcb2",
+  "date": "2023-04-27T11:28:21-03:00",
+  "path": "/nix/store/ramhj3a29lrn0bblbgyxn4712a7caq8k-tl",
+  "sha256": "1dgldi9pgg23iz3xis4i43bnvkwirh7kkycmr5xp75s2cc85zhg0",
+  "hash": "sha256-4MFfEGNCl3N7yZX5OQ/Mkc9t1yCR6NjHj0O8d1Ns9LU=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ argparse compat53 luafilesystem ];
 
@@ -3099,7 +3142,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-toml = callPackage({ lua, fetchgit, luaOlder, buildLuarocksPackage }:
+toml = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "toml";
   version = "0.3.0-0";
@@ -3113,12 +3156,13 @@ buildLuarocksPackage {
   "date": "2023-02-19T23:00:49-05:00",
   "path": "/nix/store/p6a98sqp9a4jwsw6ghqcwpn9lxmhvkdg-toml.lua",
   "sha256": "05p33bq0ajl41vbsw9bx73shpf0p11n5gb6yy8asvp93zh2m51hq",
+  "hash": "sha256-GIZSBfwj3a0V8t6sV2wIF7gL9Th9Ja7XDoRKBfAa4xY=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -3131,7 +3175,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-toml-edit = callPackage({ luaOlder, luarocks-build-rust-mlua, buildLuarocksPackage, lua, fetchgit }:
+toml-edit = callPackage({ buildLuarocksPackage, fetchgit, fetchurl, lua, luaOlder, luarocks-build-rust-mlua }:
 buildLuarocksPackage {
   pname = "toml-edit";
   version = "0.1.4-1";
@@ -3145,12 +3189,13 @@ buildLuarocksPackage {
   "date": "2023-10-02T16:54:10+02:00",
   "path": "/nix/store/p1368agmqg4jwb1qvf2iff3fdrq9vkdj-toml-edit.lua",
   "sha256": "1aa8znjnmm84392gnl7w0hm069xfv7niym3i8my7kyk0vdgxja06",
+  "hash": "sha256-BijZX9tg+nl8RXFUH+3ZricDKgT8UPtEGgTVaqX9SKk=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua luarocks-build-rust-mlua ];
@@ -3163,7 +3208,7 @@ buildLuarocksPackage {
   };
 }) {};
 
-vstruct = callPackage({ fetchgit, lua, buildLuarocksPackage, luaOlder }:
+vstruct = callPackage({ buildLuarocksPackage, fetchgit, lua, luaOlder }:
 buildLuarocksPackage {
   pname = "vstruct";
   version = "2.1.1-1";
@@ -3174,12 +3219,13 @@ buildLuarocksPackage {
   "date": "2020-05-06T23:13:06-04:00",
   "path": "/nix/store/a4i9k5hx9xiz38bij4hb505dg088jkss-vstruct",
   "sha256": "0sl9v874mckhh6jbxsan48s5xajzx193k4qlphw69sdbf8kr3p57",
+  "hash": "sha256-p9yRJ3Kr6WQ4vBSTOVLoX6peNCJW6b6kgXCySg7aiWo=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   disabled = (luaOlder "5.1");
   propagatedBuildInputs = [ lua ];
@@ -3190,26 +3236,27 @@ buildLuarocksPackage {
   };
 }) {};
 
-vusted = callPackage({ buildLuarocksPackage, fetchgit, busted }:
+vusted = callPackage({ buildLuarocksPackage, busted, fetchgit, fetchurl }:
 buildLuarocksPackage {
   pname = "vusted";
-  version = "2.2.0-1";
+  version = "2.3.1-1";
   knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/vusted-2.2.0-1.rockspec";
-    sha256 = "1ri96pdwhck1sbdnkqj9ksv9hs86pv8v2f6vl25696v9snp9jkzs";
+    url    = "mirror://luarocks/vusted-2.3.1-1.rockspec";
+    sha256 = "03h7l12xk43rql9vxb5nzfimx9srwaazx2r3j2zm1ba2qz06h0qc";
   }).outPath;
   src = fetchgit ( removeAttrs (builtins.fromJSON ''{
   "url": "https://github.com/notomo/vusted.git",
-  "rev": "f142170d3b802f6cedfcff67b945a260087ecf65",
-  "date": "2023-01-03T11:23:56+09:00",
-  "path": "/nix/store/la7h2a39wnjkdg1fzhkgw3hbrhs4c5kf-vusted",
-  "sha256": "17pdwaqjfkv2b7a801k5fdg2s0s75miiilfdjgmsyv7phighvkvw",
+  "rev": "2bc6818a756e47240d9284f1dfac21b011ca84ea",
+  "date": "2023-10-09T11:47:28+09:00",
+  "path": "/nix/store/jq2yl4adpnyilp3yyw161j1a29bwahqi-vusted",
+  "sha256": "04lxc78n3h1qhby6b4k9x8hb1c3sgqdid71fsvyg4y6j7rb55a8z",
+  "hash": "sha256-H6lSVj7SePL81i6cFht+erCwIOppkmX8gjjAYdFhnRI=",
   "fetchLFS": false,
   "fetchSubmodules": true,
   "deepClone": false,
   "leaveDotGit": false
 }
- '') ["date" "path"]) ;
+ '') ["date" "path" "sha256"]) ;
 
   propagatedBuildInputs = [ busted ];
 
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 62d4e066e50b..66e92b58f859 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -117,12 +117,6 @@ with prev;
       '';
   });
 
-  cyrussasl = prev.cyrussasl.overrideAttrs (drv: {
-    externalDeps = [
-      { name = "LIBSASL"; dep = cyrus_sasl; }
-    ];
-  });
-
   fennel = prev.fennel.overrideAttrs(oa: {
     nativeBuildInputs = oa.nativeBuildInputs ++ [
       installShellFiles
@@ -322,7 +316,7 @@ with prev;
     externalDeps = [
       { name = "EVENT"; dep = libevent; }
     ];
-    disabled = luaOlder "5.1" || luaAtLeast "5.4";
+    meta.broken = luaOlder "5.1" || luaAtLeast "5.4";
   });
 
   luaexpat = prev.luaexpat.overrideAttrs (_: {
@@ -386,6 +380,11 @@ with prev;
     ];
   });
 
+  # lua-resty-session =  prev.lua-resty-session.overrideAttrs (oa: {
+  #   # lua_pack and lua-ffi-zlib are unpackaged, causing this package to not evaluate
+  #   meta.broken = true;
+  # });
+
   lua-yajl =  prev.lua-yajl.overrideAttrs (oa: {
     buildInputs = oa.buildInputs ++ [
       yajl
@@ -514,8 +513,21 @@ with prev;
     '';
   });
 
-  readline = prev.readline.overrideAttrs (oa: {
-    propagatedBuildInputs = oa.propagatedBuildInputs ++ [ readline.out ];
+  readline = final.callPackage({ buildLuarocksPackage, fetchurl, luaAtLeast, luaOlder, lua, luaposix }:
+  buildLuarocksPackage ({
+    pname = "readline";
+    version = "3.2-0";
+    knownRockspec = (fetchurl {
+      url    = "mirror://luarocks/readline-3.2-0.rockspec";
+      sha256 = "1r0sgisxm4xd1r6i053iibxh30j7j3rcj4wwkd8rzkj8nln20z24";
+    }).outPath;
+    src = fetchurl {
+      # the rockspec url doesn't work because 'www.' is not covered by the certificate so
+      # I manually removed the 'www' prefix here
+      url    = "http://pjb.com.au/comp/lua/readline-3.2.tar.gz";
+      sha256 = "1mk9algpsvyqwhnq7jlw4cgmfzj30l7n2r6ak4qxgdxgc39f48k4";
+    };
+
     extraVariables = rec {
       READLINE_INCDIR = "${readline.dev}/include";
       HISTORY_INCDIR = READLINE_INCDIR;
@@ -524,9 +536,19 @@ with prev;
       unzip "$curSrc"
       tar xf *.tar.gz
     '';
-    # Without this, source root is wrongly set to ./readline-2.6/doc
-    sourceRoot = "readline-${lib.versions.majorMinor oa.version}";
-  });
+
+    disabled = (luaOlder "5.1") || (luaAtLeast "5.5");
+    propagatedBuildInputs = [ lua luaposix
+      readline.out
+    ];
+
+    meta = {
+      homepage = "http://pjb.com.au/comp/lua/readline.html";
+      description = "Interface to the readline library";
+      license.fullName = "MIT/X11";
+    };
+  })) {};
+
 
   sqlite = prev.sqlite.overrideAttrs (drv: {
 
diff --git a/pkgs/development/perl-modules/generic/builder.sh b/pkgs/development/perl-modules/generic/builder.sh
index 110094ad8a49..4da9f7a98212 100644
--- a/pkgs/development/perl-modules/generic/builder.sh
+++ b/pkgs/development/perl-modules/generic/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 PERL5LIB="$PERL5LIB${PERL5LIB:+:}$out/lib/perl5/site_perl"
diff --git a/pkgs/development/python-modules/boto3/default.nix b/pkgs/development/python-modules/boto3/default.nix
index e6ac07612c40..779871db10ed 100644
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "boto3";
-  version = "1.28.9"; # N.B: if you change this, change botocore and awscli to a matching version
+  version = "1.28.57"; # N.B: if you change this, change botocore and awscli to a matching version
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "boto";
     repo = pname;
     rev = version;
-    hash = "sha256-NkNHA20yn1Q7uoq/EL1Wn8F1fpi1waQujutGIKsnxlI=";
+    hash = "sha256-+kuILCUK10tvpfTEAHZGvKKmpw6Pgn+v2kQkwCkPMKg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 3dac327a48be..ddb9d35d05fd 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "botocore";
-  version = "1.31.48"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.31.57"; # N.B: if you change this, change boto3 and awscli to a matching version
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-btFvZqpu1gcP7SbWl2TLFMd1nkzAscGRKDzEiwXWXek=";
+    hash = "sha256-MBQ2F0Y1vsc5siW4QPw2XKAOXBpj5bKhnuZ50gTgG3g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/markdown-macros/default.nix b/pkgs/development/python-modules/markdown-macros/default.nix
index e95cbe3c4c10..e0e41bf3d0a0 100644
--- a/pkgs/development/python-modules/markdown-macros/default.nix
+++ b/pkgs/development/python-modules/markdown-macros/default.nix
@@ -16,8 +16,10 @@ buildPythonPackage rec {
 
   patches = [
     # Fixes a bug with markdown>2.4
+    # https://github.com/wnielson/markdown-macros/pull/1
     (fetchpatch {
-      url = "https://github.com/wnielson/markdown-macros/pull/1.patch";
+      name = "wnielson-markdown-macros-pull-1.patch";
+      url = "https://github.com/wnielson/markdown-macros/commit/e38cba9acb6789cc128f6fe9ca427ba71815a20f.patch";
       sha256 = "17njbgq2srzkf03ar6yn92frnsbda3g45cdi529fdh0x8mmyxci0";
     })
   ];
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index ebfcdd8d5574..3b5dffb42cf0 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -12,7 +12,7 @@
 
 import ./generic.nix (rec {
   pname = "pillow";
-  version = "10.0.1";
+  version = "10.1.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ import ./generic.nix (rec {
   src = fetchPypi {
     pname = "Pillow";
     inherit version;
-    hash = "sha256-1ylnsGvpMA/tXPvItbr87sSL983H2rZrHSVJA1KHGR0=";
+    hash = "sha256-5r+N5sNu2WyG6jtuHVJzxT9G71GKBiRkzX713Sz5Ljg=";
   };
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/protobuf/3.nix b/pkgs/development/python-modules/protobuf/3.nix
new file mode 100644
index 000000000000..d9e3cce5f918
--- /dev/null
+++ b/pkgs/development/python-modules/protobuf/3.nix
@@ -0,0 +1,90 @@
+{ buildPackages
+, buildPythonPackage
+, fetchpatch
+, isPyPy
+, lib
+, protobuf
+, pytestCheckHook
+, pythonAtLeast
+, tzdata
+}:
+
+assert lib.versionAtLeast protobuf.version "3.21" -> throw "Protobuf 3.20 or older required";
+
+buildPythonPackage {
+  inherit (protobuf) pname src;
+
+  version = protobuf.version;
+
+  sourceRoot = "${protobuf.src.name}/python";
+
+  patches = lib.optionals (pythonAtLeast "3.11") [
+    (fetchpatch {
+      name = "support-python311.patch";
+      url = "https://github.com/protocolbuffers/protobuf/commit/2206b63c4649cf2e8a06b66c9191c8ef862ca519.diff";
+      stripLen = 1; # because sourceRoot above
+      hash = "sha256-3GaoEyZIhS3QONq8LEvJCH5TdO9PKnOgcQF0GlEiwFo=";
+    })
+  ];
+
+  prePatch = ''
+    if [[ "$(<../version.json)" != *'"python": "'"$version"'"'* ]]; then
+      echo "Python library version mismatch. Derivation version: $version, actual: $(<../version.json)"
+      exit 1
+    fi
+  '';
+
+  # Remove the line in setup.py that forces compiling with C++14. Upstream's
+  # CMake build has been updated to support compiling with other versions of
+  # C++, but the Python build has not. Without this, we observe compile-time
+  # errors using GCC.
+  #
+  # Fedora appears to do the same, per this comment:
+  #
+  #   https://github.com/protocolbuffers/protobuf/issues/12104#issuecomment-1542543967
+  #
+  postPatch = ''
+    sed -i "/extra_compile_args.append('-std=c++14')/d" setup.py
+  '';
+
+  nativeBuildInputs = lib.optional isPyPy tzdata;
+
+  buildInputs = [ protobuf ];
+
+  propagatedNativeBuildInputs = [
+    # For protoc of the same version.
+    buildPackages."protobuf${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}"
+  ];
+
+  setupPyGlobalFlags = [ "--cpp_implementation" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = lib.optionals isPyPy [
+    # error message differs
+    "testInvalidTimestamp"
+    # requires tracemalloc which pypy does not implement
+    # https://foss.heptapod.net/pypy/pypy/-/issues/3048
+    "testUnknownFieldsNoMemoryLeak"
+    # assertion is not raised for some reason
+    "testStrictUtf8Check"
+  ];
+
+  pythonImportsCheck = [
+    "google.protobuf"
+    "google.protobuf.internal._api_implementation" # Verify that --cpp_implementation worked
+  ];
+
+  passthru = {
+    inherit protobuf;
+  };
+
+  meta = with lib; {
+    description = "Protocol Buffers are Google's data interchange format";
+    homepage = "https://developers.google.com/protocol-buffers/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ knedlsepp ];
+  };
+}
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index 2676dc90d68b..3a42754de778 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -11,30 +11,28 @@
 , tzdata
 }:
 
+assert lib.versionOlder protobuf.version "21" -> throw "Protobuf 21 or newer required";
+
 let
-  versionMajor = lib.versions.major protobuf.version;
-  versionMinor = lib.versions.minor protobuf.version;
-  versionPatch = lib.versions.patch protobuf.version;
+  protobufVersionMajor = lib.versions.major protobuf.version;
+  protobufVersionMinor = lib.versions.minor protobuf.version;
 in
 buildPythonPackage {
   inherit (protobuf) pname src;
 
-  # protobuf 3.21 corresponds with its python library 4.21
-  version =
-    if lib.versionAtLeast protobuf.version "3.21"
-    then "${toString (lib.toInt versionMajor + 1)}.${versionMinor}.${versionPatch}"
-    else protobuf.version;
+  # protobuf 21 corresponds with its python library 4.21
+  version = "4.${protobufVersionMajor}.${protobufVersionMinor}";
 
   sourceRoot = "${protobuf.src.name}/python";
 
-  patches = lib.optionals (lib.versionAtLeast protobuf.version "3.22") [
+  patches = lib.optionals (lib.versionAtLeast protobuf.version "22") [
     # Replace the vendored abseil-cpp with nixpkgs'
     (substituteAll {
       src = ./use-nixpkgs-abseil-cpp.patch;
       abseil_cpp_include_path = "${lib.getDev protobuf.abseil-cpp}/include";
     })
   ]
-  ++ lib.optionals (pythonAtLeast "3.11" && lib.versionOlder protobuf.version "3.22") [
+  ++ lib.optionals (pythonAtLeast "3.11" && lib.versionOlder protobuf.version "22") [
     (fetchpatch {
       name = "support-python311.patch";
       url = "https://github.com/protocolbuffers/protobuf/commit/2206b63c4649cf2e8a06b66c9191c8ef862ca519.diff";
@@ -69,14 +67,14 @@ buildPythonPackage {
 
   propagatedNativeBuildInputs = [
     # For protoc of the same version.
-    buildPackages."protobuf${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}"
+    buildPackages."protobuf_${protobufVersionMajor}"
   ];
 
   setupPyGlobalFlags = [ "--cpp_implementation" ];
 
   nativeCheckInputs = [
     pytestCheckHook
-  ] ++ lib.optionals (lib.versionAtLeast protobuf.version "3.22") [
+  ] ++ lib.optionals (lib.versionAtLeast protobuf.version "22") [
     numpy
   ];
 
@@ -90,7 +88,7 @@ buildPythonPackage {
     "testStrictUtf8Check"
   ];
 
