about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--nixos/modules/services/desktops/pipewire/pipewire.nix182
-rw-r--r--pkgs/applications/audio/ncspot/default.nix6
-rw-r--r--pkgs/applications/audio/noson/default.nix4
-rw-r--r--pkgs/applications/blockchains/clightning/default.nix4
-rw-r--r--pkgs/applications/blockchains/optimism/geth.nix6
-rw-r--r--pkgs/applications/editors/okteta/default.nix4
-rw-r--r--pkgs/applications/misc/sway-contrib/default.nix (renamed from pkgs/applications/window-managers/sway/contrib.nix)0
-rw-r--r--pkgs/applications/networking/cluster/terraform/default.nix6
-rw-r--r--pkgs/applications/networking/p2p/tribler/default.nix2
-rw-r--r--pkgs/applications/science/misc/root/default.nix18
-rw-r--r--pkgs/applications/science/misc/root/sw_vers.patch13
-rw-r--r--pkgs/applications/video/filebot/default.nix4
-rw-r--r--pkgs/applications/video/mpv/scripts/buildLua.nix1
-rw-r--r--pkgs/applications/virtualization/podman/default.nix4
-rw-r--r--pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch6
-rw-r--r--pkgs/by-name/as/asn1editor/package.nix37
-rw-r--r--pkgs/by-name/i3/i3-open-next-ws/package.nix24
-rw-r--r--pkgs/by-name/mo/mommy/package.nix4
-rw-r--r--pkgs/by-name/my/mystmd/package.nix6
-rw-r--r--pkgs/by-name/no/noto-fonts/package.nix4
-rw-r--r--pkgs/by-name/sw/sway-assign-cgroups/package.nix (renamed from pkgs/applications/window-managers/sway/assign-cgroups.nix)2
-rw-r--r--pkgs/by-name/sw/sway-unwrapped/fix-paths.patch (renamed from pkgs/applications/window-managers/sway/fix-paths.patch)0
-rw-r--r--pkgs/by-name/sw/sway-unwrapped/load-configuration-from-etc.patch (renamed from pkgs/applications/window-managers/sway/load-configuration-from-etc.patch)0
-rw-r--r--pkgs/by-name/sw/sway-unwrapped/package.nix (renamed from pkgs/applications/window-managers/sway/default.nix)5
-rw-r--r--pkgs/by-name/sw/sway-unwrapped/sway-config-nixos-paths.patch (renamed from pkgs/applications/window-managers/sway/sway-config-nixos-paths.patch)0
-rw-r--r--pkgs/by-name/sw/sway-unwrapped/sway-config-no-nix-store-references.patch (renamed from pkgs/applications/window-managers/sway/sway-config-no-nix-store-references.patch)0
-rw-r--r--pkgs/by-name/sw/sway/package.nix (renamed from pkgs/applications/window-managers/sway/wrapper.nix)6
-rw-r--r--pkgs/by-name/sw/swaybg/package.nix (renamed from pkgs/applications/window-managers/sway/bg.nix)0
-rw-r--r--pkgs/by-name/sw/swaycons/package.nix (renamed from pkgs/applications/window-managers/sway/swaycons.nix)0
-rw-r--r--pkgs/by-name/sw/swayest-workstyle/package.nix (renamed from pkgs/applications/window-managers/sway/swayest-workstyle/default.nix)0
-rw-r--r--pkgs/by-name/sw/swayfx-unwrapped/package.nix (renamed from pkgs/applications/window-managers/sway/fx.nix)25
-rw-r--r--pkgs/by-name/sw/swayfx/package.nix26
-rw-r--r--pkgs/by-name/sw/swayidle/package.nix (renamed from pkgs/applications/window-managers/sway/idle.nix)0
-rw-r--r--pkgs/by-name/sw/swaylock-effects/package.nix (renamed from pkgs/applications/window-managers/sway/lock-effects.nix)0
-rw-r--r--pkgs/by-name/sw/swaylock-fancy/package.nix (renamed from pkgs/applications/window-managers/sway/lock-fancy.nix)0
-rw-r--r--pkgs/by-name/sw/swaylock/package.nix (renamed from pkgs/applications/window-managers/sway/lock.nix)0
-rw-r--r--pkgs/by-name/sw/swayosd/package.nix (renamed from pkgs/applications/window-managers/sway/osd.nix)0
-rw-r--r--pkgs/by-name/sw/swayosd/swayosd_systemd_paths.patch (renamed from pkgs/applications/window-managers/sway/swayosd_systemd_paths.patch)0
-rw-r--r--pkgs/by-name/sw/swayws/package.nix (renamed from pkgs/applications/window-managers/sway/ws.nix)0
-rw-r--r--pkgs/by-name/sw/swayws/ws-update-Cargo-lock.patch (renamed from pkgs/applications/window-managers/sway/ws-update-Cargo-lock.patch)0
-rw-r--r--pkgs/by-name/sw/swaywsr/package.nix (renamed from pkgs/applications/window-managers/sway/wsr.nix)0
-rw-r--r--pkgs/by-name/wl/wl-gammarelay-rs/package.nix27
-rw-r--r--pkgs/development/interpreters/evcxr/default.nix6
-rw-r--r--pkgs/development/libraries/libatomic_ops/default.nix4
-rw-r--r--pkgs/development/libraries/rapidcheck/default.nix38
-rw-r--r--pkgs/development/python-modules/awkward-cpp/default.nix4
-rw-r--r--pkgs/development/python-modules/awkward/default.nix4
-rw-r--r--pkgs/development/python-modules/coffea/default.nix7
-rw-r--r--pkgs/development/python-modules/dask-awkward/default.nix4
-rw-r--r--pkgs/development/python-modules/dask-yarn/default.nix13
-rw-r--r--pkgs/development/python-modules/dask/default.nix4
-rw-r--r--pkgs/development/python-modules/distributed/default.nix4
-rw-r--r--pkgs/development/python-modules/patool/default.nix4
-rw-r--r--pkgs/development/python-modules/uproot/default.nix34
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/default.nix2
-rw-r--r--pkgs/os-specific/linux/nix-ld/default.nix8
-rw-r--r--pkgs/servers/minio/default.nix6
-rw-r--r--pkgs/servers/monitoring/telegraf/default.nix6
-rw-r--r--pkgs/servers/tailscale/default.nix4
-rw-r--r--pkgs/servers/web-apps/engelsystem/default.nix4
-rw-r--r--pkgs/shells/murex/default.nix4
-rw-r--r--pkgs/tools/X11/xdg-utils/default.nix2
-rw-r--r--pkgs/tools/archivers/unzip/default.nix2
-rw-r--r--pkgs/tools/archivers/zpaq/default.nix2
-rw-r--r--pkgs/tools/audio/liquidsoap/full.nix4
-rw-r--r--pkgs/tools/compression/zsync/default.nix2
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix11
-rw-r--r--pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch17
-rw-r--r--pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch26
-rw-r--r--pkgs/tools/graphics/zbar/default.nix12
-rw-r--r--pkgs/tools/networking/ockam/default.nix6
-rw-r--r--pkgs/tools/package-management/nix/common.nix2
-rw-r--r--pkgs/top-level/all-packages.nix23
73 files changed, 474 insertions, 221 deletions
diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
index 04ac415c177c..da409030b3a3 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -4,6 +4,8 @@
 with lib;
 
