summary refs log tree commit diff
diff options
context:
space:
mode:
authorgithub-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>2023-11-11 18:00:58 +0000
committerGitHub <noreply@github.com>2023-11-11 18:00:58 +0000
commit9776723357705dedeb933221c8f9b295d44813d7 (patch)
tree15d5753e5cb6835221543be566b71f0a05dd9860
parent940180423aaad6f43db3510e9418ced525613d51 (diff)
parenta4e452c906b13806fcea511ab58792d7748203b0 (diff)
downloadnixpkgs-9776723357705dedeb933221c8f9b295d44813d7.tar
nixpkgs-9776723357705dedeb933221c8f9b295d44813d7.tar.gz
nixpkgs-9776723357705dedeb933221c8f9b295d44813d7.tar.bz2
nixpkgs-9776723357705dedeb933221c8f9b295d44813d7.tar.lz
nixpkgs-9776723357705dedeb933221c8f9b295d44813d7.tar.xz
nixpkgs-9776723357705dedeb933221c8f9b295d44813d7.tar.zst
nixpkgs-9776723357705dedeb933221c8f9b295d44813d7.zip
Merge master into staging-next
-rw-r--r--CONTRIBUTING.md2
-rw-r--r--doc/languages-frameworks/lisp.section.md2
-rw-r--r--doc/packages/steam.section.md2
-rw-r--r--doc/using/overlays.chapter.md2
-rw-r--r--lib/licenses.nix10
-rw-r--r--maintainers/maintainer-list.nix5
-rwxr-xr-xmaintainers/scripts/haskell/upload-nixos-package-list-to-hackage.sh2
-rw-r--r--nixos/doc/manual/configuration/subversion.chapter.md4
-rw-r--r--nixos/doc/manual/development/running-nixos-tests-interactively.section.md7
-rw-r--r--nixos/doc/manual/development/writing-documentation.chapter.md8
-rw-r--r--nixos/doc/manual/installation/changing-config.chapter.md7
-rw-r--r--nixos/modules/config/users-groups.nix2
-rw-r--r--nixos/modules/installer/tools/nixos-generate-config.pl2
-rw-r--r--nixos/modules/programs/npm.nix2
-rw-r--r--nixos/modules/programs/zsh/oh-my-zsh.md2
-rw-r--r--nixos/modules/security/google_oslogin.nix4
-rw-r--r--nixos/modules/security/pam_mount.nix6
-rw-r--r--nixos/modules/security/polkit.nix3
-rw-r--r--nixos/modules/services/audio/jack.nix2
-rw-r--r--nixos/modules/services/computing/boinc/client.nix2
-rw-r--r--nixos/modules/services/computing/slurm/slurm.nix2
-rw-r--r--nixos/modules/services/databases/couchdb.nix2
-rw-r--r--nixos/modules/services/databases/firebird.nix2
-rw-r--r--nixos/modules/services/databases/pgmanage.nix2
-rw-r--r--nixos/modules/services/databases/postgresql.md2
-rw-r--r--nixos/modules/services/databases/postgresql.nix2
-rw-r--r--nixos/modules/services/databases/redis.nix2
-rw-r--r--nixos/modules/services/hardware/udev.nix2
-rw-r--r--nixos/modules/services/logging/logstash.nix2
-rw-r--r--nixos/modules/services/misc/mediatomb.nix2
-rw-r--r--nixos/modules/services/monitoring/bosun.nix2
-rw-r--r--nixos/modules/services/monitoring/grafana.nix4
-rw-r--r--nixos/modules/services/monitoring/graphite.nix2
-rw-r--r--nixos/modules/services/monitoring/munin.nix14
-rw-r--r--nixos/modules/services/monitoring/nagios.nix2
-rw-r--r--nixos/modules/services/network-filesystems/xtreemfs.nix10
-rw-r--r--nixos/modules/services/networking/asterisk.nix2
-rw-r--r--nixos/modules/services/networking/i2pd.nix2
-rw-r--r--nixos/modules/services/networking/ntp/ntpd.nix2
-rw-r--r--nixos/modules/services/networking/tox-bootstrapd.nix2
-rw-r--r--nixos/modules/services/torrent/transmission.nix2
-rw-r--r--nixos/modules/services/video/unifi-video.nix4
-rw-r--r--nixos/modules/services/web-apps/akkoma.nix2
-rw-r--r--nixos/modules/services/web-apps/discourse.nix4