-  disabledTestPaths = lib.optionals (lib.versionAtLeast protobuf.version "3.23") [
+  disabledTestPaths = lib.optionals (lib.versionAtLeast protobuf.version "23") [
     # The following commit (I think) added some internal test logic for Google
     # that broke generator_test.py. There is a new proto file that setup.py is
     # not generating into a .py file. However, adding this breaks a bunch of
diff --git a/pkgs/development/python-modules/psycopg2/default.nix b/pkgs/development/python-modules/psycopg2/default.nix
index bfe33e1ec3ad..43a06e5a9e4d 100644
--- a/pkgs/development/python-modules/psycopg2/default.nix
+++ b/pkgs/development/python-modules/psycopg2/default.nix
@@ -8,6 +8,7 @@
 , openssl
 , sphinxHook
 , sphinx-better-theme
+, buildPackages
 }:
 
 buildPythonPackage rec {
@@ -19,20 +20,29 @@ buildPythonPackage rec {
   # c.f. https://github.com/NixOS/nixpkgs/pull/104151#issuecomment-729750892
   disabled = pythonOlder "3.6" || isPyPy;
 
+  outputs = [ "out" "doc" ];
+
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-8AzDW9cRnx/tF7hb0QB4VRlN3iy9jeAauOuxdIdECtg=";
   };
 
-  outputs = [ "out" "doc" ];
+  postPatch = ''
+    # Preferably upstream would not depend on pg_config because config scripts are incompatible with cross-compilation, however postgresql's pc file is lacking information.
+    # some linker flags are added but the linker ignores them because they're incompatible
+    # https://github.com/psycopg/psycopg2/blob/89005ac5b849c6428c05660b23c5a266c96e677d/setup.py
+    substituteInPlace setup.py \
+      --replace "self.pg_config_exe = self.build_ext.pg_config" 'self.pg_config_exe = "${lib.getExe' buildPackages.postgresql "pg_config"}"'
+  '';
 
   nativeBuildInputs = [
-    postgresql
     sphinxHook
     sphinx-better-theme
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [
+  buildInputs = [
+    postgresql
+  ] ++ lib.optionals stdenv.isDarwin [
     openssl
   ];
 
@@ -45,6 +55,8 @@ buildPythonPackage rec {
     "psycopg2"
   ];
 
+  disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ buildPackages.postgresql ];
+
   meta = with lib; {
     description = "PostgreSQL database adapter for the Python programming language";
     homepage = "https://www.psycopg.org";
diff --git a/pkgs/development/python-modules/pybind11/default.nix b/pkgs/development/python-modules/pybind11/default.nix
index fe29cde9e522..d17bc80c8095 100644
--- a/pkgs/development/python-modules/pybind11/default.nix
+++ b/pkgs/development/python-modules/pybind11/default.nix
@@ -12,6 +12,7 @@
 , pytestCheckHook
 , libxcrypt
 , makeSetupHook
+, darwin
 }: let
   setupHook = makeSetupHook {
     name = "pybind11-setup-hook";
@@ -22,6 +23,19 @@
       pythonSitePackages = "${python}/${python.sitePackages}";
     };
   } ./setup-hook.sh;
+
+  # clang 16 defaults to C++17, which results in the use of aligned allocations by pybind11.
+  # libc++ supports aligned allocations via `posix_memalign`, which is available since 10.6,
+  # but clang has a check hard-coded requiring 10.13 because that’s when Apple first shipped a
+  # support for C++17 aligned allocations on macOS.
+  # Tell clang we’re targeting 10.13 on x86_64-darwin while continuing to use the default SDK.
+  stdenv' = if stdenv.isDarwin && stdenv.isx86_64
+    then python.stdenv.override (oldStdenv: {
+      buildPlatform = oldStdenv.buildPlatform // { darwinMinVersion = "10.13"; };
+      targetPlatform = oldStdenv.targetPlatform // { darwinMinVersion = "10.13"; };
+      hostPlatform = oldStdenv.hostPlatform // { darwinMinVersion = "10.13"; };
+    })
+    else python.stdenv;
 in buildPythonPackage rec {
   pname = "pybind11";
   version = "2.11.1";
@@ -41,6 +55,8 @@ in buildPythonPackage rec {
   buildInputs = lib.optionals (pythonOlder "3.9") [ libxcrypt ];
   propagatedBuildInputs = [ setupHook ];
 
+  stdenv = stdenv';
+
   dontUseCmakeBuildDir = true;
 
   # Don't build tests if not needed, read the doInstallCheck value at runtime
diff --git a/pkgs/development/python-modules/pympler/default.nix b/pkgs/development/python-modules/pympler/default.nix
index 9b801e42c8a9..463de728aea2 100644
--- a/pkgs/development/python-modules/pympler/default.nix
+++ b/pkgs/development/python-modules/pympler/default.nix
@@ -19,9 +19,10 @@ buildPythonPackage rec {
   patches = [
     # Fixes a TypeError on Python 3.11
     # (see https://github.com/pympler/pympler/issues/148)
+    # https://github.com/pympler/pympler/pull/149
     (fetchpatch {
       name = "${pname}-python-3.11-compat.patch";
-      url = "https://github.com/pympler/pympler/pull/149.patch";
+      url = "https://github.com/pympler/pympler/commit/0fd8ad8da39207bd0dcb28bdac0407e04744c965.patch";
       hash = "sha256-6MK0AuhVhQkUzlk29HUh1+mSbfsVTBJ1YBtYNIFhh7U=";
     })
   ];
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index f640012d9a5e..80094a1a350d 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "rapidfuzz";
-  version = "3.3.1";
+  version = "3.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "RapidFuzz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-C+jQN0QXZzH0IKdC3O5uPNAEd+XSffi3nkwFSv2HqPY=";
+    hash = "sha256-JgTmhnKVzv9m8//GMQjvCFPNJQM/7dalCD5bk6fWBPc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rocket-errbot/default.nix b/pkgs/development/python-modules/rocket-errbot/default.nix
index 29970e7fd281..65b7c62b9e34 100644
--- a/pkgs/development/python-modules/rocket-errbot/default.nix
+++ b/pkgs/development/python-modules/rocket-errbot/default.nix
@@ -11,7 +11,9 @@ buildPythonPackage rec {
 
   # remove with 1.2.6
   patches = [ (fetchpatch {
-    url = "https://github.com/errbotio/rocket/pull/1.patch";
+    # https://github.com/errbotio/rocket/pull/1
+    name = "errbotio-rocket-pull-1.patch";
+    url = "https://github.com/errbotio/rocket/compare/f1a52fe17164f83bccce5e6a1935fc5071c2265f...d69adcd49de5d78bd80f952a2ee31e6a0bac4e3d.patch";
     sha256 = "1s668yv5b86b78vbqwhcl44k2l16c9bhk3199yy9hayf0vkxnwif";
   }) ];
 
diff --git a/pkgs/development/python-modules/s3transfer/default.nix b/pkgs/development/python-modules/s3transfer/default.nix
index 361764818605..748b6abecf45 100644
--- a/pkgs/development/python-modules/s3transfer/default.nix
+++ b/pkgs/development/python-modules/s3transfer/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "s3transfer";
-  version = "0.6.2";
+  version = "0.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "boto";
     repo = pname;
     rev = version;
-    hash = "sha256-hoHNblnCSZteHmI5sJN72WrX7tveNFZqmL1jFKQmdag=";
+    hash = "sha256-EvLqRvm9E1Taf+JvbhQbfJqIlbu2a+rB2MX0IO90x98=";
   };
 
   propagatedBuildInputs = [ botocore ];
@@ -39,6 +39,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for managing Amazon S3 transfers";
     homepage = "https://github.com/boto/s3transfer";
+    changelog = "https://github.com/boto/s3transfer/blob/${version}/CHANGELOG.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ nickcao ];
   };
diff --git a/pkgs/development/python-modules/sqlalchemy-migrate/default.nix b/pkgs/development/python-modules/sqlalchemy-migrate/default.nix
index ecfa57be2e30..c71172764af7 100644
--- a/pkgs/development/python-modules/sqlalchemy-migrate/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-migrate/default.nix
@@ -26,8 +26,9 @@ buildPythonPackage rec {
 
   patches = [
     # See: https://review.openstack.org/#/c/608382/
+    # https://github.com/openstack/sqlalchemy-migrate/pull/18
     (fetchpatch {
-      url = "https://github.com/openstack/sqlalchemy-migrate/pull/18.patch";
+      url = "https://github.com/openstack/sqlalchemy-migrate/commit/a5d69a17d9354ec1a792493280f96484740cf7ff.patch";
       sha256 = "1qyfq2m7w7xqf0r9bc2x42qcra4r9k9l9g1jy5j0fvlb6bvvjj07";
     })
     ./python3.11-comp.diff
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 95e357cabda9..c69779186e7e 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -40,7 +40,7 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "2.0.21";
+  version = "2.0.22";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     owner = "sqlalchemy";
     repo = "sqlalchemy";
     rev = "refs/tags/rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-ldBn+pdZfqnBKdYkOcG47ScH/hBgeJBeIvn1hCIBw/A=";
+    hash = "sha256-HyT8wFsUukg1fnTREa0Rv1+dFb21e4Os42l09Zox/SY=";
   };
 
   nativeBuildInputs =[
diff --git a/pkgs/development/python-modules/udatetime/default.nix b/pkgs/development/python-modules/udatetime/default.nix
index 49b56c5f1e30..17011e1b9073 100644
--- a/pkgs/development/python-modules/udatetime/default.nix
+++ b/pkgs/development/python-modules/udatetime/default.nix
@@ -15,9 +15,11 @@ buildPythonPackage rec {
 
   patches = [
     # fix build with python 3.9
+    # https://github.com/freach/udatetime/pull/33
     (fetchpatch {
-      url = "https://github.com/freach/udatetime/pull/33.patch";
-      sha256 = "02wm7ivkv1viqn2wflgd10dgpddfqfrwacmrldigb1mwb79n554j";
+      name = "freach-udatetime-pull-33.patch";
+      url = "https://github.com/freach/udatetime/compare/75a07891426364f8bf0b44305b00bb1dd90534ae...2cfbc92cb274a80476a45c6c0d387c19e77a9f6e.patch";
+      sha256 = "pPskJnie+9H3qKqf8X37sxB+CH3lpkj7IYl8HfiuV/4=";
     })
   ];
 
diff --git a/pkgs/development/python-modules/uvloop/default.nix b/pkgs/development/python-modules/uvloop/default.nix
index 38283c71acd6..0dec3c2b814c 100644
--- a/pkgs/development/python-modules/uvloop/default.nix
+++ b/pkgs/development/python-modules/uvloop/default.nix
@@ -3,34 +3,42 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+
+# build-system
 , cython
+, setuptools
+
+# native dependencies
 , libuv
 , CoreServices
 , ApplicationServices
 
-# Check Inputs
+# tests
 , aiohttp
 , psutil
 , pyopenssl
-, pytest-forked
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "uvloop";
-  version = "0.17.0";
-  format = "setuptools";
+  version = "0.18.0";
+  pyproject = true;
+
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Dd9rr5zxGhoixxSH858Vss9461vefltF+7meip2RueE=";
+    hash = "sha256-1dETW+/+nNldA1DxnicWvDi+R9XfKW18xG47dVfA0f8=";
   };
 
   nativeBuildInputs = [
     cython
+    setuptools
   ];
 
+  env.LIBUV_CONFIGURE_HOST = stdenv.hostPlatform.config;
+
   buildInputs = [
     libuv
   ] ++ lib.optionals stdenv.isDarwin [
@@ -38,45 +46,26 @@ buildPythonPackage rec {
     ApplicationServices
   ];
 
-  dontUseSetuptoolsCheck = true;
   nativeCheckInputs = [
-    pytest-forked
+    aiohttp
+    pyopenssl
     pytestCheckHook
     psutil
-  ] ++ lib.optionals (pythonOlder "3.11") [
-    aiohttp
   ];
 
-  LIBUV_CONFIGURE_HOST = stdenv.hostPlatform.config;
-
   pytestFlagsArray = [
-    # from pytest.ini, these are NECESSARY to prevent failures
-    "--capture=no"
-    "--assert=plain"
-    "--strict"
-    "--tb=native"
-    # Depend on pyopenssl
-    "--deselect=tests/test_tcp.py::Test_UV_TCPSSL::test_flush_before_shutdown"
-    "--deselect=tests/test_tcp.py::Test_UV_TCPSSL::test_renegotiation"
-    # test gets stuck in epoll_pwait on hydras aarch64 builders
-    # https://github.com/MagicStack/uvloop/issues/412
-    "--deselect=tests/test_tcp.py::Test_AIO_TCPSSL::test_remote_shutdown_receives_trailing_data"
-    # Tries to import cythonized file for which the .pyx file is not shipped via PyPi
-    "--deselect=tests/test_libuv_api.py::Test_UV_libuv::test_libuv_get_loop_t_ptr"
-    # Tries to run "env", but fails to find it
+    # Tries to run "env", but fails to find it, even with coreutils provided
     "--deselect=tests/test_process.py::Test_UV_Process::test_process_env_2"
     "--deselect=tests/test_process.py::Test_AIO_Process::test_process_env_2"
     # AssertionError: b'' != b'out\n'
     "--deselect=tests/test_process.py::Test_UV_Process::test_process_streams_redirect"
     "--deselect=tests/test_process.py::Test_AIO_Process::test_process_streams_redirect"
-  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+  ] ++ lib.optionals (stdenv.isDarwin) [
     # Segmentation fault
     "--deselect=tests/test_fs_event.py::Test_UV_FS_EVENT_RENAME::test_fs_event_rename"
   ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
     # Broken: https://github.com/NixOS/nixpkgs/issues/160904
     "--deselect=tests/test_context.py::Test_UV_Context::test_create_ssl_server_manual_connection_lost"
-    # Segmentation fault
-    "--deselect=tests/test_fs_event.py::Test_UV_FS_EVENT_RENAME::test_fs_event_rename"
   ];
 
   disabledTestPaths = [
@@ -84,23 +73,13 @@ buildPythonPackage rec {
     "tests/test_sourcecode.py"
   ];
 
-  preCheck = lib.optionalString stdenv.isDarwin ''
+  preCheck = ''
+    # force using installed/compiled uvloop
+    rm -rf uvloop
+  '' + lib.optionalString stdenv.isDarwin ''
     # Work around "OSError: AF_UNIX path too long"
     # https://github.com/MagicStack/uvloop/issues/463
     export TMPDIR="/tmp"
-  '' + ''
-    # pyopenssl is not well supported by upstream
-    # https://github.com/NixOS/nixpkgs/issues/175875
-    substituteInPlace tests/test_tcp.py \
-      --replace "from OpenSSL import SSL as openssl_ssl" ""
-    # force using installed/compiled uvloop vs source by moving tests to temp dir
-    export TEST_DIR=$(mktemp -d)
-    cp -r tests $TEST_DIR
-    pushd $TEST_DIR
-  '';
-
-  postCheck = ''
-    popd
   '';
 
   pythonImportsCheck = [
@@ -112,6 +91,7 @@ buildPythonPackage rec {
   __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
+    changelog = "https://github.com/MagicStack/uvloop/releases/tag/v${version}";
     description = "Fast implementation of asyncio event loop on top of libuv";
     homepage = "https://github.com/MagicStack/uvloop";
     license = licenses.mit;
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index cb9075567274..632aa101b31d 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.4.20";
-  source.sha256 = "sha256-dEsrGVHaYTryr2hU98H54W3ZC0tmzZrxonqfRIx2G+4=";
+  version = "2.4.21";
+  source.sha256 = "sha256-AXrnGnsKMCTGFONEzQzFahbLNK/FOtoYmfs3nSZiTJE=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/tools/build-managers/boot/builder.sh b/pkgs/development/tools/build-managers/boot/builder.sh
index e007cbac9582..4506e3f0f861 100644
--- a/pkgs/development/tools/build-managers/boot/builder.sh
+++ b/pkgs/development/tools/build-managers/boot/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 boot_bin=$out/bin/boot
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 8758afea8211..f6002a7607c8 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -18,13 +18,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     rev = "refs/tags/${version}";
-    hash = "sha256-x2VN/6Kg/n6BW5S4nLKfG67dYrSR/G+Aowf6d2Vbc+0=";
+    hash = "sha256-SujnalAooIlzKZcjt0E4tSBO0J5QRkSE0X1PVpnbIF4=";
   };
 
   patches = [
@@ -75,6 +75,15 @@ python3.pkgs.buildPythonApplication rec {
         "docs/yaml/objects/dep.yaml"
       ];
     })
+
+    # Revert patch breaking mesa build on bindgen:
+    #   https://github.com/mesonbuild/meson/issues/12326
+    (fetchpatch {
+      name = "bindgen-flags-revert.patch";
+      url = "https://github.com/mesonbuild/meson/commit/d5546bdceaa2f3040d16a33fcbd824ba94b8cfde.patch";
+      hash = "sha256-qOSiWGkjfxJmUfXmqV05yl7wTgAIE0Z7qZqTko9f/LE=";
+      revert = true;
+    })
   ];
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/tools/build-managers/meson/setup-hook.sh b/pkgs/development/tools/build-managers/meson/setup-hook.sh
index 6305a405af21..21faac529c6d 100644
--- a/pkgs/development/tools/build-managers/meson/setup-hook.sh
+++ b/pkgs/development/tools/build-managers/meson/setup-hook.sh
@@ -28,14 +28,39 @@ mesonConfigurePhase() {
         echo "meson: enabled parallel building"
     fi
 
