Merge master into staging-next

95 files changed, 1947 insertions, 1086 deletions

diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 70150717838..19d4496eef5 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -285,11 +285,11 @@ specifying an interpreter version), like this:
 
 ```nix
 { lib
-, python3
+, python3Packages
 , fetchPypi
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "luigi";
   version = "2.7.9";
   pyproject = true;
@@ -300,13 +300,13 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   nativeBuildInputs = [
-    python3.pkgs.setuptools
-    python3.pkgs.wheel
+    python3Packages.setuptools
+    python3Packages.wheel
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
-    tornado
-    python-daemon
+  propagatedBuildInputs = [
+    python3Packages.tornado
+    python3Packages.python-daemon
   ];
 
   meta = with lib; {
diff --git a/lib/fileset/README.md b/lib/fileset/README.md
index 16ab58e2f26..8518d88a7d6 100644
--- a/lib/fileset/README.md
+++ b/lib/fileset/README.md
@@ -244,5 +244,4 @@ Here's a list of places in the library that need to be updated in the future:
 - > The file set library is currently somewhat limited but is being expanded to include more functions over time.
 
   in [the manual](../../doc/functions/fileset.section.md)
-- If/Once a function to convert `lib.sources` values into file sets exists, the `_coerce` and `toSource` functions should be updated to mention that function in the error when such a value is passed
 - If/Once a function exists that can optionally include a path depending on whether it exists, the error message for the path not existing in `_coerce` should mention the new function
diff --git a/lib/fileset/default.nix b/lib/fileset/default.nix
index fe7b304ba69..372d445269f 100644
--- a/lib/fileset/default.nix
+++ b/lib/fileset/default.nix
@@ -3,8 +3,10 @@ let
 
   inherit (import ./internal.nix { inherit lib; })
     _coerce
+    _singleton
     _coerceMany
     _toSourceFilter
+    _fromSourceFilter
     _unionMany
     _fileFilter
     _printFileset
@@ -152,7 +154,12 @@ in {
       sourceFilter = _toSourceFilter fileset;
     in
     if ! isPath root then
-      if isStringLike root then
+      if root ? _isLibCleanSourceWith then
+        throw ''
+          lib.fileset.toSource: `root` is a `lib.sources`-based value, but it should be a path instead.
+              To use a `lib.sources`-based value, convert it to a file set using `lib.fileset.fromSource` and pass it as `fileset`.
+              Note that this only works for sources created from paths.''
+      else if isStringLike root then
         throw ''
           lib.fileset.toSource: `root` (${toString root}) is a string-like value, but it should be a path instead.
               Paths in strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.''
@@ -189,6 +196,75 @@ in {
       };
 
   /*
+  Create a file set with the same files as a `lib.sources`-based value.
+  This does not import any of the files into the store.
+
+  This can be used to gradually migrate from `lib.sources`-based filtering to `lib.fileset`.
+
+  A file set can be turned back into a source using [`toSource`](#function-library-lib.fileset.toSource).
+
+  :::{.note}
+  File sets cannot represent empty directories.
+  Turning the result of this function back into a source using `toSource` will therefore not preserve empty directories.
+  :::
+
+  Type:
+    fromSource :: SourceLike -> FileSet
+
+  Example:
+    # There's no cleanSource-like function for file sets yet,
+    # but we can just convert cleanSource to a file set and use it that way
+    toSource {
+      root = ./.;
+      fileset = fromSource (lib.sources.cleanSource ./.);
+    }
+
+    # Keeping a previous sourceByRegex (which could be migrated to `lib.fileset.unions`),
+    # but removing a subdirectory using file set functions
+    difference
+      (fromSource (lib.sources.sourceByRegex ./. [
+        "^README\.md$"
+        # This regex includes everything in ./doc
+        "^doc(/.*)?$"
+      ])
+      ./doc/generated
+
+    # Use cleanSource, but limit it to only include ./Makefile and files under ./src
+    intersection
+      (fromSource (lib.sources.cleanSource ./.))
+      (unions [
+        ./Makefile
+        ./src
+      ]);
+  */
+  fromSource = source:
+    let
+      # This function uses `._isLibCleanSourceWith`, `.origSrc` and `.filter`,
+      # which are technically internal to lib.sources,
+      # but we'll allow this since both libraries are in the same code base
+      # and this function is a bridge between them.
+      isFiltered = source ? _isLibCleanSourceWith;
+      path = if isFiltered then source.origSrc else source;
+    in
+    # We can only support sources created from paths
+    if ! isPath path then
+      if isStringLike path then
+        throw ''
+          lib.fileset.fromSource: The source origin of the argument is a string-like value ("${toString path}"), but it should be a path instead.
+              Sources created from paths in strings cannot be turned into file sets, use `lib.sources` or derivations instead.''
+      else
+        throw ''
+          lib.fileset.fromSource: The source origin of the argument is of type ${typeOf path}, but it should be a path instead.''
+    else if ! pathExists path then
+      throw ''
+        lib.fileset.fromSource: The source origin (${toString path}) of the argument does not exist.''
+    else if isFiltered then
+      _fromSourceFilter path source.filter
+    else
+      # If there's no filter, no need to run the expensive conversion, all subpaths will be included
+      _singleton path;
+
+  /*
     The file set containing all files that are in either of two given file sets.
     This is the same as [`unions`](#function-library-lib.fileset.unions),
     but takes just two file sets instead of a list.
diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index d55c84a395e..717253f4571 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -167,7 +167,12 @@ rec {
       else
         value
     else if ! isPath value then
-      if isStringLike value then
+      if value ? _isLibCleanSourceWith then
+        throw ''
+          ${context} is a `lib.sources`-based value, but it should be a file set or a path instead.
+              To convert a `lib.sources`-based value to a file set you can use `lib.fileset.fromSource`.
+              Note that this only works for sources created from paths.''
+      else if isStringLike value then
         throw ''
           ${context} ("${toString value}") is a string-like value, but it should be a file set or a path instead.
               Paths represented as strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.''
@@ -470,6 +475,59 @@ rec {
     else
       nonEmpty;
 
+  # Turn a builtins.filterSource-based source filter on a root path into a file set
+  # containing only files included by the filter.
+  # The filter is lazily called as necessary to determine whether paths are included
+  # Type: Path -> (String -> String -> Bool) -> fileset
+  _fromSourceFilter = root: sourceFilter:
+    let
+      # During the recursion we need to track both:
+      # - The path value such that we can safely call `readDir` on it
+      # - The path string value such that we can correctly call the `filter` with it
+      #
+      # While we could just recurse with the path value,
+      # this would then require converting it to a path string for every path,
+      # which is a fairly expensive operation
+
+      # Create a file set from a directory entry
+      fromDirEntry = path: pathString: type:
+        # The filter needs to run on the path as a string
+        if ! sourceFilter pathString type then
+          null
+        else if type == "directory" then
+          fromDir path pathString
+        else
+          type;
+
+      # Create a file set from a directory
+      fromDir = path: pathString:
+        mapAttrs
+          # This looks a bit funny, but we need both the path-based and the path string-based values
+          (name: fromDirEntry (path + "/${name}") (pathString + "/${name}"))
+          # We need to readDir on the path value, because reading on a path string
+          # would be unspecified if there are multiple filesystem roots
+          (readDir path);
+
+      rootPathType = pathType root;
+
+      # We need to convert the path to a string to imitate what builtins.path calls the filter function with.
+      # We don't want to rely on `toString` for this though because it's not very well defined, see ../path/README.md
+      # So instead we use `lib.path.splitRoot` to safely deconstruct the path into its filesystem root and subpath
+      # We don't need the filesystem root though, builtins.path doesn't expose that in any way to the filter.
+      # So we only need the components, which we then turn into a string as one would expect.
+      rootString = "/" + concatStringsSep "/" (components (splitRoot root).subpath);
+    in
+    if rootPathType == "directory" then
+      # We imitate builtins.path not calling the filter on the root path
+      _create root (fromDir root rootString)
+    else
+      # Direct files are always included by builtins.path without calling the filter
+      # But we need to lift up the base path to its parent to satisfy the base path invariant
+      _create (dirOf root)
+        {
+          ${baseNameOf root} = rootPathType;
+        };
+
   # Transforms the filesetTree of a file set to a shorter base path, e.g.
   # _shortenTreeBase [ "foo" ] (_create /foo/bar null)
   # => { bar = null; }
diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index c1c67800f5e..796a03b52f0 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 # shellcheck disable=SC2016
+# shellcheck disable=SC2317
+# shellcheck disable=SC2192
 
 # Tests lib.fileset
 # Run:
@@ -224,6 +226,43 @@ withFileMonitor() {
     fi
 }
 
+
+# Create the tree structure declared in the tree variable, usage:
+#
+# tree=(
+#   [a/b] =   # Declare that file       a/b should exist
+#   [c/a] =   # Declare that file       c/a should exist
+#   [c/d/]=   # Declare that directory c/d/ should exist
+# )
+# createTree
+declare -A tree
+createTree() {
+    # Track which paths need to be created
+    local -a dirsToCreate=()
+    local -a filesToCreate=()
+    for p in "${!tree[@]}"; do
+        # If keys end with a `/` we treat them as directories, otherwise files
+        if [[ "$p" =~ /$ ]]; then
+            dirsToCreate+=("$p")
+        else
+            filesToCreate+=("$p")
+        fi
+    done
+
+    # Create all the necessary paths.
+    # This is done with only a fixed number of processes,
+    # in order to not be too slow
+    # Though this does mean we're a bit limited with how many files can be created
+    if (( ${#dirsToCreate[@]} != 0 )); then
+        mkdir -p "${dirsToCreate[@]}"
+    fi
+    if (( ${#filesToCreate[@]} != 0 )); then
+        readarray -d '' -t parentsToCreate < <(dirname -z "${filesToCreate[@]}")
+        mkdir -p "${parentsToCreate[@]}"
+        touch "${filesToCreate[@]}"
+    fi
+}
+
 # Check whether a file set includes/excludes declared paths as expected, usage:
 #
 # tree=(
@@ -232,34 +271,26 @@ withFileMonitor() {
 #   [c/d/]=   # Declare that directory c/d/ should exist and expect it to be excluded in the store path
 # )
 # checkFileset './a' # Pass the fileset as the argument
-declare -A tree
 checkFileset() {
     # New subshell so that we can have a separate trap handler, see `trap` below
     local fileset=$1
 
+    # Create the tree
+    createTree
+
     # Process the tree into separate arrays for included paths, excluded paths and excluded files.
     local -a included=()
     local -a excluded=()
     local -a excludedFiles=()
-    # Track which paths need to be created
-    local -a dirsToCreate=()
-    local -a filesToCreate=()
     for p in "${!tree[@]}"; do
-        # If keys end with a `/` we treat them as directories, otherwise files
-        if [[ "$p" =~ /$ ]]; then
-            dirsToCreate+=("$p")
-            isFile=
-        else
-            filesToCreate+=("$p")
-            isFile=1
-        fi
         case "${tree[$p]}" in
             1)
                 included+=("$p")
                 ;;
             0)
                 excluded+=("$p")
-                if [[ -n "$isFile" ]]; then
+                # If keys end with a `/` we treat them as directories, otherwise files
+                if [[ ! "$p" =~ /$ ]]; then
                     excludedFiles+=("$p")
                 fi
                 ;;
@@ -268,19 +299,6 @@ checkFileset() {
         esac
     done
 
-    # Create all the necessary paths.
-    # This is done with only a fixed number of processes,
-    # in order to not be too slow
-    # Though this does mean we're a bit limited with how many files can be created
-    if (( ${#dirsToCreate[@]} != 0 )); then
-        mkdir -p "${dirsToCreate[@]}"
-    fi
-    if (( ${#filesToCreate[@]} != 0 )); then
-        readarray -d '' -t parentsToCreate < <(dirname -z "${filesToCreate[@]}")
-        mkdir -p "${parentsToCreate[@]}"
-        touch "${filesToCreate[@]}"
-    fi
-
     expression="toSource { root = ./.; fileset = $fileset; }"
 
     # We don't have lambda's in bash unfortunately,
@@ -321,6 +339,10 @@ checkFileset() {
 expectFailure 'toSource { root = "/nix/store/foobar"; fileset = ./.; }' 'lib.fileset.toSource: `root` \(/nix/store/foobar\) is a string-like value, but it should be a path instead.
 \s*Paths in strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.'
 
+expectFailure 'toSource { root = cleanSourceWith { src = ./.; }; fileset = ./.; }' 'lib.fileset.toSource: `root` is a `lib.sources`-based value, but it should be a path instead.
+\s*To use a `lib.sources`-based value, convert it to a file set using `lib.fileset.fromSource` and pass it as `fileset`.
+\s*Note that this only works for sources created from paths.'
+
 # Only paths are accepted as `root`
 expectFailure 'toSource { root = 10; fileset = ./.; }' 'lib.fileset.toSource: `root` is of type int, but it should be a path instead.'
 
@@ -365,6 +387,9 @@ rm -rf -- *
 expectFailure 'toSource { root = ./.; fileset = 10; }' 'lib.fileset.toSource: `fileset` is of type int, but it should be a file set or a path instead.'
 expectFailure 'toSource { root = ./.; fileset = "/some/path"; }' 'lib.fileset.toSource: `fileset` \("/some/path"\) is a string-like value, but it should be a file set or a path instead.
 \s*Paths represented as strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.'
+expectFailure 'toSource { root = ./.; fileset = cleanSourceWith { src = ./.; }; }' 'lib.fileset.toSource: `fileset` is a `lib.sources`-based value, but it should be a file set or a path instead.
+\s*To convert a `lib.sources`-based value to a file set you can use `lib.fileset.fromSource`.
+\s*Note that this only works for sources created from paths.'
 
 # Path coercion errors for non-existent paths
 expectFailure 'toSource { root = ./.; fileset = ./a; }' 'lib.fileset.toSource: `fileset` \('"$work"'/a\) is a path that does not exist.'
@@ -995,6 +1020,217 @@ touch 0 "${filesToCreate[@]}"
 expectTrace 'unions (mapAttrsToList (n: _: ./. + "/${n}") (removeAttrs (builtins.readDir ./.) [ "0" ]))' "$expectedTrace"
 rm -rf -- *
 
+## lib.fileset.fromSource
+
+# Check error messages
+expectFailure 'fromSource null' 'lib.fileset.fromSource: The source origin of the argument is of type null, but it should be a path instead.'
+
+expectFailure 'fromSource (lib.cleanSource "")' 'lib.fileset.fromSource: The source origin of the argument is a string-like value \(""\), but it should be a path instead.
+\s*Sources created from paths in strings cannot be turned into file sets, use `lib.sources` or derivations instead.'
+
+expectFailure 'fromSource (lib.cleanSource null)' 'lib.fileset.fromSource: The source origin of the argument is of type null, but it should be a path instead.'
+
+# fromSource on a path works and is the same as coercing that path
+mkdir a
+touch a/b c
+expectEqual 'trace (fromSource ./.) null' 'trace ./. null'
+rm -rf -- *
+
+# Check that converting to a file set doesn't read the included files
+mkdir a
+touch a/b
+run() {
+    expectEqual "trace (fromSource (lib.cleanSourceWith { src = ./a; })) null" "builtins.trace \"$work/a (all files in directory)\" null"
+    rm a/b
+}
+withFileMonitor run a/b
+rm -rf -- *
+
+# Check that converting to a file set doesn't read entries for directories that are filtered out
+mkdir -p a/b
+touch a/b/c
+run() {
+    expectEqual "trace (fromSource (lib.cleanSourceWith {
+      src = ./a;
+      filter = pathString: type: false;
+    })) null" "builtins.trace \"(empty)\" null"
+    rm a/b/c
+    rmdir a/b
+}
+withFileMonitor run a/b
+rm -rf -- *
+
+# The filter is not needed on empty directories
+expectEqual 'trace (fromSource (lib.cleanSourceWith {
+  src = ./.;
+  filter = abort "filter should not be needed";
+})) null' 'trace _emptyWithoutBase null'
+
+# Single files also work
+touch a b
+expectEqual 'trace (fromSource (cleanSourceWith { src = ./a; })) null' 'trace ./a null'
+rm -rf -- *
+
+# For a tree assigning each subpath true/false,
+# check whether a source filter with those results includes the same files
+# as a file set created using fromSource. Usage:
+#
+# tree=(
+#   [a]=1  # ./a is a file and the filter should return true for it
+#   [b/]=0 # ./b is a directory and the filter should return false for it
+# )
+# checkSource
+checkSource() {
+    createTree
+
+    # Serialise the tree as JSON (there's only minimal savings with jq,
+    # and we don't need to handle escapes)
+    {
+        echo "{"
+        first=1
+        for p in "${!tree[@]}"; do
+            if [[ -z "$first" ]]; then
+                echo ","
+            else
+                first=
+            fi
+            echo "\"$p\":"
+            case "${tree[$p]}" in
+                1)
+                    echo "true"
+                    ;;
+                0)
+                    echo "false"
+                    ;;
+                *)
+                    die "Unsupported tree value: ${tree[$p]}"
+            esac
+        done
+        echo "}"
+    } > "$tmp/tree.json"
+
+    # An expression to create a source value with a filter matching the tree
+    sourceExpr='
+      let
+        tree = importJSON '"$tmp"'/tree.json;
+      in
+      cleanSourceWith {
+        src = ./.;
+        filter =
+          pathString: type:
+          let
+            stripped = removePrefix (toString ./. + "/") pathString;
+            key = stripped + optionalString (type == "directory") "/";
+          in
+          tree.${key} or
+            (throw "tree key ${key} missing");
+      }
+    '
+
+    filesetExpr='
+      toSource {
+        root = ./.;
+        fileset = fromSource ('"$sourceExpr"');
+      }
+    '
+
+    # Turn both into store paths
+    sourceStorePath=$(expectStorePath "$sourceExpr")
+    filesetStorePath=$(expectStorePath "$filesetExpr")
+
+    # Loop through each path in the tree
+    while IFS= read -r -d $'\0' subpath; do
+        if [[ ! -e "$sourceStorePath"/"$subpath" ]]; then
+            # If it's not in the source store path, it's also not in the file set store path
+            if [[ -e "$filesetStorePath"/"$subpath" ]]; then
+                die "The store path $sourceStorePath created by $expr doesn't contain $subpath, but the corresponding store path $filesetStorePath created via fromSource does contain $subpath"
+            fi
+        elif [[ -z "$(find "$sourceStorePath"/"$subpath" -type f)" ]]; then
+            # If it's an empty directory in the source store path, it shouldn't be in the file set store path
+            if [[ -e "$filesetStorePath"/"$subpath" ]]; then
+                die "The store path $sourceStorePath created by $expr contains the path $subpath without any files, but the corresponding store path $filesetStorePath created via fromSource didn't omit it"
+            fi
+        else
+            # If it's non-empty directory or a file, it should be in the file set store path
+            if [[ ! -e "$filesetStorePath"/"$subpath" ]]; then
+                die "The store path $sourceStorePath created by $expr contains the non-empty path $subpath, but the corresponding store path $filesetStorePath created via fromSource doesn't include it"
+            fi
+        fi
+    done < <(find . -mindepth 1 -print0)
+
+    rm -rf -- *
+}
+
+# Check whether the filter is evaluated correctly
+tree=(
+    [a]=
+    [b/]=
+    [b/c]=
+    [b/d]=
+    [e/]=
+    [e/e/]=
+)
+# We fill out the above tree values with all possible combinations of 0 and 1
+# Then check whether a filter based on those return values gets turned into the corresponding file set
+for i in $(seq 0 $((2 ** ${#tree[@]} - 1 ))); do
+    for p in "${!tree[@]}"; do
+        tree[$p]=$(( i % 2 ))
+        (( i /= 2 )) || true
+    done
+    checkSource
+done
+
+# The filter is called with the same arguments in the same order
+mkdir a e
+touch a/b a/c d e
+expectEqual '
+  trace (fromSource (cleanSourceWith {
+    src = ./.;
+    filter = pathString: type: builtins.trace "${pathString} ${toString type}" true;
+  })) null
+' '
+  builtins.seq (cleanSourceWith {
+    src = ./.;
+    filter = pathString: type: builtins.trace "${pathString} ${toString type}" true;
+  }).outPath
+  builtins.trace "'"$work"' (all files in directory)"
+  null
+'
+rm -rf -- *
+
+# Test that if a directory is not included, the filter isn't called on its contents
+mkdir a b
+touch a/c b/d
+expectEqual 'trace (fromSource (cleanSourceWith {
+  src = ./.;
+  filter = pathString: type:
+    if pathString == toString ./a then
+      false
+    else if pathString == toString ./b then
+      true
+    else if pathString == toString ./b/d then
+      true
+    else
+      abort "This filter should not be called with path ${pathString}";
+})) null' 'trace (_create ./. { b = "directory"; }) null'
+rm -rf -- *
+
+# The filter is called lazily:
+# If a later say intersection removes a part of the tree, the filter won't run on it
+mkdir a d
+touch a/{b,c} d/e
+expectEqual 'trace (intersection ./a (fromSource (lib.cleanSourceWith {
+  src = ./.;
+  filter = pathString: type:
+    if pathString == toString ./a || pathString == toString ./a/b then
+      true
+    else if pathString == toString ./a/c then
+      false
+    else
+      abort "filter should not be called on ${pathString}";
+}))) null' 'trace ./a/b null'
+rm -rf -- *
+
 # TODO: Once we have combinators and a property testing library, derive property tests from https://en.wikipedia.org/wiki/Algebra_of_sets
 
 echo >&2 tests ok
diff --git a/nixos/doc/manual/development/running-nixos-tests-interactively.section.md b/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
index 54002941d63..a816213f37d 100644
--- a/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
+++ b/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
@@ -57,6 +57,22 @@ using:
 Once the connection is established, you can enter commands in the socat terminal
 where socat is running.
 
+## Port forwarding to NixOS test VMs {#sec-nixos-test-port-forwarding}
+
+If your test has only a single VM, you may use e.g.
+
+```ShellSession
+$ QEMU_NET_OPTS="hostfwd=tcp:127.0.0.1:2222-127.0.0.1:22" ./result/bin/nixos-test-driver
+```
+
+to port-forward a port in the VM (here `22`) to the host machine (here port `2222`).
+
+This naturally does not work when multiple machines are involved,
+since a single port on the host cannot forward to multiple VMs.
+
+If the test defines multiple machines, you may opt to _temporarily_ set
+`virtualisation.forwardPorts` in the test definition for debugging.
+
 ## Reuse VM state {#sec-nixos-test-reuse-vm-state}
 
 You can re-use the VM states coming from a previous run by setting the
diff --git a/nixos/doc/manual/installation/changing-config.chapter.md b/nixos/doc/manual/installation/changing-config.chapter.md
index 11b49ccb1f6..f2ffea9088a 100644
--- a/nixos/doc/manual/installation/changing-config.chapter.md
+++ b/nixos/doc/manual/installation/changing-config.chapter.md
@@ -89,7 +89,7 @@ guest. For instance, the following will forward host port 2222 to guest
 port 22 (SSH):
 
 ```ShellSession
-$ QEMU_NET_OPTS="hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
+$ QEMU_NET_OPTS="hostfwd=tcp:127.0.0.1:2222-127.0.0.1:22" ./result/bin/run-*-vm
 ```
 
 allowing you to log in via SSH (assuming you have set the appropriate
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 03bd201246c..6b4e7adbc92 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -33,6 +33,8 @@
 - All [ROCm](https://rocm.docs.amd.com/en/latest/) packages have been updated to 5.7.0.
   - [ROCm](https://rocm.docs.amd.com/en/latest/) package attribute sets are versioned: `rocmPackages` -> `rocmPackages_5`.
 
+- `yarn-berry` has been updated to 4.0.1. This means that NodeJS versions less than `18.12` are no longer supported by it. More details at the [upstream changelog](https://github.com/yarnpkg/berry/blob/master/CHANGELOG.md).
+
 - If the user has a custom shell enabled via `users.users.${USERNAME}.shell = ${CUSTOMSHELL}`, the
   assertion will require them to also set `programs.${CUSTOMSHELL}.enable =
   true`. This is generally safe behavior, but for anyone needing to opt out from
@@ -373,6 +375,8 @@
 
 - The `junicode` font package has been updated to [major version 2](https://github.com/psb1558/Junicode-font/releases/tag/v2.001), which is now a font family. In particular, plain `Junicode.ttf` no longer exists. In addition, TrueType font files are now placed in `font/truetype` instead of `font/junicode-ttf`; this change does not affect use via `fonts.packages` NixOS option.
