about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix24
-rw-r--r--maintainers/scripts/luarocks-packages.csv1
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md2
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/cluster/kubernetes/pki.nix2
-rw-r--r--nixos/modules/services/desktops/pipewire/pipewire.nix182
-rw-r--r--nixos/modules/services/misc/tuxclocker.nix71
-rw-r--r--nixos/tests/nixos-rebuild-specialisations.nix2
-rw-r--r--pkgs/applications/audio/jack-passthrough/default.nix39
-rw-r--r--pkgs/applications/audio/monkeys-audio/default.nix4
-rw-r--r--pkgs/applications/audio/mympd/default.nix4
-rw-r--r--pkgs/applications/audio/ncspot/default.nix6
-rw-r--r--pkgs/applications/audio/noson/default.nix4
-rw-r--r--pkgs/applications/blockchains/clightning/default.nix4
-rw-r--r--pkgs/applications/blockchains/optimism/geth.nix6
-rw-r--r--pkgs/applications/editors/neovim/default.nix1
-rw-r--r--pkgs/applications/editors/okteta/default.nix4
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix4
-rw-r--r--pkgs/applications/misc/clipcat/default.nix23
-rw-r--r--pkgs/applications/misc/kaufkauflist/default.nix4
-rw-r--r--pkgs/applications/misc/nwg-bar/default.nix6
-rw-r--r--pkgs/applications/misc/sway-contrib/default.nix (renamed from pkgs/applications/window-managers/sway/contrib.nix)0
-rw-r--r--pkgs/applications/misc/translatelocally/default.nix28
-rw-r--r--pkgs/applications/misc/tuxclocker/default.nix66
-rw-r--r--pkgs/applications/networking/cluster/nerdctl/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/opentofu/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/terraform/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/neosay/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix4
-rw-r--r--pkgs/applications/networking/p2p/tribler/default.nix2
-rw-r--r--pkgs/applications/science/chemistry/jmol/default.nix4
-rw-r--r--pkgs/applications/science/electronics/nvc/default.nix4
-rw-r--r--pkgs/applications/science/logic/alt-ergo/default.nix4
-rw-r--r--pkgs/applications/science/misc/root/default.nix18
-rw-r--r--pkgs/applications/science/misc/root/sw_vers.patch13
-rw-r--r--pkgs/applications/science/robotics/mujoco/default.nix14
-rw-r--r--pkgs/applications/version-management/gitkraken/default.nix10
-rw-r--r--pkgs/applications/video/filebot/default.nix4
-rw-r--r--pkgs/applications/video/mpv/scripts/buildLua.nix1
-rw-r--r--pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix4
-rw-r--r--pkgs/applications/virtualization/nixpacks/default.nix6
-rw-r--r--pkgs/applications/virtualization/podman/default.nix4
-rw-r--r--pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch6
-rw-r--r--pkgs/build-support/fetchgitlab/default.nix12
-rw-r--r--pkgs/build-support/fetchzip/default.nix2
-rw-r--r--pkgs/by-name/an/anime4k/package.nix32
-rw-r--r--pkgs/by-name/as/asn1editor/package.nix37
-rw-r--r--pkgs/by-name/en/endlines/package.nix33
-rw-r--r--pkgs/by-name/i3/i3-open-next-ws/package.nix24
-rw-r--r--pkgs/by-name/mo/mommy/package.nix4
-rw-r--r--pkgs/by-name/my/mystmd/package.nix6
-rw-r--r--pkgs/by-name/na/nautilus-open-in-blackbox/package.nix35
-rw-r--r--pkgs/by-name/na/nautilus-open-in-blackbox/paths.patch23
-rw-r--r--pkgs/by-name/no/noto-fonts/package.nix4
-rw-r--r--pkgs/by-name/pa/passes/package.nix4
-rw-r--r--pkgs/by-name/so/soco-cli/package.nix (renamed from pkgs/tools/audio/soco-cli/default.nix)12
-rw-r--r--pkgs/by-name/sw/sway-assign-cgroups/package.nix (renamed from pkgs/applications/window-managers/sway/assign-cgroups.nix)2
-rw-r--r--pkgs/by-name/sw/sway-unwrapped/fix-paths.patch (renamed from pkgs/applications/window-managers/sway/fix-paths.patch)0
-rw-r--r--pkgs/by-name/sw/sway-unwrapped/load-configuration-from-etc.patch (renamed from pkgs/applications/window-managers/sway/load-configuration-from-etc.patch)0
-rw-r--r--pkgs/by-name/sw/sway-unwrapped/package.nix (renamed from pkgs/applications/window-managers/sway/default.nix)5
-rw-r--r--pkgs/by-name/sw/sway-unwrapped/sway-config-nixos-paths.patch (renamed from pkgs/applications/window-managers/sway/sway-config-nixos-paths.patch)0
-rw-r--r--pkgs/by-name/sw/sway-unwrapped/sway-config-no-nix-store-references.patch (renamed from pkgs/applications/window-managers/sway/sway-config-no-nix-store-references.patch)0
-rw-r--r--pkgs/by-name/sw/sway/package.nix (renamed from pkgs/applications/window-managers/sway/wrapper.nix)6
-rw-r--r--pkgs/by-name/sw/swaybg/package.nix (renamed from pkgs/applications/window-managers/sway/bg.nix)0
-rw-r--r--pkgs/by-name/sw/swaycons/package.nix (renamed from pkgs/applications/window-managers/sway/swaycons.nix)0
-rw-r--r--pkgs/by-name/sw/swayest-workstyle/package.nix (renamed from pkgs/applications/window-managers/sway/swayest-workstyle/default.nix)0
-rw-r--r--pkgs/by-name/sw/swayfx-unwrapped/package.nix (renamed from pkgs/applications/window-managers/sway/fx.nix)25
-rw-r--r--pkgs/by-name/sw/swayfx/package.nix26
-rw-r--r--pkgs/by-name/sw/swayidle/package.nix (renamed from pkgs/applications/window-managers/sway/idle.nix)0
-rw-r--r--pkgs/by-name/sw/swaylock-effects/package.nix (renamed from pkgs/applications/window-managers/sway/lock-effects.nix)0
-rw-r--r--pkgs/by-name/sw/swaylock-fancy/package.nix (renamed from pkgs/applications/window-managers/sway/lock-fancy.nix)0
-rw-r--r--pkgs/by-name/sw/swaylock/package.nix (renamed from pkgs/applications/window-managers/sway/lock.nix)0
-rw-r--r--pkgs/by-name/sw/swayosd/package.nix (renamed from pkgs/applications/window-managers/sway/osd.nix)0
-rw-r--r--pkgs/by-name/sw/swayosd/swayosd_systemd_paths.patch (renamed from pkgs/applications/window-managers/sway/swayosd_systemd_paths.patch)0
-rw-r--r--pkgs/by-name/sw/swayws/package.nix (renamed from pkgs/applications/window-managers/sway/ws.nix)0
-rw-r--r--pkgs/by-name/sw/swayws/ws-update-Cargo-lock.patch (renamed from pkgs/applications/window-managers/sway/ws-update-Cargo-lock.patch)0
-rw-r--r--pkgs/by-name/sw/swaywsr/package.nix (renamed from pkgs/applications/window-managers/sway/wsr.nix)0
-rw-r--r--pkgs/by-name/tu/tuxclocker-nvidia-plugin/no-cpu-plugin.patch14
-rw-r--r--pkgs/by-name/tu/tuxclocker-nvidia-plugin/package.nix34
-rw-r--r--pkgs/by-name/tu/tuxclocker-plugins-with-unfree/package.nix16
-rw-r--r--pkgs/by-name/tu/tuxclocker-plugins/package.nix42
-rw-r--r--pkgs/by-name/ui/uiua/package.nix8
-rw-r--r--pkgs/by-name/vi/vinegar/package.nix110
-rw-r--r--pkgs/by-name/wl/wl-gammarelay-rs/package.nix27
-rw-r--r--pkgs/by-name/zb/zbus-xmlgen/package.nix28
-rw-r--r--pkgs/data/icons/numix-icon-theme-circle/default.nix4
-rw-r--r--pkgs/data/icons/numix-icon-theme-square/default.nix4
-rw-r--r--pkgs/data/icons/numix-icon-theme/default.nix4
-rw-r--r--pkgs/desktops/lomiri/default.nix1
-rw-r--r--pkgs/desktops/lomiri/services/mediascanner2/default.nix122
-rw-r--r--pkgs/development/compilers/mlkit/default.nix4
-rw-r--r--pkgs/development/interpreters/evcxr/default.nix6
-rw-r--r--pkgs/development/libraries/libatomic_ops/default.nix4
-rw-r--r--pkgs/development/libraries/libebml/default.nix4
-rw-r--r--pkgs/development/libraries/libzim/default.nix4
-rw-r--r--pkgs/development/libraries/miniaudio/default.nix4
-rw-r--r--pkgs/development/libraries/nanoflann/default.nix4
-rw-r--r--pkgs/development/libraries/nghttp3/default.nix4
-rw-r--r--pkgs/development/libraries/ngtcp2/default.nix4
-rw-r--r--pkgs/development/libraries/physics/geant4/datasets.nix12
-rw-r--r--pkgs/development/libraries/physics/geant4/default.nix4
-rw-r--r--pkgs/development/libraries/rapidcheck/default.nix38
-rw-r--r--pkgs/development/libraries/utf8cpp/default.nix12
-rw-r--r--pkgs/development/lua-modules/aliases.nix1
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix20
-rw-r--r--pkgs/development/mobile/androidenv/emulate-app.nix37
-rw-r--r--pkgs/development/mobile/androidenv/examples/shell-with-emulator.nix1
-rw-r--r--pkgs/development/python-modules/awkward-cpp/default.nix4
-rw-r--r--pkgs/development/python-modules/awkward/default.nix4
-rw-r--r--pkgs/development/python-modules/bitarray/default.nix4
-rw-r--r--pkgs/development/python-modules/caldav/default.nix4
-rw-r--r--pkgs/development/python-modules/coffea/default.nix7
-rw-r--r--pkgs/development/python-modules/dask-awkward/default.nix4
-rw-r--r--pkgs/development/python-modules/dask-yarn/default.nix13
-rw-r--r--pkgs/development/python-modules/dask/default.nix4
-rw-r--r--pkgs/development/python-modules/distributed/default.nix4
-rw-r--r--pkgs/development/python-modules/mayim/default.nix66
-rw-r--r--pkgs/development/python-modules/mujoco/default.nix13
-rw-r--r--pkgs/development/python-modules/patool/default.nix4
-rw-r--r--pkgs/development/python-modules/pglast/default.nix4
-rw-r--r--pkgs/development/python-modules/uproot/default.nix34
-rw-r--r--pkgs/development/tools/language-servers/millet/Cargo.lock80
-rw-r--r--pkgs/development/tools/language-servers/millet/default.nix4
-rw-r--r--pkgs/development/tools/language-servers/neocmakelsp/default.nix6
-rw-r--r--pkgs/development/tools/misc/saleae-logic-2/default.nix4
-rw-r--r--pkgs/development/tools/mod/default.nix4
-rw-r--r--pkgs/development/tools/parsing/antlr/4.nix14
-rw-r--r--pkgs/development/tools/parsing/antlr/utf8cpp.patch15
-rw-r--r--pkgs/development/tools/rust/cargo-hack/default.nix6
-rw-r--r--pkgs/development/web/bun/default.nix10
-rw-r--r--pkgs/games/minesweep-rs/default.nix6
-rw-r--r--pkgs/games/teeworlds/default.nix7
-rw-r--r--pkgs/games/vvvvvv/default.nix13
-rw-r--r--pkgs/games/vvvvvv/utf8cpp.patch13
-rw-r--r--pkgs/misc/translatelocally-models/default.nix43
-rw-r--r--pkgs/misc/translatelocally-models/models.json149
-rwxr-xr-xpkgs/misc/translatelocally-models/update.sh14
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/default.nix2
-rw-r--r--pkgs/os-specific/linux/nix-ld/default.nix8
-rw-r--r--pkgs/servers/lidarr/default.nix8
-rwxr-xr-xpkgs/servers/lidarr/update.sh2
-rw-r--r--pkgs/servers/mautrix-whatsapp/default.nix6
-rw-r--r--pkgs/servers/minio/default.nix6
-rw-r--r--pkgs/servers/misc/navidrome/default.nix7
-rw-r--r--pkgs/servers/monitoring/mimir/default.nix4
-rw-r--r--pkgs/servers/monitoring/telegraf/default.nix6
-rw-r--r--pkgs/servers/mqtt/mosquitto/default.nix18
-rw-r--r--pkgs/servers/tailscale/default.nix4
-rw-r--r--pkgs/servers/web-apps/engelsystem/default.nix4
-rw-r--r--pkgs/servers/web-apps/matomo/default.nix8
-rw-r--r--pkgs/shells/murex/default.nix4
-rw-r--r--pkgs/tools/X11/xdg-utils/default.nix2
-rw-r--r--pkgs/tools/archivers/unzip/default.nix2
-rw-r--r--pkgs/tools/archivers/zpaq/default.nix2
-rw-r--r--pkgs/tools/audio/liquidsoap/full.nix4
-rw-r--r--pkgs/tools/compression/zsync/default.nix2
-rw-r--r--pkgs/tools/filesystems/btrfs-progs/default.nix11
-rw-r--r--pkgs/tools/filesystems/mount-zip/default.nix4
-rw-r--r--pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch17
-rw-r--r--pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch26
-rw-r--r--pkgs/tools/graphics/zbar/default.nix12
-rw-r--r--pkgs/tools/misc/mutagen-compose/default.nix6
-rw-r--r--pkgs/tools/networking/ockam/default.nix6
-rw-r--r--pkgs/tools/nix/nixdoc/default.nix6
-rw-r--r--pkgs/tools/package-management/apx/default.nix6
-rw-r--r--pkgs/tools/package-management/nix/common.nix2
-rw-r--r--pkgs/tools/security/cnquery/default.nix31
-rw-r--r--pkgs/tools/security/nmap-formatter/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix2
-rw-r--r--pkgs/top-level/all-packages.nix37
-rw-r--r--pkgs/top-level/python-packages.nix2
172 files changed, 1766 insertions, 543 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index daf866b4e852..e9d99ac86746 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11248,6 +11248,12 @@
     github = "marius851000";
     githubId = 22586596;
   };
+  mariuskimmina = {
+    email = "mar.kimmina@gmail.com";
+    name = "Marius Kimmina";
+    github = "mariuskimmina";
+    githubId = 38843153;
+  };
   markbeep = {
     email = "mrkswrn@gmail.com";
     github = "markbeep";
@@ -13129,6 +13135,15 @@
     githubId = 8214542;
     name = "Nicolò Balzarotti";
   };
+  nicolas-goudry = {
+    email = "goudry.nicolas@gmail.com";
+    github = "nicolas-goudry";
+    githubId = 8753998;
+    name = "Nicolas Goudry";
+    keys = [{
+      fingerprint = "21B6 A59A 4E89 0B1B 83E3 0CDB 01C8 8C03 5450 9AA9";
+    }];
+  };
   nicoo = {
     email = "nicoo@debian.org";
     github = "nbraud";
@@ -20449,6 +20464,15 @@
     githubId = 1557253;
     name = "Lennart Eichhorn";
   };
+  zedseven = {
+    name = "Zacchary Dempsey-Plante";
+    email = "zacc@ztdp.ca";
+    github = "zedseven";
+    githubId = 25164338;
+    keys = [{
+      fingerprint = "065A 0A98 FE61 E1C1 41B0  AFE7 64FA BC62 F457 2875";
+    }];
+  };
   zendo = {
     name = "zendo";
     email = "linzway@qq.com";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 1a581a450c26..404d975721d8 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -96,7 +96,6 @@ middleclass,,,,,,
 mpack,,,,,,
 moonscript,https://github.com/leafo/moonscript.git,dev-1,,,,arobyn
 nui.nvim,,,,,,mrcjkb
-nvim-client,https://github.com/neovim/lua-client.git,,,,,
 nvim-cmp,https://github.com/hrsh7th/nvim-cmp,,,,,
 penlight,https://github.com/lunarmodules/Penlight.git,,,,,alerque
 plenary.nvim,https://github.com/nvim-lua/plenary.nvim.git,,,,5.1,
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index f792194da224..0a3c3fafeca1 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -27,6 +27,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [Clevis](https://github.com/latchset/clevis), a pluggable framework for automated decryption, used to unlock encrypted devices in initrd. Available as [boot.initrd.clevis.enable](#opt-boot.initrd.clevis.enable).
 
+- [TuxClocker](https://github.com/Lurkki14/tuxclocker), a hardware control and monitoring program. Available as [programs.tuxclocker](#opt-programs.tuxclocker.enable).
+
 ## Backward Incompatibilities {#sec-release-24.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 11c344f99903..52c6fe5028f1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -770,6 +770,7 @@
   ./services/misc/tautulli.nix
   ./services/misc/tiddlywiki.nix
   ./services/misc/tp-auto-kbbl.nix
+  ./services/misc/tuxclocker.nix
   ./services/misc/tzupdate.nix
   ./services/misc/uhub.nix
   ./services/misc/weechat.nix
diff --git a/nixos/modules/services/cluster/kubernetes/pki.nix b/nixos/modules/services/cluster/kubernetes/pki.nix
index 38682701ea15..35151ebd6bd7 100644
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@@ -212,7 +212,7 @@ in
 
     services.certmgr = {
       enable = true;
-      package = pkgs.certmgr-selfsigned;
+      package = pkgs.certmgr;
       svcManager = "command";
       specs =
         let
diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
index 04ac415c177c..da409030b3a3 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -4,6 +4,8 @@
 with lib;
 
 let
+  json = pkgs.formats.json {};
+  mapToFiles = location: config: concatMapAttrs (name: value: { "pipewire/${location}.conf.d/${name}.conf".source = json.generate "${name}" value;}) config;
   cfg = config.services.pipewire;
   enable32BitAlsaPlugins = cfg.alsa.support32Bit
                            && pkgs.stdenv.isx86_64
@@ -72,15 +74,140 @@ in {
           https://github.com/PipeWire/pipewire/blob/master/NEWS
         '';
       };
+
+      extraConfig = {
+        pipewire = mkOption {
+          type = lib.types.attrsOf json.type;
+          default = {};
+          example = {
+            "10-clock-rate" = {
+              "context.properties" = {
+                "default.clock.rate" = 44100;
+              };
+            };
+            "11-no-upmixing" = {
+              "stream.properties" = {
+                "channelmix.upmix" = false;
+              };
+            };
+          };
+          description = lib.mdDoc ''
+            Additional configuration for the PipeWire server.
+
+            Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/pipewire.conf.d`.
+
+            See `man pipewire.conf` for details, and [the PipeWire wiki][wiki] for examples.
+
+            See also:
+            - [PipeWire wiki - virtual devices][wiki-virtual-device] for creating virtual devices or remapping channels
+            - [PipeWire wiki - filter-chain][wiki-filter-chain] for creating more complex processing pipelines
+            - [PipeWire wiki - network][wiki-network] for streaming audio over a network
+
+            [wiki]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-PipeWire
+            [wiki-virtual-device]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Virtual-Devices
+            [wiki-filter-chain]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Filter-Chain
+            [wiki-network]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Network
+          '';
+        };
+        client = mkOption {
+          type = lib.types.attrsOf json.type;
+          default = {};
+          example = {
+            "10-no-resample" = {
+              "stream.properties" = {
+                "resample.disable" = true;
+              };
+            };
+          };
+          description = lib.mdDoc ''
+            Additional configuration for the PipeWire client library, used by most applications.
+
+            Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/client.conf.d`.
+
+            See the [PipeWire wiki][wiki] for examples.
+
+            [wiki]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-client
+          '';
+        };
+        client-rt = mkOption {
+          type = lib.types.attrsOf json.type;
+          default = {};
+          example = {
+            "10-alsa-linear-volume" = {
+              "alsa.properties" = {
+                "alsa.volume-method" = "linear";
+              };
+            };
+          };
+          description = lib.mdDoc ''
+            Additional configuration for the PipeWire client library, used by real-time applications and legacy ALSA clients.
+
+            Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/client-rt.conf.d`.
+
+            See the [PipeWire wiki][wiki] for examples of general configuration, and [PipeWire wiki - ALSA][wiki-alsa] for ALSA clients.
+
+            [wiki]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-client
+            [wiki-alsa]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-ALSA
+          '';
+        };
+        jack = mkOption {
+          type = lib.types.attrsOf json.type;
+          default = {};
+          example = {
+            "20-hide-midi" = {
+              "jack.properties" = {
+                "jack.show-midi" = false;
+              };
+            };
+          };
+          description = lib.mdDoc ''
+            Additional configuration for the PipeWire JACK server and client library.
+
+            Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/jack.conf.d`.
+
+            See the [PipeWire wiki][wiki] for examples.
+
+            [wiki]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-JACK
+          '';
+        };
+        pipewire-pulse = mkOption {
+          type = lib.types.attrsOf json.type;
+          default = {};
+          example = {
+            "15-force-s16-info" = {
+              "pulse.rules" = [{
+                matches = [
+                  { "application.process.binary" = "my-broken-app"; }
+                ];
+                actions = {
+                  quirks = [ "force-s16-info" ];
+                };
+              }];
+            };
+          };
+          description = lib.mdDoc ''
+            Additional configuration for the PipeWire PulseAudio server.
+
+            Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/pipewire-pulse.conf.d`.
+
+            See `man pipewire-pulse.conf` for details, and [the PipeWire wiki][wiki] for examples.
+
+            See also:
+            - [PipeWire wiki - PulseAudio tricks guide][wiki-tricks] for more examples.
+
+            [wiki]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Config-PulseAudio
+            [wiki-tricks]: https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Guide-PulseAudio-Tricks
+          '';
+        };
+      };
     };
   };
 
   imports = [
     (lib.mkRemovedOptionModule ["services" "pipewire" "config"] ''
-      Overriding default Pipewire configuration through NixOS options never worked correctly and is no longer supported.
-      Please create drop-in files in /etc/pipewire/pipewire.conf.d/ to make the desired setting changes instead.
+      Overriding default PipeWire configuration through NixOS options never worked correctly and is no longer supported.
+      Please create drop-in configuration files via `services.pipewire.extraConfig` instead.
     '')
-
     (lib.mkRemovedOptionModule ["services" "pipewire" "media-session"] ''
       pipewire-media-session is no longer supported upstream and has been removed.
       Please switch to `services.pipewire.wireplumber` instead.
@@ -133,26 +260,35 @@ in {
     services.udev.packages = [ cfg.package ];
 
