Merge branch 'master' into staging-next

93 files changed, 261 insertions, 203 deletions

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9a1bc0450d2..44acc011ba1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -267,6 +267,7 @@
   ./programs/udevil.nix
   ./programs/usbtop.nix
   ./programs/vim.nix
+  ./programs/virt-manager.nix
   ./programs/wavemon.nix
   ./programs/wayland/cardboard.nix
   ./programs/wayland/river.nix
diff --git a/pkgs/applications/audio/gpodder/default.nix b/pkgs/applications/audio/gpodder/default.nix
index f8d4232798b..120a72dbd50 100644
--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@@ -14,14 +14,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gpodder";
-  version = "3.11.3";
+  version = "3.11.4";
   format = "other";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "p8BgpvMK1kP4VnRfmcvSMbXmWs5DmWBZ6te7L9b+UJQ=";
+    sha256 = "kEhyV1o8VSQW9qMx6m5avj6LnJuVTONDd6msRuc8t/4=";
   };
 
   patches = [
diff --git a/pkgs/applications/audio/musikcube/default.nix b/pkgs/applications/audio/musikcube/default.nix
index 531d2851261..f25606886ff 100644
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Terminal-based music player, library, and streaming audio server";
     homepage = "https://musikcube.com/";
-    maintainers = with lib.maintainers; [ aanderse srapenne afh ];
+    maintainers = with lib.maintainers; [ aanderse afh ];
     license = lib.licenses.bsd3;
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/applications/audio/yoshimi/default.nix b/pkgs/applications/audio/yoshimi/default.nix
index 459cbd6388b..abe49c44f6f 100644
--- a/pkgs/applications/audio/yoshimi/default.nix
+++ b/pkgs/applications/audio/yoshimi/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "yoshimi";
-  version = "2.3.0.3";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "Yoshimi";
     repo = pname;
     rev = version;
-    hash = "sha256-IsmhLUGqoa4Le86LE9SHFiXeiIKgwNfLaPFYXxnC9BM=";
+    hash = "sha256-NMgy/ucuSRFX2zlO8GhL4QSP4NZo1QKZJYTc2eXzWUA=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/applications/blockchains/besu/default.nix b/pkgs/applications/blockchains/besu/default.nix
index f9a73abb64c..549437313bb 100644
--- a/pkgs/applications/blockchains/besu/default.nix
+++ b/pkgs/applications/blockchains/besu/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "besu";
-  version = "23.7.3";
+  version = "23.10.0";
 
   src = fetchurl {
     url = "https://hyperledger.jfrog.io/artifactory/${pname}-binaries/${pname}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-wSymqYYVV+C/jycHb4yK/M5vFWRofl8Cv9yWwrGIRv8=";
+    sha256 = "sha256-PHXzeSv9sIknBbN48Li/wU72zs8div5xHY2Gh+1mh88=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/blockchains/ergo/default.nix b/pkgs/applications/blockchains/ergo/default.nix
index 1945ae3eed6..7ff9b9563d9 100644
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "5.0.14";
+  version = "5.0.15";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-YcFjnDs1hAmkYmJlq3yvY/IP6P9SPVGknbzapl5C2B4=";
+    sha256 = "sha256-/VMuye6uCQghjwotjmWEe55RADVwHCpH6PelZXVXSzM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/editors/kakoune/default.nix b/pkgs/applications/editors/kakoune/default.nix
index 11ed7036399..5ca75e76cdf 100644
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     description = "A vim inspired text editor";
     license = licenses.publicDomain;
     mainProgram = "kak";
-    maintainers = with maintainers; [ vrthra srapenne ];
+    maintainers = with maintainers; [ vrthra ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/graphics/gthumb/default.nix b/pkgs/applications/graphics/gthumb/default.nix
index f0f796ed59f..c284774bd36 100644
--- a/pkgs/applications/graphics/gthumb/default.nix
+++ b/pkgs/applications/graphics/gthumb/default.nix
@@ -35,11 +35,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gthumb";
-  version = "3.12.3";
+  version = "3.12.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-k9s11xQCxIoILVDPQIW7a4DkvVyLmxYaH3tRhBsQBxE=";
+    sha256 = "sha256-rdaTrArrmjDYKboDoGIIKJ0/aGjcOwJXNUnogZDHlOg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/yacreader/default.nix b/pkgs/applications/graphics/yacreader/default.nix
index f849512cae5..b70fdfc9d74 100644
--- a/pkgs/applications/graphics/yacreader/default.nix
+++ b/pkgs/applications/graphics/yacreader/default.nix
@@ -22,6 +22,6 @@ mkDerivation rec {
     description = "A comic reader for cross-platform reading and managing your digital comic collection";
     homepage = "http://www.yacreader.com";
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ srapenne ];
+    maintainers = with lib.maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/misc/albert/default.nix b/pkgs/applications/misc/albert/default.nix
index ceb74f7b0a3..d76231ee8c1 100644
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "albert";
-  version = "0.22.13";
+  version = "0.22.14";
 
   src = fetchFromGitHub {
     owner = "albertlauncher";
     repo = "albert";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-IZpIgU/cf25XxH8J0xQJLASu0YmTmcHY5RxUcbKrtvA=";
+    sha256 = "sha256-cAxdCjaCqEkwjL+OXW7ONkS7OpKfey3bUYmGzJyV+g8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/keepassxc/default.nix b/pkgs/applications/misc/keepassxc/default.nix
index ef1baa1e853..ed7884ad256 100644
--- a/pkgs/applications/misc/keepassxc/default.nix
+++ b/pkgs/applications/misc/keepassxc/default.nix
@@ -142,7 +142,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://keepassxc.org/";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ jonafato srapenne blankparticle ];
+    maintainers = with maintainers; [ jonafato blankparticle ];
     platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/applications/misc/minigalaxy/default.nix b/pkgs/applications/misc/minigalaxy/default.nix
index 4dffe9e08eb..ad694c01cdc 100644
--- a/pkgs/applications/misc/minigalaxy/default.nix
+++ b/pkgs/applications/misc/minigalaxy/default.nix
@@ -71,7 +71,7 @@ python3Packages.buildPythonApplication rec {
     downloadPage = "https://github.com/sharkwouter/minigalaxy/releases";
     description = "A simple GOG client for Linux";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ srapenne ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/misc/otpclient/default.nix b/pkgs/applications/misc/otpclient/default.nix
index b313ab2fa1a..04794635cdf 100644
--- a/pkgs/applications/misc/otpclient/default.nix
+++ b/pkgs/applications/misc/otpclient/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "otpclient";
-  version = "3.1.9";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "paolostivanin";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-FSXUqnES/YxONwLza4N2C4Ks02OOfRaXHbdBxr85sFg=";
+    hash = "sha256-3ypEP5HQYXOyB2euvDDpKjpbCD67oE19wkmzQbyKxiI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/xastir/default.nix b/pkgs/applications/misc/xastir/default.nix
index abb5d0b9609..21990075183 100644
--- a/pkgs/applications/misc/xastir/default.nix
+++ b/pkgs/applications/misc/xastir/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xastir";
-  version = "2.1.8";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "Release-${version}";
-    hash = "sha256-hRe0KO1lWOv3hNNDMS70t+X1rxuhNlNKykmo4LEU+U0=";
+    hash = "sha256-EQXSfH4b5vMiprFcMXCUDNl+R1cHSj9CyhZnUPAMoCw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/argo/default.nix b/pkgs/applications/networking/cluster/argo/default.nix
index 77fc279e581..b0b7e8a08eb 100644
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@@ -35,16 +35,16 @@ let
 in
 buildGoModule rec {
   pname = "argo";
-  version = "3.4.11";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-H14a1JzFvzxoNDv8WGzHgfalLnDZ+nX19BbM5ptrEes=";
+    hash = "sha256-3MwSiI21j2tMqdDInK7Q+QDMiFCophJyNXMOXMwJeEQ=";
   };
 
-  vendorHash = "sha256-0563OHMNkKZcmLY1nHS70pbtrufY1d1WNXrxcCl6MKY=";
+  vendorHash = "sha256-Zh/r4/+x67C1yXGW/R+FYKiGFaGPEV//Sg9cWwVIMxI=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/flink/default.nix b/pkgs/applications/networking/cluster/flink/default.nix
index 70c70d9ead4..60fb991fb0b 100644
--- a/pkgs/applications/networking/cluster/flink/default.nix
+++ b/pkgs/applications/networking/cluster/flink/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "flink";
-  version = "1.17.1";
+  version = "1.18.0";
 
   src = fetchurl {
     url = "mirror://apache/flink/${pname}-${version}/${pname}-${version}-bin-scala_2.12.tgz";
-    sha256 = "sha256-HpVDS3ydi2Z1SINAUed9lni9i8FCr0SI8yBCYP4wxyM=";
+    sha256 = "sha256-mwlpRx/snaTymCubVLTnvN5SpXO2EWl9qZ8seNtNKtI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/networking/cluster/k8sgpt/default.nix b/pkgs/applications/networking/cluster/k8sgpt/default.nix
index 1afac13c05a..69e8427be02 100644
--- a/pkgs/applications/networking/cluster/k8sgpt/default.nix
+++ b/pkgs/applications/networking/cluster/k8sgpt/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "k8sgpt";
-  version = "0.3.17";
+  version = "0.3.19";
 
   src = fetchFromGitHub {
     owner = "k8sgpt-ai";
     repo = "k8sgpt";
     rev = "v${version}";
-    hash = "sha256-vSytBicpYWs7MqVts+3d6qVZ19nrM1oi00YRPmCQb/I=";
+    hash = "sha256-yXlcTU0efgjcWy4nlhEIjd9dzErKyAW9gFhacOXv6pA=";
   };
 