-    if ! [[ -v enableParallelInstalling ]]; then
-        enableParallelInstalling=1
-        echo "meson: enabled parallel installing"
+    if [[ ${checkPhase-ninjaCheckPhase} = ninjaCheckPhase && -z $dontUseMesonCheck ]]; then
+        checkPhase=mesonCheckPhase
+    fi
+    if [[ ${installPhase-ninjaInstallPhase} = ninjaInstallPhase && -z $dontUseMesonInstall ]]; then
+        installPhase=mesonInstallPhase
     fi
 
     runHook postConfigure
 }
 
+mesonCheckPhase() {
+    runHook preCheck
+
+    local flagsArray=($mesonCheckFlags "${mesonCheckFlagsArray[@]}")
+
+    echoCmd 'check flags' "${flagsArray[@]}"
+    meson test --no-rebuild "${flagsArray[@]}"
+
+    runHook postCheck
+}
+
+mesonInstallPhase() {
+    runHook preInstall
+
+    # shellcheck disable=SC2086
+    local flagsArray=($mesonInstallFlags "${mesonInstallFlagsArray[@]}")
+
+    echoCmd 'install flags' "${flagsArray[@]}"
+    meson install --no-rebuild "${flagsArray[@]}"
+
+    runHook postInstall
+}
+
 if [ -z "${dontUseMesonConfigure-}" -a -z "${configurePhase-}" ]; then
     setOutputFlags=
     configurePhase=mesonConfigurePhase
diff --git a/pkgs/development/tools/misc/automake/builder.sh b/pkgs/development/tools/misc/automake/builder.sh
index 0cb1d5d61e33..b08e7251e9e2 100644
--- a/pkgs/development/tools/misc/automake/builder.sh
+++ b/pkgs/development/tools/misc/automake/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 # Wrap the given `aclocal' program, appending extra `-I' flags
diff --git a/pkgs/development/tools/misc/indent/default.nix b/pkgs/development/tools/misc/indent/default.nix
index 0d4c272e414e..8e6ba9b70c04 100644
--- a/pkgs/development/tools/misc/indent/default.nix
+++ b/pkgs/development/tools/misc/indent/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   strictDeps = true;
   nativeBuildInputs = [ texinfo ];
   buildInputs = [ libintl ];
-  pkgsBuildBuild = [ buildPackages.stdenv.cc ]; # needed when cross-compiling
+  depsBuildBuild = [ buildPackages.stdenv.cc ]; # needed when cross-compiling
 
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optional stdenv.cc.isClang "-Wno-implicit-function-declaration"
diff --git a/pkgs/development/tools/misc/lttng-ust/default.nix b/pkgs/development/tools/misc/lttng-ust/default.nix
index 3bace16de56d..0c19b59c5c35 100644
--- a/pkgs/development/tools/misc/lttng-ust/default.nix
+++ b/pkgs/development/tools/misc/lttng-ust/default.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "2.13.1";
-  sha256 = "sha256-Vme/Amnh5i4tnLl0xFb/huBAG9eqO/yNX9uXIzJJ7dw=";
+  version = "2.13.6";
+  sha256 = "sha256-5+BFlt1zrHqpnifNAA+UnbsP7VG9KQmfmwiiXB3wztU=";
 }
diff --git a/pkgs/development/tools/misc/luarocks/luarocks-nix.nix b/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
index 941a582cead0..20acab5a8584 100644
--- a/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
+++ b/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
@@ -2,13 +2,13 @@
 
 luarocks.overrideAttrs (old: {
   pname = "luarocks-nix";
-  version = "unstable-2023-02-26";
+  version = "unstable-2023-10-19";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "luarocks-nix";
-    rev = "4cfea3d5d826db4cfbc809ef8bb5f0a9f3a18919";
-    sha256 = "sha256-7L8B+/C7Kzt25Ec+OsM2rliYB2/wyZQ3OT63V7AaOxo=";
+    rev = "4240b25b95d7165cde66fc2acaf5a0f9ad40fd0c";
+    sha256 = "sha256-dqFFYehBgK0RqH0/1GtZXq7XLGCcc3Kfadq8ICYNCWk=";
   };
 
   patches = [ ];
diff --git a/pkgs/development/tools/parsing/antlr/builder.sh b/pkgs/development/tools/parsing/antlr/builder.sh
index 55259b932124..c1d20845e6bf 100644
--- a/pkgs/development/tools/parsing/antlr/builder.sh
+++ b/pkgs/development/tools/parsing/antlr/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 tar zxvf $src
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index 4b66ecfa4674..37cec14ee4c4 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.2.3";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-hxtT5cL1PTXkTXGB0nVPhMI8Vlqrk4q2MHW0KGosFwc=";
+    hash = "sha256-MVmu9m+9XhWuPBEEoaYmsSbMFziSZaM5Gg5kOr1DT54=";
   };
 
-  cargoHash = "sha256-IZWh/Bp9TdB+flc1PXVkwrIdOr83TFk6X6O5M0FVaO4=";
+  cargoHash = "sha256-hrdrGFtL2vGczINnvDa4rclkXsNWnEqtTt3NVaRay8w=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security libiconv ];
 
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 8b615a55dd3a..b1bd0ae912d9 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -34,6 +34,7 @@ let
      */
   ]) (builtins.attrNames sharedLibDeps) ++ [
     "--with-intl=system-icu"
+    "--openssl-use-def-ca-store"
   ];
 
   copyLibHeaders =
@@ -52,6 +53,12 @@ let
 
     strictDeps = true;
 
+    env = lib.optionalAttrs (stdenv.isDarwin && stdenv.isx86_64) {
+      # Make sure libc++ uses `posix_memalign` instead of `aligned_alloc` on x86_64-darwin.
+      # Otherwise, nodejs would require the 11.0 SDK and macOS 10.15+.
+      NIX_CFLAGS_COMPILE = "-D__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__=101300";
+    };
+
     CC_host = "cc";
     CXX_host = "c++";
     depsBuildBuild = [ buildPackages.stdenv.cc openssl libuv zlib icu ];
diff --git a/pkgs/development/web/nodejs/v14.nix b/pkgs/development/web/nodejs/v14.nix
index e7dec1c12f66..c2d5d58bea78 100644
--- a/pkgs/development/web/nodejs/v14.nix
+++ b/pkgs/development/web/nodejs/v14.nix
@@ -1,8 +1,20 @@
-{ callPackage, python3, lib, stdenv, openssl, enableNpm ? true }:
+{ callPackage, lib, overrideCC, pkgs, buildPackages, openssl, python3, enableNpm ? true }:
 
 let
+  # Clang 16+ cannot build Node v14 due to -Wenum-constexpr-conversion errors.
+  # Use an older version of clang with the current libc++ for compatibility (e.g., with icu).
+  ensureCompatibleCC = packages:
+    if packages.stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion packages.stdenv.cc.cc) "16"
+      then overrideCC packages.llvmPackages_15.stdenv (packages.llvmPackages_15.stdenv.cc.override {
+        inherit (packages.llvmPackages) libcxx;
+        extraPackages = [ packages.llvmPackages.libcxxabi ];
+      })
+      else packages.stdenv;
+
   buildNodejs = callPackage ./nodejs.nix {
     inherit openssl;
+    stdenv = ensureCompatibleCC pkgs;
+    buildPackages = buildPackages // { stdenv = ensureCompatibleCC buildPackages; };
     python = python3;
   };
 in
@@ -10,5 +22,5 @@ in
     inherit enableNpm;
     version = "14.21.3";
     sha256 = "sha256-RY7AkuYK1wDdzwectj1DXBXaTHuz0/mbmo5YqZ5UB14=";
-    patches = lib.optional stdenv.isDarwin ./bypass-xcodebuild.diff;
+    patches = lib.optional pkgs.stdenv.isDarwin ./bypass-xcodebuild.diff;
   }
diff --git a/pkgs/development/web/nodejs/v16.nix b/pkgs/development/web/nodejs/v16.nix
index d4bb94c07d3e..930b648ca559 100644
--- a/pkgs/development/web/nodejs/v16.nix
+++ b/pkgs/development/web/nodejs/v16.nix
@@ -1,8 +1,20 @@
-{ callPackage, openssl, python3, fetchpatch, enableNpm ? true }:
+{ callPackage, lib, overrideCC, pkgs, buildPackages, openssl, python3, fetchpatch, enableNpm ? true }:
 
 let
+  # Clang 16+ cannot build Node v14 due to -Wenum-constexpr-conversion errors.
+  # Use an older version of clang with the current libc++ for compatibility (e.g., with icu).
+  ensureCompatibleCC = packages:
+    if packages.stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion packages.stdenv.cc.cc) "16"
+      then overrideCC packages.llvmPackages_15.stdenv (packages.llvmPackages_15.stdenv.cc.override {
+        inherit (packages.llvmPackages) libcxx;
+        extraPackages = [ packages.llvmPackages.libcxxabi ];
+      })
+      else packages.stdenv;
+
   buildNodejs = callPackage ./nodejs.nix {
     inherit openssl;
+    stdenv = ensureCompatibleCC pkgs;
+    buildPackages = buildPackages // { stdenv = ensureCompatibleCC buildPackages; };
     python = python3;
   };
 
diff --git a/pkgs/games/orthorobot/default.nix b/pkgs/games/orthorobot/default.nix
index 6ca70596458d..10bf3f9268e6 100644
--- a/pkgs/games/orthorobot/default.nix
+++ b/pkgs/games/orthorobot/default.nix
@@ -48,8 +48,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     # support for love11
+    # https://github.com/Stabyourself/orthorobot/pull/3
     (fetchpatch {
-      url = "https://github.com/Stabyourself/orthorobot/pull/3.patch";
+      name = "Stabyourself-orthorobot-pull-3.patch";
+      url = "https://github.com/Stabyourself/orthorobot/compare/48f07423950b29a94b04aefe268f2f951f55b62e...05856ba7dbf1bb86d0f16a5f511d8ee9f2176015.patch";
       sha256 = "sha256-WHHP6QM7R5eEkVF+J2pGNnds/OKRIRXyon85wjd3GXI=";
     })
   ];
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index 78c669614c07..25f2a01de8aa 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -81,7 +81,7 @@ in buildFHSEnv rec {
     xorg.libXfixes
     libGL
     libva
-    pipewire.lib
+    pipewire
 
     # steamwebhelper
     harfbuzz
diff --git a/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh b/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
index bdb522744182..829bc6509e06 100644
--- a/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
+++ b/pkgs/misc/cups/drivers/samsung/4.00.39/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 arch=$(uname -m)
diff --git a/pkgs/misc/openrussian-cli/default.nix b/pkgs/misc/openrussian-cli/default.nix
index 038bdd5a73f1..6c62315143b7 100644
--- a/pkgs/misc/openrussian-cli/default.nix
+++ b/pkgs/misc/openrussian-cli/default.nix
@@ -55,5 +55,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ zane ];
     mainProgram = "openrussian";
     platforms   = platforms.unix;
+    broken = true;
   };
 }
diff --git a/pkgs/os-specific/darwin/DarwinTools/default.nix b/pkgs/os-specific/darwin/DarwinTools/default.nix
index 72a375028453..11e4c84395da 100644
--- a/pkgs/os-specific/darwin/DarwinTools/default.nix
+++ b/pkgs/os-specific/darwin/DarwinTools/default.nix
@@ -13,17 +13,17 @@ stdenv.mkDerivation rec {
     ./sw_vers-CFPriv.patch
   ];
 
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace gcc cc
-  '';
-
   configurePhase = ''
     export SRCROOT=.
     export SYMROOT=.
     export DSTROOT=$out
   '';
 
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "STRIP=${stdenv.cc.targetPrefix}strip"
+  ];
+
   postInstall = ''
     mv $out/usr/* $out
     rmdir $out/usr
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix
index 6e6712f375e6..931bebeae5dd 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix
@@ -1,6 +1,13 @@
 { appleDerivation', stdenvNoCC }:
 