     # If any paths are updated here they must also be updated in the package test.
-    environment.etc."alsa/conf.d/49-pipewire-modules.conf" = mkIf cfg.alsa.enable {
-      text = ''
-        pcm_type.pipewire {
-          libs.native = ${cfg.package}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;
-          ${optionalString enable32BitAlsaPlugins
-            "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;"}
-        }
-        ctl_type.pipewire {
-          libs.native = ${cfg.package}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;
-          ${optionalString enable32BitAlsaPlugins
-            "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;"}
-        }
-      '';
-    };
-    environment.etc."alsa/conf.d/50-pipewire.conf" = mkIf cfg.alsa.enable {
-      source = "${cfg.package}/share/alsa/alsa.conf.d/50-pipewire.conf";
-    };
-    environment.etc."alsa/conf.d/99-pipewire-default.conf" = mkIf cfg.alsa.enable {
-      source = "${cfg.package}/share/alsa/alsa.conf.d/99-pipewire-default.conf";
-    };
+    environment.etc = {
+      "alsa/conf.d/49-pipewire-modules.conf" = mkIf cfg.alsa.enable {
+        text = ''
+          pcm_type.pipewire {
+            libs.native = ${cfg.package}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;
+            ${optionalString enable32BitAlsaPlugins
+              "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;"}
+          }
+          ctl_type.pipewire {
+            libs.native = ${cfg.package}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;
+            ${optionalString enable32BitAlsaPlugins
+              "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire}/lib/alsa-lib/libasound_module_ctl_pipewire.so ;"}
+          }
+        '';
+      };
+
+      "alsa/conf.d/50-pipewire.conf" = mkIf cfg.alsa.enable {
+        source = "${cfg.package}/share/alsa/alsa.conf.d/50-pipewire.conf";
+      };
+
+      "alsa/conf.d/99-pipewire-default.conf" = mkIf cfg.alsa.enable {
+        source = "${cfg.package}/share/alsa/alsa.conf.d/99-pipewire-default.conf";
+      };
+    }
+    // mapToFiles "pipewire" cfg.extraConfig.pipewire
+    // mapToFiles "client" cfg.extraConfig.client
+    // mapToFiles "client-rt" cfg.extraConfig.client-rt
+    // mapToFiles "jack" cfg.extraConfig.jack
+    // mapToFiles "pipewire-pulse" cfg.extraConfig.pipewire-pulse;
 
     environment.sessionVariables.LD_LIBRARY_PATH =
       lib.mkIf cfg.jack.enable [ "${cfg.package.jack}/lib" ];
diff --git a/nixos/modules/services/misc/tuxclocker.nix b/nixos/modules/services/misc/tuxclocker.nix
new file mode 100644
index 000000000000..5969f75b8e30
--- /dev/null
+++ b/nixos/modules/services/misc/tuxclocker.nix
@@ -0,0 +1,71 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.tuxclocker;
+in
+{
+  options.programs.tuxclocker = {
+    enable = mkEnableOption (lib.mdDoc ''
+      TuxClocker, a hardware control and monitoring program
+    '');
+
+    enableAMD = mkEnableOption (lib.mdDoc ''
+      AMD GPU controls.
+      Sets the `amdgpu.ppfeaturemask` kernel parameter to 0xfffd7fff to enable all TuxClocker controls
+    '');
+
+    enabledNVIDIADevices = mkOption {
+      type = types.listOf types.int;
+      default = [ ];
+      example = [ 0 1 ];
+      description = lib.mdDoc ''
+        Enable NVIDIA GPU controls for a device by index.
+        Sets the `Coolbits` Xorg option to enable all TuxClocker controls.
+      '';
+    };
+
+    useUnfree = mkOption {
+      type = types.bool;
+      default = false;
+      example = true;
+      description = lib.mdDoc ''
+        Whether to use components requiring unfree dependencies.
+        Disabling this allows you to get everything from the binary cache.
+      '';
+    };
+  };
+
+  config = let
+      package = if cfg.useUnfree then pkgs.tuxclocker else pkgs.tuxclocker-without-unfree;
+    in
+      mkIf cfg.enable {
+        environment.systemPackages = [
+          package
+        ];
+
+        services.dbus.packages = [
+          package
+        ];
+
+        # MSR is used for some features
+        boot.kernelModules = [ "msr" ];
+
+        # https://download.nvidia.com/XFree86/Linux-x86_64/430.14/README/xconfigoptions.html#Coolbits
+        services.xserver.config = let
+          configSection = (i: ''
+            Section "Device"
+              Driver "nvidia"
+              Option "Coolbits" "31"
+              Identifier "Device-nvidia[${toString i}]"
+            EndSection
+          '');
+        in
+          concatStrings (map configSection cfg.enabledNVIDIADevices);
+
+        # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/amd/include/amd_shared.h#n207
+        # Enable everything modifiable in TuxClocker
+        boot.kernelParams = mkIf cfg.enableAMD [ "amdgpu.ppfeaturemask=0xfffd7fff" ];
+      };
+}
diff --git a/nixos/tests/nixos-rebuild-specialisations.nix b/nixos/tests/nixos-rebuild-specialisations.nix
index 444ff7a3b977..9192b8a8a030 100644
--- a/nixos/tests/nixos-rebuild-specialisations.nix
+++ b/nixos/tests/nixos-rebuild-specialisations.nix
@@ -23,7 +23,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
 
       virtualisation = {
         cores = 2;
-        memorySize = 2048;
+        memorySize = 4096;
       };
     };
   };
diff --git a/pkgs/applications/audio/jack-passthrough/default.nix b/pkgs/applications/audio/jack-passthrough/default.nix
new file mode 100644
index 000000000000..93f41f1b5952
--- /dev/null
+++ b/pkgs/applications/audio/jack-passthrough/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, libjack2
+, meson
+, ninja
+, fmt_9
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "jack-passthrough";
+  version = "2021-9-25";
+
+  # https://github.com/guysherman/jack-passthrough
+  src = fetchFromGitHub {
+    owner = "guysherman";
+    repo = finalAttrs.pname;
+    rev = "aad03b7c5ccc4a4dcb8fa38c49aa64cb9d628660";
+    hash = "sha256-9IsNaLW5dYAqiwe+vX0+D3oIKFP2TIfy1q1YaqmS6wE=";
+  };
+
+  nativeBuildInputs = [ pkg-config meson ninja ];
+  buildInputs = [ fmt_9 libjack2 ];
+
+  meta = with lib; {
+    description = "A simple app to help with JACK apps that behave strangely.";
+    longDescription = ''
+      Creates a JACK passthrough client with an arbitrary name and number of
+      ports. Common uses include tricking stubborn applications into creating
+      more ports than they normally would or to prevent them from
+      auto-connecting to certain things.
+    '';
+    # license unknown: https://github.com/guysherman/jack-passthrough/issues/2
+    license = licenses.unfree;
+    maintainers = [ maintainers.PowerUser64 ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/applications/audio/monkeys-audio/default.nix b/pkgs/applications/audio/monkeys-audio/default.nix
index f634539a9f61..0cbe6129e0d9 100644
--- a/pkgs/applications/audio/monkeys-audio/default.nix
+++ b/pkgs/applications/audio/monkeys-audio/default.nix
@@ -5,13 +5,13 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "10.28";
+  version = "10.30";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${
       builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    sha256 = "sha256-9EFZvD3CicT68hBcc/fS73zonQKDwbV/iNY0CbBmhtE=";
+    sha256 = "sha256-vTpfHw58WRRjS/h7FVYjYwHSqoXAF08i8Q/i9xI+9Io=";
     stripRoot = false;
   };
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/mympd/default.nix b/pkgs/applications/audio/mympd/default.nix
index 3e130b0855d4..6c9ce26fad58 100644
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "13.0.0";
+  version = "13.0.5";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-cYoGjge2VtU+QqIURGd/EpkSQ4fhvsdnYZYyESAd56U=";
+    sha256 = "sha256-9TOQoef5aVHFeDc0y3k6SCHBeKON5ueU7275HAmPw9M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/ncspot/default.nix b/pkgs/applications/audio/ncspot/default.nix
index f98f45a1b5cb..553e50f16654 100644
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
-  version = "0.13.4";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
     rev = "v${version}";
-    hash = "sha256-pYPUYy/ODzg9HN0/PTGZkV1NFBPmluhEwoJjYuZ6DTg=";
+    hash = "sha256-NHrpJC6cF/YAcyqZ4bRQdSdjDNhkEV7U2P/S4LSADao=";
   };
 
-  cargoHash = "sha256-FdXk6SzW0f3jkTfxMd8TMzfJGTRaZjG4qp56yHqDAuw=";
+  cargoHash = "sha256-HT084XewXwZByL5KZhyymqU7sy99SAjYIWysm3qGvWU=";
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optional withClipboard python3;
diff --git a/pkgs/applications/audio/noson/default.nix b/pkgs/applications/audio/noson/default.nix
index fb37c93e10fe..b8d29af7abdf 100644
--- a/pkgs/applications/audio/noson/default.nix
+++ b/pkgs/applications/audio/noson/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "noson";
-  version = "5.6.0";
+  version = "5.6.3";
 
   src = fetchFromGitHub {
     owner = "janbar";
     repo = "noson-app";
     rev = finalAttrs.version;
-    hash = "sha256-ZOAnH7pdhlTbqHOM0kiCWcHYJvnskigWdz3N9WjtM0M=";
+    hash = "sha256-Yv5p9yAEhJHm9ZDZlR76z10oGBNpdifR7ITXcAHIb54=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/blockchains/clightning/default.nix b/pkgs/applications/blockchains/clightning/default.nix
index d4fa4c68fe26..efedeb55cb1a 100644
--- a/pkgs/applications/blockchains/clightning/default.nix
+++ b/pkgs/applications/blockchains/clightning/default.nix
@@ -22,11 +22,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "clightning";
-  version = "23.11";
+  version = "23.11.1";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    sha256 = "sha256:1q1plg9qhwlrcvljnrv8yd1gaz9a98pxgql7bqxjq37vk3lfggw6";
+    sha256 = "sha256-PH5vNaQWUP9liKOiNXJnYPWn6LPBw6+XfT4KvcXb4Kk=";
   };
 
   # when building on darwin we need dawin.cctools to provide the correct libtool
diff --git a/pkgs/applications/blockchains/optimism/geth.nix b/pkgs/applications/blockchains/optimism/geth.nix
index a028c8e85844..66a446d526ad 100644
--- a/pkgs/applications/blockchains/optimism/geth.nix
+++ b/pkgs/applications/blockchains/optimism/geth.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "op-geth";
-  version = "1.101304.0";
+  version = "1.101304.2";
 
   src = fetchFromGitHub {
     owner = "ethereum-optimism";
     repo = "op-geth";
     rev = "v${version}";
-    hash = "sha256-MpLkAAYQmceabVChixF1yqvGSoRm+A9p9mOeKHhqxQE=";
+    hash = "sha256-cGCgcwP/9xSpVo2UJAArptF5KEflo7SSdfg5WYUMuxY=";
     fetchSubmodules = true;
   };
 
@@ -33,7 +33,7 @@ buildGoModule rec {
     "cmd/utils"
   ];
 
-  vendorHash = "sha256-JIuS2qWFf9g5MIJP6jVTSAkPG15XCDeMHcoYeJQz7Og=";
+  vendorHash = "sha256-F0OANE4S7WJDYKpJ6mCnR38CPyOov0Hxc0gK1MGHcIg=";
 
   # Fix for usb-related segmentation faults on darwin
   propagatedBuildInputs =
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index e183799d853a..d2aa619fe5a3 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -43,7 +43,6 @@ let
     luabitop
     mpack
   ] ++ lib.optionals doCheck [
-    nvim-client
     luv
     coxpcall
     busted
diff --git a/pkgs/applications/editors/okteta/default.nix b/pkgs/applications/editors/okteta/default.nix
index 72ff8ae5d605..3b20e5c815d5 100644
--- a/pkgs/applications/editors/okteta/default.nix
+++ b/pkgs/applications/editors/okteta/default.nix
@@ -4,11 +4,11 @@
 
 mkDerivation rec {
   pname = "okteta";
-  version = "0.26.13";
+  version = "0.26.14";
 
   src = fetchurl {
     url = "mirror://kde/stable/okteta/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "0wlpv0rk4ys4rbcpf8lqpkm0yr5dxkaz60qk2lvm27w1s489ir8l";
+    sha256 = "sha256-2bvspG3lecKlcN/+YPRmFKQCu/jhckafeSo272iE+9k=";
   };
 
   nativeBuildInputs = [ qtscript extra-cmake-modules kdoctools ];
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 734b9758c6a3..e3597c8fe14d 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3557,8 +3557,8 @@ let
         mktplcRef = {
           name = "uiua-vscode";
           publisher = "uiua-lang";
-          version = "0.0.26";
-          sha256 = "sha256-EKWThidMgbd+a4Vw4SQo988ggVbCTnCakohvq3/mZQ0=";
+          version = "0.0.27";
+          sha256 = "sha256-wEY1FZjgiQJ7VrJGZX0SgZqz/14v//jxgrqdafLjIfM=";
         };
         meta = {
           description = "VSCode language extension for Uiua";
diff --git a/pkgs/applications/misc/clipcat/default.nix b/pkgs/applications/misc/clipcat/default.nix
index 7ba97bc7a9b4..64a3c4f3f893 100644
--- a/pkgs/applications/misc/clipcat/default.nix
+++ b/pkgs/applications/misc/clipcat/default.nix
@@ -2,42 +2,33 @@
 , fetchFromGitHub
 , rustPlatform
 , protobuf
-, xvfb-run
 , installShellFiles
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "clipcat";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "xrelkd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Q9uGufIfqRLk3YJjaEEyu29JP8vSwUCe4ch9tf6Vz9g=";
+    hash = "sha256-NuljH6cqgdtTJDkNv4w44s1UM4/R1gmpVyWpCzCJ3DU=";
   };
 
-  cargoHash = "sha256-9TPj4W+BSpHlOWkbiV7jNgjiYJjjw9j2c3o8vesrJeI=";
+  cargoHash = "sha256-5+qa9/QGZyZBaO2kbvpP7Ybs1EXIO1MlPFm0PDTNqCQ=";
 
   nativeBuildInputs = [
     protobuf
     installShellFiles
   ];
 
-  nativeCheckInputs = [
-    xvfb-run
+  checkFlags = [
+    # Some test cases interact with X11, skip them
+    "--skip=test_x11_clipboard"
+    "--skip=test_x11_primary"
   ];
 
-  useNextest = true;
-
-  # cargo-nextest help us retry the failed test cases
-  NEXTEST_RETRIES = 5;
-
-  # Some test cases interact with X11, we use xvfb-run here
-  checkPhase = ''
-    xvfb-run --auto-servernum cargo nextest run --release --workspace --no-fail-fast --no-capture
-  '';
-
   postInstall = ''
     for cmd in clipcatd clipcatctl clipcat-menu clipcat-notify; do
       installShellCompletion --cmd $cmd \
diff --git a/pkgs/applications/misc/kaufkauflist/default.nix b/pkgs/applications/misc/kaufkauflist/default.nix
index 8950a3017c18..d214db2c5e78 100644
--- a/pkgs/applications/misc/kaufkauflist/default.nix
+++ b/pkgs/applications/misc/kaufkauflist/default.nix
@@ -21,14 +21,14 @@ let
   };
 in buildNpmPackage rec {
   pname = "kaufkauflist";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "annaaurora";
     repo = "kaufkauflist";
     rev = "v${version}";
-    hash = "sha256-W/FlHLZYYG/s9NdAqm0OJHlpTZtEG4iaegc4iOnAwWk=";
+    hash = "sha256-gIwJtfausORMfmZONhSOZ1DRW5CSH+cLDCNy3j+u6d0=";
   };
 
   npmDepsHash = "sha256-d1mvC72ugmKLNStoemUr8ISCUYjyo9EDWdWUCD1FMiM=";
diff --git a/pkgs/applications/misc/nwg-bar/default.nix b/pkgs/applications/misc/nwg-bar/default.nix
index 41d32418b087..7e9aecd387cd 100644
--- a/pkgs/applications/misc/nwg-bar/default.nix
+++ b/pkgs/applications/misc/nwg-bar/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "nwg-bar";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kqLQwqZ2RPSKNdw1yzKUfqSe8hQcJe/6/8UzTT/Gz/8=";
+    sha256 = "sha256-e64qCthZfGeFIe/g4Bu342d/C46qzJRBdxzzP6rM408=";
   };
 
   patches = [ ./fix-paths.patch ];
@@ -24,7 +24,7 @@ buildGoModule rec {
     substituteInPlace tools.go --subst-var out
   '';
 
-  vendorHash = "sha256-vdDlPsjfHl7w1ufosLYquHAKOvkolNBr04bt+OQBlFE=";
+  vendorHash = "sha256-YMpq9pgA3KjQMcw7JDwEDbHZ5h3N7ziFVIGvQ+xA3Ds=";
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];
 
diff --git a/pkgs/applications/window-managers/sway/contrib.nix b/pkgs/applications/misc/sway-contrib/default.nix
index df5ad07b1c5a..df5ad07b1c5a 100644
--- a/pkgs/applications/window-managers/sway/contrib.nix
+++ b/pkgs/applications/misc/sway-contrib/default.nix
diff --git a/pkgs/applications/misc/translatelocally/default.nix b/pkgs/applications/misc/translatelocally/default.nix
index 81aa9ec91bcf..1ce54adedc84 100644
--- a/pkgs/applications/misc/translatelocally/default.nix
+++ b/pkgs/applications/misc/translatelocally/default.nix
@@ -1,19 +1,20 @@
 { lib, stdenv, fetchFromGitHub
 , cmake, qt6, libarchive, pcre2, protobuf, gperftools, blas
+, runCommand, translatelocally, translatelocally-models
 }:
 
 let
-  rev = "f8a2dba0a63989c6b3a7be36f736ed478cad1dd2";
+  rev = "a210037760ca3ca9016ca1831c97531318df70fe";
 
 in stdenv.mkDerivation (finalAttrs: {
   pname = "translatelocally";
-  version = "unstable-2023-08-25";
+  version = "unstable-2023-09-20";
 
   src = fetchFromGitHub {
     owner = "XapaJIaMnu";
     repo = "translateLocally";
     inherit rev;
-    hash = "sha256-uUdDi0CwCR/FQjw5D2s088d/Tp7NQOI0ia30oOhlGoc=";
+    hash = "sha256-T7cZdR09yDrPTwYxvDIaKTdV4mrB+gTHYVfch5BQ+PE=";
     fetchSubmodules = true;
   };
 
@@ -26,6 +27,11 @@ in stdenv.mkDerivation (finalAttrs: {
       3rd_party/bergamot-translator/3rd_party/marian-dev/src/common/git_revision.h
   '';
 
+  # https://github.com/XapaJIaMnu/translateLocally/blob/81ed8b9/.github/workflows/build.yml#L330
+  postConfigure = lib.optionalString stdenv.isAarch64 ''
+    bash ../cmake/fix_ruy_build.sh .. .
+  '';
+
   nativeBuildInputs = [
     cmake
     protobuf
@@ -48,6 +54,19 @@ in stdenv.mkDerivation (finalAttrs: {
     "-DCBLAS_LIBRARIES=-lcblas"
   ];
 
+  passthru.tests = {
+    cli-translate = runCommand "${finalAttrs.pname}-test-cli-translate" {
+      nativeBuildInputs = [
+        translatelocally
+        translatelocally-models.fr-en-tiny
+      ];
+    } ''
+      export LC_ALL="C.UTF-8"
+      echo "Bonjour" | translateLocally -m fr-en-tiny > $out
+      diff "$out" <(echo "Hello")
+    '';
+  };
+
   meta = with lib; {
     mainProgram = "translateLocally";
     homepage = "https://translatelocally.com/";
@@ -55,8 +74,5 @@ in stdenv.mkDerivation (finalAttrs: {
     license = licenses.mit;
     maintainers = with maintainers; [ pacien ];
     platforms = platforms.linux;
-
-    # https://github.com/XapaJIaMnu/translateLocally/issues/150
-    broken = stdenv.isAarch64;
   };
 })
diff --git a/pkgs/applications/misc/tuxclocker/default.nix b/pkgs/applications/misc/tuxclocker/default.nix
new file mode 100644
index 000000000000..5592c8e2cdec
--- /dev/null
+++ b/pkgs/applications/misc/tuxclocker/default.nix
@@ -0,0 +1,66 @@
+{ lib
+, stdenv
+, boost
+, fetchFromGitHub
+, git
+, makeWrapper
+, meson
+, ninja
+, pkg-config
+, python3
+, qtbase
+, qtcharts
+, tuxclocker-plugins
+, wrapQtAppsHook
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tuxclocker";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "Lurkki14";
+    repo = "tuxclocker";
+    fetchSubmodules = true;
+    rev = "${finalAttrs.version}";
+    hash = "sha256-8dtuZXBWftXNQpqYgNQOayPGfvEIu9QfbqDShfkt1qA=";
+  };
+
+  # Meson doesn't find boost without these
+  BOOST_INCLUDEDIR = "${lib.getDev boost}/include";
+  BOOST_LIBRARYDIR = "${lib.getLib boost}/lib";
+
+  nativeBuildInputs = [
+    git
+    makeWrapper
+    meson
+    ninja
+    pkg-config
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    boost
+    qtbase
+    qtcharts
+  ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/tuxclockerd" \
+      --prefix "TEXTDOMAINDIR" : "${tuxclocker-plugins}/share/locale" \
+      --prefix "TUXCLOCKER_PLUGIN_PATH" : "${tuxclocker-plugins}/lib/tuxclocker/plugins" \
+      --prefix "PYTHONPATH" : "${python3.pkgs.hwdata}/${python3.sitePackages}"
+  '';
+
+  mesonFlags = [
+    "-Dplugins=false"
+  ];
+
+  meta = with lib; {
+    description = "Qt overclocking tool for GNU/Linux";
+    homepage = "https://github.com/Lurkki14/tuxclocker";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ lurkki ];
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/applications/networking/cluster/nerdctl/default.nix b/pkgs/applications/networking/cluster/nerdctl/default.nix
index 96e6d9eec7d2..ee9defe2eeca 100644
--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "nerdctl";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jjYSvY7NT9G/tcsM+9qHnsL81QKItyVMZZWuD2mpln0=";
+    hash = "sha256-6YMDGvNl1uNMWR1xTPRjYGwaKXC5c4oUy88VRY2Bedw=";
   };
 
-  vendorHash = "sha256-O48QzyQLkt7T9j+CKQG8TcHlmtS+ykoMoCamsEswPjk=";
+  vendorHash = "sha256-tXLuOZUoMhVfhhYxnxNw+nYofhEFMKI1b94lVPySd3E=";
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
 
diff --git a/pkgs/applications/networking/cluster/opentofu/default.nix b/pkgs/applications/networking/cluster/opentofu/default.nix
index 068a34d29d4b..4507a03e0b63 100644
--- a/pkgs/applications/networking/cluster/opentofu/default.nix
+++ b/pkgs/applications/networking/cluster/opentofu/default.nix
@@ -14,13 +14,13 @@
 let
   package =  buildGoModule rec {
     pname = "opentofu";
-    version = "1.6.0-beta4";
+    version = "1.6.0-beta5";
 
     src = fetchFromGitHub {
       owner = "opentofu";
       repo = "opentofu";
       rev = "v${version}";
-      hash = "sha256-AFy7xg1UwVWlFZjelYhxfkhj4Tk93uVvF1i3PHa2jEM=";
+      hash = "sha256-RHAhftoqGs9ZoO+NGvZ0AAvT5UWRKzV7cHX1/qVCAMU=";
     };
 
     vendorHash = "sha256-kSm5RZqQRgbmPaKt5IWmuMhHwAu+oJKTX1q1lbE7hWk=";
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 9937359dd497..df62730e0bb9 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -167,9 +167,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.6.5";
-    hash = "sha256-TJKs7pWoLFIeov/ERgPqZxPtbjSAHrHI2wrSEXUAS1A=";
-    vendorHash = "sha256-QHfCGlgOv4v3MzUs4JxIHytcyymUYmnk4Z0smgak1Mg=";
+    version = "1.6.6";
+    hash = "sha256-fYFmHypzSbSgut9Wij6Sz8xR97DVOwPLQap6pan7IRA=";
+    vendorHash = "sha256-fQsxTX1v8HsMDIkofeCVfNitJAaTWHwppC7DniXlvT4=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;
diff --git a/pkgs/applications/networking/instant-messengers/neosay/default.nix b/pkgs/applications/networking/instant-messengers/neosay/default.nix
index 4d9b70dd1e2e..3f76bdade3a8 100644
--- a/pkgs/applications/networking/instant-messengers/neosay/default.nix
+++ b/pkgs/applications/networking/instant-messengers/neosay/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "neosay";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "donuts-are-good";
     repo = "neosay";
     rev = "v${version}";
-    hash = "sha256-Uwz6Y26AtzWXLFgJY0WVD0HBb+vbMeeMKt8gCk6viec=";
+    hash = "sha256-2tFjvAobDpBh1h0ejdtqxDsC+AqyneN+xNssOJNfEbk=";
   };
 
   vendorHash = "sha256-w0aZnel5Obq73UXcG9wmO9t/7qQTE8ru656u349cvzQ=";
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
index d69571928af8..c331c56eb7cd 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "6.40.0";
+  version = "6.42.0";
   url = "https://github.com/0mniteck/Signal-Desktop-Mobian/raw/${version}/builds/release/signal-desktop_${version}_arm64.deb";
-  hash = "sha256-3Pi0c+CGcJR1M4ll51m+B5PmGIcIjjlc0qa9b8rkMeU=";
+  hash = "sha256-kr8FM+EAtL/7TrgJlI33oDd4CPGMJ+F2PpQCR4OL6j4=";
 }
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
index 9b99f67e156a..02b54fd1de94 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix {} rec {
   pname = "signal-desktop-beta";
   dir = "Signal Beta";
-  version = "6.40.0-beta.2";
+  version = "6.43.0-beta.1";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-pfedkxbZ25DFgz+/N7ZEb9LwKrHuoMM+Zi+Tc21QPsg=";
+  hash = "sha256-7UlfpOWAalJjZjAJLa2CL3HdR2LFlE1/5sdec5Sj/tg=";
 }
diff --git a/pkgs/applications/networking/p2p/tribler/default.nix b/pkgs/applications/networking/p2p/tribler/default.nix
index b4fba4b9197e..fc8377a4d113 100644
--- a/pkgs/applications/networking/p2p/tribler/default.nix
+++ b/pkgs/applications/networking/p2p/tribler/default.nix
@@ -95,6 +95,8 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share/applications $out/share/icons
     cp $out/build/debian/tribler/usr/share/applications/org.tribler.Tribler.desktop $out/share/applications/
     cp $out/build/debian/tribler/usr/share/pixmaps/tribler_big.xpm $out/share/icons/tribler.xpm
+    mkdir -p $out/share/copyright/tribler
+    mv $out/LICENSE $out/share/copyright/tribler
   '';
 
   shellHook = ''
diff --git a/pkgs/applications/science/chemistry/jmol/default.nix b/pkgs/applications/science/chemistry/jmol/default.nix
index f006df2ae5c0..ce3b279deab1 100644
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@@ -25,14 +25,14 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "16.1.45";
+  version = "16.1.47";
   pname = "jmol";
 
   src = let
     baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
   in fetchurl {
     url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    hash = "sha256-rLq0QrY1M0OptmRZ/dKUVssREnH1im9Ti89AbpsiFtg=";
+    hash = "sha256-3hsH+RkPPoViKp1bc/88GDVSG8jf9hiPKPkUfe9PIkk=";
   };
 
   patchPhase = ''
diff --git a/pkgs/applications/science/electronics/nvc/default.nix b/pkgs/applications/science/electronics/nvc/default.nix
index 284a0b15830b..a6f2c9d44731 100644
--- a/pkgs/applications/science/electronics/nvc/default.nix
+++ b/pkgs/applications/science/electronics/nvc/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nvc";
-  version = "1.11.0";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "nickg";
     repo = "nvc";
     rev = "r${version}";
-    hash = "sha256-95vIyBQ38SGpI+gnDqK1MRRzOT6uiYjDr1c//folqZ8=";
+    hash = "sha256-aBH3TtPFuJXtVvGTJcGJev5DYVwqjUAM9cf5PatJq9Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/logic/alt-ergo/default.nix b/pkgs/applications/science/logic/alt-ergo/default.nix
index bc8c6ae48587..d84aa5b6918a 100644
--- a/pkgs/applications/science/logic/alt-ergo/default.nix
+++ b/pkgs/applications/science/logic/alt-ergo/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, fetchpatch, lib, ocamlPackages }:
+{ darwin, fetchurl, lib, ocamlPackages, stdenv }:
 
 let
   pname = "alt-ergo";
@@ -28,7 +28,7 @@ ocamlPackages.buildDunePackage {
 
   inherit pname version src;
 
