about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--nixos/doc/manual/installation/building-images-via-systemd-repart.chapter.md17
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/cluster/kubernetes/pki.nix1
-rw-r--r--nixos/modules/services/home-automation/govee2mqtt.nix90
-rw-r--r--nixos/modules/services/misc/gitlab.nix14
-rw-r--r--nixos/tests/gitlab.nix2
-rw-r--r--pkgs/applications/graphics/xv/default.nix7
-rw-r--r--pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix6
-rw-r--r--pkgs/by-name/aw/aws-gate/disable-bootstrap.patch11
-rw-r--r--pkgs/by-name/aw/aws-gate/package.nix19
-rw-r--r--pkgs/by-name/go/govee2mqtt/dont-vendor-openssl.diff41
-rw-r--r--pkgs/by-name/go/govee2mqtt/package.nix56
-rw-r--r--pkgs/by-name/ma/manix/package.nix26
-rw-r--r--pkgs/by-name/nw/nwg-hello/package.nix67
-rw-r--r--pkgs/by-name/sn/snicat/package.nix12
-rw-r--r--pkgs/by-name/td/tdl/package.nix34
-rw-r--r--pkgs/development/compilers/erg/default.nix6
-rw-r--r--pkgs/development/cuda-modules/nccl-tests/default.nix4
-rw-r--r--pkgs/development/libraries/arrow-cpp/default.nix50
-rw-r--r--pkgs/development/libraries/onnxruntime/0001-eigen-allow-dependency-injection.patch45
-rw-r--r--pkgs/development/libraries/onnxruntime/default.nix71
-rw-r--r--pkgs/development/python-modules/aio-georss-client/default.nix21
-rw-r--r--pkgs/development/python-modules/aio-georss-gdacs/default.nix21
-rw-r--r--pkgs/development/python-modules/cmdstanpy/default.nix11
-rw-r--r--pkgs/development/python-modules/py-dmidecode/default.nix4
-rw-r--r--pkgs/development/python-modules/pyarrow/default.nix7
-rw-r--r--pkgs/development/tools/misc/runme/default.nix6
-rw-r--r--pkgs/development/tools/nwjs/default.nix10
-rw-r--r--pkgs/os-specific/linux/batman-adv/default.nix8
-rw-r--r--pkgs/os-specific/linux/batman-adv/version.nix10
-rw-r--r--pkgs/servers/etcd/3.5.nix10
-rw-r--r--pkgs/servers/geospatial/pg_featureserv/default.nix4
-rw-r--r--pkgs/servers/minio/default.nix6
-rw-r--r--pkgs/servers/sql/cockroachdb/cockroachdb-bin.nix6
-rw-r--r--pkgs/tools/backup/zfs-replicate/default.nix3
-rw-r--r--pkgs/tools/misc/broot/default.nix6
-rw-r--r--pkgs/tools/misc/upterm/default.nix6
-rw-r--r--pkgs/tools/networking/godns/default.nix6
-rw-r--r--pkgs/tools/networking/mailutils/default.nix4
-rw-r--r--pkgs/tools/nix/manix/default.nix29
-rw-r--r--pkgs/top-level/all-packages.nix8
42 files changed, 548 insertions, 224 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1b5124fcde7e..b96db205aefb 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10762,6 +10762,12 @@
     name = "Yanning Chen";
     matrix = "@self:lightquantum.me";
   };
+  Ligthiago = {
+    email = "donets.andre@gmail.com";
+    github = "Ligthiago";
+    githubId = 142721811;
+    name = "Andrey Donets";
+  };
   lihop = {
     email = "nixos@leroy.geek.nz";
     github = "lihop";
diff --git a/nixos/doc/manual/installation/building-images-via-systemd-repart.chapter.md b/nixos/doc/manual/installation/building-images-via-systemd-repart.chapter.md
index 6d0675f21a03..10bee156d113 100644
--- a/nixos/doc/manual/installation/building-images-via-systemd-repart.chapter.md
+++ b/nixos/doc/manual/installation/building-images-via-systemd-repart.chapter.md
@@ -75,9 +75,10 @@ image with a new one or by updating partitions via an A/B scheme. See the
 [Chrome OS update process][chrome-os-update] for an example of how to achieve
 this. The appliance image built in the following example does not contain a
 `configuration.nix` and thus you will not be able to call `nixos-rebuild` from
-this system.
+this system. Furthermore, it uses a [Unified Kernel Image][unified-kernel-image].
 
 [chrome-os-update]: https://chromium.googlesource.com/aosp/platform/system/update_engine/+/HEAD/README.md
+[unified-kernel-image]: https://uapi-group.org/specifications/specs/unified_kernel_image/
 
 ```nix
 let
@@ -101,18 +102,8 @@ in
             "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source =
               "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
 
-            "/loader/entries/nixos.conf".source = pkgs.writeText "nixos.conf" ''
-              title NixOS
-              linux /EFI/nixos/kernel.efi
-              initrd /EFI/nixos/initrd.efi
-              options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}
-            '';
-
-            "/EFI/nixos/kernel.efi".source =
-              "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}";
-
-            "/EFI/nixos/initrd.efi".source =
-              "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
+            "/EFI/Linux/${config.system.boot.loader.ukiFile}".source =
+              "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
           };
           repartConfig = {
             Type = "esp";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 23a761041bf4..2996da3c2d55 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -579,6 +579,7 @@
   ./services/home-automation/ebusd.nix
   ./services/home-automation/esphome.nix
   ./services/home-automation/evcc.nix
+  ./services/home-automation/govee2mqtt.nix
   ./services/home-automation/home-assistant.nix
   ./services/home-automation/homeassistant-satellite.nix
   ./services/home-automation/zigbee2mqtt.nix
diff --git a/nixos/modules/services/cluster/kubernetes/pki.nix b/nixos/modules/services/cluster/kubernetes/pki.nix
index 4b7a86c44a0c..c47ceb218e66 100644
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@@ -219,7 +219,6 @@ in
             inherit (cert) action;
             authority = {
               inherit remote;
-              file.path = cert.caCert;
               root_ca = cert.caCert;
               profile = "default";
               auth_key_file = certmgrAPITokenPath;
diff --git a/nixos/modules/services/home-automation/govee2mqtt.nix b/nixos/modules/services/home-automation/govee2mqtt.nix
new file mode 100644
index 000000000000..1dee5999fa3b
--- /dev/null
+++ b/nixos/modules/services/home-automation/govee2mqtt.nix
@@ -0,0 +1,90 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.govee2mqtt;
+in {
+  meta.maintainers = with lib.maintainers; [ SuperSandro2000 ];
+
+  options.services.govee2mqtt = {
+    enable = lib.mkEnableOption "Govee2MQTT";
+
+    package = lib.mkPackageOption pkgs "govee2mqtt" { };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "govee2mqtt";
+      description = "User under which Govee2MQTT should run.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "govee2mqtt";
+      description = "Group under which Govee2MQTT should run.";
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.path;
+      example = "/var/lib/govee2mqtt/govee2mqtt.env";
+      description = ''
+        Environment file as defined in {manpage}`systemd.exec(5)`.