 
+- The `prayer` package as well as `services.prayer` have been removed because it's been unmaintained for several years and the author's website has vanished.
+
 ## Other Notable Changes {#sec-release-23.11-notable-changes}
 
 - A new option `system.switch.enable` was added. By default, this is option is
@@ -525,6 +529,8 @@ The module update takes care of the new config syntax and the data itself (user
 
 - `services.bitcoind` now properly respects the `enable` option.
 
+- The Home Assistant module now offers support for installing custom components and lovelace modules. Available at [`services.home-assistant.customComponents`](#opt-services.home-assistant.customComponents) and [`services.home-assistant.customLovelaceModules`](#opt-services.home-assistant.customLovelaceModules).
+
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
 
 - The use of `sourceRoot = "source";`, `sourceRoot = "source/subdir";`, and similar lines in package derivations using the default `unpackPhase` is deprecated as it requires `unpackPhase` to always produce a directory named "source". Use `sourceRoot = src.name`, `sourceRoot = "${src.name}/subdir";`, or `setSourceRoot = "sourceRoot=$(echo */subdir)";` or similar instead.
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 5b278b5e806..18928a6bf21 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -86,7 +86,7 @@ in
       #rtkit = 45; # dynamically allocated 2021-09-03
       dovecot2 = 46;
       dovenull2 = 47;
-      prayer = 49;
+      # prayer = 49; # dropped in 23.11
       mpd = 50;
       clamav = 51;
       #fprot = 52; # unused
@@ -411,7 +411,7 @@ in
       #rtkit = 45; # unused
       dovecot2 = 46;
       dovenull2 = 47;
-      prayer = 49;
+      # prayer = 49; # dropped in 23.11
       mpd = 50;
       clamav = 51;
       #fprot = 52; # unused
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 6679e5bb7c6..00da6399295 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1041,7 +1041,6 @@
   ./services/networking/powerdns.nix
   ./services/networking/pppd.nix
   ./services/networking/pptpd.nix
-  ./services/networking/prayer.nix
   ./services/networking/privoxy.nix
   ./services/networking/prosody.nix
   ./services/networking/quassel.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 0fbb2351f98..3fab863adb7 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -111,6 +111,7 @@ in
     (mkRemovedOptionModule [ "services" "riak" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "cryptpad" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "rtsp-simple-server" ] "Package has been completely rebranded by upstream as mediamtx, and thus the service and the package were renamed in NixOS as well.")
+    (mkRemovedOptionModule [ "services" "prayer" ] "The corresponding package was removed from nixpkgs.")
 
     (mkRemovedOptionModule [ "i18n" "inputMethod" "fcitx" ] "The fcitx module has been removed. Please use fcitx5 instead")
     (mkRemovedOptionModule [ "services" "dhcpd4" ] ''
diff --git a/nixos/modules/services/desktops/gnome/at-spi2-core.nix b/nixos/modules/services/desktops/gnome/at-spi2-core.nix
index 10a2f1f9eca..d0320c1e630 100644
--- a/nixos/modules/services/desktops/gnome/at-spi2-core.nix
+++ b/nixos/modules/services/desktops/gnome/at-spi2-core.nix
@@ -51,7 +51,7 @@ with lib;
     })
 
     (mkIf (!config.services.gnome.at-spi2-core.enable) {
-      environment.variables = {
+      environment.sessionVariables = {
         NO_AT_BRIDGE = "1";
         GTK_A11Y = "none";
       };
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 789b06af19b..54fd3e17292 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -16,7 +16,8 @@ let
     cp ${format.generate "configuration.yaml" filteredConfig} $out
     sed -i -e "s/'\!\([a-z_]\+\) \(.*\)'/\!\1 \2/;s/^\!\!/\!/;" $out
   '';
-  lovelaceConfig = cfg.lovelaceConfig or {};
+  lovelaceConfig = if (cfg.lovelaceConfig == null) then {}
+    else (lib.recursiveUpdate customLovelaceModulesResources cfg.lovelaceConfig);
   lovelaceConfigFile = format.generate "ui-lovelace.yaml" lovelaceConfig;
 
   # Components advertised by the home-assistant package
@@ -62,8 +63,24 @@ let
     # Respect overrides that already exist in the passed package and
     # concat it with values passed via the module.
     extraComponents = oldArgs.extraComponents or [] ++ extraComponents;
-    extraPackages = ps: (oldArgs.extraPackages or (_: []) ps) ++ (cfg.extraPackages ps);
+    extraPackages = ps: (oldArgs.extraPackages or (_: []) ps)
+      ++ (cfg.extraPackages ps)
+      ++ (lib.concatMap (component: component.propagatedBuildInputs or []) cfg.customComponents);
   }));
+
+  # Create a directory that holds all lovelace modules
+  customLovelaceModulesDir = pkgs.buildEnv {
+    name = "home-assistant-custom-lovelace-modules";
+    paths = cfg.customLovelaceModules;
+  };
+
+  # Create parts of the lovelace config that reference lovelave modules as resources
+  customLovelaceModulesResources = {
+    lovelace.resources = map (card: {
+      url = "/local/nixos-lovelace-modules/${card.entrypoint or card.pname}.js?${card.version}";
+      type = "module";
+    }) cfg.customLovelaceModules;
+  };
 in {
   imports = [
     # Migrations in NixOS 22.05
@@ -137,6 +154,41 @@ in {
       '';
     };
 
+    customComponents = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      example = literalExpression ''
+        with pkgs.home-assistant-custom-components; [
+          prometheus-sensor
+        ];
+      '';
+      description = lib.mdDoc ''
+        List of custom component packages to install.
+
+        Available components can be found below `pkgs.home-assistant-custom-components`.
+      '';
+    };
+
+    customLovelaceModules = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      example = literalExpression ''
+        with pkgs.home-assistant-custom-lovelace-modules; [
+          mini-graph-card
+          mini-media-player
+        ];
+      '';
+      description = lib.mdDoc ''
+        List of custom lovelace card packages to load as lovelace resources.
+
+        Available cards can be found below `pkgs.home-assistant-custom-lovelace-modules`.
+
+        ::: {.note}
+        Automatic loading only works with lovelace in `yaml` mode.
+        :::
+      '';
+    };
+
     config = mkOption {
       type = types.nullOr (types.submodule {
         freeformType = format.type;
@@ -408,9 +460,35 @@ in {
           rm -f "${cfg.configDir}/ui-lovelace.yaml"
           ln -s /etc/home-assistant/ui-lovelace.yaml "${cfg.configDir}/ui-lovelace.yaml"
         '';
+        copyCustomLovelaceModules = if cfg.customLovelaceModules != [] then ''
+          mkdir -p "${cfg.configDir}/www"
+          ln -fns ${customLovelaceModulesDir} "${cfg.configDir}/www/nixos-lovelace-modules"
+        '' else ''
+          rm -f "${cfg.configDir}/www/nixos-lovelace-modules"
+        '';
+        copyCustomComponents = ''
+          mkdir -p "${cfg.configDir}/custom_components"
+
+          # remove components symlinked in from below the /nix/store
+          components="$(find "${cfg.configDir}/custom_components" -maxdepth 1 -type l)"
+          for component in "$components"; do
+            if [[ "$(readlink "$component")" =~ ^${escapeShellArg builtins.storeDir} ]]; then
+              rm "$component"
+            fi
+          done
+
+          # recreate symlinks for desired components
+          declare -a components=(${escapeShellArgs cfg.customComponents})
+          for component in "''${components[@]}"; do
+            path="$(dirname $(find "$component" -name "manifest.json"))"
+            ln -fns "$path" "${cfg.configDir}/custom_components/"
+          done
+        '';
       in
         (optionalString (cfg.config != null) copyConfig) +
-        (optionalString (cfg.lovelaceConfig != null) copyLovelaceConfig)
+        (optionalString (cfg.lovelaceConfig != null) copyLovelaceConfig) +
+        copyCustomLovelaceModules +
+        copyCustomComponents
       ;
       environment.PYTHONPATH = package.pythonPath;
       serviceConfig = let
diff --git a/nixos/modules/services/networking/prayer.nix b/nixos/modules/services/networking/prayer.nix
deleted file mode 100644
index 197aa8a6f44..00000000000
--- a/nixos/modules/services/networking/prayer.nix
+++ /dev/null
@@ -1,90 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  inherit (pkgs) prayer;
-
-  cfg = config.services.prayer;
-
-  stateDir = "/var/lib/prayer";
-
-  prayerUser = "prayer";
-  prayerGroup = "prayer";
-
-  prayerExtraCfg = pkgs.writeText "extraprayer.cf" ''
-    prefix = "${prayer}"
-    var_prefix = "${stateDir}"
-    prayer_user = "${prayerUser}"
-    prayer_group = "${prayerGroup}"
-    sendmail_path = "/run/wrappers/bin/sendmail"
-
-    use_http_port ${cfg.port}
-
-    ${cfg.extraConfig}
-  '';
-
-  prayerCfg = pkgs.runCommand "prayer.cf" { preferLocalBuild = true; } ''
-    # We have to remove the http_port 80, or it will start a server there
-    cat ${prayer}/etc/prayer.cf | grep -v http_port > $out
-    cat ${prayerExtraCfg} >> $out
-  '';
-
-in
-
-{
-
-  ###### interface
-
-  options = {
-
-    services.prayer = {
-
-      enable = mkEnableOption (lib.mdDoc "the prayer webmail http server");
-
-      port = mkOption {
-        default = 2080;
-        type = types.port;
-        description = lib.mdDoc ''
-          Port the prayer http server is listening to.
-        '';
-      };
-
-      extraConfig = mkOption {
-        type = types.lines;
-        default = "" ;
-        description = lib.mdDoc ''
-          Extra configuration. Contents will be added verbatim to the configuration file.
-        '';
-      };
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = mkIf config.services.prayer.enable {
-    environment.systemPackages = [ prayer ];
-
-    users.users.${prayerUser} =
-      { uid = config.ids.uids.prayer;
-        description = "Prayer daemon user";
-        home = stateDir;
-      };
-
-    users.groups.${prayerGroup} =
-      { gid = config.ids.gids.prayer; };
-
-    systemd.services.prayer = {
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig.Type = "forking";
-      preStart = ''
-        mkdir -m 0755 -p ${stateDir}
-        chown ${prayerUser}:${prayerGroup} ${stateDir}
-      '';
-      script = "${prayer}/sbin/prayer --config-file=${prayerCfg}";
-    };
-  };
-}
diff --git a/nixos/tests/home-assistant.nix b/nixos/tests/home-assistant.nix
index b7deb95b2c1..e97e8a467b1 100644
--- a/nixos/tests/home-assistant.nix
+++ b/nixos/tests/home-assistant.nix
@@ -43,6 +43,16 @@ in {
         psycopg2
       ];
 
+      # test loading custom components
+      customComponents = with pkgs.home-assistant-custom-components; [
+        prometheus-sensor
+      ];
+
+      # test loading lovelace modules
+      customLovelaceModules = with pkgs.home-assistant-custom-lovelace-modules; [
+        mini-graph-card
+      ];
+
       config = {
         homeassistant = {
           name = "Home";
@@ -114,6 +124,14 @@ in {
       inheritParentConfig = true;
       configuration.services.home-assistant.config.backup = {};
     };
+
+    specialisation.removeCustomThings = {
+      inheritParentConfig = true;
+      configuration.services.home-assistant = {
+        customComponents = lib.mkForce [];
+        customLovelaceModules = lib.mkForce [];
+      };
+    };
   };
 
   testScript = { nodes, ... }: let
@@ -161,6 +179,14 @@ in {
         hass.wait_for_open_port(8123)
         hass.succeed("curl --fail http://localhost:8123/lovelace")
 
+    with subtest("Check that custom components get installed"):
+        hass.succeed("test -f ${configDir}/custom_components/prometheus_sensor/manifest.json")
+        hass.wait_until_succeeds("journalctl -u home-assistant.service | grep -q 'We found a custom integration prometheus_sensor which has not been tested by Home Assistant'")
+
+    with subtest("Check that lovelace modules are referenced and fetchable"):
+        hass.succeed("grep -q 'mini-graph-card-bundle.js' '${configDir}/ui-lovelace.yaml'")
+        hass.succeed("curl --fail http://localhost:8123/local/nixos-lovelace-modules/mini-graph-card-bundle.js")
+
     with subtest("Check that optional dependencies are in the PYTHONPATH"):
         env = get_unit_property("Environment")
         python_path = env.split("PYTHONPATH=")[1].split()[0]
@@ -200,6 +226,13 @@ in {
         for domain in ["backup"]:
             assert f"Setup of domain {domain} took" in journal, f"{domain} setup missing"
 
+    with subtest("Check custom components and custom lovelace modules get removed"):
+        cursor = get_journal_cursor()
+        hass.succeed("${system}/specialisation/removeCustomThings/bin/switch-to-configuration test")
+        hass.fail("grep -q 'mini-graph-card-bundle.js' '${configDir}/ui-lovelace.yaml'")
+        hass.fail("test -f ${configDir}/custom_components/prometheus_sensor/manifest.json")
+        wait_for_homeassistant(cursor)
+
     with subtest("Check that no errors were logged"):
         hass.fail("journalctl -u home-assistant -o cat | grep -q ERROR")
 
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index d55b79fdf50..ace04b88372 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1575,8 +1575,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "copilot";
-          version = "1.126.493";
-          sha256 = "1an7z8z3xz2piw2xz1hdrs6l5rhpyvnjmb650ff2m4k24n01svfy";
+          version = "1.135.544";
+          sha256 = "sha256-OeG1nkQbQAfu8NuDEA+iaWy0ioFyXPe7Qm/CZIKPiX8=";
         };
 
         meta = {
@@ -1592,8 +1592,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "copilot-chat";
-          version = "0.3.2023061502";
-          sha256 = "sha256-sUoKwlPDMz+iQbmIsD2JhyDwmUQzOyCHXaXCUaizQ7k=";
+          version = "0.11.2023111001";
+          sha256 = "sha256-sBDvqqyq0R0ZyS81G61fI9Vd860RIjhNzCqY0bdz1mg=";
         };
         meta = {
           description = "GitHub Copilot Chat is a companion extension to GitHub Copilot that houses experimental chat features";
@@ -3554,8 +3554,8 @@ let
         mktplcRef = {
           name = "uiua-vscode";
           publisher = "uiua-lang";
-          version = "0.0.22";
-          sha256 = "sha256-fJcSJwwRVofduWEEMa5f2VrSfyONKPkFl9OW+++lSRw=";
+          version = "0.0.23";
+          sha256 = "sha256-NauXoYTAka8qXNPYlW5g7r6NNX1x8cnvDRbEGkRsMoY=";
         };
         meta = {
           description = "VSCode language extension for Uiua";
diff --git a/pkgs/applications/emulators/flycast/default.nix b/pkgs/applications/emulators/flycast/default.nix
index f1874d62fba..ee02b1eee07 100644
--- a/pkgs/applications/emulators/flycast/default.nix
+++ b/pkgs/applications/emulators/flycast/default.nix
@@ -6,35 +6,24 @@
 , makeWrapper
 , alsa-lib
 , curl
-, egl-wayland
 , libao
-, libdecor
-, libevdev
-, libffi
-, libGL
 , libpulseaudio
-, libX11
-, libXext
-, libxkbcommon
 , libzip
-, mesa
+, lua
 , miniupnpc
-, udev
-, vulkan-headers
+, SDL2
 , vulkan-loader
-, wayland
-, zlib
 }:
 
 stdenv.mkDerivation rec {
   pname = "flycast";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "V${version}";
-    sha256 = "sha256-PRInOqg9OpaUVLwSj1lOxDtjpVaYehkRsp0jLrVKPyY=";
+    rev = "v${version}";
+    sha256 = "sha256-eQMKaUaZ1b0oXre4Ouli4qIyNaG64KntyRGk3/YIopc=";
     fetchSubmodules = true;
   };
 
@@ -47,23 +36,16 @@ stdenv.mkDerivation rec {
   buildInputs = [
     alsa-lib
     curl
-    egl-wayland
     libao
-    libdecor
-    libevdev
-    libffi
-    libGL
     libpulseaudio
-    libX11
-    libXext
-    libxkbcommon
     libzip
-    mesa # for libgbm
+    lua
     miniupnpc
-    udev
-    vulkan-headers
-    wayland
-    zlib
+    SDL2
+  ];
+
+  cmakeFlags = [
+    "-DUSE_HOST_SDL=ON"
   ];
 
   postFixup = ''
diff --git a/pkgs/applications/misc/camunda-modeler/default.nix b/pkgs/applications/misc/camunda-modeler/default.nix
index 4898c8cb9f5..c9caa508f17 100644
--- a/pkgs/applications/misc/camunda-modeler/default.nix
+++ b/pkgs/applications/misc/camunda-modeler/default.nix
@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "camunda-modeler";
-  version = "5.16.0";
+  version = "5.17.0";
 
   src = fetchurl {
     url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-Y+v/r5bhtgXBjRQic0s5FA+KMWx5R7DOK+qZ9Izdnb0=";
+    hash = "sha256-yxph3Aor5nZOhu2PY4MGcfScaz9w24JXqXbhT+QKlNI=";
   };
   sourceRoot = "camunda-modeler-${version}-linux-x64";
 
diff --git a/pkgs/applications/misc/jetbrains-toolbox/default.nix b/pkgs/applications/misc/jetbrains-toolbox/default.nix
index 569492d296e..b3800d6c7e1 100644
--- a/pkgs/applications/misc/jetbrains-toolbox/default.nix
+++ b/pkgs/applications/misc/jetbrains-toolbox/default.nix
@@ -10,11 +10,11 @@
 }:
 let
   pname = "jetbrains-toolbox";
-  version = "2.0.5.17700";
+  version = "2.1.0.18144";
 
   src = fetchzip {
     url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${version}.tar.gz";
-    sha256 = "sha256-BO9W9miQUltsg1tCyTl9j5xRCJUCsO02hUKDCYt7hd8=";
+    sha256 = "sha256-K65naW+RWAy4uxQq2GQmL0kwCH+G73ez1kgTtnTwjEw=";
     stripRoot = false;
   };
 
diff --git a/pkgs/applications/misc/kemai/000-cmake-disable-conan.diff b/pkgs/applications/misc/kemai/000-cmake-disable-conan.diff
deleted file mode 100644
index 3a438e2519a..00000000000
--- a/pkgs/applications/misc/kemai/000-cmake-disable-conan.diff
+++ /dev/null
@@ -1,38 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index ce78a9d..3cd51e0 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -8,18 +8,21 @@ list(APPEND CMAKE_PREFIX_PATH ${CMAKE_BINARY_DIR})
- # Common configuration
- set(CMAKE_CXX_STANDARD 20)
- set(CMAKE_CXX_STANDARD_REQUIRED ON)
--
--# Setup Conan
--if(NOT EXISTS "${CMAKE_BINARY_DIR}/conan.cmake")
--    message(STATUS "Downloading conan.cmake from https://github.com/conan-io/cmake-conan")
--    file(DOWNLOAD "https://raw.githubusercontent.com/conan-io/cmake-conan/0.18.1/conan.cmake"
--            "${CMAKE_BINARY_DIR}/conan.cmake"
--            TLS_VERIFY ON)
--endif()
--include(${CMAKE_BINARY_DIR}/conan.cmake)
--
--conan_cmake_autodetect(settings)
--conan_cmake_install(PATH_OR_REFERENCE ${CMAKE_SOURCE_DIR} BUILD missing SETTINGS ${settings})
-+set(USE_CONAN ON CACHE BOOL "Use conan for dependency managment")
-+
-+if(USE_CONAN)
-+    # Setup Conan
-+    if(NOT EXISTS "${CMAKE_BINARY_DIR}/conan.cmake")
-+        message(STATUS "Downloading conan.cmake from https://github.com/conan-io/cmake-conan")
-+        file(DOWNLOAD "https://raw.githubusercontent.com/conan-io/cmake-conan/0.18.1/conan.cmake"
-+                "${CMAKE_BINARY_DIR}/conan.cmake"
-+                TLS_VERIFY ON)
-+    endif()
-+    include(${CMAKE_BINARY_DIR}/conan.cmake)
-+
-+    conan_cmake_autodetect(settings)
-+    conan_cmake_install(PATH_OR_REFERENCE ${CMAKE_SOURCE_DIR} BUILD missing SETTINGS ${settings})
-+endif ()
- 
- # Setup Qt
- set(CMAKE_AUTOMOC ON)
diff --git a/pkgs/applications/misc/kemai/default.nix b/pkgs/applications/misc/kemai/default.nix
index 1e358299f5f..70941045ce3 100644
--- a/pkgs/applications/misc/kemai/default.nix
+++ b/pkgs/applications/misc/kemai/default.nix
@@ -1,13 +1,16 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , magic-enum
+, range-v3
 , spdlog
 , qtbase
 , qtconnectivity
 , qttools
 , qtlanguageserver
+, qtwayland
 , wrapQtAppsHook
 , libXScrnSaver
 , nix-update-script
@@ -15,15 +18,24 @@
 
 stdenv.mkDerivation rec {
   pname = "kemai";
-  version = "0.9.2";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "AlexandrePTJ";
     repo = "kemai";
     rev = version;
-    hash = "sha256-PDjNO2iMPK0J3TSHVZ/DW3W0GkdB8yNZYoTGEd2snac=";
+    hash = "sha256-wclBAgeDyAIw/nGF6lzIwbwdoZMBTu+tjxsnIxIkODM=";
   };
 
+  patches = [
+    # Backport the fix for an issue where LICENSE.txt ends up in /bin
+    # Remove in next release
+    (fetchpatch {
+      url = "https://github.com/AlexandrePTJ/kemai/commit/e279679dd7308efebe004252d168d7308f3b99ce.patch";
+      hash = "sha256-5cmRRMVATf4ul4HhaQKiE0yTN2qd+MfNFQzGTLLpOyg=";
+    })
+  ];
+
   buildInputs = [
     qtbase
     qtconnectivity
@@ -31,10 +43,14 @@ stdenv.mkDerivation rec {
     qtlanguageserver
     libXScrnSaver
     magic-enum
+    range-v3
     spdlog
+  ] ++ lib.optional stdenv.hostPlatform.isLinux qtwayland;
+  cmakeFlags = [
+    "-DFETCHCONTENT_FULLY_DISCONNECTED=ON"
+    "-DFETCHCONTENT_QUIET=OFF"
+    "-DFETCHCONTENT_TRY_FIND_PACKAGE_MODE=ALWAYS"
   ];
-  cmakeFlags = [ "-DUSE_CONAN=OFF" ];
-  patches = [ ./000-cmake-disable-conan.diff ];
 
   nativeBuildInputs = [ cmake wrapQtAppsHook ];
 
@@ -48,5 +64,7 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ poelzi ];
     platforms   = platforms.unix;
+    broken = stdenv.isDarwin;
+    mainProgram = "Kemai";
   };
 }
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 8a9cc71d083..c77411b6c26 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -503,6 +503,9 @@ buildStdenv.mkDerivation {
 
   preBuild = ''
     cd mozobj
+  '' + lib.optionalString (lib.versionAtLeast version "120") ''
+    # https://bugzilla.mozilla.org/show_bug.cgi?id=1864083
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config dbus-1 --cflags)"
   '';
 
   postBuild = ''
diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index 645efb7578b..c4d59bc2c14 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -30,11 +30,11 @@
 
   firefox-beta = buildMozillaMach rec {
     pname = "firefox-beta";
-    version = "119.0b9";
+    version = "120.0b9";
     applicationName = "Mozilla Firefox Beta";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "11d07474e3ca72a4e2f60053882e09a215e0d29d6830d0cd41447bb67370118356090af7adcbacd7703ad9fcdda83c9f909419c86b8f3bf2eacd9ca3d3aa3f54";
+      sha512 = "7ac5562ce393ea84663eac5c6ee1a0ca527ff4a8a9ec6aaaef37213ff071076846949e80af21d95ec8e32d3cbc740b772a9d7cc54965b7bbc8e015da22ae927f";
     };
 
     meta = {
@@ -58,12 +58,12 @@
 
   firefox-devedition = (buildMozillaMach rec {
     pname = "firefox-devedition";
-    version = "119.0b9";
+    version = "120.0b9";
     applicationName = "Mozilla Firefox Developer Edition";
     branding = "browser/branding/aurora";
     src = fetchurl {
       url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "ce3e2adb3171aa05c7af3b7a4ea25eaafbc109c522b90e26aad577192a0902000fb7d705fa5707a9a7d0be2ab1c0cddc5a98abbe6549e1377c0a1d765bda62eb";
+      sha512 = "07bf1a58550e70c683719adef55fa3d1ee06876e0cb086c28242879c683269c4aa784b1dce639218b3ad24a546192088fe5224a52e13a0086f205ec5470e2428";
     };
 
     meta = {
diff --git a/pkgs/applications/networking/browsers/palemoon/bin.nix b/pkgs/applications/networking/browsers/palemoon/bin.nix
index 79020e18b9f..2ea777728f9 100644
--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "32.4.1";
+  version = "32.5.0";
 
   src = fetchzip {
     urls = [
@@ -26,9 +26,9 @@ stdenv.mkDerivation (finalAttrs: {
       "https://rm-us.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
     ];
     hash = if withGTK3 then
-      "sha256-c/rfnMpiLWqlNZppqPRNWXsgAQ1FofAdel5EFnK+mrY="
+      "sha256-1MJ5K9Zc/BHeQwwlq3XyUV8XTFEpPytNyTnsDpE1tBI="
     else
-      "sha256-27njFdqq2DUctlz/UOtH5tlOduQNpoapuCYS+48K9dk=";
+      "sha256-xXunZTqoc2A+ilosRUUluxDwewD3xwITF5nb5Lbyv7Y=";
   };
 
   preferLocalBuild = true;
diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index 94bc2827ec9..b89cc624bd4 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -95,6 +95,7 @@ let
       removed = name: date: throw "the ${name} terraform provider removed from nixpkgs on ${date}";
     in
     lib.optionalAttrs config.allowAliases {
+      fly = archived "fly" "2023/10";
       ksyun = removed "ksyun" "2023/04";
     };
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index bd7012619b6..9caf5d07ff6 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -425,15 +425,6 @@
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-RqYzqKPzb5GcrzHnEDZC7GaBt1zP8g28Wo3WNAe07Ck="
   },
-  "fly": {
-    "hash": "sha256-9QB2fbggCKcJz8tkSYgq/X8r+MB2M76VCWXgsHARTkU=",
-    "homepage": "https://registry.terraform.io/providers/fly-apps/fly",
-    "owner": "fly-apps",
-    "repo": "terraform-provider-fly",
-    "rev": "v0.0.23",
-    "spdx": "BSD-3-Clause",
-    "vendorHash": "sha256-f+Z6Y2WPxqJoHoCwuK6sgFa8nUnkW/WwrD55dtU0wtM="
-  },
   "fortios": {
     "hash": "sha256-RpcKMndbO3wbkHmrINkbsQ+UeFsZrQ7x02dv8ZpFMec=",
     "homepage": "https://registry.terraform.io/providers/fortinetdev/fortios",
diff --git a/pkgs/by-name/ro/rockyou/package.nix b/pkgs/by-name/ro/rockyou/package.nix
new file mode 100644
index 00000000000..7e6bb2f34c3
--- /dev/null
+++ b/pkgs/by-name/ro/rockyou/package.nix
@@ -0,0 +1,20 @@
+{ seclists
+, stdenvNoCC
+}:
+stdenvNoCC.mkDerivation {
+  pname = "rockyou";
+  inherit (seclists) version src;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/wordlists/
+    tar -xvzf ${seclists}/share/wordlists/seclists/Passwords/Leaked-Databases/rockyou.txt.tar.gz -C $out/share/wordlists/
+
+    runHook postInstall
+  '';
+
+  meta = seclists.meta // {
+    description = "A famous wordlist often used for brute force attacks";
+  };
+}
diff --git a/pkgs/by-name/se/seclists/package.nix b/pkgs/by-name/se/seclists/package.nix
new file mode 100644
index 00000000000..d01328a1841
--- /dev/null
+++ b/pkgs/by-name/se/seclists/package.nix
@@ -0,0 +1,34 @@
+{ lib
+, fetchFromGitHub
+, stdenvNoCC
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "seclists";
+  version = "2023.2";
+
+  src = fetchFromGitHub {
+    owner = "danielmiessler";
+    repo = "SecLists";
+    rev = "2023.2";
+    hash = "sha256-yVxb5GaQDuCsyjIV+oZzNUEFoq6gMPeaIeQviwGdAgY=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/wordlists/seclists
+    find . -maxdepth 1 -type d -regextype posix-extended -regex '^./[A-Z].*' -exec cp -R {} $out/share/wordlists/seclists \;
+    find $out/share/wordlists/seclists -name "*.md" -delete
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A collection of multiple types of lists used during security assessments, collected in one place";
+    homepage = "https://github.com/danielmiessler/seclists";
+    license = licenses.mit;
+    maintainers = with maintainers; [ tochiaha janik pamplemousse ];
+  };
+}
+
diff --git a/pkgs/by-name/ui/uiua/package.nix b/pkgs/by-name/ui/uiua/package.nix
index ae4c6bcd494..1a6f8132544 100644
--- a/pkgs/by-name/ui/uiua/package.nix
+++ b/pkgs/by-name/ui/uiua/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uiua";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "uiua-lang";
     repo = "uiua";
     rev = version;
-    hash = "sha256-ZoiT7Yf8Mdwh2vBkRCDxhkbvTkekhTopFNWjUnyoPUQ=";
+    hash = "sha256-RAMQC9weEvTV44nAXjwMYv+4O5aSNNM5UOf/xBb4SBE=";
   };
 
-  cargoHash = "sha256-My/15zNfEqt+a0jganS6LfFiEXENUaPTcyz6SBL0oKo=";
+  cargoHash = "sha256-ZBedAIHwbRiR9i6w0CWIiE+OJvTkmxiEihn7zLAV/Dg=";
 
   nativeBuildInputs = lib.optionals stdenv.isDarwin [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/wo/wordlists/package.nix b/pkgs/by-name/wo/wordlists/package.nix
new file mode 100644
index 00000000000..16106707fd9
--- /dev/null
+++ b/pkgs/by-name/wo/wordlists/package.nix
@@ -0,0 +1,70 @@
+{ lib
+, callPackage
+, nmap
+, rockyou
+, runtimeShell
+, seclists
+, symlinkJoin
+, tree
+, wfuzz
+, lists ? [
+    nmap
+    rockyou
+    seclists
+    wfuzz
+  ]
+}:
+
+symlinkJoin rec {
+  pname = "wordlists";
+  version = "unstable-2023-10-10";
+
+  name = "${pname}-${version}";
+  paths = lists;
+
+  postBuild = ''
+    mkdir -p $out/bin
+
+    # Create a command to show the location of the links.