-  nativeBuildInputs = [ ocamlPackages.menhir ];
+  nativeBuildInputs = [ ocamlPackages.menhir ] ++ lib.optionals stdenv.isDarwin [ darwin.sigtool ];
   buildInputs = [ alt-ergo-parsers ] ++ (with ocamlPackages; [ cmdliner dune-site ]);
 
   meta = {
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index 9fe06f6d7969..ee3610c5f6f6 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -58,7 +58,7 @@
 
 stdenv.mkDerivation rec {
   pname = "root";
-  version = "6.28.10";
+  version = "6.30.02";
 
   passthru = {
     tests = import ./tests { inherit callPackage; };
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    hash = "sha256-adb962B+ayC9AsdX+mIXAkwLYTLB6bHf9Nhdmiu35R4=";
+    hash = "sha256-eWWkVtGtHuDV/kdpv1qP7Cka9oTtk9sPMICpw2JDUYM=";
   };
 
   nativeBuildInputs = [ makeWrapper cmake pkg-config git ];
@@ -110,6 +110,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./sw_vers.patch
+
+    # Fix for builtin_llvm=OFF
+    # https://github.com/root-project/root/pull/14238
+    (fetchpatch {
+      url = "https://github.com/root-project/root/commit/1477d3adebf27a19f3a8b85f21c27a0a5649c7ff.diff";
+      hash = "sha256-g+FqXBTWXA7t7F/rMarnmOK2014oCNnNJbHhjH+Tvjw=";
+    })
   ];
 
   preConfigure = ''
@@ -121,7 +128,7 @@ stdenv.mkDerivation rec {
     substituteInPlace cmake/modules/SearchInstalledSoftware.cmake \
       --replace 'set(lcgpackages ' '#set(lcgpackages '
 
-    substituteInPlace interpreter/llvm/src/tools/clang/tools/driver/CMakeLists.txt \
+    substituteInPlace interpreter/llvm-project/clang/tools/driver/CMakeLists.txt \
       --replace 'add_clang_symlink(''${link} clang)' ""
 
     # Don't require textutil on macOS
@@ -136,8 +143,8 @@ stdenv.mkDerivation rec {
     substituteInPlace rootx/src/rootx.cxx --replace "gNoLogo = false" "gNoLogo = true"
   '' + lib.optionalString stdenv.isDarwin ''
     # Eliminate impure reference to /System/Library/PrivateFrameworks
-    substituteInPlace core/CMakeLists.txt \
-      --replace "-F/System/Library/PrivateFrameworks" ""
+    substituteInPlace core/macosx/CMakeLists.txt \
+      --replace "-F/System/Library/PrivateFrameworks " ""
   '' + lib.optionalString (stdenv.isDarwin && lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
     MACOSX_DEPLOYMENT_TARGET=10.16
   '';
@@ -184,6 +191,7 @@ stdenv.mkDerivation rec {
     "-Dsqlite=OFF"
     "-Dssl=ON"
     "-Dtmva=ON"
+    "-Dtmva-pymva=OFF"
     "-Dvdt=OFF"
     "-Dwebgui=ON"
     "-Dxml=ON"
diff --git a/pkgs/applications/science/misc/root/sw_vers.patch b/pkgs/applications/science/misc/root/sw_vers.patch
index 836bbb5b17a4..54ad1091392e 100644
--- a/pkgs/applications/science/misc/root/sw_vers.patch
+++ b/pkgs/applications/science/misc/root/sw_vers.patch
@@ -1,8 +1,8 @@
 diff a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
 --- a/cmake/modules/SetUpMacOS.cmake
 +++ b/cmake/modules/SetUpMacOS.cmake
-@@ -28,17 +28,10 @@ if(CMAKE_VERSION VERSION_LESS 3.14.4)
- endif()
+@@ -8,17 +8,10 @@
+ set(ROOT_PLATFORM macosx)
  
  if (CMAKE_SYSTEM_NAME MATCHES Darwin)
 -  EXECUTE_PROCESS(COMMAND sw_vers "-productVersion"
@@ -19,7 +19,7 @@ diff a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
      #TODO: check haveconfig and rpath -> set rpath true
      #TODO: check Thread, define link command
      #TODO: more stuff check configure script
-@@ -57,22 +50,7 @@ if (CMAKE_SYSTEM_NAME MATCHES Darwin)
+@@ -37,22 +30,7 @@
         SET(CMAKE_SHARED_LIBRARY_CREATE_CXX_FLAGS "${CMAKE_SHARED_LIBRARY_CREATE_CXX_FLAGS} -m64")
         SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -m64")
         SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -m64")
@@ -42,7 +42,7 @@ diff a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
  
    if (CMAKE_COMPILER_IS_GNUCXX)
       SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -pipe -W -Wshadow -Wall -Woverloaded-virtual -fsigned-char -fno-common")
-@@ -130,7 +108,6 @@ if (CMAKE_SYSTEM_NAME MATCHES Darwin)
+@@ -96,7 +74,6 @@
    endif()
  
    #---Set Linker flags----------------------------------------------------------------------
@@ -53,7 +53,7 @@ diff a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
 diff a/config/root-config.in b/config/root-config.in
 --- a/config/root-config.in
 +++ b/config/root-config.in
-@@ -312,12 +312,6 @@ macosxicc)
+@@ -307,12 +307,6 @@
     ;;
  macosx64|macosxarm64)
     # MacOS X with gcc (GNU cc v4.x) in 64 bit mode
@@ -66,7 +66,7 @@ diff a/config/root-config.in b/config/root-config.in
     auxcflags="${cxxversionflag} -m64"
     auxldflags="-m64"
     auxlibs="-lm -ldl"
-@@ -378,18 +372,11 @@ freebsd* | openbsd* | linux*)
+@@ -387,17 +381,11 @@
     done
     ;;
  macosx*)
@@ -74,7 +74,6 @@ diff a/config/root-config.in b/config/root-config.in
        auxcflags="-pthread $auxcflags"
        auxlibs="-lpthread $auxlibs"
 -   else
--      auxcflags="-D_REENTRANT $auxcflags"
 -      auxlibs="-lpthread $auxlibs"
 -   fi
     for f in $features ; do
diff --git a/pkgs/applications/science/robotics/mujoco/default.nix b/pkgs/applications/science/robotics/mujoco/default.nix
index 139e1140e7c9..95d3e1269350 100644
--- a/pkgs/applications/science/robotics/mujoco/default.nix
+++ b/pkgs/applications/science/robotics/mujoco/default.nix
@@ -22,8 +22,8 @@ let
     benchmark = fetchFromGitHub {
       owner = "google";
       repo = "benchmark";
-      rev = "344117638c8ff7e239044fd0fa7085839fc03021";
-      hash = "sha256-gztnxui9Fe/FTieMjdvfJjWHjkImtlsHn6fM1FruyME=";
+      rev = "e45585a4b8e75c28479fa4107182c28172799640";
+      hash = "sha256-pgHvmRpPd99ePUVRsi7WXLVSZngZ5q6r1vWW4mdGvxY=";
     };
     ccd = fetchFromGitHub {
       owner = "danfis";
@@ -34,8 +34,8 @@ let
     eigen3 = fetchFromGitLab {
       owner = "libeigen";
       repo = "eigen";
-      rev = "e8515f78ac098329ab9f8cab21c87caede090a3f";
-      hash = "sha256-HXKtFJsKGpug+wNPjYynTuyaG0igo3oG4rFQktveh1g=";
+      rev = "454f89af9d6f3525b1df5f9ef9c86df58bf2d4d3";
+      hash = "sha256-a9QAnv6vIM8a9Bn8ZmfeMT0+kbtb0QGxM0+m5xwIqm8=";
     };
     googletest = fetchFromGitHub {
       owner = "google";
@@ -129,13 +129,15 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "mujoco";
-  version = "3.0.1";
+  version = "3.1.0";
 
+  # Bumping version? Make sure to look though the MuJoCo's commit
+  # history for bumped dependency pins!
   src = fetchFromGitHub {
     owner = "google-deepmind";
     repo = pname;
     rev = version;
-    hash = "sha256-UXE+7KDti8RarpoJoo9Ei3TgW/Qdnj3ASRo8uTWhGrU=";
+    hash = "sha256-a8h30psoAlj9dI4j8IfY3WzWjY4MrRosGbvgt79s1BQ=";
   };
 
   patches = [ ./mujoco-system-deps-dont-fetch.patch ];
diff --git a/pkgs/applications/version-management/gitkraken/default.nix b/pkgs/applications/version-management/gitkraken/default.nix
index a58ea68fe2b6..0e25f63765e1 100644
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@@ -10,24 +10,24 @@ with lib;
 
 let
   pname = "gitkraken";
-  version = "9.9.2";
+  version = "9.10.0";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchzip {
       url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-      sha256 = "sha256-UfzHkgqxEaSsoiDwFLsyIBW2min9AvSBrLPJ2MlKh3U=";
+      hash = "sha256-JVeJY0VUNyIeR/IQcfoLBN0I1WQNFy7PpCjzk5bPv/Q=";
     };
 
     x86_64-darwin = fetchzip {
       url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      sha256 = "sha256-ble0n+giM8xmuSewBVdj+RuT2093rW0taNzsyQLO92I=";
+      hash = "sha256-npc+dwHH0tlVKkAZxmGwpoiHXeDn0VHkivqbwoJsI7M=";
     };
 
     aarch64-darwin = fetchzip {
       url = "https://release.axocdn.com/darwin-arm64/GitKraken-v${version}.zip";
-      sha256 = "sha256-QYhYzjqbCO0/pRDK7c5jYifj+/UY7SLpRqQUQ3LBFkE=";
+      hash = "sha256-fszsGdNKcVgKdv97gBBf+fSODzjKbOBB4MyCvWzm3CA=";
     };
   };
 
@@ -39,7 +39,7 @@ let
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = builtins.attrNames srcs;
-    maintainers = with maintainers; [ xnwdd evanjs arkivm ];
+    maintainers = with maintainers; [ xnwdd evanjs arkivm nicolas-goudry ];
     mainProgram = "gitkraken";
   };
 
diff --git a/pkgs/applications/video/filebot/default.nix b/pkgs/applications/video/filebot/default.nix
index e38b4dde3d29..fd779bf0bf81 100644
--- a/pkgs/applications/video/filebot/default.nix
+++ b/pkgs/applications/video/filebot/default.nix
@@ -10,11 +10,11 @@ let
   };
 in stdenv.mkDerivation (finalAttrs: {
   pname = "filebot";
-  version = "5.1.1";
+  version = "5.1.2";
 
   src = fetchurl {
     url = "https://web.archive.org/web/20230917142929/https://get.filebot.net/filebot/FileBot_${finalAttrs.version}/FileBot_${finalAttrs.version}-portable.tar.xz";
-    hash = "sha256-BCsZBRtT2Ka7WZw7WFnagwoJwIO1L3qpFk/6nlGdpmQ=";
+    hash = "sha256-+5I0t67asbCwaMCuqI/ixRHNAdcLTziuYOfepVThoPk=";
   };
 
   unpackPhase = "tar xvf $src";
diff --git a/pkgs/applications/video/mpv/scripts/buildLua.nix b/pkgs/applications/video/mpv/scripts/buildLua.nix
index c7f510253f94..37690d987430 100644
--- a/pkgs/applications/video/mpv/scripts/buildLua.nix
+++ b/pkgs/applications/video/mpv/scripts/buildLua.nix
@@ -2,7 +2,6 @@
 , stdenvNoCC }:
 
 let
-  inherit (lib) hasPrefix hasSuffix removeSuffix;
   escapedList = with lib; concatMapStringsSep " " (s: "'${escape [ "'" ] s}'");
   fileName = pathStr: lib.last (lib.splitString "/" pathStr);
   scriptsDir = "$out/share/mpv/scripts";
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix b/pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix
index 6d11ed2ffd55..3b5824f34529 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-vertical-canvas";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "Aitum";
     repo = "obs-vertical-canvas";
     rev = version;
-    sha256 = "sha256-gDM2S/ygN58iodfO5d34LYUclkzf+nAIBWp+wFeWWik=";
+    sha256 = "sha256-kJJepKUH/tc6iV/zFDtrAa4bM9Gaqc9M7IItytknkGA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index a896829356b1..c8ca4b8d20ee 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yeZGhE+ImWXW3HPpAo+E1GOSEwPr7yK78XVmCocGqH4=";
+    sha256 = "sha256-EaJYuapTWzVD80UyhzjP1q1SCCNmUozf+hUl4wBgC14=";
   };
 
-  cargoHash = "sha256-xqKYd80PCM7Rnj+9dV2XjigE4sweOnL4HfOQiOYzCEQ=";
+  cargoHash = "sha256-Vh5mdxxROVthDUzK+PRhl9AY5jcmvhEXP5UqOeqOm6o=";
 
   # skip test due FHS dependency
   doCheck = false;
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index 8841abcd3671..b714db0bd62a 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -62,13 +62,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "4.7.2";
+  version = "4.8.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-o5FTCuFUbTlENqvh+u6fPEfD816tKWPxHu2yhBi/Mf0=";
+    hash = "sha256-EDIgipbv8Z7nVV6VQ5IAmvHvvpLyGEDHMDnwhMUm/BQ=";
   };
 
   patches = [
diff --git a/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch b/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
index 5663f5e8a018..179ce41f02b2 100644
--- a/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
+++ b/pkgs/applications/virtualization/podman/rm-podman-mac-helper-msg.patch
@@ -1,5 +1,5 @@
 diff --git a/pkg/machine/machine_common.go b/pkg/machine/machine_common.go
-index 649748947..a981d93bf 100644
+index 4e43dd54c..a981d93bf 100644
 --- a/pkg/machine/machine_common.go
 +++ b/pkg/machine/machine_common.go
 @@ -127,14 +127,6 @@ address can't be used by podman. `
@@ -7,10 +7,10 @@ index 649748947..a981d93bf 100644
  				if len(helper) < 1 {
  					fmt.Print(fmtString)
 -				} else {
--					fmtString += `If you would like to install it run the\nfollowing commands:
+-					fmtString += `If you would like to install it, run the following commands:
 -
 -        sudo %s install
--        podman machine stop%[1]s; podman machine start%[1]s
+-        podman machine stop%[2]s; podman machine start%[2]s
 -
 -                `
 -					fmt.Printf(fmtString, helper, suffix)
diff --git a/pkgs/build-support/fetchgitlab/default.nix b/pkgs/build-support/fetchgitlab/default.nix
index 2ccb81335cc2..749883f2365e 100644
--- a/pkgs/build-support/fetchgitlab/default.nix
+++ b/pkgs/build-support/fetchgitlab/default.nix
@@ -1,9 +1,11 @@
-{ fetchgit, fetchzip, lib }:
+{ lib, fetchgit, fetchzip }:
 
 lib.makeOverridable (
 # gitlab example
 { owner, repo, rev, protocol ? "https", domain ? "gitlab.com", name ? "source", group ? null
-, fetchSubmodules ? false, leaveDotGit ? false, deepClone ? false
+, fetchSubmodules ? false, leaveDotGit ? false
+, deepClone ? false, forceFetchGit ? false
+, sparseCheckout ? []
 , ... # For hash agility
 } @ args:
 
@@ -11,15 +13,15 @@ let
   slug = lib.concatStringsSep "/" ((lib.optional (group != null) group) ++ [ owner repo ]);
   escapedSlug = lib.replaceStrings [ "." "/" ] [ "%2E" "%2F" ] slug;
   escapedRev = lib.replaceStrings [ "+" "%" "/" ] [ "%2B" "%25" "%2F" ] rev;
-  passthruAttrs = removeAttrs args [ "protocol" "domain" "owner" "group" "repo" "rev" "fetchSubmodules" "leaveDotGit" "deepClone" ];
+  passthruAttrs = removeAttrs args [ "protocol" "domain" "owner" "group" "repo" "rev" "fetchSubmodules" "forceFetchGit" "leaveDotGit" "deepClone" ];
 
-  useFetchGit = deepClone || fetchSubmodules || leaveDotGit;
+  useFetchGit = fetchSubmodules || leaveDotGit || deepClone || forceFetchGit || (sparseCheckout != []);
   fetcher = if useFetchGit then fetchgit else fetchzip;
 
   gitRepoUrl = "${protocol}://${domain}/${slug}.git";
 
   fetcherArgs = (if useFetchGit then {
-    inherit rev deepClone fetchSubmodules leaveDotGit;
+    inherit rev deepClone fetchSubmodules sparseCheckout leaveDotGit;
     url = gitRepoUrl;
   } else {
     url = "${protocol}://${domain}/api/v4/projects/${escapedSlug}/repository/archive.tar.gz?sha=${escapedRev}";
diff --git a/pkgs/build-support/fetchzip/default.nix b/pkgs/build-support/fetchzip/default.nix
index 0446851d6409..6e6c5270a750 100644
--- a/pkgs/build-support/fetchzip/default.nix
+++ b/pkgs/build-support/fetchzip/default.nix
@@ -24,7 +24,7 @@
 # the rest are given to fetchurl as is
 , ... } @ args:
 
-assert (extraPostFetch != "") -> lib.warn "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub'." true;
+assert (extraPostFetch != "") -> lib.warn "use 'postFetch' instead of 'extraPostFetch' with 'fetchzip' and 'fetchFromGitHub' or 'fetchFromGitLab'." true;
 
 let
   tmpFilename =
diff --git a/pkgs/by-name/an/anime4k/package.nix b/pkgs/by-name/an/anime4k/package.nix
new file mode 100644
index 000000000000..eef64ffc3ae9
--- /dev/null
+++ b/pkgs/by-name/an/anime4k/package.nix
@@ -0,0 +1,32 @@
+{ fetchFromGitHub
+, lib
+, stdenvNoCC
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "anime4k";
+  version = "4.0.1";
+
+  src = fetchFromGitHub {
+    owner = "bloc97";
+    repo = "Anime4k";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-OQWJWcDpwmnJJ/kc4uEReaO74dYFlxNQwf33E5Oagb0=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 glsl/*/*.glsl -t $out
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A high-quality real time upscaler for anime";
+    homepage = "https://github.com/bloc97/Anime4K";
+    license = licenses.mit;
+    maintainers = with maintainers; [ surfaceflinger ];
+    platforms = platforms.all;
+  };
+})
diff --git a/pkgs/by-name/as/asn1editor/package.nix b/pkgs/by-name/as/asn1editor/package.nix
new file mode 100644
index 000000000000..a85d8f53fe6d
--- /dev/null
+++ b/pkgs/by-name/as/asn1editor/package.nix
@@ -0,0 +1,37 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "asn1editor";
+  version = "0.8.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "Futsch1";
+    repo = "asn1editor";
+    rev = "v${version}";
+    hash = "sha256-mgluhC2DMS4OyS/BoWqBdVf7GcxquOtOKTHZ/hbiHQM=";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    asn1tools
+    coverage
+    wxPython_4_2
+  ];
+
+  pythonImportsCheck = [ "asn1editor" ];
+
+  # Tests fail in sandbox, e.g.
+  # "SystemExit: Unable to access the X Display, is $DISPLAY set properly?"
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Python based editor for ASN.1 encoded data";
+    homepage = "https://github.com/Futsch1/asn1editor";
+    license = licenses.mit;
+    mainProgram = "asn1editor";
+    maintainers = with maintainers; [ bjornfor ];
+  };
+}
diff --git a/pkgs/by-name/en/endlines/package.nix b/pkgs/by-name/en/endlines/package.nix
new file mode 100644
index 000000000000..b03a0d733535
--- /dev/null
+++ b/pkgs/by-name/en/endlines/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "endlines";
+  version = "1.9.2";
+
+  src = fetchFromGitHub {
+    owner = "mdolidon";
+    repo = "endlines";
+    rev = finalAttrs.version;
+    hash = "sha256-M0IyY/WXR8qv9/qx5G0pG3EKqMoZAP3fJTZ6sSSMMyQ=";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile --replace "/usr/local" "$out"
+  '';
+
+  preInstall = ''
+    mkdir -p $out/bin
+  '';
+
+  meta = {
+    homepage = "https://github.com/mdolidon/endlines";
+    description = "Easy conversion between new-line conventions";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ zedseven ];
+    mainProgram = "endlines";
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/i3/i3-open-next-ws/package.nix b/pkgs/by-name/i3/i3-open-next-ws/package.nix
new file mode 100644
index 000000000000..129f170dd28e
--- /dev/null
+++ b/pkgs/by-name/i3/i3-open-next-ws/package.nix
@@ -0,0 +1,24 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "i3-open-next-ws";
+  version = "0.1.5";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-eYHCm8jEv6Ll6/h1kcYHNxWGnVWI41ZB96Jec9oZFsY=";
+  };
+  cargoHash = "sha256-9U0bYCbkvcZJOCd4jZog4bSJkP1ntmAFjWm7lJDdcuo=";
+
+  meta = {
+    description = "A workspace management utility for i3 and sway, that picks the first unused workspace automagically";
+    homepage = "https://github.com/JohnDowson/i3-open-next-ws";
+    license = lib.licenses.mit;
+    mainProgram = "i3-open-next-ws";
+    maintainers = with lib.maintainers; [quantenzitrone];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/mo/mommy/package.nix b/pkgs/by-name/mo/mommy/package.nix
index 24e83eef6d09..d7bdbb1a383c 100644
--- a/pkgs/by-name/mo/mommy/package.nix
+++ b/pkgs/by-name/mo/mommy/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mommy";
-  version = "1.2.4";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "FWDekker";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-SqWhbhQeRUO0cD9Fv/nwKjTI3F0Sg2VhFZtrbyA9Wb4=";
+    hash = "sha256-5mf157hjDE/9YcLsThjadkknuEfPZS8Pp6mtNCWbvEw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/my/mystmd/package.nix b/pkgs/by-name/my/mystmd/package.nix
index 79fbff2f2b07..3fc3880220f9 100644
--- a/pkgs/by-name/my/mystmd/package.nix
+++ b/pkgs/by-name/my/mystmd/package.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "mystmd";
-  version = "1.1.31";
+  version = "1.1.36";
 
   src = fetchFromGitHub {
     owner = "executablebooks";
     repo = "mystmd";
     rev = "mystmd@${version}";
-    hash = "sha256-1zjz1HJxa8ww02MnqravCWM51bpuSpnLxn34Kazbt5o=";
+    hash = "sha256-mmrNfE8d5yhWU7KsSBKuRpP59Ba6Q6pdkCN2AE+PEJE=";
   };
 