 let
+  json = pkgs.formats.json {};
+  mapToFiles = location: config: concatMapAttrs (name: value: { "pipewire/${location}.conf.d/${name}.conf".source = json.generate "${name}" value;}) config;
   cfg = config.services.pipewire;
   enable32BitAlsaPlugins = cfg.alsa.support32Bit
                            && pkgs.stdenv.isx86_64
@@ -72,15 +74,140 @@ in {
           https://github.com/PipeWire/pipewire/blob/master/NEWS
         '';
       };
+
+      extraConfig = {
+        pipewire = mkOption {
+          type = lib.types.attrsOf json.type;
+          default = {};
+          example = {
+            "10-clock-rate" = {
+              "context.properties" = {
+                "default.clock.rate" = 44100;
+              };
+            };
+            "11-no-upmixing" = {
+              "stream.properties" = {
+                "channelmix.upmix" = false;
+              };
+            };
+          };
+          description = lib.mdDoc ''
+            Additional configuration for the PipeWire server.
+
+            Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/pipewire.conf.d`.
+
+            See `man pipewire.conf` for details, and [the PipeWire wiki][wiki] for examples.
+
+            See also:
+            - [PipeWire wiki - virtual devices][wiki-virtual-device] for creating virtual devices or remapping channels
+            - [PipeWire wiki - filter-chain][wiki-filter-chain] for creating more complex processing pipelines
+            - [PipeWire wiki - network][wiki-network] for streaming audio over a network
+
+            [wiki]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-PipeWire
+            [wiki-virtual-device]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Virtual-Devices
+            [wiki-filter-chain]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Filter-Chain
+            [wiki-network]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Network
+          '';
+        };
+        client = mkOption {
+          type = lib.types.attrsOf json.type;
+          default = {};
+          example = {
+            "10-no-resample" = {
+              "stream.properties" = {
+                "resample.disable" = true;
+              };
+            };
+          };
+          description = lib.mdDoc ''
+            Additional configuration for the PipeWire client library, used by most applications.
+
+            Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/client.conf.d`.
+
+            See the [PipeWire wiki][wiki] for examples.
+
+            [wiki]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-client
+          '';
+        };
+        client-rt = mkOption {
+          type = lib.types.attrsOf json.type;
+          default = {};
+          example = {
+            "10-alsa-linear-volume" = {
+              "alsa.properties" = {
+                "alsa.volume-method" = "linear";
+              };
+            };
+          };
+          description = lib.mdDoc ''
+            Additional configuration for the PipeWire client library, used by real-time applications and legacy ALSA clients.
+
+            Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/client-rt.conf.d`.
+
+            See the [PipeWire wiki][wiki] for examples of general configuration, and [PipeWire wiki - ALSA][wiki-alsa] for ALSA clients.
+
+            [wiki]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-client
+            [wiki-alsa]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-ALSA
+          '';
+        };
+        jack = mkOption {
+          type = lib.types.attrsOf json.type;
+          default = {};
+          example = {
+            "20-hide-midi" = {
+              "jack.properties" = {
+                "jack.show-midi" = false;
+              };
+            };
+          };
+          description = lib.mdDoc ''
+            Additional configuration for the PipeWire JACK server and client library.
+
+            Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/jack.conf.d`.
+
+            See the [PipeWire wiki][wiki] for examples.
+
+            [wiki]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-JACK
+          '';
+        };
+        pipewire-pulse = mkOption {
+          type = lib.types.attrsOf json.type;
+          default = {};
+          example = {
+            "15-force-s16-info" = {
+              "pulse.rules" = [{
+                matches = [
+                  { "application.process.binary" = "my-broken-app"; }
+                ];
+                actions = {
+                  quirks = [ "force-s16-info" ];
+                };
+              }];
+            };
+          };
+          description = lib.mdDoc ''
+            Additional configuration for the PipeWire PulseAudio server.
+
+            Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/pipewire-pulse.conf.d`.
+
+            See `man pipewire-pulse.conf` for details, and [the PipeWire wiki][wiki] for examples.
+
+            See also:
+            - [PipeWire wiki - PulseAudio tricks guide][wiki-tricks] for more examples.
+
+            [wiki]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-PulseAudio
+            [wiki-tricks]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Guide-PulseAudio-Tricks
+          '';
+        };
+      };
     };
   };
 
   imports = [
     (lib.mkRemovedOptionModule ["services" "pipewire" "config"] ''
-      Overriding default Pipewire configuration through NixOS options never worked correctly and is no longer supported.
-      Please create drop-in files in /etc/pipewire/pipewire.conf.d/ to make the desired setting changes instead.
+      Overriding default PipeWire configuration through NixOS options never worked correctly and is no longer supported.
+      Please create drop-in configuration files via `services.pipewire.extraConfig` instead.
     '')
-
     (lib.mkRemovedOptionModule ["services" "pipewire" "media-session"] ''
       pipewire-media-session is no longer supported upstream and has been removed.
       Please switch to `services.pipewire.wireplumber` instead.
@@ -133,26 +260,35 @@ in {
     services.udev.packages = [ cfg.package ];
 
     # If any paths are updated here they must also be updated in the package test.
-    environment.etc."alsa/conf.d/49-pipewire-modules.conf" = mkIf cfg.alsa.enable {
-      text = ''
-        pcm_type.pipewire {
-          libs.native = ${cfg.package}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;
-          ${optionalString enable32BitAlsaPlugins
-            "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;"}
-        }
-        ctl_type.pipewire {
-          libs.native = ${cfg.package}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;
-          ${optionalString enable32BitAlsaPlugins
-            "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;"}
-        }
-      '';
-    };
-    environment.etc."alsa/conf.d/50-pipewire.conf" = mkIf cfg.alsa.enable {
-      source = "${cfg.package}/share/alsa/alsa.conf.d/50-pipewire.conf";
-    };
-    environment.etc."alsa/conf.d/99-pipewire-default.conf" = mkIf cfg.alsa.enable {
-      source = "${cfg.package}/share/alsa/alsa.conf.d/99-pipewire-default.conf";
-    };
+    environment.etc = {
+      "alsa/conf.d/49-pipewire-modules.conf" = mkIf cfg.alsa.enable {
+        text = ''
+          pcm_type.pipewire {
+            libs.native = ${cfg.package}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;
+            ${optionalString enable32BitAlsaPlugins
+              "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;"}
+          }
+          ctl_type.pipewire {
+            libs.native = ${cfg.package}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;
+            ${optionalString enable32BitAlsaPlugins
+              "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;"}
+          }
+        '';
+      };
+
+      "alsa/conf.d/50-pipewire.conf" = mkIf cfg.alsa.enable {
+        source = "${cfg.package}/share/alsa/alsa.conf.d/50-pipewire.conf";
+      };
+
+      "alsa/conf.d/99-pipewire-default.conf" = mkIf cfg.alsa.enable {
+        source = "${cfg.package}/share/alsa/alsa.conf.d/99-pipewire-default.conf";
+      };
+    }
+    // mapToFiles "pipewire" cfg.extraConfig.pipewire
+    // mapToFiles "client" cfg.extraConfig.client
+    // mapToFiles "client-rt" cfg.extraConfig.client-rt
+    // mapToFiles "jack" cfg.extraConfig.jack
+    // mapToFiles "pipewire-pulse" cfg.extraConfig.pipewire-pulse;
 
     environment.sessionVariables.LD_LIBRARY_PATH =
       lib.mkIf cfg.jack.enable [ "${cfg.package.jack}/lib" ];
diff --git a/pkgs/applications/audio/ncspot/default.nix b/pkgs/applications/audio/ncspot/default.nix
index f98f45a1b5cb..553e50f16654 100644
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
-  version = "0.13.4";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
     rev = "v${version}";
-    hash = "sha256-pYPUYy/ODzg9HN0/PTGZkV1NFBPmluhEwoJjYuZ6DTg=";
+    hash = "sha256-NHrpJC6cF/YAcyqZ4bRQdSdjDNhkEV7U2P/S4LSADao=";
   };
 
-  cargoHash = "sha256-FdXk6SzW0f3jkTfxMd8TMzfJGTRaZjG4qp56yHqDAuw=";
+  cargoHash = "sha256-HT084XewXwZByL5KZhyymqU7sy99SAjYIWysm3qGvWU=";
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optional withClipboard python3;
diff --git a/pkgs/applications/audio/noson/default.nix b/pkgs/applications/audio/noson/default.nix
index fb37c93e10fe..b8d29af7abdf 100644
--- a/pkgs/applications/audio/noson/default.nix
+++ b/pkgs/applications/audio/noson/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "noson";
-  version = "5.6.0";
+  version = "5.6.3";
 
   src = fetchFromGitHub {
     owner = "janbar";
     repo = "noson-app";
     rev = finalAttrs.version;
-    hash = "sha256-ZOAnH7pdhlTbqHOM0kiCWcHYJvnskigWdz3N9WjtM0M=";
+    hash = "sha256-Yv5p9yAEhJHm9ZDZlR76z10oGBNpdifR7ITXcAHIb54=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/blockchains/clightning/default.nix b/pkgs/applications/blockchains/clightning/default.nix
index d4fa4c68fe26..efedeb55cb1a 100644
--- a/pkgs/applications/blockchains/clightning/default.nix
+++ b/pkgs/applications/blockchains/clightning/default.nix
@@ -22,11 +22,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "clightning";
-  version = "23.11";
+  version = "23.11.1";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    sha256 = "sha256:1q1plg9qhwlrcvljnrv8yd1gaz9a98pxgql7bqxjq37vk3lfggw6";
+    sha256 = "sha256-PH5vNaQWUP9liKOiNXJnYPWn6LPBw6+XfT4KvcXb4Kk=";
   };
 
   # when building on darwin we need dawin.cctools to provide the correct libtool
diff --git a/pkgs/applications/blockchains/optimism/geth.nix b/pkgs/applications/blockchains/optimism/geth.nix
index a028c8e85844..66a446d526ad 100644
--- a/pkgs/applications/blockchains/optimism/geth.nix
+++ b/pkgs/applications/blockchains/optimism/geth.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "op-geth";
-  version = "1.101304.0";
+  version = "1.101304.2";
 
   src = fetchFromGitHub {
     owner = "ethereum-optimism";
     repo = "op-geth";
     rev = "v${version}";
-    hash = "sha256-MpLkAAYQmceabVChixF1yqvGSoRm+A9p9mOeKHhqxQE=";
+    hash = "sha256-cGCgcwP/9xSpVo2UJAArptF5KEflo7SSdfg5WYUMuxY=";
     fetchSubmodules = true;
   };
 
@@ -33,7 +33,7 @@ buildGoModule rec {
     "cmd/utils"
   ];
 
-  vendorHash = "sha256-JIuS2qWFf9g5MIJP6jVTSAkPG15XCDeMHcoYeJQz7Og=";
+  vendorHash = "sha256-F0OANE4S7WJDYKpJ6mCnR38CPyOov0Hxc0gK1MGHcIg=";
 