+
+        See upstream documentation <https://github.com/wez/govee2mqtt/blob/main/docs/CONFIG.md>.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users = {
+      groups.${cfg.group} = { };
+      users.${cfg.user} = {
+        description = "Govee2MQTT service user";
+        inherit (cfg) group;
+        isSystemUser = true;
+      };
+    };
+
+    systemd.services.govee2mqtt = {
+      description = "Govee2MQTT Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "networking.target" ];
+      serviceConfig = {
+        CacheDirectory = "govee2mqtt";
+        Environment = [
+          "GOVEE_CACHE_DIR=/var/cache/govee2mqtt"
+        ];
+        EnvironmentFile = cfg.environmentFile;
+        ExecStart = "${lib.getExe cfg.package} serve --govee-iot-key=/var/lib/govee2mqtt/iot.key --govee-iot-cert=/var/lib/govee2mqtt/iot.cert"
+          + " --amazon-root-ca=${pkgs.cacert.unbundled}/etc/ssl/certs/Amazon_Root_CA_1:66c9fcf99bf8c0a39e2f0788a43e696365bca.crt";
+        Group = cfg.group;
+        Restart = "on-failure";
+        StateDirectory = "govee2mqtt";
+        User = cfg.user;
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 6756d59cf367..ec347a75f063 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -1386,10 +1386,8 @@ in {
 
     systemd.services.gitlab-db-config = {
       after = [ "gitlab-config.service" "gitlab-postgresql.service" "postgresql.service" ];
-      bindsTo = [
-        "gitlab-config.service"
-      ] ++ optional (cfg.databaseHost == "") "postgresql.service"
-        ++ optional databaseActuallyCreateLocally "gitlab-postgresql.service";
+      wants = optional (cfg.databaseHost == "") "postgresql.service" ++ optional databaseActuallyCreateLocally "gitlab-postgresql.service";
+      bindsTo = [ "gitlab-config.service" ];
       wantedBy = [ "gitlab.target" ];
       partOf = [ "gitlab.target" ];
       serviceConfig = {
@@ -1422,10 +1420,10 @@ in {
         "gitlab-db-config.service"
       ];
       bindsTo = [
-        "redis-gitlab.service"
         "gitlab-config.service"
         "gitlab-db-config.service"
-      ] ++ optional (cfg.databaseHost == "") "postgresql.service";
+      ];
+      wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.service";
       wantedBy = [ "gitlab.target" ];
       partOf = [ "gitlab.target" ];
       environment = gitlabEnv // (optionalAttrs cfg.sidekiq.memoryKiller.enable {
@@ -1612,10 +1610,10 @@ in {
         "gitlab-db-config.service"
       ];
       bindsTo = [
-        "redis-gitlab.service"
         "gitlab-config.service"
         "gitlab-db-config.service"
-      ] ++ optional (cfg.databaseHost == "") "postgresql.service";
+      ];
+      wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.service";
       requiredBy = [ "gitlab.target" ];
       partOf = [ "gitlab.target" ];
       environment = gitlabEnv;
diff --git a/nixos/tests/gitlab.nix b/nixos/tests/gitlab.nix
index 8d3126425311..c4d69a56c93a 100644
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@@ -419,7 +419,7 @@ in {
       gitlab.systemctl("start gitlab-backup.service")
       gitlab.wait_for_unit("gitlab-backup.service")
       gitlab.wait_for_file("${nodes.gitlab.services.gitlab.statePath}/backup/dump_gitlab_backup.tar")
-      gitlab.systemctl("stop postgresql.service gitlab.target")
+      gitlab.systemctl("stop postgresql.service gitlab-config.service gitlab.target")
       gitlab.succeed(
           "find ${nodes.gitlab.services.gitlab.statePath} -mindepth 1 -maxdepth 1 -not -name backup -execdir rm -r {} +"
       )
diff --git a/pkgs/applications/graphics/xv/default.nix b/pkgs/applications/graphics/xv/default.nix
index b70c96ea8d39..d3708dd0c4a1 100644
--- a/pkgs/applications/graphics/xv/default.nix
+++ b/pkgs/applications/graphics/xv/default.nix
@@ -7,26 +7,25 @@
   libpng,
   libwebp,
   libtiff,
-  libjpeg,
   jasper,
 }:
 
 stdenv.mkDerivation rec {
   pname = "xv";
-  version = "4.2.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "jasper-software";
     repo = "xv";
     rev = "v${version}";
-    sha256 = "TXUcdrwtPNiS7z795RbzBXzNYRADeVtF5uz4aovLo/M=";
+    sha256 = "sha256-ATV/LxXQNJB6rjBmurx6a1gRPR8zNuILstvEJoQJhUs=";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ xorg.libX11 xorg.libXt libpng libwebp libtiff jasper ];
 
   meta = {
-    description = "Classic image viewer and editor for X.";
+    description = "Classic image viewer and editor for X";
     homepage = "http://www.trilon.com/xv/";
     license = {
       fullName = "XV License";
diff --git a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
index 13a1ceba3cda..6bdc197269cc 100644
--- a/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
+++ b/pkgs/applications/science/electronics/hal-hardware-analyzer/default.nix
@@ -44,6 +44,11 @@ let
         --replace "igraph_scg_grouping3" "" \
         --replace "igraph_scg_semiprojectors2" ""
     '';
+    NIX_CFLAGS_COMPILE = (prev.NIX_CFLAGS_COMPILE or []) ++ lib.optionals stdenv.cc.isClang [
+      "-Wno-strict-prototypes"
+      "-Wno-unused-but-set-parameter"
+      "-Wno-unused-but-set-variable"
+    ];
     # general options brought back from the old 0.9.x package
     buildInputs = prev.buildInputs ++ [ suitesparse ];
     cmakeFlags = prev.cmakeFlags ++ [ "-DIGRAPH_USE_INTERNAL_CXSPARSE=OFF" ];
@@ -138,7 +143,6 @@ in stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "A comprehensive reverse engineering and manipulation framework for gate-level netlists";
     homepage = "https://github.com/emsec/hal";
     license = licenses.mit;
diff --git a/pkgs/by-name/aw/aws-gate/disable-bootstrap.patch b/pkgs/by-name/aw/aws-gate/disable-bootstrap.patch
index 63b6ebce3b8a..6fbd7019081d 100644
--- a/pkgs/by-name/aw/aws-gate/disable-bootstrap.patch
+++ b/pkgs/by-name/aw/aws-gate/disable-bootstrap.patch
@@ -38,14 +38,3 @@ index ac37c2f..9743415 100644
      elif args.subcommand == "exec":
          exec(
              config=config,
-diff --git a/requirements/requirements.txt b/requirements/requirements.txt
-index 50b203e..8c3496f 100644
---- a/requirements/requirements.txt
-+++ b/requirements/requirements.txt
-@@ -3,5 +3,4 @@ cryptography==39.0.2
- marshmallow==3.19.0
- packaging==23.0
- PyYAML>=5.1,<6.1