-  npmDepsHash = "sha256-7H3VKJAzbsKLhyFD7MoASsOyJwbt6vERO6LM2mpz/y0=";
+  npmDepsHash = "sha256-5ns2mVD8YJvVMpMq9VeelAoGU0b9SLNIOdRAHXpnCDM=";
 
   dontNpmInstall = true;
 
diff --git a/pkgs/by-name/na/nautilus-open-in-blackbox/package.nix b/pkgs/by-name/na/nautilus-open-in-blackbox/package.nix
new file mode 100644
index 000000000000..638d6ac671e1
--- /dev/null
+++ b/pkgs/by-name/na/nautilus-open-in-blackbox/package.nix
@@ -0,0 +1,35 @@
+{ python3, fetchFromGitHub, gnome, stdenv, lib }:
+stdenv.mkDerivation rec {
+  pname = "nautilus-open-in-blackbox";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+      owner = "ppvan";
+      repo = "nautilus-open-in-blackbox";
+      rev = "refs/tags/${version}";
+      hash = "sha256-5rvh3qNalpjamcBVQrnAW6GxhwPPlRxP5h045YDqvrM=";
+  };
+
+  # The Orignal Source code tries to execute `/usr/bin/blackbox` which is not valid in NixOS
+  # This patch replaces the call with `blackbox`
+  patches = [ ./paths.patch ];
+
+  buildInputs = [
+    gnome.nautilus-python
+    python3.pkgs.pygobject3
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm555 ./nautilus-open-in-blackbox.py -t $out/share/nautilus-python/extensions
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Extension for nautilus, which adds an context-entry for opening in blackbox";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ blankparticle ];
+    homepage = "https://github.com/ppvan/nautilus-open-in-blackbox";
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/na/nautilus-open-in-blackbox/paths.patch b/pkgs/by-name/na/nautilus-open-in-blackbox/paths.patch
new file mode 100644
index 000000000000..4705426a58de
--- /dev/null
+++ b/pkgs/by-name/na/nautilus-open-in-blackbox/paths.patch
@@ -0,0 +1,23 @@
+diff --git a/nautilus-open-in-blackbox.py b/nautilus-open-in-blackbox.py
+index 9a43f90..0a5b632 100755
+--- a/nautilus-open-in-blackbox.py
++++ b/nautilus-open-in-blackbox.py
+@@ -78,17 +78,10 @@ class BlackBoxNautilus(GObject.GObject, Nautilus.MenuProvider):
+ 
+         return item
+ 
+-    def is_native(self):
+-        return shutil.which("blackbox") == "/usr/bin/blackbox"
+-
+     def _nautilus_run(self, menu, path):
+         """'Open with BlackBox 's menu item callback."""
+         print("Openning:", path)
+-        args = None
+-        if self.is_native():
+-            args = args = ["blackbox", "-w", path]
+-        else:
+-            args = ["/usr/bin/flatpak", "run", TERMINAL_NAME, "-w", path]
++        args = ["blackbox", "-w", path]
+ 
+         subprocess.Popen(args, cwd=path)
+ 
diff --git a/pkgs/by-name/no/noto-fonts/package.nix b/pkgs/by-name/no/noto-fonts/package.nix
index 4f8606095e02..2d47e7ee64ab 100644
--- a/pkgs/by-name/no/noto-fonts/package.nix
+++ b/pkgs/by-name/no/noto-fonts/package.nix
@@ -18,13 +18,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "noto-fonts${suffix}";
-  version = "23.11.1";
+  version = "23.12.1";
 
   src = fetchFromGitHub {
     owner = "notofonts";
     repo = "notofonts.github.io";
     rev = "noto-monthly-release-${version}";
-    hash = "sha256-qBHLCOfVBOn9CV194S4cYw9nhHyAe2AUBJHQMvyEfW8=";
+    hash = "sha256-Hmw6yGFbnxgKMdKjQCQzuVl+pFCVxbJrT3sGntXUPgk=";
   };
 
   _variants = map (variant: builtins.replaceStrings [ " " ] [ "" ] variant) variants;
diff --git a/pkgs/by-name/pa/passes/package.nix b/pkgs/by-name/pa/passes/package.nix
index 35a8a94a9fe1..39a502038b52 100644
--- a/pkgs/by-name/pa/passes/package.nix
+++ b/pkgs/by-name/pa/passes/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "passes";
-  version = "0.8";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "pablo-s";
     repo = "passes";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SIJLBVWyW9+Hzb6ebfUnBfUuvNmYBm9ojKrnFOS3BGc=";
+    hash = "sha256-RfoqIyqc9zwrWZ5RLhQl+6vTccbCTwtDcMlnWPCDOag=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/audio/soco-cli/default.nix b/pkgs/by-name/so/soco-cli/package.nix
index 068f916e4ef0..b2b415414c79 100644
--- a/pkgs/tools/audio/soco-cli/default.nix
+++ b/pkgs/by-name/so/soco-cli/package.nix
@@ -5,16 +5,16 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "soco-cli";
-  version = "0.4.55";
+  version = "0.4.73";
   format = "setuptools";
 
   disabled = python3.pythonOlder "3.6";
 
-  src = fetchFromGitHub rec {
+  src = fetchFromGitHub {
     owner = "avantrec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zdu1eVtVBTYa47KjGc5fqKN6olxp98RoLGT2sNCfG9E=";
+    hash = "sha256-WxBwHjh5tCXclQXqrHrpvZdcQU93RObteAfZyyVvKf0=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -32,11 +32,11 @@ python3.pkgs.buildPythonApplication rec {
     "soco_cli"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Command-line interface to control Sonos sound systems";
     homepage = "https://github.com/avantrec/soco-cli";
-    license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ fab ];
+    license = with lib.licenses; [ asl20 ];
     mainProgram = "sonos";
+    maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/applications/window-managers/sway/assign-cgroups.nix b/pkgs/by-name/sw/sway-assign-cgroups/package.nix
index c6029de3ee80..c420a32cf37b 100644
--- a/pkgs/applications/window-managers/sway/assign-cgroups.nix
+++ b/pkgs/by-name/sw/sway-assign-cgroups/package.nix
@@ -4,7 +4,7 @@
 }:
 
 python3Packages.buildPythonApplication rec {
-  pname = "assign-cgroups";
+  pname = "sway-assign-cgroups";
   version = "0.4.0";
   src = fetchFromGitHub {
     owner = "alebastr";
diff --git a/pkgs/applications/window-managers/sway/fix-paths.patch b/pkgs/by-name/sw/sway-unwrapped/fix-paths.patch
index c52f65b146b7..c52f65b146b7 100644
--- a/pkgs/applications/window-managers/sway/fix-paths.patch
+++ b/pkgs/by-name/sw/sway-unwrapped/fix-paths.patch
diff --git a/pkgs/applications/window-managers/sway/load-configuration-from-etc.patch b/pkgs/by-name/sw/sway-unwrapped/load-configuration-from-etc.patch
index 46a170abc04a..46a170abc04a 100644
--- a/pkgs/applications/window-managers/sway/load-configuration-from-etc.patch
+++ b/pkgs/by-name/sw/sway-unwrapped/load-configuration-from-etc.patch
diff --git a/pkgs/applications/window-managers/sway/default.nix b/pkgs/by-name/sw/sway-unwrapped/package.nix
index 38fa09e86f70..452925beeabb 100644
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/by-name/sw/sway-unwrapped/package.nix
@@ -2,7 +2,7 @@
 , meson, ninja, pkg-config, wayland-scanner, scdoc
 , libGL, wayland, libxkbcommon, pcre2, json_c, libevdev
 , pango, cairo, libinput, gdk-pixbuf, librsvg
-, wlroots, wayland-protocols, libdrm
+, wlroots_0_16, wayland-protocols, libdrm
 , nixosTests
 # Used by the NixOS module:
 , isNixOS ? false
@@ -11,6 +11,9 @@
 , trayEnabled ? systemdSupport
 }:
 
+let
+  wlroots = wlroots_0_16;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sway-unwrapped";
   version = "1.8.1";
diff --git a/pkgs/applications/window-managers/sway/sway-config-nixos-paths.patch b/pkgs/by-name/sw/sway-unwrapped/sway-config-nixos-paths.patch
index bbb0f722b8bc..bbb0f722b8bc 100644
--- a/pkgs/applications/window-managers/sway/sway-config-nixos-paths.patch
+++ b/pkgs/by-name/sw/sway-unwrapped/sway-config-nixos-paths.patch
diff --git a/pkgs/applications/window-managers/sway/sway-config-no-nix-store-references.patch b/pkgs/by-name/sw/sway-unwrapped/sway-config-no-nix-store-references.patch
index 009c12959430..009c12959430 100644
--- a/pkgs/applications/window-managers/sway/sway-config-no-nix-store-references.patch
+++ b/pkgs/by-name/sw/sway-unwrapped/sway-config-no-nix-store-references.patch
diff --git a/pkgs/applications/window-managers/sway/wrapper.nix b/pkgs/by-name/sw/sway/package.nix
index 7510e1e9582b..3e9ed51613f8 100644
--- a/pkgs/applications/window-managers/sway/wrapper.nix
+++ b/pkgs/by-name/sw/sway/package.nix
@@ -31,8 +31,10 @@ let
        exec ${lib.optionalString dbusSupport "${dbus}/bin/dbus-run-session"} ${lib.getExe sway} "$@"
      fi
    '';
-in symlinkJoin {
-  name = "${sway.meta.mainProgram}-${sway.version}";
+in symlinkJoin rec {
+  pname = lib.replaceStrings ["-unwrapped"] [""] sway.pname;
+  inherit (sway) version;
+  name = "${pname}-${version}";
 
   paths = (optional withBaseWrapper baseWrapper)
     ++ [ sway ];
diff --git a/pkgs/applications/window-managers/sway/bg.nix b/pkgs/by-name/sw/swaybg/package.nix
index aa5d12cdfc4f..aa5d12cdfc4f 100644
--- a/pkgs/applications/window-managers/sway/bg.nix
+++ b/pkgs/by-name/sw/swaybg/package.nix
diff --git a/pkgs/applications/window-managers/sway/swaycons.nix b/pkgs/by-name/sw/swaycons/package.nix
index c990a2bb5186..c990a2bb5186 100644
--- a/pkgs/applications/window-managers/sway/swaycons.nix
+++ b/pkgs/by-name/sw/swaycons/package.nix
diff --git a/pkgs/applications/window-managers/sway/swayest-workstyle/default.nix b/pkgs/by-name/sw/swayest-workstyle/package.nix
index 2867db53f371..2867db53f371 100644
--- a/pkgs/applications/window-managers/sway/swayest-workstyle/default.nix
+++ b/pkgs/by-name/sw/swayest-workstyle/package.nix
diff --git a/pkgs/applications/window-managers/sway/fx.nix b/pkgs/by-name/sw/swayfx-unwrapped/package.nix
index d8ca9cfb7f48..b49496f1383d 100644
--- a/pkgs/applications/window-managers/sway/fx.nix
+++ b/pkgs/by-name/sw/swayfx-unwrapped/package.nix
@@ -1,7 +1,25 @@
-{ fetchFromGitHub, lib, sway-unwrapped }:
+{
+  lib,
+  fetchFromGitHub,
+  sway-unwrapped,
+  stdenv,
+  systemd,
+  # Used by the NixOS module:
+  isNixOS ? false,
+  enableXWayland ? true,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  trayEnabled ? systemdSupport,
+}:
 
-sway-unwrapped.overrideAttrs (oldAttrs: rec {
-  pname = "swayfx";
+(sway-unwrapped.override {
+  inherit
+    isNixOS
+    enableXWayland
+    systemdSupport
+    trayEnabled
+    ;
+}).overrideAttrs (oldAttrs: rec {
+  pname = "swayfx-unwrapped";
   version = "0.3.2";
 
   src = fetchFromGitHub {
@@ -23,7 +41,6 @@ sway-unwrapped.overrideAttrs (oldAttrs: rec {
       (patch: !builtins.elem (patch.name or null) removePatches)
       (oldAttrs.patches or [ ]);
 
-
   meta = with lib; {
     description = "Sway, but with eye candy!";
     homepage = "https://github.com/WillPower3309/swayfx";
diff --git a/pkgs/by-name/sw/swayfx/package.nix b/pkgs/by-name/sw/swayfx/package.nix
new file mode 100644
index 000000000000..9583f9b7a710
--- /dev/null
+++ b/pkgs/by-name/sw/swayfx/package.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  swayfx-unwrapped,
+  sway,
+  # Used by the NixOS module:
+  withBaseWrapper ? true,
+  extraSessionCommands ? "",
+  withGtkWrapper ? false,
+  extraOptions ? [ ], # E.g.: [ "--verbose" ]
+  isNixOS ? false,
+  enableXWayland ? true,
+  dbusSupport ? true,
+}:
+
+sway.override {
+  inherit
+    withBaseWrapper
+    extraSessionCommands
+    withGtkWrapper
+    extraOptions
+    isNixOS
+    enableXWayland
+    dbusSupport
+    ;
+  sway-unwrapped = swayfx-unwrapped;
+}
diff --git a/pkgs/applications/window-managers/sway/idle.nix b/pkgs/by-name/sw/swayidle/package.nix
index 0ee08dc7ca1d..0ee08dc7ca1d 100644
--- a/pkgs/applications/window-managers/sway/idle.nix
+++ b/pkgs/by-name/sw/swayidle/package.nix
diff --git a/pkgs/applications/window-managers/sway/lock-effects.nix b/pkgs/by-name/sw/swaylock-effects/package.nix
index c5dbf3766f06..c5dbf3766f06 100644
--- a/pkgs/applications/window-managers/sway/lock-effects.nix
+++ b/pkgs/by-name/sw/swaylock-effects/package.nix
diff --git a/pkgs/applications/window-managers/sway/lock-fancy.nix b/pkgs/by-name/sw/swaylock-fancy/package.nix
index 83d56def4dcc..83d56def4dcc 100644
--- a/pkgs/applications/window-managers/sway/lock-fancy.nix
+++ b/pkgs/by-name/sw/swaylock-fancy/package.nix
diff --git a/pkgs/applications/window-managers/sway/lock.nix b/pkgs/by-name/sw/swaylock/package.nix
index 0b438df13d28..0b438df13d28 100644
--- a/pkgs/applications/window-managers/sway/lock.nix
+++ b/pkgs/by-name/sw/swaylock/package.nix
diff --git a/pkgs/applications/window-managers/sway/osd.nix b/pkgs/by-name/sw/swayosd/package.nix
index b2a7b17b4315..b2a7b17b4315 100644
--- a/pkgs/applications/window-managers/sway/osd.nix
+++ b/pkgs/by-name/sw/swayosd/package.nix
diff --git a/pkgs/applications/window-managers/sway/swayosd_systemd_paths.patch b/pkgs/by-name/sw/swayosd/swayosd_systemd_paths.patch
index 189c761e9d36..189c761e9d36 100644
--- a/pkgs/applications/window-managers/sway/swayosd_systemd_paths.patch
+++ b/pkgs/by-name/sw/swayosd/swayosd_systemd_paths.patch
diff --git a/pkgs/applications/window-managers/sway/ws.nix b/pkgs/by-name/sw/swayws/package.nix
index 999581153ac9..999581153ac9 100644
--- a/pkgs/applications/window-managers/sway/ws.nix
+++ b/pkgs/by-name/sw/swayws/package.nix
diff --git a/pkgs/applications/window-managers/sway/ws-update-Cargo-lock.patch b/pkgs/by-name/sw/swayws/ws-update-Cargo-lock.patch
index e1d7614e8bfa..e1d7614e8bfa 100644
--- a/pkgs/applications/window-managers/sway/ws-update-Cargo-lock.patch
+++ b/pkgs/by-name/sw/swayws/ws-update-Cargo-lock.patch
diff --git a/pkgs/applications/window-managers/sway/wsr.nix b/pkgs/by-name/sw/swaywsr/package.nix
index 23a82bd2df08..23a82bd2df08 100644
--- a/pkgs/applications/window-managers/sway/wsr.nix
+++ b/pkgs/by-name/sw/swaywsr/package.nix
diff --git a/pkgs/by-name/tu/tuxclocker-nvidia-plugin/no-cpu-plugin.patch b/pkgs/by-name/tu/tuxclocker-nvidia-plugin/no-cpu-plugin.patch
new file mode 100644
index 000000000000..d6d864fb9789
--- /dev/null
+++ b/pkgs/by-name/tu/tuxclocker-nvidia-plugin/no-cpu-plugin.patch
@@ -0,0 +1,14 @@
+diff --git a/src/plugins/meson.build b/src/plugins/meson.build
+index cdd3b5b..a5a2174 100644
+--- a/src/plugins/meson.build
++++ b/src/plugins/meson.build
+@@ -63,9 +63,3 @@ if all_nvidia_linux_libs
+ 		install : true,
+ 		link_with : libtuxclocker)
+ endif
+-
+-shared_library('cpu', 'CPU.cpp', 'Utils.cpp',
+-        include_directories : [incdir, fplus_inc],
+-        install_dir : get_option('libdir') / 'tuxclocker' / 'plugins',
+-        install : true,
+-        link_with : libtuxclocker)
diff --git a/pkgs/by-name/tu/tuxclocker-nvidia-plugin/package.nix b/pkgs/by-name/tu/tuxclocker-nvidia-plugin/package.nix
new file mode 100644
index 000000000000..dac3b342c4c2
--- /dev/null
+++ b/pkgs/by-name/tu/tuxclocker-nvidia-plugin/package.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, boost
+, libX11
+, libXext
+, linuxPackages
+, openssl
+, tuxclocker-plugins
+}:
+
+stdenv.mkDerivation {
+  pname = "tuxclocker-nvidia-plugin";
+
+  inherit (tuxclocker-plugins) src version meta BOOST_INCLUDEDIR BOOST_LIBRARYDIR nativeBuildInputs;
+
+  buildInputs = [
+    boost
+    libX11
+    libXext
+    linuxPackages.nvidia_x11
+    linuxPackages.nvidia_x11.settings.libXNVCtrl
+    openssl
+  ];
+
+  # Build doesn't have a way to disable building the CPU plugin, which is already
+  # provided by 'tuxclocker-plugins'
+  patches = [ ./no-cpu-plugin.patch ];
+
+  mesonFlags = [
+    "-Ddaemon=false"
+    "-Dgui=false"
+    "-Drequire-nvidia=true"
+  ];
+}
diff --git a/pkgs/by-name/tu/tuxclocker-plugins-with-unfree/package.nix b/pkgs/by-name/tu/tuxclocker-plugins-with-unfree/package.nix
new file mode 100644
index 000000000000..f055cf111fa3
--- /dev/null
+++ b/pkgs/by-name/tu/tuxclocker-plugins-with-unfree/package.nix
@@ -0,0 +1,16 @@
+{ symlinkJoin
+, tuxclocker-nvidia-plugin
+, tuxclocker-plugins
+}:
+
+symlinkJoin rec {
+  inherit (tuxclocker-plugins) version meta;
+
+  pname = "tuxclocker-plugins-with-unfree";
+  name = "${pname}-${version}";
+
+  paths = [
+    tuxclocker-nvidia-plugin
+    tuxclocker-plugins
+  ];
+}
diff --git a/pkgs/by-name/tu/tuxclocker-plugins/package.nix b/pkgs/by-name/tu/tuxclocker-plugins/package.nix
new file mode 100644
index 000000000000..19c8fa52441b
--- /dev/null
+++ b/pkgs/by-name/tu/tuxclocker-plugins/package.nix
@@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, boost
+, cmake
+, gettext
+, git
+, libdrm
+, meson
+, ninja
+, openssl
+, pkg-config
+, python3
+, tuxclocker
+}:
+
+stdenv.mkDerivation {
+  inherit (tuxclocker) src version meta BOOST_INCLUDEDIR BOOST_LIBRARYDIR;
+
+  pname = "tuxclocker-plugins";
+
+  nativeBuildInputs = [
+    gettext
+    git
+    meson
+    ninja
+    pkg-config
+    (python3.withPackages(p: [ p.hwdata ]))
+  ];
+
+  buildInputs = [
+    boost
+    libdrm
+    openssl
+  ];
+
+  mesonFlags = [
+    "-Ddaemon=false"
+    "-Dgui=false"
+    "-Drequire-amd=true"
+    "-Drequire-python-hwdata=true"
+  ];
+}
diff --git a/pkgs/by-name/ui/uiua/package.nix b/pkgs/by-name/ui/uiua/package.nix
index 8ad589954ceb..f88f3d491b0c 100644
--- a/pkgs/by-name/ui/uiua/package.nix
+++ b/pkgs/by-name/ui/uiua/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uiua";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "uiua-lang";
     repo = "uiua";
     rev = version;
-    hash = "sha256-/yeLsuwEKw6+jBKd7CAnR9RuVaKwXjVpcvO3v0FaAck=";
+    hash = "sha256-QQgwUXWro2CQjUsVuaZghNUPwSm1kNr5YgLL3SMgCPw=";
   };
 
-  cargoHash = "sha256-4tR1n96s91EFZLO4RIBpNKLjOSbGrBIApJrS60RBuQQ=";
+  cargoHash = "sha256-DaKIzadivG6KGXUVP8LbHhjExY87xwsGESqiWANJxjw=";
 
   nativeBuildInputs = lib.optionals stdenv.isDarwin [
     rustPlatform.bindgenHook
@@ -48,7 +48,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   meta = {
-    changelog = "https://github.com/uiua-lang/uiua/releases/tag/${src.rev}";
+    changelog = "https://github.com/uiua-lang/uiua/blob/${src.rev}/changelog.md";
     description = "A stack-oriented array programming language with a focus on simplicity, beauty, and tacit code";
     longDescription = ''
       Uiua combines the stack-oriented and array-oriented paradigms in a single
diff --git a/pkgs/by-name/vi/vinegar/package.nix b/pkgs/by-name/vi/vinegar/package.nix
index 9b2aae176a2e..bee2a13d5027 100644
--- a/pkgs/by-name/vi/vinegar/package.nix
+++ b/pkgs/by-name/vi/vinegar/package.nix
@@ -1,54 +1,70 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, wine-staging
-, makeBinaryWrapper
-, pkg-config
-, libGL
-, libxkbcommon
-, xorg
-}:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  pkg-config,
+  libGL,
+  libxkbcommon,
+  xorg,
+  wineWowPackages,
+  fetchpatch,
+}: let
+  # wine-staging doesn't support overrideAttrs for now
+  wine = wineWowPackages.stagingFull.overrideDerivation (oldAttrs: {
+    patches =
+      (oldAttrs.patches or [])
+      ++ [
+        # upstream issue: https://bugs.winehq.org/show_bug.cgi?id=55604
+        # Here are the currently applied patches for Roblox to run under WINE:
+        (fetchpatch {
+          name = "vinegar-wine-segrevert.patch";
+          url = "https://raw.githubusercontent.com/flathub/org.vinegarhq.Vinegar/8fc153c492542a522d6cc2dff7d1af0e030a529a/patches/wine/temp.patch";
+          hash = "sha256-AnEBBhB8leKP0xCSr6UsQK7CN0NDbwqhe326tJ9dDjc=";
+        })
+      ];
+  });
+in
+  buildGoModule rec {
+    pname = "vinegar";
+    version = "1.5.9";
 
-buildGoModule rec {
-  pname = "vinegar";
-  version = "1.5.9";
+    src = fetchFromGitHub {
+      owner = "vinegarhq";
+      repo = "vinegar";
+      rev = "v${version}";
+      hash = "sha256-cLzQnNmQYyAIdTGygk/CNU/mxGgcgoFTg5G/0DNwpz4=";
+    };
 
-  src = fetchFromGitHub {
-    owner = "vinegarhq";
-    repo = "vinegar";
-    rev = "v${version}";
-    hash = "sha256-cLzQnNmQYyAIdTGygk/CNU/mxGgcgoFTg5G/0DNwpz4=";
-  };
+    vendorHash = "sha256-DZI4APnrldnwOmLZ9ucFBGQDxzPXTIi44eLu74WrSBI=";
 
-  vendorHash = "sha256-DZI4APnrldnwOmLZ9ucFBGQDxzPXTIi44eLu74WrSBI=";
+    nativeBuildInputs = [pkg-config makeBinaryWrapper];
+    buildInputs = [libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wine];
 
-  nativeBuildInputs = [ pkg-config makeBinaryWrapper ];
-  buildInputs = [ libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wine-staging ];
+    buildPhase = ''
+      runHook preBuild
+      make PREFIX=$out
+      runHook postBuild
+    '';
 
-  buildPhase = ''
-    runHook preBuild
-    make PREFIX=$out
-    runHook postBuild
-  '';
+    installPhase = ''
+      runHook preInstall
+      make PREFIX=$out install
+      runHook postInstall
+    '';
 
-  installPhase = ''
-    runHook preInstall
-    make PREFIX=$out install
-    runHook postInstall
-  '';
+    postInstall = ''
+      wrapProgram $out/bin/vinegar \
+        --prefix PATH : ${lib.makeBinPath [wine]}
+    '';
 