-rw-r--r--nixos/modules/services/web-apps/nextcloud.md2
-rw-r--r--nixos/modules/services/web-apps/tt-rss.nix2
-rw-r--r--nixos/modules/services/web-servers/lighttpd/default.nix6
-rw-r--r--nixos/modules/services/web-servers/mighttpd2.nix4
-rw-r--r--nixos/modules/services/web-servers/nginx/default.nix2
-rw-r--r--nixos/modules/services/x11/desktop-managers/enlightenment.nix2
-rw-r--r--nixos/modules/services/x11/desktop-managers/gnome.nix2
-rw-r--r--nixos/modules/services/x11/desktop-managers/pantheon.nix2
-rw-r--r--nixos/modules/services/x11/display-managers/default.nix2
-rw-r--r--nixos/modules/services/x11/display-managers/xpra.nix6
-rw-r--r--nixos/modules/services/x11/imwheel.nix2
-rw-r--r--nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix2
-rw-r--r--nixos/modules/system/boot/loader/grub/grub.nix2
-rw-r--r--nixos/modules/system/boot/luksroot.nix2
-rw-r--r--nixos/modules/system/boot/stage-1.nix2
-rw-r--r--nixos/modules/virtualisation/google-compute-config.nix4
-rw-r--r--pkgs/applications/audio/pbpctrl/default.nix6
-rw-r--r--pkgs/applications/emulators/gxemul/default.nix4
-rw-r--r--pkgs/applications/file-managers/dfilemanager/default.nix2
-rw-r--r--pkgs/applications/graphics/freecad/0001-NIXOS-don-t-ignore-PYTHONPATH.patch7
-rw-r--r--pkgs/applications/graphics/freecad/default.nix17
-rw-r--r--pkgs/applications/graphics/openscad/default.nix2
-rw-r--r--pkgs/applications/graphics/pikopixel/default.nix6
-rw-r--r--pkgs/applications/graphics/viewnior/default.nix2
-rw-r--r--pkgs/applications/misc/syncthingtray/default.nix4
-rw-r--r--pkgs/applications/misc/yate/default.nix2
-rw-r--r--pkgs/applications/networking/clash-verge/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/fn-cli/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/opentofu/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/pluto/default.nix4
-rw-r--r--pkgs/applications/networking/irc/kirc/default.nix2
-rw-r--r--pkgs/applications/networking/irc/kvirc/default.nix2
-rw-r--r--pkgs/applications/networking/p2p/mldonkey/default.nix2
-rw-r--r--pkgs/applications/radio/ebook2cw/default.nix2
-rw-r--r--pkgs/applications/science/logic/aiger/default.nix4
-rw-r--r--pkgs/applications/science/logic/cadical/default.nix2
-rw-r--r--pkgs/applications/science/logic/cvc3/default.nix6
-rw-r--r--pkgs/applications/science/logic/kissat/default.nix2
-rw-r--r--pkgs/applications/science/logic/picosat/default.nix4
-rw-r--r--pkgs/applications/science/math/colpack/default.nix2
-rw-r--r--pkgs/applications/video/mpv/scripts/default.nix6
-rw-r--r--pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix15
-rw-r--r--pkgs/applications/video/mpv/scripts/quality-menu.nix21
-rw-r--r--pkgs/applications/video/mpv/scripts/thumbnail.nix19
-rw-r--r--pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix4
-rw-r--r--pkgs/applications/virtualization/crosvm/default.nix13
-rw-r--r--pkgs/applications/virtualization/qemu/default.nix7
-rw-r--r--pkgs/applications/virtualization/virt-manager/default.nix2
-rw-r--r--pkgs/applications/virtualization/virt-viewer/default.nix2
-rw-r--r--pkgs/by-name/si/signal-export/package.nix40
-rw-r--r--pkgs/by-name/zp/zpaqfranz/package.nix4
-rw-r--r--pkgs/data/soundfonts/generaluser/default.nix4
-rw-r--r--pkgs/development/beam-modules/mix-release.nix162