 appleDerivation' stdenvNoCC {
+  patches = [
+    # The source release version of math.h is missing some symbols that are actually present
+    # in newer SDKs. Patch them into the header to avoid implicit function declaration errors
+    # when compiling with newer versions of clang.
+    ./missing-declarations.patch
+  ];
+
   installPhase = ''
     mkdir -p $out/include
 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libm/missing-declarations.patch b/pkgs/os-specific/darwin/apple-source-releases/Libm/missing-declarations.patch
new file mode 100644
index 000000000000..e56934e59d4c
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libm/missing-declarations.patch
@@ -0,0 +1,292 @@
+--- a/Source/Intel/math.h	2023-10-20 09:43:42.640416006 -0400
++++ b/Source/Intel/math.h	2023-10-20 09:47:59.743127003 -0400
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2002 Apple Computer, Inc. All rights reserved.
++ * Copyright (c) 2002-2015 Apple Inc. All rights reserved.
+  *
+  * @APPLE_LICENSE_HEADER_START@
+  * 
+@@ -27,14 +27,17 @@
+ *     Contains: typedefs, prototypes, and macros germane to C99 floating point.*
+ *                                                                              *
+ *******************************************************************************/
++#ifndef __MATH_H__
++#define __MATH_H__
++
+ #ifndef __MATH__
+ #define __MATH__
++#endif
+ 
+-#include <sys/cdefs.h> /* For definition of __DARWIN_UNIX03 et al */
++#include <sys/cdefs.h>
++#include <Availability.h>
+ 
+-#ifdef __cplusplus
+-extern "C" {
+-#endif
++__BEGIN_DECLS
+ 
+ /******************************************************************************
+ *       Floating point data types                                             *
+@@ -87,14 +90,26 @@
+ #define FP_SUBNORMAL    5
+ #define FP_SUPERNORMAL  6 /* meaningful only on PowerPC */
+ 
+-/* fma() *function call* is more costly than equivalent (in-line) multiply and add operations    */
+-/* For single and double precision, the cost isn't too bad, because we can fall back on higher   */
+-/* precision hardware, with the necessary range to handle infinite precision products. However,  */
+-/* expect the long double fma to be at least an order of magnitude slower than a simple multiply */
+-/* and an add.                                                                                   */
+-#undef FP_FAST_FMA
+-#undef FP_FAST_FMAF
+-#undef FP_FAST_FMAL
++#if defined __arm64__ || defined __ARM_VFPV4__
++/*  On these architectures, fma(), fmaf( ), and fmal( ) are generally about as
++    fast as (or faster than) separate multiply and add of the same operands.  */
++#   define FP_FAST_FMA     1
++#   define FP_FAST_FMAF    1
++#   define FP_FAST_FMAL    1
++#elif (defined __i386__ || defined __x86_64__) && (defined __FMA__)
++/*  When targeting the FMA ISA extension, fma() and fmaf( ) are generally
++    about as fast as (or faster than) separate multiply and add of the same
++    operands, but fmal( ) may be more costly.                                 */
++#   define FP_FAST_FMA     1
++#   define FP_FAST_FMAF    1
++#   undef  FP_FAST_FMAL
++#else
++/*  On these architectures, fma( ), fmaf( ), and fmal( ) function calls are
++    significantly more costly than separate multiply and add operations.      */
++#   undef  FP_FAST_FMA
++#   undef  FP_FAST_FMAF
++#   undef  FP_FAST_FMAL
++#endif
+ 
+ /* The values returned by `ilogb' for 0 and NaN respectively. */
+ #define FP_ILOGB0	(-2147483647 - 1)
+@@ -191,6 +206,23 @@
+ 	static __inline__  int __inline_isnormalf( float __x ) { float fabsf = __builtin_fabsf(__x); if( __x != __x ) return 0; return fabsf < __builtin_inff() && fabsf >= __FLT_MIN__; }  
+ 	static __inline__  int __inline_isnormald( double __x ) { double fabsf = __builtin_fabs(__x); if( __x != __x ) return 0; return fabsf < __builtin_inf() && fabsf >= __DBL_MIN__; }  
+ 	static __inline__  int __inline_isnormal( long double __x ) { long double fabsf = __builtin_fabsl(__x); if( __x != __x ) return 0; return fabsf < __builtin_infl() && fabsf >= __LDBL_MIN__; }  
++
++#if defined __i386__ || defined __x86_64__
++__header_always_inline int __inline_signbitl(long double __x) {
++    union {
++        long double __ld;
++        struct{ unsigned long long __m; unsigned short __sexp; } __p;
++    } __u;
++    __u.__ld = __x;
++    return (int)(__u.__p.__sexp >> 15);
++}
++#else
++__header_always_inline int __inline_signbitl(long double __x) {
++    union { long double __f; unsigned long long __u;} __u;
++    __u.__f = __x;
++    return (int)(__u.__u >> 63);
++}
++#endif
+ 	
+ #else
+ 
+@@ -509,7 +541,112 @@
+ extern long double  __infl( void );
+ extern float  		__nan( void ); /* 10.3 (and later) must retain in ABI for backward compatability */
+ 
+-#if !defined(_ANSI_SOURCE)
++
++/******************************************************************************
++ *  Apple extensions to the C standard                                        *
++ ******************************************************************************/
++
++/*  Because these functions are not specified by any relevant standard, they
++    are prefixed with __, which places them in the implementor's namespace, so
++    they should not conflict with any developer or third-party code.  If they
++    are added to a relevant standard in the future, un-prefixed names may be
++    added to the library and they may be moved out of this section of the
++    header.                                                                   
++ 
++    Because these functions are non-standard, they may not be available on non-
++    Apple platforms.                                                          */
++
++/*  __exp10(x) returns 10**x.  Edge cases match those of exp( ) and exp2( ).  */
++extern float __exp10f(float) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++extern double __exp10(double) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++
++/*  __sincos(x,sinp,cosp) computes the sine and cosine of x with a single
++    function call, storing the sine in the memory pointed to by sinp, and
++    the cosine in the memory pointed to by cosp. Edge cases match those of
++    separate calls to sin( ) and cos( ).                                      */
++__header_always_inline void __sincosf(float __x, float *__sinp, float *__cosp);
++__header_always_inline void __sincos(double __x, double *__sinp, double *__cosp);
++
++/*  __sinpi(x) returns the sine of pi times x; __cospi(x) and __tanpi(x) return
++    the cosine and tangent, respectively.  These functions can produce a more
++    accurate answer than expressions of the form sin(M_PI * x) because they
++    avoid any loss of precision that results from rounding the result of the
++    multiplication M_PI * x.  They may also be significantly more efficient in
++    some cases because the argument reduction for these functions is easier
++    to compute.  Consult the man pages for edge case details.                 */
++extern float __cospif(float) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++extern double __cospi(double) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++extern float __sinpif(float) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++extern double __sinpi(double) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++extern float __tanpif(float) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++extern double __tanpi(double) __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
++
++#if (defined __MAC_OS_X_VERSION_MIN_REQUIRED && __MAC_OS_X_VERSION_MIN_REQUIRED < 1090) || \
++    (defined __IPHONE_OS_VERSION_MIN_REQUIRED && __IPHONE_OS_VERSION_MIN_REQUIRED < 70000)
++/*  __sincos and __sincosf were introduced in OSX 10.9 and iOS 7.0.  When
++    targeting an older system, we simply split them up into discrete calls
++    to sin( ) and cos( ).                                                     */
++__header_always_inline void __sincosf(float __x, float *__sinp, float *__cosp) {
++  *__sinp = sinf(__x);
++  *__cosp = cosf(__x);
++}
++
++__header_always_inline void __sincos(double __x, double *__sinp, double *__cosp) {
++  *__sinp = sin(__x);
++  *__cosp = cos(__x);
++}
++#else
++/*  __sincospi(x,sinp,cosp) computes the sine and cosine of pi times x with a
++    single function call, storing the sine in the memory pointed to by sinp,
++    and the cosine in the memory pointed to by cosp.  Edge cases match those
++    of separate calls to __sinpi( ) and __cospi( ), and are documented in the
++    man pages.
++ 
++    These functions were introduced in OSX 10.9 and iOS 7.0.  Because they are
++    implemented as header inlines, weak-linking does not function as normal,
++    and they are simply hidden when targeting earlier OS versions.            */
++__header_always_inline void __sincospif(float __x, float *__sinp, float *__cosp);
++__header_always_inline void __sincospi(double __x, double *__sinp, double *__cosp);
++
++/*  Implementation details of __sincos and __sincospi allowing them to return
++    two results while allowing the compiler to optimize away unnecessary load-
++    store traffic.  Although these interfaces are exposed in the math.h header
++    to allow compilers to generate better code, users should call __sincos[f]
++    and __sincospi[f] instead and allow the compiler to emit these calls.     */
++struct __float2 { float __sinval; float __cosval; };
++struct __double2 { double __sinval; double __cosval; };
++
++extern struct __float2 __sincosf_stret(float);
++extern struct __double2 __sincos_stret(double);
++extern struct __float2 __sincospif_stret(float);
++extern struct __double2 __sincospi_stret(double);
++
++__header_always_inline void __sincosf(float __x, float *__sinp, float *__cosp) {
++    const struct __float2 __stret = __sincosf_stret(__x);
++    *__sinp = __stret.__sinval; *__cosp = __stret.__cosval;
++}
++
++__header_always_inline void __sincos(double __x, double *__sinp, double *__cosp) {
++    const struct __double2 __stret = __sincos_stret(__x);
++    *__sinp = __stret.__sinval; *__cosp = __stret.__cosval;
++}
++
++__header_always_inline void __sincospif(float __x, float *__sinp, float *__cosp) {
++    const struct __float2 __stret = __sincospif_stret(__x);
++    *__sinp = __stret.__sinval; *__cosp = __stret.__cosval;
++}
++
++__header_always_inline void __sincospi(double __x, double *__sinp, double *__cosp) {
++    const struct __double2 __stret = __sincospi_stret(__x);
++    *__sinp = __stret.__sinval; *__cosp = __stret.__cosval;
++}
++#endif
++
++/******************************************************************************
++ *  POSIX/UNIX extensions to the C standard                                   *
++ ******************************************************************************/
++
++#if __DARWIN_C_LEVEL >= 199506L
+ extern double j0 ( double );
+ 
+ extern double j1 ( double );
+@@ -543,14 +680,32 @@
+ extern int signgam;     /* required for unix 2003 */
+ 
+ 
+-#endif /* !defined(_ANSI_SOURCE) */
++#endif /* __DARWIN_C_LEVEL >= 199506L */
+ 
+-#if !defined(__NOEXTENSIONS__) && (!defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE))
+-#define __WANT_EXTENSIONS__
+-#endif
++/*  Long-double versions of M_E, etc for convenience on Intel where long-
++    double is not the same as double.  Define __MATH_LONG_DOUBLE_CONSTANTS
++    to make these constants available.                                        */
++#if defined __MATH_LONG_DOUBLE_CONSTANTS
++#define M_El        0xa.df85458a2bb4a9bp-2L
++#define M_LOG2El    0xb.8aa3b295c17f0bcp-3L
++#define M_LOG10El   0xd.e5bd8a937287195p-5L
++#define M_LN2l      0xb.17217f7d1cf79acp-4L
++#define M_LN10l     0x9.35d8dddaaa8ac17p-2L
++#define M_PIl       0xc.90fdaa22168c235p-2L
++#define M_PI_2l     0xc.90fdaa22168c235p-3L
++#define M_PI_4l     0xc.90fdaa22168c235p-4L
++#define M_1_PIl     0xa.2f9836e4e44152ap-5L
++#define M_2_PIl     0xa.2f9836e4e44152ap-4L
++#define M_2_SQRTPIl 0x9.06eba8214db688dp-3L
++#define M_SQRT2l    0xb.504f333f9de6484p-3L
++#define M_SQRT1_2l  0xb.504f333f9de6484p-4L
++#endif /* defined __MATH_LONG_DOUBLE_CONSTANTS */
+ 
+-#ifdef __WANT_EXTENSIONS__
++/******************************************************************************
++ *  Legacy BSD extensions to the C standard                                   *
++ ******************************************************************************/
+ 
++#if __DARWIN_C_LEVEL >= __DARWIN_C_FULL
+ #define FP_SNAN		FP_NAN
+ #define FP_QNAN		FP_NAN
+ 
+@@ -560,11 +715,6 @@
+ /* Legacy API: please use C99 lround() instead. */
+ extern long int roundtol ( double );
+ 
+-/*
+- * XOPEN/SVID
+- */
+-#if !defined(_ANSI_SOURCE) && (!defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE))
+-#if (!defined(_XOPEN_SOURCE) || defined(_DARWIN_C_SOURCE))
+ #if !defined(__cplusplus)
+ /* used by matherr below */
+ struct exception {
+@@ -592,19 +742,12 @@
+ #define	TLOSS		5
+ #define	PLOSS		6
+ 
+-#endif /* (!_XOPEN_SOURCE || _DARWIN_C_SOURCE) */
+-#endif /* !_ANSI_SOURCE && (!_POSIX_C_SOURCE || _DARWIN_C_SOURCE) */
+-
+-#if !defined( __STRICT_ANSI__) && !defined(_ANSI_SOURCE) && (!defined(_POSIX_C_SOURCE) || defined(_DARWIN_C_SOURCE))
+-    
+ /* Legacy API: please use C99 isfinite() instead. */
+ extern int finite ( double );
+     
+ /* Legacy API: please use C99 tgamma() instead. */
+ extern double gamma ( double );
+ 
+-#if (!defined(_XOPEN_SOURCE) || defined(_DARWIN_C_SOURCE))
+-
+ #if !defined(__cplusplus)
+ extern int matherr ( struct exception * );
+ #endif
+@@ -633,14 +776,8 @@
+ 	extern double lgamma_r ( double, int * ) AVAILABLE_MAC_OS_X_VERSION_10_6_AND_LATER;
+ 	extern long double lgammal_r ( long double, int * ) AVAILABLE_MAC_OS_X_VERSION_10_6_AND_LATER;
+ #endif /* _REENTRANT */
+-	
+-#endif /* (!_XOPEN_SOURCE || _DARWIN_C_SOURCE) */
+-#endif /* !_ANSI_SOURCE && (!_POSIX_C_SOURCE || _DARWIN_C_SOURCE) */
+-
+-#endif /* __WANT_EXTENSIONS__ */
+ 
+-#ifdef __cplusplus
+-}
+-#endif
++#endif /* __DARWIN_C_LEVEL >= __DARWIN_C_FULL */
+ 
+-#endif /* __MATH__ */
++__END_DECLS
++#endif /* __MATH_H__ */
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index acb484ba6b6a..c6c7d9d0f509 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -23,11 +23,11 @@
   ];
 in stdenv.mkDerivation rec {
   pname = "bluez";
-  version = "5.66";
+  version = "5.70";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-Of6mS1kMlJKYSgwnqJ/CA+HNx0hmCG77j0aYZ3qytXQ=";
+    sha256 = "sha256-N+Ny6RaVXhRMuIL4iOS+QImPEK47fCE93N1V7pwAkng=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix
index bbd871a1b9ae..f4b8bfc5661a 100644
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -1,4 +1,4 @@
-{ version, sha256Hash }:
+{ version, hash }:
 
 { lib, stdenv, fetchFromGitHub, fetchpatch
 , fusePackages, util-linux, gettext, shadow
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
     owner = "libfuse";
     repo = "libfuse";
     rev = "${pname}-${version}";
-    sha256 = sha256Hash;
+    inherit hash;
   };
 
   preAutoreconf = "touch config.rpath";
@@ -48,6 +48,7 @@ in stdenv.mkDerivation rec {
   mesonFlags = lib.optionals isFuse3 [
     "-Dudevrulesdir=/udev/rules.d"
     "-Duseroot=false"
+    "-Dinitscriptdir="
   ];
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index 6aa3e46d4e1a..f692c2fb41c7 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -7,11 +7,11 @@ let
 in {
   fuse_2 = mkFuse {
     version = "2.9.9";
-    sha256Hash = "1yxxvm58c30pc022nl1wlg8fljqpmwnchkywic3r74zirvlcq23n";
+    hash = "sha256-dgjM6M7xk5MHi9xPyCyvF0vq0KM8UCsEYBcMhkrdvfs=";
   };
 
   fuse_3 = mkFuse {
-    version = "3.11.0";
-    sha256Hash = "1wx80xxlvjn0wxhmkr1g91vwrgxssyzds1hizzxc2xrd4kjh9dfb";
+    version = "3.16.2";
+    hash = "sha256-QO9s+IkR0rkqIYNqt2IYST6AVBkCr56jcuuz5nKJuA4=";
   };
 }
diff --git a/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch b/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
index 903f30325df2..582d3eb0dec8 100644
--- a/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
+++ b/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
@@ -1,12 +1,13 @@
+diff --git a/lib/meson.build b/lib/meson.build
 --- a/lib/meson.build
 +++ b/lib/meson.build
 @@ -37,8 +37,7 @@ libfuse = library('fuse3', libfuse_sources, version: meson.project_version(),
                    soversion: '3', include_directories: include_dirs,
                    dependencies: deps, install: true,
                    link_depends: 'fuse_versionscript',
--                  c_args: [ '-DFUSE_USE_VERSION=35',
+-                  c_args: [ '-DFUSE_USE_VERSION=312',
 -                            '-DFUSERMOUNT_DIR="@0@"'.format(fusermount_path) ],
-+                  c_args: [ '-DFUSE_USE_VERSION=35' ],
++                  c_args: [ '-DFUSE_USE_VERSION=312' ],
                    link_args: ['-Wl,--version-script,' + meson.current_source_dir()
                                + '/fuse_versionscript' ])
  
diff --git a/pkgs/os-specific/linux/fuse/fuse3-install.patch b/pkgs/os-specific/linux/fuse/fuse3-install.patch
index 147bcb439fb8..769e3088664c 100644
--- a/pkgs/os-specific/linux/fuse/fuse3-install.patch
+++ b/pkgs/os-specific/linux/fuse/fuse3-install.patch
@@ -1,18 +1,20 @@
---- a/util/install_helper.sh	2019-07-10 12:00:15.984840142 +0200
-+++ b/util/install_helper.sh	2019-07-10 12:28:56.343011401 +0200
-@@ -37,10 +37,10 @@
- fi
+--- a/util/install_helper.sh	2023-08-26 22:12:11.028651669 +0200
++++ b/util/install_helper.sh	2023-08-26 22:38:03.165058694 +0200
+@@ -39,12 +39,12 @@
  
- install -D -m 644 "${MESON_SOURCE_ROOT}/util/udev.rules" \
+ if [ "${udevrulesdir}" != "" ]; then
+     install -D -m 644 "${MESON_SOURCE_ROOT}/util/udev.rules" \
 -        "${DESTDIR}${udevrulesdir}/99-fuse3.rules"
 +        "${sysconfdir}${udevrulesdir}/99-fuse3.rules"
+ fi
  
- install -D -m 755 "${MESON_SOURCE_ROOT}/util/init_script" \
--        "${DESTDIR}/etc/init.d/fuse3"
-+        "${sysconfdir}/init.d/fuse3"
- 
+ if [ "$initscriptdir" != "" ]; then
+     install -D -m 755 "${MESON_SOURCE_ROOT}/util/init_script" \
+-            "${DESTDIR}${initscriptdir}/fuse3"
++            "${sysconfdir}${initscriptdir}/fuse3"
  
- if test -x /usr/sbin/update-rc.d && test -z "${DESTDIR}"; then
+     if test -x /usr/sbin/update-rc.d && test -z "${DESTDIR}"; then
+         /usr/sbin/update-rc.d fuse3 start 34 S . start 41 0 6 . || /bin/true
 diff --git a/util/meson.build b/util/meson.build
 index aa0e734..06d4378 100644
 --- a/util/meson.build
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index a64a0574d8ff..1719dbe01cad 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.374";
+  version = "0.375";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-RvjYd8iD6JkGhh6TDy/Qo+UzLxbhPvIJvhl/Rw14lbk=";
+    hash = "sha256-2cahF9kOtr1R42zhwdwRqXSbWK9EkknTPnjs0DJl4TU=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index ff40e585b1d8..e0a3c4319b8b 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -119,7 +119,10 @@ in {
         hash = "sha256-eldLvCCALqdrUsp/rwcmf3IEXoYbGJFcUnKpjCer+IQ=";
       };
       patches = [
-         ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
+        ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
+
+        # Fix regression turning `struct sockaddr_ll` flexible size.
+        ./revert-af_packet-flex.patch
       ];
     };
 }
diff --git a/pkgs/os-specific/linux/kernel-headers/revert-af_packet-flex.patch b/pkgs/os-specific/linux/kernel-headers/revert-af_packet-flex.patch
new file mode 100644
index 000000000000..ed6c8861d2fb
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel-headers/revert-af_packet-flex.patch
@@ -0,0 +1,31 @@
+Revert commit https://github.com/torvalds/linux/commit/a0ade8404c3bc2bf2631cb0f20d372eed22d9d96
+
+The change caused API regression by turning fixed size struct to
+flexible size struct. It was an unintentional change, broke `udp2raw`:
+    https://github.com/NixOS/nixpkgs/pull/252587#issuecomment-1744427473
+--- a/include/uapi/linux/if_packet.h
++++ b/include/uapi/linux/if_packet.h
+@@ -18,11 +18,7 @@ struct sockaddr_ll {
+ 	unsigned short	sll_hatype;
+ 	unsigned char	sll_pkttype;
+ 	unsigned char	sll_halen;
+-	union {
+-		unsigned char	sll_addr[8];
+-		/* Actual length is in sll_halen. */
+-		__DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
+-	};
++	unsigned char	sll_addr[8];
+ };
+ 
+ /* Packet types */
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3607,7 +3607,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
+ 	if (dev) {
+ 		sll->sll_hatype = dev->type;
+ 		sll->sll_halen = dev->addr_len;
+-		memcpy(sll->sll_addr_flex, dev->dev_addr, dev->addr_len);
++		memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
+ 	} else {
+ 		sll->sll_hatype = 0;	/* Bad: we have no ARPHRD_UNSPEC */
+ 		sll->sll_halen = 0;
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index a21890a38ca2..c32b06bc27c8 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -131,8 +131,6 @@ let
     platformName = stdenv.hostPlatform.linux-kernel.name;
     # e.g. "defconfig"
     kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig;
-    # e.g. "bzImage"
-    kernelTarget = stdenv.hostPlatform.linux-kernel.target;
 
     makeFlags = lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags) stdenv.hostPlatform.linux-kernel.makeFlags
       ++ extraMakeFlags;
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 94c383ff8dbd..7b7213c6fd68 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -7,10 +7,6 @@
         "version": "6.5.8",
         "hash": "sha256:05zpdh4dxaadq52hlczdmwb7bsqfm3q45v7bdqbsmplhgn4wm719"
     },
-    "6.4": {
-        "version": "6.4.16",
-        "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
-    },
     "6.1": {
         "version": "6.1.59",
         "hash": "sha256:1860r1aan258yi2jq68bp1kdbcyy7ygc7d8g54wnc0vmqqj7fzv2"
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index 0763ffda26b9..c58c4e67e4d0 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -6,27 +6,32 @@
 # bcachefs-tools stores the expected-revision in:
 #   https://evilpiepirate.org/git/bcachefs-tools.git/tree/.bcachefs_revision
 # but this does not means that it'll be the latest-compatible revision
-, currentCommit ? "84f132d5696138bb038d2dc8f1162d2fab5ac832"
-, diffHash ? "sha256-RaBWBU7rXjJFb1euFAFBHWCBQAG7npaCodjp/vMYpyw="
+, currentCommit ? "4d2faeb4fb58c389dc9f76b8d5ae991ef4497e04"
+, diffHash ? "sha256-DtMc8P4lTRzvS6PVvD7WtWEPsfnxIXSpqMsKKWs+edI="
 , kernelPatches # must always be defined in bcachefs' all-packages.nix entry because it's also a top-level attribute supplied by callPackage
 , argsOverride ? {}
 , ...
 } @ args:
-
 # NOTE: bcachefs-tools should be updated simultaneously to preserve compatibility
 (kernel.override ( args // {
-  version = "${kernel.version}-bcachefs-unstable-${commitDate}";
 