--requests==2.28.2
- unix-ar==0.2.1
- wrapt==1.15.0
\ No newline at end of file
diff --git a/pkgs/by-name/aw/aws-gate/package.nix b/pkgs/by-name/aw/aws-gate/package.nix
index 77e56026665d..cafe14c611bd 100644
--- a/pkgs/by-name/aw/aws-gate/package.nix
+++ b/pkgs/by-name/aw/aws-gate/package.nix
@@ -26,14 +26,25 @@ python3Packages.buildPythonApplication rec {
   '';
 
   nativeBuildInputs = [
+    installShellFiles
+    python3Packages.pythonRelaxDepsHook
     python3Packages.setuptools
     python3Packages.wheel
-    installShellFiles
   ];
 
-  propagatedBuildInputs = [ ssm-session-manager-plugin ] ++ builtins.attrValues {
-    inherit (python3Packages) marshmallow boto3 pyyaml wrapt cryptography;
-  };
+  pythonRelaxDeps = true;
+
+  propagatedBuildInputs = [
+    python3Packages.boto3
+    python3Packages.cryptography
+    python3Packages.marshmallow
+    python3Packages.packaging
+    python3Packages.pyyaml
+    python3Packages.requests
+    python3Packages.unix-ar
+    python3Packages.wrapt
+    ssm-session-manager-plugin
+  ];
 
   postInstall = ''
     installShellCompletion --bash completions/bash/aws-gate
diff --git a/pkgs/by-name/go/govee2mqtt/dont-vendor-openssl.diff b/pkgs/by-name/go/govee2mqtt/dont-vendor-openssl.diff
new file mode 100644
index 000000000000..fb290f11eccd
--- /dev/null
+++ b/pkgs/by-name/go/govee2mqtt/dont-vendor-openssl.diff
@@ -0,0 +1,41 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 303f6f8..952a7ff 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1373,15 +1373,6 @@ version = "0.1.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
+ 
+-[[package]]
+-name = "openssl-src"
+-version = "300.2.1+3.2.0"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "3fe476c29791a5ca0d1273c697e96085bbabbbea2ef7afd5617e78a4b40332d3"
+-dependencies = [
+- "cc",
+-]
+-
+ [[package]]
+ name = "openssl-sys"
+ version = "0.9.98"
+@@ -1390,7 +1381,6 @@ checksum = "c1665caf8ab2dc9aef43d1c0023bd904633a6a05cb30b0ad59bec2ae986e57a7"
+ dependencies = [
+  "cc",
+  "libc",
+- "openssl-src",
+  "pkg-config",
+  "vcpkg",
+ ]
+diff --git a/Cargo.toml b/Cargo.toml
+index a4cf25c..42fde6d 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -44,7 +44,7 @@ parking_lot = "0.12.1"
+ 
+ [dependencies.mosquitto-rs]
+ version="0.11.1"
+-features = ["vendored-openssl"]
++features = ["router"]
+ #path = "../mosquitto-rs/mosquitto-rs"
+ 
+ [dev-dependencies]
diff --git a/pkgs/by-name/go/govee2mqtt/package.nix b/pkgs/by-name/go/govee2mqtt/package.nix
new file mode 100644
index 000000000000..41392d0022c1
--- /dev/null
+++ b/pkgs/by-name/go/govee2mqtt/package.nix
@@ -0,0 +1,56 @@
+{ rustPlatform
+, lib
+, fetchFromGitHub
+, fetchpatch
+, openssl
+, pkg-config
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "govee2mqtt";
+  version = "2024.01.24-ea3cd430";
+
+  src = fetchFromGitHub {
+    owner = "wez";
+    repo = "govee2mqtt";
+    rev = version;
+    hash = "sha256-iGOj0a4+wLd8QlM1tr+NYfd2tuwgHV+u5dt0zf+WscY=";
+  };
+
+  cargoPatches = [
+    ./dont-vendor-openssl.diff
+  ];
+
+  patches = [
+    # update test fixtures https://github.com/wez/govee2mqtt/pull/120
+    (fetchpatch {
+      url = "https://github.com/wez/govee2mqtt/commit/0c2dc3e1cc1ccd44ddf98ead34e081ac4b4335f1.patch";
+      hash = "sha256-0TNYyvRRcMkE9FYPcVoKburejhAn/cVYM3eaobS4nx8=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace src/service/http.rs \
+      --replace '"assets"' '"${placeholder "out"}/share/govee2mqtt/assets"'
+  '';
+
+  cargoHash = "sha256-wApf+H5T7HPkCGQwv8ePoDnStUn04oVvv3eIJ8aKVUw=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ];
+
+  postInstall = ''
+    mkdir -p $out/share/govee2mqtt/
+    cp -r assets $out/share/govee2mqtt/
+  '';
+
+  meta = with lib; {
+    description = "Connect Govee lights and devices to Home Assistant";
+    homepage = "https://github.com/wez/govee2mqtt";
+    changelog = "https://github.com/wez/govee2mqtt/blob/${src.rev}/addon/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+    mainProgram = "govee";
+  };
+}
diff --git a/pkgs/by-name/ma/manix/package.nix b/pkgs/by-name/ma/manix/package.nix
new file mode 100644
index 000000000000..aca3846761bb
--- /dev/null
+++ b/pkgs/by-name/ma/manix/package.nix
@@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "manix";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "nix-community";
+    repo = "manix";
+    rev = "v${version}";
+    hash = "sha256-b/3NvY+puffiQFCQuhRMe81x2wm3vR01MR3iwe/gJkw=";
+  };
+
+  cargoHash = "sha256-45cb0yO/ypGLcvEgPOkN6Py99yqK09xnCmMOLOOYYSA=";
+
+  meta = with lib; {
+    description = "A fast CLI documentation searcher for Nix";
+    homepage = "https://github.com/nix-community/manix";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ iogamaster lecoqjacob ];
+    mainProgram = "manix";
+  };
+}
diff --git a/pkgs/by-name/nw/nwg-hello/package.nix b/pkgs/by-name/nw/nwg-hello/package.nix
new file mode 100644
index 000000000000..de4cff184af4
--- /dev/null
+++ b/pkgs/by-name/nw/nwg-hello/package.nix
@@ -0,0 +1,67 @@
+{ lib
+, fetchFromGitHub
+, gobject-introspection
+, gtk-layer-shell
+, gtk3
+, python3Packages
+, wrapGAppsHook
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "nwg-hello";
+  version = "0.1.6";
+
+  src = fetchFromGitHub {
+    owner = "nwg-piotr";
+    repo = "nwg-hello";
+    rev = "v${version}";
+    hash = "sha256-+D89QTFUV7/dhfcOWnQshG8USh35Vdm/QPHbsxiV0j0=";
+  };
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3
+    gtk-layer-shell
+  ];
+
+  propagatedBuildInputs = [
+    python3Packages.pygobject3
+  ];
+
+  postPatch = ''
+    # hard coded paths
+    substituteInPlace nwg_hello/main.py \
+      --replace '/etc/nwg-hello' "$out/etc/nwg-hello" \
+      --replace "/usr/share/xsessions" "/run/current-system/sw/share/xsessions" \
+      --replace "/usr/share/wayland-sessions" "/run/current-system/sw/share/wayland-sessions"
+
+    substituteInPlace nwg-hello-default.json \
+      --replace "/usr/share/xsessions" "/run/current-system/sw/share/xsessions" \
+      --replace "/usr/share/wayland-sessions" "/run/current-system/sw/share/wayland-sessions"
+
+    substituteInPlace nwg_hello/ui.py --replace '/usr/share/nwg-hello' "$out/share/nwg-hello"
+  '';
+
+  postInstall = ''