-  postInstall = ''
-    wrapProgram $out/bin/vinegar \
-      --prefix PATH : ${lib.makeBinPath [ wine-staging ]}
-  '';
-
-  meta = with lib; {
-    description = "An open-source, minimal, configurable, fast bootstrapper for running Roblox on Linux";
-    homepage = "https://github.com/vinegarhq/vinegar";
-    changelog = "https://github.com/vinegarhq/vinegar/releases/tag/v${version}";
-    mainProgram = "vinegar";
-    license = licenses.gpl3Only;
-    platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [ nyanbinary ];
-  };
-}
+    meta = with lib; {
+      description = "An open-source, minimal, configurable, fast bootstrapper for running Roblox on Linux";
+      homepage = "https://github.com/vinegarhq/vinegar";
+      changelog = "https://github.com/vinegarhq/vinegar/releases/tag/v${version}";
+      mainProgram = "vinegar";
+      license = licenses.gpl3Only;
+      platforms = ["x86_64-linux" "i686-linux"];
+      maintainers = with maintainers; [nyanbinary];
+    };
+  }
diff --git a/pkgs/by-name/wl/wl-gammarelay-rs/package.nix b/pkgs/by-name/wl/wl-gammarelay-rs/package.nix
new file mode 100644
index 000000000000..b406e1466408
--- /dev/null
+++ b/pkgs/by-name/wl/wl-gammarelay-rs/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "wl-gammarelay-rs";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "MaxVerevkin";
+    repo = "wl-gammarelay-rs";
+    rev = "v${version}";
+    hash = "sha256-md6e9nRCs6TZarwFD3/GQEoJSIhtdq++rIZTP7Vl0wQ=";
+  };
+
+  cargoHash = "sha256-TDP5RC7B7/ldpK22WsmXd6fSl2rHtvG0hP9NYzoEVYo=";
+
+  meta = {
+    description = "A simple program that provides DBus interface to control display temperature and brightness under wayland without flickering";
+    homepage = "https://github.com/MaxVerevkin/wl-gammarelay-rs";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "wl-gammarelay-rs";
+    maintainers = with lib.maintainers; [quantenzitrone];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/zb/zbus-xmlgen/package.nix b/pkgs/by-name/zb/zbus-xmlgen/package.nix
new file mode 100644
index 000000000000..2e0dc5715f51
--- /dev/null
+++ b/pkgs/by-name/zb/zbus-xmlgen/package.nix
@@ -0,0 +1,28 @@
+{ lib, rustPlatform, fetchCrate, makeBinaryWrapper, rustfmt }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "zbus_xmlgen";
+  version = "3.1.1";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-vaefyfasOLFFYWPjSJFgjIFkvnRiJVe/GLYUQxUYlt0=";
+  };
+
+  cargoHash = "sha256-WXJ49X4B2aNy1zPbTllIzRhZJvF+RwfQ0Hhm/D+LQfk=";
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/zbus-xmlgen \
+        --prefix PATH : ${lib.makeBinPath [ rustfmt ]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://crates.io/crates/zbus_xmlgen";
+    description = "D-Bus XML interface Rust code generator";
+    mainProgram = "zbus-xmlgen";
+    maintainers = with maintainers; [ qyliss ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index 947ca68b6a1e..60515e76692f 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "23.11.11";
+  version = "23.12.10";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-sIC5GYROj53vrMRdKKEHprGP+jHZqgz2lbPPFIVuj74=";
+    sha256 = "sha256-DZmjSMJ1I+Ir/Hz/fmsw36dFSp5S3YF024nJLb/Xxig=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/data/icons/numix-icon-theme-square/default.nix b/pkgs/data/icons/numix-icon-theme-square/default.nix
index 1652415295ac..3dac6c8d95c6 100644
--- a/pkgs/data/icons/numix-icon-theme-square/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-square/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-square";
-  version = "23.11.11";
+  version = "23.12.10";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-yu9ufr1l21l6v8bRXLJcVkpBD0fDIlgePbStTLH+CDc=";
+    sha256 = "sha256-kNO0YHHapoIKAosGvCMUEhjP6FkD/CRNhrv5D3dxgoI=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/data/icons/numix-icon-theme/default.nix b/pkgs/data/icons/numix-icon-theme/default.nix
index 8070b352c7d2..24eb68ceed22 100644
--- a/pkgs/data/icons/numix-icon-theme/default.nix
+++ b/pkgs/data/icons/numix-icon-theme/default.nix
@@ -11,13 +11,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme";
-  version = "23.11.20";
+  version = "23.12.02";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-jH3bzwyiDRovrH8GyJhwMJRHM5du8ek4leKnFSO8vAo=";
+    sha256 = "sha256-ks2JJROSYzeDqq7i6Y4iJAB994ZRcDOGGRcCL3Dt1zI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/lomiri/default.nix b/pkgs/desktops/lomiri/default.nix
index a1f87820df02..8d97a1f0d3bd 100644
--- a/pkgs/desktops/lomiri/default.nix
+++ b/pkgs/desktops/lomiri/default.nix
@@ -28,6 +28,7 @@ let
     biometryd = callPackage ./services/biometryd { };
     hfd-service = callPackage ./services/hfd-service { };
     lomiri-app-launch = callPackage ./development/lomiri-app-launch { };
+    mediascanner2 = callPackage ./services/mediascanner2 { };
   };
 in
   lib.makeScope libsForQt5.newScope packages
diff --git a/pkgs/desktops/lomiri/services/mediascanner2/default.nix b/pkgs/desktops/lomiri/services/mediascanner2/default.nix
new file mode 100644
index 000000000000..d9470668ce1d
--- /dev/null
+++ b/pkgs/desktops/lomiri/services/mediascanner2/default.nix
@@ -0,0 +1,122 @@
+{ stdenv
+, lib
+, fetchFromGitLab
+, gitUpdater
+, testers
+, boost
+, cmake
+, cmake-extras
+, dbus
+, dbus-cpp
+, gdk-pixbuf
+, glib
+, gst_all_1
+, gtest
+, libapparmor
+, libexif
+, pkg-config
+, properties-cpp
+, qtbase
+, qtdeclarative
+, shared-mime-info
+, sqlite
+, taglib
+, udisks
+, wrapQtAppsHook
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mediascanner2";
+  version = "0.115";
+
+  src = fetchFromGitLab {
+    owner = "ubports";
+    repo = "development/core/mediascanner2";
+    rev = finalAttrs.version;
+    hash = "sha256-UEwFe65VB2asxQhuWGEAVow/9rEvZxry4dd2/60fXN4=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  postPatch = ''
+    substituteInPlace src/qml/MediaScanner.*/CMakeLists.txt \
+      --replace "\''${CMAKE_INSTALL_LIBDIR}/qt5/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
+
+    # Lomiri desktop doesn't identify itself under Canonical's name anymore
+    substituteInPlace src/daemon/scannerdaemon.cc \
+      --replace 'Unity8' 'Lomiri'
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    gst_all_1.gstreamer # GST_PLUGIN_SYSTEM_PATH_1_0 setup hook
+    pkg-config
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    boost
+    cmake-extras
+    dbus
+    dbus-cpp
+    gdk-pixbuf
+    glib
+    libapparmor
+    libexif
+    properties-cpp
+    qtbase
+    qtdeclarative
+    shared-mime-info
+    sqlite
+    taglib
+    udisks
+  ] ++ (with gst_all_1; [
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
+  ]);
+
+  checkInputs = [
+    gtest
+  ];
+
+  cmakeFlags = [
+    "-DENABLE_TESTS=${lib.boolToString finalAttrs.doCheck}"
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  preCheck = ''
+    export QT_PLUGIN_PATH=${lib.getBin qtbase}/${qtbase.qtPluginPrefix}
+    export XDG_DATA_DIRS=${shared-mime-info}/share:$XDG_DATA_DIRS
+  '';
+
+  preFixup = ''
+    qtWrapperArgs+=(
+      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
+      --prefix XDG_DATA_DIRS : ${shared-mime-info}/share
+    )
+  '';
+
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = gitUpdater { };
+  };
+
+  meta = with lib; {
+    description = "Media scanner service & access library";
+    homepage = "https://gitlab.com/ubports/development/core/mediascanner2";
+    license = licenses.gpl3Only;
+    maintainers = teams.lomiri.members;
+    mainProgram = "mediascanner-service-2.0";
+    platforms = platforms.linux;
+    pkgConfigModules = [
+      "mediascanner-2.0"
+    ];
+  };
+})
diff --git a/pkgs/development/compilers/mlkit/default.nix b/pkgs/development/compilers/mlkit/default.nix
index a91273a3523a..220e25c39f4e 100644
--- a/pkgs/development/compilers/mlkit/default.nix
+++ b/pkgs/development/compilers/mlkit/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlkit";
-  version = "4.7.5";
+  version = "4.7.7";
 
   src = fetchFromGitHub {
     owner = "melsman";
     repo = "mlkit";
     rev = "v${version}";
-    sha256 = "sha256-LAlJCAF8nyXVUlkOEdcoxq5bZn1bd7dqwx6PxOxJRsM=";
+    sha256 = "sha256-XwyZpv80keMhwPm/kvhwrMQg04E8IFjt0UMl9Ocxtyc=";
   };
 
   nativeBuildInputs = [ autoreconfHook mlton ];
diff --git a/pkgs/development/interpreters/evcxr/default.nix b/pkgs/development/interpreters/evcxr/default.nix
index 7b1a9b8b0835..0cb4bef01669 100644
--- a/pkgs/development/interpreters/evcxr/default.nix
+++ b/pkgs/development/interpreters/evcxr/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "evcxr";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "evcxr";
     rev = "v${version}";
-    sha256 = "sha256-TQG0YNwD3WU50fftFv5nGUK9ucxDXYnbQVv8Dewhwm8=";
+    sha256 = "sha256-6gSJJ3ptqpYydjg+xf5Pz3iTk0D+bkC6N79OeiKxPHY=";
   };
 
-  cargoHash = "sha256-F2CduT0/vjoVHua5WshYxsxf4P0QBa+BjFVp7iTsFkU=";
+  cargoHash = "sha256-MRoEFP7VXBNBe6/e3ezPnzhKACwqTApGH9c0T4ycvg4=";
 
   RUST_SRC_PATH = "${rustPlatform.rustLibSrc}";
 
diff --git a/pkgs/development/libraries/libatomic_ops/default.nix b/pkgs/development/libraries/libatomic_ops/default.nix
index ae15c6236aa2..e7170953d0ca 100644
--- a/pkgs/development/libraries/libatomic_ops/default.nix
+++ b/pkgs/development/libraries/libatomic_ops/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libatomic_ops";
-  version = "7.8.0";
+  version = "7.8.2";
 
   src = fetchurl {
     urls = [
       "http://www.ivmaisoft.com/_bin/atomic_ops/libatomic_ops-${version}.tar.gz"
       "https://github.com/ivmai/libatomic_ops/releases/download/v${version}/libatomic_ops-${version}.tar.gz"
     ];
-    sha256 = "sha256-FWdudnThG9paflCnP02efWBFInG4rPb9Oacf79+J+jE=";
+    sha256 = "sha256-0wUgf+IH8rP7XLTAGdoStEzj/LxZPf1QgNhnsaJBm1E=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/libebml/default.nix b/pkgs/development/libraries/libebml/default.nix
index 92181db1c7cd..3478217d7f6b 100644
--- a/pkgs/development/libraries/libebml/default.nix
+++ b/pkgs/development/libraries/libebml/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libebml";
-  version = "1.4.4";
+  version = "1.4.5";
 
   src = fetchFromGitHub {
     owner  = "Matroska-Org";
     repo   = "libebml";
     rev    = "release-${version}";
-    sha256 = "sha256-36SfZUHJ2sIvrrHox583cQqfWWcrL2zW1IHzgDchC9g=";
+    sha256 = "sha256-PIVBePTWceMgiENdaL9lvXIL/RQIrtg7l0OG2tO0SU8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/libzim/default.nix b/pkgs/development/libraries/libzim/default.nix
index 855fc48a2aef..50cb0847089b 100644
--- a/pkgs/development/libraries/libzim/default.nix
+++ b/pkgs/development/libraries/libzim/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libzim";
-  version = "9.0.0";
+  version = "9.1.0";
 
   src = fetchFromGitHub {
     owner = "openzim";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-K1S2MiugUeqCfPq0Oclmghb9064xrsKgUEVjFCJHt0U=";
+    hash = "sha256-yWnW/+CaQwbemrNLzvQpXw5yvW2Q6LtwDgvA58+fVUs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/miniaudio/default.nix b/pkgs/development/libraries/miniaudio/default.nix
index 76b77227130b..d8567177be61 100644
--- a/pkgs/development/libraries/miniaudio/default.nix
+++ b/pkgs/development/libraries/miniaudio/default.nix
@@ -4,13 +4,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "miniaudio";
-  version = "0.11.20";
+  version = "0.11.21";
 
   src = fetchFromGitHub {
     owner = "mackron";
     repo = "miniaudio";
     rev = version;
-    hash = "sha256-qIUqHLHTHFMtZU0GMZp5iWnoBJ/+Zv3tbLopSHolB4s=";
+    hash = "sha256-EOIykyUXYcdDeTYb/Mf3xgcxEpKS4us213tEFwm5mEI=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/nanoflann/default.nix b/pkgs/development/libraries/nanoflann/default.nix
index a9fb463e707a..bfd4b87dc07c 100644
--- a/pkgs/development/libraries/nanoflann/default.nix
+++ b/pkgs/development/libraries/nanoflann/default.nix
@@ -6,14 +6,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.5.1";
+  version = "1.5.3";
   pname = "nanoflann";
 
   src = fetchFromGitHub {
     owner = "jlblancoc";
     repo = "nanoflann";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ozFYqEq6PSe1C6Lc13Szxt8+sUTTlbXrmMgb8cvX04I=";
+    hash = "sha256-cTi3Q+SUSNQkSgi2K7nPqfqEQFMkbchbn2+pE2ol9xQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/nghttp3/default.nix b/pkgs/development/libraries/nghttp3/default.nix
index 21e0cff3b87a..76de14079deb 100644
--- a/pkgs/development/libraries/nghttp3/default.nix
+++ b/pkgs/development/libraries/nghttp3/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nghttp3";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-mw0zI7528lvEZlv+/KuST7PWjuu37p/+EGGsjIEto2Q=";
+    hash = "sha256-B/5r0mRpOEi5DQ7OUAAcDmAm1nnak6qNz4qjDrzWlDc=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index 1d716704c104..add6771e1bb9 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dnYIRcNGTIzETu2OjTJa0IWB1+xttdGFKRBmMkTwrXk=";
+    hash = "sha256-z6lvtfO5XL/bZgbE+Sak+32QzjEhAdOnkpIO731h+bk=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/physics/geant4/datasets.nix b/pkgs/development/libraries/physics/geant4/datasets.nix
index 149f541ee42f..bfe1cf1139ae 100644
--- a/pkgs/development/libraries/physics/geant4/datasets.nix
+++ b/pkgs/development/libraries/physics/geant4/datasets.nix
@@ -42,8 +42,8 @@ in
 
     {
       pname = "G4EMLOW";
-      version = "8.2";
-      sha256 = "sha256-PXdoJk/1pTvLlgh2BLvhHGC3/qkKqsj30SUhg+Go5Cc=";
+      version = "8.5";
+      sha256 = "sha256-ZrrKSaxdReKsEMEltPsmYiXlEYA+ZpgZCc6c0+m873M=";
       envvar = "LE";
     }
 
@@ -77,15 +77,15 @@ in
 
     {
       pname = "G4ABLA";
-      version = "3.1";
-      sha256 = "sha256-dpiwUrWL8bmIa+rNvWr2B63B4Jn8cwq2shz38JDAJ+0=";
+      version = "3.3";
+      sha256 = "sha256-HgQbMlLunO+IbWJPdT5pMwOqMtfl7zu6h7NPNtkuorE=";
       envvar = "ABLA";
     }
 
     {
       pname = "G4INCL";
-      version = "1.0";
-      sha256 = "sha256-cWFhghrp89BWX788LPNPTgLj5RnrQZqCI27vIsLENn0=";
+      version = "1.2";
+      sha256 = "sha256-+ICxYHPuCpLXSU8ydqbVLU3h02d6DUx8WHADlu0OGn4=";
       envvar = "INCL";
     }
 
diff --git a/pkgs/development/libraries/physics/geant4/default.nix b/pkgs/development/libraries/physics/geant4/default.nix
index b2b368f0349e..516d42aa577d 100644
--- a/pkgs/development/libraries/physics/geant4/default.nix
+++ b/pkgs/development/libraries/physics/geant4/default.nix
@@ -48,12 +48,12 @@ in
 lib.warnIf (enableQT != false) "geant4: enableQT is deprecated, please use enableQt"
 
 stdenv.mkDerivation rec {
-  version = "11.1.3";
+  version = "11.2.0";
   pname = "geant4";
 
   src = fetchurl {
     url = "https://cern.ch/geant4-data/releases/geant4-v${version}.tar.gz";
-    hash = "sha256-TF++pnidjWGe2sygYx1rUhGmDhv5l0w9P6ue+eImkvU=";
+    hash = "sha256-Rq1/qzxctL0L3XfdbT4igxhIGSNby8AbLRF9gbNVlqY=";
   };
 
   # Fix broken paths in a .pc
diff --git a/pkgs/development/libraries/rapidcheck/default.nix b/pkgs/development/libraries/rapidcheck/default.nix
index fe94f5dce959..68f2e5e096a8 100644
--- a/pkgs/development/libraries/rapidcheck/default.nix
+++ b/pkgs/development/libraries/rapidcheck/default.nix
@@ -3,40 +3,48 @@
 , fetchFromGitHub
 , cmake
 , unstableGitUpdater
+, testers
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rapidcheck";
-  version = "unstable-2023-04-16";
+  version = "unstable-2023-12-14";
 
   src = fetchFromGitHub {
     owner = "emil-e";
     repo  = "rapidcheck";
-    rev   = "a5724ea5b0b00147109b0605c377f1e54c353ba2";
-    hash = "sha256-nq2VBDREkAOnvtdYr3m0TYNXx7mv9hbV5HZFVL2uTTg=";
+    rev   = "ff6af6fc683159deb51c543b065eba14dfcf329b";
+    hash = "sha256-Ixz5RpY0n8Un/Pv4XoTfbs40+70iyMbkQUjDqoLaWOg=";
   };
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "RC_INSTALL_ALL_EXTRAS" true)
   ];
 
-  # Install the extras headers
-  postInstall = ''
-    cp -r $src/extras $out
-    chmod -R +w $out/extras
-    rm $out/extras/CMakeLists.txt
-    rm $out/extras/**/CMakeLists.txt
-  '';
-
-  passthru.updateScript = unstableGitUpdater { };
+  passthru = {
+    updateScript = unstableGitUpdater { };
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
 
   meta = with lib; {
     description = "A C++ framework for property based testing inspired by QuickCheck";
-    inherit (src.meta) homepage;
+    inherit (finalAttrs.src.meta) homepage;
     maintainers = with maintainers; [ ];
     license = licenses.bsd2;
+    pkgConfigModules = [
+      "rapidcheck"
+      # Extras
+      "rapidcheck_boost"
+      "rapidcheck_boost_test"
+      "rapidcheck_catch"
+      "rapidcheck_doctest"
+      "rapidcheck_gtest"
+    ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/utf8cpp/default.nix b/pkgs/development/libraries/utf8cpp/default.nix
index 764f991c4467..1ca767d98cb6 100644
--- a/pkgs/development/libraries/utf8cpp/default.nix
+++ b/pkgs/development/libraries/utf8cpp/default.nix
@@ -2,26 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "utf8cpp";
-  version = "3.2.5";
+  version = "4.0.3";
 
   src = fetchFromGitHub {
     owner = "nemtrif";
     repo = "utfcpp";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-cWiGggn2GP25K/8eopvnFPq6iwcBteNI3i9Lo1Sr+ig=";
+    hash = "sha256-oUr476HMBYzX64x28Kcudw0B1BVqLUPVVdRzRe82AOc=";
   };
 
-  cmakeFlags = [
-    "-DCMAKE_INSTALL_LIBDIR=lib"
-  ];
-
   nativeBuildInputs = [ cmake ];
 
-  # Tests fail on darwin, probably due to a bug in the test framework:
-  # https://github.com/nemtrif/utfcpp/issues/84
-  doCheck = !stdenv.isDarwin;
-
   meta = with lib; {
     homepage = "https://github.com/nemtrif/utfcpp";
     changelog = "https://github.com/nemtrif/utfcpp/releases/tag/v${version}";
diff --git a/pkgs/development/lua-modules/aliases.nix b/pkgs/development/lua-modules/aliases.nix
index 0b31689baf5f..4f5beb317611 100644
--- a/pkgs/development/lua-modules/aliases.nix
+++ b/pkgs/development/lua-modules/aliases.nix
@@ -42,4 +42,5 @@ mapAliases {
   lpty = throw "lpy was removed because broken and unmaintained "; # added 2023-10-14
   cyrussasl = throw "cyrussasl was removed because broken and unmaintained "; # added 2023-10-18
   nlua-nvim = throw "nlua-nvim was removed, use neodev-nvim instead"; # added 2023-12-16
+  nvim-client = throw "nvim-client was removed because it is now part of neovim"; # added 2023-12-17
 }
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index b1d016ba7dca..71ac6c68abc4 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -2755,26 +2755,6 @@ buildLuarocksPackage {
   };
 }) {};
 
-nvim-client = callPackage({ buildLuarocksPackage, coxpcall, fetchurl, lua, luaOlder, luv, mpack }:
-buildLuarocksPackage {
-  pname = "nvim-client";
-  version = "0.2.4-1";
-
-  src = fetchurl {
-    url    = "https://github.com/neovim/lua-client/archive/0.2.4-1.tar.gz";
-    sha256 = "0sk1lmj0r7pyj9k3p6n0wqjbd95br44ansz0ck3amp6ql8f9kprf";
-  };
-
-  disabled = (luaOlder "5.1");
-  propagatedBuildInputs = [ coxpcall lua luv mpack ];
-
-  meta = {
-    homepage = "https://github.com/neovim/lua-client";
-    description = "Lua client to Nvim";
-    license.fullName = "Apache";
-  };
-}) {};
-
 nvim-cmp = callPackage({ buildLuarocksPackage, fetchgit, lua, luaAtLeast, luaOlder }:
 buildLuarocksPackage {
   pname = "nvim-cmp";
diff --git a/pkgs/development/mobile/androidenv/emulate-app.nix b/pkgs/development/mobile/androidenv/emulate-app.nix
index 74e002bdd16f..e4b3af304fa9 100644
--- a/pkgs/development/mobile/androidenv/emulate-app.nix
+++ b/pkgs/development/mobile/androidenv/emulate-app.nix
@@ -1,16 +1,26 @@
 { composeAndroidPackages, stdenv, lib, runtimeShell }:
-{ name, app ? null
+{ name
+, app ? null
 , platformVersion ? "33"
 , abiVersion ? "armeabi-v7a"
 , systemImageType ? "default"
-, enableGPU ? false
-, extraAVDFiles ? []
+, enableGPU ? false # Enable GPU acceleration. It's deprecated, instead use `configOptions` below.
+, configOptions ? (
+    # List of options to add in config.ini
+    lib.optionalAttrs enableGPU
+      (lib.warn
+        "enableGPU argument is deprecated and will be removed; use configOptions instead"
+        { "hw.gpu.enabled" = "yes"; }
+      )
+  )
+, extraAVDFiles ? [ ]
 , package ? null
 , activity ? null
 , androidUserHome ? null
 , avdHomeDir ? null # Support old variable with non-standard naming!
 , androidAvdHome ? avdHomeDir
-, sdkExtraArgs ? {}
+, deviceName ? "device"
+, sdkExtraArgs ? { }
 , androidAvdFlags ? null
 , androidEmulatorFlags ? null
 }:
@@ -99,27 +109,28 @@ stdenv.mkDerivation {
     export ANDROID_SERIAL="emulator-$port"
 
     # Create a virtual android device for testing if it does not exist
-    if [ "$(${sdk}/bin/avdmanager list avd | grep 'Name: device')" = "" ]
+    if [ "$(${sdk}/bin/avdmanager list avd | grep 'Name: ${deviceName}')" = "" ]
     then
         # Create a virtual android device
-        yes "" | ${sdk}/bin/avdmanager create avd --force -n device -k "system-images;android-${platformVersion};${systemImageType};${abiVersion}" -p $ANDROID_AVD_HOME $NIX_ANDROID_AVD_FLAGS
+        yes "" | ${sdk}/bin/avdmanager create avd --force -n ${deviceName} -k "system-images;android-${platformVersion};${systemImageType};${abiVersion}" -p $ANDROID_AVD_HOME/${deviceName}.avd $NIX_ANDROID_AVD_FLAGS
 
-        ${lib.optionalString enableGPU ''
-          # Enable GPU acceleration
-          echo "hw.gpu.enabled=yes" >> $ANDROID_AVD_HOME/device.avd/config.ini
-        ''}
+        ${builtins.concatStringsSep "\n" (
+          lib.mapAttrsToList (configKey: configValue: ''
+            echo "${configKey} = ${configValue}" >> $ANDROID_AVD_HOME/${deviceName}.avd/config.ini
+          '') configOptions
+        )}
 
         ${lib.concatMapStrings (extraAVDFile: ''
-          ln -sf ${extraAVDFile} $ANDROID_AVD_HOME/device.avd
+          ln -sf ${extraAVDFile} $ANDROID_AVD_HOME/${deviceName}.avd
         '') extraAVDFiles}
     fi
 
     # Launch the emulator
     echo "\nLaunch the emulator"
-    $ANDROID_SDK_ROOT/emulator/emulator -avd device -no-boot-anim -port $port $NIX_ANDROID_EMULATOR_FLAGS &
+    $ANDROID_SDK_ROOT/emulator/emulator -avd ${deviceName} -no-boot-anim -port $port $NIX_ANDROID_EMULATOR_FLAGS &
 
     # Wait until the device has completely booted
-    echo "Waiting until the emulator has booted the device and the package manager is ready..." >&2
+    echo "Waiting until the emulator has booted the ${deviceName} and the package manager is ready..." >&2
 