-  extraMeta = {
-    branch = "master";
-    broken = stdenv.isAarch64;
-    maintainers = with lib.maintainers; [ davidak Madouura pedrohlc raitobezarius ];
-  };
+  argsOverride = {
+    version = "${kernel.version}-bcachefs-unstable-${commitDate}";
+    modDirVersion = kernel.modDirVersion;
+
+    extraMeta = {
+      homepage = "https://bcachefs.org/";
+      branch = "master";
+      maintainers = with lib.maintainers; [ davidak Madouura pedrohlc raitobezarius YellowOnion ];
+    };
+  } // argsOverride;
 
   structuredExtraConfig = with lib.kernel; {
     BCACHEFS_FS = module;
     BCACHEFS_QUOTA = option yes;
     BCACHEFS_POSIX_ACL = option yes;
+    # useful for bug reports
+    FTRACE = option yes;
   };
 
   kernelPatches = [ {
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index d5b67b5efbe3..2ba31fbc9789 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
-, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, kmod
+, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, kmod, ubootTools
 , fetchpatch
 }:
 
@@ -120,10 +120,6 @@ let
         # Ensure that depmod gets resolved through PATH
         sed -i Makefile -e 's|= /sbin/depmod|= depmod|'
 
-        # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
-        # FIXME: remove when no longer needed
-        substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd
-
         # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
         # This way kernels can be bit-by-bit reproducible depending on settings
         # (e.g. MODULE_SIG and SECURITY_LOCKDOWN_LSM need to be disabled).
@@ -368,8 +364,7 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
   enableParallelBuilding = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ]
-      ++ optional  (stdenv.hostPlatform.linux-kernel.target == "uImage") buildPackages.ubootTools
+  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ubootTools ]
       ++ optional  (lib.versionOlder version "5.8") libelf
       ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
diff --git a/pkgs/os-specific/linux/numatop/default.nix b/pkgs/os-specific/linux/numatop/default.nix
index ad0138f18b75..f4995264b09e 100644
--- a/pkgs/os-specific/linux/numatop/default.nix
+++ b/pkgs/os-specific/linux/numatop/default.nix
@@ -16,12 +16,14 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
-      url = "https://github.com/intel/numatop/pull/54.patch";
+      # https://github.com/intel/numatop/pull/54
+      url = "https://github.com/intel/numatop/compare/eab0ac5253c5843aa0f0ac36e2eec7612207711b...c1001fd926c24eae2d40729492e07270ce133b72.patch";
       sha256 = "sha256-TbMLv7TT9T8wE4uJ1a/AroyPPwrwL0eX5IBLsh9GTTM=";
       name = "fix-string-operations.patch";
     })
     (fetchpatch {
-      url = "https://github.com/intel/numatop/pull/64.patch";
+      # https://github.com/intel/numatop/pull/64
+      url = "https://github.com/intel/numatop/commit/635e2ce2ccb1ac793cc276a7fcb8a92b1ffefa5d.patch";
       sha256 = "sha256-IevbSFJRTS5iQ5apHOVXzF67f3LJaW6j7DySFmVuyiM=";
       name = "fix-format-strings-mvwprintw.patch";
     })
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index b7824f209776..fbb116ab42ad 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 unpackManually() {
diff --git a/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh b/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
index 34f9b1579455..ed2c60da2612 100644
--- a/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
+++ b/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 mkdir -p $out/lib
diff --git a/pkgs/os-specific/linux/pam_p11/default.nix b/pkgs/os-specific/linux/pam_p11/default.nix
index 8970f7ed6285..0a7e02f4ad81 100644
--- a/pkgs/os-specific/linux/pam_p11/default.nix
+++ b/pkgs/os-specific/linux/pam_p11/default.nix
@@ -13,8 +13,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     # fix with openssl 3.x
+    # https://github.com/OpenSC/pam_p11/pull/22
     (fetchpatch {
-      url = "https://github.com/OpenSC/pam_p11/pull/22.patch";
+      name = "OpenSC-pam_p11-pull-22.patch";
+      url = "https://github.com/OpenSC/pam_p11/compare/cd4eba2e921e1c2f93cde71922a76af99376246c...debd4f7acfaf998cfe4002e0be5c35ad9a9591b5.patch";
       excludes = [ ".github/build.sh" ];
       hash = "sha256-bm/agnBgvrr8L8yoGK4gzBqOGgsNWf9NIgcNJG7proE=";
     })
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index 746f9b17a698..38fec65b3334 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -17,13 +17,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "shadow";
-  version = "4.14.0";
+  version = "4.14.1";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
     repo = pname;
     rev = version;
-    hash = "sha256-zopJevCv7ot8RLp/rSQGKO05eF4FjkLaOEMo9aq9Afo=";
+    hash = "sha256-DzPPnttnJSOMQwXWyFcz6fEtjwBC3p2PpZpBAQ/Ew18=";
   };
 
   outputs = [ "out" "su" "dev" "man" ];
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 954977882ee9..b13db4a3427c 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -202,6 +202,14 @@ stdenv.mkDerivation (finalAttrs: {
     ./0017-core-don-t-taint-on-unmerged-usr.patch
     ./0018-tpm2_context_init-fix-driver-name-checking.patch
     ./0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+
+    # Fix for `RuntimeError: ELF .dynamic section is missing.`
+    # https://github.com/systemd/systemd/issues/29381
+    # https://github.com/systemd/systemd/pull/29392
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/cecbb162a3134b43d2ca160e13198c73ff34c3ef.patch";
+      hash = "sha256-hWpUosTDA18mYm5nIb9KnjwOlnzbEHgzha/WpyHoC54=";
+    })
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
diff --git a/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch b/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
new file mode 100644
index 000000000000..068744d4f32d
--- /dev/null
+++ b/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
@@ -0,0 +1,277 @@
+commit 68564ebb50f8afab5a9527c534417e247cca0b27
+Author: Filipe Manana <fdmanana@kernel.org>
+Date:   Thu Aug 17 10:20:13 2023 +0100
+
+    libmount: Fix regression when mounting with atime
+    
+    A regression was introduced in v2.39 that causes mounting with the atime
+    option to fail:
+    
+      $ mkfs.ext4 -F /dev/sdi
+      $ mount -o atime /dev/sdi /mnt/sdi
+      mount: /mnt/sdi: not mount point or bad option.
+             dmesg(1) may have more information after failed mount system call.
+    
+    The failure comes from the mount_setattr(2) call returning -EINVAL. This
+    is because we pass an invalid value for the attr_clr argument. From a
+    strace capture we have:
+    
+      mount_setattr(4, "", AT_EMPTY_PATH, {attr_set=0, attr_clr=MOUNT_ATTR_NOATIME, propagation=0 /* MS_??? */, userns_fd=0}, 32) = -1 EINVAL (Invalid argument)
+    
+    We can't pass MOUNT_ATTR_NOATIME to mount_setattr(2) through the attr_clr
+    argument because all atime options are exclusive, so in order to set atime
+    one has to pass MOUNT_ATTR__ATIME to attr_clr and leave attr_set as
+    MOUNT_ATTR_RELATIME (which is defined as a value of 0).
+    
+    This can be read from the man page for mount_setattr(2) and also from the
+    kernel source:
+    
+      $ cat fs/namespace.c
+      static int build_mount_kattr(const struct mount_attr *attr, size_t usize,
+                                   struct mount_kattr *kattr, unsigned int flags)
+      {
+          (...)
+          /*
+           * Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap,
+           * users wanting to transition to a different atime setting cannot
+           * simply specify the atime setting in @attr_set, but must also
+           * specify MOUNT_ATTR__ATIME in the @attr_clr field.
+           * So ensure that MOUNT_ATTR__ATIME can't be partially set in
+           * @attr_clr and that @attr_set can't have any atime bits set if
+           * MOUNT_ATTR__ATIME isn't set in @attr_clr.
+           */
+          if (attr->attr_clr & MOUNT_ATTR__ATIME) {
+              if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME)
+                  return -EINVAL;
+    
+                  /*
+                   * Clear all previous time settings as they are mutually
+                   * exclusive.
+                   */
+                  kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME;
+                  switch (attr->attr_set & MOUNT_ATTR__ATIME) {
+                  case MOUNT_ATTR_RELATIME:
+                      kattr->attr_set |= MNT_RELATIME;
+                      break;
+                  case MOUNT_ATTR_NOATIME:
+                      kattr->attr_set |= MNT_NOATIME;
+                      break;
+                  case MOUNT_ATTR_STRICTATIME:
+                      break;
+                  default:
+                      return -EINVAL;
+                  }
+        (...)
+    
+    So fix this by setting attr_clr MOUNT_ATTR__ATIME if we want to clear any
+    atime related option.
+    
+    Signed-off-by: Filipe Manana <fdmanana@kernel.org>
+
+diff --git a/libmount/src/optlist.c b/libmount/src/optlist.c
+index 1e962ec6d..0702adae7 100644
+--- a/libmount/src/optlist.c
++++ b/libmount/src/optlist.c
+@@ -875,7 +875,18 @@ int mnt_optlist_get_attrs(struct libmnt_optlist *ls, uint64_t *set, uint64_t *cl
+ 
+ 		if (opt->ent->mask & MNT_INVERT) {
+ 			DBG(OPTLIST, ul_debugobj(ls, " clr: %s", opt->ent->name));
+-			*clr |= x;
++			/*
++			 * All atime settings are mutually exclusive so *clr must
++			 * have MOUNT_ATTR__ATIME set.
++			 *
++			 * See the function fs/namespace.c:build_mount_kattr()
++			 * in the linux kernel source.
++			 */
++			if (x == MOUNT_ATTR_RELATIME || x == MOUNT_ATTR_NOATIME ||
++			    x == MOUNT_ATTR_STRICTATIME)
++				*clr |= MOUNT_ATTR__ATIME;
++			else
++				*clr |= x;
+ 		} else {
+ 			DBG(OPTLIST, ul_debugobj(ls, " set: %s", opt->ent->name));
+ 			*set |= x;
+diff --git a/tests/expected/libmount/context-mount-flags b/tests/expected/libmount/context-mount-flags
+index 960641863..eb71323dd 100644
+--- a/tests/expected/libmount/context-mount-flags
++++ b/tests/expected/libmount/context-mount-flags
+@@ -3,3 +3,6 @@ ro,nosuid,noexec
+ successfully mounted
+ rw,nosuid,noexec
+ successfully umounted
++successfully mounted
++rw,relatime
++successfully umounted
+diff --git a/tests/ts/libmount/context b/tests/ts/libmount/context
+index f5b47185e..a5d2e81a3 100755
+--- a/tests/ts/libmount/context
++++ b/tests/ts/libmount/context
+@@ -116,8 +116,15 @@ $TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPU
+ 
+ ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
+ is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
+-ts_finalize_subtest
+ 
++# Test that the atime option works after the migration to use the new kernel mount APIs.
++ts_run $TESTPROG --mount -o atime $DEVICE $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
++$TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPUT 2>> $TS_ERRLOG
++is_mounted $DEVICE || echo "$DEVICE not mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
++ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
++is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
++
++ts_finalize_subtest
+ 
+ ts_init_subtest "mount-loopdev"
+ mkdir -p $MOUNTPOINT &> /dev/null
+
+commit 1ec71634aa4ef5ddca23d65c8a296f3614231e8a
+Author: Colin Gillespie <colin@cgillespie.xyz>
+Date:   Wed Aug 9 18:28:07 2023 +1000
+
+    libblkid: (bcachefs) fix not detecting large superblocks
+    
+    Probing does not detect bcachefs filesystems with a superblock larger
+    than 4KiB. Bcachefs superblocks grow in size and can become much larger
+    than this.
+    
+    Increase the superblock maximum size limit to 1MiB.
+    
+    Validate the superblock isn't larger than the maximum size defined in
+    the superblocks layout section.
+    
+    (cherry picked from commit 48d573797797650d96456979797c0155d58f61cb)
+
+diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
+index 40e702d75..236877042 100644
+--- a/libblkid/src/superblocks/bcache.c
++++ b/libblkid/src/superblocks/bcache.c
+@@ -102,6 +102,15 @@ union bcachefs_sb_csum {
+ 	uint8_t raw[16];
+ } __attribute__((packed));
+ 
++struct bcachefs_sb_layout {
++	uint8_t		magic[16];
++	uint8_t		layout_type;
++	uint8_t		sb_max_size_bits;
++	uint8_t		nr_superblocks;
++	uint8_t		pad[5];
++	uint64_t	sb_offset[61];
++} __attribute__((packed));
++
+ struct bcachefs_super_block {
+ 	union bcachefs_sb_csum	csum;
+ 	uint16_t	version;
+@@ -123,7 +132,7 @@ struct bcachefs_super_block {
+ 	uint64_t	flags[8];
+ 	uint64_t	features[2];
+ 	uint64_t	compat[2];
+-	uint8_t		layout[512];
++	struct bcachefs_sb_layout layout;
+ 	struct bcachefs_sb_field _start[];
+ }  __attribute__((packed));
+ 
+@@ -143,7 +152,7 @@ struct bcachefs_super_block {
+ /* granularity of offset and length fields within superblock */
+ #define BCACHEFS_SECTOR_SIZE   512
+ /* maximum superblock size */
+-#define BCACHEFS_SB_MAX_SIZE   4096
++#define BCACHEFS_SB_MAX_SIZE   0x100000
+ /* fields offset within super block */
+ #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
+ /* tag value for members field */
+@@ -302,6 +311,9 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
+ 		return BLKID_PROBE_NONE;
+ 
+ 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
++	if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
++		return BLKID_PROBE_NONE;
++
+ 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
+ 		return BLKID_PROBE_NONE;
+ 
+
+commit acbf17ae8f8ee0f941fe98ed12f115f2b349bba8
+Author: Karel Zak <kzak@redhat.com>
+Date:   Wed Aug 23 11:53:45 2023 +0200
+
+    libblkid: (bcachefs) fix compiler warning [-Werror=sign-compare]
+    
+    Addresses: https://github.com/util-linux/util-linux/pull/2427
+    Signed-off-by: Karel Zak <kzak@redhat.com>
+    (cherry picked from commit 17873d38fc97913c0a31d4bd08cfbfe45c4de5be)
+
+diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
+index 236877042..6ab3fe9d4 100644
+--- a/libblkid/src/superblocks/bcache.c
++++ b/libblkid/src/superblocks/bcache.c
+@@ -311,7 +311,7 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
+ 		return BLKID_PROBE_NONE;
+ 
+ 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
+-	if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
++	if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
+ 		return BLKID_PROBE_NONE;
+ 
+ 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
+
+commit 6b9fda87c4e5d0c6f945d7565197f157b9fa3d5f
+Author: Thomas Weißschuh <thomas@t-8ch.de>
+Date:   Wed Aug 23 11:58:33 2023 +0200
+
+    libblkid: (bcachefs) fix size validation
+    
+    Avoid signed shift out-of-bounds.
+    
+    Also mark the constants explitly as unsigned instead of casting.
+    
+    Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
+    (cherry picked from commit befe455f59de8c7bc66b85ed52aae8cbc95325fa)
+
+diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
+index 6ab3fe9d4..28ac4b52b 100644
+--- a/libblkid/src/superblocks/bcache.c
++++ b/libblkid/src/superblocks/bcache.c
+@@ -142,17 +142,19 @@ struct bcachefs_super_block {
+ /* magic string len */
+ #define BCACHE_SB_MAGIC_LEN (sizeof(BCACHE_SB_MAGIC) - 1)
+ /* super block offset */
+-#define BCACHE_SB_OFF       0x1000
++#define BCACHE_SB_OFF       0x1000U
+ /* supper block offset in kB */
+ #define BCACHE_SB_KBOFF     (BCACHE_SB_OFF >> 10)
+ /* magic string offset within super block */
+ #define BCACHE_SB_MAGIC_OFF offsetof(struct bcache_super_block, magic)
+ /* start of checksummed data within superblock */
+-#define BCACHE_SB_CSUMMED_START 8
++#define BCACHE_SB_CSUMMED_START 8U
+ /* granularity of offset and length fields within superblock */
+-#define BCACHEFS_SECTOR_SIZE   512
++#define BCACHEFS_SECTOR_SIZE   512U
++/* maximum superblock size shift */
++#define BCACHEFS_SB_MAX_SIZE_SHIFT   0x10U
+ /* maximum superblock size */
+-#define BCACHEFS_SB_MAX_SIZE   0x100000
++#define BCACHEFS_SB_MAX_SIZE   (1U << BCACHEFS_SB_MAX_SIZE_SHIFT)
+ /* fields offset within super block */
+ #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
+ /* tag value for members field */
+@@ -311,12 +313,16 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
+ 		return BLKID_PROBE_NONE;
+ 
+ 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
+-	if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
+-		return BLKID_PROBE_NONE;
+ 
+ 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
+ 		return BLKID_PROBE_NONE;
+ 
++	if (bcs->layout.sb_max_size_bits > BCACHEFS_SB_MAX_SIZE_SHIFT)
++		return BLKID_PROBE_NONE;
++
++	if (sb_size > (BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
++		return BLKID_PROBE_NONE;
++
+ 	sb = blkid_probe_get_sb_buffer(pr, mag, sb_size);
+ 	if (!sb)
+ 		return BLKID_PROBE_NONE;
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 45c0d57cbff4..d710fabb7ace 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./rtcwake-search-PATH-for-shutdown.patch
+    ./bcachefs-patch-set.patch
   ];
 