-  vendorHash = "sha256-UFXESGdipfM/TI/9ZSVwoUPsd3LVeEmTFB6sVqkkzQo=";
+  vendorHash = "sha256-/yibMktAzoUCGED8oJWmNZJxOY0UM0zMl4Qww6olOZY=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/applications/networking/cluster/kubedb-cli/default.nix b/pkgs/applications/networking/cluster/kubedb-cli/default.nix
index ee6508ae75e..3af7a599082 100644
--- a/pkgs/applications/networking/cluster/kubedb-cli/default.nix
+++ b/pkgs/applications/networking/cluster/kubedb-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubedb-cli";
-  version = "0.35.1";
+  version = "0.36.0";
 
   src = fetchFromGitHub {
     owner = "kubedb";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-vpjz2t5wnSWbxc5kdASXIaq2m7izqmC3aSLXvnC+IyE=";
+    sha256 = "sha256-nDLdATiUcg5o86Pda1/Do9dPMtdNCUo/xj6ERRzih8w=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/linkerd/default.nix b/pkgs/applications/networking/cluster/linkerd/default.nix
index a7631770344..3544669ee9c 100644
--- a/pkgs/applications/networking/cluster/linkerd/default.nix
+++ b/pkgs/applications/networking/cluster/linkerd/default.nix
@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "stable";
-  version = "2.14.1";
-  sha256 = "1fxwy8c1zcjwnv055czn9ixalpvq710k0m82633n73a0ixnlmjbv";
-  vendorHash = "sha256-hOuvIndyGGvNWYmzE0rho/Y30/ilCzeBtL5GEvl9QqU=";
+  version = "2.14.2";
+  sha256 = "0j7w1x88fxbwlmdj111l3v02m8a2p75zsjj847d09a901jav3ih5";
+  vendorHash = "sha256-yEwz9CopCbK8mOUxzjDG3nsbWzhJlA3JTO4nYN8G68E=";
 }
diff --git a/pkgs/applications/networking/coreth/default.nix b/pkgs/applications/networking/coreth/default.nix
index 681be48cb9b..92319f17349 100644
--- a/pkgs/applications/networking/coreth/default.nix
+++ b/pkgs/applications/networking/coreth/default.nix
@@ -6,19 +6,19 @@
 
 buildGoModule rec {
   pname = "coreth";
-  version = "0.12.5";
+  version = "0.12.6";
 
   src = fetchFromGitHub {
     owner = "ava-labs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jHJubqNmU0OkKmWNCkucmv+IM19x3nfyDkfBpRihh7Y=";
+    hash = "sha256-AmlDOtV6uQtrscvIgK5kz6PldA7a1XrVuwO4DCFZeno=";
   };
 
   # go mod vendor has a bug, see: golang/go#57529
   proxyVendor = true;
 
-  vendorHash = "sha256-GKAGBEHP09NJ/GLq349K9VwFGt8rCvoHu8BB8TzN4CU=";
+  vendorHash = "sha256-v1DoRZuv6k6UIgPirXMbvunttn1aBLbTc+GdtdKquDk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/feedreaders/goeland/default.nix b/pkgs/applications/networking/feedreaders/goeland/default.nix
index 70da2b8796a..0c97ad68b82 100644
--- a/pkgs/applications/networking/feedreaders/goeland/default.nix
+++ b/pkgs/applications/networking/feedreaders/goeland/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "goeland";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "slurdge";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-b/A76f9/pFDdG1ZiHQnJrxYmlvFIjhZZhTIGl09cMcg=";
+    sha256 = "sha256-bjPmhNJFkN0N0Mx3Q4RJuNfeqFy9v8KphiAU1WyKCo4=";
   };
 
-  vendorHash = "sha256-jOtIA7+rM/2qObhR61utvmXD+Rxi/+dEvzgYkGR76I8=";
+  vendorHash = "sha256-jYrPsVagGgvpQ9Zj3o2kB82xgw/yaJS9BXxuqMkNjEA=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/instant-messengers/alfaview/default.nix b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
index 17c9d9de710..ecbe202487a 100644
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alfaview";
-  version = "9.2.0";
+  version = "9.4.0";
 
   src = fetchurl {
     url = "https://assets.alfaview.com/stable/linux/deb/${pname}_${version}.deb";
-    sha256 = "sha256-bvcKM9rBUHZFvoFKW/ksjrgqJfovcHaoDNEcSWhHJTU=";
+    sha256 = "sha256-bOK6QP9uLMJP9pgts4EyvW0WIKqcfhtvb1heG629Q38=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/mailreaders/claws-mail/default.nix b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
index bc5b692501a..2ae02236fe0 100644
--- a/pkgs/applications/networking/mailreaders/claws-mail/default.nix
+++ b/pkgs/applications/networking/mailreaders/claws-mail/default.nix
@@ -158,6 +158,6 @@ in stdenv.mkDerivation rec {
     homepage = "https://www.claws-mail.org/";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fpletz globin orivej oxzi ajs124 srapenne ];
+    maintainers = with maintainers; [ fpletz globin orivej oxzi ajs124 ];
   };
 }
diff --git a/pkgs/applications/science/robotics/qgroundcontrol/default.nix b/pkgs/applications/science/robotics/qgroundcontrol/default.nix
index 9f88fe58e3c..0ff92337566 100644
--- a/pkgs/applications/science/robotics/qgroundcontrol/default.nix
+++ b/pkgs/applications/science/robotics/qgroundcontrol/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "qgroundcontrol";
-  version = "4.2.8";
+  version = "4.2.9";
 
   propagatedBuildInputs = [
     qtbase qtcharts qtlocation qtserialport qtsvg qtquickcontrols2
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
     owner = "mavlink";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-EmGtVy/cHiZ2SqOOKmt9vCUQbyT5Sl8XnkRlhn9BdvA=";
+    sha256 = "sha256-nzBap5ldlLLLBB1ILkOktt9FnBqbo8MALLOETiqoAzk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/version-management/ghr/default.nix b/pkgs/applications/version-management/ghr/default.nix
index a2abe04fea9..7c786bb0b6b 100644
--- a/pkgs/applications/version-management/ghr/default.nix
+++ b/pkgs/applications/version-management/ghr/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "ghr";
-  version = "0.16.1";
+  version = "0.16.2";
 
   src = fetchFromGitHub {
     owner = "tcnksm";
     repo = "ghr";
     rev = "v${version}";
-    sha256 = "sha256-swu+hj8fL/xIC3KdhGQ2Ezdt7aj9L8sU/7q/AXM2i98=";
+    sha256 = "sha256-xClqqTVCEGghaf63kN40mwo49lkS8KC4k/36NYIngFI=";
   };
 
   vendorHash = "sha256-Wzzg66yJaHJUCfC2aH3Pk+B0d5l/+L7/bcNhQxo8ro0=";
diff --git a/pkgs/applications/version-management/tig/default.nix b/pkgs/applications/version-management/tig/default.nix
index 188a0b115fd..e4b54078edc 100644
--- a/pkgs/applications/version-management/tig/default.nix
+++ b/pkgs/applications/version-management/tig/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://jonas.github.io/tig/";
     description = "Text-mode interface for git";
-    maintainers = with maintainers; [ bjornfor domenkozar qknight globin ma27 srapenne ];
+    maintainers = with maintainers; [ bjornfor domenkozar qknight globin ma27 ];
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
   };
diff --git a/pkgs/applications/video/vokoscreen-ng/default.nix b/pkgs/applications/video/vokoscreen-ng/default.nix
index e601f0443c4..6f445da73d3 100644
--- a/pkgs/applications/video/vokoscreen-ng/default.nix
+++ b/pkgs/applications/video/vokoscreen-ng/default.nix
@@ -22,13 +22,13 @@
 
 mkDerivation rec {
   pname = "vokoscreen-ng";
-  version = "3.7.0";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "vkohaupt";
     repo = "vokoscreenNG";
     rev = version;
-    sha256 = "sha256-epz/KoXo84zzCD1dzclRWgeQSqrgwEtaIGvrTPuN9hw=";
+    sha256 = "sha256-4tQ/fLaAbjfc3mt2qJsW9scku/CGUs74SehDaZgLPj4=";
   };
 
   qmakeFlags = [ "src/vokoscreenNG.pro" ];
diff --git a/pkgs/applications/virtualization/podman/default.nix b/pkgs/applications/virtualization/podman/default.nix
index c1fdc2977a7..8841abcd367 100644
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@@ -62,13 +62,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "4.7.0";
+  version = "4.7.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-xbU2F/QYtTKeZacTmwKDfIGuUg9VStEO/jkpChK0DyU=";
+    hash = "sha256-o5FTCuFUbTlENqvh+u6fPEfD816tKWPxHu2yhBi/Mf0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index b058449ea22..e8667bc468a 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bruno";
-  version = "0.27.0";
+  version = "0.27.2";
 
   src = fetchurl {
     url = "https://github.com/usebruno/bruno/releases/download/v${version}/bruno_${version}_amd64_linux.deb";
-    hash = "sha256-57Cbp/+3rNq/bhUItPuN6ZIjSd8IzmJsn9FNm89khiE=";
+    hash = "sha256-FhlwwdX845Say6I/g9HYRTexh94DXhc/K9jmqFiHwVY=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook dpkg wrapGAppsHook ];
diff --git a/pkgs/by-name/go/go-camo/package.nix b/pkgs/by-name/go/go-camo/package.nix
index a7761f341c0..69dccb00318 100644
--- a/pkgs/by-name/go/go-camo/package.nix
+++ b/pkgs/by-name/go/go-camo/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-camo";
-  version = "2.4.4";
+  version = "2.4.5";
 
   src = fetchFromGitHub {
     owner = "cactus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-27kAVuFJaGKt7q9E2tchAD6kSukO4xkhU+1JTPfT3Qk=";
+    sha256 = "sha256-qELWl8kWQzgwQ8Mwp7MAxlYhHV6Us3kTuMjKVwJjZFs=";
   };
 