+    install -D -m 644 -t "$out/etc/nwg-hello/" nwg-hello-default.json nwg-hello-default.css hyprland.conf sway-config README
+    install -D -m 644 -t "$out/share/nwg-hello/" nwg.jpg
+    install -D -m 644 -t "$out/share/nwg-hello/" img/*
+  '';
+
+  # Upstream has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "nwg_hello" ];
+
+  meta = {
+    homepage = "https://github.com/nwg-piotr/nwg-hello";
+    description = "GTK3-based greeter for the greetd daemon, written in python";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = [ ];
+    mainProgram = "nwg-hello";
+  };
+}
diff --git a/pkgs/by-name/sn/snicat/package.nix b/pkgs/by-name/sn/snicat/package.nix
index e7e9e6f3ab53..bbc3fded5b2f 100644
--- a/pkgs/by-name/sn/snicat/package.nix
+++ b/pkgs/by-name/sn/snicat/package.nix
@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , buildGoPackage
 , fetchFromGitHub
 }:
@@ -14,19 +13,12 @@ buildGoPackage rec {
     hash = "sha256-fFlTBOz127le2Y7F9KKhbcldcyFEpAU5QiJ4VCAPs9Y=";
   };
 
-  patchPhase = ''
-    runHook prePatch
-
-    substituteInPlace snicat.go \
-      --replace-warn "v0.0.0" "v${version}"
-
-    runHook postPatch
-  '';
-
   goPackagePath = "github.com/CTFd/snicat";
 
   goDeps = ./deps.nix;
 
+  ldflags = [ "-s" "-w" "-X main.version=v${version}" ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/td/tdl/package.nix b/pkgs/by-name/td/tdl/package.nix
new file mode 100644
index 000000000000..d4abe11fe764
--- /dev/null
+++ b/pkgs/by-name/td/tdl/package.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+buildGoModule rec {
+  pname = "tdl";
+  version = "0.15.1";
+
+  src = fetchFromGitHub {
+    owner = "iyear";
+    repo = "tdl";
+    rev = "v${version}";
+    hash = "sha256-vKcKHxPwF7kdsEASJ4VunPZ9kVztPq3yH8RnCd9uI9A=";
+  };
+
+  vendorHash = "sha256-v5okd7PAnA2JsgZ4SqvpZmXOQXSCzl+SwFx9NWo7C/0=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/iyear/tdl/pkg/consts.Version=${version}"
+  ];
+
+  # Requires network access
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A Telegram downloader/tools written in Golang";
+    homepage = "https://github.com/iyear/tdl";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ Ligthiago ];
+    mainProgram = "tdl";
+  };
+}
diff --git a/pkgs/development/compilers/erg/default.nix b/pkgs/development/compilers/erg/default.nix
index 5183a8712d2a..ab5458855423 100644
--- a/pkgs/development/compilers/erg/default.nix
+++ b/pkgs/development/compilers/erg/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "erg";
-  version = "0.6.29";
+  version = "0.6.30";
 
   src = fetchFromGitHub {
     owner = "erg-lang";
     repo = "erg";
     rev = "v${version}";
-    hash = "sha256-sHW0e8a8ZDmcA8u0leIJLxzJLI8guKlMB/u7CFhbyQE=";
+    hash = "sha256-lStTLDXgdaaqyzdzU1V2JnKX8jt27Z1A23fkuZU8dt0=";
   };
 
-  cargoHash = "sha256-3wrH++IItJQNueJoa5wuzN2ZXWa5OflBItjQxS/XhO0=";
+  cargoHash = "sha256-MsDan3wL9RhH0uhAuq0Lg8IRBXR8a3ooEBx6n2CMAVk=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/development/cuda-modules/nccl-tests/default.nix b/pkgs/development/cuda-modules/nccl-tests/default.nix
index 5c2f29b7ed56..9c9fc5dfb8d1 100644
--- a/pkgs/development/cuda-modules/nccl-tests/default.nix
+++ b/pkgs/development/cuda-modules/nccl-tests/default.nix
@@ -26,13 +26,13 @@ backendStdenv.mkDerivation (
   finalAttrs: {
 
     pname = "nccl-tests";
-    version = "2.13.8";
+    version = "2.13.9";
 
     src = fetchFromGitHub {
       owner = "NVIDIA";
       repo = finalAttrs.pname;
       rev = "v${finalAttrs.version}";
-      hash = "sha256-dxLoflsTHDBnZRTzoXdm30OyKpLlRa73b784YWALBHg=";
+      hash = "sha256-QYuMBPhvHHVo2ku14jD1CVINLPW0cyiXJkXxb77IxbE=";
     };
 
     strictDeps = true;
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index 4cc55effdaa5..174d5aa827f9 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -52,16 +52,16 @@ let
     name = "arrow-testing";
     owner = "apache";
     repo = "arrow-testing";
-    rev = "47f7b56b25683202c1fd957668e13f2abafc0f12";
-    hash = "sha256-ZDznR+yi0hm5O1s9as8zq5nh1QxJ8kXCRwbNQlzXpnI=";
+    rev = "ad82a736c170e97b7c8c035ebd8a801c17eec170";
+    hash = "sha256-wN0dam0ZXOAJ+D8bGDMhsdaV3llI9LsiCXwqW9mR3gQ=";
   };
 
   parquet-testing = fetchFromGitHub {
     name = "parquet-testing";
     owner = "apache";
     repo = "parquet-testing";
-    rev = "b2e7cc755159196e3a068c8594f7acbaecfdaaac";
-    hash = "sha256-IFvGTOkaRSNgZOj8DziRj88yH5JRF+wgSDZ5N0GNvjk=";
+    rev = "d69d979223e883faef9dc6fe3cf573087243c28a";
+    hash = "sha256-CUckfNjfDW05crWigzMP5b9UynviXKGZUlIr754OoGU=";
   };
 
   aws-sdk-cpp-arrow = aws-sdk-cpp.override {
@@ -76,16 +76,16 @@ let
   };
 
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "arrow-cpp";
-  version = "14.0.1";
+  version = "15.0.0";
 
   src = fetchurl {
-    url = "mirror://apache/arrow/arrow-${version}/apache-arrow-${version}.tar.gz";
-    hash = "sha256-XHDq+xAR+dEkuvsyiv5U9izFuSgLcIDh49Zo94wOQH4=";
+    url = "mirror://apache/arrow/arrow-${finalAttrs.version}/apache-arrow-${finalAttrs.version}.tar.gz";
+    hash = "sha256-Ad0/cOhdm1uTPsksDbik71BKUQX3jS2GIuhCeftFwl0=";
   };
 
-  sourceRoot = "apache-arrow-${version}/cpp";
+  sourceRoot = "apache-arrow-${finalAttrs.version}/cpp";
 
   # versions are all taken from
   # https://github.com/apache/arrow/blob/apache-arrow-${version}/cpp/thirdparty/versions.txt
@@ -211,8 +211,8 @@ stdenv.mkDerivation rec {
   ++ lib.optionals enableS3 [ "-DAWSSDK_CORE_HEADER_FILE=${aws-sdk-cpp-arrow}/include/aws/core/Aws.h" ];
 
   doInstallCheck = true;
-  ARROW_TEST_DATA = lib.optionalString doInstallCheck "${arrow-testing}/data";
-  PARQUET_TEST_DATA = lib.optionalString doInstallCheck "${parquet-testing}/data";
+  ARROW_TEST_DATA = lib.optionalString finalAttrs.doInstallCheck "${arrow-testing}/data";
+  PARQUET_TEST_DATA = lib.optionalString finalAttrs.doInstallCheck "${parquet-testing}/data";
   GTEST_FILTER =
     let
       # Upstream Issue: https://issues.apache.org/jira/browse/ARROW-11398
@@ -236,7 +236,7 @@ stdenv.mkDerivation rec {
         "ExecPlanExecution.StressSourceSinkStopped"
       ];
     in
-    lib.optionalString doInstallCheck "-${lib.concatStringsSep ":" filteredTests}";