   # Fix for usb-related segmentation faults on darwin
   propagatedBuildInputs =
diff --git a/pkgs/applications/editors/okteta/default.nix b/pkgs/applications/editors/okteta/default.nix
index 72ff8ae5d605..3b20e5c815d5 100644
--- a/pkgs/applications/editors/okteta/default.nix
+++ b/pkgs/applications/editors/okteta/default.nix
@@ -4,11 +4,11 @@
 
 mkDerivation rec {
   pname = "okteta";
-  version = "0.26.13";
+  version = "0.26.14";
 
   src = fetchurl {
     url = "mirror://kde/stable/okteta/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "0wlpv0rk4ys4rbcpf8lqpkm0yr5dxkaz60qk2lvm27w1s489ir8l";
+    sha256 = "sha256-2bvspG3lecKlcN/+YPRmFKQCu/jhckafeSo272iE+9k=";
   };
 
   nativeBuildInputs = [ qtscript extra-cmake-modules kdoctools ];
diff --git a/pkgs/applications/window-managers/sway/contrib.nix b/pkgs/applications/misc/sway-contrib/default.nix
index df5ad07b1c5a..df5ad07b1c5a 100644
--- a/pkgs/applications/window-managers/sway/contrib.nix
+++ b/pkgs/applications/misc/sway-contrib/default.nix
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 9937359dd497..df62730e0bb9 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -167,9 +167,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.6.5";
-    hash = "sha256-TJKs7pWoLFIeov/ERgPqZxPtbjSAHrHI2wrSEXUAS1A=";
-    vendorHash = "sha256-QHfCGlgOv4v3MzUs4JxIHytcyymUYmnk4Z0smgak1Mg=";
+    version = "1.6.6";
+    hash = "sha256-fYFmHypzSbSgut9Wij6Sz8xR97DVOwPLQap6pan7IRA=";
+    vendorHash = "sha256-fQsxTX1v8HsMDIkofeCVfNitJAaTWHwppC7DniXlvT4=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;
diff --git a/pkgs/applications/networking/p2p/tribler/default.nix b/pkgs/applications/networking/p2p/tribler/default.nix
index b4fba4b9197e..fc8377a4d113 100644
--- a/pkgs/applications/networking/p2p/tribler/default.nix
+++ b/pkgs/applications/networking/p2p/tribler/default.nix
@@ -95,6 +95,8 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share/applications $out/share/icons
     cp $out/build/debian/tribler/usr/share/applications/org.tribler.Tribler.desktop $out/share/applications/
     cp $out/build/debian/tribler/usr/share/pixmaps/tribler_big.xpm $out/share/icons/tribler.xpm
+    mkdir -p $out/share/copyright/tribler
+    mv $out/LICENSE $out/share/copyright/tribler
   '';
 
   shellHook = ''
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index 9fe06f6d7969..ee3610c5f6f6 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -58,7 +58,7 @@
 
 stdenv.mkDerivation rec {
   pname = "root";
-  version = "6.28.10";
+  version = "6.30.02";
 
   passthru = {
     tests = import ./tests { inherit callPackage; };
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    hash = "sha256-adb962B+ayC9AsdX+mIXAkwLYTLB6bHf9Nhdmiu35R4=";
+    hash = "sha256-eWWkVtGtHuDV/kdpv1qP7Cka9oTtk9sPMICpw2JDUYM=";
   };
 
   nativeBuildInputs = [ makeWrapper cmake pkg-config git ];
@@ -110,6 +110,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./sw_vers.patch
+
+    # Fix for builtin_llvm=OFF
+    # https://github.com/root-project/root/pull/14238
+    (fetchpatch {
+      url = "https://github.com/root-project/root/commit/1477d3adebf27a19f3a8b85f21c27a0a5649c7ff.diff";
+      hash = "sha256-g+FqXBTWXA7t7F/rMarnmOK2014oCNnNJbHhjH+Tvjw=";
+    })
   ];
 
   preConfigure = ''
@@ -121,7 +128,7 @@ stdenv.mkDerivation rec {
     substituteInPlace cmake/modules/SearchInstalledSoftware.cmake \
       --replace 'set(lcgpackages ' '#set(lcgpackages '
 
-    substituteInPlace interpreter/llvm/src/tools/clang/tools/driver/CMakeLists.txt \
+    substituteInPlace interpreter/llvm-project/clang/tools/driver/CMakeLists.txt \
       --replace 'add_clang_symlink(''${link} clang)' ""
 
     # Don't require textutil on macOS
@@ -136,8 +143,8 @@ stdenv.mkDerivation rec {
     substituteInPlace rootx/src/rootx.cxx --replace "gNoLogo = false" "gNoLogo = true"
   '' + lib.optionalString stdenv.isDarwin ''
     # Eliminate impure reference to /System/Library/PrivateFrameworks
-    substituteInPlace core/CMakeLists.txt \
-      --replace "-F/System/Library/PrivateFrameworks" ""
+    substituteInPlace core/macosx/CMakeLists.txt \
+      --replace "-F/System/Library/PrivateFrameworks " ""
   '' + lib.optionalString (stdenv.isDarwin && lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
     MACOSX_DEPLOYMENT_TARGET=10.16
   '';
@@ -184,6 +191,7 @@ stdenv.mkDerivation rec {
     "-Dsqlite=OFF"
     "-Dssl=ON"
     "-Dtmva=ON"
+    "-Dtmva-pymva=OFF"
     "-Dvdt=OFF"
     "-Dwebgui=ON"
     "-Dxml=ON"
diff --git a/pkgs/applications/science/misc/root/sw_vers.patch b/pkgs/applications/science/misc/root/sw_vers.patch
index 836bbb5b17a4..54ad1091392e 100644
--- a/pkgs/applications/science/misc/root/sw_vers.patch
+++ b/pkgs/applications/science/misc/root/sw_vers.patch
@@ -1,8 +1,8 @@
 diff a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
 --- a/cmake/modules/SetUpMacOS.cmake
 +++ b/cmake/modules/SetUpMacOS.cmake
-@@ -28,17 +28,10 @@ if(CMAKE_VERSION VERSION_LESS 3.14.4)
- endif()
+@@ -8,17 +8,10 @@
+ set(ROOT_PLATFORM macosx)
  
  if (CMAKE_SYSTEM_NAME MATCHES Darwin)
 -  EXECUTE_PROCESS(COMMAND sw_vers "-productVersion"
@@ -19,7 +19,7 @@ diff a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
      #TODO: check haveconfig and rpath -> set rpath true
      #TODO: check Thread, define link command
      #TODO: more stuff check configure script
-@@ -57,22 +50,7 @@ if (CMAKE_SYSTEM_NAME MATCHES Darwin)
+@@ -37,22 +30,7 @@
         SET(CMAKE_SHARED_LIBRARY_CREATE_CXX_FLAGS "${CMAKE_SHARED_LIBRARY_CREATE_CXX_FLAGS} -m64")
         SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -m64")
         SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -m64")
@@ -42,7 +42,7 @@ diff a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
  
    if (CMAKE_COMPILER_IS_GNUCXX)
       SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -pipe -W -Wshadow -Wall -Woverloaded-virtual -fsigned-char -fno-common")
-@@ -130,7 +108,6 @@ if (CMAKE_SYSTEM_NAME MATCHES Darwin)
+@@ -96,7 +74,6 @@
    endif()
  
    #---Set Linker flags----------------------------------------------------------------------
@@ -53,7 +53,7 @@ diff a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
 diff a/config/root-config.in b/config/root-config.in
 --- a/config/root-config.in
 +++ b/config/root-config.in
-@@ -312,12 +312,6 @@ macosxicc)
+@@ -307,12 +307,6 @@
     ;;
  macosx64|macosxarm64)
     # MacOS X with gcc (GNU cc v4.x) in 64 bit mode
@@ -66,7 +66,7 @@ diff a/config/root-config.in b/config/root-config.in
     auxcflags="${cxxversionflag} -m64"
     auxldflags="-m64"
     auxlibs="-lm -ldl"
-@@ -378,18 +372,11 @@ freebsd* | openbsd* | linux*)
+@@ -387,17 +381,11 @@
     done
     ;;
  macosx*)
@@ -74,7 +74,6 @@ diff a/config/root-config.in b/config/root-config.in
        auxcflags="-pthread $auxcflags"
        auxlibs="-lpthread $auxlibs"
 -   else
--      auxcflags="-D_REENTRANT $auxcflags"
 -      auxlibs="-lpthread $auxlibs"
 -   fi
     for f in $features ; do
diff --git a/pkgs/applications/video/filebot/default.nix b/pkgs/applications/video/filebot/default.nix
index e38b4dde3d29..fd779bf0bf81 100644
--- a/pkgs/applications/video/filebot/default.nix
+++ b/pkgs/applications/video/filebot/default.nix
@@ -10,11 +10,11 @@ let
   };
 in stdenv.mkDerivation (finalAttrs: {
   pname = "filebot";
-  version = "5.1.1";
+  version = "5.1.2";
 
   src = fetchurl {
     url = "https://web.archive.org/web/20230917142929/https://get.filebot.net/filebot/FileBot_${finalAttrs.version}/FileBot_${finalAttrs.version}-portable.tar.xz";
-    hash = "sha256-BCsZBRtT2Ka7WZw7WFnagwoJwIO1L3qpFk/6nlGdpmQ=";
+    hash = "sha256-+5I0t67asbCwaMCuqI/ixRHNAdcLTziuYOfepVThoPk=";
   };
 