-  vendorHash = "sha256-LVQnQ8Tpkzpc6aUsUgwz2xTttccHynJPsQKvWGiRAIU=";
+  vendorHash = "sha256-PF7WqA3hdV+eFu++eoCo1m2m4o92vUtArH0uS+rjxGU=";
 
   ldflags = [ "-s" "-w" "-X=main.ServerVersion=${version}" ];
 
diff --git a/pkgs/data/fonts/fg-virgil/default.nix b/pkgs/data/fonts/fg-virgil/default.nix
new file mode 100644
index 00000000000..fdf83df42e0
--- /dev/null
+++ b/pkgs/data/fonts/fg-virgil/default.nix
@@ -0,0 +1,31 @@
+{ lib, stdenvNoCC, fetchFromGitHub }:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "fg-virgil";
+  version = "0.16.1";
+
+  src = fetchFromGitHub {
+    owner = "excalidraw";
+    repo = "excalidraw";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-iziCCHacaShPqb0f5nI8cCinFFs5fB3TcMJrifNhg4I=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m 444 public/Virgil.woff2 -t $out/share/fonts/woff2
+    install -D -m 444 public/FG_Virgil.woff2 -t $out/share/fonts/woff2
+    install -D -m 444 public/FG_Virgil.ttf -t $out/share/fonts/ttf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/excalidraw/virgil";
+    description = "The font that powers Excalidraw";
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ drupol ];
+    license = lib.licenses.ofl;
+  };
+})
diff --git a/pkgs/data/themes/flat-remix-gnome/default.nix b/pkgs/data/themes/flat-remix-gnome/default.nix
index 7a8444afbe3..61ddd00abd3 100644
--- a/pkgs/data/themes/flat-remix-gnome/default.nix
+++ b/pkgs/data/themes/flat-remix-gnome/default.nix
@@ -7,25 +7,25 @@
 let
   # make install will use dconf to find desktop background file uri.
   # consider adding an args to allow specify pictures manually.
-  # https://github.com/daniruiz/flat-remix-gnome/blob/20230606/Makefile#L38
+  # https://github.com/daniruiz/flat-remix-gnome/blob/20231026/Makefile#L38
   fake-dconf = writeScriptBin "dconf" "echo -n";
 in
 stdenv.mkDerivation rec {
   pname = "flat-remix-gnome";
-  version = "20230606";
+  version = "20231026";
 
   src = fetchFromGitHub {
     owner = "daniruiz";
     repo = pname;
     rev = version;
-    hash = "sha256-NnCRWADyAOR5yyOjB18zSQov+5FfKhhCSkDXBAL80wo=";
+    hash = "sha256-sKQOq0GMslkzND2ayL5M6XIxJv8t0yj6XCP3poA6wRc=";
   };
 
   nativeBuildInputs = [ glib fake-dconf ];
   makeFlags = [ "PREFIX=$(out)" ];
 
   # make install will back up this file, it will fail if the file doesn't exist.
-  # https://github.com/daniruiz/flat-remix-gnome/blob/20230606/Makefile#L56
+  # https://github.com/daniruiz/flat-remix-gnome/blob/20231026/Makefile#L56
   preInstall = ''
     mkdir -p $out/share/gnome-shell/
     touch $out/share/gnome-shell/gnome-shell-theme.gresource
diff --git a/pkgs/development/compilers/ballerina/default.nix b/pkgs/development/compilers/ballerina/default.nix
index 4eaa731ce27..29ca5463247 100644
--- a/pkgs/development/compilers/ballerina/default.nix
+++ b/pkgs/development/compilers/ballerina/default.nix
@@ -1,6 +1,6 @@
 { ballerina, lib, writeText, runCommand, makeWrapper, fetchzip, stdenv, openjdk }:
 let
-  version = "2201.8.1";
+  version = "2201.8.2";
   codeName = "swan-lake";
 in stdenv.mkDerivation {
   pname = "ballerina";
@@ -8,7 +8,7 @@ in stdenv.mkDerivation {
 
   src = fetchzip {
     url = "https://dist.ballerina.io/downloads/${version}/ballerina-${version}-${codeName}.zip";
-    hash = "sha256-tfsaZnZOsKVm56s3nNI/27wrbVg5fcJ8tW2THSQ8ec0=";
+    hash = "sha256-vTrVcWo7fjcj9oZqIzvVTTynf4dSh5D7PAUYj3Vs8Gg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/compilers/kotlin/default.nix b/pkgs/development/compilers/kotlin/default.nix
index 6fd5b880192..50b9d0fadee 100644
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kotlin";
-  version = "1.9.10";
+  version = "1.9.20";
 
   src = fetchurl {
     url = "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-compiler-${version}.zip";
-    sha256 = "0hh3qa4nical29wkm3byqvmd00xhx9gp7hslx8l0z3ngxqyqcx3x";
+    sha256 = "sha256-Faiiglt0zPbETgTpdnLbgC0t91zi+7Y+8FOb865QBvA=";
   };
 
   propagatedBuildInputs = [ jre ] ;
diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix
index 5fe8da17507..a09afadf527 100644
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@@ -103,9 +103,6 @@ builder rec {
     # See below.
     "--without-threads"
   ]
-  # Disable JIT on Apple Silicon, as it is not yet supported
-  # https://debbugs.gnu.org/cgi/bugreport.cgi?bug=44505";
-  ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) "--enable-jit=no"
   # At least on x86_64-darwin '-flto' autodetection is not correct:
   #  https://github.com/NixOS/nixpkgs/pull/160051#issuecomment-1046193028
   ++ lib.optional (stdenv.isDarwin) "--disable-lto";
diff --git a/pkgs/development/interpreters/rakudo/zef.nix b/pkgs/development/interpreters/rakudo/zef.nix
index 4b0d0388466..fc7e541ceff 100644
--- a/pkgs/development/interpreters/rakudo/zef.nix
+++ b/pkgs/development/interpreters/rakudo/zef.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zef";
-  version = "0.19.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "ugexe";
     repo = "zef";
     rev = "v${version}";
-    sha256 = "sha256-tA3BH8YlOHCcbYht2mnZr05vtUfeHn6LGB5Hrylbrpw=";
+    sha256 = "sha256-IWOgbKYaWKjC2+dc2P3THAVy23F3iQXh2D6od/0e0Jw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index f2238eb5fa8..86b1317c276 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "14.0.2";
+  version = "14.0.4";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-/YAu2wIeDhMojWfutJSEp7SELOV4G/EfQjypLQI+jo8=";
+    hash = "sha256-VojHQDp6Vnr466coGkrBrrDVYBqpb985nXiQNpKdJ5g=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
-  cargoHash = "sha256-4Ca3RlpJQ67zwje0SowqqEcBGLnht5QL/PCrrtFTc4o=";
+  cargoHash = "sha256-iNEtivaruSOKeD3NJ58TXSyvZSZE8A2GjKN63fKA55w=";
   cargoBuildFlags = [ "--package" "wasmtime-cli" "--package" "wasmtime-c-api" ];
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/eccodes/default.nix b/pkgs/development/libraries/eccodes/default.nix
index d8cbc6b1a7f..0258165d4ee 100644
--- a/pkgs/development/libraries/eccodes/default.nix
+++ b/pkgs/development/libraries/eccodes/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "eccodes";
-  version = "2.32.0";
+  version = "2.32.1";
 
   src = fetchurl {
     url = "https://confluence.ecmwf.int/download/attachments/45757960/eccodes-${version}-Source.tar.gz";
-    sha256 = "sha256-tX6O6w66DAXWb9pVJ8T/qEtas1xGvLyaIicUKXPMuOY=";
+    sha256 = "sha256-rSrBvzZXex01xKdxtNF0oG9SKh5e9sH15Tp5X7Ykhj4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/gsound/default.nix b/pkgs/development/libraries/gsound/default.nix
index 7dbe5cd2bbf..6c5c98b77d7 100644
--- a/pkgs/development/libraries/gsound/default.nix
+++ b/pkgs/development/libraries/gsound/default.nix
@@ -14,11 +14,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config meson ninja gobject-introspection libtool vala ];
   buildInputs = [ glib libcanberra ];
 