   # We separate some of the utilities into their own outputs. This
diff --git a/pkgs/servers/http/tomcat/axis2/builder.sh b/pkgs/servers/http/tomcat/axis2/builder.sh
index d334ab6f927f..de8e225456b4 100644
--- a/pkgs/servers/http/tomcat/axis2/builder.sh
+++ b/pkgs/servers/http/tomcat/axis2/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 unzip $src
diff --git a/pkgs/servers/redpanda/server.nix b/pkgs/servers/redpanda/server.nix
index 27e6343a42a2..ec4250820d3a 100644
--- a/pkgs/servers/redpanda/server.nix
+++ b/pkgs/servers/redpanda/server.nix
@@ -16,7 +16,7 @@
 , p11-kit
 , pkg-config
 , procps
-, protobuf3_21
+, protobuf_21
 , python3
 , snappy
 , src
@@ -100,7 +100,7 @@ llvmPackages_14.stdenv.mkDerivation rec {
     dpdk
     hdr-histogram
     p11-kit
-    protobuf3_21
+    protobuf_21
     rapidjson
     seastar
     snappy
diff --git a/pkgs/servers/x11/xorg/builder.sh b/pkgs/servers/x11/xorg/builder.sh
index a9c607ae35ea..833acf43a5b0 100644
--- a/pkgs/servers/x11/xorg/builder.sh
+++ b/pkgs/servers/x11/xorg/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 # This is the builder for all X.org components.
 source $stdenv/setup
 
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index eb9c1ced6711..1024eeeaa4ca 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1518,11 +1518,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libXrandr = callPackage ({ stdenv, pkg-config, fetchurl, xorgproto, libX11, libXext, libXrender, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "libXrandr";
-    version = "1.5.3";
+    version = "1.5.4";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/lib/libXrandr-1.5.3.tar.xz";
-      sha256 = "0a5l9q37c9m6gfdchlj43a9j3mw2avfwasfn0ivlkqbq980kjxl9";
+      url = "mirror://xorg/individual/lib/libXrandr-1.5.4.tar.xz";
+      sha256 = "1lxlqd9ffjr1myfpyk91594n1h07ck6121m6ba8qajjz6xjv1m8s";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
@@ -3899,11 +3899,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xkeyboardconfig = callPackage ({ stdenv, pkg-config, fetchurl, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xkeyboard-config";
-    version = "2.39";
+    version = "2.40";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.39.tar.xz";
-      sha256 = "10m6mbjymi7qf30g5yd400kqijdjg7ym9qjzh0bc3c7pxwrzbias";
+      url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.40.tar.xz";
+      sha256 = "1qrakn6gyj701mxwbrlhjv4gd73ws51140ns68a1kivxxhdvlgbs";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index e7c93e10bacb..9a3c13d3cac8 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -74,7 +74,7 @@ mirror://xorg/individual/app/xwininfo-1.1.6.tar.xz
 mirror://xorg/individual/app/xwud-1.0.6.tar.xz
 mirror://xorg/individual/data/xbitmaps-1.1.3.tar.xz
 mirror://xorg/individual/data/xcursor-themes-1.0.7.tar.xz
-mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.39.tar.xz
+mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-2.40.tar.xz
 mirror://xorg/individual/doc/xorg-docs-1.7.2.tar.gz
 mirror://xorg/individual/doc/xorg-sgml-doctools-1.12.tar.gz
 mirror://xorg/individual/driver/xf86-input-evdev-2.10.6.tar.bz2
@@ -195,7 +195,7 @@ mirror://xorg/individual/lib/libXmu-1.1.4.tar.xz
 mirror://xorg/individual/lib/libXp-1.0.4.tar.xz
 mirror://xorg/individual/lib/libXpm-3.5.17.tar.xz
 mirror://xorg/individual/lib/libXpresent-1.0.1.tar.xz
-mirror://xorg/individual/lib/libXrandr-1.5.3.tar.xz
+mirror://xorg/individual/lib/libXrandr-1.5.4.tar.xz
 mirror://xorg/individual/lib/libXrender-0.9.11.tar.xz
 mirror://xorg/individual/lib/libXres-1.2.2.tar.xz
 mirror://xorg/individual/lib/libXScrnSaver-1.2.4.tar.xz
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index f7d7053c77a9..7c64fd7e3928 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -60,12 +60,13 @@ rec {
       mkDerivationFromStdenv = withOldMkDerivation old (stdenv: mkDerivationSuper: args:
       if stdenv.hostPlatform.isDarwin
       then throw "Cannot build fully static binaries on Darwin/macOS"
-      else (mkDerivationSuper args).overrideAttrs(finalAttrs: {
-        NIX_CFLAGS_LINK = toString (finalAttrs.NIX_CFLAGS_LINK or "") + " -static";
-      } // lib.optionalAttrs (!(finalAttrs.dontAddStaticConfigureFlags or false)) {
-        configureFlags = (finalAttrs.configureFlags or []) ++ [
-            "--disable-shared" # brrr...
-          ];
+      else (mkDerivationSuper args).overrideAttrs (args: {
+        NIX_CFLAGS_LINK = toString (args.NIX_CFLAGS_LINK or "") + " -static";
+      } // lib.optionalAttrs (!(args.dontAddStaticConfigureFlags or false)) {
+        configureFlags = (args.configureFlags or []) ++ [
+          "--disable-shared" # brrr...
+        ];
+        cmakeFlags = (args.cmakeFlags or []) ++ ["-DCMAKE_SKIP_INSTALL_RPATH=On"];
       }));
     } // lib.optionalAttrs (stdenv0.hostPlatform.libc == "glibc") {
       extraBuildInputs = (old.extraBuildInputs or []) ++ [
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 25a80fd11aa2..9ee6dfb10807 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -1047,9 +1047,9 @@ in
 
     overrides = self: super: {
       inherit (prevStage) ccWrapperStdenv
-        autoconf automake bash bison cmake cmakeMinimal cpio cyrus_sasl db expat flex groff
-        libedit libtool m4 ninja openldap openssh patchutils pbzx perl pkg-config python3
-        python3Minimal scons serf sqlite subversion sysctl texinfo unzip which
+        autoconf automake bash bison cmake cmakeMinimal cyrus_sasl db expat flex groff
+        libedit libtool m4 ninja openldap openssh patchutils perl pkg-config python3 scons
+        serf sqlite subversion sysctl texinfo unzip which
 
         # CF dependencies - don’t rebuild them.
         icu
@@ -1057,11 +1057,40 @@ in
         # LLVM dependencies - don’t rebuild them.
         libffi libiconv libxml2 ncurses zlib;
 
+      # These overrides are required to break an infinite recursion. curl depends on Darwin
+      # frameworks, but those frameworks require these dependencies to build, which
+      # depend on curl indirectly.
+      cpio = super.cpio.override {
+        inherit (prevStage) fetchurl;
+      };
+
+      libyaml = super.libyaml.override {
+        inherit (prevStage) fetchFromGitHub;
+      };
+
+      pbzx = super.pbzx.override {
+        inherit (prevStage) fetchFromGitHub;
+      };
+
+      python3Minimal = super.python3Minimal.override {
+        inherit (prevStage) fetchurl;
+      };
+
+      xar = super.xar.override {
+        inherit (prevStage) fetchurl;
+      };
+
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
         inherit (prevStage.darwin) dyld CF Libsystem darwin-stubs
           # CF dependencies - don’t rebuild them.
           libobjc objc4;
 
+        # rewrite-tbd is also needed to build Darwin frameworks, so it’s built using the
+        # previous stage’s fetchFromGitHub to avoid an infinite recursion (same as above).
+        rewrite-tbd = superDarwin.rewrite-tbd.override {
+          inherit (prevStage) fetchFromGitHub;
+        };
+
         signingUtils = superDarwin.signingUtils.override {
           inherit (selfDarwin) sigtool;
         };
@@ -1158,9 +1187,10 @@ in
   (prevStage:
     # previous stage4 stdenv:
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage; [
-      bash binutils-unwrapped brotli bzip2 curl diffutils ed file findutils gawk gettext gmp
-      gnugrep gnumake gnused gnutar gzip icu libffi libiconv libidn2 libkrb5 libssh2
-      libunistring libxml2 ncurses nghttp2 openbsm openpam openssl patch pcre xz zlib zstd
+      bash binutils-unwrapped brotli bzip2 cpio curl diffutils ed file findutils gawk
+      gettext gmp gnugrep gnumake gnused gnutar gzip icu libffi libiconv libidn2 libkrb5
+      libssh2 libunistring libxml2 libyaml ncurses nghttp2 openbsm openpam openssl patch
+      pbzx pcre python3Minimal xar xz zlib zstd
     ]);
 
     assert lib.all isBuiltByNixpkgsCompiler (with prevStage.darwin; [
@@ -1176,9 +1206,9 @@ in
     ]);
 
     assert lib.all isBuiltByBootstrapFilesCompiler (with prevStage; [
-      autoconf automake bison cmake cmakeMinimal cpio cyrus_sasl db expat flex groff libedit
-      libtool m4 ninja openldap openssh patchutils pbzx perl pkg-config.pkg-config python3
-      python3Minimal scons serf sqlite subversion sysctl.provider texinfo unzip which
+      autoconf automake bison cmake cmakeMinimal cyrus_sasl db expat flex groff libedit
+      libtool m4 ninja openldap openssh patchutils perl pkg-config.pkg-config python3 scons
+      serf sqlite subversion sysctl.provider texinfo unzip which
     ]);
 
     assert prevStage.darwin.cctools == prevStage.darwin.cctools-llvm;
@@ -1307,14 +1337,14 @@ in
 
       overrides = self: super: {
         inherit (prevStage)
-          bash binutils brotli bzip2 coreutils curl diffutils ed file findutils gawk gettext
-          gmp gnugrep gnumake gnused gnutar gzip icu libffi libiconv libidn2 libssh2
-          libunistring libxml2 ncurses nghttp2 openbsm openpam openssl patch pcre xz zlib
-          zstd;
+          bash binutils brotli bzip2 coreutils cpio curl diffutils ed file findutils gawk
+          gettext gmp gnugrep gnumake gnused gnutar gzip icu libffi libiconv libidn2 libssh2
+          libunistring libxml2 libyaml ncurses nghttp2 openbsm openpam openssl patch pbzx
+          pcre python3Minimal xar xz zlib zstd;
 
         darwin = super.darwin.overrideScope (_: _: {
           inherit (prevStage.darwin)
-            CF ICU Libsystem darwin-stubs dyld locale libobjc libtapi xnu;
+            CF ICU Libsystem darwin-stubs dyld locale libobjc libtapi rewrite-tbd xnu;
         } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
           inherit (prevStage.darwin) binutils binutils-unwrapped cctools-llvm cctools-port;
         });
diff --git a/pkgs/stdenv/generic/default-builder.sh b/pkgs/stdenv/generic/default-builder.sh
index 8c6fec7873b6..d49fb8aa57fc 100644
--- a/pkgs/stdenv/generic/default-builder.sh
+++ b/pkgs/stdenv/generic/default-builder.sh
@@ -1,6 +1,4 @@
-if [ -f .attrs.sh ]; then
-    . .attrs.sh
-fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 
 source $stdenv/setup
 genericBuild
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index ad9857fc9d61..419a66261e61 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -16,29 +16,15 @@ if (( "${NIX_DEBUG:-0}" >= 6 )); then
     set -x
 fi
 
-if [ -f .attrs.sh ]; then
+if [ -f .attrs.sh ] || [[ -n "${NIX_ATTRS_JSON_FILE:-}" ]]; then
     __structuredAttrs=1
     echo "structuredAttrs is enabled"
-else
-    __structuredAttrs=
-fi
 
-if [ -n "$__structuredAttrs" ]; then
     for outputName in "${!outputs[@]}"; do
         # ex: out=/nix/store/...
         export "$outputName=${outputs[$outputName]}"
     done
 
-    # Before Nix 2.4, $NIX_ATTRS_*_FILE was named differently:
-    # https://github.com/NixOS/nix/commit/27ce722
-    if [[ -n "${ATTRS_JSON_FILE:-}" ]]; then
-        export NIX_ATTRS_JSON_FILE="$ATTRS_JSON_FILE"
-    fi
-
-    if [[ -n "${ATTRS_SH_FILE:-}" ]]; then
-        export NIX_ATTRS_SH_FILE="$ATTRS_SH_FILE"
-    fi
-
     # $NIX_ATTRS_JSON_FILE pointed to the wrong location in sandbox
     # https://github.com/NixOS/nix/issues/6736; please keep around until the
     # fix reaches *every patch version* that's >= lib/minver.nix
@@ -49,6 +35,7 @@ if [ -n "$__structuredAttrs" ]; then
         export NIX_ATTRS_SH_FILE="$NIX_BUILD_TOP/.attrs.sh"
     fi
 else
+    __structuredAttrs=
     : "${outputs:=out}"
 fi
 
diff --git a/pkgs/test/simple/builder.sh b/pkgs/test/simple/builder.sh
index 908faec3c388..0b09a109bead 100644
--- a/pkgs/test/simple/builder.sh
+++ b/pkgs/test/simple/builder.sh
@@ -1,4 +1,4 @@
-if [ -e .attrs.sh ]; then source .attrs.sh; fi
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 set -x
 
 export NIX_DEBUG=1
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index e65cac675dbd..16acc62416af 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -3,24 +3,20 @@
 , fetchPypi
 , groff
 , less
+, nix-update-script
+, testers
+, awscli
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "awscli";
-  version = "1.29.9"; # N.B: if you change this, change botocore and boto3 to a matching version too
+  version = "1.29.57"; # N.B: if you change this, change botocore and boto3 to a matching version too
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8SmOu79FZESL1Hd15wdd1m1Uewswqaum2y8LOZAl9P8=";
+    hash = "sha256-+xME5GiDitxn61yrIkiEByx/xeMeXMrVS2rifIX6Ci8=";
   };
 
-  # https://github.com/aws/aws-cli/issues/4837
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "docutils>=0.10,<0.17" "docutils>=0.10" \
-      --replace "colorama>=0.2.5,<0.4.5" "colorama>=0.2.5,<0.5" \
-      --replace "rsa>=3.1.2,<4.8" "rsa<5,>=3.1.2"
-  '';
 
   propagatedBuildInputs = with python3.pkgs; [
     botocore
@@ -44,10 +40,6 @@ python3.pkgs.buildPythonApplication rec {
     rm $out/bin/aws.cmd
   '';
 
-  passthru = {
-    python = python3; # for aws_shell
-  };
-
   doInstallCheck = true;
 
   installCheckPhase = ''
@@ -59,12 +51,25 @@ python3.pkgs.buildPythonApplication rec {
     runHook postInstallCheck
   '';
 
+  passthru = {
+    python = python3; # for aws_shell
+    updateScript = nix-update-script {
+      # Excludes 1.x versions from the Github tags list
+      extraArgs = [ "--version-regex" "^(1\.(.*))" ];
+    };
+    tests.version = testers.testVersion {
+      package = awscli;
+      command = "aws --version";
+      inherit version;
+    };
+  };
+
   meta = with lib; {
     homepage = "https://aws.amazon.com/cli/";
     changelog = "https://github.com/aws/aws-cli/blob/${version}/CHANGELOG.rst";
     description = "Unified tool to manage your AWS services";
     license = licenses.asl20;
     mainProgram = "aws";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ anthonyroussel ];
   };
 }
diff --git a/pkgs/tools/cd-dvd/sacd/default.nix b/pkgs/tools/cd-dvd/sacd/default.nix
index 963300c9ca11..948c51428402 100644
--- a/pkgs/tools/cd-dvd/sacd/default.nix
+++ b/pkgs/tools/cd-dvd/sacd/default.nix
@@ -17,8 +17,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     # Makefile prefix, otherwise `/usr` prefix is enforced
+    # https://github.com/Sound-Linux-More/sacd/pull/1
     (fetchpatch {
-      url = "https://github.com/Sound-Linux-More/sacd/pull/1.patch";
+      url = "https://github.com/Sound-Linux-More/sacd/commit/a72def4fab234bcd68b444cf7447a8876b4e2ce8.patch";
       name = "makefile-prefix.patch";
       sha256 = "0a7r4x0yqpg6l4vr84dq4wbrypabqm4vvcjv91am068gqjiw6w64";
     })
diff --git a/pkgs/tools/filesystems/bcachefs-tools/default.nix b/pkgs/tools/filesystems/bcachefs-tools/default.nix
index 81152d144aa9..8ea406a5f1f2 100644
--- a/pkgs/tools/filesystems/bcachefs-tools/default.nix
+++ b/pkgs/tools/filesystems/bcachefs-tools/default.nix
@@ -12,32 +12,29 @@
 , lz4
 , attr
 , udev
-, valgrind
 , nixosTests
 , fuse3
 , cargo
 , rustc
-, coreutils
 , rustPlatform
 , makeWrapper
 , fuseSupport ? false
 }:
 let
-  rev = "cfa816bf3f823a3bedfedd8e214ea929c5c755fe";
-in stdenv.mkDerivation {
+  rev = "6b175a022496572416918bd38d083120c23ba5f2";
+in
+stdenv.mkDerivation {
   pname = "bcachefs-tools";
-  version = "unstable-2023-06-28";
+  version = "unstable-2023-09-29";
+
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
     inherit rev;
-    hash = "sha256-XgXUwyZV5N8buYTuiu1Y1ZU3uHXjZ/OZ1kbZ9d6Rt5I=";
+    hash = "sha256-qC6Bq2zdO8Tj+bZbIUvcVBqvuKccqDEX3HIeOXsEloQ=";
   };
 