+    lib.optionalString finalAttrs.doInstallCheck "-${lib.concatStringsSep ":" filteredTests}";
 
   __darwinAllowLocalNetworking = true;
 
@@ -244,19 +244,21 @@ stdenv.mkDerivation rec {
     ++ lib.optionals enableS3 [ minio ]
     ++ lib.optionals enableFlight [ python3 ];
 
-  disabledTests = [
-    # requires networking
-    "arrow-gcsfs-test"
-    "arrow-flight-integration-test"
-  ];
-
-  installCheckPhase = ''
-    runHook preInstallCheck
+  installCheckPhase =
+    let
+      disabledTests = [
+        # requires networking
+        "arrow-gcsfs-test"
+        "arrow-flight-integration-test"
+      ];
+    in
+    ''
+      runHook preInstallCheck
 
-    ctest -L unittest --exclude-regex '^(${lib.concatStringsSep "|" disabledTests})$'
+      ctest -L unittest --exclude-regex '^(${lib.concatStringsSep "|" disabledTests})$'
 
-    runHook postInstallCheck
-  '';
+      runHook postInstallCheck
+    '';
 
   meta = with lib; {
     description = "A cross-language development platform for in-memory data";
@@ -268,4 +270,4 @@ stdenv.mkDerivation rec {
   passthru = {
     inherit enableFlight enableJemalloc enableS3 enableGcs;
   };
-}
+})
diff --git a/pkgs/development/libraries/onnxruntime/0001-eigen-allow-dependency-injection.patch b/pkgs/development/libraries/onnxruntime/0001-eigen-allow-dependency-injection.patch
new file mode 100644
index 000000000000..41a7cf54abaa
--- /dev/null
+++ b/pkgs/development/libraries/onnxruntime/0001-eigen-allow-dependency-injection.patch
@@ -0,0 +1,45 @@
+From a29cffa646356228d6ec7bd7ce21fe3ab90fdd19 Mon Sep 17 00:00:00 2001
+From: Someone Serge <sergei.kozlukov@aalto.fi>
+Date: Wed, 7 Feb 2024 16:59:09 +0000
+Subject: [PATCH] eigen: allow dependency injection
+
+---
+ cmake/external/eigen.cmake | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/cmake/external/eigen.cmake b/cmake/external/eigen.cmake
+index c0f7ddc50e..996b83d18a 100644
+--- a/cmake/external/eigen.cmake
++++ b/cmake/external/eigen.cmake
+@@ -1,4 +1,3 @@
+-
+ if (onnxruntime_USE_PREINSTALLED_EIGEN)
+     add_library(eigen INTERFACE)
+     file(TO_CMAKE_PATH ${eigen_SOURCE_PATH} eigen_INCLUDE_DIRS)
+@@ -10,14 +9,21 @@ else ()
+             URL ${DEP_URL_eigen}
+             URL_HASH SHA1=${DEP_SHA1_eigen}
+             PATCH_COMMAND ${Patch_EXECUTABLE} --ignore-space-change --ignore-whitespace < ${PROJECT_SOURCE_DIR}/patches/eigen/Fix_Eigen_Build_Break.patch
++            FIND_PACKAGE_ARGS NAMES Eigen3
+         )
+     else()
+         FetchContent_Declare(
+             eigen
+             URL ${DEP_URL_eigen}
+             URL_HASH SHA1=${DEP_SHA1_eigen}
++            FIND_PACKAGE_ARGS NAMES Eigen3
+         )
+     endif()
+-    FetchContent_Populate(eigen)
+-    set(eigen_INCLUDE_DIRS  "${eigen_SOURCE_DIR}")
++    FetchContent_MakeAvailable(eigen)
++    add_library(eigen ALIAS Eigen3::Eigen)
++
++    # Onnxruntime doesn't always use `eigen` as a target in
++    # `target_link_libraries`, sometimes it just uses
++    # `target_include_directories`:
++    get_target_property(eigen_INCLUDE_DIRS Eigen3::Eigen INTERFACE_INCLUDE_DIRECTORIES)
+ endif()
+-- 
+2.42.0
+
diff --git a/pkgs/development/libraries/onnxruntime/default.nix b/pkgs/development/libraries/onnxruntime/default.nix
index 7a8b8570f62c..6faa3088fa3c 100644
--- a/pkgs/development/libraries/onnxruntime/default.nix
+++ b/pkgs/development/libraries/onnxruntime/default.nix
@@ -2,11 +2,11 @@
 , lib
 , fetchFromGitHub
 , fetchFromGitLab
-, fetchpatch
-, fetchurl
 , Foundation
 , abseil-cpp
 , cmake
+, eigen
+, gtest
 , libpng
 , nlohmann_json
 , nsync
@@ -16,7 +16,6 @@
 , zlib
 , microsoft-gsl
 , iconv
-, gtest
 , protobuf_21
 , pythonSupport ? true
 }:
@@ -30,25 +29,18 @@ let
     sha256 = "sha256-BYL7wxsYRI45l8C3VwxYIIocn5TzJnBtU0UZ9pHwwZw=";
   };
 
-  eigen = fetchFromGitLab {
-    owner = "libeigen";
-    repo = "eigen";
-    rev = "d10b27fe37736d2944630ecd7557cefa95cf87c9";
-    sha256 = "sha256-Lmco0s9gIm9sIw7lCr5Iewye3RmrHEE4HLfyzRkQCm0=";
-  };
-
   mp11 = fetchFromGitHub {
     owner = "boostorg";
     repo = "mp11";
     rev = "boost-1.79.0";
-    sha256 = "sha256-ZxgPDLvpISrjpEHKpLGBowRKGfSwTf6TBfJD18yw+LM=";
+    hash = "sha256-ZxgPDLvpISrjpEHKpLGBowRKGfSwTf6TBfJD18yw+LM=";
   };
 
   safeint = fetchFromGitHub {
     owner = "dcleblanc";
     repo = "safeint";
     rev = "ff15c6ada150a5018c5ef2172401cb4529eac9c0";
-    sha256 = "sha256-PK1ce4C0uCR4TzLFg+elZdSk5DdPCRhhwT3LvEwWnPU=";
+    hash = "sha256-PK1ce4C0uCR4TzLFg+elZdSk5DdPCRhhwT3LvEwWnPU=";
   };
 
   pytorch_cpuinfo = fetchFromGitHub {
@@ -56,14 +48,14 @@ let
     repo = "cpuinfo";
     # There are no tags in the repository
     rev = "5916273f79a21551890fd3d56fc5375a78d1598d";
-    sha256 = "sha256-nXBnloVTuB+AVX59VDU/Wc+Dsx94o92YQuHp3jowx2A=";
+    hash = "sha256-nXBnloVTuB+AVX59VDU/Wc+Dsx94o92YQuHp3jowx2A=";
   };
 
   flatbuffers = fetchFromGitHub {
     owner = "google";
     repo = "flatbuffers";
     rev = "v1.12.0";
-    sha256 = "sha256-L1B5Y/c897Jg9fGwT2J3+vaXsZ+lfXnskp8Gto1p/Tg=";
+    hash = "sha256-L1B5Y/c897Jg9fGwT2J3+vaXsZ+lfXnskp8Gto1p/Tg=";
   };
 
   gtest' = gtest.overrideAttrs (oldAttrs: rec {
@@ -74,44 +66,62 @@ let
       rev = "v${version}";
       hash = "sha256-LVLEn+e7c8013pwiLzJiiIObyrlbBHYaioO/SWbItPQ=";
     };
-    });
+  });
+
+  onnx = fetchFromGitHub {
+    owner = "onnx";
+    repo = "onnx";
+    rev = "refs/tags/v1.14.1";
+    hash = "sha256-ZVSdk6LeAiZpQrrzLxphMbc1b3rNUMpcxcXPP8s/5tE=";
+  };
 in
 stdenv.mkDerivation rec {
   pname = "onnxruntime";
-  version = "1.15.1";
+  version = "1.16.3";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "onnxruntime";
-    rev = "v${version}";
-    sha256 = "sha256-SnHo2sVACc++fog7Tg6f2LK/Sv/EskFzN7RZS7D113s=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-bTW9Pc3rvH+c8VIlDDEtAXyA3sajVyY5Aqr6+SxaMF4=";
     fetchSubmodules = true;
   };
 
+  patches = [
+    # If you stumble on these patches trying to update onnxruntime, check
+    # `git blame` and ping the introducers.
+
+    # Context: we want the upstream to
+    # - always try find_package first (FIND_PACKAGE_ARGS),
+    # - use MakeAvailable instead of the low-level Populate,
+    # - use Eigen3::Eigen as the target name (as declared by libeigen/eigen).