-  mesonFlags = [
-    "-Dintrospection=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
-    "-Denable_vala=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
-  ];
-
   passthru = {
     updateScript = gnome.updateScript {
       packageName = pname;
diff --git a/pkgs/development/libraries/kde-frameworks/networkmanager-qt.nix b/pkgs/development/libraries/kde-frameworks/networkmanager-qt.nix
index e9f812d68da..a9d4baebf1c 100644
--- a/pkgs/development/libraries/kde-frameworks/networkmanager-qt.nix
+++ b/pkgs/development/libraries/kde-frameworks/networkmanager-qt.nix
@@ -2,10 +2,25 @@
   mkDerivation, lib,
   extra-cmake-modules,
   networkmanager, qtbase,
+  fetchpatch
 }:
 
 mkDerivation {
   pname = "networkmanager-qt";
+
+  # backport patches for NetworkManager 1.44 compatibility
+  # FIXME: remove in 5.112
+  patches = [
+    (fetchpatch {
+      url = "https://invent.kde.org/frameworks/networkmanager-qt/-/commit/d9a938ddbfb5800503935926301ff2865ab77a6d.patch";
+      hash = "sha256-EjFBcU0YJQocp8skDZUTxCQhfrtQP5Fdo8q1BC9lLnQ=";
+    })
+    (fetchpatch {
+      url = "https://invent.kde.org/frameworks/networkmanager-qt/-/commit/d35c6cb97443424d228dfd8eee8282af6632b5f5.patch";
+      hash = "sha256-KmRcCjdHGGk+5PY5JKNbk0BHCtdwibns+Hw4aNRaoZI=";
+    })
+  ];
+
   nativeBuildInputs = [ extra-cmake-modules ];
   propagatedBuildInputs = [ networkmanager qtbase ];
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/level-zero/default.nix b/pkgs/development/libraries/level-zero/default.nix
index 0c953b8d871..f2ea91bf8be 100644
--- a/pkgs/development/libraries/level-zero/default.nix
+++ b/pkgs/development/libraries/level-zero/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "level-zero";
-  version = "1.14.0";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "level-zero";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7hFGY255dLgDo93+Nx2we/cfEtwaiaajdVg1VTst1/U=";
+    hash = "sha256-jf1sKFfUmeNbLtmawKISmLQK2/95XvSg40se9IEKMT0=";
   };
 
   nativeBuildInputs = [ cmake addOpenGLRunpath ];
diff --git a/pkgs/development/libraries/libdeltachat/default.nix b/pkgs/development/libraries/libdeltachat/default.nix
index 395764d955e..7a395a9866d 100644
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/deltachat/deltachat-core-rust/";
     changelog = "https://github.com/deltachat/deltachat-core-rust/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ dotlambda srapenne ];
+    maintainers = with maintainers; [ dotlambda ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/libraries/poco/default.nix b/pkgs/development/libraries/poco/default.nix
index 1459d605acb..b3037c463e5 100644
--- a/pkgs/development/libraries/poco/default.nix
+++ b/pkgs/development/libraries/poco/default.nix
@@ -3,12 +3,12 @@
 stdenv.mkDerivation rec {
   pname = "poco";
 
-  version = "1.12.4";
+  version = "1.12.5";
 
   src = fetchFromGitHub {
     owner = "pocoproject";
     repo = "poco";
-    sha256 = "sha256-gQ97fkoTGI6yuMPjEsITfapH9FSQieR8rcrPR1nExxc=";
+    sha256 = "sha256-2macXa2pi5FebSrTIfSQbIiafNCXczNQEP+PFbFxylw=";
     rev = "poco-${version}-release";
   };
 
diff --git a/pkgs/development/libraries/science/math/coin-utils/default.nix b/pkgs/development/libraries/science/math/coin-utils/default.nix
index 6cb7666e568..22aa10fc6d1 100644
--- a/pkgs/development/libraries/science/math/coin-utils/default.nix
+++ b/pkgs/development/libraries/science/math/coin-utils/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, pkg-config }:
 
 stdenv.mkDerivation rec {
-  version = "2.11.9";
+  version = "2.11.10";
   pname = "coinutils";
 
   src = fetchFromGitHub {
     owner = "coin-or";
     repo = "CoinUtils";
     rev = "releases/${version}";
-    hash = "sha256-DgHVbcXd36WW6JQbiq1MUHAiKLs8CTau87rs0T76sGs=";
+    hash = "sha256-Rbm45HRbRKQ6Cdup+gvKJ1xkK1HKG3irR5AIjhLer7g=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/libraries/science/math/osi/default.nix b/pkgs/development/libraries/science/math/osi/default.nix
index 8ee048c2819..a6bc5a08625 100644
--- a/pkgs/development/libraries/science/math/osi/default.nix
+++ b/pkgs/development/libraries/science/math/osi/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "osi";
-  version = "0.108.8";
+  version = "0.108.9";
 
   src = fetchFromGitHub {
     owner = "coin-or";
     repo = "Osi";
     rev = "releases/${version}";
-    hash = "sha256-Wyxeyn49QWzGvW6bMwCp39iLkB1eMQUEpIxUgpLcxgA=";
+    hash = "sha256-ueIa9CL4K5ygKpkMRvfuWR0emEG6omg65ZKCsConWsw=";
   };
 
   buildInputs =
diff --git a/pkgs/development/libraries/vulkan-utility-libraries/default.nix b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
index fe967ef1a2a..f82fad83627 100644
--- a/pkgs/development/libraries/vulkan-utility-libraries/default.nix
+++ b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.3.268.0";
+  version = "1.3.269";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
-    rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-O1agpzZpXiQZFYx1jPosIhxJovZtfZSLBNFj1LVB1VI=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-7BN+U97dqpSyCYhHuFTPqokRnABH7Gt91njZPxItpzg=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/libraries/wfa2-lib/default.nix b/pkgs/development/libraries/wfa2-lib/default.nix
index 1f97f9c95a6..1543484868b 100644
--- a/pkgs/development/libraries/wfa2-lib/default.nix
+++ b/pkgs/development/libraries/wfa2-lib/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wfa2-lib";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "smarco";
     repo = "WFA2-lib";
     rev = "v${version}";
-    hash = "sha256-PLZhxKMBhKm6E/ENFZ/yWMWIwJG5voaJls2in44OGoQ=";
+    hash = "sha256-h4e+f+JkQr3qqaBUDly24ZvKxaEGzeJtMXejh8aD5D0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/wxsqlite3/default.nix b/pkgs/development/libraries/wxsqlite3/default.nix
index 5dc9829b1a3..f058ac7ed0e 100644
--- a/pkgs/development/libraries/wxsqlite3/default.nix
+++ b/pkgs/development/libraries/wxsqlite3/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wxsqlite3";
-  version = "4.9.4";
+  version = "4.9.6";
 
   src = fetchFromGitHub {
     owner = "utelle";
     repo = "wxsqlite3";
     rev = "v${version}";
-    hash = "sha256-aM79DI/Kj1QEIJ1HMttlfqK/WZER9RJhQbrnbPto57U=";
+    hash = "sha256-ah9EFj15cP9soVJATVJk4XGYItxcrt4HB6ZTfpsVhS8=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/ocaml-modules/eio/default.nix b/pkgs/development/ocaml-modules/eio/default.nix
index 1f9e18e887e..005364039e0 100644
--- a/pkgs/development/ocaml-modules/eio/default.nix
+++ b/pkgs/development/ocaml-modules/eio/default.nix
@@ -1,4 +1,6 @@
 { lib
+, ocaml
+, version ? if lib.versionAtLeast ocaml.version "5.1" then "0.13" else "0.12"
 , buildDunePackage
 , bigstringaf
 , cstruct
@@ -16,16 +18,26 @@
 , mdx
 }:
 