+    cat >> $out/bin/wordlists << __EOF__
+    #!${runtimeShell}
+    ${tree}/bin/tree ${placeholder "out"}/share/wordlists
+    __EOF__
+    chmod +x $out/bin/wordlists
+
+    # Create a handy command for easy access to the wordlists.
+    # e.g.: `cat "$(wordlists_path)/rockyou.txt"`, or `ls "$(wordlists_path)/dirbuster"`
+    cat >> $out/bin/wordlists_path << __EOF__
+    #!${runtimeShell}
+    printf "${placeholder "out"}/share/wordlists\n"
+    __EOF__
+    chmod +x $out/bin/wordlists_path
+  '';
+
+  meta = with lib; {
+    description = "A collection of wordlists useful for security testing";
+    longDescription = ''
+      The `wordlists` package provides two scripts. One is called {command}`wordlists`,
+      and it will list a tree of all the wordlists installed. The other one is
+      called {command}`wordlists_path` which will print the path to the nix store
+      location of the lists. You can for example do
+      {command}`$(wordlists_path)/rockyou.txt` to get the location of the
+      [rockyou](https://en.wikipedia.org/wiki/RockYou#Data_breach)
+      wordlist. If you want to modify the available wordlists you can override
+      the `lists` attribute`. In your nixos configuration this would look
+      similiar to this:
+
+      ```nix
+      environment.systemPackages = [
+        (pkgs.wordlists.override { lists = with pkgs; [ rockyou ] })
+      ]
+      ```
+
+      you can use this with nix-shell by doing:
+      {command}`nix-shell -p 'wordlists.override { lists = with (import <nixpkgs> {}); [ nmap ]; }'
+      If you want to add a new package that provides wordlist/s the convention
+      is to copy it to {file}`$out/share/wordlists/myNewWordlist`.
+    '';
+    maintainers = with maintainers; [ janik pamplemousse ];
+  };
+}
diff --git a/pkgs/development/compilers/elm/packages/lamdera.nix b/pkgs/development/compilers/elm/packages/lamdera.nix
index d9727996e05..e3dda4c31a5 100644
--- a/pkgs/development/compilers/elm/packages/lamdera.nix
+++ b/pkgs/development/compilers/elm/packages/lamdera.nix
@@ -7,16 +7,16 @@ let
   arch = if stdenv.isAarch64 then "arm64" else "x86_64";
   hashes =
     {
-      "x86_64-linux" = "b13110bacc3f71c2a3e12c52172a821a85cc13243a95249ca18c8beb296c0ce8";
-      "aarch64-linux" = "afbc71f0570b86215942d1b4207fe3de0299e6fdfd2e6caac78bf688c81b9bd1";
-      "x86_64-darwin" = "50a3df09b02b34e1653beb1507c6de0f332674e088ded7c66af4e5987753304e";
-      "aarch64-darwin" = "174a5bfec355361c4f030861405513818be25fd7e4325f7221aa71ebd27475d3";
+      "x86_64-linux" = "a51d5b9a011c54b0001ff3273cee027774686e233adadb20b1978d2cabfe32a6";
+      "aarch64-linux" = "8904ce928f60e06df1f06b3af5ee5eb320c388922aa38b698d823df1d73e8e49";
+      "x86_64-darwin" = "b4d1bb5ddc3503862750e5b241f74c22dc013792bc4f410dd914a5216e20ed2f";
+      "aarch64-darwin" = "6d20e384dae90bb994c3f1e866c964124c7e8a51e9e08bad0e90a2b560bb5a18";
     };
 in
 
 stdenv.mkDerivation rec {
   pname = "lamdera";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://static.lamdera.com/bin/lamdera-${version}-${os}-${arch}";
diff --git a/pkgs/development/compilers/gleam/default.nix b/pkgs/development/compilers/gleam/default.nix
index 344c803419f..bc2dfbda09f 100644
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@@ -6,8 +6,8 @@
 , pkg-config
 , openssl
 , Security
-, libiconv
 , nix-update-script
+, SystemConfiguration
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ git pkg-config ];
 
   buildInputs = [ openssl ] ++
-    lib.optionals stdenv.isDarwin [ Security libiconv ];
+    lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
   cargoHash = "sha256-ffnDTGg+m0NUhG2BYjsXb2fWHeQmtDcBGqQDLqwZMWI=";
 
diff --git a/pkgs/development/libraries/boost-ext/boost-sml/default.nix b/pkgs/development/libraries/boost-ext/boost-sml/default.nix
index fd69db12d3c..0383adca64a 100644
--- a/pkgs/development/libraries/boost-ext/boost-sml/default.nix
+++ b/pkgs/development/libraries/boost-ext/boost-sml/default.nix
@@ -7,15 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "boost-sml";
-  # This is first commit since 1.1.6 that passes all tests (test_policies_logging is commented out)
-  version = "1.1.6";
-  working_tests = "24d762d1901f4f6afaa5c5e0d1b7b77537964694";
+  version = "1.1.9";
 
   src = fetchFromGitHub {
     owner = "boost-ext";
     repo = "sml";
-    rev = "${working_tests}";
-    hash = "sha256-ZhIfyYdzrzPTAYevOz5I6tAcUiLRMV8HENKX9jychEY=";
+    rev = "v${version}";
+    hash = "sha256-RYgSpnsmgZybpkJALIzxpkDRfe9QF2FHG+nA3msFaK0=";
   };
 
   buildInputs = [ boost ];
diff --git a/pkgs/development/libraries/cracklib/default.nix b/pkgs/development/libraries/cracklib/default.nix
index ba5d96a9518..4c0badf3df7 100644
--- a/pkgs/development/libraries/cracklib/default.nix
+++ b/pkgs/development/libraries/cracklib/default.nix
@@ -1,6 +1,6 @@
 let version = "2.9.11"; in
 { stdenv, lib, buildPackages, fetchurl, zlib, gettext
-, wordlists ? [ (fetchurl {
+, lists ? [ (fetchurl {
   url = "https://github.com/cracklib/cracklib/releases/download/v${version}/cracklib-words-${version}.gz";
   hash = "sha256-popxGjE1c517Z+nzYLM/DU7M+b1/rE0XwNXkVqkcUXo=";
 }) ]
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     patchShebangs util
 
   '' + ''
-    ln -vs ${toString wordlists} dicts/
+    ln -vs ${toString lists} dicts/
   '';
 
   postInstall = ''
diff --git a/pkgs/development/libraries/intel-media-driver/default.nix b/pkgs/development/libraries/intel-media-driver/default.nix
index cb014ed80bf..68028849b63 100644
--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-driver";
-  version = "23.1.6";
+  version = "23.3.5";
 
   outputs = [ "out" "dev" ];
 
@@ -24,14 +24,14 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "media-driver";
     rev = "intel-media-${version}";
-    sha256 = "sha256-Z1xBU+4SdwknXpYUS8EwEURNIsg2+R/U0CcW3FW325M=";
+    hash = "sha256-7OdLpqO2evNeyxceOtHEI7sJCVybqvrcM1ZZx8bI4xw=";
   };
 
   patches = [
     # fix platform detection
     (fetchpatch {
-      url = "https://salsa.debian.org/multimedia-team/intel-media-driver-non-free/-/raw/04ffb03f744780a55aba311c612d708b00584bb7/debian/patches/0002-Remove-settings-based-on-ARCH.patch";
-      sha256 = "sha256-o/Pg0S53SYh3O7L+AwxOPl1Bx4TS6iKB8ql8GhhHI/o=";
+      url = "https://salsa.debian.org/multimedia-team/intel-media-driver-non-free/-/raw/7376a99f060c26d6be8e56674da52a61662617b9/debian/patches/0002-Remove-settings-based-on-ARCH.patch";
+      hash = "sha256-57yePuHWYb3XXrB4MjYO2h6jbqfs4SGTLlLG91el8M4=";
     })
   ];
 
diff --git a/pkgs/development/libraries/libfive/default.nix b/pkgs/development/libraries/libfive/default.nix
index d789aafbcb4..f5fbf21f94f 100644
--- a/pkgs/development/libraries/libfive/default.nix
+++ b/pkgs/development/libraries/libfive/default.nix
@@ -10,6 +10,7 @@
 , libpng
 , boost
 , guile
+, python
 , qtbase
 , darwin
 }:
@@ -25,8 +26,8 @@ stdenv.mkDerivation {
     hash = "sha256-OITy3fJx+Z6856V3D/KpSQRJztvOdJdqUv1c65wNgCc=";
   };
 
-  nativeBuildInputs = [ wrapQtAppsHook cmake ninja pkg-config ];
-  buildInputs = [ eigen zlib libpng boost guile qtbase ]
+  nativeBuildInputs = [ wrapQtAppsHook cmake ninja pkg-config python.pkgs.pythonImportsCheckHook ];
+  buildInputs = [ eigen zlib libpng boost guile python qtbase ]
     ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk_11_0.frameworks.Cocoa ];
 
   preConfigure = ''
@@ -42,6 +43,14 @@ stdenv.mkDerivation {
       --replace "LIBFIVE_STDLIB_DIR=$<TARGET_FILE_DIR:libfive-stdlib>" \
                 "LIBFIVE_STDLIB_DIR=$out/lib"
 
+    substituteInPlace libfive/bind/python/CMakeLists.txt \
+      --replace ' ''${PYTHON_SITE_PACKAGES_DIR}' \
+                " $out/${python.sitePackages}" \
+
+    substituteInPlace libfive/bind/python/libfive/ffi.py \
+      --replace "os.path.join('libfive', folder)" \
+                "os.path.join('$out/${python.sitePackages}/libfive', folder)" \
+
     export XDG_CACHE_HOME=$(mktemp -d)/.cache
   '';
 
@@ -63,12 +72,29 @@ stdenv.mkDerivation {
   '' + ''
     # Link "Studio" binary to "libfive-studio" to be more obvious:
     ln -s "$out/bin/Studio" "$out/bin/libfive-studio"
+
+    # Create links since libfive looks for the library in a specific path.
+    mkdir -p "$out/${python.sitePackages}/libfive/src"
+    ln -s "$out"/lib/libfive.* "$out/${python.sitePackages}/libfive/src/"
+    mkdir -p "$out/${python.sitePackages}/libfive/stdlib"
+    ln -s "$out"/lib/libfive-stdlib.* "$out/${python.sitePackages}/libfive/stdlib/"
+
+    # Create links so Studio can find the bindings.
+    mkdir -p "$out/libfive/bind"
+    ln -s "$out/${python.sitePackages}" "$out/libfive/bind/python"
   '';
 
+  pythonImportsCheck = [
+    "libfive"
+    "libfive.runner"
+    "libfive.shape"
+    "libfive.stdlib"
+  ];
+
   meta = with lib; {
     description = "Infrastructure for solid modeling with F-Reps in C, C++, and Guile";
     homepage = "https://libfive.com/";
-    maintainers = with maintainers; [ hodapp kovirobi ];
+    maintainers = with maintainers; [ hodapp kovirobi wulfsta ];
     license = with licenses; [ mpl20 gpl2Plus ];
     platforms = with platforms; all;
   };
diff --git a/pkgs/development/mobile/maestro/default.nix b/pkgs/development/mobile/maestro/default.nix
index d503bda7876..f670f79a8be 100644
--- a/pkgs/development/mobile/maestro/default.nix
+++ b/pkgs/development/mobile/maestro/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "maestro";
-  version = "1.34.0";
+  version = "1.34.1";
 
   src = fetchurl {
     url = "https://github.com/mobile-dev-inc/maestro/releases/download/cli-${version}/maestro.zip";
-    sha256 = "1qbva38lcy1rm5k6r207hk3nqrr07h7x9sdppz4w5f37q0ll986r";
+    sha256 = "0whnhcf7a3j01693254qqwfk9d3xa4icv4kyqkn4ihxyibznb91d";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index ca577acc283..cf9a5140dea 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "18.2.1";
+  version = "18.2.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-PW3/V4PTm+UxTsfSSvOEX+FGcuF4m+mDOz6Z/AzB2qk=";
+    hash = "sha256-m82UfhcmAFBDfSVmia6nhBB2qyQjSZJbXtzD/sGeqk4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bluetooth-data-tools/default.nix b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
index 8df2ee06a99..faec6cb3650 100644
--- a/pkgs/development/python-modules/bluetooth-data-tools/default.nix
+++ b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-data-tools";
-  version = "1.13.0";
+  version = "1.14.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-qvr4CYOMgyTEFONpe6KA176H56+w6RHThAyUthIzszE=";
+    hash = "sha256-eO17EuZ9K6tLAyEGmTaxw1Cxfz3XPPwNCcIwZ2/uHug=";
   };
 
   # The project can build both an optimized cython version and an unoptimized
diff --git a/pkgs/development/python-modules/geoalchemy2/default.nix b/pkgs/development/python-modules/geoalchemy2/default.nix
index 70a0101c6d0..53e1544ed01 100644
--- a/pkgs/development/python-modules/geoalchemy2/default.nix
+++ b/pkgs/development/python-modules/geoalchemy2/default.nix
@@ -1,12 +1,12 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , packaging
+, setuptools
 , setuptools-scm
 , shapely
 , sqlalchemy
 , alembic
-, psycopg2
 , pytestCheckHook
 , pythonOlder
 }:
@@ -14,37 +14,35 @@
 buildPythonPackage rec {
   pname = "geoalchemy2";
   version = "0.14.2";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
-  src = fetchPypi {
-    pname = "GeoAlchemy2";
-    inherit version;
-    hash = "sha256-jKAj3LmjbG0xLztK7mMdZjhSZOL8n+sKsPRG61YJQH0=";
+  src = fetchFromGitHub {
+    owner = "geoalchemy";
+    repo = "geoalchemy2";
+    rev = "refs/tags/${version}";
+    hash = "sha256-C/F1hpL2DnzC4UPAGGFntlQlULCx5Ufzkw7EIrzRV7I=";
   };
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
   propagatedBuildInputs = [
-    packaging
-    shapely
     sqlalchemy
+    packaging
   ];
 
   nativeCheckInputs = [
     alembic
-    psycopg2
     pytestCheckHook
-  ];
+  ] ++ passthru.optional-dependencies.shapely;
 
-  pytestFlagsArray = [
-    # tests require live postgis database
-    "--deselect=tests/test_pickle.py::TestPickle::test_pickle_unpickle"
-    "--deselect=tests/gallery/test_specific_compilation.py::test_specific_compilation"
-  ];
+  env = {
+    SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  };
 
   disabledTestPaths = [
     # tests require live databases
@@ -52,23 +50,29 @@ buildPythonPackage rec {
     "tests/gallery/test_length_at_insert.py"
     "tests/gallery/test_insert_raster.py"
     "tests/gallery/test_orm_mapped_v2.py"
+    "tests/gallery/test_specific_compilation.py"
     "tests/gallery/test_summarystatsagg.py"
     "tests/gallery/test_type_decorator.py"
     "tests/test_functional.py"
     "tests/test_functional_postgresql.py"
     "tests/test_functional_mysql.py"
     "tests/test_alembic_migrations.py"
+    "tests/test_pickle.py"
   ];
 
   pythonImportsCheck = [
     "geoalchemy2"
   ];
 
+  passthru.optional-dependencies = {
+    shapely = [ shapely ];
+  };
+
   meta = with lib; {
     description = "Toolkit for working with spatial databases";
-    homepage =  "https://geoalchemy-2.readthedocs.io/";
+    homepage = "https://geoalchemy-2.readthedocs.io/";
     changelog = "https://github.com/geoalchemy/geoalchemy2/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ nickcao ];
   };
 }
diff --git a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
index a0833b20798..c5cd3d2e4f3 100644
--- a/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
+++ b/pkgs/development/python-modules/home-assistant-bluetooth/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "home-assistant-bluetooth";
-  version = "1.10.3";
+  version = "1.10.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-77RrqmoCftPc48fFtuuFo0KqGX3n+6aDx2RFkwGCNzQ=";
+    hash = "sha256-7gkesxQI6QBxyQpHlSSh1w6MDeid0dSdXn+jnxvafD0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/jupyter-cache/default.nix b/pkgs/development/python-modules/jupyter-cache/default.nix
index 29a8bb02458..7a2501f317b 100644
--- a/pkgs/development/python-modules/jupyter-cache/default.nix
+++ b/pkgs/development/python-modules/jupyter-cache/default.nix
@@ -15,14 +15,15 @@
 
 buildPythonPackage rec {
   pname = "jupyter-cache";
-  version = "0.6.1";
-  format = "pyproject";
+  version = "1.0.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-Jvg5ARQ+30ry8/9akeLSrSmORuLO4DyAcdN6I6Y8y/w=";
+    inherit version;
+    pname = "jupyter_cache";
+    hash = "sha256-0Pp9dTPNV5gZjYiJMYJpqME4LtOyL2IsCak1ZSH0hoc=";
   };
 
   nativeBuildInputs = [
@@ -45,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A defined interface for working with a cache of jupyter notebooks";
     homepage = "https://github.com/executablebooks/jupyter-cache";
+    changelog = "https://github.com/executablebooks/jupyter-cache/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ marsam ];
   };
diff --git a/pkgs/development/python-modules/labgrid/0001-serialdriver-remove-pyserial-version-check.patch b/pkgs/development/python-modules/labgrid/0001-serialdriver-remove-pyserial-version-check.patch
deleted file mode 100644
index d3e3082b352..00000000000
--- a/pkgs/development/python-modules/labgrid/0001-serialdriver-remove-pyserial-version-check.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 75baa1751973378cb96fb204b0a18a74e5caa2d1 Mon Sep 17 00:00:00 2001
-From: Rouven Czerwinski <r.czerwinski@pengutronix.de>
-Date: Wed, 17 Feb 2021 14:03:20 +0100
-Subject: [PATCH] serialdriver: remove pyserial version check
-
-This check isn't required on NixOS, since pyserial within NixOS already
-contains the patches.