-rw-r--r--pkgs/development/compilers/pforth/default.nix2
-rw-r--r--pkgs/development/compilers/uasm/default.nix2
-rw-r--r--pkgs/development/interpreters/luau/default.nix8
-rw-r--r--pkgs/development/interpreters/picolisp/default.nix2
-rw-r--r--pkgs/development/interpreters/supercollider/default.nix6
-rw-r--r--pkgs/development/libraries/ctpp2/default.nix4
-rw-r--r--pkgs/development/libraries/ctranslate2/default.nix4
-rw-r--r--pkgs/development/libraries/dbus/default.nix2
-rw-r--r--pkgs/development/libraries/gusb/default.nix4
-rw-r--r--pkgs/development/libraries/irrlicht/default.nix2
-rw-r--r--pkgs/development/libraries/irrlicht/mac.nix2
-rw-r--r--pkgs/development/libraries/libcdr/default.nix2
-rw-r--r--pkgs/development/libraries/libevdev/default.nix2
-rw-r--r--pkgs/development/libraries/libproxy/default.nix2
-rw-r--r--pkgs/development/libraries/libsodium/default.nix2
-rw-r--r--pkgs/development/libraries/libtsm/default.nix2
-rw-r--r--pkgs/development/libraries/libvirt/default.nix4
-rw-r--r--pkgs/development/libraries/openfx/default.nix4
-rw-r--r--pkgs/development/libraries/polkit/default.nix2
-rw-r--r--pkgs/development/libraries/portaudio/default.nix4
-rw-r--r--pkgs/development/libraries/qtutilities/default.nix4
-rw-r--r--pkgs/development/libraries/startup-notification/default.nix2
-rw-r--r--pkgs/development/libraries/vcg/default.nix2
-rw-r--r--pkgs/development/libraries/wolfssl/default.nix9
-rw-r--r--pkgs/development/lisp-modules-new-obsolete/examples/bordeaux-threads.nix2
-rw-r--r--pkgs/development/python-modules/cvxopt/default.nix2
-rw-r--r--pkgs/development/python-modules/jupyterlab_launcher/default.nix26
-rw-r--r--pkgs/development/python-modules/jwt/default.nix (renamed from pkgs/development/python-modules/python-jwt/default.nix)0
-rw-r--r--pkgs/development/python-modules/langchain/default.nix18
-rw-r--r--pkgs/development/python-modules/langsmith/default.nix6
-rw-r--r--pkgs/development/python-modules/libvirt/default.nix4
-rw-r--r--pkgs/development/python-modules/nibe/default.nix8
-rw-r--r--pkgs/development/python-modules/nlpcloud/default.nix4
-rw-r--r--pkgs/development/python-modules/polling/default.nix2
-rw-r--r--pkgs/development/python-modules/pydexcom/default.nix25
-rw-r--r--pkgs/development/python-modules/pyjnius/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-testmon/default.nix8
-rw-r--r--pkgs/development/python-modules/python-lsp-ruff/default.nix4
-rw-r--r--pkgs/development/python-modules/python-lsp-server/default.nix4
-rw-r--r--pkgs/development/python-modules/python-pptx/default.nix4
-rw-r--r--pkgs/development/python-modules/setuptools-trial/default.nix (renamed from pkgs/development/python-modules/setuptoolstrial/default.nix)7
-rw-r--r--pkgs/development/python-modules/sqlobject/default.nix2
-rw-r--r--pkgs/development/ruby-modules/gem-config/default.nix7
-rw-r--r--pkgs/development/tools/continuous-integration/buildbot/master.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/buildbot/worker.nix4
-rw-r--r--pkgs/development/tools/fx/default.nix6
-rw-r--r--pkgs/development/tools/misc/texlab/default.nix9
-rw-r--r--pkgs/development/tools/nailgun/default.nix2
-rw-r--r--pkgs/development/tools/protoc-gen-grpc-web/default.nix4
-rw-r--r--pkgs/development/tools/rust/cargo-mommy/default.nix6
-rw-r--r--pkgs/development/tools/sqlint/Gemfile.lock12