+    ./0001-eigen-allow-dependency-injection.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
     python3Packages.python
     protobuf_21
   ] ++ lib.optionals pythonSupport (with python3Packages; [
-    setuptools
-    wheel
     pip
+    python
     pythonOutputDistHook
+    setuptools
+    wheel
   ]);
 
   buildInputs = [
+    eigen
     libpng
     zlib
     nlohmann_json
-    nsync
-    re2
     microsoft-gsl
-  ] ++ lib.optionals pythonSupport [
-    python3Packages.numpy
-    python3Packages.pybind11
-    python3Packages.packaging
-  ] ++ lib.optionals stdenv.isDarwin [
+  ] ++ lib.optionals pythonSupport (with python3Packages; [
+    numpy
+    pybind11
+    packaging
+  ]) ++ lib.optionals stdenv.isDarwin [
     Foundation
     iconv
   ];
@@ -137,11 +147,10 @@ stdenv.mkDerivation rec {
     "-DFETCHCONTENT_QUIET=OFF"
     "-DFETCHCONTENT_SOURCE_DIR_ABSEIL_CPP=${abseil-cpp.src}"
     "-DFETCHCONTENT_SOURCE_DIR_DATE=${howard-hinnant-date}"
-    "-DFETCHCONTENT_SOURCE_DIR_EIGEN=${eigen}"
     "-DFETCHCONTENT_SOURCE_DIR_FLATBUFFERS=${flatbuffers}"
     "-DFETCHCONTENT_SOURCE_DIR_GOOGLE_NSYNC=${nsync.src}"
     "-DFETCHCONTENT_SOURCE_DIR_MP11=${mp11}"
-    "-DFETCHCONTENT_SOURCE_DIR_ONNX=${python3Packages.onnx.src}"
+    "-DFETCHCONTENT_SOURCE_DIR_ONNX=${onnx}"
     "-DFETCHCONTENT_SOURCE_DIR_PYTORCH_CPUINFO=${pytorch_cpuinfo}"
     "-DFETCHCONTENT_SOURCE_DIR_RE2=${re2.src}"
     "-DFETCHCONTENT_SOURCE_DIR_SAFEINT=${safeint}"
@@ -165,14 +174,14 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace cmake/libonnxruntime.pc.cmake.in \
-      --replace '$'{prefix}/@CMAKE_INSTALL_ @CMAKE_INSTALL_
+      --replace-fail '$'{prefix}/@CMAKE_INSTALL_ @CMAKE_INSTALL_
   '' + lib.optionalString (stdenv.hostPlatform.system == "aarch64-linux") ''
     # https://github.com/NixOS/nixpkgs/pull/226734#issuecomment-1663028691
     rm -v onnxruntime/test/optimizer/nhwc_transformer_test.cc
   '';
 
   postBuild = lib.optionalString pythonSupport ''
-    python ../setup.py bdist_wheel
+    ${python3Packages.python.interpreter} ../setup.py bdist_wheel
   '';
 
   postInstall = ''
diff --git a/pkgs/development/python-modules/aio-georss-client/default.nix b/pkgs/development/python-modules/aio-georss-client/default.nix
index 9c3cda759039..6130564b421c 100644
--- a/pkgs/development/python-modules/aio-georss-client/default.nix
+++ b/pkgs/development/python-modules/aio-georss-client/default.nix
@@ -1,6 +1,6 @@
 { lib
 , aiohttp
-, aresponses
+, aioresponses
 , buildPythonPackage
 , dateparser
 , fetchFromGitHub
@@ -10,23 +10,30 @@
 , pytestCheckHook
 , pythonOlder
 , requests
+, setuptools
 , xmltodict
 }:
 
 buildPythonPackage rec {
   pname = "aio-georss-client";
-  version = "0.11";
-  format = "setuptools";
+  version = "0.12";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "exxamalte";
     repo = "python-aio-georss-client";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Voc1ME0iGQCMaDfBXDSVnRp8olvId+fLhH8sqHwB2Ak=";
+    hash = "sha256-qs0/TkGZlwsucnkgCBco2Pqr9mf5fZHY7ikMBKff+gA=";
   };
 
+  __darwinAllowLocalNetworking = true;
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     aiohttp
     haversine
@@ -35,10 +42,8 @@ buildPythonPackage rec {
     dateparser
   ];
 
-  __darwinAllowLocalNetworking = true;
-
   nativeCheckInputs = [
-    aresponses
+    aioresponses
     mock
     pytest-asyncio
     pytestCheckHook
diff --git a/pkgs/development/python-modules/aio-georss-gdacs/default.nix b/pkgs/development/python-modules/aio-georss-gdacs/default.nix
index f55a42b5dd22..52c5c79a198e 100644
--- a/pkgs/development/python-modules/aio-georss-gdacs/default.nix
+++ b/pkgs/development/python-modules/aio-georss-gdacs/default.nix
@@ -1,37 +1,42 @@
 { lib
 , aio-georss-client
-, aresponses
+, aioresponses
 , buildPythonPackage
 , dateparser
 , fetchFromGitHub
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "aio-georss-gdacs";
-  version = "0.8";
-  format = "setuptools";
+  version = "0.9";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "exxamalte";
     repo = "python-aio-georss-gdacs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1mpOWd4Z2gTQtRewWfZsfEtmS6i5uMPAMTlC8UpawxM=";
+    hash = "sha256-B0qVCh2u0WleF0iv0o1/d5UIS2kbYCAqCgmNHyCpJ8Q=";
   };
 
+  __darwinAllowLocalNetworking = true;
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     aio-georss-client
     dateparser
   ];
 
-  __darwinAllowLocalNetworking = true;
-
   nativeCheckInputs = [
-    aresponses
+    aioresponses
     pytest-asyncio
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/cmdstanpy/default.nix b/pkgs/development/python-modules/cmdstanpy/default.nix
index 717f85dc8e54..9ca60fe3c88e 100644
--- a/pkgs/development/python-modules/cmdstanpy/default.nix
+++ b/pkgs/development/python-modules/cmdstanpy/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , substituteAll
-, fetchpatch
 , cmdstan
 , pythonRelaxDepsHook
 , setuptools
@@ -17,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "cmdstanpy";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stan-dev";
     repo = "cmdstanpy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1/X5JDvCx21qLNamNQXpg+w3d3DdSRlB+liIv2fThs4=";
+    hash = "sha256-q+AFhWEzjYElJpiHT4h6YfZrwZJ56pv+8R+001vREyQ=";
   };
 
   patches = [
@@ -32,11 +31,6 @@ buildPythonPackage rec {
       src = ./use-nix-cmdstan-path.patch;
       cmdstan = "${cmdstan}/opt/cmdstan";
     })
-    (fetchpatch {
-      name = "stan-2.34-fix-parsing-of-unit_e-output-files.patch";
-      url = "https://github.com/stan-dev/cmdstanpy/commit/144d641739ccd1109055d13b5b96e4e76607305d.patch";
-      hash = "sha256-21hcbK3Xs7vGBNRs4hMfY5g7jIwEG49WYnsOxYJ6ccs=";
-    })
   ];
 
   postPatch = ''
@@ -77,7 +71,6 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    "test_lp_good" # Fails for some reason
     "test_serialization" # Pickle class mismatch errors
     # These tests use the flag -DSTAN_THREADS which doesn't work in cmdstan (missing file)
     "test_multi_proc_threads"
diff --git a/pkgs/development/python-modules/py-dmidecode/default.nix b/pkgs/development/python-modules/py-dmidecode/default.nix
index d48fe7411d79..bcd850def625 100644
--- a/pkgs/development/python-modules/py-dmidecode/default.nix
+++ b/pkgs/development/python-modules/py-dmidecode/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "py-dmidecode";
-  version = "0.1.2";
+  version = "0.1.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "py_dmidecode";
     inherit version;