-
-Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
----
- labgrid/driver/serialdriver.py | 6 ------
- 1 file changed, 6 deletions(-)
-
-diff --git a/labgrid/driver/serialdriver.py b/labgrid/driver/serialdriver.py
-index 126f674e..59a92269 100644
---- a/labgrid/driver/serialdriver.py
-+++ b/labgrid/driver/serialdriver.py
-@@ -27,12 +27,6 @@ class SerialDriver(ConsoleExpectMixin, Driver, ConsoleProtocol):
-         bindings = {"port": "SerialPort", }
-     else:
-         bindings = {"port": {"SerialPort", "NetworkSerialPort"}, }
--    if version.parse(serial.__version__) != version.Version('3.4.0.1'):
--        message = ("The installed pyserial version does not contain important RFC2217 fixes.\n"
--                   "You can install the labgrid fork via:\n"
--                   "pip uninstall pyserial\n"
--                   "pip install https://github.com/labgrid-project/pyserial/archive/v3.4.0.1.zip#egg=pyserial\n")  # pylint: disable=line-too-long
--        warnings.warn(message)
- 
-     txdelay = attr.ib(default=0.0, validator=attr.validators.instance_of(float))
-     timeout = attr.ib(default=3.0, validator=attr.validators.instance_of(float))
--- 
-2.30.0
-
diff --git a/pkgs/development/python-modules/labgrid/default.nix b/pkgs/development/python-modules/labgrid/default.nix
index 0e96bf2fe9a..aa4b10d49d5 100644
--- a/pkgs/development/python-modules/labgrid/default.nix
+++ b/pkgs/development/python-modules/labgrid/default.nix
@@ -17,7 +17,9 @@
 , pyusb
 , pyyaml
 , requests
+, setuptools
 , setuptools-scm
+, wheel
 , xmodem
 }:
 
@@ -32,13 +34,13 @@ buildPythonPackage rec {
     sha256 = "sha256-yhlBqqCLOt6liw4iv8itG6E4QfIa7cW76QJqefUM5dw=";
   };
 
-  patches = [
-    # Pyserial within Nixpkgs already includes the necessary fix, remove the
-    # pyserial version check from labgrid.
-    ./0001-serialdriver-remove-pyserial-version-check.patch
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
   ];
 
-  nativeBuildInputs = [ setuptools-scm ];
+  pyproject = true;
 
   propagatedBuildInputs = [
     ansicolors
diff --git a/pkgs/development/python-modules/maison/default.nix b/pkgs/development/python-modules/maison/default.nix
index 8fa3393d1e9..03d4c5c05d8 100644
--- a/pkgs/development/python-modules/maison/default.nix
+++ b/pkgs/development/python-modules/maison/default.nix
@@ -11,16 +11,16 @@
 
 buildPythonPackage rec {
   pname = "maison";
-  version = "1.4.0";
-  format = "pyproject";
+  version = "1.4.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "dbatten5";
-    repo = pname;
+    repo = "maison";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ny/n1vDWS6eA9zLIB0os5zrbwvutb+7sQ6iPXeid1M0=";
+    hash = "sha256-uJW+7+cIt+jnbiC+HvT7KzyNk1enEtELTxtfc4eXAPU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mechanize/default.nix b/pkgs/development/python-modules/mechanize/default.nix
index 3060c2f4607..0f89f3f4252 100644
--- a/pkgs/development/python-modules/mechanize/default.nix
+++ b/pkgs/development/python-modules/mechanize/default.nix
@@ -2,25 +2,56 @@
 , buildPythonPackage
 , fetchPypi
 , html5lib
+, pytestCheckHook
+, pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "mechanize";
-  version = "0.4.8";
+  version = "0.4.9";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XoasB3c1fgBusEzSj37Z+BHUjf+mA9OJGsbSuSKA3JE=";
+    hash = "sha256-aaXtsJYvkh6LEINzaMIkLYrQSfC5H/aZzn9gG/xDFSE=";
   };
 
-  propagatedBuildInputs = [ html5lib ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    html5lib
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
 
-  doCheck = false;
+  pythonImportsCheck = [
+    "mechanize"
+  ];
+
+  disabledTestPaths = [
+    # Tests require network access
+    "test/test_urllib2_localnet.py"
+    "test/test_functional.py"
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "test_pickling"
+    "test_password_manager"
+  ];
 
   meta = with lib; {
     description = "Stateful programmatic web browsing in Python";
     homepage = "https://github.com/python-mechanize/mechanize";
-    license = "BSD-style";
+    changelog = "https://github.com/python-mechanize/mechanize/blob/v${version}/ChangeLog";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
   };
-
 }
diff --git a/pkgs/development/python-modules/omemo-dr/default.nix b/pkgs/development/python-modules/omemo-dr/default.nix
index 39adbdc7cc3..03850fc8cca 100644
--- a/pkgs/development/python-modules/omemo-dr/default.nix
+++ b/pkgs/development/python-modules/omemo-dr/default.nix
@@ -1,22 +1,47 @@
-{ lib, buildPythonPackage, fetchPypi, cryptography, protobuf }:
+{ lib
+, buildPythonPackage
+, cryptography
+, fetchPypi
+, protobuf
+, pytestCheckHook
+, pythonOlder
+, setuptools
+}:
 
 buildPythonPackage rec {
   pname = "omemo-dr";
-  version = "1.0.0";
+  version = "1.0.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-sP5QI+lHoXt0D7ftSqJGEg1vIdgZtYEulN/JVwUgvmE=";
+    hash = "sha256-KoqMdyMdc5Sb3TdSeNTVomElK9ruUstiQayyUcIC02E=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     cryptography
     protobuf
   ];
 
-  meta = {
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "omemo_dr"
+  ];
+
+  meta = with lib; {
     description = "OMEMO Double Ratchet";
-    license = lib.licenses.lgpl3;
     homepage = "https://dev.gajim.org/gajim/omemo-dr/";
+    changelog = "https://dev.gajim.org/gajim/omemo-dr/-/blob/v${version}/CHANGELOG.md";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/omrdatasettools/default.nix b/pkgs/development/python-modules/omrdatasettools/default.nix
index 4448a686e1a..45c6ee0a90e 100644
--- a/pkgs/development/python-modules/omrdatasettools/default.nix
+++ b/pkgs/development/python-modules/omrdatasettools/default.nix
@@ -20,11 +20,11 @@
 
 buildPythonPackage rec {
   pname = "omrdatasettools";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0cdq02jp8vh78yjq9bncjjl0pb554idrcxkd62rzwk4l6ss2fkw5";
+    sha256 = "sha256-kUUcbti29uDnSEvCubMAUnptlaZGpEsW2IBGSAGnGyQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyatmo/default.nix b/pkgs/development/python-modules/pyatmo/default.nix
index 92ccf8e071b..5c37066ae9d 100644
--- a/pkgs/development/python-modules/pyatmo/default.nix
+++ b/pkgs/development/python-modules/pyatmo/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyatmo";
-  version = "7.5.0";
+  version = "7.6.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "jabesq";
     repo = "pyatmo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-GucatimZTg0Fggrz4bG1x6YSa3wE/uLGB4ufil/km3w=";
+    hash = "sha256-rAmSxayXljOJchiMtSOgnotzQmapK2n86HwNi9HJX68=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/python-jenkins/default.nix b/pkgs/development/python-modules/python-jenkins/default.nix
index 674ca539c70..e4ff8f1e7e5 100644
--- a/pkgs/development/python-modules/python-jenkins/default.nix
+++ b/pkgs/development/python-modules/python-jenkins/default.nix
@@ -18,11 +18,11 @@
 
 buildPythonPackage rec {
   pname = "python-jenkins";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/18dklOdkD+GmwLq8rExREfm1tePdn7c/dkpZ9UyucY=";
+    hash = "sha256-VufauwYHvbjh1vxtLUMBq+2+2RZdorIG+svTBxy27ss=";
   };
 
   # test uses timeout mechanism unsafe for use with the "spawn"
diff --git a/pkgs/development/python-modules/python-telegram/default.nix b/pkgs/development/python-modules/python-telegram/default.nix
index 405f74bebda..50a14d6ccc2 100644
--- a/pkgs/development/python-modules/python-telegram/default.nix
+++ b/pkgs/development/python-modules/python-telegram/default.nix
@@ -1,11 +1,12 @@
 { lib
 , stdenv
-, fetchpatch
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , pythonOlder
 , setuptools
 , tdlib
+, telegram-text
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -13,30 +14,33 @@ buildPythonPackage rec {
   version = "0.18.0";
   disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-UbJW/op01qe/HchfJUlBPBY9/W8NbZkEmFM8gZ5+EmI=";
+  src = fetchFromGitHub {
+    owner = "alexander-akhmetov";
+    repo = "python-telegram";
+    rev = version;
+    hash = "sha256-2Q0nUZ2TMVWznd05+fqYojkRn4xfFZJrlqb1PMuBsAY=";
   };
 
-  patches = [
-    # Search for the system library first, and fallback to the embedded one if the system was not found
-    (fetchpatch {
-      url = "https://github.com/alexander-akhmetov/python-telegram/commit/b0af0985910ebb8940cff1b92961387aad683287.patch";
-      hash = "sha256-ZqsntaiC2y9l034gXDMeD2BLO/RcsbBII8FomZ65/24=";
-    })
-  ];
-
   postPatch = ''
     # Remove bundled libtdjson
     rm -fr telegram/lib
 
     substituteInPlace telegram/tdjson.py \
-      --replace "ctypes.util.find_library(\"libtdjson\")" \
+      --replace "ctypes.util.find_library(\"tdjson\")" \
                 "\"${tdlib}/lib/libtdjson${stdenv.hostPlatform.extensions.sharedLibrary}\""
   '';
 
   propagatedBuildInputs = [
     setuptools
+    telegram-text
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    "TestGetTdjsonTdlibPath"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/scikit-rf/default.nix b/pkgs/development/python-modules/scikit-rf/default.nix
index 130e56896e3..a2cf6d82a35 100644
--- a/pkgs/development/python-modules/scikit-rf/default.nix
+++ b/pkgs/development/python-modules/scikit-rf/default.nix
@@ -27,12 +27,13 @@
 , setuptools
 , pytestCheckHook
 , pytest-cov
+, pytest-mock
 }:
 
 buildPythonPackage rec {
   pname = "scikit-rf";
-  version = "0.29.0";
-  format = "pyproject";
+  version = "0.29.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -40,7 +41,7 @@ buildPythonPackage rec {
     owner = "scikit-rf";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-rBOw1rIEF8Ia6xXlXxVzRRiUxrOjOAlipFuKiL+gRl0=";
+    hash = "sha256-sLE6rcBGUKmk5y7oO06rHON3GVIjcvnKlr6Tgddj64Y=";
   };
 
   buildInputs = [
@@ -88,6 +89,7 @@ buildPythonPackage rec {
     coverage
     flake8
     pytest-cov
+    pytest-mock
     nbval
     matplotlib
     pyvisa
@@ -99,6 +101,12 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  # test_calibration.py generates a divide by zero error on darwin
+  # https://github.com/scikit-rf/scikit-rf/issues/972
+  disabledTestPaths =
+    lib.optional (stdenv.isAarch64 && stdenv.isDarwin)
+    "skrf/calibration/tests/test_calibration.py";
+
   pythonImportsCheck = [
     "skrf"
   ];
diff --git a/pkgs/development/python-modules/tabula-py/default.nix b/pkgs/development/python-modules/tabula-py/default.nix
index b985ebf8d89..2bacc67690f 100644
--- a/pkgs/development/python-modules/tabula-py/default.nix
+++ b/pkgs/development/python-modules/tabula-py/default.nix
@@ -7,13 +7,14 @@
 , pandas
 , pytestCheckHook
 , pythonOlder
-, setuptools-scm
 , setuptools
+, setuptools-scm
+, jpype1
 }:
 
 buildPythonPackage rec {
   pname = "tabula-py";
-  version = "2.8.1";
+  version = "2.8.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,28 +23,30 @@ buildPythonPackage rec {
     owner = "chezou";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-QqTfbSwGaNRXBiAzB1fsEawxCvlIunB1j2jSFD9imPI=";
+    hash = "sha256-Zrq1i+HYXXNulyZ/fv00AgVd7ODj3rP9orLq5rT3ERU=";
   };
 
-  patches = [
-    ./java-interpreter-path.patch
-  ];
-
   postPatch = ''
-    sed -i 's|@JAVA@|${jre}/bin/java|g' $(find -name '*.py')
+    substituteInPlace tabula/backend.py \
+      --replace '"java"' '"${lib.getExe jre}"'
   '';
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   nativeBuildInputs = [
+    setuptools
     setuptools-scm
   ];
 
+  buildInputs = [
+    jre
+  ];
+
   propagatedBuildInputs = [
     distro
     numpy
     pandas
-    setuptools
+    jpype1
   ];
 
   nativeCheckInputs = [
@@ -60,6 +63,11 @@ buildPythonPackage rec {
     "test_read_pdf_with_remote_template"
     "test_read_remote_pdf"
     "test_read_remote_pdf_with_custom_user_agent"
+    # not sure what it checks
+    # probably related to jpype, but we use subprocess instead
+    # https://github.com/chezou/tabula-py/issues/352#issuecomment-1730791540
+    # Failed: DID NOT RAISE <class 'RuntimeError'>
+    "test_read_pdf_with_silent_true"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/tabula-py/java-interpreter-path.patch b/pkgs/development/python-modules/tabula-py/java-interpreter-path.patch
deleted file mode 100644
index fcd03628794..00000000000
--- a/pkgs/development/python-modules/tabula-py/java-interpreter-path.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-diff -ru origsource/tabula/io.py source/tabula/io.py
---- origsource/tabula/io.py	2022-11-23 17:19:35.419837514 +0100
-+++ source/tabula/io.py	2022-11-23 17:22:08.204194807 +0100
-@@ -79,7 +79,7 @@
-             )
-         )
- 
--    args = ["java"] + java_options + ["-jar", _jar_path()] + options.build_option_list()
-+    args = ["@JAVA@"] + java_options + ["-jar", _jar_path()] + options.build_option_list()
-     if path:
-         args.append(path)
- 
-diff -ru origsource/tabula/util.py source/tabula/util.py
---- origsource/tabula/util.py	2022-11-23 17:19:35.422837521 +0100
-+++ source/tabula/util.py	2022-11-23 17:21:41.514132392 +0100
-@@ -26,7 +26,7 @@
- 
-     try:
-         res = subprocess.check_output(
--            ["java", "-version"], stderr=subprocess.STDOUT
-+            ["@JAVA@", "-version"], stderr=subprocess.STDOUT
-         ).decode()
- 
-     except FileNotFoundError:
-diff -ru origsource/tests/test_read_pdf_table.py source/tests/test_read_pdf_table.py
---- origsource/tests/test_read_pdf_table.py	2022-11-23 17:19:35.422837521 +0100
-+++ source/tests/test_read_pdf_table.py	2022-11-23 17:21:22.008086776 +0100
-@@ -281,7 +281,7 @@
- 
-         tabula.read_pdf(self.pdf_path, encoding="utf-8")
- 
--        target_args = ["java"]
-+        target_args = ["@JAVA@"]
-         if platform.system() == "Darwin":
-             target_args += ["-Djava.awt.headless=true"]
-         target_args += [
-@@ -355,7 +355,7 @@
- 
-         tabula.read_pdf(self.pdf_path, encoding="utf-8", silent=False)
- 
--        target_args = ["java"]
-+        target_args = ["@JAVA@"]
-         if platform.system() == "Darwin":
-             target_args += ["-Djava.awt.headless=true"]
-         target_args += [
-@@ -382,7 +382,7 @@
- 
-         tabula.read_pdf(self.pdf_path, encoding="utf-8", silent=True)
- 
--        target_args = ["java"]
-+        target_args = ["@JAVA@"]
-         if platform.system() == "Darwin":
-             target_args += ["-Djava.awt.headless=true"]
-         target_args += [
diff --git a/pkgs/development/python-modules/tailscale/default.nix b/pkgs/development/python-modules/tailscale/default.nix
index 806da0dc3e4..c146c7fd9bd 100644
--- a/pkgs/development/python-modules/tailscale/default.nix
+++ b/pkgs/development/python-modules/tailscale/default.nix
@@ -3,8 +3,9 @@
 , aresponses
 , buildPythonPackage
 , fetchFromGitHub
+, mashumaro
+, orjson
 , poetry-core
-, pydantic
 , pytest-asyncio
 , pytestCheckHook
 , pythonOlder
@@ -13,22 +14,22 @@
 
 buildPythonPackage rec {
   pname = "tailscale";
-  version = "0.3.0";
+  version = "0.6.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-tailscale";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gGDsVGsCBZi/pxD0cyH3+xrvHVBC+wJCcl/NGqsTqiE=";
+    hash = "sha256-wO6yMMU5fxk8GQ0e4ZCse2atlR4wrzulZOFXkVKAsmU=";
   };
 
   postPatch = ''
     # Upstream doesn't set a version for the pyproject.toml
     substituteInPlace pyproject.toml \
-      --replace "0.0.0" "${version}" \
+      --replace 'version = "0.0.0"' 'version = "${version}"' \
       --replace "--cov" ""
   '';
 
@@ -38,7 +39,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
-    pydantic
+    mashumaro
+    orjson
     yarl
   ];
 
diff --git a/pkgs/development/python-modules/telegram-text/default.nix b/pkgs/development/python-modules/telegram-text/default.nix
new file mode 100644
index 00000000000..b79cd78bf4b
--- /dev/null
+++ b/pkgs/development/python-modules/telegram-text/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, poetry-core
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "telegram-text";
+  version = "0.1.2";
+  pyproject = true;
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "SKY-ALIN";
+    repo = "telegram-text";
+    rev = "v${version}";
+    hash = "sha256-p8SVQq7IvkVuOFE8VDugROLY5Wk0L2HmXyacTzFFSP4=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Python markup module for Telegram messenger";
+    downloadPage = "https://github.com/SKY-ALIN/telegram-text";
+    homepage = "https://telegram-text.alinsky.tech/";
+    changelog = "https://github.com/SKY-ALIN/telegram-text/blob/v${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sikmir ];
+  };
+}
diff --git a/pkgs/development/python-modules/ulid-transform/default.nix b/pkgs/development/python-modules/ulid-transform/default.nix
index 77c4b099687..95b765bd3e6 100644
--- a/pkgs/development/python-modules/ulid-transform/default.nix
+++ b/pkgs/development/python-modules/ulid-transform/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "ulid-transform";
-  version = "0.8.1";
+  version = "0.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "bdraco";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-isngr9CZ2YYuq+5s3p4HXrTU20vPqZGZ1r8mBoVkxiI=";
+    hash = "sha256-r9uxPXpmQSsL1rX4d9TH87olFbZugdGdNG++Ygjie1I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wfuzz/default.nix b/pkgs/development/python-modules/wfuzz/default.nix
index 1304b6c1dd7..1bc512398bd 100644
--- a/pkgs/development/python-modules/wfuzz/default.nix
+++ b/pkgs/development/python-modules/wfuzz/default.nix
@@ -63,6 +63,11 @@ buildPythonPackage rec {
     "wfuzz"
   ];
 
+  postInstall = ''
+    mkdir -p $out/share/wordlists/wfuzz
+    cp -R -T "wordlist" "$out/share/wordlists/wfuzz"
+  '';
+
   meta = with lib; {
     description = "Web content fuzzer to facilitate web applications assessments";
     longDescription = ''
diff --git a/pkgs/development/skaware-packages/skalibs/default.nix b/pkgs/development/skaware-packages/skalibs/default.nix
index 7b035eee57f..80db4b62482 100644
--- a/pkgs/development/skaware-packages/skalibs/default.nix
+++ b/pkgs/development/skaware-packages/skalibs/default.nix
@@ -1,4 +1,8 @@
-{ skawarePackages, pkgs }:
+{ lib
+, stdenv
+, skawarePackages
+, pkgs
+}:
 
 with skawarePackages;
 
@@ -21,6 +25,17 @@ buildPackage {
     # Empty the default path, which would be "/usr/bin:bin".
     # It would be set when PATH is empty. This hurts hermeticity.
     "--with-default-path="
+
+  ] ++ lib.optionals (stdenv.buildPlatform.config != stdenv.hostPlatform.config) [
+    # ./configure: sysdep posixspawnearlyreturn cannot be autodetected
+    # when cross-compiling. Please manually provide a value with the
+    # --with-sysdep-posixspawnearlyreturn=yes|no|... option.
+    #
+    # posixspawnearlyreturn: `yes` if the target has a broken
+    # `posix_spawn()` implementation that can return before the
+    # child has successfully exec'ed. That happens with old glibcs
+    # and some virtual platforms.