   unpackPhase = "tar xvf $src";
diff --git a/pkgs/applications/video/mpv/scripts/buildLua.nix b/pkgs/applications/video/mpv/scripts/buildLua.nix
index c7f510253f94..37690d987430 100644
--- a/pkgs/applications/video/mpv/scripts/buildLua.nix
+++ b/pkgs/applications/video/mpv/scripts/buildLua.nix
@@ -2,7 +2,6 @@
 , stdenvNoCC }:
 
 let
-  inherit (lib) hasPrefix hasSuffix removeSuffix;
   escapedList = with lib; concatMapStringsSep " " (s: "'${escape [ "'" ] s}'");
   fileName = pathStr: lib.last (lib.splitString "/" pathStr);
   scriptsDir = "$out/share/mpv/scripts";
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 8841abcd3671..b714db0bd62a 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -62,13 +62,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "4.7.2";
+  version = "4.8.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-o5FTCuFUbTlENqvh+u6fPEfD816tKWPxHu2yhBi/Mf0=";
+    hash = "sha256-EDIgipbv8Z7nVV6VQ5IAmvHvvpLyGEDHMDnwhMUm/BQ=";
   };
 
   patches = [
diff --git a/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch b/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
index 5663f5e8a018..179ce41f02b2 100644
--- a/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
+++ b/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
@@ -1,5 +1,5 @@
 diff --git a/pkg/machine/machine_common.go b/pkg/machine/machine_common.go
-index 649748947..a981d93bf 100644
+index 4e43dd54c..a981d93bf 100644
 --- a/pkg/machine/machine_common.go
 +++ b/pkg/machine/machine_common.go
 @@ -127,14 +127,6 @@ address can't be used by podman. `
@@ -7,10 +7,10 @@ index 649748947..a981d93bf 100644
  				if len(helper) < 1 {
  					fmt.Print(fmtString)
 -				} else {
--					fmtString += `If you would like to install it run the\nfollowing commands:
+-					fmtString += `If you would like to install it, run the following commands:
 -
 -        sudo %s install
--        podman machine stop%[1]s; podman machine start%[1]s
+-        podman machine stop%[2]s; podman machine start%[2]s
 -
 -                `
 -					fmt.Printf(fmtString, helper, suffix)
diff --git a/pkgs/by-name/as/asn1editor/package.nix b/pkgs/by-name/as/asn1editor/package.nix
new file mode 100644
index 000000000000..a85d8f53fe6d
--- /dev/null
+++ b/pkgs/by-name/as/asn1editor/package.nix
@@ -0,0 +1,37 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "asn1editor";
+  version = "0.8.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "Futsch1";
+    repo = "asn1editor";
+    rev = "v${version}";
+    hash = "sha256-mgluhC2DMS4OyS/BoWqBdVf7GcxquOtOKTHZ/hbiHQM=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    asn1tools
+    coverage
+    wxPython_4_2
+  ];
+
+  pythonImportsCheck = [ "asn1editor" ];
+
+  # Tests fail in sandbox, e.g.
+  # "SystemExit: Unable to access the X Display, is $DISPLAY set properly?"
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Python based editor for ASN.1 encoded data";
+    homepage = "https://github.com/Futsch1/asn1editor";
+    license = licenses.mit;
+    mainProgram = "asn1editor";
+    maintainers = with maintainers; [ bjornfor ];
+  };
+}
diff --git a/pkgs/by-name/i3/i3-open-next-ws/package.nix b/pkgs/by-name/i3/i3-open-next-ws/package.nix
new file mode 100644
index 000000000000..129f170dd28e
--- /dev/null
+++ b/pkgs/by-name/i3/i3-open-next-ws/package.nix
@@ -0,0 +1,24 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "i3-open-next-ws";
+  version = "0.1.5";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-eYHCm8jEv6Ll6/h1kcYHNxWGnVWI41ZB96Jec9oZFsY=";
+  };
+  cargoHash = "sha256-9U0bYCbkvcZJOCd4jZog4bSJkP1ntmAFjWm7lJDdcuo=";
+
+  meta = {
+    description = "A workspace management utility for i3 and sway, that picks the first unused workspace automagically";
+    homepage = "https://github.com/JohnDowson/i3-open-next-ws";
+    license = lib.licenses.mit;
+    mainProgram = "i3-open-next-ws";
+    maintainers = with lib.maintainers; [quantenzitrone];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/mo/mommy/package.nix b/pkgs/by-name/mo/mommy/package.nix
index 24e83eef6d09..d7bdbb1a383c 100644
--- a/pkgs/by-name/mo/mommy/package.nix
+++ b/pkgs/by-name/mo/mommy/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mommy";
-  version = "1.2.4";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "FWDekker";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-SqWhbhQeRUO0cD9Fv/nwKjTI3F0Sg2VhFZtrbyA9Wb4=";
+    hash = "sha256-5mf157hjDE/9YcLsThjadkknuEfPZS8Pp6mtNCWbvEw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/my/mystmd/package.nix b/pkgs/by-name/my/mystmd/package.nix
index 79fbff2f2b07..3fc3880220f9 100644
--- a/pkgs/by-name/my/mystmd/package.nix
+++ b/pkgs/by-name/my/mystmd/package.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "mystmd";
-  version = "1.1.31";
+  version = "1.1.36";
 
   src = fetchFromGitHub {
     owner = "executablebooks";
     repo = "mystmd";
     rev = "mystmd@${version}";
-    hash = "sha256-1zjz1HJxa8ww02MnqravCWM51bpuSpnLxn34Kazbt5o=";
+    hash = "sha256-mmrNfE8d5yhWU7KsSBKuRpP59Ba6Q6pdkCN2AE+PEJE=";
   };
 
-  npmDepsHash = "sha256-7H3VKJAzbsKLhyFD7MoASsOyJwbt6vERO6LM2mpz/y0=";
+  npmDepsHash = "sha256-5ns2mVD8YJvVMpMq9VeelAoGU0b9SLNIOdRAHXpnCDM=";
 
   dontNpmInstall = true;
 
diff --git a/pkgs/by-name/no/noto-fonts/package.nix b/pkgs/by-name/no/noto-fonts/package.nix
index 4f8606095e02..2d47e7ee64ab 100644
--- a/pkgs/by-name/no/noto-fonts/package.nix
+++ b/pkgs/by-name/no/noto-fonts/package.nix
@@ -18,13 +18,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "noto-fonts${suffix}";
-  version = "23.11.1";
+  version = "23.12.1";
 
   src = fetchFromGitHub {
     owner = "notofonts";
     repo = "notofonts.github.io";
     rev = "noto-monthly-release-${version}";
-    hash = "sha256-qBHLCOfVBOn9CV194S4cYw9nhHyAe2AUBJHQMvyEfW8=";
+    hash = "sha256-Hmw6yGFbnxgKMdKjQCQzuVl+pFCVxbJrT3sGntXUPgk=";
   };
 
   _variants = map (variant: builtins.replaceStrings [ " " ] [ "" ] variant) variants;
diff --git a/pkgs/applications/window-managers/sway/assign-cgroups.nix b/pkgs/by-name/sw/sway-assign-cgroups/package.nix
index c6029de3ee80..c420a32cf37b 100644
--- a/pkgs/applications/window-managers/sway/assign-cgroups.nix
+++ b/pkgs/by-name/sw/sway-assign-cgroups/package.nix
@@ -4,7 +4,7 @@
 }:
 
 python3Packages.buildPythonApplication rec {
-  pname = "assign-cgroups";
+  pname = "sway-assign-cgroups";
   version = "0.4.0";
   src = fetchFromGitHub {
     owner = "alebastr";
diff --git a/pkgs/applications/window-managers/sway/fix-paths.patch b/pkgs/by-name/sw/sway-unwrapped/fix-paths.patch
index c52f65b146b7..c52f65b146b7 100644
--- a/pkgs/applications/window-managers/sway/fix-paths.patch
+++ b/pkgs/by-name/sw/sway-unwrapped/fix-paths.patch
diff --git a/pkgs/applications/window-managers/sway/load-configuration-from-etc.patch b/pkgs/by-name/sw/sway-unwrapped/load-configuration-from-etc.patch
index 46a170abc04a..46a170abc04a 100644
--- a/pkgs/applications/window-managers/sway/load-configuration-from-etc.patch
+++ b/pkgs/by-name/sw/sway-unwrapped/load-configuration-from-etc.patch
diff --git a/pkgs/applications/window-managers/sway/default.nix b/pkgs/by-name/sw/sway-unwrapped/package.nix
index 38fa09e86f70..452925beeabb 100644
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/by-name/sw/sway-unwrapped/package.nix
@@ -2,7 +2,7 @@
 , meson, ninja, pkg-config, wayland-scanner, scdoc
 , libGL, wayland, libxkbcommon, pcre2, json_c, libevdev
 , pango, cairo, libinput, gdk-pixbuf, librsvg
-, wlroots, wayland-protocols, libdrm
+, wlroots_0_16, wayland-protocols, libdrm
 , nixosTests
 # Used by the NixOS module:
 , isNixOS ? false
@@ -11,6 +11,9 @@
 , trayEnabled ? systemdSupport
 }:
 