-    hash = "sha256-nMy/jOlg7yUPfGF27MN0NyVM0vuTIBuJTV2GKNP13UA=";
+    hash = "sha256-pS1fRWuWLnXuNEGYXU/j1njC8THWQOHbnVOF9+c13Cw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index fc424376477e..053b280c500e 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -16,7 +16,6 @@
 , pytestCheckHook
 , pytest-lazy-fixture
 , pkg-config
-, scipy
 , setuptools
 , setuptools-scm
 , oldest-supported-numpy
@@ -53,10 +52,12 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     cffi
+    numpy
+  ];
+
+  checkInputs = [
     cloudpickle
     fsspec
-    numpy
-    scipy
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/tools/misc/runme/default.nix b/pkgs/development/tools/misc/runme/default.nix
index c0f305a591e3..36b1173aeb39 100644
--- a/pkgs/development/tools/misc/runme/default.nix
+++ b/pkgs/development/tools/misc/runme/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "runme";
-  version = "2.2.2";
+  version = "2.2.5";
 
   src = fetchFromGitHub {
     owner = "stateful";
     repo = "runme";
     rev = "v${version}";
-    hash = "sha256-JEKfUrXCN2cvoVs2bScq1v/DfmqaUoew3PyGnNaTKN8=";
+    hash = "sha256-CEJsLBfLMWEQV6Q9TMy1Igdmn45v8vV0rxOMmFW/sb8=";
   };
 
-  vendorHash = "sha256-+g6vEgA+vbGzLnotmhk0gp1IcY3zpF71TdoB8d84W6A=";
+  vendorHash = "sha256-QoZzEq1aC7cjY/RVp5Z5HhSuTFf2BSYQnfg0jSaeTJU=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/nwjs/default.nix b/pkgs/development/tools/nwjs/default.nix
index 752ec8b70188..9b1d662ae756 100644
--- a/pkgs/development/tools/nwjs/default.nix
+++ b/pkgs/development/tools/nwjs/default.nix
@@ -85,7 +85,7 @@ let
     extraOutputsToInstall = [ "lib" "out" ];
   };
 
-  version = "0.83.0";
+  version = "0.84.0";
 in
 stdenv.mkDerivation {
   pname = "nwjs";
@@ -96,10 +96,10 @@ stdenv.mkDerivation {
     in fetchurl {
       url = "https://dl.nwjs.io/v${version}/nwjs-${flavor}v${version}-linux-${bits}.tar.gz";
       hash = {
-        "sdk-ia32" = "sha256-Sps0XFOnnJIkDRPI+PJSjseF8cyaYvXXs4ZeVI8mcm8=";
-        "sdk-x64" = "sha256-qsNPfmDQK/BZzMTlX9MDaV7KZsU32YQ1B/Qh/EHIZrQ=";
-        "ia32" = "sha256-99+EU4Kg8lH8facRmIl2SV3GyWUw46rGYpso5QSP//k=";
-        "x64" = "sha256-y0oBVvVguRDe391EsQs6qYqkTRPzUfm50m6NDOZh+7o=";
+        "sdk-ia32" = "sha256-uy6WZuA5b79yACSe3wiKiEeMb6K/z84cSeQDrKFUUdE=";
+        "sdk-x64" = "sha256-xI/YMHg5RWYh9XCLskSkuDwemH77U43Fzb8C9+fS9wE=";
+        "ia32" = "sha256-Sc9geGuwl9TIdLrKr97Wz2h4S+AEgP3DAd12Toyk7b8=";
+        "x64" = "sha256-VIygMzCPTKzLr47bG1DYy/zj0OxsjGcms0G1BkI/TEI=";
       }."${flavor + bits}";
     };
 
diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
index 5c4c14eeb069..b825cfc0a962 100644
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -16,14 +16,6 @@ stdenv.mkDerivation rec {
     sha256 = cfg.sha256.${pname};
   };
 
-  patches = [
-    # batman-adv: compat: Fix skb_vlan_eth_hdr conflict in stable kernels
-    (fetchpatch2 {
-      url = "https://git.open-mesh.org/batman-adv.git/commitdiff_plain/be69e50e8c249ced085d41ddd308016c1c692174?hp=74d3c5e1c682a9efe31b75e8986668081a4b5341";
-      sha256 = "sha256-yfEiU74wuMSKal/6mwzgdccqDMEv4P7CkAeiSAEwvjA=";
-    })
-  ];
-
   nativeBuildInputs = kernel.moduleBuildDependencies;
   makeFlags = kernel.makeFlags ++ [
     "KERNELPATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
diff --git a/pkgs/os-specific/linux/batman-adv/version.nix b/pkgs/os-specific/linux/batman-adv/version.nix
index f78191489d0f..545285a6cf42 100644
--- a/pkgs/os-specific/linux/batman-adv/version.nix
+++ b/pkgs/os-specific/linux/batman-adv/version.nix
@@ -1,16 +1,16 @@
 {
-  version = "2023.3";
+  version = "2024.0";
 
   # To get these, run:
   #
   # ```
   # for tool in alfred batctl batman-adv; do
-  #   nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2023.3/$tool-2023.3.tar.gz --type sha256 | xargs nix hash to-sri --type sha256
+  #   nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2024.0/$tool-2024.0.tar.gz --type sha256 | xargs nix hash to-sri --type sha256
   # done
   # ```
   sha256 = {
-    alfred = "sha256-rVrUFJ+uz351MCpXeqpnOxz8lAXSAksrSpFjuscMjk8=";
-    batctl = "sha256-mswxFwkwwXl8OHY7h73/iAVMNNHwEvu4EAaCc/7zEhI=";
-    batman-adv = "sha256-98bFPlk0PBYmQsubRPEBZ2XUv1E+A5ACvmEremweo2w=";
+    alfred = "sha256-0CmkNjirFnceX3HhNLyEPRcT10BBxlvNoYox0Y9VMb0=";
+    batctl = "sha256-doU+hyAa9jxBHbFS/QxiWnKalzMRWJfRMxYE4sWmfH0=";
+    batman-adv = "sha256-YREGl7V5n2RqKoKk3Pl/rtS7EqfMQ79Gg9LE3k9rQOc=";
   };
 }
diff --git a/pkgs/servers/etcd/3.5.nix b/pkgs/servers/etcd/3.5.nix
index 226547087412..f02533ea9a14 100644
--- a/pkgs/servers/etcd/3.5.nix
+++ b/pkgs/servers/etcd/3.5.nix
@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, symlinkJoin, nixosTests }:
 
 let
-  version = "3.5.11";
+  version = "3.5.12";
 
   src = fetchFromGitHub {
     owner = "etcd-io";
     repo = "etcd";
     rev = "v${version}";
-    hash = "sha256-OjAWi5EXy1d1O6HLBzHcSfeCNmZZLNtrQXpTJ075B0I=";
+    hash = "sha256-Z2WXNzFJYfRQCldUspQjUR5NyUzCCINycuEXWaTn4vU=";
   };
 
   CGO_ENABLED = 0;
@@ -25,7 +25,7 @@ let
 
     inherit CGO_ENABLED meta src version;
 
-    vendorHash = "sha256-1/ma737hGdek+263w5OuO5iN5DTA8fpb6m0Fefyww20=";
+    vendorHash = "sha256-S5cEIV4hKRjn9JFEKWBiSEPytHtVacsSnG6T8dofgyk=";
 
     modRoot = "./server";
 
@@ -45,7 +45,7 @@ let
 
     inherit CGO_ENABLED meta src version;
 
-    vendorHash = "sha256-AMN8iWTIFeT0HLqxYrp7sieT0nEKBNwFXV9mZG3xG5I=";
+    vendorHash = "sha256-Vgp44Kg6zUDYVJU6SiYd8ZEcAWqKPPTsqYafcfk89Cc=";
 
     modRoot = "./etcdutl";
   };
@@ -55,7 +55,7 @@ let
 
     inherit CGO_ENABLED meta src version;
 
-    vendorHash = "sha256-zwafVpNBvrRUbL0qkDK9TOyo8KCiGjpZhvdUrgklG5Y=";
+    vendorHash = "sha256-PZLsekZzwlGzccCirNk9uUj70Ue5LMDs6LMWBI9yivs=";
 
     modRoot = "./etcdctl";
   };
diff --git a/pkgs/servers/geospatial/pg_featureserv/default.nix b/pkgs/servers/geospatial/pg_featureserv/default.nix
index 6c9d3a6c10c9..b6e68eb946e2 100644
--- a/pkgs/servers/geospatial/pg_featureserv/default.nix
+++ b/pkgs/servers/geospatial/pg_featureserv/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pg_featureserv";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "CrunchyData";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Kii9Qbff6dIAaHx3QfNPTg8g+QrBpZghGlHxrsGaMbo=";
+    sha256 = "sha256-GsloUZFgrOrJc23vKv+8iSeyIEKblaukPSCpZGRtSL4=";
   };
 
   vendorHash = "sha256-BHiEVyi3FXPovYy3iDP8q+y+LgfI4ElDPVZexd7nnuo=";