+    "--with-sysdep-posixspawnearlyreturn=no"
   ];
 
   postInstall = ''
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
index 8fb37a9f666..de82eb54eb9 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_6/default.nix
@@ -22,6 +22,7 @@
 , file
 , substituteAll
 , writeTextFile
+, writeShellApplication
 }:
 
 let
@@ -128,6 +129,16 @@ let
 
   defaultShellPath = lib.makeBinPath defaultShellUtils;
 
+  bashWithDefaultShellUtils = writeShellApplication {
+    name = "bash";
+    text = ''
+      if [[ "$PATH" == "/no-such-path" ]]; then
+        export PATH=${defaultShellPath}
+      fi
+      exec ${bash}/bin/bash "$@"
+    '';
+  };
+
   platforms = lib.platforms.linux ++ lib.platforms.darwin;
 
   system = if stdenv.hostPlatform.isDarwin then "darwin" else "linux";
@@ -420,8 +431,8 @@ stdenv.mkDerivation rec {
         # If you add more replacements here, you must change the grep above!
         # Only files containing /bin are taken into account.
         substituteInPlace "$path" \
-          --replace /bin/bash ${bash}/bin/bash \
-          --replace "/usr/bin/env bash" ${bash}/bin/bash \
+          --replace /bin/bash ${bashWithDefaultShellUtils}/bin/bash \
+          --replace "/usr/bin/env bash" ${bashWithDefaultShellUtils}/bin/bash \
           --replace "/usr/bin/env python" ${python3}/bin/python \
           --replace /usr/bin/env ${coreutils}/bin/env \
           --replace /bin/true ${coreutils}/bin/true
@@ -436,17 +447,17 @@ stdenv.mkDerivation rec {
 
       # bazel test runner include references to /bin/bash
       substituteInPlace tools/build_rules/test_rules.bzl \
-        --replace /bin/bash ${bash}/bin/bash
+        --replace /bin/bash ${bashWithDefaultShellUtils}/bin/bash
 
       for i in $(find tools/cpp/ -type f)
       do
         substituteInPlace $i \
-          --replace /bin/bash ${bash}/bin/bash
+          --replace /bin/bash ${bashWithDefaultShellUtils}/bin/bash
       done
 
       # Fixup scripts that generate scripts. Not fixed up by patchShebangs below.
       substituteInPlace scripts/bootstrap/compile.sh \
-          --replace /bin/bash ${bash}/bin/bash
+          --replace /bin/bash ${bashWithDefaultShellUtils}/bin/bash
 
       # add nix environment vars to .bazelrc
       cat >> .bazelrc <<EOF
diff --git a/pkgs/development/tools/rust/cargo-update/default.nix b/pkgs/development/tools/rust/cargo-update/default.nix
index 2660bc5d235..99c10f7d21f 100644
--- a/pkgs/development/tools/rust/cargo-update/default.nix
+++ b/pkgs/development/tools/rust/cargo-update/default.nix
@@ -16,14 +16,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-update";
-  version = "13.1.0";
+  version = "13.2.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-2j35R7QTn7Z3yqzOU+VWAoZfYodecDt45Plx/D7+GyU=";
+    sha256 = "sha256-yMHGn/RPtYuxS3rHzm87mW7nBUEaSOGsCT7Ckxvhabk=";
   };
 
-  cargoHash = "sha256-OEv9LOep4YNWY7oixY5zD9QgxqSYTrcf5oSXpxvnKIs=";
+  cargoHash = "sha256-hO2W0NRV9fGHnnS1kOkQ+e0sFzVSBQk3MOm8qDYbA00=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/tools/viceroy/default.nix b/pkgs/development/tools/viceroy/default.nix
index eeccc89a7b1..2f3bfbe8c2c 100644
--- a/pkgs/development/tools/viceroy/default.nix
+++ b/pkgs/development/tools/viceroy/default.nix
@@ -2,18 +2,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "viceroy";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-vMyNsLXMJk8MTiZYRiGQpOLZfeJbKlYcG1U8xTQIty0=";
+    hash = "sha256-LOm4d6SV5rlb7NovhSp7V0JIaOfHIZOqeIcpIvTsZsA=";
   };
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
-  cargoHash = "sha256-+v2P9ISSA7Xy5fTjfVNETAStPo19dLxv5K57MC/GU4E=";
+  cargoHash = "sha256-Pz+jA4uC/40mj5Jn/lB+XcoN/QSD23iLwsEowTUI0pg=";
 
   cargoTestFlags = [
     "--package viceroy-lib"
diff --git a/pkgs/development/tools/yarn-berry/default.nix b/pkgs/development/tools/yarn-berry/default.nix
index b8181e812fc..e9ae6ef416a 100644
--- a/pkgs/development/tools/yarn-berry/default.nix
+++ b/pkgs/development/tools/yarn-berry/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "yarn-berry";
-  version = "3.4.1";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "yarnpkg";
     repo = "berry";
     rev = "@yarnpkg/cli/${version}";
-    hash = "sha256-eBBB/F+mnGi93Qf23xgt306/ogoV76RXOM90O14u5Tw=";
+    hash = "sha256-9QNeXamNqRx+Bfg8nAhnImPuNFyqrHIs1eF9prSwIR4=";
   };
 
   buildInputs = [
@@ -33,11 +33,11 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-   meta = with lib; {
+  meta = with lib; {
     homepage = "https://yarnpkg.com/";
     description = "Fast, reliable, and secure dependency management.";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ ryota-ka ];
+    maintainers = with maintainers; [ ryota-ka thehedgeh0g ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/games/anki/bin.nix b/pkgs/games/anki/bin.nix
index d633c594d87..7404be23bc6 100644
--- a/pkgs/games/anki/bin.nix
+++ b/pkgs/games/anki/bin.nix
@@ -3,22 +3,22 @@
 let
   pname = "anki-bin";
   # Update hashes for both Linux and Darwin!
-  version = "23.10";
+  version = "23.10.1";
 
   sources = {
     linux = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-qt6.tar.zst";
-      sha256 = "sha256-dfL95UKu6kwD4WHLtXlIdkf5UItEtW2WCAKP7YGlCtc=";
+      sha256 = "sha256-Kv0SH+bLnBSM/tYHe2kEJc4n7izZTBNWQs2nm/teLEU=";
     };
 
     # For some reason anki distributes completely separate dmg-files for the aarch64 version and the x86_64 version
     darwin-x86_64 = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-intel-qt6.dmg";
-      sha256 = "sha256-Y8BZ7EA6Dn4+5kMCFyuXi17XDLn9YRxqVGautt9WUOo=";
+      sha256 = "sha256-MSlKsEv4N/H7G1bUOBlPBXerpHIW32P6Va02aRq1+54=";
     };
     darwin-aarch64 = fetchurl {
       url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-apple-qt6.dmg";
-      sha256 = "sha256-IrKWJ16gMCR2MH8dgYUCtMj6mDQP18+HQr17hfekPIs=";
+      sha256 = "sha256-jEm9WJBXx77KpldzBuxK1Pu6VGiARZPnRmMhEjZdm1I=";
     };
   };
 
@@ -45,7 +45,7 @@ let
   meta = with lib; {
     inherit (anki.meta) license homepage description longDescription;
     platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ];
-    maintainers = with maintainers; [ mahmoudk1000 atemu ];
+    maintainers = with maintainers; [ mahmoudk1000 ];
   };
 
   passthru = { inherit sources; };
diff --git a/pkgs/servers/dns/pdns-recursor/default.nix b/pkgs/servers/dns/pdns-recursor/default.nix
index 0c714cce59c..5ff385cf65a 100644
--- a/pkgs/servers/dns/pdns-recursor/default.nix
+++ b/pkgs/servers/dns/pdns-recursor/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pdns-recursor";
-  version = "4.9.1";
+  version = "4.9.2";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${version}.tar.bz2";
-    sha256 = "sha256-Ch7cE+jyvWYfOeMWOH2UHiLeagO4p6L8Zi/fi5Quor4=";
+    sha256 = "sha256-TLgYBFjs+1KKPZo0uihEts0u1pyhxGHd4koOvWaCkUQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/servers/home-assistant/build-custom-component/check_manifest.py b/pkgs/servers/home-assistant/build-custom-component/check_manifest.py
new file mode 100644
index 00000000000..bbe9535824e
--- /dev/null
+++ b/pkgs/servers/home-assistant/build-custom-component/check_manifest.py
@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+
+import json
+import importlib_metadata
+import sys
+
+from packaging.requirements import Requirement
+
+
+def check_requirement(req: str):
+    # https://packaging.pypa.io/en/stable/requirements.html
+    requirement = Requirement(req)
+    try:
+        version = importlib_metadata.distribution(requirement.name).version
+    except importlib_metadata.PackageNotFoundError:
+        print(f"  - Dependency {requirement.name} is missing", file=sys.stderr)
+        return False
+
+    # https://packaging.pypa.io/en/stable/specifiers.html
+    if not version in requirement.specifier:
+        print(
+            f"  - {requirement.name}{requirement.specifier} expected, but got {version}",
+            file=sys.stderr,
+        )
+        return False
+
+    return True
+
+
+def check_manifest(manifest_file: str):
+    with open(manifest_file) as fd:
+        manifest = json.load(fd)
+    if "requirements" in manifest:
+        ok = True
+        for requirement in manifest["requirements"]:
+            ok &= check_requirement(requirement)
+        if not ok:
+            print("Manifest requirements are not met", file=sys.stderr)
+            sys.exit(1)
+
+
+if __name__ == "__main__":
+    if len(sys.argv) < 2:
+        raise RuntimeError(f"Usage {sys.argv[0]} <manifest>")
+    manifest_file = sys.argv[1]
+    check_manifest(manifest_file)
diff --git a/pkgs/servers/home-assistant/build-custom-component/default.nix b/pkgs/servers/home-assistant/build-custom-component/default.nix
new file mode 100644
index 00000000000..05b7c2d4b03
--- /dev/null
+++ b/pkgs/servers/home-assistant/build-custom-component/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, home-assistant
+, makeSetupHook
+}:
+
+{ pname
+, version
+, format ? "other"
+, ...
+}@args:
+
+let
+  manifestRequirementsCheckHook = import ./manifest-requirements-check-hook.nix {
+    inherit makeSetupHook;
+    inherit (home-assistant) python;
+  };
+in
+home-assistant.python.pkgs.buildPythonPackage (
+  {
+    inherit format;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir $out
+      cp -r $src/custom_components/ $out/
+
+      runHook postInstall
+    '';
+
+    nativeCheckInputs = with home-assistant.python.pkgs; [
+      importlib-metadata
+      manifestRequirementsCheckHook
+      packaging
+    ] ++ (args.nativeCheckInputs or []);
+
+  } // builtins.removeAttrs args [ "nativeCheckInputs" ]
+)
diff --git a/pkgs/servers/home-assistant/build-custom-component/manifest-requirements-check-hook.nix b/pkgs/servers/home-assistant/build-custom-component/manifest-requirements-check-hook.nix
new file mode 100644
index 00000000000..76317c9d0bc
--- /dev/null
+++ b/pkgs/servers/home-assistant/build-custom-component/manifest-requirements-check-hook.nix
@@ -0,0 +1,11 @@
+{ python
+, makeSetupHook
+}:
+
+makeSetupHook {
+  name = "manifest-requirements-check-hook";
+  substitutions = {
+    pythonCheckInterpreter = python.interpreter;
+    checkManifest = ./check_manifest.py;
+  };
+} ./manifest-requirements-check-hook.sh
diff --git a/pkgs/servers/home-assistant/build-custom-component/manifest-requirements-check-hook.sh b/pkgs/servers/home-assistant/build-custom-component/manifest-requirements-check-hook.sh
new file mode 100644
index 00000000000..74f29ca399e
--- /dev/null
+++ b/pkgs/servers/home-assistant/build-custom-component/manifest-requirements-check-hook.sh
@@ -0,0 +1,25 @@
+# Setup hook to check HA manifest requirements
+echo "Sourcing manifest-requirements-check-hook"
+
+function manifestCheckPhase() {
+    echo "Executing manifestCheckPhase"
+    runHook preCheck
+
+    manifests=$(shopt -s nullglob; echo $out/custom_components/*/manifest.json)
+
+    if [ ! -z "$manifests" ]; then
+        echo Checking manifests $manifests
+        @pythonCheckInterpreter@ @checkManifest@ $manifests
+    else
+        echo "No custom component manifests found in $out" >&2
+        exit 1
+    fi
+
+    runHook postCheck
+    echo "Finished executing manifestCheckPhase"
+}
+
+if [ -z "${dontCheckManifest-}" ] && [ -z "${installCheckPhase-}" ]; then
+    echo "Using manifestCheckPhase"
+    preDistPhases+=" manifestCheckPhase"
+fi
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 271ed97c857..7b856c0b253 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,12 +2,13 @@
 # Do not edit!
 
 {
-  version = "2023.11.1";
+  version = "2023.11.2";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
     "abode" = ps: with ps; [
       jaraco-abode
+      jaraco-functools
     ];
     "accuweather" = ps: with ps; [
       accuweather
diff --git a/pkgs/servers/home-assistant/custom-components/README.md b/pkgs/servers/home-assistant/custom-components/README.md
new file mode 100644
index 00000000000..a7244b25c17
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/README.md
@@ -0,0 +1,57 @@
+# Packaging guidelines
+
+## buildHomeAssistantComponent
+
+Custom components should be packaged using the
+ `buildHomeAssistantComponent` function, that is provided at top-level.
+It builds upon `buildPythonPackage` but uses a custom install and check
+phase.
+
+Python runtime dependencies can be directly consumed as unqualified
+function arguments. Pass them into `propagatedBuildInputs`, for them to
+be available to Home Assistant.
+
+Out-of-tree components need to use python packages from
+`home-assistant.python.pkgs` as to not introduce conflicting package
+versions into the Python environment.
+
+
+**Example Boilerplate:**
+
+```nix
+{ lib
+, buildHomeAssistantcomponent
+, fetchFromGitHub
+}:
+
+buildHomeAssistantComponent {
+  # pname, version
+
+  src = fetchFromGithub {
+    # owner, repo, rev, hash
+  };
+
+  propagatedBuildInputs = [
+    # python requirements, as specified in manifest.json
+  ];
+
+  meta = with lib; {
+    # changelog, description, homepage, license, maintainers
+  }
+}
+
+## Package name normalization
+
+Apply the same normalization rules as defined for python packages in
+[PEP503](https://peps.python.org/pep-0503/#normalized-names).
+The name should be lowercased and dots, underlines or multiple
+dashes should all be replaced by a single dash.
+
+## Manifest check
+
+The `buildHomeAssistantComponent` builder uses a hook to check whether
+the dependencies specified in the `manifest.json` are present and
+inside the specified version range.
+
+There shouldn't be a need to disable this hook, but you can set
+`dontCheckManifest` to `true` in the derivation to achieve that.
diff --git a/pkgs/servers/home-assistant/custom-components/default.nix b/pkgs/servers/home-assistant/custom-components/default.nix
new file mode 100644
index 00000000000..4a96b305964
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/default.nix
@@ -0,0 +1,6 @@
+{ callPackage
+}:
+
+{
+  prometheus-sensor = callPackage ./prometheus-sensor {};
+}
diff --git a/pkgs/servers/home-assistant/custom-components/prometheus-sensor/default.nix b/pkgs/servers/home-assistant/custom-components/prometheus-sensor/default.nix
new file mode 100644
index 00000000000..07bcd9abec1
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-components/prometheus-sensor/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, fetchFromGitHub
+, buildHomeAssistantComponent
+}:
+
+buildHomeAssistantComponent rec {
+  pname = "prometheus-sensor";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "mweinelt";
+    repo = "ha-prometheus-sensor";
+    rev = "refs/tags/${version}";
+    hash = "sha256-10COLFXvmpm8ONLyx5c0yiQdtuP0SC2NKq/ZYHro9II=";
+  };
+
+  dontBuild = true;
+
+  meta = with lib; {
+    changelog = "https://github.com/mweinelt/ha-prometheus-sensor/blob/${version}/CHANGELOG.md";
+    description = "Import prometheus query results into Home Assistant";
+    homepage = "https://github.com/mweinelt/ha-prometheus-sensor";
+    maintainers = with maintainers; [ hexa ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/README.md b/pkgs/servers/home-assistant/custom-lovelace-modules/README.md
new file mode 100644
index 00000000000..b67fd0fb91d
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/README.md
@@ -0,0 +1,13 @@
+# Packaging guidelines
+
+## Entrypoint
+
+Every lovelace module has an entrypoint in the form of a `.js` file. By
+default the nixos module will try to load `${pname}.js` when a module is
+configured.
+
+The entrypoint used can be overridden in `passthru` like this:
+
+```nix
+passthru.entrypoint = "demo-card-bundle.js";
+```
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/default.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/default.nix
new file mode 100644
index 00000000000..4bb1e63b5f7
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/default.nix
@@ -0,0 +1,8 @@
+{ callPackage
+}:
+
+{
+  mini-graph-card = callPackage ./mini-graph-card {};
+
+  mini-media-player = callPackage ./mini-media-player {};
+}
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/mini-graph-card/default.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/mini-graph-card/default.nix
new file mode 100644
index 00000000000..60942d5f4ed
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/mini-graph-card/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "mini-graph-card";
+  version = "0.11.0";
+
+  src = fetchFromGitHub {
+    owner = "kalkih";
+    repo = "mini-graph-card";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-AC4VawRtWTeHbFqDJ6oQchvUu08b4F3ManiPPXpyGPc=";
+  };
+
+  npmDepsHash = "sha256-0ErOTkcCnMqMTsTkVL320SxZaET/izFj9GiNWC2tQtQ=";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp -v dist/mini-graph-card-bundle.js $out/
+
+    runHook postInstall
+  '';
+
+  passthru.entrypoint = "mini-graph-card-bundle.js";
+
+  meta = with lib; {
+    changelog = "https://github.com/kalkih/mini-graph-card/releases/tag/v${version}";
+    description = "Minimalistic graph card for Home Assistant Lovelace UI";
+    homepage = "https://github.com/kalkih/mini-graph-card";
+    maintainers = with maintainers; [ hexa ];
+    license = licenses.mit;
+  };
+}
+
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/mini-media-player/default.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/mini-media-player/default.nix
new file mode 100644
index 00000000000..6945b18bde2
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/mini-media-player/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+}:
+
+buildNpmPackage rec {
+  pname = "mini-media-player";
+  version = "1.16.5";
+
+  src = fetchFromGitHub {
+    owner = "kalkih";
+    repo = "mini-media-player";
+    rev = "v${version}";
+    hash = "sha256-ydkY7Qx2GMh4CpvvBAQubJ7PlxSscDZRJayn82bOczM=";
+  };
+
+  npmDepsHash = "sha256-v9NvZOrQPMOoG3LKACnu79jKgZtcnGiopWad+dFbplw=";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp -v ./dist/mini-media-player-bundle.js $out/
+
+    runHook postInstall
+  '';
+
+  passthru.entrypoint = "mini-media-player-bundle.js";
+
+  meta = with lib; {
+    changelog = "https://github.com/kalkih/mini-media-player/releases/tag/v${version}";
+    description = "Minimalistic media card for Home Assistant Lovelace UI";
+    homepage = "https://github.com/kalkih/mini-media-player";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 755409e1db2..533e0e631ba 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -3,7 +3,6 @@
 , callPackage
 , fetchFromGitHub
 , fetchPypi
-, fetchpatch
 , python311
 , substituteAll
 , ffmpeg-headless
@@ -193,6 +192,15 @@ let
         };
       });
 
+      psutil = super.psutil.overridePythonAttrs (oldAttrs: rec {
+        version = "5.9.6";
+        src = fetchPypi {
+          pname = "psutil";
+          inherit version;
+          hash = "sha256-5Lkt3NfdTN0/kAGA6h4QSTLHvOI0+4iXbio7KWRBIlo=";
+        };
+      });
+
       py-synologydsm-api = super.py-synologydsm-api.overridePythonAttrs (oldAttrs: rec {
         version = "2.1.4";
         src = fetchFromGitHub {
@@ -310,17 +318,6 @@ let
         doCheck = false;
       });
 
-      # Pinned due to API changes in 0.3.0
-      tailscale = super.tailscale.overridePythonAttrs (oldAttrs: rec {
-        version = "0.2.0";
-        src = fetchFromGitHub {
-          owner = "frenck";
-          repo = "python-tailscale";
-          rev = "refs/tags/v${version}";
-          hash = "sha256-/tS9ZMUWsj42n3MYPZJYJELzX3h02AIHeRZmD2SuwWE=";
-        };
-      });
-
       # Pinned due to API changes ~1.0
       vultr = super.vultr.overridePythonAttrs (oldAttrs: rec {
         version = "0.1.2";
@@ -356,7 +353,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.11.1";
+  hassVersion = "2023.11.2";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -372,7 +369,7 @@ in python.pkgs.buildPythonApplication rec {
   # Primary source is the pypi sdist, because it contains translations
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4OIvY6blun++7JDY+B0Cjrr4yNgnjTd8G55SWkhS3Cs=";
+    hash = "sha256-cnneRq0hIyvgKo0du/52ze0IVs8TgTPNQM3T1kyy03s=";
   };
 
   # Secondary source is git for tests
@@ -380,7 +377,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-Z/CV1sGdJsdc4OxUZulC0boHaMP7WpajbY8Y6R9Q//I=";
+    hash = "sha256-OljfYmlXSJVoWWsd4jcSF4nI/FXHqRA8e4LN5AaPVv8=";
   };
 
   nativeBuildInputs = with python.pkgs; [
@@ -396,17 +393,14 @@ in python.pkgs.buildPythonApplication rec {
 
   # leave this in, so users don't have to constantly update their downstream patch handling
   patches = [
+    # Follow symlinks in /var/lib/hass/www
+    ./patches/static-symlinks.patch
+
+    # Patch path to ffmpeg binary
     (substituteAll {
       src = ./patches/ffmpeg-path.patch;
       ffmpeg = "${lib.getBin ffmpeg-headless}/bin/ffmpeg";
     })
-    (fetchpatch {
-      # freeze time in litterrobot tests
-      # https://github.com/home-assistant/core/pull/103444
-      name = "home-assistant-litterrobot-freeze-test-time.patch";
-      url = "https://github.com/home-assistant/core/commit/806205952ff863e2cf1875be406ea0254be5f13a.patch";
-      hash = "sha256-OVbmJWy275nYWrif9awAGIYlgZqrRPcYBhB0Vil8rmk=";
-    })
   ];
 
   postPatch = let
@@ -526,6 +520,8 @@ in python.pkgs.buildPythonApplication rec {
     "--deselect=tests/helpers/test_entity_registry.py::test_get_or_create_updates_data"
     # AssertionError: assert 2 == 1
     "--deselect=tests/helpers/test_entity_values.py::test_override_single_value"
+    # AssertionError: assert 'WARNING' not in '2023-11-10 ...nt abc[L]>\n'"
+    "--deselect=tests/helpers/test_script.py::test_multiple_runs_repeat_choose"
     # tests are located in tests/
     "tests"
   ];
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index ae2ef562440..1c7bc02172b 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -4,7 +4,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20231030.1";
+  version = "20231030.2";
   format = "wheel";
 
   src = fetchPypi {
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-S363j7HnOxLqCBaml1Kb9xfY0AaqBIgj09NutByn6Xo=";
+    hash = "sha256-qzodzqWpAXZjwBJkiCyBi5zzfpEqqtauJn2PKZ5UtJ0=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/home-assistant/parse-requirements.py b/pkgs/servers/home-assistant/parse-requirements.py
index 1df4d98fb45..bb5e7099432 100755
--- a/pkgs/servers/home-assistant/parse-requirements.py
+++ b/pkgs/servers/home-assistant/parse-requirements.py
@@ -56,6 +56,15 @@ EXTRA_COMPONENT_DEPS = {
     ],
 }
 
+# Sometimes we have unstable versions for libraries that are not
+# well-maintained. This allows us to mark our weird version as newer
+# than a certain wanted version
+OUR_VERSION_IS_NEWER_THAN = {
+    "blinkstick": "1.2.0",
+    "gps3": "0.33.3",
+    "pybluez": "0.22",
+}
+
 
 
 def run_sync(cmd: List[str]) -> None:
@@ -226,7 +235,12 @@ def main() -> None:
                         Version.parse(our_version)
                     except InvalidVersion:
                         print(f"Attribute {attr_name} has invalid version specifier {our_version}", file=sys.stderr)
-                        attr_outdated = True
+
+                        # allow specifying that our unstable version is newer than some version
+                        if newer_than_version := OUR_VERSION_IS_NEWER_THAN.get(attr_name):
+                            attr_outdated = Version.parse(newer_than_version) < Version.parse(required_version)
+                        else:
+                            attr_outdated = True
                     else:
                         attr_outdated = Version.parse(our_version) < Version.parse(required_version)
                     finally:
diff --git a/pkgs/servers/home-assistant/patches/static-symlinks.patch b/pkgs/servers/home-assistant/patches/static-symlinks.patch
new file mode 100644
index 00000000000..7784a60f6b2
--- /dev/null
+++ b/pkgs/servers/home-assistant/patches/static-symlinks.patch
@@ -0,0 +1,37 @@
+diff --git a/homeassistant/components/frontend/__init__.py b/homeassistant/components/frontend/__init__.py
+index 2ec991750f..9a937006ce 100644
+--- a/homeassistant/components/frontend/__init__.py
++++ b/homeassistant/components/frontend/__init__.py
+@@ -383,7 +383,7 @@ async def async_setup(hass: HomeAssistant, config: ConfigType) -> bool:
+ 
+     local = hass.config.path("www")
+     if os.path.isdir(local):
+-        hass.http.register_static_path("/local", local, not is_dev)
++        hass.http.register_static_path("/local", local, not is_dev, follow_symlinks=True)
+ 
+     # Can be removed in 2023
+     hass.http.register_redirect("/config/server_control", "/developer-tools/yaml")
+diff --git a/homeassistant/components/http/__init__.py b/homeassistant/components/http/__init__.py
+index 122b7b79ce..3cf2b7e0db 100644
+--- a/homeassistant/components/http/__init__.py
++++ b/homeassistant/components/http/__init__.py
+@@ -411,16 +411,16 @@ class HomeAssistantHTTP:
+         )
+ 
+     def register_static_path(
+-        self, url_path: str, path: str, cache_headers: bool = True
++        self, url_path: str, path: str, cache_headers: bool = True, follow_symlinks: bool = False
+     ) -> None:
+         """Register a folder or file to serve as a static path."""