+let
+  param = {
+    "0.12" = {
+      minimalOCamlVersion = "5.0";
+      hash = "sha256-2EhHzoX/t4ZBSWrSS+PGq1zCxohc7a1q4lfsrFnZJqA=";
+    };
+    "0.13" = {
+      minimalOCamlVersion = "5.1";
+      hash = "sha256-glN+4cWxgp/eggdhSk459WC9WCMyhBKQ7V73ZpHzr3A=";
+    };
+  }."${version}";
+in
 buildDunePackage rec {
   pname = "eio";
-  version = "0.12";
-
-  minimalOCamlVersion = "5.0";
-  duneVersion = "3";
+  inherit version;
+  inherit (param) minimalOCamlVersion;
 
   src = fetchurl {
     url = "https://github.com/ocaml-multicore/${pname}/releases/download/v${version}/${pname}-${version}.tbz";
-    sha256 = "2EhHzoX/t4ZBSWrSS+PGq1zCxohc7a1q4lfsrFnZJqA=";
+    inherit (param) hash;
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/eio/linux.nix b/pkgs/development/ocaml-modules/eio/linux.nix
index 62f9800790b..b376f709794 100644
--- a/pkgs/development/ocaml-modules/eio/linux.nix
+++ b/pkgs/development/ocaml-modules/eio/linux.nix
@@ -10,7 +10,6 @@ buildDunePackage {
   inherit (eio) meta src version;
 
   minimalOCamlVersion = "5.0";
-  duneVersion = "3";
 
   dontStrip = true;
 
diff --git a/pkgs/development/ocaml-modules/eio/main.nix b/pkgs/development/ocaml-modules/eio/main.nix
index def30f2a059..410e5355127 100644
--- a/pkgs/development/ocaml-modules/eio/main.nix
+++ b/pkgs/development/ocaml-modules/eio/main.nix
@@ -11,7 +11,6 @@ buildDunePackage {
   inherit (eio) meta src version;
 
   minimalOCamlVersion = "5.0";
-  duneVersion = "3";
 
   dontStrip = true;
 
diff --git a/pkgs/development/ocaml-modules/eio/posix.nix b/pkgs/development/ocaml-modules/eio/posix.nix
index 6c3042e65fa..e8dc4072bab 100644
--- a/pkgs/development/ocaml-modules/eio/posix.nix
+++ b/pkgs/development/ocaml-modules/eio/posix.nix
@@ -11,7 +11,6 @@ buildDunePackage {
   inherit (eio) meta src version;
 
   minimalOCamlVersion = "5.0";
-  duneVersion = "3";
 
   dontStrip = true;
 
diff --git a/pkgs/development/python-modules/aiojobs/default.nix b/pkgs/development/python-modules/aiojobs/default.nix
index 094e7509ee3..1061b4f777a 100644
--- a/pkgs/development/python-modules/aiojobs/default.nix
+++ b/pkgs/development/python-modules/aiojobs/default.nix
@@ -14,40 +14,50 @@ buildPythonPackage rec {
   version = "1.2.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "aio-libs";
-    repo = pname;
+    repo = "aiojobs";
     rev = "refs/tags/v${version}";
     hash = "sha256-/+PTHLrZyf2UuYkLWkNgzf9amFywDJnP2OKVWvARcAA=";
   };
 
   postPatch = ''
-    substituteInPlace setup.cfg \
-      --replace "--cov=aiojobs/ --cov=tests/" ""
+    substituteInPlace pytest.ini \
+      --replace "--cov=aiojobs/ --cov=tests/ --cov-report term" ""
   '';
 
   nativeBuildInputs = [
     setuptools
   ];
 
-  propagatedBuildInputs = [
-    aiohttp
+  propagatedBuildInputs = lib.optionals (pythonOlder "3.11") [
     async-timeout
   ];
 
-  __darwinAllowLocalNetworking = true;
+  passthru.optional-dependencies = {
+    aiohttp = [
+      aiohttp
+    ];
+  };
 
   nativeCheckInputs = [
     pytestCheckHook
     pytest-aiohttp
-  ];
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
 
   pythonImportsCheck = [
     "aiojobs"
   ];
 
+  disabledTests = [
+    # RuntimeWarning: coroutine 'Scheduler._wait_failed' was never awaited
+    "test_scheduler_must_be_created_within_running_loop"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "Jobs scheduler for managing background task (asyncio)";
     homepage = "https://github.com/aio-libs/aiojobs";
diff --git a/pkgs/development/python-modules/python-crontab/default.nix b/pkgs/development/python-modules/python-crontab/default.nix
index 99cf1c63ca8..a1fb349c9ee 100644
--- a/pkgs/development/python-modules/python-crontab/default.nix
+++ b/pkgs/development/python-modules/python-crontab/default.nix
@@ -4,12 +4,13 @@
 , python-dateutil
 , pytestCheckHook
 , pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "python-crontab";
   version = "3.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -18,6 +19,10 @@ buildPythonPackage rec {
     hash = "sha256-eft0ZQOd39T7k9By1u4NRcGsi/FZfwaG6hT9Q2Hbo3k=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     python-dateutil
   ];
@@ -30,6 +35,8 @@ buildPythonPackage rec {
     "test_07_non_posix_shell"
     # doctest that assumes /tmp is writeable, awkward to patch
     "test_03_usage"
+    # AssertionError: 4 != 0
+    "test_19_frequency_at_month"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/symengine/default.nix b/pkgs/development/python-modules/symengine/default.nix
index 38ceda09820..599b2e74566 100644
--- a/pkgs/development/python-modules/symengine/default.nix
+++ b/pkgs/development/python-modules/symengine/default.nix
@@ -1,6 +1,5 @@
 { lib
 , buildPythonPackage
-, fetchpatch
 , fetchFromGitHub
 , cython
 , cmake
@@ -22,14 +21,6 @@ buildPythonPackage rec {
     hash = "sha256-03lHip0iExfptrUe5ObA6xXrsfS4QJPrh1Z0v7q2lDI=";
   };
 
-  patches = [
-    (fetchpatch {
-      # setuptools 61 compat
-      url = "https://github.com/symengine/symengine.py/commit/987e665e71cf92d1b021d7d573a1b9733408eecf.patch";
-      hash = "sha256-2QbNdw/lKYRIRpOU5BiwF2kK+5Lh2j/Q82MKUIvl0+c=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace setup.py \
       --replace "\"cmake\"" "\"${cmake}/bin/cmake\"" \
diff --git a/pkgs/development/tools/analysis/codeql/default.nix b/pkgs/development/tools/analysis/codeql/default.nix
index 1a01d162406..c23c933e48e 100644
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.14.6";
+  version = "2.15.1";
 
   dontConfigure = true;
   dontBuild = true;
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-MmVH5rB6yg5w8RsrRkiV7bfCxHgp0jw27IOmUS3fcHA=";
+    hash = "sha256-ksWf5z0PM5osMxnR5XeEyZw4g7UbHUCqnpw2FB5M6kU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/benthos/default.nix b/pkgs/development/tools/benthos/default.nix
index 8dc8b26f43d..071bc11c50f 100644
--- a/pkgs/development/tools/benthos/default.nix
+++ b/pkgs/development/tools/benthos/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "benthos";
-  version = "4.19.0";
+  version = "4.22.0";
 
   src = fetchFromGitHub {
     owner = "benthosdev";
     repo = "benthos";
     rev = "refs/tags/v${version}";
-    hash = "sha256-C/dExBN+ZBE8o3L0RBgYe4griFhv/Yd2I10em2UK/nQ=";
+    hash = "sha256-RlwHaLW27Y6yRzlvFLpJhOkPa1dYoX87XxMKecoT/dE=";
   };
 
-  vendorHash = "sha256-33eY+jF12lYSO1Fqm1hRLKA1+aMNxe0c9gqNl2wf10I=";
+  vendorHash = "sha256-9h7AocnhfYecEQbvesuFwXm+cTSd5lS9kdWjjO0GZP4=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/database/vitess/default.nix b/pkgs/development/tools/database/vitess/default.nix
index da974074061..ad783780060 100644
--- a/pkgs/development/tools/database/vitess/default.nix
+++ b/pkgs/development/tools/database/vitess/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "vitess";
-  version = "17.0.2";
+  version = "17.0.3";
 
   src = fetchFromGitHub {
     owner = "vitessio";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-uST+FtYhGIn/Tieyofbh2r8xonw8qsS6ODrpd/A27r4=";
+    hash = "sha256-/nj//8mCP6ytsdJAj/rJ0/vDEyyvOyUWNaLELBe/yts=";
   };
 
   vendorHash = "sha256-0OrPbMG7ElOD+9/kWx1HtvGUBiFpIsNs5Vu7QofzE6Q=";
diff --git a/pkgs/development/tools/frugal/default.nix b/pkgs/development/tools/frugal/default.nix
index 4ce0ab17189..e1836b92051 100644
--- a/pkgs/development/tools/frugal/default.nix
+++ b/pkgs/development/tools/frugal/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "frugal";
-  version = "3.17.2";
+  version = "3.17.5";
 
   src = fetchFromGitHub {
     owner = "Workiva";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7+8wjWxePU3OrIf9SLYzu6jAaaeB3MUzZ/H6tdFn3ts=";
+    sha256 = "sha256-NkzlhxlQISqFmYeO7LttwMWhvL7YblrWREkvnKrpTuA=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-vES8WGaurEW5X9PX+ILN4XUGoSEtayq7UAes+1URKzg=";
+  vendorHash = "sha256-iZl5DWZYecXCirJumnidgEWrqfaz+fvM3udOWOC6Upk=";
 
   meta = with lib; {
     description = "Thrift improved";
diff --git a/pkgs/development/tools/kustomize/kustomize-sops.nix b/pkgs/development/tools/kustomize/kustomize-sops.nix
index 055077dd20f..d751e0f43fd 100644
--- a/pkgs/development/tools/kustomize/kustomize-sops.nix
+++ b/pkgs/development/tools/kustomize/kustomize-sops.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kustomize-sops";
-  version = "4.2.3";
+  version = "4.2.5";
 
   src = fetchFromGitHub {
     owner = "viaduct-ai";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-dtfs2hUC1Y0N5R/qYrW/bQ+w1X95rgNjo3e9FBKnkvg=";
+    hash = "sha256-zhu1fBqa6rNO2MoOFUE50I3dtAaOP4Dr9v2rTNB5oro=";
   };
 