     ${sdk}/libexec/android-sdk/platform-tools/adb -s emulator-$port wait-for-device
 
diff --git a/pkgs/development/mobile/androidenv/examples/shell-with-emulator.nix b/pkgs/development/mobile/androidenv/examples/shell-with-emulator.nix
index 4cee79824a6b..3c08887eb5be 100644
--- a/pkgs/development/mobile/androidenv/examples/shell-with-emulator.nix
+++ b/pkgs/development/mobile/androidenv/examples/shell-with-emulator.nix
@@ -78,6 +78,7 @@ let
   androidComposition = androidEnv.composeAndroidPackages sdkArgs;
   androidEmulator = androidEnv.emulateApp {
     name = "android-sdk-emulator-demo";
+    configOptions = { "hw.keyboard" = "yes"; };
     sdkExtraArgs = sdkArgs;
   };
   androidSdk = androidComposition.androidsdk;
diff --git a/pkgs/development/python-modules/awkward-cpp/default.nix b/pkgs/development/python-modules/awkward-cpp/default.nix
index 2c3bd96fcf22..476888d1b1a0 100644
--- a/pkgs/development/python-modules/awkward-cpp/default.nix
+++ b/pkgs/development/python-modules/awkward-cpp/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "awkward-cpp";
-  version = "26";
+  version = "27";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-o3wI+JEmtjfUczRUob8/KLGNn3lH0h3GuhIDfYg7HGY=";
+    hash = "sha256-PBllGL/M5wl2bWOHgEExekkUti+Ag+Gj4DtP1upvPI0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/awkward/default.nix b/pkgs/development/python-modules/awkward/default.nix
index da217b4496bb..12a4593bbd2d 100644
--- a/pkgs/development/python-modules/awkward/default.nix
+++ b/pkgs/development/python-modules/awkward/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "awkward";
-  version = "2.4.10";
+  version = "2.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "scikit-hep";
     repo = "awkward";
     rev = "refs/tags/v${version}";
-    hash = "sha256-D+bgKI6olK3smgnRdACvd0gYMWvS6ao6f7nQh3YExXw=";
+    hash = "sha256-lfeoWTmK/VNm3uFLHmIPO4r9aZPK3NhgDwio5WN4jqU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bitarray/default.nix b/pkgs/development/python-modules/bitarray/default.nix
index e69b31b118f6..2895aac54621 100644
--- a/pkgs/development/python-modules/bitarray/default.nix
+++ b/pkgs/development/python-modules/bitarray/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "bitarray";
-  version = "2.8.3";
+  version = "2.8.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4VWHsr3xjTLrO6JfX1pRvt0NwGsxEqTFPated1O8ZYg=";
+    hash = "sha256-t1ZP0hjMRHn38BBtNB4Jb3iQe0eGWu7/cCyAffGSfAE=";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/caldav/default.nix b/pkgs/development/python-modules/caldav/default.nix
index 97a2e3baf5b2..a1d9686ec757 100644
--- a/pkgs/development/python-modules/caldav/default.nix
+++ b/pkgs/development/python-modules/caldav/default.nix
@@ -5,10 +5,12 @@
 , lxml
 , pytestCheckHook
 , pythonOlder
+, python
 , pytz
 , recurring-ical-events
 , requests
 , setuptools
+, toPythonModule
 , tzlocal
 , vobject
 , xandikos
@@ -44,7 +46,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-    xandikos
+    (toPythonModule (xandikos.override { python3Packages = python.pkgs; }))
   ];
 
   pythonImportsCheck = [ "caldav" ];
diff --git a/pkgs/development/python-modules/coffea/default.nix b/pkgs/development/python-modules/coffea/default.nix
index 47f98327cb37..ab10055187d0 100644
--- a/pkgs/development/python-modules/coffea/default.nix
+++ b/pkgs/development/python-modules/coffea/default.nix
@@ -31,20 +31,19 @@
 
 buildPythonPackage rec {
   pname = "coffea";
-  version = "2023.10.0.rc1";
+  version = "2023.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CoffeaTeam";
     repo = "coffea";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1mfTuZDfkD0NjcmSoXN3BLC5o+dWvw+r65ukZTZf8j4=";
+    hash = "sha256-Xlud3ibdI4UnoHe72NPc7WQojuWPpXtncENDinYgk4o=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "numba>=0.58.0" "numba" \
-      --replace "numpy>=1.22.0,<1.26" "numpy"
+      --replace "numba>=0.58.1" "numba"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dask-awkward/default.nix b/pkgs/development/python-modules/dask-awkward/default.nix
index 39ae8e5ddcad..c07cd8d6db5a 100644
--- a/pkgs/development/python-modules/dask-awkward/default.nix
+++ b/pkgs/development/python-modules/dask-awkward/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dask-awkward";
-  version = "2023.11.2";
+  version = "2023.12.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "dask-contrib";
     repo = "dask-awkward";
     rev = "refs/tags/${version}";
-    hash = "sha256-yx0B31x+BMS4alHro+hAPeVB6YK9B7Tg+3sSCMCYjKs=";
+    hash = "sha256-MfZ3mdCCShD/rcqHx7xyujXax5t96RQI1e2Ckyif9e4=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/dask-yarn/default.nix b/pkgs/development/python-modules/dask-yarn/default.nix
index b9204f0eb839..044c70f64f89 100644
--- a/pkgs/development/python-modules/dask-yarn/default.nix
+++ b/pkgs/development/python-modules/dask-yarn/default.nix
@@ -4,6 +4,7 @@
 , dask
 , distributed
 , fetchFromGitHub
+, fetchpatch
 , grpcio
 , pytestCheckHook
 , pythonOlder
@@ -19,11 +20,19 @@ buildPythonPackage rec {
 
   src = fetchFromGitHub {
     owner = "dask";
-    repo = pname;
-    rev = version;
+    repo = "dask-yarn";
+    rev = "refs/tags/${version}";
     hash = "sha256-/BTsxQSiVQrihrCa9DE7pueyg3aPAdjd/Dt4dpUwdtM=";
   };
 
+  patches = [
+    (fetchpatch {  # https://github.com/dask/dask-yarn/pull/150
+      name = "address-deprecations-introduced-in-distributed-2021-07-0";
+      url = "https://github.com/dask/dask-yarn/pull/150/commits/459848afcdc22568905ee98622c74e4071496423.patch";
+      hash = "sha256-LS46QBdiAmsp4jQq4DdYdmmk1qzx5JZNTQUlRcRwY5k=";
+    })
+  ];
+
   propagatedBuildInputs = [
     distributed
     dask
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index 63a13d779913..70b15822cb65 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -38,7 +38,7 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2023.10.1";
+  version = "2023.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -47,7 +47,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = "dask";
     rev = "refs/tags/${version}";
-    hash = "sha256-asD5oLd7XcZ8ZFSrsSCAKgZ3Gsqs6T77nb1qesamgUI=";
+    hash = "sha256-LMd55s8LT4m6Ym+LmXb4TKPnZ0jMkNBfcPJxmgruMDM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/distributed/default.nix b/pkgs/development/python-modules/distributed/default.nix
index 55d5dabdd009..074a450a39e4 100644
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "distributed";
-  version = "2023.10.0";
+  version = "2023.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = "distributed";
     rev = "refs/tags/${version}";
-    hash = "sha256-V0L1qY9xtJgKxNEZ69z8CQuXsUs30cqu6xFrsjKWkbY=";
+    hash = "sha256-Zv31BTzY31eXkU7wqa+h33qGrH+OTzKEj6L7Ei/aizk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mayim/default.nix b/pkgs/development/python-modules/mayim/default.nix
new file mode 100644
index 000000000000..3cbc740aa458
--- /dev/null
+++ b/pkgs/development/python-modules/mayim/default.nix
@@ -0,0 +1,66 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, wheel
+
+, psycopg
+, aiosqlite
+, asyncmy
+
+# test
+, pytest-asyncio
+
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "mayim";
+  version = "1.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ahopkins";
+    repo = "mayim";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-nb0E9kMEJUihaCp8RnqGh0nSyDQo50eL1C4K5lBPlPQ=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "--cov=src --cov-append --cov-report term-missing" ""
+  '';
+
+  passthru.optional-dependencies = {
+    postgres = [
+      psycopg
+    ] ++ psycopg.optional-dependencies.pool;
+    mysql = [
+      asyncmy
+    ];
+    sqlite = [
+      aiosqlite
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+  ] ++ (with passthru.optional-dependencies; [postgres mysql sqlite]);
+
+  pythonImportsCheck = [
+    "mayim"
+  ];
+
+  meta = with lib; {
+    description = "Asynchronous SQL hydrator";
+    homepage = "https://github.com/ahopkins/mayim";
+    license = licenses.mit;
+    maintainers = with maintainers; [ huyngo ];
+  };
+}
diff --git a/pkgs/development/python-modules/mujoco/default.nix b/pkgs/development/python-modules/mujoco/default.nix
index 2392de3847bd..881253845ed6 100644
--- a/pkgs/development/python-modules/mujoco/default.nix
+++ b/pkgs/development/python-modules/mujoco/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "mujoco";
-  version = "3.0.1";
+  version = "3.1.0";
 
   pyproject = true;
 
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   # in the project's CI.
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-pftecOk4q19qKBHs9hBBVenI+SgJg9VT7vc6NKuiY0s=";
+    hash = "sha256-rZNVihIuvNJnQWqA5tV9DG5r3/LttWNW6fN2js+fDb8=";
   };
 
   nativeBuildInputs = [ cmake setuptools ];
@@ -36,13 +36,12 @@ buildPythonPackage rec {
 
   env.MUJOCO_PATH = "${mujoco}";
   env.MUJOCO_PLUGIN_PATH = "${mujoco}/lib";
-  env.MUJOCO_CMAKE_ARGS = "-DMUJOCO_SIMULATE_USE_SYSTEM_GLFW=ON";
+  env.MUJOCO_CMAKE_ARGS = lib.concatStringsSep " " [
+    "-DMUJOCO_SIMULATE_USE_SYSTEM_GLFW=ON"
+    "-DMUJOCO_PYTHON_USE_SYSTEM_PYBIND11=ON"
+  ];
 
   preConfigure =
-    # Use system packages for pybind
-    ''
-      ${perl}/bin/perl -0777 -i -pe "s/(findorfetch\(.{3}USE_SYSTEM_PACKAGE.{3})(OFF)(.{3}PACKAGE_NAME.{3}pybind11.*\))/\1ON\3/gms" mujoco/CMakeLists.txt
-    '' +
     # Use non-system eigen3, lodepng, abseil: Remove mirror info and prefill
     # dependency directory. $build from setuptools.
     (let
diff --git a/pkgs/development/python-modules/patool/default.nix b/pkgs/development/python-modules/patool/default.nix
index 9d31fa9e93ee..d36400970391 100644
--- a/pkgs/development/python-modules/patool/default.nix
+++ b/pkgs/development/python-modules/patool/default.nix
@@ -1,7 +1,7 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , pytestCheckHook
 , p7zip
 , cabextract
@@ -60,6 +60,8 @@ buildPythonPackage rec {
     "test_unzip_file"
     "test_zip"
     "test_zip_file"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "test_ar"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pglast/default.nix b/pkgs/development/python-modules/pglast/default.nix
index 4edaa22bb16d..d6db6b08c865 100644
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pglast";
-  version = "5.5";
+  version = "5.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-yz6Q+Vt7ZuT9NaxuQQA+BH7U6Efaim7No6GJmnOQo1o=";
+    hash = "sha256-WHFc8rXzdcRrp1U6tAuepQYagFYo8+0WQr8783w/Ql8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/uproot/default.nix b/pkgs/development/python-modules/uproot/default.nix
index 837d16204473..1fd62b8eb2fc 100644
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@@ -5,10 +5,12 @@
 , awkward
 , hatchling
 , numpy
+, fsspec
 , packaging
 , pytestCheckHook
 , lz4
 , pytest-timeout
+, rangehttpserver
 , scikit-hep-testdata
 , xxhash
 , zstandard
@@ -16,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "5.1.2";
+  version = "5.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +27,7 @@ buildPythonPackage rec {
     owner = "scikit-hep";
     repo = "uproot5";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TMa+j2jdFagJJhlyCx4rNLaxQhrJyq1HdpnA40xiyME=";
+    hash = "sha256-Oig66OvnmuqT56UkAecSG9qg+qxEQINX/DWS30yq46s=";
   };
 
   nativeBuildInputs = [
@@ -35,6 +37,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     awkward
     numpy
+    fsspec
     packaging
   ];
 
@@ -42,6 +45,7 @@ buildPythonPackage rec {
     pytestCheckHook
     lz4
     pytest-timeout
+    rangehttpserver
     scikit-hep-testdata
     xxhash
     zstandard
@@ -53,20 +57,32 @@ buildPythonPackage rec {
 
   disabledTests = [
     # Tests that try to download files
+    "test_fallback"
+    "test_file"
+    "test_fsspec_chunks"
+    "test_fsspec_globbing_http"
+    "test_fsspec_writing_memory"
     "test_http"
+    "test_http_fallback"
+    "test_http_multipart"
+    "test_http_port"
+    "test_http_size"
+    "test_http_size_port"
+    "test_issue_1054_filename_colons"
     "test_no_multipart"
-    "test_fallback"
+    "test_open_fsspec_http"
+    "test_open_fsspec_github"
     "test_pickle_roundtrip_http"
-    "test_open_fsspec_local"
   ];
 
   disabledTestPaths = [
     # Tests that try to download files
-    "tests/test_0066-fix-http-fallback-freeze.py"
-    "tests/test_0088-read-with-http.py"
-    "tests/test_0220-contiguous-byte-ranges-in-http.py"
-    "tests/test_0916-read-from-s3.py"
-    "tests/test_0930-expressions-in-pandas.py"
+    "tests/test_0066_fix_http_fallback_freeze.py"
+    "tests/test_0088_read_with_http.py"
+    "tests/test_0220_contiguous_byte_ranges_in_http.py"
+
+    # FileNotFoundError: uproot-issue-1043.root
+    "tests/test_1043_const_std_string.py"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/tools/language-servers/millet/Cargo.lock b/pkgs/development/tools/language-servers/millet/Cargo.lock
index e8b9d9229b30..9275df8c1c14 100644
--- a/pkgs/development/tools/language-servers/millet/Cargo.lock
+++ b/pkgs/development/tools/language-servers/millet/Cargo.lock
@@ -28,7 +28,7 @@ dependencies = [
 
 [[package]]
 name = "analysis"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "config",
  "diagnostic",
@@ -118,7 +118,7 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chain-map"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "fast-hash",
  "str-util",
@@ -131,7 +131,7 @@ source = "git+https://github.com/azdavis/language-util.git#50962261bfd5159c350fd
 
 [[package]]
 name = "cm-syntax"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "lex-util",
  "paths",
@@ -161,7 +161,7 @@ dependencies = [
 
 [[package]]
 name = "config"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "fast-hash",
  "serde",
@@ -189,7 +189,7 @@ checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"
 
 [[package]]
 name = "cov-mark"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "fast-hash",
  "once_cell",
@@ -417,7 +417,7 @@ dependencies = [
 
 [[package]]
 name = "input"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "cm-syntax",
  "config",
@@ -466,7 +466,7 @@ checksum = "3752f229dcc5a481d60f385fa479ff46818033d881d2d801aa27dffcfb5e8306"
 
 [[package]]
 name = "lang-srv"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "analysis",
  "anyhow",
@@ -494,7 +494,7 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "lex-util"
-version = "0.14.0"
+version = "0.14.2"
 
 [[package]]
 name = "libc"
@@ -566,7 +566,7 @@ dependencies = [
 
 [[package]]
 name = "millet-cli"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "analysis",
  "codespan-reporting",
@@ -584,7 +584,7 @@ dependencies = [
 
 [[package]]
 name = "millet-ls"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "anyhow",
  "env_logger",
@@ -604,7 +604,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-hir"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "fast-hash",
  "paths",
@@ -616,7 +616,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-statics"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "config",
  "diagnostic",
@@ -641,7 +641,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-syntax"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "lex-util",
  "paths",
@@ -705,7 +705,7 @@ checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "panic-hook"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "better-panic",
 ]
@@ -928,7 +928,7 @@ dependencies = [
 
 [[package]]
 name = "slash-var-path"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "fast-hash",
  "str-util",
@@ -936,14 +936,14 @@ dependencies = [
 
 [[package]]
 name = "sml-comment"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "sml-syntax",
 ]
 
 [[package]]
 name = "sml-dynamics"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "fast-hash",
  "fmt-util",
@@ -954,7 +954,7 @@ dependencies = [
 
 [[package]]
 name = "sml-dynamics-tests"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "config",
  "pretty_assertions",
@@ -971,11 +971,11 @@ dependencies = [
 
 [[package]]
 name = "sml-file"
-version = "0.14.0"
+version = "0.14.2"
 
 [[package]]
 name = "sml-file-syntax"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "config",
  "elapsed",
@@ -990,7 +990,7 @@ dependencies = [
 
 [[package]]
 name = "sml-fixity"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "fast-hash",
  "once_cell",
@@ -999,7 +999,7 @@ dependencies = [
 
 [[package]]
 name = "sml-hir"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "la-arena",
  "sml-lab",
@@ -1010,7 +1010,7 @@ dependencies = [
 
 [[package]]
 name = "sml-hir-lower"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "config",
  "cov-mark",
@@ -1022,23 +1022,26 @@ dependencies = [
  "sml-path",
  "sml-syntax",
  "str-util",
+ "text-size-util",
 ]
 
 [[package]]
 name = "sml-lab"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "str-util",
 ]
 
 [[package]]
 name = "sml-lex"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "cov-mark",
  "diagnostic",
  "lex-util",
  "sml-syntax",
+ "text-size-util",
+ "token",
 ]
 
 [[package]]
@@ -1048,20 +1051,21 @@ source = "git+https://github.com/azdavis/sml-libs.git#0d94e3ce13f2a489dff86151f7
 
 [[package]]
 name = "sml-naive-fmt"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "fast-hash",
  "sml-comment",
  "sml-syntax",
+ "text-size-util",
 ]
 
 [[package]]
 name = "sml-namespace"
-version = "0.14.0"
+version = "0.14.2"
 
 [[package]]
 name = "sml-parse"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "diagnostic",
  "event-parse",
@@ -1069,18 +1073,20 @@ dependencies = [
  "sml-fixity",
  "sml-syntax",
  "str-util",
+ "text-size-util",
+ "token",
 ]
 
 [[package]]
 name = "sml-path"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "str-util",
 ]
 
 [[package]]
 name = "sml-scon"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "num-bigint",
  "num-traits",
@@ -1089,7 +1095,7 @@ dependencies = [
 
 [[package]]
 name = "sml-statics"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "chain-map",
  "config",
@@ -1112,7 +1118,7 @@ dependencies = [
 
 [[package]]
 name = "sml-statics-types"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "chain-map",
  "code-h2-md-map",
@@ -1131,7 +1137,7 @@ dependencies = [
 
 [[package]]
 name = "sml-symbol-kind"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "sml-namespace",
  "sml-statics-types",
@@ -1139,7 +1145,7 @@ dependencies = [
 
 [[package]]
 name = "sml-syntax"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "code-h2-md-map",
  "fast-hash",
@@ -1150,7 +1156,7 @@ dependencies = [
 
 [[package]]
 name = "sml-ty-var-scope"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "fast-hash",
  "sml-hir",
@@ -1223,7 +1229,7 @@ dependencies = [
 
 [[package]]
 name = "tests"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "analysis",
  "cm-syntax",
@@ -1634,7 +1640,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "0.14.0"
+version = "0.14.2"
 dependencies = [
  "anyhow",
  "flate2",
diff --git a/pkgs/development/tools/language-servers/millet/default.nix b/pkgs/development/tools/language-servers/millet/default.nix
index 9efe4b1f45ad..42f932c04ef9 100644
--- a/pkgs/development/tools/language-servers/millet/default.nix
+++ b/pkgs/development/tools/language-servers/millet/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.14.0";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dTYnJofXzpkfXfS4RoJHqXEMlPKW5w1z+X39rL+VoQE=";
+    hash = "sha256-UtdkflM9ftmSVQI4CF0PAlLlbQ9l0EHF5SzJL4sU08Q=";
   };
 
   cargoLock = {
diff --git a/pkgs/development/tools/language-servers/neocmakelsp/default.nix b/pkgs/development/tools/language-servers/neocmakelsp/default.nix
index 3cee6dd3b708..6397dabb1da4 100644
--- a/pkgs/development/tools/language-servers/neocmakelsp/default.nix
+++ b/pkgs/development/tools/language-servers/neocmakelsp/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "neocmakelsp";
-  version = "0.6.11";
+  version = "0.6.17";
 
   src = fetchFromGitHub {
     owner = "Decodetalkers";
     repo = "neocmakelsp";
     rev = "v${version}";
-    hash = "sha256-ZLZGPigZSrW2C909Kc8t0U3+5sWRGkhT820fl+k37x4=";
+    hash = "sha256-0Rc5oPm6BAjPmoRHUO3gVivbQt2p2y62VbT5NIzHtpI=";
   };
 
-  cargoHash = "sha256-dONoaLX2nlnJIjnRPSgQ5oHWqWw632nSpoWUOiU0w58=";
+  cargoHash = "sha256-7ifdmW9JBjz0jxpltn5gFa60oNsB4daA6cXCLnBne7o=";
 
   meta = with lib; {
     description = "A cmake lsp based on tower-lsp and treesitter";
diff --git a/pkgs/development/tools/misc/saleae-logic-2/default.nix b/pkgs/development/tools/misc/saleae-logic-2/default.nix
index c15e7f6451be..ce77855b419e 100644
--- a/pkgs/development/tools/misc/saleae-logic-2/default.nix
+++ b/pkgs/development/tools/misc/saleae-logic-2/default.nix
@@ -1,10 +1,10 @@
 { lib, fetchurl, makeDesktopItem, appimageTools }:
 let
   name = "saleae-logic-2";
-  version = "2.4.12";
+  version = "2.4.13";
   src = fetchurl {
     url = "https://downloads.saleae.com/logic2/Logic-${version}-linux-x64.AppImage";
-    hash = "sha256-QqGtozLZtrS5UgnLmsKWxqbcTykLhlossVxuN4WNYzo=";
+    hash = "sha256-0GIZQKQDY3arDUlxjQKWOHDB3j76xVwkx5H+8q+d0Rc=";
   };
   desktopItem = makeDesktopItem {
     inherit name;
diff --git a/pkgs/development/tools/mod/default.nix b/pkgs/development/tools/mod/default.nix
index 074a5853ba28..fb5abd0fe6ad 100644
--- a/pkgs/development/tools/mod/default.nix
+++ b/pkgs/development/tools/mod/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "mod";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "marwan-at-work";
     repo = "mod";
     rev = "v${version}";
-    sha256 = "sha256-ZFAjiTCmx9o/rUa1vK1Fmz6sE695zzlexTyWJO05M6k=";
+    sha256 = "sha256-QkLARUN/NiN0D6VEhosdFJSce6DP+sWRWFwAEocZaOQ=";
   };
 
   vendorHash = "sha256-5A4W99wcuXMWH0s+uykBWuKCxo8wr3GbTpUKj+Ql0os=";
diff --git a/pkgs/development/tools/parsing/antlr/4.nix b/pkgs/development/tools/parsing/antlr/4.nix
index 6c004a7b0b37..a4b2034852f2 100644
--- a/pkgs/development/tools/parsing/antlr/4.nix
+++ b/pkgs/development/tools/parsing/antlr/4.nix
@@ -15,7 +15,8 @@ let
   mkAntlr = {
     version, sourceSha256, jarSha256,
     extraCppBuildInputs ? [],
-    extraCppCmakeFlags ? []
+    extraCppCmakeFlags ? [],
+    extraPatches ? [ ]
   }: rec {
     source = fetchFromGitHub {
       owner = "antlr";
@@ -81,7 +82,8 @@ let
         pname = "antlr-runtime-cpp";
         inherit version;
         src = source;
-        sourceRoot = "${source.name}/runtime/Cpp";
+
+        patches = extraPatches;
 
         outputs = [ "out" "dev" "doc" ];
 
@@ -90,6 +92,8 @@ let
           lib.optional stdenv.isDarwin CoreFoundation ++
           extraCppBuildInputs;
 