+         if os.path.isdir(path):
+             if cache_headers:
+                 resource: CachingStaticResource | web.StaticResource = (
+-                    CachingStaticResource(url_path, path)
++                    CachingStaticResource(url_path, path, follow_symlinks=follow_symlinks)
+                 )
+             else:
+-                resource = web.StaticResource(url_path, path)
++                resource = web.StaticResource(url_path, path, follow_symlinks=follow_symlinks)
+             self.app.router.register_resource(resource)
+             self.app["allow_configured_cors"](resource)
+             return
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index d4c009fa258..b3652e734f1 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2023.11.1";
+  version = "2023.11.2";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-eLmWOMKLzhZ7M/gdUHhlDZ3T+N4h5aHxMwOI8ZUepps=";
+    hash = "sha256-stVfFXb5QfC+wZUSk53+jt/hb8kO1gCcgeOnHHpNlWE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/http/apt-cacher-ng/default.nix b/pkgs/servers/http/apt-cacher-ng/default.nix
index 9cdc0c58ee4..dd364896143 100644
--- a/pkgs/servers/http/apt-cacher-ng/default.nix
+++ b/pkgs/servers/http/apt-cacher-ng/default.nix
@@ -1,8 +1,10 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , bzip2
 , cmake
 , doxygen
 , fetchurl
+, fetchpatch
 , fuse
 , libevent
 , xz
@@ -23,6 +25,15 @@ stdenv.mkDerivation rec {
     sha256 = "0pwsj9rf6a6q7cnfbpcrfq2gjcy7sylqzqqr49g2zi39lrrh8533";
   };
 
+  patches = [
+    # this patch fixes the build for glibc >= 2.38
+    (fetchpatch {
+      name = "strlcpy-glibc238.patch";
+      url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=0;bug=1052360;msg=10";
+      hash = "sha256-uhQj+ZcHCV36Tm0pF/+JG59bSaRdTZCrMcKL3YhZTk8=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake doxygen pkg-config ];
   buildInputs = [ bzip2 fuse libevent xz openssl systemd tcp_wrappers zlib c-ares ];
 
diff --git a/pkgs/servers/mir/default.nix b/pkgs/servers/mir/default.nix
index 6221c467689..078125016bf 100644
--- a/pkgs/servers/mir/default.nix
+++ b/pkgs/servers/mir/default.nix
@@ -1,13 +1,12 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , gitUpdater
 , testers
 , cmake
 , pkg-config
 , python3
-, doxygen
-, libxslt
 , boost
 , egl-wayland
 , freetype
@@ -40,15 +39,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mir";
-  version = "2.14.1";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "MirServer";
     repo = "mir";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-IEGeZVNxwzHn5GASCyjNuQsnCzzfQBHdC33MWVMeZws=";
+    hash = "sha256-c1+gxzLEtNCjR/mx76O5QElQ8+AO4WsfcG7Wy1+nC6E=";
   };
 
+  patches = [
+    # Fix gbm-kms tests
+    # Remove when version > 2.15.0
+    (fetchpatch {
+      name = "0001-mir-Fix-the-signature-of-drmModeCrtcSetGamma.patch";
+      url = "https://github.com/MirServer/mir/commit/98250e9c32c5b9b940da2fb0a32d8139bbc68157.patch";
+      hash = "sha256-tTtOHGNue5rsppOIQSfkOH5sVfFSn/KPGHmubNlRtLI=";
+    })
+  ];
+
   postPatch = ''
     # Fix scripts that get run in tests
     patchShebangs tools/detect_fd_leaks.bash tests/acceptance-tests/wayland-generator/test_wayland_generator.sh.in
@@ -73,21 +82,13 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace src/platform/graphics/CMakeLists.txt \
       --replace "/usr/include/drm/drm_fourcc.h" "${lib.getDev libdrm}/include/libdrm/drm_fourcc.h" \
       --replace "/usr/include/libdrm/drm_fourcc.h" "${lib.getDev libdrm}/include/libdrm/drm_fourcc.h"
-
-    # Fix date in generated docs not honouring SOURCE_DATE_EPOCH
-    # Install docs to correct dir
-    substituteInPlace cmake/Doxygen.cmake \
-      --replace '"date"' '"date" "--date=@'"$SOURCE_DATE_EPOCH"'"' \
-      --replace "\''${CMAKE_INSTALL_PREFIX}/share/doc/mir-doc" "\''${CMAKE_INSTALL_DOCDIR}"
   '';
 
   strictDeps = true;
 
   nativeBuildInputs = [
     cmake
-    doxygen
     glib # gdbus-codegen
-    libxslt
     lttng-ust # lttng-gen-tp
     pkg-config
     (python3.withPackages (ps: with ps; [
@@ -137,9 +138,8 @@ stdenv.mkDerivation (finalAttrs: {
     wlcs
   ];
 
-  buildFlags = [ "all" "doc" ];
-
   cmakeFlags = [
+    "-DBUILD_DOXYGEN=OFF"
     "-DMIR_PLATFORM='gbm-kms;x11;eglstream-kms;wayland'"
     "-DMIR_ENABLE_TESTS=${if finalAttrs.doCheck then "ON" else "OFF"}"
     # BadBufferTest.test_truncated_shm_file *doesn't* throw an error as the test expected, mark as such
@@ -160,7 +160,7 @@ stdenv.mkDerivation (finalAttrs: {
     export XDG_RUNTIME_DIR=/tmp
   '';
 
-  outputs = [ "out" "dev" "doc" ];
+  outputs = [ "out" "dev" ];
 
   passthru = {
     tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
diff --git a/pkgs/servers/monitoring/nagios/default.nix b/pkgs/servers/monitoring/nagios/default.nix
index edf82742bc5..6f357ccb08c 100644
--- a/pkgs/servers/monitoring/nagios/default.nix
+++ b/pkgs/servers/monitoring/nagios/default.nix
@@ -1,19 +1,47 @@
-{ lib, stdenv, fetchurl, perl, php, gd, libpng, zlib, unzip, nixosTests }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, perl
+, php
+, gd
+, libpng
+, openssl
+, zlib
+, unzip
+, nixosTests
+, nix-update-script
+}:
 
 stdenv.mkDerivation rec {
   pname = "nagios";
-  version = "4.4.6";
+  version = "4.4.14";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/nagios/nagios-4.x/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "1x5hb97zbvkm73q53ydp1gwj8nnznm72q9c4rm6ny7phr995l3db";
+  src = fetchFromGitHub {
+    owner = "NagiosEnterprises";
+    repo = "nagioscore";
+    rev = "refs/tags/nagios-${version}";
+    hash = "sha256-EJKMgU3Nzfefq2VXxBrfDDrQZWZvj7HqKnWR9j75fGI=";
   };
 
   patches = [ ./nagios.patch ];
   nativeBuildInputs = [ unzip ];
-  buildInputs = [ php perl gd libpng zlib ];
 
-  configureFlags = [ "--localstatedir=/var/lib/nagios" ];
+  buildInputs = [
+    php
+    perl
+    gd
+    libpng
+    openssl
+    zlib
+  ];
+
+  configureFlags = [
+    "--localstatedir=/var/lib/nagios"
+    "--with-ssl=${openssl.dev}"
+    "--with-ssl-inc=${openssl.dev}/include"
+    "--with-ssl-lib=${lib.getLib openssl}/lib"
+  ];
+
   buildFlags = [ "all" ];
 
   # Do not create /var directories
@@ -28,15 +56,22 @@ stdenv.mkDerivation rec {
     sed -i 's@/bin/@@g' $out/etc/objects/commands.cfg
   '';
 
-  passthru.tests = {
-    inherit (nixosTests) nagios;
+  passthru = {
+    tests = {
+      inherit (nixosTests) nagios;
+    };
+    updateScript = nix-update-script {
+      extraArgs = [ "--version-regex" "nagios-(.*)" ];
+    };
   };
 
   meta = {
     description = "A host, service and network monitoring program";
-    homepage    = "https://www.nagios.org/";
-    license     = lib.licenses.gpl2;
-    platforms   = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ immae thoughtpolice relrod ];
+    homepage = "https://www.nagios.org/";
+    changelog = "https://github.com/NagiosEnterprises/nagioscore/blob/nagios-${version}/Changelog";
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.linux;
+    mainProgram = "nagios";
+    maintainers = with lib.maintainers; [ immae thoughtpolice relrod anthonyroussel ];
   };
 }
diff --git a/pkgs/servers/prayer/default.nix b/pkgs/servers/prayer/default.nix
deleted file mode 100644
index c335358b6dd..00000000000
--- a/pkgs/servers/prayer/default.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{ lib, stdenv, fetchurl, fetchpatch, perl, openssl, db, zlib, uwimap, html-tidy, pam}:
-
-let
-  ssl = lib.optionals uwimap.withSSL
-    "-e 's/CCLIENT_SSL_ENABLE.*= false/CCLIENT_SSL_ENABLE=true/'";
-in
-stdenv.mkDerivation rec {
-  pname = "prayer";
-  version = "1.3.5";
-
-  src = fetchurl {
-    url = "ftp://ftp.csx.cam.ac.uk/pub/software/email/prayer/${pname}-${version}.tar.gz";
-    sha256 = "135fjbxjn385b6cjys6qhbwfw61mdcl2akkll4jfpdzfvhbxlyda";
-  };
-
-  patches = [
-    ./install.patch
-
-    # fix build errors which result from openssl changes
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/p/prayer/1.3.5-dfsg1-6/debian/patches/disable_ssl3.patch";
-      sha256 = "1rx4bidc9prh4gffipykp144cyi3zd6qzd990s2aad3knzv5bkdd";
-    })
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/p/prayer/1.3.5-dfsg1-6/debian/patches/openssl1.1.patch";
-      sha256 = "0zinylvq3bcifdmki867gir49pbjx6qb5h019hawwif2l4jmlxw1";
-    })
-  ];
-
-  postPatch = ''
-    sed -i -e s/gmake/make/ -e 's/LDAP_ENABLE.*= true/LDAP_ENABLE=false/' \
-      ${ssl} \
-      -e 's/CCLIENT_LIBS=.*/CCLIENT_LIBS=-lc-client/' \
-      -e 's,^PREFIX .*,PREFIX='$out, \
-      -e 's,^CCLIENT_DIR=.*,CCLIENT_DIR=${uwimap}/include/c-client,' \
-      Config
-    sed -i -e s,/usr/bin/perl,${perl}/bin/perl, \
-      templates/src/*.pl
-    sed -i -e '/<stropts.h>/d' lib/os_linux.h
-  '' + /* html-tidy updates */ ''
-    substituteInPlace ./session/html_secure_tidy.c \
-      --replace buffio.h tidybuffio.h
-  '';
-
-  buildInputs = [ openssl db zlib uwimap html-tidy pam ];
-  nativeBuildInputs = [ perl ];
-
-  NIX_LDFLAGS = "-lpam";
-
-  meta = {
-    homepage = "http://www-uxsup.csx.cam.ac.uk/~dpc22/prayer/";
-    description = "Yet another Webmail interface for IMAP servers on Unix systems written in C";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/servers/prayer/install.patch b/pkgs/servers/prayer/install.patch
deleted file mode 100644
index 439202dd955..00000000000
--- a/pkgs/servers/prayer/install.patch
+++ /dev/null
@@ -1,170 +0,0 @@
-diff --git a/accountd/Makefile b/accountd/Makefile
-index c3e8107..7946776 100644
---- a/accountd/Makefile
-+++ b/accountd/Makefile
-@@ -75,6 +75,6 @@ clean:
- 	-rm -f prayer-accountd test core *.o *~ \#*\# 
- 
- install:
--	$(INSTALL) -m 755 -o ${RO_USER} -g ${RW_GROUP} \
-+	$(INSTALL) -m 755 \
- 	prayer-accountd ${BROOT}${BIN_DIR}
- 
-diff --git a/files/Makefile b/files/Makefile
-index 743d0ed..7eff064 100644
---- a/files/Makefile
-+++ b/files/Makefile
-@@ -52,20 +52,20 @@ distclean:
- 
- install-cert:
- 	if [ -f certs/prayer.pem ]; then \
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) \
-+	$(INSTALL) \
- 	-m $(PRIVATE_FILE) certs/prayer.pem ${BROOT}${PREFIX}/certs; \
- 	fi
- 
- install-config: etc/prayer.cf
--	$(INSTALL) -D -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_FILE) \
-+	$(INSTALL) -D -m $(PUBLIC_FILE) \
- 	etc/prayer.cf ${BROOT}${PRAYER_CONFIG_FILE}
- 
- install-aconfig:
--	$(INSTALL) -D -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_FILE) \
-+	$(INSTALL) -D -m $(PUBLIC_FILE) \
- 	etc/prayer-accountd.cf ${BROOT}${ACCOUNTD_CONFIG_FILE}
- 
- install-motd:
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_FILE) \
-+	$(INSTALL) -m $(PUBLIC_FILE) \
- 	etc/motd.html ${BROOT}${PREFIX}/etc
- 
- install:
-@@ -83,6 +83,6 @@ install:
- 	if [ ! -f $(BROOT)$(PREFIX)/etc/motd.html ]; then $(MAKE) install-motd; fi
- 
- redhat-install-init.d:
--	install -D -o root -g root -m 755 \
-+	install -D -m 755 \
- 		./init.d/prayer $(BROOT)/etc/rc.d/init.d/prayer
- 	#chkconfig prayer --level 2345 on
-diff --git a/files/install.sh b/files/install.sh
-index 8d1d1f4..0804a08 100755
---- a/files/install.sh
-+++ b/files/install.sh
-@@ -2,8 +2,6 @@
- #
- # $Cambridge: hermes/src/prayer/files/install.sh,v 1.7 2008/09/16 09:59:56 dpc22 Exp $
- 
--PATH=/bin:/sbin/:/usr/bin:/usr/sbin
--
- error=0
- 
- if [ "x$PREFIX" = "x" ]; then
-@@ -55,24 +53,20 @@ if [ $error != 0 ]; then
-     exit 1
- fi
- 
--if [ ! -d ${VAR_PREFIX} -a `whoami` = "root" ]; then
--    ${INSTALL} -d -o ${RW_USER} -g ${RW_GROUP} -m ${PRIVATE_DIR} ${VAR_PREFIX}
--fi
--
- if [ ! -d ${PREFIX} ]; then
--    ${INSTALL} -d -o ${RO_USER} -g ${RO_GROUP} -m ${PUBLIC_DIR} ${PREFIX}
-+    ${INSTALL} -d -m ${PUBLIC_DIR} ${PREFIX}
- fi
- 
- if [ ! -d ${PREFIX}/etc ]; then
--    ${INSTALL} -d -o ${RO_USER} -g ${RO_GROUP} -m ${PUBLIC_DIR} ${PREFIX}/etc
-+    ${INSTALL} -d -m ${PUBLIC_DIR} ${PREFIX}/etc
- fi
- 
- if [ ! -d ${PREFIX}/certs ]; then
--    ${INSTALL} -d -o ${RO_USER} -g ${RO_GROUP} -m ${PRIVATE_DIR} ${PREFIX}/certs
-+    ${INSTALL} -d -m ${PRIVATE_DIR} ${PREFIX}/certs
- fi
- 
- if [ ! -d ${BIN_DIR} ]; then
--    ${INSTALL} -d -o ${RO_USER} -g ${RO_GROUP} -m ${PUBLIC_DIR} ${BIN_DIR}
-+    ${INSTALL} -d -m ${PUBLIC_DIR} ${BIN_DIR}
- fi
- 
- for i in icons static
-@@ -83,5 +77,4 @@ do
-     fi
-     echo Copying ${i}
-     (tar cf - ${i}) | (cd ${PREFIX} ; tar xf -)
--    (cd ${PREFIX}; chown -R ${RO_USER}:${RO_GROUP} ${i})
- done
-diff --git a/servers/Makefile b/servers/Makefile
-index 021aed5..5ccbd08 100644
---- a/servers/Makefile
-+++ b/servers/Makefile
-@@ -107,13 +107,13 @@ clean:
- 	-rm -f $(BIN) core *.o *.flc *~ \#*\#
- 
- install: all
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_DIR) -d \
-+	$(INSTALL) -m $(PUBLIC_DIR) -d \
- 	  $(BROOT)$(BIN_DIR)
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_EXEC) \
-+	$(INSTALL) -m $(PUBLIC_EXEC) \
- 	  prayer           $(BROOT)$(BIN_DIR)
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_EXEC) \
-+	$(INSTALL) -m $(PUBLIC_EXEC) \
- 	  prayer-chroot           $(BROOT)$(BIN_DIR)
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_EXEC) \
-+	$(INSTALL) -m $(PUBLIC_EXEC) \
- 	  prayer-session   $(BROOT)$(BIN_DIR)
- 
- prayer: $(PRAYER_OBJS) prayer_main.o
-diff --git a/templates/cam/Makefile b/templates/cam/Makefile
-index 9f4122a..396b628 100644
---- a/templates/cam/Makefile
-+++ b/templates/cam/Makefile
-@@ -124,7 +124,7 @@ _template_index.c:
- 	$(COMPILE) $(TYPE) $@ $*
- 
- install:
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_DIR) -d \
-+	$(INSTALL) -m $(PUBLIC_DIR) -d \
- 	  $(BROOT)$(PREFIX)/templates/$(TYPE)
- 	cp *.t $(BROOT)$(PREFIX)/templates/$(TYPE)
- 	cp *.vars $(BROOT)$(PREFIX)/templates/$(TYPE)
-diff --git a/templates/old/Makefile b/templates/old/Makefile
-index 31016cf..288a64c 100644
---- a/templates/old/Makefile
-+++ b/templates/old/Makefile
-@@ -123,7 +123,7 @@ _template_index.c:
- 	$(COMPILE) $(TYPE) $@ $*
- 
- install:
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_DIR) -d \
-+	$(INSTALL) -m $(PUBLIC_DIR) -d \
- 	  $(BROOT)$(PREFIX)/templates/$(TYPE)
- 	cp *.t $(BROOT)$(PREFIX)/templates/$(TYPE)
- 	cp *.vars $(BROOT)$(PREFIX)/templates/$(TYPE)
-diff --git a/utils/Makefile b/utils/Makefile
-index 9c79916..ef82481 100644
---- a/utils/Makefile
-+++ b/utils/Makefile
-@@ -72,15 +72,15 @@ clean:
- 	-rm -f $(BIN) core *.o *.flc *~ \#*\#
- 
- install: all
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_DIR) -d \
-+	$(INSTALL) -m $(PUBLIC_DIR) -d \
- 	  $(BROOT)$(BIN_DIR)
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_EXEC) \
-+	$(INSTALL) -m $(PUBLIC_EXEC) \
- 	  prayer-ssl-prune $(BROOT)$(BIN_DIR)
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_EXEC) \
-+	$(INSTALL) -m $(PUBLIC_EXEC) \
- 	  prayer-sem-prune $(BROOT)$(BIN_DIR)
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_EXEC) \
-+	$(INSTALL) -m $(PUBLIC_EXEC) \
- 	  prayer-db-prune $(BROOT)$(BIN_DIR)
--	$(INSTALL) -o $(RO_USER) -g $(RO_GROUP) -m $(PUBLIC_EXEC) \
-+	$(INSTALL) -m $(PUBLIC_EXEC) \
- 	  prayer-cyclog    $(BROOT)$(BIN_DIR)
- 
- prayer-ssl-prune: $(PRUNE_OBJS)
diff --git a/pkgs/servers/xmpp/ejabberd/default.nix b/pkgs/servers/xmpp/ejabberd/default.nix
index 671e88c5281..1cbd33cd4fd 100644
--- a/pkgs/servers/xmpp/ejabberd/default.nix
+++ b/pkgs/servers/xmpp/ejabberd/default.nix
@@ -1,6 +1,7 @@
 { stdenv, writeScriptBin, makeWrapper, lib, fetchurl, git, cacert, libpng, libjpeg, libwebp
 , erlang, openssl, expat, libyaml, bash, gnused, gnugrep, coreutils, util-linux, procps, gd
 , flock, autoreconfHook
+, gawk
 , nixosTests
 , withMysql ? false
 , withPgsql ? false
@@ -12,7 +13,7 @@
 }:
 
 let
-  ctlpath = lib.makeBinPath [ bash gnused gnugrep coreutils util-linux procps ];
+  ctlpath = lib.makeBinPath [ bash gnused gnugrep gawk coreutils util-linux procps ];
 in stdenv.mkDerivation rec {
   pname = "ejabberd";
   version = "23.01";
diff --git a/pkgs/tools/networking/veilid/Cargo.lock b/pkgs/tools/networking/veilid/Cargo.lock
index cb0a0243889..fbd257e1d69 100644
--- a/pkgs/tools/networking/veilid/Cargo.lock
+++ b/pkgs/tools/networking/veilid/Cargo.lock
@@ -41,9 +41,9 @@ dependencies = [
 
 [[package]]
 name = "ahash"
-version = "0.7.6"
+version = "0.7.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+checksum = "5a824f2aa7e75a0c98c5a504fceb80649e9c35265d44525b5f94de4771a395cd"
 dependencies = [
  "getrandom",
  "once_cell",
@@ -52,14 +52,15 @@ dependencies = [
 
 [[package]]
 name = "ahash"
-version = "0.8.3"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
+checksum = "91429305e9f0a25f6205c5b8e0d2db09e0708a7a6df0f42212bb56c32c8ac97a"
 dependencies = [
  "cfg-if 1.0.0",
  "getrandom",
  "once_cell",
  "version_check 0.9.4",
+ "zerocopy",
 ]
 
 [[package]]
@@ -294,15 +295,15 @@ dependencies = [
 
 [[package]]
 name = "async-executor"
-version = "1.5.4"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c1da3ae8dabd9c00f453a329dfe1fb28da3c0a72e2478cdcd93171740c20499"
+checksum = "4b0c4a4f319e45986f347ee47fef8bf5e81c9abc3f6f58dc2391439f30df65f0"
 dependencies = [
- "async-lock",
+ "async-lock 2.8.0",
  "async-task",
  "concurrent-queue",
  "fastrand 2.0.1",
- "futures-lite",
+ "futures-lite 1.13.0",
  "slab",
 ]
 
@@ -314,10 +315,10 @@ checksum = "f1b6f5d7df27bd294849f8eec66ecfc63d11814df7a4f5d74168a2394467b776"
 dependencies = [
  "async-channel",
  "async-executor",
- "async-io",
- "async-lock",
+ "async-io 1.13.0",
+ "async-lock 2.8.0",
  "blocking",
- "futures-lite",
+ "futures-lite 1.13.0",
  "once_cell",
 ]
 
@@ -327,18 +328,38 @@ version = "1.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fc5b45d93ef0529756f812ca52e44c221b35341892d3dcc34132ac02f3dd2af"
 dependencies = [
- "async-lock",
+ "async-lock 2.8.0",
  "autocfg",
  "cfg-if 1.0.0",
  "concurrent-queue",
- "futures-lite",
+ "futures-lite 1.13.0",
  "log",
  "parking",
- "polling",
- "rustix 0.37.25",
+ "polling 2.8.0",
+ "rustix 0.37.27",
+ "slab",
+ "socket2 0.4.10",
+ "waker-fn",
+]
+
+[[package]]
+name = "async-io"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41ed9d5715c2d329bf1b4da8d60455b99b187f27ba726df2883799af9af60997"
+dependencies = [
+ "async-lock 3.0.0",
+ "cfg-if 1.0.0",
+ "concurrent-queue",
+ "futures-io",
+ "futures-lite 2.0.1",
+ "parking",
+ "polling 3.3.0",
+ "rustix 0.38.21",
  "slab",
- "socket2 0.4.9",
+ "tracing",
  "waker-fn",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -351,35 +372,46 @@ dependencies = [
 ]
 
 [[package]]
+name = "async-lock"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45e900cdcd39bb94a14487d3f7ef92ca222162e6c7c3fe7cb3550ea75fb486ed"
+dependencies = [
+ "event-listener 3.0.1",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
 name = "async-process"
 version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ea6438ba0a08d81529c69b36700fa2f95837bfe3e776ab39cde9c14d9149da88"
 dependencies = [
- "async-io",
- "async-lock",
+ "async-io 1.13.0",
+ "async-lock 2.8.0",
  "async-signal",
  "blocking",
  "cfg-if 1.0.0",
- "event-listener 3.0.0",
- "futures-lite",
- "rustix 0.38.19",
+ "event-listener 3.0.1",
+ "futures-lite 1.13.0",
+ "rustix 0.38.21",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "async-signal"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2a5415b7abcdc9cd7d63d6badba5288b2ca017e3fbd4173b8f405449f1a2399"
+checksum = "9e47d90f65a225c4527103a8d747001fc56e375203592b25ad103e1ca13124c5"
 dependencies = [
- "async-io",
- "async-lock",
+ "async-io 2.2.0",
+ "async-lock 2.8.0",
  "atomic-waker",
  "cfg-if 1.0.0",
  "futures-core",
  "futures-io",
- "rustix 0.38.19",
+ "rustix 0.38.21",
  "signal-hook-registry",
  "slab",
  "windows-sys 0.48.0",
@@ -394,14 +426,14 @@ dependencies = [
  "async-attributes",
  "async-channel",
  "async-global-executor",
- "async-io",
- "async-lock",
+ "async-io 1.13.0",
+ "async-lock 2.8.0",
  "async-process",
  "crossbeam-utils",
  "futures-channel",
  "futures-core",
  "futures-io",
- "futures-lite",
+ "futures-lite 1.13.0",
  "gloo-timers",
  "kv-log-macro",
  "log",
@@ -415,16 +447,16 @@ dependencies = [
 
 [[package]]
 name = "async-std-resolver"
-version = "0.23.1"
+version = "0.23.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63547755965f54b682ed0fcb3fa467905fe071ef8feff2d59f24c7afc59661bc"
+checksum = "0928198152da571a19145031360f34fc7569ef2dc387681565f330c811a5ba9b"
 dependencies = [
  "async-std",
  "async-trait",
  "futures-io",
  "futures-util",
  "pin-utils",
- "socket2 0.5.4",
+ "socket2 0.5.5",
  "trust-dns-resolver",
 ]
 
@@ -447,26 +479,24 @@ checksum = "16e62a023e7c117e27523144c5d2459f4397fcc3cab0085af8e2224f643a0193"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "async-task"
-version = "4.4.1"
+version = "4.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9441c6b2fe128a7c2bf680a44c34d0df31ce09e5b7e401fcca3faa483dbc921"
+checksum = "b4eb2cdb97421e01129ccb49169d8279ed21e829929144f4a22a6e54ac549ca1"
 
 [[package]]
 name = "async-tls"
 version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfeefd0ca297cbbb3bd34fd6b228401c2a5177038257afd751bc29f0a2da4795"
+source = "git+https://github.com/async-rs/async-tls?rev=c58588a#c58588a276e6180f3ef99f4ec3bf9176c5f0f58c"
 dependencies = [
  "futures-core",
  "futures-io",
  "rustls",
  "rustls-pemfile",
- "webpki",
  "webpki-roots 0.22.6",
 ]
 
@@ -478,7 +508,7 @@ checksum = "a66537f1bb974b254c98ed142ff995236e81b9d0fe4db0575f46612cb15eb0f9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -632,9 +662,9 @@ checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
 [[package]]
 name = "base64"
-version = "0.21.4"
+version = "0.21.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ba43ea6f343b788c8764558649e08df62f86c6ef251fdaeb1ffd010a9ae50a2"