+let
+  wlroots = wlroots_0_16;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sway-unwrapped";
   version = "1.8.1";
diff --git a/pkgs/applications/window-managers/sway/sway-config-nixos-paths.patch b/pkgs/by-name/sw/sway-unwrapped/sway-config-nixos-paths.patch
index bbb0f722b8bc..bbb0f722b8bc 100644
--- a/pkgs/applications/window-managers/sway/sway-config-nixos-paths.patch
+++ b/pkgs/by-name/sw/sway-unwrapped/sway-config-nixos-paths.patch
diff --git a/pkgs/applications/window-managers/sway/sway-config-no-nix-store-references.patch b/pkgs/by-name/sw/sway-unwrapped/sway-config-no-nix-store-references.patch
index 009c12959430..009c12959430 100644
--- a/pkgs/applications/window-managers/sway/sway-config-no-nix-store-references.patch
+++ b/pkgs/by-name/sw/sway-unwrapped/sway-config-no-nix-store-references.patch
diff --git a/pkgs/applications/window-managers/sway/wrapper.nix b/pkgs/by-name/sw/sway/package.nix
index 7510e1e9582b..3e9ed51613f8 100644
--- a/pkgs/applications/window-managers/sway/wrapper.nix
+++ b/pkgs/by-name/sw/sway/package.nix
@@ -31,8 +31,10 @@ let
        exec ${lib.optionalString dbusSupport "${dbus}/bin/dbus-run-session"} ${lib.getExe sway} "$@"
      fi
    '';
-in symlinkJoin {
-  name = "${sway.meta.mainProgram}-${sway.version}";
+in symlinkJoin rec {
+  pname = lib.replaceStrings ["-unwrapped"] [""] sway.pname;
+  inherit (sway) version;
+  name = "${pname}-${version}";
 
   paths = (optional withBaseWrapper baseWrapper)
     ++ [ sway ];
diff --git a/pkgs/applications/window-managers/sway/bg.nix b/pkgs/by-name/sw/swaybg/package.nix
index aa5d12cdfc4f..aa5d12cdfc4f 100644
--- a/pkgs/applications/window-managers/sway/bg.nix
+++ b/pkgs/by-name/sw/swaybg/package.nix
diff --git a/pkgs/applications/window-managers/sway/swaycons.nix b/pkgs/by-name/sw/swaycons/package.nix
index c990a2bb5186..c990a2bb5186 100644
--- a/pkgs/applications/window-managers/sway/swaycons.nix
+++ b/pkgs/by-name/sw/swaycons/package.nix
diff --git a/pkgs/applications/window-managers/sway/swayest-workstyle/default.nix b/pkgs/by-name/sw/swayest-workstyle/package.nix
index 2867db53f371..2867db53f371 100644
--- a/pkgs/applications/window-managers/sway/swayest-workstyle/default.nix
+++ b/pkgs/by-name/sw/swayest-workstyle/package.nix
diff --git a/pkgs/applications/window-managers/sway/fx.nix b/pkgs/by-name/sw/swayfx-unwrapped/package.nix
index d8ca9cfb7f48..b49496f1383d 100644
--- a/pkgs/applications/window-managers/sway/fx.nix
+++ b/pkgs/by-name/sw/swayfx-unwrapped/package.nix
@@ -1,7 +1,25 @@
-{ fetchFromGitHub, lib, sway-unwrapped }:
+{
+  lib,
+  fetchFromGitHub,
+  sway-unwrapped,
+  stdenv,
+  systemd,
+  # Used by the NixOS module:
+  isNixOS ? false,
+  enableXWayland ? true,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  trayEnabled ? systemdSupport,
+}:
 
-sway-unwrapped.overrideAttrs (oldAttrs: rec {
-  pname = "swayfx";
+(sway-unwrapped.override {
+  inherit
+    isNixOS
+    enableXWayland
+    systemdSupport
+    trayEnabled
+    ;
+}).overrideAttrs (oldAttrs: rec {
+  pname = "swayfx-unwrapped";
   version = "0.3.2";
 
   src = fetchFromGitHub {
@@ -23,7 +41,6 @@ sway-unwrapped.overrideAttrs (oldAttrs: rec {
       (patch: !builtins.elem (patch.name or null) removePatches)
       (oldAttrs.patches or [ ]);
 
-
   meta = with lib; {
     description = "Sway, but with eye candy!";
     homepage = "https://github.com/WillPower3309/swayfx";
diff --git a/pkgs/by-name/sw/swayfx/package.nix b/pkgs/by-name/sw/swayfx/package.nix
new file mode 100644
index 000000000000..9583f9b7a710
--- /dev/null
+++ b/pkgs/by-name/sw/swayfx/package.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  swayfx-unwrapped,
+  sway,
+  # Used by the NixOS module:
+  withBaseWrapper ? true,
+  extraSessionCommands ? "",
+  withGtkWrapper ? false,
+  extraOptions ? [ ], # E.g.: [ "--verbose" ]
+  isNixOS ? false,
+  enableXWayland ? true,
+  dbusSupport ? true,
+}:
+
+sway.override {
+  inherit
+    withBaseWrapper
+    extraSessionCommands
+    withGtkWrapper
+    extraOptions
+    isNixOS
+    enableXWayland
+    dbusSupport
+    ;
+  sway-unwrapped = swayfx-unwrapped;
+}
diff --git a/pkgs/applications/window-managers/sway/idle.nix b/pkgs/by-name/sw/swayidle/package.nix
index 0ee08dc7ca1d..0ee08dc7ca1d 100644
--- a/pkgs/applications/window-managers/sway/idle.nix
+++ b/pkgs/by-name/sw/swayidle/package.nix
diff --git a/pkgs/applications/window-managers/sway/lock-effects.nix b/pkgs/by-name/sw/swaylock-effects/package.nix
index c5dbf3766f06..c5dbf3766f06 100644
--- a/pkgs/applications/window-managers/sway/lock-effects.nix
+++ b/pkgs/by-name/sw/swaylock-effects/package.nix
diff --git a/pkgs/applications/window-managers/sway/lock-fancy.nix b/pkgs/by-name/sw/swaylock-fancy/package.nix
index 83d56def4dcc..83d56def4dcc 100644
--- a/pkgs/applications/window-managers/sway/lock-fancy.nix
+++ b/pkgs/by-name/sw/swaylock-fancy/package.nix
diff --git a/pkgs/applications/window-managers/sway/lock.nix b/pkgs/by-name/sw/swaylock/package.nix
index 0b438df13d28..0b438df13d28 100644
--- a/pkgs/applications/window-managers/sway/lock.nix
+++ b/pkgs/by-name/sw/swaylock/package.nix
diff --git a/pkgs/applications/window-managers/sway/osd.nix b/pkgs/by-name/sw/swayosd/package.nix
index b2a7b17b4315..b2a7b17b4315 100644
--- a/pkgs/applications/window-managers/sway/osd.nix
+++ b/pkgs/by-name/sw/swayosd/package.nix
diff --git a/pkgs/applications/window-managers/sway/swayosd_systemd_paths.patch b/pkgs/by-name/sw/swayosd/swayosd_systemd_paths.patch
index 189c761e9d36..189c761e9d36 100644
--- a/pkgs/applications/window-managers/sway/swayosd_systemd_paths.patch
+++ b/pkgs/by-name/sw/swayosd/swayosd_systemd_paths.patch
diff --git a/pkgs/applications/window-managers/sway/ws.nix b/pkgs/by-name/sw/swayws/package.nix
index 999581153ac9..999581153ac9 100644
--- a/pkgs/applications/window-managers/sway/ws.nix
+++ b/pkgs/by-name/sw/swayws/package.nix
diff --git a/pkgs/applications/window-managers/sway/ws-update-Cargo-lock.patch b/pkgs/by-name/sw/swayws/ws-update-Cargo-lock.patch
index e1d7614e8bfa..e1d7614e8bfa 100644
--- a/pkgs/applications/window-managers/sway/ws-update-Cargo-lock.patch
+++ b/pkgs/by-name/sw/swayws/ws-update-Cargo-lock.patch
diff --git a/pkgs/applications/window-managers/sway/wsr.nix b/pkgs/by-name/sw/swaywsr/package.nix
index 23a82bd2df08..23a82bd2df08 100644
--- a/pkgs/applications/window-managers/sway/wsr.nix
+++ b/pkgs/by-name/sw/swaywsr/package.nix
diff --git a/pkgs/by-name/wl/wl-gammarelay-rs/package.nix b/pkgs/by-name/wl/wl-gammarelay-rs/package.nix
new file mode 100644
index 000000000000..b406e1466408
--- /dev/null
+++ b/pkgs/by-name/wl/wl-gammarelay-rs/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "wl-gammarelay-rs";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "MaxVerevkin";
+    repo = "wl-gammarelay-rs";
+    rev = "v${version}";
+    hash = "sha256-md6e9nRCs6TZarwFD3/GQEoJSIhtdq++rIZTP7Vl0wQ=";
+  };
+
+  cargoHash = "sha256-TDP5RC7B7/ldpK22WsmXd6fSl2rHtvG0hP9NYzoEVYo=";
+
+  meta = {
+    description = "A simple program that provides DBus interface to control display temperature and brightness under wayland without flickering";
+    homepage = "https://github.com/MaxVerevkin/wl-gammarelay-rs";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "wl-gammarelay-rs";
+    maintainers = with lib.maintainers; [quantenzitrone];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/development/interpreters/evcxr/default.nix b/pkgs/development/interpreters/evcxr/default.nix
index 7b1a9b8b0835..0cb4bef01669 100644
--- a/pkgs/development/interpreters/evcxr/default.nix
+++ b/pkgs/development/interpreters/evcxr/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "evcxr";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "evcxr";
     rev = "v${version}";
-    sha256 = "sha256-TQG0YNwD3WU50fftFv5nGUK9ucxDXYnbQVv8Dewhwm8=";
+    sha256 = "sha256-6gSJJ3ptqpYydjg+xf5Pz3iTk0D+bkC6N79OeiKxPHY=";
   };
 