+        cmakeDir = "../runtime/Cpp";
+
         cmakeFlags = extraCppCmakeFlags;
 
         meta = with lib; {
@@ -162,6 +166,12 @@ in {
     jarSha256 = "0dnz2x54kigc58bxnynjhmr5iq49f938vj6p50gdir1xdna41kdg";
     extraCppBuildInputs = [ utf8cpp ]
       ++ lib.optional stdenv.isLinux libuuid;
+    extraCppCmakeFlags = [
+      "-DCMAKE_CXX_FLAGS='-I${lib.getDev utf8cpp}/include/utf8cpp'"
+    ];
+    extraPatches = [
+      ./utf8cpp.patch
+    ];
   }).antlr;
 
   antlr4_8 = (mkAntlr {
diff --git a/pkgs/development/tools/parsing/antlr/utf8cpp.patch b/pkgs/development/tools/parsing/antlr/utf8cpp.patch
new file mode 100644
index 000000000000..aad6b11857e3
--- /dev/null
+++ b/pkgs/development/tools/parsing/antlr/utf8cpp.patch
@@ -0,0 +1,15 @@
+diff --git a/runtime/Cpp/runtime/CMakeLists.txt b/runtime/Cpp/runtime/CMakeLists.txt
+index c8b16c6cf..e8da7960d 100644
+--- a/runtime/Cpp/runtime/CMakeLists.txt
++++ b/runtime/Cpp/runtime/CMakeLists.txt
+@@ -40,8 +40,8 @@ find_package(utf8cpp QUIET)
+ set(INSTALL_utf8cpp FALSE)
+ 
+ if (utf8cpp_FOUND)
+-  target_link_libraries(antlr4_shared utf8cpp)
+-  target_link_libraries(antlr4_static utf8cpp)
++  target_link_libraries(antlr4_shared utf8cpp::utf8cpp)
++  target_link_libraries(antlr4_static utf8cpp::utf8cpp)
+ else()
+ 
+   # older utf8cpp doesn't define the package above
diff --git a/pkgs/development/tools/rust/cargo-hack/default.nix b/pkgs/development/tools/rust/cargo-hack/default.nix
index 9a880a7a92f0..9d3e0e279c3a 100644
--- a/pkgs/development/tools/rust/cargo-hack/default.nix
+++ b/pkgs/development/tools/rust/cargo-hack/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-hack";
-  version = "0.6.14";
+  version = "0.6.15";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-RWYCESNNrB4eZGHGbbXAZJ+NhrRY5rImoAG7OFRPHZ0=";
+    hash = "sha256-yjaX4lqUj9aZPkRuiJC3yBwXvfvd+Okr87Ia2IQvxfM=";
   };
 
-  cargoHash = "sha256-YRNIFNiFPK7/RgdUSDA+UPJ9wooyqi32+pzshW+ajSU=";
+  cargoHash = "sha256-6ogeqVN2V38N7mNBjimjNv/KK2JtV4aa5AorRfYMBx8=";
 
   # some necessary files are absent in the crate version
   doCheck = false;
diff --git a/pkgs/development/web/bun/default.nix b/pkgs/development/web/bun/default.nix
index 1f0ca3e6a8b6..125671f9be46 100644
--- a/pkgs/development/web/bun/default.nix
+++ b/pkgs/development/web/bun/default.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.0.17";
+  version = "1.0.18";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -51,19 +51,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-0zZJ3GYYwJOv3/CmvUHYI1GdJXf3/7ujGpEf+dn/tlI=";
+        hash = "sha256-z3C6V8jG/et+CizWHHx6zN56JBe4QBhEKbDQgx67dmc=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-lscEZki4sMHFAeZJwBTksdBUXOmZ6EEu1YFoedBr5bs=";
+        hash = "sha256-xnFN1Kiaerot6ieMqf5fvyq826vE4KpM57r/7wz4C7o=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64.zip";
-        hash = "sha256-wY0d8JiBtfSZ8xQQjhwdSs4PPtjZp7JnxQf9cSp2T3Q=";
+        hash = "sha256-cNfTiMSdeCINchtRtAA1Lv4vVmrxwhLQNUe+96UFYp4=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-JvzOC/2JxA7K7J0+2l+Bq0FVSrt7llZNE/wkM58nMXY=";
+        hash = "sha256-qwqgaU3zYiuer4tI4JiSsZd94IO6xn+dSjJZkM70WP4=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/games/minesweep-rs/default.nix b/pkgs/games/minesweep-rs/default.nix
index 11950a8f7410..034b3107959c 100644
--- a/pkgs/games/minesweep-rs/default.nix
+++ b/pkgs/games/minesweep-rs/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "minesweep-rs";
-  version = "6.0.39";
+  version = "6.0.41";
 
   src = fetchFromGitHub {
     owner = "cpcloud";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-gV+16gxXfogHFFAXz/aG+D/uaXbZTgVjYK24QQizQ0c=";
+    hash = "sha256-j72ragB4cwFGX08Zlz8eF3j+3dp7JZ64oJ461JoLIrU=";
   };
 
-  cargoHash = "sha256-D6HnpXxixmVugbjr5pMYZiVeGLgje41k3n3xic6Ecps=";
+  cargoHash = "sha256-QtAuUNhBIMz+j6h2DVLDxxWk8iMXy8G2pinS8115qr4=";
 
   meta = with lib; {
     description = "Sweep some mines for fun, and probably not for profit";
diff --git a/pkgs/games/teeworlds/default.nix b/pkgs/games/teeworlds/default.nix
index bec2b9bc7aa7..30e4833d0666 100644
--- a/pkgs/games/teeworlds/default.nix
+++ b/pkgs/games/teeworlds/default.nix
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, lib, stdenv, cmake, pkg-config, python3, alsa-lib
+{ fetchFromGitHub, fetchpatch, lib, stdenv, cmake, pkg-config, python3, alsa-lib
 , libX11, libGLU, SDL2, lua5_3, zlib, freetype, wavpack, icoutils
 , nixosTests
 , Cocoa
@@ -21,6 +21,11 @@ stdenv.mkDerivation rec {
     # Can't use fetchpatch or fetchpatch2 because of https://github.com/NixOS/nixpkgs/issues/32084
     # Using fetchurl instead is also not a good idea, see https://github.com/NixOS/nixpkgs/issues/32084#issuecomment-727223713
     ./rename-VERSION-to-VERSION.txt.patch
+    (fetchpatch {
+      name = "CVE-2021-43518.patch";
+      url = "https://salsa.debian.org/games-team/teeworlds/-/raw/a6c4b23c1ce73466e6d89bccbede70e61e8c9cba/debian/patches/CVE-2021-43518.patch";
+      hash = "sha256-2MmsucaaYjqLgMww1492gNmHmvBJm/NED+VV5pZDnBY=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/games/vvvvvv/default.nix b/pkgs/games/vvvvvv/default.nix
index 6fc3ab6ecef5..909bfa430d70 100644
--- a/pkgs/games/vvvvvv/default.nix
+++ b/pkgs/games/vvvvvv/default.nix
@@ -26,7 +26,11 @@ stdenv.mkDerivation rec {
     rev = version;
     sha256 = "sha256-sLNO4vkmlirsqJmCV9YWpyNnIiigU1KMls7rOgWgSmQ=";
   };
-  sourceRoot = "${src.name}/desktop_version";
+
+  patches = [
+    ./utf8cpp.patch
+  ];
+
   dataZip = fetchurl {
     url = "https://thelettervsixtim.es/makeandplay/data.zip";
     name = "data.zip";
@@ -51,7 +55,12 @@ stdenv.mkDerivation rec {
   # Help CMake find SDL_mixer.h
   env.NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL2_mixer}/include/SDL2";
 
-  cmakeFlags = [ "-DBUNDLE_DEPENDENCIES=OFF" ] ++ lib.optional makeAndPlay "-DMAKEANDPLAY=ON";
+  cmakeDir = "../desktop_version";
+
+  cmakeFlags = [
+    "-DBUNDLE_DEPENDENCIES=OFF"
+    "-DCMAKE_CXX_FLAGS='-I${lib.getDev utf8cpp}/include/utf8cpp'"
+  ] ++ lib.optional makeAndPlay "-DMAKEANDPLAY=ON";
 
   desktopItems = [
     (makeDesktopItem {
diff --git a/pkgs/games/vvvvvv/utf8cpp.patch b/pkgs/games/vvvvvv/utf8cpp.patch
new file mode 100644
index 000000000000..fc279564e759
--- /dev/null
+++ b/pkgs/games/vvvvvv/utf8cpp.patch
@@ -0,0 +1,13 @@
+diff --git a/desktop_version/CMakeLists.txt b/desktop_version/CMakeLists.txt
+index 7405c122..68ba40e3 100644
+--- a/desktop_version/CMakeLists.txt
++++ b/desktop_version/CMakeLists.txt
+@@ -296,7 +296,7 @@ if(BUNDLE_DEPENDENCIES)
+ else()
+ 	find_package(utf8cpp CONFIG)
+ 
+-	target_link_libraries(VVVVVV physfs tinyxml2 utf8cpp lodepng-static)
++	target_link_libraries(VVVVVV physfs tinyxml2 utf8cpp::utf8cpp lodepng-static)
+ endif()
+ 
+ # SDL2 Dependency (Detection pulled from FAudio)
diff --git a/pkgs/misc/translatelocally-models/default.nix b/pkgs/misc/translatelocally-models/default.nix
new file mode 100644
index 000000000000..3c71247d1d9a
--- /dev/null
+++ b/pkgs/misc/translatelocally-models/default.nix
@@ -0,0 +1,43 @@
+{ lib, stdenvNoCC, fetchurl }:
+
+let
+  modelSpecs = (builtins.fromJSON (builtins.readFile ./models.json));
+  withCodeAsKey = f: { code, ... }@attrs: lib.nameValuePair code (f attrs);
+  mkModelPackage = { name, code, version, url, checksum }:
+    stdenvNoCC.mkDerivation {
+      pname = "translatelocally-model-${code}";
+      version = toString version;
+
+      src = fetchurl {
+        inherit url;
+        sha256 = checksum;
+      };
+      dontUnpack = true;
+
+      installPhase = ''
+        TARGET="$out/share/translateLocally/models"
+        mkdir -p "$TARGET"
+        tar -xzf "$src" -C "$TARGET"
+
+        # avoid patching shebangs in inconsistently executable extra files
+        find "$out" -type f -exec chmod -x {} +
+      '';
+
+      meta = {
+        description = "translateLocally model - ${name}";
+        homepage = "https://translatelocally.com/";
+        # https://github.com/browsermt/students/blob/master/LICENSE.md
+        license = lib.licenses.cc-by-sa-40;
+      };
+    };
+  allModelPkgs =
+    lib.listToAttrs (map (withCodeAsKey mkModelPackage) modelSpecs);
+
+in allModelPkgs // {
+  is-en-tiny = allModelPkgs.is-en-tiny.overrideAttrs (super: {
+    # missing model https://github.com/XapaJIaMnu/translateLocally/issues/147
+    meta = super.meta // { broken = true; };
+  });
+} // {
+  passthru.updateScript = ./update.sh;
+}
diff --git a/pkgs/misc/translatelocally-models/models.json b/pkgs/misc/translatelocally-models/models.json
new file mode 100644
index 000000000000..98529a1a9549
--- /dev/null
+++ b/pkgs/misc/translatelocally-models/models.json
@@ -0,0 +1,149 @@
+[
+  {
+    "version": 1,
+    "checksum": "3714539160d5b4dce3ce0d829939315e3daffeaff53647249cc6336d745c09f2",
+    "url": "https://data.statmt.org/bergamot/models/csen/csen.student.base.tar.gz",
+    "name": "Czech-English base",
+    "code": "cs-en-base"
+  },
+  {
+    "version": 1,
+    "checksum": "693aa14ecb86275169ad4b01cbca294f3bd38d8d9bc1fad8dd89fa7e937e7d2c",
+    "url": "https://data.statmt.org/bergamot/models/csen/csen.student.tiny11.tar.gz",
+    "name": "Czech-English tiny",
+    "code": "cs-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "7a57b4e3a11a2c5e03fc6855ffc2b8f61ce3f1a68aeefa4592577a9eebe25031",
+    "url": "https://data.statmt.org/bergamot/models/csen/encs.student.base.tar.gz",
+    "name": "English-Czech base",
+    "code": "en-cs-base"
+  },
+  {
+    "version": 1,
+    "checksum": "f999d6511bdb4f1ff246b0563fdf9b71d836e1c3037fe5306a61836d3b5b8d19",
+    "url": "https://data.statmt.org/bergamot/models/csen/encs.student.tiny11.tar.gz",
+    "name": "English-Czech tiny",
+    "code": "en-cs-tiny"
+  },
+  {
+    "version": 2,
+    "checksum": "e7362faa83c4f61e552adf8fbd4bc528fe706746eb9fc1c286ec9af7566e3daf",
+    "url": "https://data.statmt.org/bergamot/models/deen/deen.student.base.tar.gz",
+    "name": "German-English base",
+    "code": "de-en-base"
+  },
+  {
+    "version": 2,
+    "checksum": "5c11b6ccfa0533fd5632b3cbccbb054972076266e2d1d989d3babb0ec0b10e28",
+    "url": "https://data.statmt.org/bergamot/models/deen/deen.student.tiny11.tar.gz",
+    "name": "German-English tiny",
+    "code": "de-en-tiny"
+  },
+  {
+    "version": 2,
+    "checksum": "cf9ab5a41ce359672ab47579686f9af50fc1fe040552c375ca86912f0fce7827",
+    "url": "https://data.statmt.org/bergamot/models/deen/ende.student.base.tar.gz",
+    "name": "English-German base",
+    "code": "en-de-base"
+  },
+  {
+    "version": 2,
+    "checksum": "0e85d1d7ee4f8a3ec12680696ffc11fa97d67a54d068ceafcf390a87df94877f",
+    "url": "https://data.statmt.org/bergamot/models/deen/ende.student.tiny11.tar.gz",
+    "name": "English-German tiny",
+    "code": "en-de-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "adf49d0e2f21b82414bc353ae1f0904d93360caa92203ae9f2fc209a83882d81",
+    "url": "https://data.statmt.org/bergamot/models/esen/esen.student.tiny11.tar.gz",
+    "name": "Spanish-English tiny",
+    "code": "es-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "6594dda2a4f5d333969c30f8356f4a9f3fe15a9f8a5fd018b0d85b9d9ad2abb0",
+    "url": "https://data.statmt.org/bergamot/models/esen/enes.student.tiny11.tar.gz",
+    "name": "English-Spanish tiny",
+    "code": "en-es-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "05c6525549c9c621e348f8de74533764ad7696aba8245fc9a504116f8ef4053c",
+    "url": "https://data.statmt.org/bergamot/models/eten/eten.student.tiny11.tar.gz",
+    "name": "Estonian-English tiny",
+    "code": "et-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "afce6c566270abdd4db332e8dcf4fe22057ada3b2a1171aab04d0d4817396fb5",
+    "url": "https://data.statmt.org/bergamot/models/eten/enet.student.tiny11.tar.gz",
+    "name": "English-Estonian tiny",
+    "code": "en-et-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "5c1696747590d1a75bef67348dce96bcd3889eb5a06a0f670c3d7232ed79f60e",
+    "url": "https://data.statmt.org/bergamot/models/isen/isen.student.tiny11.tar.gz",
+    "name": "Icelandic-English tiny",
+    "code": "is-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "9f5dde2f4f87438c24c9561990636e624c53b527ddc8505f822b22b073069de8",
+    "url": "https://data.statmt.org/bergamot/models/nben/nben.student.tiny11.tar.gz",
+    "name": "Norwegian (Bokmål)-English tiny",
+    "code": "nb-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "0bb4b83560caaffae95940574d939999092800a7803fae4c79a97e6481887a4f",
+    "url": "https://data.statmt.org/bergamot/models/nnen/nnen.student.tiny11.tar.gz",
+    "name": "Norwegian (Nynorsk)-English tiny",
+    "code": "nn-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "ecfe9c2b0be3406c0205ad2da58f4005893a4ae969e81dd9c523093cf5c7abc3",
+    "url": "https://data.statmt.org/bergamot/models/bgen/bgen.student.tiny11.tar.gz",
+    "name": "Bulgarian-English tiny",
+    "code": "bg-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "eb9a7511ae9c89fb91ab6da1e9d5061946ad752e5801351f39c8eddca9705c74",
+    "url": "https://data.statmt.org/bergamot/models/bgen/enbg.student.tiny11.tar.gz",
+    "name": "English-Bulgarian tiny",
+    "code": "en-bg-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "87148203cbda28421d76fffbd7d3cd6c1fc0d6dae2843c248870274d6512a388",
+    "url": "https://data.statmt.org/bergamot/models/plen/plen.student.tiny11.tar.gz",
+    "name": "Polish-English tiny",
+    "code": "pl-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "c33219daa12e7872cf7ac8a1b86a2f3e0592ebadd7e756bf11d16d9a7725cf9b",
+    "url": "https://data.statmt.org/bergamot/models/plen/enpl.student.tiny11.tar.gz",
+    "name": "English-Polish tiny",
+    "code": "en-pl-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "817a45ed9ec3228bfb797e5e14781ab7fe9f388fe1e834e280031f05089809f8",
+    "url": "https://data.statmt.org/bergamot/models/fren/fren.student.tiny11.tar.gz",
+    "name": "French-English tiny",
+    "code": "fr-en-tiny"
+  },
+  {
+    "version": 1,
+    "checksum": "28deea86d2a02102a7fedf19391a7628386f01f1f532d430306a9728dc5ec2d6",
+    "url": "https://data.statmt.org/bergamot/models/fren/enfr.student.tiny11.tar.gz",
+    "name": "English-French tiny",
+    "code": "en-fr-tiny"
+  }
+]
diff --git a/pkgs/misc/translatelocally-models/update.sh b/pkgs/misc/translatelocally-models/update.sh
new file mode 100755
index 000000000000..4c75508211b6
--- /dev/null
+++ b/pkgs/misc/translatelocally-models/update.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p curl -p jq
+
+set -eu -o pipefail
+
+curl https://translatelocally.com/models.json \
+  | jq '.models | map(with_entries(select([.key] | inside([
+      "name",
+      "code",
+      "version",
+      "url",
+      "checksum"
+    ]))))' \
+  > "$(dirname "$0")/models.json"
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index e96902a13029..ccab9bda9aae 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -22,7 +22,6 @@
 , valgrind
 , meson
 , libuuid
-, colord
 , ninja
 , gnutls
 , protobufc
@@ -184,7 +183,6 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     elfutils
     libgudev
-    colord
     libjcat
     libuuid
     json-glib
diff --git a/pkgs/os-specific/linux/nix-ld/default.nix b/pkgs/os-specific/linux/nix-ld/default.nix
index bb6489ecdb17..208c59ab7576 100644
--- a/pkgs/os-specific/linux/nix-ld/default.nix
+++ b/pkgs/os-specific/linux/nix-ld/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nix-ld";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "mic92";
     repo = "nix-ld";
     rev = version;
-    hash = "sha256-+z9t7BLugZO1WhyYEq6FI38TMh2EwfgfAv3RDFSjwtc=";
+    hash = "sha256-h+odOVyiGmEERMECoFOj5P7FPiMR8IPRzroFA4sKivg=";
   };
 
   doCheck = true;
@@ -48,9 +48,5 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ mic92 ];
     platforms = platforms.linux;
-
-    # 32 bit builds are broken due to a missing #define value:
-    # https://github.com/Mic92/nix-ld/issues/64
-    broken = stdenv.is32bit;
   };
 }
diff --git a/pkgs/servers/lidarr/default.nix b/pkgs/servers/lidarr/default.nix
index daad39ee1cfb..aba1c766ce50 100644
--- a/pkgs/servers/lidarr/default.nix
+++ b/pkgs/servers/lidarr/default.nix
@@ -8,13 +8,13 @@ let
     x86_64-darwin = "x64";
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   hash = {
-    x64-linux_hash = "sha256-qiI6+uiDBwY+UkqWyYqySfdOilJ87GyAojY6a5NrHNY=";
-    arm64-linux_hash = "sha256-CXbZjVIF8JL+bOzUvnaDzpDn+DK9D1g6HnmdvEDR/S8=";
-    x64-osx_hash = "sha256-t58xYrootKjavdyZp37KByyQa0CwSkl+DLxZuGYV9qs=";
+    x64-linux_hash = "sha256-TqwVWV3kfBTqGYf6PT9H0E9YiG/AfLWEViKocVrhZuU=";
+    arm64-linux_hash = "sha256-aCaUZgnk4rnhEV3hDVZx1Bfz+PteefGeGvEdoKXGxxg=";
+    x64-osx_hash = "sha256-4O3H2gsH2Q3V9xY1fIMzkaU0qSEg3CF89chnrMdCmdk=";
   }."${arch}-${os}_hash";
 in stdenv.mkDerivation rec {
   pname = "lidarr";
-  version = "1.4.5.3639";
+  version = "2.0.7.3849";
 
   src = fetchurl {
     url = "https://github.com/lidarr/Lidarr/releases/download/v${version}/Lidarr.master.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/lidarr/update.sh b/pkgs/servers/lidarr/update.sh
index cff608e7ebf0..0da098f89bed 100755
--- a/pkgs/servers/lidarr/update.sh
+++ b/pkgs/servers/lidarr/update.sh
@@ -25,7 +25,7 @@ updateVersion()
     sed -i "s/version = \"[0-9.]*\";/version = \"$1\";/g" "$dirname/default.nix"
 }
 
-currentVersion=$(cd $dirname && nix eval --raw -f ../../.. radarr.version)
+currentVersion=$(cd $dirname && nix eval --raw -f ../../.. lidarr.version)
 
 latestTag=$(curl https://api.github.com/repos/Lidarr/Lidarr/releases/latest | jq -r ".tag_name")
 latestVersion="$(expr $latestTag : 'v\(.*\)')"
diff --git a/pkgs/servers/mautrix-whatsapp/default.nix b/pkgs/servers/mautrix-whatsapp/default.nix
index f8e94264858b..3423985f6584 100644
--- a/pkgs/servers/mautrix-whatsapp/default.nix
+++ b/pkgs/servers/mautrix-whatsapp/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
-  version = "0.10.4";
+  version = "0.10.5";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     rev = "v${version}";
-    hash = "sha256-uouxOXvVbUNRHM83JearPhMTZQtMPEBfWvsVb7QJSO8=";
+    hash = "sha256-bn9nUTtpaEkzF2SEdCcKG27WQDL7xsgfgA/72wElQqA=";
   };
 
   buildInputs = [ olm ];
 
-  vendorHash = "sha256-dgaI/gpngCcVRVK8SK6ac1hmc7/aYLJCnW2CCYRDXy0=";
+  vendorHash = "sha256-PDUSjza+0SDanQwKYQRuLzsiA/sHjRnG0xpzlzhkm+U=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 38f20a1d68ab..28436ca33706 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -21,16 +21,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2023-11-01T18-37-25Z";
+  version = "2023-12-14T18-51-57Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-3YCXIn/xBhkKrmM41JBBfzc6re1nAFHO9GCwTE6AddY=";
+    sha256 = "sha256-UVl6rDm2BlTtmoTcTwCpgm7EdgUVqMi3kPQ/pLVc4kw=";
   };
 
-  vendorHash = "sha256-UZqICN3vPJRgO7fKzVTlP/sFx4cWUnEN9BpSp1bFgL0=";
+  vendorHash = "sha256-0MLQPqua3FC0524drTnlbiqlkGSIBSm0YiYW871cnmU=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/misc/navidrome/default.nix b/pkgs/servers/misc/navidrome/default.nix
index 8c3b00857b4c..8c18b6769a13 100644
--- a/pkgs/servers/misc/navidrome/default.nix
+++ b/pkgs/servers/misc/navidrome/default.nix
@@ -1,4 +1,5 @@
 { buildGoModule
+, buildPackages
 , fetchFromGitHub
 , fetchNpmDeps
 , lib
@@ -17,13 +18,13 @@
 
 buildGoModule rec {
   pname = "navidrome";
-  version = "0.50.1";
+  version = "0.50.2";
 
   src = fetchFromGitHub {
     owner = "navidrome";
     repo = "navidrome";
     rev = "v${version}";
-    hash = "sha256-mbjc5fznJZmZrY1Rd+57ABN55Hyzg1XqZR/qwtesRIg=";
+    hash = "sha256-SZ9wVOHtmkrWfYGA0hNCXag2Yp17glOQpBsEQRK6Npg=";
   };
 
   vendorHash = "sha256-PKj2zJhGR1yETLZ4as35cuwil3vfyFKfkKF/32YdAt8=";
@@ -37,7 +38,7 @@ buildGoModule rec {
   };
 
   nativeBuildInputs = [
-    makeWrapper
+    buildPackages.makeWrapper
     nodejs
     npmHooks.npmConfigHook
     pkg-config
diff --git a/pkgs/servers/monitoring/mimir/default.nix b/pkgs/servers/monitoring/mimir/default.nix
index b52ca5a2f1c2..8516d40fdeb4 100644
--- a/pkgs/servers/monitoring/mimir/default.nix
+++ b/pkgs/servers/monitoring/mimir/default.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, nixosTests, nix-update-script }:
 buildGoModule rec {
   pname = "mimir";
-  version = "2.10.4";
+  version = "2.10.5";
 
   src = fetchFromGitHub {
     rev = "${pname}-${version}";
     owner = "grafana";
     repo = pname;
-    hash = "sha256-0OFuMWoYgo8qCxWk93wOy45diLb2JIBsoxptLKTeOC4=";
+    hash = "sha256-+Xlejvdpum1UMUhELUzcF9bJOXx4tIkDA8wHrE88U5w=";
   };
 
   vendorHash = null;
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 0cd20589caa2..c90ae14d0871 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.29.0";
+  version = "1.29.1";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -16,10 +16,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-I6fc2cjM9dFOKvUBcMA5Suvwe3oQw2kKswfkoSJZf5I=";
+    hash = "sha256-iEVVMARdt3gibahxU9snwo13yi6gINWWdhFkTHLYAuU=";
   };
 