-  # errors on fsck_err function. Maybe miss-detection?
-  NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
-
   nativeBuildInputs = [
     pkg-config
     cargo
@@ -71,7 +68,6 @@ in stdenv.mkDerivation {
 
   doCheck = false; # needs bcachefs module loaded on builder
   checkFlags = [ "BCACHEFS_TEST_USE_VALGRIND=no" ];
-  nativeCheckInputs = [ valgrind ];
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
@@ -79,7 +75,7 @@ in stdenv.mkDerivation {
     "INITRAMFS_DIR=${placeholder "out"}/etc/initramfs-tools"
   ];
 
-  preCheck = lib.optionalString fuseSupport ''
+  preCheck = lib.optionalString (!fuseSupport) ''
     rm tests/test_fuse.py
   '';
 
@@ -88,11 +84,6 @@ in stdenv.mkDerivation {
     inherit (nixosTests.installer) bcachefsSimple bcachefsEncrypted bcachefsMulti;
   };
 
-  postFixup = ''
-    wrapProgram $out/bin/mount.bcachefs \
-      --prefix PATH : ${lib.makeBinPath [ coreutils ]}
-  '';
-
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/tools/misc/expect/default.nix b/pkgs/tools/misc/expect/default.nix
index 19ab5158a65b..e2457ad63e13 100644
--- a/pkgs/tools/misc/expect/default.nix
+++ b/pkgs/tools/misc/expect/default.nix
@@ -6,18 +6,29 @@ tcl.mkTclDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/expect/Expect/${version}/expect${version}.tar.gz";
-    sha256 = "0d1cp5hggjl93xwc8h1y6adbnrvpkk0ywkd00inz9ndxn21xm9s9";
+    hash = "sha256-Safag7C92fRtBKBN7sGcd2e7mjI+QMR4H4nK92C5LDQ=";
   };
 
   patches = [
     (fetchpatch {
       url = "https://raw.githubusercontent.com/buildroot/buildroot/c05e6aa361a4049eabd8b21eb64a34899ef83fc7/package/expect/0001-enable-cross-compilation.patch";
-      sha256 = "1jwx2l1slidvcpahxbyqs942l81jd62rzbxliyd9lwysk38c8b6b";
+      hash = "sha256-yyzE0Jjac5qaj7Svn4VpMiAqSNLYrw7VZbtFqgMVncs=";
     })
     (substituteAll {
       src = ./fix-cross-compilation.patch;
       tcl = "${buildPackages.tcl}/bin/tclsh";
     })
+    # The following patches fix compilation with clang 15+
+    (fetchpatch {
+      url = "https://sourceforge.net/p/expect/patches/24/attachment/0001-Add-prototype-to-function-definitions.patch";
+      hash = "sha256-X2Vv6VVM3KjmBHo2ukVWe5YTVXRmqe//Kw2kr73OpZs=";
+    })
+    (fetchpatch {
+      url = "https://sourceforge.net/p/expect/patches/_discuss/thread/b813ca9895/6759/attachment/expect-configure-c99.patch";
+      hash = "sha256-PxQQ9roWgVXUoCMxkXEgu+it26ES/JuzHF6oML/nk54=";
+    })
+    # Include `sys/ioctl.h` and `util.h` on Darwin, which are required for `ioctl` and `openpty`.
+    ./fix-darwin-clang16.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/tools/misc/expect/fix-darwin-clang16.patch b/pkgs/tools/misc/expect/fix-darwin-clang16.patch
new file mode 100644
index 000000000000..9454769c99c8
--- /dev/null
+++ b/pkgs/tools/misc/expect/fix-darwin-clang16.patch
@@ -0,0 +1,31 @@
+diff -ur a/exp_win.c b/exp_win.c
+--- a/exp_win.c	2018-02-02 14:15:52.000000000 -0500
++++ b/exp_win.c	2023-10-10 07:47:33.082690432 -0400
+@@ -39,7 +39,8 @@
+ /* Sigh.  On AIX 2.3, termios.h exists but does not define TIOCGWINSZ */
+ /* Instead, it has to come from ioctl.h.  However, As I said above, this */
+ /* can't be cavalierly included on all machines, even when it exists. */
+-#if defined(HAVE_TERMIOS) && !defined(HAVE_TIOCGWINSZ_IN_TERMIOS_H)
++/* Darwin also has termios.h, but it requires ioctl.h for `ioctl`. */
++#if defined(HAVE_TERMIOS) && (defined(__APPLE__) || !defined(HAVE_TIOCGWINSZ_IN_TERMIOS_H))
+ #  include <sys/ioctl.h>
+ #endif
+ 
+diff -ur d/pty_termios.c c/pty_termios.c
+--- d/pty_termios.c	2023-10-10 07:59:23.244452442 -0400
++++ c/pty_termios.c	2023-10-10 08:00:35.303231582 -0400
+@@ -7,7 +7,13 @@
+ 
+ */
+ 
+-#include <pty.h> /* openpty */
++/* openpty */
++#ifdef __APPLE__
++#include <util.h>
++#else /* pty.h is Linux-specific */
++#include <pty.h>
++#endif
++
+ #include <stdio.h>
+ #include <signal.h>
+ 
diff --git a/pkgs/tools/misc/xvfb-run/default.nix b/pkgs/tools/misc/xvfb-run/default.nix
index fc87723208ed..eb1e7c5b01b7 100644
--- a/pkgs/tools/misc/xvfb-run/default.nix
+++ b/pkgs/tools/misc/xvfb-run/default.nix
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation rec {
     chmod a+x $out/bin/xvfb-run
     patchShebangs $out/bin/xvfb-run
     wrapProgram $out/bin/xvfb-run \
-      --set FONTCONFIG_FILE "${fontsConf}" \
+      --set-default FONTCONFIG_FILE "${fontsConf}" \
       --prefix PATH : ${lib.makeBinPath [ getopt xorgserver xauth which util-linux gawk coreutils ]}
   '';
 
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index c99f09e7f93a..ad7cac085b4b 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, perl, nixosTests
+{ lib, stdenv, fetchurl, darwin, pkg-config, perl, nixosTests
 , brotliSupport ? false, brotli
 , c-aresSupport ? false, c-aresMinimal
 , gnutlsSupport ? false, gnutls
@@ -57,10 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-FsYqnErw9wPSi9pte783ukcFWtNBTXDexj4uYzbyqC0=";
   };
 
-  patches = [
-    ./7.79.1-darwin-no-systemconfiguration.patch
-  ];
-
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;
 
@@ -68,6 +64,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    CoreFoundation
+    CoreServices
+    SystemConfiguration
+  ]);
   nativeBuildInputs = [ pkg-config perl ];
 
   # Zlib and OpenSSL must be propagated because `libcurl.la' contains
diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index b23753e20412..43d2124d682b 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, nettle
-, libidn, libnetfilter_conntrack, buildPackages
+, libidn, libnetfilter_conntrack, nftables, buildPackages
 , dbusSupport ? stdenv.isLinux
 , dbus
 , nixosTests
@@ -13,6 +13,7 @@ let
     "-DHAVE_DBUS"
   ] ++ lib.optionals stdenv.isLinux [
     "-DHAVE_CONNTRACK"
+    "-DHAVE_NFTSET"
   ]);
 in
 stdenv.mkDerivation rec {
@@ -75,7 +76,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ nettle libidn ]
     ++ lib.optionals dbusSupport [ dbus ]
-    ++ lib.optionals stdenv.isLinux [ libnetfilter_conntrack ];
+    ++ lib.optionals stdenv.isLinux [ libnetfilter_conntrack nftables ];
 
   passthru.tests = {
     prometheus-exporter = nixosTests.prometheus-exporters.dnsmasq;
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index ebf56f3cc29d..6ee8c4928e02 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -57,11 +57,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "networkmanager";
-  version = "1.44.0";
+  version = "1.44.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/NetworkManager/${lib.versions.majorMinor version}/NetworkManager-${version}.tar.xz";
-    sha256 = "sha256-7coJY30YL4BrOxLYxWI9e629c8zKGuY74g0vKYd5+58=";
+    sha256 = "sha256-S1i/OsV+LO+1ZS79CUXrC0vDamPZKmGrRx2LssmkIOE=";
   };
 
   outputs = [ "out" "dev" "devdoc" "man" "doc" ];
diff --git a/pkgs/tools/package-management/ciel/default.nix b/pkgs/tools/package-management/ciel/default.nix
index 7ccd34c665dc..d6040c4a0763 100644
--- a/pkgs/tools/package-management/ciel/default.nix
+++ b/pkgs/tools/package-management/ciel/default.nix
@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage rec {
     # FIXME: remove this patch after https://github.com/AOSC-Dev/ciel-rs/pull/16 is merged
     (fetchpatch {
       name = "use-canonicalize-path-to-find-libexec.patch";
-      url = "https://github.com/AOSC-Dev/ciel-rs/pull/16.patch";
+      url = "https://github.com/AOSC-Dev/ciel-rs/commit/17f41538ed1057e855540f5abef7faf6ea4abf5c.patch";
       sha256 = "sha256-ELK2KpOuoBS774apomUIo8q1eXYs/FX895G7eBdgOQg=";
     })
   ];
diff --git a/pkgs/tools/security/certmgr/default.nix b/pkgs/tools/security/certmgr/default.nix
index e2318c853f11..da62e7d0568e 100644
--- a/pkgs/tools/security/certmgr/default.nix
+++ b/pkgs/tools/security/certmgr/default.nix
@@ -35,7 +35,9 @@ in
     # TODO: remove patch when PR is merged.
     patches = [
       (fetchpatch {
-        url    = "https://github.com/cloudflare/certmgr/pull/51.patch";
+        # https://github.com/cloudflare/certmgr/pull/51
+        name   = "cloudflare-certmgr-pull-51.patch";
+        url    = "https://github.com/cloudflare/certmgr/compare/232e0adf8379db28ab74c46e0dd3eddb3cd8f2ea...55c595a4a2dc871726b3c8337469daf5597718a3.patch";
         sha256 = "0jhsw159d2mgybvbbn6pmvj4yqr5cwcal5fjwkcn9m4f4zlb6qrs";
       })
     ];
diff --git a/pkgs/tools/security/ibm-sw-tpm2/default.nix b/pkgs/tools/security/ibm-sw-tpm2/default.nix
index 012d492aacad..de260e068249 100644
--- a/pkgs/tools/security/ibm-sw-tpm2/default.nix
+++ b/pkgs/tools/security/ibm-sw-tpm2/default.nix
@@ -1,4 +1,9 @@
-{ stdenv, fetchurl, lib, openssl }:
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, openssl
+}:
 
 stdenv.mkDerivation rec {
   pname = "ibm-sw-tpm2";
@@ -9,6 +14,18 @@ stdenv.mkDerivation rec {
     hash = "sha256-PLZC+HGheyPVCwRuX5X0ScIodBX8HnrrS9u4kg28s48=";
   };
 
+  patches = [
+    # Backport openssl-3.1 from development branch.
+    # Can be removed with next release.
+    (fetchpatch {
+      name = "openssl-3.1.patch";
+      url = "https://github.com/kgoldman/ibmswtpm2/commit/15501bf4973d334ca9420fa2fb0f0fe1800871e0.patch";
+      includes = [ "TpmToOsslMath.h" ];
+      stripLen = 1;
+      hash = "sha256-8TwyZVy8pQwq5Fl8cy9xJWtdckwL+QK0+DL5EHDLYUY=";
+    })
+  ];
+
   buildInputs = [ openssl ];
 
   sourceRoot = "src";
diff --git a/pkgs/tools/video/mjpegtools/c++-17-fixes.patch b/pkgs/tools/video/mjpegtools/c++-17-fixes.patch
new file mode 100644
index 000000000000..018cc7e9beab
--- /dev/null
+++ b/pkgs/tools/video/mjpegtools/c++-17-fixes.patch
@@ -0,0 +1,44 @@
+diff -ur a/mplex/main.cpp b/mplex/main.cpp
+--- a/mplex/main.cpp	2021-09-05 02:14:13.029372000 -0400
++++ b/mplex/main.cpp	2023-09-23 08:47:07.683450627 -0400
+@@ -50,7 +50,7 @@
+ #include "multiplexor.hpp"
+ 
+ 
+-using std::auto_ptr;
++using std::unique_ptr;
+ 
+ 
+ /*************************************************************************
+@@ -138,7 +138,7 @@
+ void 
+ FileOutputStream::NextSegment( )
+ {
+-    auto_ptr<char> prev_filename_buf( new char[strlen(cur_filename)+1] );
++    unique_ptr<char> prev_filename_buf( new char[strlen(cur_filename)+1] );
+     char *prev_filename = prev_filename_buf.get();
+ 	fclose(strm);
+ 	++segment_num;
+diff -ur a/utils/fastintfns.h b/utils/fastintfns.h
+--- a/utils/fastintfns.h	2021-09-05 02:14:13.033372000 -0400
++++ b/utils/fastintfns.h	2023-09-23 08:44:40.147112973 -0400
+@@ -2,12 +2,17 @@
+  *
+  * WARNING: Assumes 2's complement arithmetic.
+  */
+-static inline int intmax( register int x, register int y )
++#ifdef __cplusplus
++#define REGISTER
++#else
++#define REGISTER register
++#endif
++static inline int intmax( REGISTER int x, REGISTER int y )
+ {
+ 	return x < y ? y : x;
+ }
+ 
+-static inline int intmin( register int x, register int y )
++static inline int intmin( REGISTER int x, REGISTER int y )
+ {
+ 	return x < y ? x : y;
+ }
diff --git a/pkgs/tools/video/mjpegtools/default.nix b/pkgs/tools/video/mjpegtools/default.nix
index 675dfc109de1..f231d6ed184d 100644
--- a/pkgs/tools/video/mjpegtools/default.nix
+++ b/pkgs/tools/video/mjpegtools/default.nix
@@ -16,6 +16,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-sYBTbX2ZYLBeACOhl7ANyxAJKaSaq3HRnVX0obIQ9Jo=";
   };
 
+  # Clang 16 defaults to C++17. `std::auto_ptr` has been removed from C++17, and the
+  # `register` type class specifier is no longer allowed.
+  patches = [ ./c++-17-fixes.patch ];
+
   hardeningDisable = [ "format" ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/tools/wayland/chayang/default.nix b/pkgs/tools/wayland/chayang/default.nix
index ccfba6a0cf02..30780ed90a8b 100644
--- a/pkgs/tools/wayland/chayang/default.nix
+++ b/pkgs/tools/wayland/chayang/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  pkgsBuildBuild = [
+  depsBuildBuild = [
     pkg-config
   ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d399c8ee659c..6c2764c5e72b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -702,6 +702,9 @@ mapAliases ({
   prometheus-speedtest-exporter = throw "prometheus-speedtest-exporter was removed as unmaintained"; # Added 2023-07-31
   protobuf3_17 = throw "protobuf3_17 does not receive updates anymore and has been removed"; # Added 2023-05-21
   protobuf3_19 = throw "protobuf3_19 does not receive updates anymore and has been removed"; # Added 2023-10-01
+  protobuf3_24 = protobuf_24;
+  protobuf3_23 = protobuf_23;
+  protobuf3_21 = protobuf_21;
   protonup = protonup-ng; # Added 2022-11-06
   proxmark3-rrg = proxmark3; # Added 2023-07-25
   proxmark3-unstable = throw "removed in favor of rfidresearchgroup fork"; # Added 2023-07-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 637ef9e037b6..00d36466617a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -761,7 +761,7 @@ with pkgs;
   protoc-gen-go-vtproto = callPackage ../development/tools/protoc-gen-go-vtproto { };
 
   protoc-gen-grpc-web = callPackage ../development/tools/protoc-gen-grpc-web {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   protoc-gen-connect-go = callPackage ../development/tools/protoc-gen-connect-go { };
@@ -1085,7 +1085,7 @@ with pkgs;
     antlr = antlr4_10;
     boost = boost177; # Configure checks for specific version.
     icu =  icu69;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   mysql-shell-innovation = callPackage ../development/tools/mysql-shell/innovation.nix {
@@ -1094,7 +1094,7 @@ with pkgs;
     antlr = antlr4_10;
     boost = boost177; # Configure checks for specific version.
     icu =  icu69;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   broadlink-cli = callPackage ../tools/misc/broadlink-cli { };
@@ -2673,7 +2673,7 @@ with pkgs;
   gensgs = pkgsi686Linux.callPackage ../applications/emulators/gens-gs { };
 
   goldberg-emu = callPackage ../applications/emulators/goldberg-emu {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   gopsuinfo = callPackage ../tools/system/gopsuinfo { };
@@ -4159,7 +4159,7 @@ with pkgs;
   amoco = callPackage ../tools/security/amoco { };
 
   anbox = callPackage ../os-specific/linux/anbox {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   androidenv = callPackage ../development/mobile/androidenv { };
@@ -4707,7 +4707,7 @@ with pkgs;
   common-licenses = callPackage ../data/misc/common-licenses { };
 