-  cargoHash = "sha256-F2CduT0/vjoVHua5WshYxsxf4P0QBa+BjFVp7iTsFkU=";
+  cargoHash = "sha256-MRoEFP7VXBNBe6/e3ezPnzhKACwqTApGH9c0T4ycvg4=";
 
   RUST_SRC_PATH = "${rustPlatform.rustLibSrc}";
 
diff --git a/pkgs/development/libraries/libatomic_ops/default.nix b/pkgs/development/libraries/libatomic_ops/default.nix
index ae15c6236aa2..e7170953d0ca 100644
--- a/pkgs/development/libraries/libatomic_ops/default.nix
+++ b/pkgs/development/libraries/libatomic_ops/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libatomic_ops";
-  version = "7.8.0";
+  version = "7.8.2";
 
   src = fetchurl {
     urls = [
       "http://www.ivmaisoft.com/_bin/atomic_ops/libatomic_ops-${version}.tar.gz"
       "https://github.com/ivmai/libatomic_ops/releases/download/v${version}/libatomic_ops-${version}.tar.gz"
     ];
-    sha256 = "sha256-FWdudnThG9paflCnP02efWBFInG4rPb9Oacf79+J+jE=";
+    sha256 = "sha256-0wUgf+IH8rP7XLTAGdoStEzj/LxZPf1QgNhnsaJBm1E=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/rapidcheck/default.nix b/pkgs/development/libraries/rapidcheck/default.nix
index fe94f5dce959..68f2e5e096a8 100644
--- a/pkgs/development/libraries/rapidcheck/default.nix
+++ b/pkgs/development/libraries/rapidcheck/default.nix
@@ -3,40 +3,48 @@
 , fetchFromGitHub
 , cmake
 , unstableGitUpdater
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rapidcheck";
-  version = "unstable-2023-04-16";
+  version = "unstable-2023-12-14";
 
   src = fetchFromGitHub {
     owner = "emil-e";
     repo  = "rapidcheck";
-    rev   = "a5724ea5b0b00147109b0605c377f1e54c353ba2";
-    hash = "sha256-nq2VBDREkAOnvtdYr3m0TYNXx7mv9hbV5HZFVL2uTTg=";
+    rev   = "ff6af6fc683159deb51c543b065eba14dfcf329b";
+    hash = "sha256-Ixz5RpY0n8Un/Pv4XoTfbs40+70iyMbkQUjDqoLaWOg=";
   };
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "RC_INSTALL_ALL_EXTRAS" true)
   ];
 
-  # Install the extras headers
-  postInstall = ''
-    cp -r $src/extras $out
-    chmod -R +w $out/extras
-    rm $out/extras/CMakeLists.txt
-    rm $out/extras/**/CMakeLists.txt
-  '';
-
-  passthru.updateScript = unstableGitUpdater { };
+  passthru = {
+    updateScript = unstableGitUpdater { };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
 
   meta = with lib; {
     description = "A C++ framework for property based testing inspired by QuickCheck";
-    inherit (src.meta) homepage;
+    inherit (finalAttrs.src.meta) homepage;
     maintainers = with maintainers; [ ];
     license = licenses.bsd2;
+    pkgConfigModules = [
+      "rapidcheck"
+      # Extras
+      "rapidcheck_boost"
+      "rapidcheck_boost_test"
+      "rapidcheck_catch"
+      "rapidcheck_doctest"
+      "rapidcheck_gtest"
+    ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/python-modules/awkward-cpp/default.nix b/pkgs/development/python-modules/awkward-cpp/default.nix
index 2c3bd96fcf22..476888d1b1a0 100644
--- a/pkgs/development/python-modules/awkward-cpp/default.nix
+++ b/pkgs/development/python-modules/awkward-cpp/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "awkward-cpp";
-  version = "26";
+  version = "27";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-o3wI+JEmtjfUczRUob8/KLGNn3lH0h3GuhIDfYg7HGY=";
+    hash = "sha256-PBllGL/M5wl2bWOHgEExekkUti+Ag+Gj4DtP1upvPI0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/awkward/default.nix b/pkgs/development/python-modules/awkward/default.nix
index da217b4496bb..12a4593bbd2d 100644
--- a/pkgs/development/python-modules/awkward/default.nix
+++ b/pkgs/development/python-modules/awkward/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "awkward";
-  version = "2.4.10";
+  version = "2.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "scikit-hep";
     repo = "awkward";
     rev = "refs/tags/v${version}";
-    hash = "sha256-D+bgKI6olK3smgnRdACvd0gYMWvS6ao6f7nQh3YExXw=";
+    hash = "sha256-lfeoWTmK/VNm3uFLHmIPO4r9aZPK3NhgDwio5WN4jqU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/coffea/default.nix b/pkgs/development/python-modules/coffea/default.nix
index 47f98327cb37..ab10055187d0 100644
--- a/pkgs/development/python-modules/coffea/default.nix
+++ b/pkgs/development/python-modules/coffea/default.nix
@@ -31,20 +31,19 @@
 
 buildPythonPackage rec {
   pname = "coffea";
-  version = "2023.10.0.rc1";
+  version = "2023.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CoffeaTeam";
     repo = "coffea";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1mfTuZDfkD0NjcmSoXN3BLC5o+dWvw+r65ukZTZf8j4=";
+    hash = "sha256-Xlud3ibdI4UnoHe72NPc7WQojuWPpXtncENDinYgk4o=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "numba>=0.58.0" "numba" \
-      --replace "numpy>=1.22.0,<1.26" "numpy"
+      --replace "numba>=0.58.1" "numba"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dask-awkward/default.nix b/pkgs/development/python-modules/dask-awkward/default.nix
index 39ae8e5ddcad..c07cd8d6db5a 100644
--- a/pkgs/development/python-modules/dask-awkward/default.nix
+++ b/pkgs/development/python-modules/dask-awkward/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dask-awkward";
-  version = "2023.11.2";
+  version = "2023.12.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "dask-contrib";
     repo = "dask-awkward";
     rev = "refs/tags/${version}";
-    hash = "sha256-yx0B31x+BMS4alHro+hAPeVB6YK9B7Tg+3sSCMCYjKs=";
+    hash = "sha256-MfZ3mdCCShD/rcqHx7xyujXax5t96RQI1e2Ckyif9e4=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/dask-yarn/default.nix b/pkgs/development/python-modules/dask-yarn/default.nix
index b9204f0eb839..044c70f64f89 100644
--- a/pkgs/development/python-modules/dask-yarn/default.nix
+++ b/pkgs/development/python-modules/dask-yarn/default.nix
@@ -4,6 +4,7 @@
 , dask
 , distributed
 , fetchFromGitHub
+, fetchpatch
 , grpcio
 , pytestCheckHook
 , pythonOlder
@@ -19,11 +20,19 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "dask";
-    repo = pname;
-    rev = version;
+    repo = "dask-yarn";
+    rev = "refs/tags/${version}";
     hash = "sha256-/BTsxQSiVQrihrCa9DE7pueyg3aPAdjd/Dt4dpUwdtM=";
   };
 
+  patches = [
+    (fetchpatch {  # https://github.com/dask/dask-yarn/pull/150
+      name = "address-deprecations-introduced-in-distributed-2021-07-0";
+      url = "https://github.com/dask/dask-yarn/pull/150/commits/459848afcdc22568905ee98622c74e4071496423.patch";
+      hash = "sha256-LS46QBdiAmsp4jQq4DdYdmmk1qzx5JZNTQUlRcRwY5k=";
+    })
+  ];
+
   propagatedBuildInputs = [
     distributed
     dask
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index 63a13d779913..70b15822cb65 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -38,7 +38,7 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2023.10.1";
+  version = "2023.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -47,7 +47,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = "dask";
     rev = "refs/tags/${version}";
-    hash = "sha256-asD5oLd7XcZ8ZFSrsSCAKgZ3Gsqs6T77nb1qesamgUI=";
+    hash = "sha256-LMd55s8LT4m6Ym+LmXb4TKPnZ0jMkNBfcPJxmgruMDM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index 55d5dabdd009..074a450a39e4 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "distributed";
-  version = "2023.10.0";
+  version = "2023.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = "distributed";
     rev = "refs/tags/${version}";
-    hash = "sha256-V0L1qY9xtJgKxNEZ69z8CQuXsUs30cqu6xFrsjKWkbY=";
+    hash = "sha256-Zv31BTzY31eXkU7wqa+h33qGrH+OTzKEj6L7Ei/aizk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/patool/default.nix b/pkgs/development/python-modules/patool/default.nix
index 9d31fa9e93ee..d36400970391 100644
--- a/pkgs/development/python-modules/patool/default.nix
+++ b/pkgs/development/python-modules/patool/default.nix
@@ -1,7 +1,7 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pytestCheckHook
 , p7zip
 , cabextract
@@ -60,6 +60,8 @@ buildPythonPackage rec {
     "test_unzip_file"
     "test_zip"
     "test_zip_file"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "test_ar"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/uproot/default.nix b/pkgs/development/python-modules/uproot/default.nix
index 837d16204473..1fd62b8eb2fc 100644
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@@ -5,10 +5,12 @@
 , awkward
 , hatchling
 , numpy
+, fsspec
 , packaging
 , pytestCheckHook
 , lz4
 , pytest-timeout
+, rangehttpserver
 , scikit-hep-testdata
 , xxhash
 , zstandard
@@ -16,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "5.1.2";
+  version = "5.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +27,7 @@ buildPythonPackage rec {
     owner = "scikit-hep";
     repo = "uproot5";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TMa+j2jdFagJJhlyCx4rNLaxQhrJyq1HdpnA40xiyME=";
+    hash = "sha256-Oig66OvnmuqT56UkAecSG9qg+qxEQINX/DWS30yq46s=";
   };
 