-  vendorHash = "sha256-iBzW/IdG8NTlw22If6PwGsoikB2l3hIvTf7lLQa4s4c=";
+  vendorHash = "sha256-GuzBSFENkHTri1FF2Ar6paGId7Yj7HuWSEDirFZrqZM=";
 
   installPhase = ''
     mkdir -p $out/lib/viaduct.ai/v1/ksops-exec/
diff --git a/pkgs/development/tools/marksman/default.nix b/pkgs/development/tools/marksman/default.nix
index be5419d6c8c..45ef51945dc 100644
--- a/pkgs/development/tools/marksman/default.nix
+++ b/pkgs/development/tools/marksman/default.nix
@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "marksman";
-  version = "2023-07-25";
+  version = "2023-10-30";
 
   src = fetchFromGitHub {
     owner = "artempyanykh";
     repo = "marksman";
     rev = version;
-    sha256 = "sha256-DxubrZAj2MOF7gUMDl8rW1jGHaw70KGe5Nit1SBQBW8=";
+    sha256 = "sha256-dAyZIqc9YGuhGydT17s4D1q4CKH6uK5CYW0c0ZJwJAI=";
   };
 
   projectFile = "Marksman/Marksman.fsproj";
diff --git a/pkgs/development/tools/marksman/deps.nix b/pkgs/development/tools/marksman/deps.nix
index 300fa38e1be..b6e14d84e5a 100644
--- a/pkgs/development/tools/marksman/deps.nix
+++ b/pkgs/development/tools/marksman/deps.nix
@@ -10,7 +10,7 @@
   (fetchNuGet { pname = "FSharp.SystemCommandLine"; version = "0.13.0-beta4"; sha256 = "10h58gqfdg2hdy9laf6ry8djfysrdmwlj9n0d7ydwyszb6zgnd20"; })
   (fetchNuGet { pname = "FSharpPlus"; version = "1.2.4"; sha256 = "08yg36hgmglll053kkqkkadcfcrdd37qqwqwfwzyrmyqp1mw4mj2"; })
   (fetchNuGet { pname = "Glob"; version = "1.1.9"; sha256 = "1q72haq20bf414xwdabsx30lp5c55fjh7hav6r9sp2cqhmva0y53"; })
-  (fetchNuGet { pname = "Markdig"; version = "0.30.2"; sha256 = "0m4vjg3kzvknk376yfzazr6i6qkb833s63857a5xcym0l04chlha"; })
+  (fetchNuGet { pname = "Markdig"; version = "0.33.0"; sha256 = "1dj06wgdqmjji4nfr1dysz7hwp5bjgsrk9qjkdq82d7gk6nmhs9r"; })
   (fetchNuGet { pname = "MessagePack"; version = "2.3.85"; sha256 = "0n7kv4i6knhv1dd35cv45sfpidsiy9albfdmbrdschykd1mzxmiy"; })
   (fetchNuGet { pname = "MessagePack.Annotations"; version = "2.3.85"; sha256 = "0axjgy9r533bw00lflnc6acjyza76mf2x1nn6fw7qacvak9rqxm3"; })
   (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; sha256 = "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"; })
diff --git a/pkgs/games/hyperrogue/default.nix b/pkgs/games/hyperrogue/default.nix
index cd44b9904c4..cd24a44f92a 100644
--- a/pkgs/games/hyperrogue/default.nix
+++ b/pkgs/games/hyperrogue/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hyperrogue";
-  version = "12.1q";
+  version = "12.1x";
 
   src = fetchFromGitHub {
     owner = "zenorogue";
     repo = "hyperrogue";
     rev = "v${version}";
-    sha256 = "sha256-dYkeAQBpnETbJiXZSejFPJVhXt3kJBBv6qBKPb7t9fU=";
+    sha256 = "sha256-MzeTNjGFL8l+8afndjpMqbEKD872ic+AqnpgY2VAPRA=";
   };
 
   CXXFLAGS = [
diff --git a/pkgs/misc/screensavers/xlockmore/default.nix b/pkgs/misc/screensavers/xlockmore/default.nix
index 3b771ffedc2..a2bf191dd36 100644
--- a/pkgs/misc/screensavers/xlockmore/default.nix
+++ b/pkgs/misc/screensavers/xlockmore/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xlockmore";
-  version = "5.72";
+  version = "5.73";
 
   src = fetchurl {
     url = "http://sillycycle.com/xlock/xlockmore-${version}.tar.xz";
-    sha256 = "sha256-1RGXWWeuc1UHKs3M9rG/QU+KFr5QzMgHDxPmJGI+x3I=";
+    sha256 = "sha256-MOH85e5L/r99fXRq9Gf5awvIUh/NC1C4Vh/VtW3rh10=";
     curlOpts = "--user-agent 'Mozilla/5.0'";
   };
 
diff --git a/pkgs/servers/monitoring/vmagent/default.nix b/pkgs/servers/monitoring/vmagent/default.nix
index b62f9f7e8cf..7ccd36981a4 100644
--- a/pkgs/servers/monitoring/vmagent/default.nix
+++ b/pkgs/servers/monitoring/vmagent/default.nix
@@ -1,13 +1,13 @@
 { lib, fetchFromGitHub, buildGoModule }:
 buildGoModule rec {
   pname = "vmagent";
-  version = "1.93.5";
+  version = "1.93.6";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     rev = "v${version}";
-    sha256 = "sha256-AC3tQAgGHKl86MakfSWnFMX1Lr5r7RwZfomXtp5/oBs=";
+    sha256 = "sha256-5z8o6I2AoX43t4UeOjxha9fkEDxVDRhdGNgVZGlHrRE=";
   };
 
   ldflags = [ "-s" "-w" "-X github.com/VictoriaMetrics/VictoriaMetrics/lib/buildinfo.Version=${version}" ];
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index 552c51c4ce0..fb70c7747e4 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.18.10";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-fbzoUmxWwQYEGrUIXtHP6Lz71C51TR30gz+5deB00LM=";
+    hash = "sha256-5VvjEFiZ7jnjqdagWeP2xrwDKtU9S6rQmsaupDFiK+c=";
   };
 
-  vendorHash = "sha256-b0i+I/HzHbpmgclYn2g6MtpbslT/sLm9K2woMjvWaD0=";
+  vendorHash = "sha256-RGpB8f/1+eWZIAqb4OFUFlxhYRRm1WOh2edHp8KuGF4=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/servers/search/weaviate/default.nix b/pkgs/servers/search/weaviate/default.nix
index d195d6511a4..f63805cd36e 100644
--- a/pkgs/servers/search/weaviate/default.nix
+++ b/pkgs/servers/search/weaviate/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "weaviate";
-  version = "1.21.1";
+  version = "1.21.7";
 
   src = fetchFromGitHub {
     owner = "weaviate";
     repo = "weaviate";
     rev = "v${version}";
-    hash = "sha256-rWoVuWzfRJhhYDwOBcmSIJXh0WwvZFYM2GPOMvP98xM=";
+    hash = "sha256-fhBjKmWtbivntgBFmxfG4bQNUvCdP5uWtysOvsSqFuw=";
   };
 
-  vendorHash = "sha256-HUfkwmAIwTPDZsgRLte7tu/0QKT82WriTqJ14iiKKOs=";
+  vendorHash = "sha256-/ylYXwgJKtkAIvYgSsl8MzBxuxp0Nco3ZR4ZBdmmS+w=";
 
   subPackages = [ "cmd/weaviate-server" ];
 
diff --git a/pkgs/servers/sql/mssql/jdbc/default.nix b/pkgs/servers/sql/mssql/jdbc/default.nix
index efa3089e47c..a4a6e869f9a 100644
--- a/pkgs/servers/sql/mssql/jdbc/default.nix
+++ b/pkgs/servers/sql/mssql/jdbc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mssql-jdbc";
-  version = "12.4.1";
+  version = "12.4.2";
 
   src = fetchurl {
     url = "https://github.com/Microsoft/mssql-jdbc/releases/download/v${version}/mssql-jdbc-${version}.jre8.jar";
-    sha256 = "sha256-Ci59MLU50Dl+rmUstX7c/BdAJJ/GCCYLqcyrxGr2g7E=";
+    sha256 = "sha256-JGt6SXg4Ok+czMwGpDk9xdVw/WSkNLeBxqghcM3WmRE=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 35335e5e587..b07a715f673 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub, makeWrapper, iptables, iproute2, procps, shadow, getent }:
 
 let
-  version = "1.52.0";
+  version = "1.52.1";
 in
 buildGoModule {
   pname = "tailscale";
@@ -11,7 +11,7 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-mvsDM1kOLP/1LbTzmojquEF8HGy6Kb2cqJu7EnxEHPU=";
+    hash = "sha256-hscKV4jhJ+tqgTFuOEThABpu8iqK3+av7+DcuSmZwQ4=";
   };
   vendorHash = "sha256-WGZkpffwe4I8FewdBHXGaLbKQP/kHr7UF2lCXBTcNb4=";
 
diff --git a/pkgs/servers/web-apps/wallabag/default.nix b/pkgs/servers/web-apps/wallabag/default.nix
index 251735e0f78..87bde25166c 100644
--- a/pkgs/servers/web-apps/wallabag/default.nix
+++ b/pkgs/servers/web-apps/wallabag/default.nix
@@ -15,7 +15,7 @@
 