   compactor = callPackage ../applications/networking/compactor {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   consul = callPackage ../servers/consul { };
@@ -5519,7 +5519,7 @@ with pkgs;
   ghdorker = callPackage ../tools/security/ghdorker { };
 
   ghidra = darwin.apple_sdk_11_0.callPackage ../tools/security/ghidra/build.nix {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   ghidra-bin = callPackage ../tools/security/ghidra { };
@@ -6839,7 +6839,7 @@ with pkgs;
   clementine = libsForQt5.callPackage ../applications/audio/clementine {
     gst_plugins =
       with gst_all_1; [ gst-plugins-base gst-plugins-good gst-plugins-ugly gst-libav ];
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   mellowplayer = libsForQt5.callPackage ../applications/audio/mellowplayer { };
@@ -7044,7 +7044,7 @@ with pkgs;
 
     mozc = callPackage ../tools/inputmethods/ibus-engines/ibus-mozc {
       stdenv = clangStdenv;
-      protobuf = pkgs.protobuf3_21.overrideDerivation (_: { stdenv = clangStdenv; });
+      protobuf = pkgs.protobuf_21.overrideDerivation (_: { stdenv = clangStdenv; });
     };
 
     openbangla-keyboard = libsForQt5.callPackage ../applications/misc/openbangla-keyboard { withIbusSupport = true; };
@@ -10242,7 +10242,7 @@ with pkgs;
 
   netdata = callPackage ../tools/system/netdata {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation IOKit;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
   netdataCloud = netdata.override {
     withCloud = !stdenv.isDarwin;
@@ -11388,7 +11388,7 @@ with pkgs;
   nq = callPackage ../tools/system/nq { };
 
   nsjail = callPackage ../tools/security/nsjail {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   nss_pam_ldapd = callPackage ../tools/networking/nss-pam-ldapd { };
@@ -11518,7 +11518,7 @@ with pkgs;
   oh-my-zsh = callPackage ../shells/zsh/oh-my-zsh { };
 
   ola = callPackage ../applications/misc/ola {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   olive-editor = qt6Packages.callPackage ../applications/video/olive-editor {
@@ -11791,7 +11791,7 @@ with pkgs;
   p3x-onenote = callPackage ../applications/office/p3x-onenote { };
 
   p4c = callPackage ../development/compilers/p4c {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   p7zip = callPackage ../tools/archivers/p7zip { };
@@ -11891,7 +11891,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
     boost = boost177; # Configure checks for specific version.
     icu = icu69;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
   percona-xtrabackup = percona-xtrabackup_8_0;
   percona-xtrabackup_8_0 = callPackage ../tools/backup/percona-xtrabackup/8_0.nix {
@@ -15190,7 +15190,7 @@ with pkgs;
   zasm = callPackage ../development/compilers/zasm { };
 
   zbackup = callPackage ../tools/backup/zbackup {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   zbar = libsForQt5.callPackage ../tools/graphics/zbar {
@@ -16669,10 +16669,10 @@ with pkgs;
     # This returns the minimum supported version for the platform. The
     # assumption is that or any later version is good.
     choose = platform:
-      /**/ if platform.isDarwin then 11
+      /**/ if platform.isDarwin then 16
       else if platform.isFreeBSD then 12
       else if platform.isAndroid then 12
-      else if platform.isLinux then 11
+      else if platform.isLinux then 16
       else if platform.isWasm then 12
       else 14;
     # We take the "max of the mins". Why? Since those are lower bounds of the
@@ -16956,11 +16956,11 @@ with pkgs;
     inherit (darwin) apple_sdk;
   };
 
-  rust_1_72 = callPackage ../development/compilers/rust/1_72.nix {
+  rust_1_73 = callPackage ../development/compilers/rust/1_73.nix {
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     llvm_16 = llvmPackages_16.libllvm;
   };
-  rust = rust_1_72;
+  rust = rust_1_73;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
@@ -16968,8 +16968,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  rustPackages_1_72 = rust_1_72.packages.stable;
-  rustPackages = rustPackages_1_72;
+  rustPackages_1_73 = rust_1_73.packages.stable;
+  rustPackages = rustPackages_1_73;
 
   inherit (rustPackages) cargo cargo-auditable cargo-auditable-cargo-wrapper clippy rustc rustPlatform;
 
@@ -18058,9 +18058,9 @@ with pkgs;
     inherit (darwin) libobjc;
   };
 
-  inherit (darwin.apple_sdk_11_0.callPackage ../development/interpreters/ruby {
+  inherit (callPackage ../development/interpreters/ruby {
     inherit (darwin) libobjc libunwind;
-    inherit (darwin.apple_sdk_11_0.frameworks) Foundation;
+    inherit (darwin.apple_sdk.frameworks) Foundation;
   })
     mkRubyVersion
     mkRuby
@@ -18198,9 +18198,9 @@ with pkgs;
   # Needed for autogen
   guile_2_0 = callPackage ../development/interpreters/guile/2.0.nix { };
 
-  guile_2_2 = darwin.apple_sdk_11_0.callPackage ../development/interpreters/guile/2.2.nix { };
+  guile_2_2 = callPackage ../development/interpreters/guile/2.2.nix { };
 
-  guile_3_0 = darwin.apple_sdk_11_0.callPackage ../development/interpreters/guile/3.0.nix { };
+  guile_3_0 = callPackage ../development/interpreters/guile/3.0.nix { };
 
   guile = guile_3_0;
 
@@ -20137,12 +20137,12 @@ with pkgs;
   };
 
   spoofer = callPackage ../tools/networking/spoofer {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   spoofer-gui = callPackage ../tools/networking/spoofer {
     withGUI = true;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   spooles = callPackage ../development/libraries/science/math/spooles { };
@@ -20885,7 +20885,7 @@ with pkgs;
   cmrt = callPackage ../development/libraries/cmrt { };
 
   codecserver = callPackage ../applications/audio/codecserver {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   coeurl = callPackage ../development/libraries/coeurl { };
@@ -21397,7 +21397,7 @@ with pkgs;
   gallia = callPackage ../tools/security/gallia { };
 
   gamenetworkingsockets = callPackage ../development/libraries/gamenetworkingsockets {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   game-music-emu = callPackage ../development/libraries/audio/game-music-emu { };
@@ -21776,7 +21776,16 @@ with pkgs;
 
   grilo-plugins = callPackage ../development/libraries/grilo-plugins { };
 
-  grpc = callPackage ../development/libraries/grpc { };
+  grpc = callPackage ../development/libraries/grpc {
+    stdenv = if (stdenv.isDarwin && stdenv.isx86_64) then
+      # Work around Clang check for 10.13 when using aligned allocations with C++17.
+      stdenv.override (old: {
+        hostPlatform = old.hostPlatform // { darwinMinVersion = "10.13"; };
+        buildPlatform = old.buildPlatform // { darwinMinVersion = "10.13"; };
+        targetPlatform = old.targetPlatform // { darwinMinVersion = "10.13"; };
+      })
+      else stdenv;
+  };
 
   gsettings-qt = libsForQt5.callPackage ../development/libraries/gsettings-qt { };
 
@@ -23415,7 +23424,7 @@ with pkgs;
   libptytty = callPackage ../development/libraries/libptytty { };
 
   libpulsar = callPackage ../development/libraries/libpulsar {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   libpwquality = callPackage ../development/libraries/libpwquality {
@@ -24424,7 +24433,8 @@ with pkgs;
 
   inherit (callPackages ../development/libraries/openssl { })
     openssl_1_1
-    openssl_3;
+    openssl_3
+    openssl_3_1;
 
   opensubdiv = callPackage ../development/libraries/opensubdiv { };
 
@@ -24580,13 +24590,14 @@ with pkgs;
 
   prospector = callPackage ../development/tools/prospector { };
 
-  protobuf = protobuf3_24;
+  protobuf = protobuf_24;
 
-  protobuf3_24 = callPackage ../development/libraries/protobuf/3.24.nix { };
-  protobuf3_23 = callPackage ../development/libraries/protobuf/3.23.nix { };
-  protobuf3_21 = callPackage ../development/libraries/protobuf/3.21.nix {
+  protobuf_24 = callPackage ../development/libraries/protobuf/24.nix { };
+  protobuf_23 = callPackage ../development/libraries/protobuf/23.nix { };
+  protobuf_21 = callPackage ../development/libraries/protobuf/21.nix {
     abseil-cpp = abseil-cpp_202103;
   };
+
   protobuf3_20 = callPackage ../development/libraries/protobuf/3.20.nix {
     abseil-cpp = abseil-cpp_202103;
   };
@@ -24760,7 +24771,7 @@ with pkgs;
   qm-dsp = callPackage ../development/libraries/audio/qm-dsp { };
 
   qradiolink = callPackage ../applications/radio/qradiolink {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   qrupdate = callPackage ../development/libraries/qrupdate { };
@@ -25440,7 +25451,7 @@ with pkgs;
 
   valhalla = callPackage ../development/libraries/valhalla {
     boost = boost.override { enablePython = true; python = python38; };
-    protobuf = protobuf3_21.override {
+    protobuf = protobuf_21.override {
       abseil-cpp = abseil-cpp_202103.override {
         cxxStandard = "17";
       };
@@ -26970,7 +26981,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
     boost = boost177; # Configure checks for specific version.
     icu = icu69;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   mysql_jdbc = callPackage ../servers/sql/mysql/jdbc { };
@@ -27259,7 +27270,7 @@ with pkgs;
   rethinkdb = callPackage ../servers/nosql/rethinkdb {
     stdenv = clangStdenv;
     libtool = darwin.cctools;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   rippled = callPackage ../servers/rippled {
@@ -28699,7 +28710,7 @@ with pkgs;
   sgx-ssl = callPackage ../os-specific/linux/sgx/ssl { };
 
   sgx-psw = callPackage ../os-specific/linux/sgx/psw {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   shadow = callPackage ../os-specific/linux/shadow { };
@@ -30465,7 +30476,7 @@ with pkgs;
 
   astroid = callPackage ../applications/networking/mailreaders/astroid {
     vim = vim-full.override { features = "normal"; };
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   aucatctl = callPackage ../applications/audio/aucatctl { };
@@ -32490,7 +32501,7 @@ with pkgs;
   };
 
   hyperion-ng = libsForQt5.callPackage ../applications/video/hyperion-ng {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   hyperledger-fabric = callPackage ../tools/misc/hyperledger-fabric { };
@@ -33987,14 +33998,14 @@ with pkgs;
       avahi = avahi-compat;
       pulseSupport = config.pulseaudio or false;
       iceSupport = config.murmur.iceSupport or true;
-      protobuf = protobuf3_21;
+      protobuf = protobuf_21;
     }).murmur;
 
   mumble = (callPackages ../applications/networking/mumble {
       avahi = avahi-compat;
       jackSupport = config.mumble.jackSupport or false;
       speechdSupport = config.mumble.speechdSupport or false;
-      protobuf = protobuf3_21;
+      protobuf = protobuf_21;
     }).mumble;
 
   mumble_overlay = callPackage ../applications/networking/mumble/overlay.nix {
@@ -34122,7 +34133,7 @@ with pkgs;
   osm2pgsql = callPackage ../tools/misc/osm2pgsql { };
 
   ostinato = libsForQt5.callPackage ../applications/networking/ostinato {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   p4 = callPackage ../applications/version-management/p4 {
@@ -34231,7 +34242,7 @@ with pkgs;
 
   shogun = callPackage ../applications/science/machine-learning/shogun {
     opencv = opencv3;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   smplayer = libsForQt5.callPackage ../applications/video/smplayer { };
@@ -34596,7 +34607,7 @@ with pkgs;
   osmo-sip-connector = callPackage ../servers/osmocom/osmo-sip-connector { };
 
   osmscout-server = libsForQt5.callPackage ../applications/misc/osmscout-server {
-    protobuf = protobuf3_21.override {
+    protobuf = protobuf_21.override {
       abseil-cpp = abseil-cpp_202103.override {
         cxxStandard = "17";
       };
@@ -35115,7 +35126,7 @@ with pkgs;
   rgp = libsForQt5.callPackage ../development/tools/rgp { };
 
   ricochet = libsForQt5.callPackage ../applications/networking/instant-messengers/ricochet {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   ries = callPackage ../applications/science/math/ries { };
@@ -35438,7 +35449,7 @@ with pkgs;
 
   curaengine = callPackage ../applications/misc/curaengine {
     inherit (python3.pkgs) libarcus;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   cura = libsForQt5.callPackage ../applications/misc/cura { };
@@ -35827,7 +35838,7 @@ with pkgs;
   tijolo = callPackage ../applications/editors/tijolo { };
 
   tilemaker = callPackage ../applications/misc/tilemaker {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   timbreid = callPackage ../applications/audio/pd-plugins/timbreid {
@@ -37027,11 +37038,11 @@ with pkgs;
 
   bitcoin-abc  = libsForQt5.callPackage ../applications/blockchains/bitcoin-abc {
     withGui = true;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
   bitcoind-abc = callPackage ../applications/blockchains/bitcoin-abc {
     mkDerivation = stdenv.mkDerivation;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
     withGui = false;
   };
 
@@ -37602,7 +37613,7 @@ with pkgs;
   ckan = callPackage ../games/ckan { };
 
   cockatrice = libsForQt5.callPackage ../games/cockatrice {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   commandergenius = callPackage ../games/commandergenius { };
@@ -38195,12 +38206,12 @@ with pkgs;
   pong3d = callPackage ../games/pong3d { };
 
   pokerth = libsForQt5.callPackage ../games/pokerth {
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   pokerth-server = libsForQt5.callPackage ../games/pokerth {
     target = "server";
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
   };
 
   pokete = callPackage ../games/pokete { };
@@ -39285,7 +39296,7 @@ with pkgs;
 
   or-tools = callPackage ../development/libraries/science/math/or-tools {
     python = python3;
-    protobuf = protobuf3_21;
+    protobuf = protobuf_21;
     # or-tools builds with -std=c++20, so abseil-cpp must
     # also be built that way
     abseil-cpp = abseil-cpp_202206.override {
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index ed049340332c..78ad5271ef9f 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -13,6 +13,11 @@ let
   # default.
   targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
                                         (stdenv.targetPlatform.config + "-");
+
+  # Bootstrap `fetchurl` needed to build SDK packages without causing an infinite recursion.
+  fetchurlBoot = import ../build-support/fetchurl/boot.nix {
+    inherit (stdenv) system;
+  };
 in
 
 makeScopeWithSplicing' {
@@ -32,10 +37,13 @@ makeScopeWithSplicing' {
   apple_sdk_10_12 = pkgs.callPackage ../os-specific/darwin/apple-sdk {
     inherit (buildPackages.darwin) print-reexports;
     inherit (self) darwin-stubs;
+    fetchurl = fetchurlBoot;
   };
 
   # macOS 11.0 SDK
-  apple_sdk_11_0 = pkgs.callPackage ../os-specific/darwin/apple-sdk-11.0 { };
+  apple_sdk_11_0 = pkgs.callPackage ../os-specific/darwin/apple-sdk-11.0 {
+    fetchurl = fetchurlBoot;
+  };
 
   # Pick an SDK
   apple_sdk = if stdenv.hostPlatform.isAarch64 then apple_sdk_11_0 else apple_sdk_10_12;
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index d796fa7164d0..28526297f5dd 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -195,15 +195,9 @@ in {
 
     linux_testing_bcachefs = callPackage ../os-specific/linux/kernel/linux-testing-bcachefs.nix {
       # Pinned on the last version which Kent's commits can be cleany rebased up.
-      kernel = callPackage ../os-specific/linux/kernel/mainline.nix {
-        branch = "6.4";
-      };
-      kernelPatches = [
-        kernelPatches.bridge_stp_helper
-        kernelPatches.request_key_helper
-        kernelPatches.dell_xps_regression
-      ];
-    };
+      kernel = linux_6_5;
+      kernelPatches = linux_6_5.kernelPatches;
+   };
 
     # Using zenKernels like this due lqx&zen came from one source, but may have different base kernel version
     # https://github.com/NixOS/nixpkgs/pull/161773#discussion_r820134708
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index bf18ff41cd24..dfad261388c4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2482,10 +2482,10 @@ self: super: with self; {
   cython = callPackage ../development/python-modules/Cython { };
 
   cython_3 = self.cython.overridePythonAttrs (old: rec {
-    version = "3.0.2";
+    version = "3.0.3";
     src = old.src.override {
       inherit version;
-      hash = "sha256-lZSBjcqLsirmWAxSItorxcwyM0NQvS0pSgDYZpvMYbU=";
+      hash = "sha256-MnMJMBsB9ynxc6lFEcsigMh7oDyJ7UKOiPkT93gkUDA=";
     };
     patches = [ ];
   });
@@ -6108,7 +6108,7 @@ self: super: with self; {
   };
 
   libarcus = callPackage ../development/python-modules/libarcus {
-    protobuf = pkgs.protobuf3_21;
+    protobuf = pkgs.protobuf_21;
   };
 
   libasyncns = callPackage ../development/python-modules/libasyncns {
@@ -9537,11 +9537,11 @@ self: super: with self; {
   # Protobuf 4.x
   protobuf = callPackage ../development/python-modules/protobuf {
     # If a protobuf upgrade causes many Python packages to fail, please pin it here to the previous version.
-    inherit (pkgs) protobuf;
+    protobuf = pkgs.protobuf;
   };
 
   # Protobuf 3.x
-  protobuf3 = callPackage ../development/python-modules/protobuf {
+  protobuf3 = callPackage ../development/python-modules/protobuf/3.nix {
     protobuf = pkgs.protobuf3_20;
   };