   nativeBuildInputs = [
@@ -35,6 +37,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     awkward
     numpy
+    fsspec
     packaging
   ];
 
@@ -42,6 +45,7 @@ buildPythonPackage rec {
     pytestCheckHook
     lz4
     pytest-timeout
+    rangehttpserver
     scikit-hep-testdata
     xxhash
     zstandard
@@ -53,20 +57,32 @@ buildPythonPackage rec {
 
   disabledTests = [
     # Tests that try to download files
+    "test_fallback"
+    "test_file"
+    "test_fsspec_chunks"
+    "test_fsspec_globbing_http"
+    "test_fsspec_writing_memory"
     "test_http"
+    "test_http_fallback"
+    "test_http_multipart"
+    "test_http_port"
+    "test_http_size"
+    "test_http_size_port"
+    "test_issue_1054_filename_colons"
     "test_no_multipart"
-    "test_fallback"
+    "test_open_fsspec_http"
+    "test_open_fsspec_github"
     "test_pickle_roundtrip_http"
-    "test_open_fsspec_local"
   ];
 
   disabledTestPaths = [
     # Tests that try to download files
-    "tests/test_0066-fix-http-fallback-freeze.py"
-    "tests/test_0088-read-with-http.py"
-    "tests/test_0220-contiguous-byte-ranges-in-http.py"
-    "tests/test_0916-read-from-s3.py"
-    "tests/test_0930-expressions-in-pandas.py"
+    "tests/test_0066_fix_http_fallback_freeze.py"
+    "tests/test_0088_read_with_http.py"
+    "tests/test_0220_contiguous_byte_ranges_in_http.py"
+
+    # FileNotFoundError: uproot-issue-1043.root
+    "tests/test_1043_const_std_string.py"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index e96902a13029..ccab9bda9aae 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -22,7 +22,6 @@
 , valgrind
 , meson
 , libuuid
-, colord
 , ninja
 , gnutls
 , protobufc
@@ -184,7 +183,6 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     elfutils
     libgudev
-    colord
     libjcat
     libuuid
     json-glib
diff --git a/pkgs/os-specific/linux/nix-ld/default.nix b/pkgs/os-specific/linux/nix-ld/default.nix
index bb6489ecdb17..208c59ab7576 100644
--- a/pkgs/os-specific/linux/nix-ld/default.nix
+++ b/pkgs/os-specific/linux/nix-ld/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nix-ld";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "mic92";
     repo = "nix-ld";
     rev = version;
-    hash = "sha256-+z9t7BLugZO1WhyYEq6FI38TMh2EwfgfAv3RDFSjwtc=";
+    hash = "sha256-h+odOVyiGmEERMECoFOj5P7FPiMR8IPRzroFA4sKivg=";
   };
 
   doCheck = true;
@@ -48,9 +48,5 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ mic92 ];
     platforms = platforms.linux;
-
-    # 32 bit builds are broken due to a missing #define value:
-    # https://github.com/Mic92/nix-ld/issues/64
-    broken = stdenv.is32bit;
   };
 }
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 38f20a1d68ab..28436ca33706 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -21,16 +21,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2023-11-01T18-37-25Z";
+  version = "2023-12-14T18-51-57Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-3YCXIn/xBhkKrmM41JBBfzc6re1nAFHO9GCwTE6AddY=";
+    sha256 = "sha256-UVl6rDm2BlTtmoTcTwCpgm7EdgUVqMi3kPQ/pLVc4kw=";
   };
 
-  vendorHash = "sha256-UZqICN3vPJRgO7fKzVTlP/sFx4cWUnEN9BpSp1bFgL0=";
+  vendorHash = "sha256-0MLQPqua3FC0524drTnlbiqlkGSIBSm0YiYW871cnmU=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 0cd20589caa2..c90ae14d0871 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.29.0";
+  version = "1.29.1";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -16,10 +16,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-I6fc2cjM9dFOKvUBcMA5Suvwe3oQw2kKswfkoSJZf5I=";
+    hash = "sha256-iEVVMARdt3gibahxU9snwo13yi6gINWWdhFkTHLYAuU=";
   };
 
-  vendorHash = "sha256-frLMaB+n2YYsdmh3C7xPmZXwm984mYBws9jUPNhfIaU=";
+  vendorHash = "sha256-R6+GKyGD7tUulOA6qEPUlSMj2/zXdLmmrX1HubLNCEc=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 1b1546427db0..ac8a5b833e1d 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub, makeWrapper, iptables, iproute2, procps, shadow, getent }:
 
 let
-  version = "1.56.0";
+  version = "1.56.1";
 in
 buildGoModule {
   pname = "tailscale";
@@ -11,7 +11,7 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-st+s4fJMq1tad6IfPewGnM3LC7JDRoSt0LDV7392Kp4=";
+    hash = "sha256-kMk5Q/KvNcsohHNLDMmpBm+gUxQEOeO8o/odukcJi0A=";
   };
   vendorHash = "sha256-bG/ydsJf2UncOcDo8/BXdvQJO3Mk0tl8JGje1b6kto4=";
 
diff --git a/pkgs/servers/web-apps/engelsystem/default.nix b/pkgs/servers/web-apps/engelsystem/default.nix
index ee92f58a2121..9b9cf0ff3bfe 100644
--- a/pkgs/servers/web-apps/engelsystem/default.nix
+++ b/pkgs/servers/web-apps/engelsystem/default.nix
@@ -6,11 +6,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "engelsystem";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchzip {
     url = "https://github.com/engelsystem/engelsystem/releases/download/v${version}/engelsystem-v${version}.zip";
-    hash = "sha256-Z0p+6QlMrj5OtiwFKBfWxkkd/kbL2dxDSKvljcTXWo0=";
+    hash = "sha256-5KniP1nrLfmWHruXnUJmlvgL95U+EsDmCs4tg/YLWtw=";
   };
 
   buildInputs = [ phpExt ];
diff --git a/pkgs/shells/murex/default.nix b/pkgs/shells/murex/default.nix
index e5b1bfb7c543..5e42880e5522 100644
--- a/pkgs/shells/murex/default.nix
+++ b/pkgs/shells/murex/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "murex";
-  version = "5.2.7610";
+  version = "5.3.4000";
 
   src = fetchFromGitHub {
     owner = "lmorg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YyMt1V9Utar849+HPGLGJc25PvV7Q2pJehpFOOxlraY=";
+    sha256 = "sha256-cShXZa3ms7RmnRrvWyvijWF7kTO7K6GS1IvEUyT2mio=";
   };
 
   vendorHash = "sha256-qOItRqCIxoHigufI6b7j2VdBDo50qGDe+LAaccgDh5w=";
diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index cf46239939b5..3be7b2fd0ee6 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/xdg-utils/";
     description = "A set of command line tools that assist applications with a variety of desktop integration tasks";
-    license = if mimiSupport then licenses.gpl2 else licenses.free;
+    license = if mimiSupport then licenses.gpl2 else licenses.mit;
     maintainers = [ maintainers.eelco ];
     platforms = platforms.all;
   };
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index ab37ef98c0bd..9860817cf3e1 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -100,7 +100,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "http://www.info-zip.org";
     description = "An extraction utility for archives compressed in .zip format";
-    license = lib.licenses.free; # http://www.info-zip.org/license.html
+    license = lib.licenses.info-zip;
     platforms = lib.platforms.all;
     mainProgram = "unzip";
   };
diff --git a/pkgs/tools/archivers/zpaq/default.nix b/pkgs/tools/archivers/zpaq/default.nix
index 7c394e27d178..6a03b825e902 100644
--- a/pkgs/tools/archivers/zpaq/default.nix
+++ b/pkgs/tools/archivers/zpaq/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     homepage = "http://mattmahoney.net/dc/zpaq.html";
     license = licenses.gpl3Plus ;
     maintainers = with maintainers; [ raskin ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     mainProgram = "zpaq";
   };
 }
diff --git a/pkgs/tools/audio/liquidsoap/full.nix b/pkgs/tools/audio/liquidsoap/full.nix
index 22925dce99fa..87914436fd49 100644
--- a/pkgs/tools/audio/liquidsoap/full.nix
+++ b/pkgs/tools/audio/liquidsoap/full.nix
@@ -7,7 +7,7 @@
 