 let
   pname = "wallabag";
-  version = "2.6.6";
+  version = "2.6.7";
 in
 stdenv.mkDerivation {
   inherit pname version;
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   # Release tarball includes vendored files
   src = fetchurl {
     url = "https://github.com/wallabag/wallabag/releases/download/${version}/wallabag-${version}.tar.gz";
-    hash = "sha256-0CkJFSHPnOz333+7uMUqXI3A9dsA9FchZXXmwq7F09o=";
+    hash = "sha256-prk/sF72v5qyBv1Lz/2nY6LPM+on5/gwAMM1u9+X8xA=";
   };
 
   patches = [
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index bd816f9a899..1fa5b9c6151 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -298,7 +298,7 @@ let
       homepage = "https://fishshell.com/";
       license = licenses.gpl2;
       platforms = platforms.unix;
-      maintainers = with maintainers; [ cole-h winter srapenne ];
+      maintainers = with maintainers; [ cole-h winter ];
       mainProgram = "fish";
     };
 
diff --git a/pkgs/tools/admin/aws-mfa/default.nix b/pkgs/tools/admin/aws-mfa/default.nix
index 666161f1d36..53b3a8d4a47 100644
--- a/pkgs/tools/admin/aws-mfa/default.nix
+++ b/pkgs/tools/admin/aws-mfa/default.nix
@@ -41,6 +41,6 @@ buildPythonApplication rec {
     description = "Manage AWS MFA Security Credentials";
     homepage = "https://github.com/broamski/aws-mfa";
     license = licenses.mit;
-    maintainers = [ maintainers.srapenne ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/tools/admin/kics/default.nix b/pkgs/tools/admin/kics/default.nix
index 205a8f42b99..0cb8be3e4da 100644
--- a/pkgs/tools/admin/kics/default.nix
+++ b/pkgs/tools/admin/kics/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "kics";
-  version = "1.7.8";
+  version = "1.7.10";
 
   src = fetchFromGitHub {
     owner = "Checkmarx";
     repo = "kics";
     rev = "v${version}";
-    hash = "sha256-T4b4PO4NcpsosiyRa/78WJ4yYvc1Ez7t7KIbZzSlQAo=";
+    hash = "sha256-3guudT+PidrgHcJ6/lA/XWHmZXdvjGOhtpoO+9hkYOY=";
   };
 
   vendorHash = "sha256-gJu3B30IPp8A/xgtE5fzThQAtnFbbzr8ZwucAsObBxs=";
diff --git a/pkgs/tools/compression/upx/default.nix b/pkgs/tools/compression/upx/default.nix
index 4c808acd003..09aab8258a8 100644
--- a/pkgs/tools/compression/upx/default.nix
+++ b/pkgs/tools/compression/upx/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "upx";
-  version = "4.1.0";
+  version = "4.2.0";
   src = fetchFromGitHub {
     owner = "upx";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-pHJypO+sK7+ytM7yJxJpfBJHTYpGc9nr/JiFGd7hlJM=";
+    sha256 = "sha256-PRfIJSjmeXjbslqWnKrHUPdOJfZU08nr4wXoAnP9qm0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/filesystems/wipefreespace/default.nix b/pkgs/tools/filesystems/wipefreespace/default.nix
index 03adc070c0e..f9d586d91d6 100644
--- a/pkgs/tools/filesystems/wipefreespace/default.nix
+++ b/pkgs/tools/filesystems/wipefreespace/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "wipefreespace";
-  version = "2.5";
+  version = "2.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/wipefreespace/wipefreespace/${version}/wipefreespace-${version}.tar.gz";
-    hash = "sha256-wymV6G4Et5TCoIztZfdb3xuzjdBHFyB5OmI4EcsJKwQ=";
+    hash = "sha256-Pt6MDQ9wSJbL4tW/qckTpFsvE9FdXIkp/QmnYSlWR/M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/graphics/fim/default.nix b/pkgs/tools/graphics/fim/default.nix
index 6722e1d7819..0f2e11ba59b 100644
--- a/pkgs/tools/graphics/fim/default.nix
+++ b/pkgs/tools/graphics/fim/default.nix
@@ -11,11 +11,11 @@
 
 gcc9Stdenv.mkDerivation rec {
   pname = "fim";
-  version = "0.6";
+  version = "0.7";
 
   src = fetchurl {
     url = "mirror://savannah/fbi-improved/${pname}-${version}-trunk.tar.gz";
-    sha256 = "124b7c4flx5ygmy5sqq0gpvxqzafnknbcj6f45ddnbdxik9lazzp";
+    sha256 = "sha256-/p7bjeZM46DJOQ9sgtebhkNpBPj2RJYY3dMXhzHnNmg=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/graphics/pngquant/default.nix b/pkgs/tools/graphics/pngquant/default.nix
index 9a33e4282b2..73fa81ad602 100644
--- a/pkgs/tools/graphics/pngquant/default.nix
+++ b/pkgs/tools/graphics/pngquant/default.nix
@@ -28,6 +28,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     license = with licenses; [ gpl3Plus hpnd bsd2 ];
     mainProgram = "pngquant";
-    maintainers = [ maintainers.srapenne ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/tools/misc/birdfont/default.nix b/pkgs/tools/misc/birdfont/default.nix
index 69b5c53bd28..aa8e9ac6a9e 100644
--- a/pkgs/tools/misc/birdfont/default.nix
+++ b/pkgs/tools/misc/birdfont/default.nix
@@ -4,11 +4,11 @@ gobject-introspection, gsettings-desktop-schemas, wrapGAppsHook, autoPatchelfHoo
 
 stdenv.mkDerivation rec {
   pname = "birdfont";
-  version = "2.33.1";
+  version = "2.33.3";
 
   src = fetchurl {
     url = "https://birdfont.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-vFXpZNvsXpz7saRp6ruhvsP50rmJ2Prr2M78+8oxQ9M=";
+    sha256 = "sha256-NNw7203BtHhNyyQezb3/EP98cTsu7ABDFBnM5Ms2ePY=";
   };
 
   nativeBuildInputs = [ python3 pkg-config vala gobject-introspection wrapGAppsHook autoPatchelfHook ];
diff --git a/pkgs/tools/misc/birdfont/xmlbird.nix b/pkgs/tools/misc/birdfont/xmlbird.nix
index cacebb93995..10aec383435 100644
--- a/pkgs/tools/misc/birdfont/xmlbird.nix
+++ b/pkgs/tools/misc/birdfont/xmlbird.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xmlbird";
-  version = "1.2.12";
+  version = "1.2.14";
 
   src = fetchurl {
     url = "https://birdfont.org/${pname}-releases/lib${pname}-${version}.tar.xz";
-    sha256 = "15z4rvii3p54g2hasibjnf83c1702d84367fnl8pbisjqqrdcl04";
+    sha256 = "sha256-qygvJC1glSfvwWL7oQPFykgitvnWXwHMhycSjSBGksU=";
   };
 
   nativeBuildInputs = [ python3 pkg-config vala gobject-introspection ];
diff --git a/pkgs/tools/misc/jfrog-cli/default.nix b/pkgs/tools/misc/jfrog-cli/default.nix
index 1a5af43935d..a717e9f54da 100644
--- a/pkgs/tools/misc/jfrog-cli/default.nix
+++ b/pkgs/tools/misc/jfrog-cli/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "jfrog-cli";
-  version = "2.50.0";
+  version = "2.50.4";
 
   src = fetchFromGitHub {
     owner = "jfrog";
     repo = "jfrog-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZQsc1Far3x4WySbSU5wZXN6acirgVu467BGyjbcT5Ks=";
+    hash = "sha256-q4l0C99CEY3CEw2eXEnz+29z4JGSgqhVKFoaQ7azsZQ=";
   };
 
-  vendorHash = "sha256-KCFLM8qElbPbmLBCzyThUiqv/BLXsG3eauCBjahMMYk=";
+  vendorHash = "sha256-7+kmKqMDrGw/lnOL+JS4MRguQNlLaOb47ptX33BEWkM=";
 
   postInstall = ''
     # Name the output the same way as the original build script does
diff --git a/pkgs/tools/misc/rlwrap/default.nix b/pkgs/tools/misc/rlwrap/default.nix
index 34465b4e251..ec0f90a5c46 100644
--- a/pkgs/tools/misc/rlwrap/default.nix
+++ b/pkgs/tools/misc/rlwrap/default.nix
@@ -25,6 +25,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/hanslub42/rlwrap";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ srapenne jlesquembre ];
+    maintainers = with maintainers; [ jlesquembre ];
   };
 }
diff --git a/pkgs/tools/misc/tmux/default.nix b/pkgs/tools/misc/tmux/default.nix
index 34707ce834d..3cf6172891b 100644
--- a/pkgs/tools/misc/tmux/default.nix
+++ b/pkgs/tools/misc/tmux/default.nix
@@ -103,6 +103,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
     mainProgram = "tmux";
-    maintainers = with lib.maintainers; [ thammers fpletz srapenne ];
+    maintainers = with lib.maintainers; [ thammers fpletz ];
   };
 })
diff --git a/pkgs/tools/misc/vttest/default.nix b/pkgs/tools/misc/vttest/default.nix
index 96915f5c9fd..6b649cbb71d 100644
--- a/pkgs/tools/misc/vttest/default.nix
+++ b/pkgs/tools/misc/vttest/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vttest";
-  version = "20230201";
+  version = "20230924";
 