+checksum = "35636a1494ede3b646cc98f74f8e62c773a38a659ebc777a2cf26b9b74171df9"
 
 [[package]]
 name = "base64ct"
@@ -673,9 +703,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
 
 [[package]]
 name = "blake2"
@@ -707,7 +737,7 @@ checksum = "e0b121a9fe0df916e362fb3271088d071159cdf11db0e4182d02152850756eff"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -757,11 +787,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8c36a4d0d48574b3dd360b4b7d95cc651d2b6557b6402848a27d4b228a473e2a"
 dependencies = [
  "async-channel",
- "async-lock",
+ "async-lock 2.8.0",
  "async-task",
  "fastrand 2.0.1",
  "futures-io",
- "futures-lite",
+ "futures-lite 1.13.0",
  "piper",
  "tracing",
 ]
@@ -801,9 +831,9 @@ checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
 
 [[package]]
 name = "capnp"
-version = "0.18.1"
+version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9eddbd729bd9742aa22d29e871a42ffea7f216a4ddbfdaf09ea88150ef2e7f76"
+checksum = "499cea1db22c19b7a823fa4876330700077b388cc7de2c5477028df00bcb4ae4"
 dependencies = [
  "embedded-io",
 ]
@@ -939,9 +969,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.4.6"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d04704f56c2cde07f43e8e2c154b43f216dc5c92fc98ada720177362f953b956"
+checksum = "ac495e00dcec98c83465d5ad66c5c4fabd652fd6686e7c6269b117e729a6f17b"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -949,9 +979,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.4.6"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e231faeaca65ebd1ea3c737966bf858971cd38c3849107aa3ea7de90a804e45"
+checksum = "c77ed9a32a62e6ca27175d00d29d05ca32e396ea1eb5fb01d8256b669cec7663"
 dependencies = [
  "anstream",
  "anstyle",
@@ -962,21 +992,21 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.4.2"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0862016ff20d69b84ef8247369fabf5c008a7417002411897d40ee1f4532b873"
+checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.5.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd7cc57abe963c6d3b9d8be5b06ba7c8957a930305ca90304f24ef040aa6f961"
+checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
 
 [[package]]
 name = "clipboard-win"
@@ -1162,9 +1192,9 @@ dependencies = [
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.9"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
+checksum = "ce420fe07aecd3e67c5f910618fe65e94158f6dcc0adf44e00d69ce2bdfe0fd0"
 dependencies = [
  "libc",
 ]
@@ -1244,6 +1274,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "ctor"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37e366bff8cd32dd8754b0991fb66b279dc48f598c3a18914852a6673deef583"
+dependencies = [
+ "quote",
+ "syn 2.0.39",
+]
+
+[[package]]
 name = "ctrlc"
 version = "3.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1258,7 +1298,7 @@ name = "cursive"
 version = "0.20.0"
 source = "git+https://gitlab.com/veilid/cursive.git#a76fc9050f69edf56bc37efc63194050b9f222e4"
 dependencies = [
- "ahash 0.8.3",
+ "ahash 0.8.6",
  "async-std",
  "cfg-if 1.0.0",
  "crossbeam-channel",
@@ -1315,7 +1355,7 @@ name = "cursive_core"
 version = "0.3.7"
 source = "git+https://gitlab.com/veilid/cursive.git#a76fc9050f69edf56bc37efc63194050b9f222e4"
 dependencies = [
- "ahash 0.8.3",
+ "ahash 0.8.6",
  "ansi-parser",
  "async-std",
  "crossbeam-channel",
@@ -1364,13 +1404,13 @@ dependencies = [
 
 [[package]]
 name = "curve25519-dalek-derive"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fdaf97f4804dcebfa5862639bc9ce4121e82140bec2a987ac5140294865b5b"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -1426,7 +1466,7 @@ dependencies = [
  "ident_case",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -1448,7 +1488,7 @@ checksum = "836a9bbc7ad63342d6d6e7b815ccab164bc77a2d95d84bc3117a8c0d5c98e2d5"
 dependencies = [
  "darling_core 0.20.3",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -1458,10 +1498,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
 dependencies = [
  "cfg-if 1.0.0",
- "hashbrown 0.14.1",
+ "hashbrown 0.14.2",
  "lock_api",
  "once_cell",
- "parking_lot_core 0.9.8",
+ "parking_lot_core 0.9.9",
 ]
 
 [[package]]
@@ -1549,15 +1589,15 @@ checksum = "0688c2a7f92e427f44895cd63841bff7b29f8d7a1648b9e7e07a4a365b2e1257"
 
 [[package]]
 name = "dyn-clone"
-version = "1.0.14"
+version = "1.0.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d2f3407d9a573d666de4b5bdf10569d73ca9478087346697dcbae6244bfbcd"
+checksum = "545b22097d44f8a9581187cdf93de7a71e4722bf51200cfaba810865b49a495d"
 
 [[package]]
 name = "ed25519"
-version = "2.2.2"
+version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60f6d271ca33075c88028be6f04d502853d63a5ece419d269c15315d4fc1cf1d"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
  "pkcs8",
  "signature",
@@ -1599,14 +1639,14 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "enum-map"
-version = "2.6.3"
+version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c188012f8542dee7b3996e44dd89461d64aa471b0a7c71a1ae2f595d259e96e5"
+checksum = "53337c2dbf26a3c31eccc73a37b10c1614e8d4ae99b6a50d553e8936423c1f16"
 dependencies = [
  "enum-map-derive",
 ]
@@ -1619,7 +1659,7 @@ checksum = "04d0b288e3bb1d861c4403c1774a6f7a798781dfc519b3647df2a3dd4ae95f25"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -1662,7 +1702,7 @@ dependencies = [
  "darling 0.20.3",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -1722,9 +1762,9 @@ checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
 
 [[package]]
 name = "event-listener"
-version = "3.0.0"
+version = "3.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29e56284f00d94c1bc7fd3c77027b4623c88c1f53d8d2394c6199f2921dea325"
+checksum = "01cec0252c2afff729ee6f00e903d479fba81784c8e2bd77447673471fdfaea1"
 dependencies = [
  "concurrent-queue",
  "parking",
@@ -1732,6 +1772,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "event-listener-strategy"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d96b852f1345da36d551b9473fa1e2b1eb5c5195585c6c018118bc92a8d91160"
+dependencies = [
+ "event-listener 3.0.1",
+ "pin-project-lite",
+]
+
+[[package]]
 name = "eyre"
 version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1770,9 +1820,9 @@ checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
 
 [[package]]
 name = "fdeflate"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d329bdeac514ee06249dabc27877490f17f5d371ec693360768b838e19f3ae10"
+checksum = "64d6dafc854908ff5da46ff3f8f473c6984119a2876a383a860246dd7841a868"
 dependencies = [
  "simd-adler32",
 ]
@@ -1789,9 +1839,9 @@ dependencies = [
 
 [[package]]
 name = "fiat-crypto"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0870c84016d4b481be5c9f323c24f65e31e901ae618f0e80f4308fb00de1d2d"
+checksum = "a481586acf778f1b1455424c343f71124b048ffa5f4fc3f8f6ae9dc432dcb3c7"
 
 [[package]]
 name = "flate2"
@@ -1830,7 +1880,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "nanorand",
- "spin 0.9.8",
+ "spin",
 ]
 
 [[package]]
@@ -1875,15 +1925,15 @@ version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2eeb4ed9e12f43b7fa0baae3f9cdda28352770132ef2e09a23760c29cae8bd47"
 dependencies = [
- "rustix 0.38.19",
+ "rustix 0.38.21",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "futures"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23342abe12aba583913b2e62f22225ff9c950774065e4bfb61a19cd9770fec40"
+checksum = "da0290714b38af9b4a7b094b8a37086d1b4e61f2df9122c3cad2577669145335"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1896,9 +1946,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2"
+checksum = "ff4dd66668b557604244583e3e1e1eada8c5c2e96a6d0d6653ede395b78bbacb"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -1906,15 +1956,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bca583b7e26f571124fe5b7561d49cb2868d79116cfa0eefce955557c6fee8c"
+checksum = "eb1d22c66e66d9d72e1758f0bd7d4fd0bee04cad842ee34587d68c07e45d088c"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccecee823288125bd88b4d7f565c9e58e41858e47ab72e8ea2d64e93624386e0"
+checksum = "0f4fb8693db0cf099eadcca0efe2a5a22e4550f98ed16aba6c48700da29597bc"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -1923,9 +1973,9 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fff74096e71ed47f8e023204cfd0aa1289cd54ae5430a9523be060cdb849964"
+checksum = "8bf34a163b5c4c52d0478a4d757da8fb65cabef42ba90515efee0f6f9fa45aaa"
 
 [[package]]
 name = "futures-lite"
@@ -1943,27 +1993,37 @@ dependencies = [
 ]
 
 [[package]]
+name = "futures-lite"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3831c2651acb5177cbd83943f3d9c8912c5ad03c76afcc0e9511ba568ec5ebb"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
 name = "futures-macro"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72"
+checksum = "53b153fd91e4b0147f4aced87be237c98248656bb01050b96bf3ee89220a8ddb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f43be4fe21a13b9781a69afa4985b0f6ee0e1afab2c6f454a8cf30e2b2237b6e"
+checksum = "e36d3378ee38c2a36ad710c5d30c2911d752cb941c00c72dbabfb786a7970817"
 
 [[package]]
 name = "futures-task"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76d3d132be6c0e6aa1534069c705a74a5997a356c0dc2f86a47765e5617c5b65"
+checksum = "efd193069b0ddadc69c46389b740bbccdd97203899b48d09c5f7969591d6bae2"
 
 [[package]]
 name = "futures-timer"
@@ -1977,9 +2037,9 @@ dependencies = [
 
 [[package]]
 name = "futures-util"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b01e40b772d54cf6c6d721c1d1abd0647a0106a12ecaa1c186273392a69533"
+checksum = "a19526d624e703a3179b3d322efec918b6246ea0fa51d41124525f00f1cc8104"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2171,16 +2231,16 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 dependencies = [
- "ahash 0.7.6",
+ "ahash 0.7.7",
 ]
 
 [[package]]
 name = "hashbrown"
-version = "0.14.1"
+version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dfda62a12f55daeae5015f81b0baea145391cb4520f86c248fc615d72640d12"
+checksum = "f93e7192158dbcda357bdec5fb5788eebf8bbac027f3f33e719d29135ae84156"
 dependencies = [
- "ahash 0.8.3",
+ "ahash 0.8.6",
  "allocator-api2",
 ]
 
@@ -2190,7 +2250,7 @@ version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8094feaf31ff591f651a2664fb9cfd92bba7a60ce3197265e9482ebe753c8f7"
 dependencies = [
- "hashbrown 0.14.1",
+ "hashbrown 0.14.2",
 ]
 
 [[package]]
@@ -2342,7 +2402,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2 0.4.9",
+ "socket2 0.4.10",
  "tokio",
  "tower-service",
  "tracing",
@@ -2363,16 +2423,16 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.57"
+version = "0.1.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fad5b825842d2b38bd206f3e81d6957625fd7f0a361e345c30e01a0ae2dd613"
+checksum = "8326b86b6cff230b97d0d312a6c40a60726df3332e721f72a1b035f451663b20"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
  "iana-time-zone-haiku",
  "js-sys",
  "wasm-bindgen",
- "windows 0.48.0",
+ "windows-core",
 ]
 
 [[package]]
@@ -2449,12 +2509,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.0.2"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8adf3ddd720272c6ea8bf59463c04e0f93d0bbf7c5439b691bca2987e0270897"
+checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.1",
+ "hashbrown 0.14.2",
 ]
 
 [[package]]
@@ -2492,7 +2552,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
 dependencies = [
- "socket2 0.5.4",
+ "socket2 0.5.5",
  "widestring",
  "windows-sys 0.48.0",
  "winreg",
@@ -2500,9 +2560,9 @@ dependencies = [
 
 [[package]]
 name = "ipnet"
-version = "2.8.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28b29a3cd74f0f4598934efe3aeba42bae0eb4680554128851ebbecb02af14e6"
+checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
 [[package]]
 name = "itertools"
@@ -2558,9 +2618,9 @@ checksum = "bc0000e42512c92e31c2252315bda326620a4e034105e900c98ec492fa077b3e"
 
 [[package]]
 name = "js-sys"
-version = "0.3.64"
+version = "0.3.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
+checksum = "54c0c35952f67de54bb584e9fd912b3023117cbafc0a77d8f3dee1fb5f572fe8"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -2646,7 +2706,7 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d93d243dfa1643389f8b981ddc07b2a7c533f0fae38b3f5831b004b2cc7f6353"
 dependencies = [
- "async-lock",
+ "async-lock 2.8.0",
  "flume",
  "futures",
  "js-sys",
@@ -2682,9 +2742,18 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.149"
+version = "0.2.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
+checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
+
+[[package]]
+name = "libc-print"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c17f111e2175c779daaf5e89fe3a3b0776b0adec218bc1159c56e4d3f58032f5"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "libloading"
@@ -2697,6 +2766,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "libredox"
+version = "0.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85c833ca1e66078851dba29046874e38f08b2c883700aa29a03ddd3b23814ee8"
+dependencies = [
+ "bitflags 2.4.1",
+ "libc",
+ "redox_syscall 0.4.1",
+]
+
+[[package]]
 name = "libsqlite3-sys"
 version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2739,9 +2819,9 @@ checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"
 
 [[package]]
 name = "lock_api"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -2846,9 +2926,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "927a765cd3fc26206e66b296465fa9d3e5ab003e651c1b3c060e7956d96b19d2"
+checksum = "3dce281c5e46beae905d4de1870d8b1509a9142b62eedf18b443b011ca8343d0"
 dependencies = [
  "libc",
  "log",
@@ -2872,7 +2952,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b1bb540dc6ef51cfe1916ec038ce7a620daf3a111e2502d745197cd53d6bca15"
 dependencies = [
  "libc",
- "socket2 0.4.9",
+ "socket2 0.4.10",
 ]
 
 [[package]]
@@ -3001,7 +3081,7 @@ version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6471bf08e7ac0135876a9581bf3217ef0333c191c128d34878079f42ee150411"
 dependencies = [
- "async-io",
+ "async-io 1.13.0",
  "bytes",
  "futures",
  "libc",
@@ -3051,7 +3131,7 @@ version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.1",
  "cfg-if 1.0.0",
  "libc",
 ]
@@ -3429,9 +3509,9 @@ dependencies = [
 
 [[package]]
 name = "parking"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e52c774a4c39359c1d1c52e43f73dd91a75a614652c825408eec30c95a9b2067"
+checksum = "bb813b8af86854136c6922af0598d719255ecb2179515e6e7730d468f05c9cae"
 
 [[package]]
 name = "parking_lot"
@@ -3451,7 +3531,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
 dependencies = [
  "lock_api",
- "parking_lot_core 0.9.8",
+ "parking_lot_core 0.9.9",
 ]
 
 [[package]]
@@ -3470,13 +3550,13 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
 dependencies = [
  "cfg-if 1.0.0",
  "libc",
- "redox_syscall 0.3.5",
+ "redox_syscall 0.4.1",
  "smallvec",
  "windows-targets 0.48.5",
 ]
@@ -3518,9 +3598,9 @@ checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
 
 [[package]]
 name = "pest"
-version = "2.7.4"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c022f1e7b65d6a24c0dbbd5fb344c66881bc01f3e5ae74a1c8100f2f985d98a4"
+checksum = "ae9cee2a55a544be8b89dc6848072af97a20f2422603c10865be2a42b580fff5"
 dependencies = [
  "memchr",
  "thiserror",
@@ -3529,9 +3609,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.7.4"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35513f630d46400a977c4cb58f78e1bfbe01434316e60c37d27b9ad6139c66d8"
+checksum = "81d78524685f5ef2a3b3bd1cafbc9fcabb036253d9b1463e726a91cd16e2dfc2"
 dependencies = [
  "pest",
  "pest_generator",
@@ -3539,22 +3619,22 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.7.4"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc9fc1b9e7057baba189b5c626e2d6f40681ae5b6eb064dc7c7834101ec8123a"
+checksum = "68bd1206e71118b5356dae5ddc61c8b11e28b09ef6a31acbd15ea48a28e0c227"
 dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "pest_meta"
-version = "2.7.4"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1df74e9e7ec4053ceb980e7c0c8bd3594e977fde1af91daba9c928e8e8c6708d"
+checksum = "7c747191d4ad9e4a4ab9c8798f1e82a39affe7ef9648390b7e5548d18e099de6"
 dependencies = [
  "once_cell",
  "pest",
@@ -3588,7 +3668,7 @@ checksum = "4359fd9c9171ec6e8c62926d6faaf553a8dc3f64e1507e76da7911b4f6a04405"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -3632,9 +3712,9 @@ checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
 
 [[package]]
 name = "platforms"
-version = "3.1.2"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4503fa043bf02cee09a9582e9554b4c6403b2ef55e4612e96561d294419429f8"
+checksum = "14e6ab3f592e6fb464fc9712d8d6e6912de6473954635fd76a589d832cffcbb0"
 
 [[package]]
 name = "png"
@@ -3666,6 +3746,20 @@ dependencies = [
 ]
 
 [[package]]
+name = "polling"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e53b6af1f60f36f8c2ac2aad5459d75a5a9b4be1e8cdd40264f315d78193e531"
+dependencies = [
+ "cfg-if 1.0.0",
+ "concurrent-queue",
+ "pin-project-lite",
+ "rustix 0.38.21",
+ "tracing",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
 name = "poly1305"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3759,7 +3853,7 @@ dependencies = [
  "itertools 0.11.0",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -3851,33 +3945,33 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.3.5"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
  "bitflags 1.3.2",
 ]
 
 [[package]]
 name = "redox_users"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
+checksum = "a18479200779601e498ada4e8c1e1f50e3ee19deb0259c25825a98b5603b2cb4"
 dependencies = [
  "getrandom",
- "redox_syscall 0.2.16",
+ "libredox",
  "thiserror",
 ]
 
 [[package]]
 name = "regex"
-version = "1.10.1"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aaac441002f822bc9705a681810a4dd2963094b9ca0ddc41cb963a4c189189ea"
+checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.4.2",
+ "regex-automata 0.4.3",
  "regex-syntax 0.8.2",
 ]
 
@@ -3892,9 +3986,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5011c7e263a695dc8ca064cddb722af1be54e517a280b12a5356f98366899e5d"
+checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -3925,30 +4019,15 @@ dependencies = [
 
 [[package]]
 name = "ring"
-version = "0.16.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
-dependencies = [
- "cc",
- "libc",
- "once_cell",
- "spin 0.5.2",
- "untrusted 0.7.1",
- "web-sys",
- "winapi",
-]
-
-[[package]]
-name = "ring"
-version = "0.17.3"
+version = "0.17.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9babe80d5c16becf6594aa32ad2be8fe08498e7ae60b77de8df700e67f191d7e"
+checksum = "fb0205304757e5d899b9c2e448b867ffd03ae7f988002e47cd24954391394d0b"
 dependencies = [
  "cc",
  "getrandom",
  "libc",
- "spin 0.9.8",
- "untrusted 0.9.0",
+ "spin",
+ "untrusted",
  "windows-sys 0.48.0",
 ]
 
@@ -4009,7 +4088,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "549b9d036d571d42e6e85d1c1425e2ac83491075078ca9a15be021c56b1641f2"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.1",
  "fallible-iterator",
  "fallible-streaming-iterator",
  "hashlink",
@@ -4050,9 +4129,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.37.25"
+version = "0.37.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4eb579851244c2c03e7c24f501c3432bed80b8f720af1d6e5b0e0f01555a035"
+checksum = "fea8ca367a3a01fe35e6943c400addf443c0f57670e6ec51196f71a4b8762dd2"
 dependencies = [
  "bitflags 1.3.2",
  "errno",
@@ -4064,11 +4143,11 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.19"
+version = "0.38.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "745ecfa778e66b2b63c88a61cb36e0eea109e803b0b86bf9879fbc77c70e86ed"
+checksum = "2b426b0506e5d50a7d8dafcf2e81471400deb602392c7dd110815afb4eaf02a3"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.1",
  "errno",
  "libc",
  "linux-raw-sys 0.4.10",
@@ -4077,14 +4156,14 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.20.9"
+version = "0.21.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b80e3dec595989ea8510028f30c408a4630db12c9cbb8de34203b89d6577e99"
+checksum = "446e14c5cda4f3f30fe71863c34ec70f5ac79d6087097ad0bb433e1be5edf04c"
 dependencies = [
  "log",
- "ring 0.16.20",
+ "ring",
+ "rustls-webpki",
  "sct",
- "webpki",
 ]
 
 [[package]]
@@ -4093,7 +4172,17 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d3987094b1d07b653b7dfdc3f70ce9a1da9c51ac18c1b06b662e4f9a0e9f4b2"
 dependencies = [
- "base64 0.21.4",
+ "base64 0.21.5",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.101.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+dependencies = [
+ "ring",
+ "untrusted",
 ]
 
 [[package]]
@@ -4155,12 +4244,12 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "sct"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
 dependencies = [
- "ring 0.16.20",
- "untrusted 0.7.1",
+ "ring",
+ "untrusted",
 ]
 
 [[package]]
@@ -4229,9 +4318,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.189"
+version = "1.0.191"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e422a44e74ad4001bdc8eede9a4570ab52f71190e9c076d14369f38b9200537"
+checksum = "a834c4821019838224821468552240d4d95d14e751986442c816572d39a080c9"
 dependencies = [
  "serde_derive",
 ]
@@ -4258,9 +4347,9 @@ dependencies = [
 
 [[package]]
 name = "serde-wasm-bindgen"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30c9933e5689bd420dc6c87b7a1835701810cbc10cd86a26e4da45b73e6b1d78"
+checksum = "17ba92964781421b6cef36bf0d7da26d201e96d84e1b10e7ae6ed416e516906d"
 dependencies = [
  "js-sys",
  "serde",
@@ -4288,13 +4377,13 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.189"
+version = "1.0.191"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e48d1f918009ce3145511378cf68d613e3b3d9137d67272562080d68a2b32d5"