 let
   pname = "liquidsoap";
-  version = "2.2.2";
+  version = "2.2.3";
 in
 stdenv.mkDerivation {
   inherit pname version;
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
     owner = "savonet";
     repo = "liquidsoap";
     rev = "refs/tags/v${version}";
-    hash = "sha256-t7rkWHSAd3DaTCXaGfL9NcIQYT+f4Od9D6huuZlwhWk=";
+    hash = "sha256-oCMSdmdU3oHrq3QFEDQLdb3CLFYcWylxTqKWtGOoQW8=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/compression/zsync/default.nix b/pkgs/tools/compression/zsync/default.nix
index b92112a4816e..0de21cb9c736 100644
--- a/pkgs/tools/compression/zsync/default.nix
+++ b/pkgs/tools/compression/zsync/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "http://zsync.moria.org.uk/";
     description = "File distribution system using the rsync algorithm";
-    license = licenses.free;
+    license = licenses.artistic2;
     maintainers = with maintainers; [ viric ];
     platforms = with platforms; all;
   };
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 676194736731..ba40e432cad1 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl
-, pkg-config, sphinx
+, pkg-config, python3
 , zstd
 , acl, attr, e2fsprogs, libuuid, lzo, udev, zlib
 , runCommand, btrfs-progs
@@ -9,17 +9,20 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "6.6.2";
+  version = "6.6.3";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    hash = "sha256-tCZzbclOKwS2mD6ZjE3EJ9wWbWbd6iRsiQ7ZwqRQBE8=";
+    hash = "sha256-9BzlP2Zz/1Ue5KP+fclgHloN3mttCRd9H6ticYq8bZo=";
   };
 
   nativeBuildInputs = [
     pkg-config
   ] ++ [
-    sphinx
+    (python3.withPackages (ps: with ps; [
+      sphinx
+      sphinx-rtd-theme
+    ]))
   ];
 
   buildInputs = [ acl attr e2fsprogs libuuid lzo udev zlib zstd ];
diff --git a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch
deleted file mode 100644
index 7b7ca5a0befa..000000000000
--- a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-Simple bounds checks for CVE-2023-40889, based on third-party
-fix by Remi Meier @
-https://github.com/Raemi/zbar/commit/5e8acc6974f17e56c3ddaa5509870beb8d7a599c
-
---- a/zbar/qrcode/qrdec.c
-+++ b/zbar/qrcode/qrdec.c
-@@ -3900,8 +3900,8 @@ void qr_reader_match_centers(qr_reader *_reader,qr_code_data_list *_qrlist,
-     /*TODO: We might be able to accelerate this step significantly by
-        considering the remaining finder centers in a more intelligent order,
-        based on the first finder center we just chose.*/
--    for(j=i+1;!mark[i]&&j<_ncenters;j++){
--      for(k=j+1;!mark[j]&&k<_ncenters;k++)if(!mark[k]){
-+    for(j=i+1; i < _ncenters && !mark[i]&&j<_ncenters;j++){
-+      for(k=j+1; j < _ncenters && !mark[j]&&k<_ncenters;k++)if(!mark[k]){
-         qr_finder_center *c[3];
-         qr_code_data      qrdata;
-         int               version;
diff --git a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch
deleted file mode 100644
index 3576df214ae1..000000000000
--- a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-Simple bounds checks for CVE-2023-40890
-
---- a/zbar/decoder/databar.c
-+++ b/zbar/decoder/databar.c
-@@ -23,6 +23,8 @@
- 
- #include <config.h>
- #include <zbar.h>
-+#include <stdlib.h>
-+#include <stdio.h>
- 
- #ifdef DEBUG_DATABAR
- # define DEBUG_LEVEL (DEBUG_DATABAR)
-@@ -691,6 +693,12 @@ lookup_sequence (databar_segment_t *seg,
-             fixed = -1;
-         s <<= 1;
-         dbprintf(2, "%x", s);
-+
-+        if (i > 20) {
-+            fprintf(stderr, "Bug: Out-of-bounds condition detected\n");
-+            exit(99);
-+        }
-+
-         seq[i++] = s++;
-         seq[i++] = s;
-     }
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index 5a1d7e94fdf6..fe398bf53314 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -44,8 +44,16 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    ./0.23.92-CVE-2023-40889.patch
-    ./0.23.92-CVE-2023-40890.patch
+    (fetchpatch {
+      name = "CVE-2023-40889.patch";
+      url = "https://salsa.debian.org/debian/zbar/-/raw/debian/0.23.92-9/debian/patches/0003-CVE-2023-40889-qrdec.c-Fix-array-out-of-bounds-acces.patch";
+      hash = "sha256-z0IADJwUt9PBoox5xJJN//5vrcRbIrWB9H7wtxNVUZU=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-40890.patch";
+      url = "https://salsa.debian.org/debian/zbar/-/raw/debian/0.23.92-9/debian/patches/0004-Add-bounds-check-for-CVE-2023-40890.patch";
+      hash = "sha256-YgiptwXpRpz0qIcXBpARfIzSB8KYmksZR58o5yFPahs=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/ockam/default.nix b/pkgs/tools/networking/ockam/default.nix
index fe0bbf374635..55a1300c06d0 100644
--- a/pkgs/tools/networking/ockam/default.nix
+++ b/pkgs/tools/networking/ockam/default.nix
@@ -12,7 +12,7 @@
 
 let
   pname = "ockam";
-  version = "0.105.0";
+  version = "0.111.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage {
     owner = "build-trust";
     repo = pname;
     rev = "ockam_v${version}";
-    sha256 = "sha256-YS98elkf1iIslC1dAf+Os2VoA0pmHmkQN0//PtBRBcM=";
+    sha256 = "sha256-pd27611px/TXnO5FlRjBI8iQ64l5X9fmfCG/KnR7AAI=";
   };
 
-  cargoHash = "sha256-aW+Pc2C7vohUAByrzBiOaJlBPfSLAv0FrOxRiB1AM9k=";
+  cargoHash = "sha256-O91enOKMoTfFTv8Hkg3qBSstJpxtKxZVITqGlZQUL/4=";
   nativeBuildInputs = [ git pkg-config ];
   buildInputs = [ openssl dbus ]
     ++ lib.optionals stdenv.isDarwin [ Security ];
diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix
index d61384ec1055..0ea47dd7e17c 100644
--- a/pkgs/tools/package-management/nix/common.nix
+++ b/pkgs/tools/package-management/nix/common.nix
@@ -182,8 +182,6 @@ self = stdenv.mkDerivation {
     "--enable-gc"
   ] ++ lib.optionals (!enableDocumentation) [
     "--disable-doc-gen"
-  ] ++ lib.optionals atLeast214 [
-    "CXXFLAGS=-I${lib.getDev rapidcheck}/extras/gtest/include"
   ] ++ lib.optionals stdenv.isLinux [
     "--with-sandbox-shell=${busybox-sandbox-shell}/bin/busybox"
   ] ++ lib.optionals (atLeast210 && stdenv.isLinux && stdenv.hostPlatform.isStatic) [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9032def7401a..f8e00dcb7a98 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -32674,33 +32674,12 @@ with pkgs;
     wlroots_0_16
     wlroots;
 
-  sway-unwrapped = callPackage ../applications/window-managers/sway {
-    wlroots = wlroots_0_16;
-  };
-  sway = callPackage ../applications/window-managers/sway/wrapper.nix { };
-  swaybg = callPackage ../applications/window-managers/sway/bg.nix { };
-  swayidle = callPackage ../applications/window-managers/sway/idle.nix { };
-  swaylock = callPackage ../applications/window-managers/sway/lock.nix { };
-  swayosd = callPackage ../applications/window-managers/sway/osd.nix { };
-  swayws = callPackage ../applications/window-managers/sway/ws.nix { };
-  swaywsr = callPackage ../applications/window-managers/sway/wsr.nix { };
-  sway-assign-cgroups = callPackage ../applications/window-managers/sway/assign-cgroups.nix { };
-  sway-contrib = recurseIntoAttrs (callPackages ../applications/window-managers/sway/contrib.nix { });
-
-  swaycons = callPackage ../applications/window-managers/sway/swaycons.nix { };
-
-  swayfx = callPackage ../applications/window-managers/sway/fx.nix { };
-
-  swaylock-fancy = callPackage ../applications/window-managers/sway/lock-fancy.nix { };
-
-  swaylock-effects = callPackage ../applications/window-managers/sway/lock-effects.nix { };
+  sway-contrib = recurseIntoAttrs (callPackages ../applications/misc/sway-contrib { });
 
   swaynotificationcenter = callPackage ../applications/misc/swaynotificationcenter { };
 
   swaynag-battery = callPackage ../applications/misc/swaynag-battery { };
 
-  swayest-workstyle = callPackage ../applications/window-managers/sway/swayest-workstyle { };
-
   tiramisu = callPackage ../applications/misc/tiramisu { };
 
   rlaunch = callPackage ../applications/misc/rlaunch { };