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 59d0270cef67..cd498ba55533 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -21,16 +21,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2024-01-31T20-20-33Z";
+  version = "2024-02-04T22-36-13Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    hash = "sha256-cQqgLjUGjLGV9o1asMbZrmGZ2FPB0/08JaoYW6hgDPE=";
+    hash = "sha256-vA1xrwvHyhqrdWjEXqs0MUaPq8S3J2r1uE0IndpwdjQ=";
   };
 
-  vendorHash = "sha256-v6Mn0f8xNsaV1ixnuVs9cPi5FghAGKjX5nWiBZLhBUU=";
+  vendorHash = "sha256-eE8F/cG7SdSHrFW4qg+MBdS/rxoz4xB0JbCQ3vi38ok=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/sql/cockroachdb/cockroachdb-bin.nix b/pkgs/servers/sql/cockroachdb/cockroachdb-bin.nix
index 363e7cd224a7..7e5c342a691e 100644
--- a/pkgs/servers/sql/cockroachdb/cockroachdb-bin.nix
+++ b/pkgs/servers/sql/cockroachdb/cockroachdb-bin.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "23.1.7";
+  version = "23.1.14";
   pname = "cockroachdb";
 
   # For several reasons building cockroach from source has become
@@ -17,11 +17,11 @@ let
   srcs = {
     aarch64-linux = fetchzip {
       url = "https://binaries.cockroachdb.com/cockroach-v${version}.linux-arm64.tgz";
-      hash = "sha256-73qJL3o328NckH6POXv+AUvlAJextb31Vs8NGdc8dwE=";
+      hash = "sha256-cwczzmSKKQs/DN6WZ/FF6nJC82Pu47akeDqWdBMgdz0=";
     };
     x86_64-linux = fetchzip {
       url = "https://binaries.cockroachdb.com/cockroach-v${version}.linux-amd64.tgz";
-      hash = "sha256-FL/zDrl+QstBp54LE9/SbIfSPorneGZSef6dcOQJbSo=";
+      hash = "sha256-goCBE+zv9KArdoMsI48rlISurUM0bL/l1OEYWQKqzv0=";
     };
   };
   src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
diff --git a/pkgs/tools/backup/zfs-replicate/default.nix b/pkgs/tools/backup/zfs-replicate/default.nix
index abc9bc6b4068..c5852d400eab 100644
--- a/pkgs/tools/backup/zfs-replicate/default.nix
+++ b/pkgs/tools/backup/zfs-replicate/default.nix
@@ -38,8 +38,7 @@ buildPythonApplication rec {
     stringcase
   ];
 
-  # Current releases do not include tests.
-  doCheck = false;
+  doCheck = true;
 
   meta = with lib; {
     homepage = "https://github.com/alunduil/zfs-replicate";
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index 1650cbd419fe..17090d28ca93 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.32.0";
+  version = "1.33.1";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-CFrWX40VpkMySDYoci+i7CrypT/dIW3rg/jzRU5V5Tc=";
+    hash = "sha256-k8rBf1kSeumtOHixJR9g90q+u5eIL0584fvTK/Qg/FU=";
   };
 
-  cargoHash = "sha256-QCCTqP3GNfg/zRXqjpDSnFSwEF0116qtSZ0yYkLbjgQ=";
+  cargoHash = "sha256-MxWtPc1C+L5ZSPOyXwxzdAWe5WbZiPW+Zfv1P1j73JQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/misc/upterm/default.nix b/pkgs/tools/misc/upterm/default.nix
index 5b022e8134a5..135fa5dcec69 100644
--- a/pkgs/tools/misc/upterm/default.nix
+++ b/pkgs/tools/misc/upterm/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "upterm";
-  version = "0.12.0";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "owenthereal";
     repo = "upterm";
     rev = "v${version}";
-    hash = "sha256-Ljiy23qZTe81qaRTgrpuAdZqdOT8t8+cTqXLpKo5yFc=";
+    hash = "sha256-GpD8OUZWN2myADHjpIBUzu2adkE9eFLENxpybX+k9Zg=";
   };
 
-  vendorHash = "sha256-hXmcgLNzVkU3RC3rj9I+/GlXyxbvPFsoFvVSLJTUHMM=";
+  vendorHash = "sha256-Rh3xgxaCPj9CbiNy8AycuCPvD/HCiLohcdiCQwPduDM=";
 
   subPackages = [ "cmd/upterm" "cmd/uptermd" ];
 
diff --git a/pkgs/tools/networking/godns/default.nix b/pkgs/tools/networking/godns/default.nix
index d02e7527d149..c50fa68a068b 100644
--- a/pkgs/tools/networking/godns/default.nix
+++ b/pkgs/tools/networking/godns/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "godns";
-  version = "3.0.6";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "TimothyYe";
     repo = "godns";
     rev = "refs/tags/v${version}";
-    hash = "sha256-e4d0q4Sw0/Oq5AHw1ikRKakKSVdtf+hTbg7OX/RLT+o=";
+    hash = "sha256-7zgvrEVt8xg54NijcqnXoZcXetzOu9h3Ucw7w03YagU=";
   };
 
-  vendorHash = "sha256-PVp09gWk35T0gQoYOPzaVFtrqua0a8cNjPOgfYyu7zg=";
+  vendorHash = "sha256-veDrGB6gjUa8G/UyKzEgH2ItGGEPlXDePahq2XP2nAo=";
 
   # Some tests require internet access, broken in sandbox
   doCheck = false;
diff --git a/pkgs/tools/networking/mailutils/default.nix b/pkgs/tools/networking/mailutils/default.nix
index 884bb9cdd6ab..f13cd8e07794 100644
--- a/pkgs/tools/networking/mailutils/default.nix
+++ b/pkgs/tools/networking/mailutils/default.nix
@@ -31,11 +31,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mailutils";
-  version = "3.16";
+  version = "3.17";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-BB0VjTCMA3YYQ4jpyTbPqEGlHNwl1Nt1mEp3Gj+gAsA=";
+    hash = "sha256-+km6zsN1Zv5S+IIh04cWc6Yzru4M2SPMOo5lu+8rhOk=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/tools/nix/manix/default.nix b/pkgs/tools/nix/manix/default.nix
deleted file mode 100644
index 082f99f4de74..000000000000
--- a/pkgs/tools/nix/manix/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  rustPlatform,
-  Security,
-}:
-rustPlatform.buildRustPackage rec {
-  pname = "manix";
-  version = "0.7.1";
-
-  src = fetchFromGitHub {
-    repo = pname;
-    owner = "lecoqjacob";
-    rev = "${version}";
-    hash = "sha256-kTQbeOIGG1HmbsXKfXw5yCZ49kGufbGiCkkIRMTwcsg=";
-  };
-
-  buildInputs = lib.optionals stdenv.isDarwin [Security];
-  cargoSha256 = "sha256-7SHUi1qH9Dr4Oi7A6gRmZqhAIr8RzLNU1l1x4WGtQYI=";
-
-  meta = with lib; {
-    license = [licenses.mpl20];
-    platforms = platforms.unix;
-    homepage = "https://github.com/lecoqjacob/manix";
-    description = "A Fast Documentation Searcher for Nix";
-    maintainers = [maintainers.lecoqjacob];
-  };
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b7667a7961eb..520115bce7df 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9083,7 +9083,9 @@ with pkgs;
 
   hatch = python3Packages.callPackage ../development/tools/hatch { };
 
-  hal-hardware-analyzer = libsForQt5.callPackage ../applications/science/electronics/hal-hardware-analyzer { };
+  hal-hardware-analyzer = libsForQt5.callPackage ../applications/science/electronics/hal-hardware-analyzer {
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
+  };
 
   half = callPackage ../development/libraries/half { };
 
@@ -10752,10 +10754,6 @@ with pkgs;
     inherit (python3Packages) mako;
   };
 
-  manix = callPackage ../tools/nix/manix {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   marktext = callPackage ../applications/misc/marktext { };
 
   mars-mips = callPackage ../development/tools/mars-mips { };