+checksum = "46fa52d5646bce91b680189fe5b1c049d2ea38dabb4e2e7c8d00ca12cfbfbcfd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -4316,14 +4405,14 @@ checksum = "e578a843d40b4189a4d66bba51d7684f57da5bd7c304c64e14bd63efbef49509"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.107"
+version = "1.0.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
+checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
 dependencies = [
  "itoa",
  "ryu",
@@ -4332,31 +4421,31 @@ dependencies = [
 
 [[package]]
 name = "serde_repr"
-version = "0.1.16"
+version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8725e1dfadb3a50f7e5ce0b1a540466f6ed3fe7a0fca2ac2b8b831d31316bd00"
+checksum = "3081f5ffbb02284dda55132aa26daecedd7372a42417bbbab6f14ab7d6bb9145"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96426c9936fd7a0124915f9185ea1d20aa9445cc9821142f0a73bc9207a2e186"
+checksum = "12022b835073e5b11e90a14f86838ceb1c8fb0325b72416845c487ac0fa95e80"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "serde_yaml"
-version = "0.9.25"
+version = "0.9.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a49e178e4452f45cb61d0cd8cebc1b0fafd3e41929e996cef79aa3aca91f574"
+checksum = "3cc7a1570e38322cfe4154732e5110f887ea57e22b76f4bfd32b5bdd3368666c"
 dependencies = [
- "indexmap 2.0.2",
+ "indexmap 2.1.0",
  "itoa",
  "ryu",
  "serde",
@@ -4385,7 +4474,7 @@ checksum = "91d129178576168c589c9ec973feedf7d3126c01ac2bf08795109aa35b69fb8f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -4460,8 +4549,8 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c4aa94397e2023af5b7cff5b8d4785e935cfb77f0e4aab0cae3b26258ace556"
 dependencies = [
- "async-io",
- "futures-lite",
+ "async-io 1.13.0",
+ "futures-lite 1.13.0",
  "libc",
  "signal-hook",
 ]
@@ -4539,9 +4628,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64a4a911eed85daf18834cfaa86a79b7d266ff93ff5ba14005426219480ed662"
+checksum = "9f7916fc008ca5542385b89a3d3ce689953c143e9304a9bf8beec1de48994c0d"
 dependencies = [
  "libc",
  "winapi",
@@ -4549,9 +4638,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.5.4"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4031e820eb552adee9295814c0ced9e5cf38ddf1e8b7d566d6de8e2538ea989e"
+checksum = "7b5fac59a5cb5dd637972e5fca70daf0523c9067fcdc4842f053dae04a18f8e9"
 dependencies = [
  "libc",
  "windows-sys 0.48.0",
@@ -4559,12 +4648,6 @@ dependencies = [
 
 [[package]]
 name = "spin"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
-
-[[package]]
-name = "spin"
 version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
@@ -4643,9 +4726,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.38"
+version = "2.0.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
+checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4687,7 +4770,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "21bebf2b7c9e0a515f6e0f8c51dc0f8e4696391e6f1ff30379559f8365fb0df7"
 dependencies = [
- "rustix 0.38.19",
+ "rustix 0.38.21",
  "windows-sys 0.48.0",
 ]
 
@@ -4702,22 +4785,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.49"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1177e8c6d7ede7afde3585fd2513e611227efd6481bd78d2e82ba1ce16557ed4"
+checksum = "f9a7210f5c9a7156bb50aa36aed4c95afb51df0df00713949448cf9e97d382d2"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.49"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10712f02019e9288794769fba95cd6847df9874d49d871d062172f9dd41bc4cc"
+checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -4801,7 +4884,7 @@ dependencies = [
  "parking_lot 0.12.1",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.5.4",
+ "socket2 0.5.5",
  "tokio-macros",
  "tracing",
  "windows-sys 0.48.0",
@@ -4825,7 +4908,7 @@ checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -4841,9 +4924,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.9"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d68074620f57a0b21594d9735eb2e98ab38b17f80d3fcb189fca266771ca60d"
+checksum = "5419f34732d9eb6ee4c3578b7989078579b7f039cbbb9ca2c4da015749371e15"
 dependencies = [
  "bytes",
  "futures-core",
@@ -4877,9 +4960,9 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.3"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cda73e2f1397b1262d6dfdcef8aafae14d1de7748d66822d3bfeeb6d03e5e4b"
+checksum = "3550f4e9685620ac18a50ed434eb3aec30db8ba93b0287467bca5826ea25baf1"
 dependencies = [
  "serde",
 ]
@@ -4890,7 +4973,7 @@ version = "0.19.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
 dependencies = [
- "indexmap 2.0.2",
+ "indexmap 2.1.0",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -4905,7 +4988,7 @@ checksum = "3082666a3a6433f7f511c7192923fa1fe07c69332d3c6a2e6bb040b569199d5a"
 dependencies = [
  "async-trait",
  "axum",
- "base64 0.21.4",
+ "base64 0.21.5",
  "bytes",
  "futures-core",
  "futures-util",
@@ -4934,7 +5017,7 @@ dependencies = [
  "async-stream",
  "async-trait",
  "axum",
- "base64 0.21.4",
+ "base64 0.21.5",
  "bytes",
  "h2",
  "http",
@@ -4986,9 +5069,9 @@ checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
 
 [[package]]
 name = "tracing"
-version = "0.1.39"
+version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee2ef2af84856a50c1d430afce2fdded0a4ec7eda868db86409b4543df0797f9"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
  "log",
  "pin-project-lite",
@@ -5015,7 +5098,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -5051,12 +5134,12 @@ dependencies = [
 
 [[package]]
 name = "tracing-log"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ddad33d2d10b1ed7eb9d1f518a5674713876e97e5bb9b7345a7984fbb4f922"
+checksum = "f751112709b4e791d8ce53e32c4ed2d353565a795ce84da2285393f41557bdf2"
 dependencies = [
- "lazy_static",
  "log",
+ "once_cell",
  "tracing-core",
 ]
 
@@ -5133,9 +5216,9 @@ dependencies = [
 
 [[package]]
 name = "trust-dns-proto"
-version = "0.23.1"
+version = "0.23.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "559ac980345f7f5020883dd3bcacf176355225e01916f8c2efecad7534f682c6"
+checksum = "3119112651c157f4488931a01e586aa459736e9d6046d3bd9105ffb69352d374"
 dependencies = [
  "async-trait",
  "cfg-if 1.0.0",
@@ -5158,9 +5241,9 @@ dependencies = [
 
 [[package]]
 name = "trust-dns-resolver"
-version = "0.23.1"
+version = "0.23.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c723b0e608b24ad04c73b2607e0241b2c98fd79795a95e98b068b6966138a29d"
+checksum = "10a3e6c3aff1718b3c73e395d1f35202ba2ffa847c6a62eea0db8fb4cfe30be6"
 dependencies = [
  "cfg-if 1.0.0",
  "futures-util",
@@ -5206,7 +5289,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals 0.28.0",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -5297,12 +5380,6 @@ checksum = "f28467d3e1d3c6586d8f25fa243f544f5800fec42d97032474e17222c2b75cfa"
 
 [[package]]
 name = "untrusted"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
-
-[[package]]
-name = "untrusted"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
@@ -5344,9 +5421,9 @@ checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
 
 [[package]]
 name = "value-bag"
-version = "1.4.1"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d92ccd67fb88503048c01b59152a04effd0782d035a83a6d256ce6085f08f4a3"
+checksum = "4a72e1902dde2bd6441347de2b70b7f5d59bf157c6c62f0c44572607a1d55bbe"
 
 [[package]]
 name = "vcpkg"
@@ -5368,14 +5445,14 @@ checksum = "a9ee584edf237fac328b891dd06c21e7914a1db3762907edc366a13803451fe3"
 
 [[package]]
 name = "veilid-cli"
-version = "0.2.4"
+version = "0.2.5"
 dependencies = [
  "arboard",
  "async-std",
  "async-tungstenite",
  "cfg-if 1.0.0",
  "chrono",
- "clap 4.4.6",
+ "clap 4.4.7",
  "config",
  "crossbeam-channel",
  "cursive",
@@ -5405,11 +5482,11 @@ dependencies = [
 
 [[package]]
 name = "veilid-core"
-version = "0.2.4"
+version = "0.2.5"
 dependencies = [
  "argon2",
- "async-io",
- "async-lock",
+ "async-io 1.13.0",
+ "async-lock 2.8.0",
  "async-std",
  "async-std-resolver",
  "async-tls",
@@ -5465,13 +5542,13 @@ dependencies = [
  "send_wrapper 0.6.0",
  "serde",
  "serde-big-array",
- "serde-wasm-bindgen 0.6.0",
+ "serde-wasm-bindgen 0.6.1",
  "serde_bytes",
  "serde_json",
  "serial_test",
  "shell-words",
  "simplelog",
- "socket2 0.5.4",
+ "socket2 0.5.5",
  "static_assertions",
  "stop-token",
  "thiserror",
@@ -5499,7 +5576,7 @@ dependencies = [
  "webpki-roots 0.25.2",
  "wee_alloc",
  "winapi",
- "windows 0.51.1",
+ "windows",
  "windows-permissions",
  "ws_stream_wasm",
  "x25519-dalek",
@@ -5507,21 +5584,25 @@ dependencies = [
 
 [[package]]
 name = "veilid-flutter"
-version = "0.2.4"
+version = "0.2.5"
 dependencies = [
  "allo-isolate",
+ "android_log-sys 0.3.1",
  "async-std",
  "backtrace",
  "cfg-if 1.0.0",
+ "ctor",
  "data-encoding",
  "ffi-support",
  "futures-util",
  "hostname",
  "jni",
  "lazy_static",
+ "libc-print",
  "opentelemetry",
  "opentelemetry-otlp",
  "opentelemetry-semantic-conventions",
+ "oslog",
  "paranoid-android",
  "parking_lot 0.12.1",
  "serde",
@@ -5541,7 +5622,7 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a3dabbda02cfe176635dcaa18a021416ff2eb4d0b47a913e3fdc7f62049d7b1"
 dependencies = [
- "hashbrown 0.14.1",
+ "hashbrown 0.14.2",
  "serde",
 ]
 
@@ -5560,14 +5641,14 @@ dependencies = [
 
 [[package]]
 name = "veilid-server"
-version = "0.2.4"
+version = "0.2.5"
 dependencies = [
  "ansi_term",
  "async-std",
  "async-tungstenite",
  "backtrace",
  "cfg-if 1.0.0",
- "clap 4.4.6",
+ "clap 4.4.7",
  "color-eyre",
  "config",
  "console-subscriber",
@@ -5610,10 +5691,10 @@ dependencies = [
 
 [[package]]
 name = "veilid-tools"
-version = "0.2.4"
+version = "0.2.5"
 dependencies = [
  "android_logger 0.13.3",
- "async-lock",
+ "async-lock 2.8.0",
  "async-std",
  "async_executors",
  "backtrace",
@@ -5667,7 +5748,7 @@ dependencies = [
 
 [[package]]
 name = "veilid-wasm"
-version = "0.2.4"
+version = "0.2.5"
 dependencies = [
  "cfg-if 1.0.0",
  "console_error_panic_hook",
@@ -5679,7 +5760,7 @@ dependencies = [
  "parking_lot 0.12.1",
  "send_wrapper 0.6.0",
  "serde",
- "serde-wasm-bindgen 0.6.0",
+ "serde-wasm-bindgen 0.6.1",
  "serde_bytes",
  "serde_json",
  "tracing",
@@ -5738,9 +5819,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
+checksum = "7daec296f25a1bae309c0cd5c29c4b260e510e6d813c286b19eaadf409d40fce"
 dependencies = [
  "cfg-if 1.0.0",
  "serde",
@@ -5750,24 +5831,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
+checksum = "e397f4664c0e4e428e8313a469aaa58310d302159845980fd23b0f22a847f217"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.37"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c02dbc21516f9f1f04f187958890d7e6026df8d16540b7ad9492bc34a67cea03"
+checksum = "9afec9963e3d0994cac82455b2b3502b81a7f40f9a0d32181f7528d9f4b43e02"
 dependencies = [
  "cfg-if 1.0.0",
  "js-sys",
@@ -5777,9 +5858,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
+checksum = "5961017b3b08ad5f3fe39f1e79877f8ee7c23c5e5fd5eb80de95abc41f1f16b2"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -5787,28 +5868,28 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
+checksum = "c5353b8dab669f5e10f5bd76df26a9360c748f054f862ff5f3f8aae0c7fb3907"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
+checksum = "0d046c5d029ba91a1ed14da14dca44b68bf2f124cfbaf741c54151fdb3e0750b"
 
 [[package]]
 name = "wasm-bindgen-test"
-version = "0.3.37"
+version = "0.3.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e6e302a7ea94f83a6d09e78e7dc7d9ca7b186bc2829c24a22d0753efd680671"
+checksum = "c6433b7c56db97397842c46b67e11873eda263170afeb3a2dc74a7cb370fee0d"
 dependencies = [
  "console_error_panic_hook",
  "js-sys",
@@ -5820,12 +5901,13 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-test-macro"
-version = "0.3.37"
+version = "0.3.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecb993dd8c836930ed130e020e77d9b2e65dd0fbab1b67c790b0f5d80b11a575"
+checksum = "493fcbab756bb764fa37e6bee8cec2dd709eb4273d06d0c282a5e74275ded735"
 dependencies = [
  "proc-macro2",
  "quote",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -5847,9 +5929,9 @@ checksum = "323f4da9523e9a669e1eaf9c6e763892769b1d38c623913647bfdc1532fe4549"
 
 [[package]]
 name = "web-sys"
-version = "0.3.64"
+version = "0.3.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b85cbef8c220a6abc02aefd892dfc0fc23afb1c6a426316ec33253a3877249b"
+checksum = "5db499c5f66323272151db0e666cd34f78617522fb0c1604d31a27c50c206a85"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -5861,8 +5943,8 @@ version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed63aea5ce73d0ff405984102c42de94fc55a6b75765d621c65262469b3c9b53"
 dependencies = [
- "ring 0.17.3",
- "untrusted 0.9.0",
+ "ring",
+ "untrusted",
 ]
 
 [[package]]
@@ -5918,7 +6000,7 @@ dependencies = [
  "either",
  "home",
  "once_cell",
- "rustix 0.38.19",
+ "rustix 0.38.21",
 ]
 
 [[package]]
@@ -5969,15 +6051,6 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e686886bc078bc1b0b600cac0147aadb815089b6e4da64016cbd754b6342700f"
-dependencies = [
- "windows-targets 0.48.5",
-]
-
-[[package]]
-name = "windows"
 version = "0.51.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca229916c5ee38c2f2bc1e9d8f04df975b4bd93f9955dc69fabb5d91270045c9"
@@ -6150,9 +6223,9 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "winnow"
-version = "0.5.17"
+version = "0.5.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3b801d0e0a6726477cc207f60162da452f3a95adb368399bef20a946e06f65c"
+checksum = "829846f3e3db426d4cee4510841b71a8e58aa2a76b1132579487ae430ccd9c7b"
 dependencies = [
  "memchr",
 ]
@@ -6256,7 +6329,7 @@ version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9cbeb2291cd7267a94489b71376eda33496c1b9881adf6b36f26cc2779f3fc49"
 dependencies = [
- "async-io",
+ "async-io 1.13.0",
  "byteorder",
  "derivative",
  "enumflags2",
@@ -6265,7 +6338,7 @@ dependencies = [
  "nb-connect",
  "nix 0.22.3",
  "once_cell",
- "polling",
+ "polling 2.8.0",
  "scoped-tls",
  "serde",
  "serde_repr",
@@ -6286,6 +6359,26 @@ dependencies = [
 ]
 
 [[package]]
+name = "zerocopy"
+version = "0.7.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cd369a67c0edfef15010f980c3cbe45d7f651deac2cd67ce097cd801de16557"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2f140bda219a26ccc0cdb03dba58af72590c53b22642577d88a927bc5c87d6b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.39",
+]
+
+[[package]]
 name = "zeroize"
 version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -6302,7 +6395,7 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
diff --git a/pkgs/tools/networking/veilid/default.nix b/pkgs/tools/networking/veilid/default.nix
index 76880eadc45..a787bb64517 100644
--- a/pkgs/tools/networking/veilid/default.nix
+++ b/pkgs/tools/networking/veilid/default.nix
@@ -10,18 +10,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "veilid";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitLab {
     owner = "veilid";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DQ/rFxUByPlZOHOLBO9OenT2WPiaBKl45ANiH+YkQ08=";
+    sha256 = "sha256-jcSoZhAAoiKn3Jsov4Q0vunPRC+JwX8O0vYZDT5uO0I=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
+      "async-tls-0.12.0" = "sha256-SAirarvQKsYLftr3u29czQFBwVZgl2cSCUqC0/Qgye0=";
       "cursive-0.20.0" = "sha256-jETyRRnzt7OMkTo4LRfeRr37oPJpn9R2soxkH7tzGy8=";
       "cursive-flexi-logger-view-0.5.0" = "sha256-zFpfVFNZNNdNMdpJbaT4O2pMYccGEAGnvYzpRziMwfQ=";
       "cursive_buffered_backend-0.6.1" = "sha256-+sTJnp570HupwaJxV2x+oKyLwNmqQ4HqOH2P1s9Hhw8=";
diff --git a/pkgs/tools/package-management/apx/default.nix b/pkgs/tools/package-management/apx/default.nix
index 9c58e5e0850..8671cb611dc 100644
--- a/pkgs/tools/package-management/apx/default.nix
+++ b/pkgs/tools/package-management/apx/default.nix
@@ -1,54 +1,42 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
-, makeWrapper
-, installShellFiles
-, docker
 , distrobox
 }:
 
 buildGoModule rec {
   pname = "apx";
-  version = "1.8.2";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "Vanilla-OS";
     repo = pname;
-    rev = "refs/tags/${version}";
-    hash = "sha256-nBhSl4r7LlgCA5/HCLpOleihE5n/JCJgf43KdCklQbg=";
+    rev = "v${version}";
+    hash = "sha256-3CelqEntpfld0n+Ewg7NCkowVjgCf5b6StfSkYbgV5k=";
   };
 
   vendorHash = null;
 
   ldflags = [ "-s" "-w" ];
 
-  nativeBuildInputs = [
-    makeWrapper
-    installShellFiles
-  ];
+  postPatch = ''
+    substituteInPlace config/apx.json \
+      --replace "/usr/share/apx/distrobox" "${distrobox}/bin/distrobox" \
+      --replace "/usr/share/apx" "$out/bin/apx"
+    substituteInPlace settings/config.go \
+      --replace "/usr/share/apx/" "$out/share/apx/"
+  '';
 
   postInstall = ''
-    mkdir -p $out/etc/apx
-
-    cat > "$out/etc/apx/config.json" <<EOF
-    {
-      "containername": "apx_managed",
-      "image": "docker.io/library/ubuntu",
-      "pkgmanager": "apt",
-      "distroboxpath": "${distrobox}/bin/distrobox"
-    }
-    EOF
-
-    wrapProgram $out/bin/apx --prefix PATH : ${lib.makeBinPath [ docker distrobox ]}
-
-    installManPage man/de/man1/apx.1 man/es/man1/apx.1 man/fr/man1/apx.1 man/it/man1/apx.1 man/man1/apx.1 man/nl/man1/apx.1 man/pl/man1/apx.1 man/pt/man1/apx.1 man/pt_BR/man1/apx.1 man/ro/man1/apx.1 man/ru/man1/apx.1 man/sv/man1/apx.1 man/tr/man1/apx.1
+    install -D config/apx.json -t $out/share/apx/
+    install -D man/man1/apx.1 -t $out/man/man1/
   '';
 
   meta = with lib; {
     description = "The Vanilla OS package manager";
     homepage = "https://github.com/Vanilla-OS/apx";
-    changelog = "https://github.com/Vanilla-OS/apx/releases/tag/${version}";
+    changelog = "https://github.com/Vanilla-OS/apx/releases/tag/v${version}";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ dit7ya ];
+    maintainers = with maintainers; [ dit7ya jgarcia ];
   };
 }
diff --git a/pkgs/tools/security/nmap/default.nix b/pkgs/tools/security/nmap/default.nix
index 1f9084964b2..64dcd4f220b 100644
--- a/pkgs/tools/security/nmap/default.nix
+++ b/pkgs/tools/security/nmap/default.nix
@@ -26,6 +26,10 @@ stdenv.mkDerivation rec {
     "--without-zenmap"
   ];
 
+  postInstall = ''
+    install -m 444 -D nselib/data/passwords.lst $out/share/wordlists/nmap.lst
+  '';
+
   makeFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "AR=${stdenv.cc.bintools.targetPrefix}ar"
     "RANLIB=${stdenv.cc.bintools.targetPrefix}ranlib"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index b9fb30729cc..9c144f09a0f 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -715,6 +715,7 @@ mapAliases ({
   pinentry_qt = throw "'pinentry_qt' has been renamed to/replaced by 'pinentry-qt'"; # Converted to throw 2023-09-10
   pinentry_qt5 = pinentry-qt; # Added 2020-02-11
   poetry2nix = throw "poetry2nix is now maintained out-of-tree. Please use https://github.com/nix-community/poetry2nix/"; # Added 2023-10-26
+  prayer = throw "prayer has been removed from nixpkgs"; # Added 2023-11-09
   privacyidea = throw "privacyidea has been removed from nixpkgs"; # Added 2023-10-31
   probe-rs-cli = throw "probe-rs-cli is now part of the probe-rs package"; # Added 2023-07-03
   processing3 = throw "'processing3' has been renamed to/replaced by 'processing'"; # Converted to throw 2023-09-10
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8c0a27ae9ea..b5ab9983785 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16256,7 +16256,7 @@ with pkgs;
   gforth = callPackage ../development/compilers/gforth { };
 
   gleam = callPackage ../development/compilers/gleam {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
   gmqcc = callPackage ../development/compilers/gmqcc { };
@@ -22904,7 +22904,9 @@ with pkgs;
 
   libfabric = callPackage ../development/libraries/libfabric { };
 
-  libfive = qt6Packages.callPackage ../development/libraries/libfive { };
+  libfive = qt6Packages.callPackage ../development/libraries/libfive {
+    python = python3;
+  };
 
   libfixposix = callPackage ../development/libraries/libfixposix { };
 
@@ -26515,6 +26517,14 @@ with pkgs;
 
   home-assistant = callPackage ../servers/home-assistant { };
 
+  buildHomeAssistantComponent = callPackage ../servers/home-assistant/build-custom-component { };
+  home-assistant-custom-components = lib.recurseIntoAttrs
+    (callPackage ../servers/home-assistant/custom-components {
+      inherit (home-assistant.python.pkgs) callPackage;
+    });
+  home-assistant-custom-lovelace-modules = lib.recurseIntoAttrs
+    (callPackage ../servers/home-assistant/custom-lovelace-modules {});
+
   home-assistant-cli = callPackage ../servers/home-assistant/cli.nix { };
 
   home-assistant-component-tests = recurseIntoAttrs home-assistant.tests.components;
@@ -28610,8 +28620,6 @@ with pkgs;
 
   pps-tools = callPackage ../os-specific/linux/pps-tools { };
 
-  prayer = callPackage ../servers/prayer { };
-
   procps = if stdenv.isLinux
     then callPackage ../os-specific/linux/procps-ng { }
     else unixtools.procps;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6c8e9aa4dd8..af6c244e4ab 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6150,6 +6150,10 @@ self: super: with self; {
     pythonSupport = true;
   });
 
+  libfive = toPythonModule (pkgs.libfive.override {
+    inherit python;
+  });
+
   libgpiod = callPackage ../development/python-modules/libgpiod {
     inherit (pkgs) libgpiod;
   };
@@ -13687,6 +13691,8 @@ self: super: with self; {
 
   telfhash = callPackage ../development/python-modules/telfhash { };
 
+  telegram-text = callPackage ../development/python-modules/telegram-text { };
+
   temescal = callPackage ../development/python-modules/temescal { };
 
   temperusb = callPackage ../development/python-modules/temperusb { };