   src = fetchurl {
     urls = [
       "https://invisible-mirror.net/archives/${pname}/${pname}-${version}.tgz"
       "ftp://ftp.invisible-island.net/${pname}/${pname}-${version}.tgz"
     ];
-    sha256 = "sha256-J/QwB5Hny8+dFfiEIfmONdOu5mMRNoQwYk4sGlqL5oM=";
+    sha256 = "sha256-vosHy1kJdtH0KvhZfdrayAjQiwomi7YwSoh9qz8Toig=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/bacnet-stack/default.nix b/pkgs/tools/networking/bacnet-stack/default.nix
index 9e47993df60..6a514939aac 100644
--- a/pkgs/tools/networking/bacnet-stack/default.nix
+++ b/pkgs/tools/networking/bacnet-stack/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bacnet-stack";
-  version = "1.0.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "bacnet-stack";
     repo = "bacnet-stack";
     rev = "bacnet-stack-${version}";
-    sha256 = "078p7qsy9v6fl7pzwgcr72pgjqxfxmfxyqajih2zqlb5g5sf88vh";
+    sha256 = "sha256-Uq55zrcP8jBKklmT2AZfL8gkplm/wwSDAh/yXd1jydc=";
   };
 
   hardeningDisable = [ "all" ];
diff --git a/pkgs/tools/networking/bwm-ng/default.nix b/pkgs/tools/networking/bwm-ng/default.nix
index 397fb30490a..cfe0d4176a6 100644
--- a/pkgs/tools/networking/bwm-ng/default.nix
+++ b/pkgs/tools/networking/bwm-ng/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     homepage = "http://www.gropp.org/?id=projects&sub=bwm-ng";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ srapenne ];
+    maintainers = with maintainers; [ ];
     longDescription = ''
       bwm-ng supports:
        - /proc/net/dev, netstat, getifaddr, sysctl, kstat, /proc/diskstats /proc/partitions, IOKit,
diff --git a/pkgs/tools/networking/zrok/default.nix b/pkgs/tools/networking/zrok/default.nix
index 49a495493d8..7420942a1c7 100644
--- a/pkgs/tools/networking/zrok/default.nix
+++ b/pkgs/tools/networking/zrok/default.nix
@@ -11,14 +11,14 @@ let
   }.${system} or throwSystem;
 
   sha256 = {
-    x86_64-linux = "sha256-w3BF5Zu68e7X6vfkJhUTS6wkg7LSFZunx9dnBA2Ao5c=";
-    aarch64-linux = "sha256-hJiXDydUF750mTsFIXH6X8AjzjaG2Iaa+TzsCCCVAvs=";
-    armv7l-linux = "sha256-lEPo6Y+cqlG2QflwJdG/MNqFLMPdwQLI0+TC/VVlGV4=";
+    x86_64-linux = "sha256-c/MLhCmfoC5qbIH8psHqVexjKGb6P9vxMag7igFKt84=";
+    aarch64-linux = "sha256-CaZr0Izhwkdb6Hf3wRdOskoDg3m9LNgCPgfxka+ZwWo=";
+    armv7l-linux = "sha256-YVqm2tfcti5a6adN9Rn8X41nTTT5bajSJ0qIEvgk/8s=";
   }.${system} or throwSystem;
 in
 stdenv.mkDerivation rec {
   pname = "zrok";
-  version = "0.4.6";
+  version = "0.4.10";
 
   src = fetchzip {
     url = "https://github.com/openziti/zrok/releases/download/v${version}/zrok_${version}_${plat}.tar.gz";
diff --git a/pkgs/tools/package-management/libdnf/default.nix b/pkgs/tools/package-management/libdnf/default.nix
index 1a2d1521f0f..739210ce924 100644
--- a/pkgs/tools/package-management/libdnf/default.nix
+++ b/pkgs/tools/package-management/libdnf/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdnf";
-  version = "0.71.0";
+  version = "0.72.0";
 
   src = fetchFromGitHub {
     owner = "rpm-software-management";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-kRpB80ntb5CbqnWpc3M3i7w06CkstPlJfo2X3WsuME8=";
+    hash = "sha256-Ou7cXJz4g8cx2KjeX+IFRA2m158PGKcb9jCXFuAOKqU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/package-management/opkg/default.nix b/pkgs/tools/package-management/opkg/default.nix
index 49e044323cc..6a85e4bb9e8 100644
--- a/pkgs/tools/package-management/opkg/default.nix
+++ b/pkgs/tools/package-management/opkg/default.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "opkg";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchurl {
     url = "https://downloads.yoctoproject.org/releases/opkg/opkg-${version}.tar.gz";
-    hash = "sha256-6H/MtXXGTTrAVZREAWonlfEhJZhqDaiWurl8ShovGyo=";
+    hash = "sha256-rHOpCiVJzQSUjlY9kVkSx44bi6D0OvdcWlP8ykdK29U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/aespipe/default.nix b/pkgs/tools/security/aespipe/default.nix
index ad4cf36fa32..9ab8e089f30 100644
--- a/pkgs/tools/security/aespipe/default.nix
+++ b/pkgs/tools/security/aespipe/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "aespipe";
-  version = "2.4f";
+  version = "2.4g";
 
   src = fetchurl {
     url = "mirror://sourceforge/loop-aes/aespipe/aespipe-v${version}.tar.bz2";
-    sha256 = "15pg9j27mjzl78mpzkdqd84kdafj0g6j72f8wgjrpp2qkxjy2ddi";
+    sha256 = "sha256-v7l+feFh6NfOETsWO9odGo7HfSwa+rVtzIFT16kBh/w=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/crowdsec/default.nix b/pkgs/tools/security/crowdsec/default.nix
index 9c3dceda96f..ed97dd98c03 100644
--- a/pkgs/tools/security/crowdsec/default.nix
+++ b/pkgs/tools/security/crowdsec/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "crowdsec";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "crowdsecurity";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-5VwsuPNoAhCvhKUJDUkXnEVLMqHx2M1Nz11VoBASoxU=";
+    hash = "sha256-dE2PeYyC75y9dc84QdhQ6xaLMPdPWtPDse2sY5bFGwU=";
   };
 
-  vendorHash = "sha256-6ODcb7UQPgM5n5RPN4AdkrY3+vlu+GXlUfrlTePywyY=";
+  vendorHash = "sha256-hvandF9LPh1g4zIgmNIyId2YhqHU4RPKHGCtJI9aoPk=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/gotrue/supabase.nix b/pkgs/tools/security/gotrue/supabase.nix
index 6955f08a226..36ce6d72ceb 100644
--- a/pkgs/tools/security/gotrue/supabase.nix
+++ b/pkgs/tools/security/gotrue/supabase.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gotrue";
-  version = "2.99.0";
+  version = "2.105.0";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-OUxiAEPX1mWL4td3xdiK9420i4K9pwNdGqch/5T21BY=";
+    hash = "sha256-6tFXuVBd7UptoVMSse1Pk9ok6XyGL994pfFkFTyc5I0=";
   };
 
-  vendorHash = "sha256-r1xJka1ISahaHJOkFwjn/Nrf2EU0iGVosz8PZnH31TE=";
+  vendorHash = "sha256-cwTwze8WuhL5exaY5HJYDgcxNB9O1QuFpJgZmj6R838=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/security/yubihsm-shell/default.nix b/pkgs/tools/security/yubihsm-shell/default.nix
index 650224dd03b..37ac2ec1ae4 100644
--- a/pkgs/tools/security/yubihsm-shell/default.nix
+++ b/pkgs/tools/security/yubihsm-shell/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "yubihsm-shell";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "Yubico";
     repo = "yubihsm-shell";
     rev = version;
-    hash = "sha256-zWhvECPdZnrbSAVPDVZk54SWHVkd/HEQxS3FgXoqXHY=";
+    hash = "sha256-Ucqi+ZAoTkmj/UfdoisNxzDIyjW8j9gf/NR0WZCO4wo=";
   };
 
   postPatch = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2d8aff9d157..3fe321c41db 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -29306,6 +29306,8 @@ with pkgs;
 
   ferrum = callPackage ../data/fonts/ferrum { };
 
+  fg-virgil = callPackage ../data/fonts/fg-virgil { };
+
   fixedsys-excelsior = callPackage ../data/fonts/fixedsys-excelsior { };
 
   graphs = callPackage ../data/misc/graphs { };
@@ -35690,7 +35692,9 @@ with pkgs;
 
   taizen = callPackage ../applications/misc/taizen { };
 
-  talosctl = callPackage ../applications/networking/cluster/talosctl { };
+  talosctl = callPackage ../applications/networking/cluster/talosctl {
+    buildGoModule = buildGo120Module;
+  };
 
   talentedhack = callPackage ../applications/audio/talentedhack { };
 
@@ -39479,9 +39483,7 @@ with pkgs;
 
   alt-ergo = callPackage ../applications/science/logic/alt-ergo { };
 
-  aspino = callPackage ../applications/science/logic/aspino {
-    stdenv = gcc10StdenvCompat;
-  };
+  aspino = callPackage ../applications/science/logic/aspino { };
 
   beluga = callPackage ../applications/science/logic/beluga { };