-  vendorHash = "sha256-frLMaB+n2YYsdmh3C7xPmZXwm984mYBws9jUPNhfIaU=";
+  vendorHash = "sha256-R6+GKyGD7tUulOA6qEPUlSMj2/zXdLmmrX1HubLNCEc=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/mqtt/mosquitto/default.nix b/pkgs/servers/mqtt/mosquitto/default.nix
index f586b606f1d2..824dcdf62f88 100644
--- a/pkgs/servers/mqtt/mosquitto/default.nix
+++ b/pkgs/servers/mqtt/mosquitto/default.nix
@@ -12,6 +12,7 @@
 , openssl
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 , systemd
+, uthash
 , fetchpatch
 , nixosTests
 }:
@@ -52,11 +53,6 @@ stdenv.mkDerivation rec {
       substituteInPlace man/$f.xsl \
         --replace http://docbook.sourceforge.net/release/xsl/current ${docbook_xsl}/share/xml/docbook-xsl
     done
-
-    # the manpages are not generated when using cmake
-    pushd man
-    make
-    popd
   '';
 
   outputs = [ "out" "dev" "lib" ];
@@ -70,12 +66,18 @@ stdenv.mkDerivation rec {
     libuv
     libwebsockets'
     openssl
+    uthash
   ] ++ lib.optional withSystemd systemd;
 
   cmakeFlags = [
-    "-DWITH_THREADING=ON"
-    "-DWITH_WEBSOCKETS=ON"
-  ] ++ lib.optional withSystemd "-DWITH_SYSTEMD=ON";
+    (lib.cmakeBool "WITH_BUNDLED_DEPS" false)
+    (lib.cmakeBool "WITH_WEBSOCKETS" true)
+    (lib.cmakeBool "WITH_SYSTEMD" withSystemd)
+  ];
+
+  postFixup = ''
+    sed -i "s|^prefix=.*|prefix=$lib|g" $dev/lib/pkgconfig/*.pc
+  '';
 
   passthru.tests = {
     inherit (nixosTests) mosquitto;
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 1b1546427db0..ac8a5b833e1d 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub, makeWrapper, iptables, iproute2, procps, shadow, getent }:
 
 let
-  version = "1.56.0";
+  version = "1.56.1";
 in
 buildGoModule {
   pname = "tailscale";
@@ -11,7 +11,7 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-st+s4fJMq1tad6IfPewGnM3LC7JDRoSt0LDV7392Kp4=";
+    hash = "sha256-kMk5Q/KvNcsohHNLDMmpBm+gUxQEOeO8o/odukcJi0A=";
   };
   vendorHash = "sha256-bG/ydsJf2UncOcDo8/BXdvQJO3Mk0tl8JGje1b6kto4=";
 
diff --git a/pkgs/servers/web-apps/engelsystem/default.nix b/pkgs/servers/web-apps/engelsystem/default.nix
index ee92f58a2121..9b9cf0ff3bfe 100644
--- a/pkgs/servers/web-apps/engelsystem/default.nix
+++ b/pkgs/servers/web-apps/engelsystem/default.nix
@@ -6,11 +6,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "engelsystem";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchzip {
     url = "https://github.com/engelsystem/engelsystem/releases/download/v${version}/engelsystem-v${version}.zip";
-    hash = "sha256-Z0p+6QlMrj5OtiwFKBfWxkkd/kbL2dxDSKvljcTXWo0=";
+    hash = "sha256-5KniP1nrLfmWHruXnUJmlvgL95U+EsDmCs4tg/YLWtw=";
   };
 
   buildInputs = [ phpExt ];
diff --git a/pkgs/servers/web-apps/matomo/default.nix b/pkgs/servers/web-apps/matomo/default.nix
index 4f0d02b67005..f4946809a6a9 100644
--- a/pkgs/servers/web-apps/matomo/default.nix
+++ b/pkgs/servers/web-apps/matomo/default.nix
@@ -3,15 +3,15 @@
 let
   versions = {
     matomo = {
-      version = "4.15.1";
-      hash = "sha256-XnfiprGLqFQqPk30gcAVLdBZ3pYMSdBPfnicm7V1PSc=";
+      version = "4.16.0";
+      hash = "sha256-OFZT4195WTWw2XNAyGiNixW6hSNKC3IyBpa5kM9PCVk=";
     };
     matomo-beta = {
       version = "5.0.0";
       # `beta` examples: "b1", "rc1", null
       # when updating: use null if stable version is >= latest beta or release candidate
-      beta = "rc3";
-      hash = "sha256-Q5GB4i0ew6+tr8Bsm9PYkzJ8U6DmVPwG2QCi8CTge5E=";
+      beta = "rc9";
+      hash = "sha256-OXxJCEXcrl6UXYh+jbNqLQGYphrSjxaOAZg3AZVPAqs=";
     };
   };
   common = pname: { version, hash, beta ? null }:
diff --git a/pkgs/shells/murex/default.nix b/pkgs/shells/murex/default.nix
index e5b1bfb7c543..5e42880e5522 100644
--- a/pkgs/shells/murex/default.nix
+++ b/pkgs/shells/murex/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "murex";
-  version = "5.2.7610";
+  version = "5.3.4000";
 
   src = fetchFromGitHub {
     owner = "lmorg";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YyMt1V9Utar849+HPGLGJc25PvV7Q2pJehpFOOxlraY=";
+    sha256 = "sha256-cShXZa3ms7RmnRrvWyvijWF7kTO7K6GS1IvEUyT2mio=";
   };
 
   vendorHash = "sha256-qOItRqCIxoHigufI6b7j2VdBDo50qGDe+LAaccgDh5w=";
diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index cf46239939b5..3be7b2fd0ee6 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/xdg-utils/";
     description = "A set of command line tools that assist applications with a variety of desktop integration tasks";
-    license = if mimiSupport then licenses.gpl2 else licenses.free;
+    license = if mimiSupport then licenses.gpl2 else licenses.mit;
     maintainers = [ maintainers.eelco ];
     platforms = platforms.all;
   };
diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index ab37ef98c0bd..9860817cf3e1 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -100,7 +100,7 @@ stdenv.mkDerivation rec {
   meta = {
     homepage = "http://www.info-zip.org";
     description = "An extraction utility for archives compressed in .zip format";
-    license = lib.licenses.free; # http://www.info-zip.org/license.html
+    license = lib.licenses.info-zip;
     platforms = lib.platforms.all;
     mainProgram = "unzip";
   };
diff --git a/pkgs/tools/archivers/zpaq/default.nix b/pkgs/tools/archivers/zpaq/default.nix
index 7c394e27d178..6a03b825e902 100644
--- a/pkgs/tools/archivers/zpaq/default.nix
+++ b/pkgs/tools/archivers/zpaq/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     homepage = "http://mattmahoney.net/dc/zpaq.html";
     license = licenses.gpl3Plus ;
     maintainers = with maintainers; [ raskin ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     mainProgram = "zpaq";
   };
 }
diff --git a/pkgs/tools/audio/liquidsoap/full.nix b/pkgs/tools/audio/liquidsoap/full.nix
index 22925dce99fa..87914436fd49 100644
--- a/pkgs/tools/audio/liquidsoap/full.nix
+++ b/pkgs/tools/audio/liquidsoap/full.nix
@@ -7,7 +7,7 @@
 
 let
   pname = "liquidsoap";
-  version = "2.2.2";
+  version = "2.2.3";
 in
 stdenv.mkDerivation {
   inherit pname version;
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
     owner = "savonet";
     repo = "liquidsoap";
     rev = "refs/tags/v${version}";
-    hash = "sha256-t7rkWHSAd3DaTCXaGfL9NcIQYT+f4Od9D6huuZlwhWk=";
+    hash = "sha256-oCMSdmdU3oHrq3QFEDQLdb3CLFYcWylxTqKWtGOoQW8=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/compression/zsync/default.nix b/pkgs/tools/compression/zsync/default.nix
index b92112a4816e..0de21cb9c736 100644
--- a/pkgs/tools/compression/zsync/default.nix
+++ b/pkgs/tools/compression/zsync/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "http://zsync.moria.org.uk/";
     description = "File distribution system using the rsync algorithm";
-    license = licenses.free;
+    license = licenses.artistic2;
     maintainers = with maintainers; [ viric ];
     platforms = with platforms; all;
   };
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 676194736731..ba40e432cad1 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl
-, pkg-config, sphinx
+, pkg-config, python3
 , zstd
 , acl, attr, e2fsprogs, libuuid, lzo, udev, zlib
 , runCommand, btrfs-progs
@@ -9,17 +9,20 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "6.6.2";
+  version = "6.6.3";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    hash = "sha256-tCZzbclOKwS2mD6ZjE3EJ9wWbWbd6iRsiQ7ZwqRQBE8=";
+    hash = "sha256-9BzlP2Zz/1Ue5KP+fclgHloN3mttCRd9H6ticYq8bZo=";
   };
 
   nativeBuildInputs = [
     pkg-config
   ] ++ [
-    sphinx
+    (python3.withPackages (ps: with ps; [
+      sphinx
+      sphinx-rtd-theme
+    ]))
   ];
 
   buildInputs = [ acl attr e2fsprogs libuuid lzo udev zlib zstd ];
diff --git a/pkgs/tools/filesystems/mount-zip/default.nix b/pkgs/tools/filesystems/mount-zip/default.nix
index c3fea94f42f5..bda338108051 100644
--- a/pkgs/tools/filesystems/mount-zip/default.nix
+++ b/pkgs/tools/filesystems/mount-zip/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mount-zip";
-  version = "1.0.11";
+  version = "1.0.12";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "mount-zip";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-67GaZdmDuUc8ixeRP86xA/+n1PRqwwIEe7JK9OZGUC8=";
+    hash = "sha256-bsuGEgCrU7Gxd9oAiI39AYT9aiXufrI9CniTCfa6LCY=";
   };
 
   nativeBuildInputs = [ boost gcc icu pandoc pkg-config ];
diff --git a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch
deleted file mode 100644
index 7b7ca5a0befa..000000000000
--- a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-Simple bounds checks for CVE-2023-40889, based on third-party
-fix by Remi Meier @
-https://github.com/Raemi/zbar/commit/5e8acc6974f17e56c3ddaa5509870beb8d7a599c
-
---- a/zbar/qrcode/qrdec.c
-+++ b/zbar/qrcode/qrdec.c
-@@ -3900,8 +3900,8 @@ void qr_reader_match_centers(qr_reader *_reader,qr_code_data_list *_qrlist,
-     /*TODO: We might be able to accelerate this step significantly by
-        considering the remaining finder centers in a more intelligent order,
-        based on the first finder center we just chose.*/
--    for(j=i+1;!mark[i]&&j<_ncenters;j++){
--      for(k=j+1;!mark[j]&&k<_ncenters;k++)if(!mark[k]){
-+    for(j=i+1; i < _ncenters && !mark[i]&&j<_ncenters;j++){
-+      for(k=j+1; j < _ncenters && !mark[j]&&k<_ncenters;k++)if(!mark[k]){
-         qr_finder_center *c[3];
-         qr_code_data      qrdata;
-         int               version;
diff --git a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch
deleted file mode 100644
index 3576df214ae1..000000000000
--- a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-Simple bounds checks for CVE-2023-40890
-
---- a/zbar/decoder/databar.c
-+++ b/zbar/decoder/databar.c
-@@ -23,6 +23,8 @@
- 
- #include <config.h>
- #include <zbar.h>
-+#include <stdlib.h>
-+#include <stdio.h>
- 
- #ifdef DEBUG_DATABAR
- # define DEBUG_LEVEL (DEBUG_DATABAR)
-@@ -691,6 +693,12 @@ lookup_sequence (databar_segment_t *seg,
-             fixed = -1;
-         s <<= 1;
-         dbprintf(2, "%x", s);
-+
-+        if (i > 20) {
-+            fprintf(stderr, "Bug: Out-of-bounds condition detected\n");
-+            exit(99);
-+        }
-+
-         seq[i++] = s++;
-         seq[i++] = s;
-     }
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index 5a1d7e94fdf6..fe398bf53314 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -44,8 +44,16 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    ./0.23.92-CVE-2023-40889.patch
-    ./0.23.92-CVE-2023-40890.patch
+    (fetchpatch {
+      name = "CVE-2023-40889.patch";
+      url = "https://salsa.debian.org/debian/zbar/-/raw/debian/0.23.92-9/debian/patches/0003-CVE-2023-40889-qrdec.c-Fix-array-out-of-bounds-acces.patch";
+      hash = "sha256-z0IADJwUt9PBoox5xJJN//5vrcRbIrWB9H7wtxNVUZU=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-40890.patch";
+      url = "https://salsa.debian.org/debian/zbar/-/raw/debian/0.23.92-9/debian/patches/0004-Add-bounds-check-for-CVE-2023-40890.patch";
+      hash = "sha256-YgiptwXpRpz0qIcXBpARfIzSB8KYmksZR58o5yFPahs=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/mutagen-compose/default.nix b/pkgs/tools/misc/mutagen-compose/default.nix
index a98f8c770bb1..a9ecae787b95 100644
--- a/pkgs/tools/misc/mutagen-compose/default.nix
+++ b/pkgs/tools/misc/mutagen-compose/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "mutagen-compose";
-  version = "0.17.2";
+  version = "0.17.4";
 
   src = fetchFromGitHub {
     owner = "mutagen-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FEUVRDGVYYpgNSOSSR9hyUyz9mP8B8qWy3MnTtuE3fQ=";
+    hash = "sha256-arvDV1AlhrXfndoXGd7jn6O9ZAc1+7hq30QpYPLhpJw=";
   };
 
-  vendorHash = "sha256-u4vRQjqBSsugEcBzteV7yOTizbXGpCH+M/zAvdWusK0=";
+  vendorHash = "sha256-wqenEPTRsZvQscXv+/eVEFVk8Fd1/Aj3QcBSZzpkmGA=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/ockam/default.nix b/pkgs/tools/networking/ockam/default.nix
index fe0bbf374635..55a1300c06d0 100644
--- a/pkgs/tools/networking/ockam/default.nix
+++ b/pkgs/tools/networking/ockam/default.nix
@@ -12,7 +12,7 @@
 
 let
   pname = "ockam";
-  version = "0.105.0";
+  version = "0.111.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage {
     owner = "build-trust";
     repo = pname;
     rev = "ockam_v${version}";
-    sha256 = "sha256-YS98elkf1iIslC1dAf+Os2VoA0pmHmkQN0//PtBRBcM=";
+    sha256 = "sha256-pd27611px/TXnO5FlRjBI8iQ64l5X9fmfCG/KnR7AAI=";
   };
 
-  cargoHash = "sha256-aW+Pc2C7vohUAByrzBiOaJlBPfSLAv0FrOxRiB1AM9k=";
+  cargoHash = "sha256-O91enOKMoTfFTv8Hkg3qBSstJpxtKxZVITqGlZQUL/4=";
   nativeBuildInputs = [ git pkg-config ];
   buildInputs = [ openssl dbus ]
     ++ lib.optionals stdenv.isDarwin [ Security ];
diff --git a/pkgs/tools/nix/nixdoc/default.nix b/pkgs/tools/nix/nixdoc/default.nix
index 183e7f019e62..e757e79f4684 100644
--- a/pkgs/tools/nix/nixdoc/default.nix
+++ b/pkgs/tools/nix/nixdoc/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixdoc";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nixdoc";
     rev = "v${version}";
-    sha256 = "sha256-g1PBPpvK3kg0bJEDXsifVgcl3+v54q08Ae3nZ4cJ+Xs=";
+    sha256 = "sha256-0cyKI8KHFsMXYca3hzbqxmBpxGdhl4/i183kfUQr8pg=";
   };
 
-  cargoHash = "sha256-E5SJfwGfy1DcLC0cF/5FTbVEJs/WYb2KO+OdOo2fgQk=";
+  cargoHash = "sha256-9dqjNExxLDgVsu14yDQOJP1qxKy2ACiUH+pbX77iT70=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ darwin.Security ];
 
diff --git a/pkgs/tools/package-management/apx/default.nix b/pkgs/tools/package-management/apx/default.nix
index 20f77dbfe442..41446af5151f 100644
--- a/pkgs/tools/package-management/apx/default.nix
+++ b/pkgs/tools/package-management/apx/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "apx";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "Vanilla-OS";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-3CelqEntpfld0n+Ewg7NCkowVjgCf5b6StfSkYbgV5k=";
+    hash = "sha256-spxZgc1krs8AhOhAZmqGj/yiXzMUefcFFKg/xFpdWj8=";
   };
 
   vendorHash = null;
@@ -21,7 +21,7 @@ buildGoModule rec {
 
   postPatch = ''
     substituteInPlace config/apx.json \
-      --replace "/usr/share/apx/distrobox" "${distrobox}/bin/distrobox" \
+      --replace "/usr/share/apx/distrobox/distrobox" "${distrobox}/bin/distrobox" \
       --replace "/usr/share/apx" "$out/bin/apx"
     substituteInPlace settings/config.go \
       --replace "/usr/share/apx/" "$out/share/apx/"
diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix
index d61384ec1055..0ea47dd7e17c 100644
--- a/pkgs/tools/package-management/nix/common.nix
+++ b/pkgs/tools/package-management/nix/common.nix
@@ -182,8 +182,6 @@ self = stdenv.mkDerivation {
     "--enable-gc"
   ] ++ lib.optionals (!enableDocumentation) [
     "--disable-doc-gen"
-  ] ++ lib.optionals atLeast214 [
-    "CXXFLAGS=-I${lib.getDev rapidcheck}/extras/gtest/include"
   ] ++ lib.optionals stdenv.isLinux [
     "--with-sandbox-shell=${busybox-sandbox-shell}/bin/busybox"
   ] ++ lib.optionals (atLeast210 && stdenv.isLinux && stdenv.hostPlatform.isStatic) [
diff --git a/pkgs/tools/security/cnquery/default.nix b/pkgs/tools/security/cnquery/default.nix
new file mode 100644
index 000000000000..12a0ed8fb09a
--- /dev/null
+++ b/pkgs/tools/security/cnquery/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "cnquery";
+  version = "9.11.0";
+
+  src = fetchFromGitHub {
+    owner = "mondoohq";
+    repo = "cnquery";
+    rev = "v${version}";
+    hash = "sha256-3fyX6vz3lqnV07gu/H7qeIrLyNSbqhLpICJWqPTv7T0=";
+  };
+
+  subPackages = [ "apps/cnquery" ];
+
+  vendorHash = "sha256-7zZRX0LWDmO7LA0fIjAh8+5kK2dcAV/4HQmKdn9I3Mg=";
+
+  meta = with lib; {
+    description = "cloud-native, graph-based asset inventory";
+    longDescription = ''
+    cnquery is a cloud-native tool for querying your entire fleet. It answers thousands of questions about your infrastructure and integrates with over 300 resources across cloud accounts, Kubernetes, containers, services, VMs, APIs, and more.
+      '';
+    homepage = "https://mondoo.com/cnquery";
+    changelog = "https://github.com/mondoohq/cnquery/releases/tag/v${version}";
+    license = licenses.bsl11;
+    maintainers = with maintainers; [ mariuskimmina ];
+  };
+}
diff --git a/pkgs/tools/security/nmap-formatter/default.nix b/pkgs/tools/security/nmap-formatter/default.nix
index 9af9b3071041..b78cb2e075d2 100644
--- a/pkgs/tools/security/nmap-formatter/default.nix
+++ b/pkgs/tools/security/nmap-formatter/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nmap-formatter";
-  version = "2.1.4";
+  version = "2.1.6";
 
   src = fetchFromGitHub {
     owner = "vdjagilev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-M0IV7pgJyCxwfWRnJeMevFFsvaXTRfjXoGRsMngt7Pk=";
+    hash = "sha256-40ix4D/f63Q5cqVmBvpSmbK2KNXiYLdv/xXBNPJXfac=";
   };
 
-  vendorHash = "sha256-Wx07tSHr5LKPdO3BQ3tGMxzxYP9jBnH3JQ8/yrvwX1U=";
+  vendorHash = "sha256-OUhvQwC7EJF7CIM7NHCs0TqRTZHTiDupkfYREPaxpXo=";
 
   meta = with lib; {
     description = "Tool that allows you to convert nmap output";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 16d8b581e90b..12684c39e4b8 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1065,7 +1065,7 @@ mapAliases ({
   inherit (stdenv) buildPlatform hostPlatform targetPlatform; # Added 2023-01-09
 
   # LLVM packages for (integration) testing that should not be used inside Nixpkgs:
-  llvmPackages_latest = llvmPackages_16;
+  llvmPackages_latest = llvmPackages_17;
   llvmPackages_git = recurseIntoAttrs (callPackage ../development/compilers/llvm/git {
     inherit (stdenvAdapters) overrideCC;
     buildLlvmTools = buildPackages.llvmPackages_git.tools;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4a53cacef4ee..80a52672b31f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -518,6 +518,8 @@ with pkgs;
 
   cm256cc = callPackage ../development/libraries/cm256cc {  };
 
+  cnquery = callPackage ../tools/security/cnquery { };
+
   cocogitto = callPackage ../development/tools/cocogitto {
     inherit (darwin.apple_sdk.frameworks) Security;
   };
@@ -14103,6 +14105,8 @@ with pkgs;
 
   translatelocally = callPackage ../applications/misc/translatelocally { };
 
+  translatelocally-models = recurseIntoAttrs (callPackages ../misc/translatelocally-models { });
+
   translate-shell = callPackage ../applications/misc/translate-shell { };
 
   translatepy = with python3.pkgs; toPythonApplication translatepy;
@@ -25113,8 +25117,6 @@ with pkgs;
 
   socket_wrapper = callPackage ../development/libraries/socket_wrapper { };
 
-  soco-cli = callPackage ../tools/audio/soco-cli { };
-
   sofia_sip = callPackage ../development/libraries/sofia-sip {
     inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
   };
@@ -32646,33 +32648,12 @@ with pkgs;
     wlroots_0_16
     wlroots;
 
-  sway-unwrapped = callPackage ../applications/window-managers/sway {
-    wlroots = wlroots_0_16;
-  };
-  sway = callPackage ../applications/window-managers/sway/wrapper.nix { };
-  swaybg = callPackage ../applications/window-managers/sway/bg.nix { };
-  swayidle = callPackage ../applications/window-managers/sway/idle.nix { };
-  swaylock = callPackage ../applications/window-managers/sway/lock.nix { };
-  swayosd = callPackage ../applications/window-managers/sway/osd.nix { };
-  swayws = callPackage ../applications/window-managers/sway/ws.nix { };
-  swaywsr = callPackage ../applications/window-managers/sway/wsr.nix { };
-  sway-assign-cgroups = callPackage ../applications/window-managers/sway/assign-cgroups.nix { };
-  sway-contrib = recurseIntoAttrs (callPackages ../applications/window-managers/sway/contrib.nix { });
-
-  swaycons = callPackage ../applications/window-managers/sway/swaycons.nix { };
-
-  swayfx = callPackage ../applications/window-managers/sway/fx.nix { };
-
-  swaylock-fancy = callPackage ../applications/window-managers/sway/lock-fancy.nix { };
-
-  swaylock-effects = callPackage ../applications/window-managers/sway/lock-effects.nix { };
+  sway-contrib = recurseIntoAttrs (callPackages ../applications/misc/sway-contrib { });
 
   swaynotificationcenter = callPackage ../applications/misc/swaynotificationcenter { };
 
   swaynag-battery = callPackage ../applications/misc/swaynag-battery { };
 
-  swayest-workstyle = callPackage ../applications/window-managers/sway/swayest-workstyle { };
-
   tiramisu = callPackage ../applications/misc/tiramisu { };
 
   rlaunch = callPackage ../applications/misc/rlaunch { };
@@ -32967,6 +32948,8 @@ with pkgs;
 
   jack_oscrolloscope = callPackage ../applications/audio/jack-oscrolloscope { };
 
+  jack-passthrough = callPackage ../applications/audio/jack-passthrough { };
+
   jack_rack = callPackage ../applications/audio/jack-rack { };
 
   jackmeter = callPackage ../applications/audio/jackmeter { };
@@ -36029,6 +36012,12 @@ with pkgs;
 
   tut = callPackage ../applications/misc/tut { };
 
+  tuxclocker = libsForQt5.callPackage ../applications/misc/tuxclocker {
+    tuxclocker-plugins = tuxclocker-plugins-with-unfree;
+  };
+
+  tuxclocker-without-unfree = libsForQt5.callPackage ../applications/misc/tuxclocker { };
+
   tuxedo-rs = callPackage ../os-specific/linux/tuxedo-rs { };
 
   tuxguitar = callPackage ../applications/editors/music/tuxguitar {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3c40cdc0b7c9..35ca0d3fd5fe 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6810,6 +6810,8 @@ self: super: with self; {
     inherit (self) buildPythonPackage pythonOlder pythonAtLeast pyface pygments numpy packaging vtk traitsui envisage apptools pyqt5;
   };
 
+  mayim = callPackage ../development/python-modules/mayim { };
+
   mbddns = callPackage ../development/python-modules/mbddns { };
 
   mbstrdecoder = callPackage ../development/python-modules/mbstrdecoder { };