-rw-r--r--pkgs/development/tools/sqlint/gemset.nix12
-rw-r--r--pkgs/development/tools/subxt/default.nix36
-rw-r--r--pkgs/games/hedgewars/default.nix2
-rw-r--r--pkgs/games/hyperrogue/default.nix2
-rw-r--r--pkgs/games/xskat/default.nix4
-rw-r--r--pkgs/misc/cups/cups-pk-helper.nix2
-rw-r--r--pkgs/os-specific/linux/ch9344/default.nix2
-rw-r--r--pkgs/os-specific/linux/kmscon/default.nix2
-rw-r--r--pkgs/os-specific/linux/microcode/intel.nix2
-rw-r--r--pkgs/servers/openafs/1.8/module.nix63
-rw-r--r--pkgs/servers/web-apps/slskd/default.nix9
-rw-r--r--pkgs/servers/web-apps/whitebophir/default.nix4
-rw-r--r--pkgs/tools/bootloaders/refind/default.nix11
-rw-r--r--pkgs/tools/filesystems/unionfs-fuse/default.nix2
-rw-r--r--pkgs/tools/misc/ccal/default.nix5
-rw-r--r--pkgs/tools/misc/desktop-file-utils/default.nix2
-rw-r--r--pkgs/tools/misc/diffoscope/default.nix4
-rw-r--r--pkgs/tools/misc/nb/default.nix4
-rw-r--r--pkgs/tools/misc/plantuml/default.nix2
-rw-r--r--pkgs/tools/networking/clash/default.nix49
-rw-r--r--pkgs/tools/networking/redsocks/default.nix2
-rw-r--r--pkgs/tools/networking/ripmime/default.nix6
-rw-r--r--pkgs/tools/networking/whois/clang.patch11
-rw-r--r--pkgs/tools/networking/whois/default.nix8
-rw-r--r--pkgs/tools/security/afl/qemu.nix4
-rw-r--r--pkgs/tools/security/bitwarden/cli.nix6
-rw-r--r--pkgs/tools/security/bitwarden/default.nix6
-rw-r--r--pkgs/tools/security/chkrootkit/default.nix4
-rw-r--r--pkgs/tools/system/supercronic/default.nix38
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix6
-rw-r--r--pkgs/top-level/python-aliases.nix2
-rw-r--r--pkgs/top-level/python-packages.nix8
181 files changed, 679 insertions, 494 deletions
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 483267935c8..dadda215b0d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -353,7 +353,7 @@ In a case a contributor definitively leaves the Nix community, they should creat
 # Flow of merged pull requests
 
 After a pull request is merged, it eventually makes it to the [official Hydra CI](https://hydra.nixos.org/).
-Hydra regularly evaluates and builds Nixpkgs, updating [the official channels](http://channels.nixos.org/) when specific Hydra jobs succeeded.
+Hydra regularly evaluates and builds Nixpkgs, updating [the official channels](https://channels.nixos.org/) when specific Hydra jobs succeeded.
 See [Nix Channel Status](https://status.nixos.org/) for the current channels and their state.
 Here's a brief overview of the main Git branches and what channels they're used for:
 
diff --git a/doc/languages-frameworks/lisp.section.md b/doc/languages-frameworks/lisp.section.md
index fe7f2ef80a2..09193093b08 100644
--- a/doc/languages-frameworks/lisp.section.md
+++ b/doc/languages-frameworks/lisp.section.md
@@ -66,7 +66,7 @@ buildPhase = ''
 To save some work of writing Nix expressions, there is a script that imports all
 the packages distributed by Quicklisp into `imported.nix`. This works by parsing
 its `releases.txt` and `systems.txt` files, which are published every couple of
-months on [quicklisp.org](http://beta.quicklisp.org/dist/quicklisp.txt).
+months on [quicklisp.org](https://beta.quicklisp.org/dist/quicklisp.txt).
 
 The import process is implemented in the `import` directory as Common Lisp
 code in the `org.lispbuilds.nix` ASDF system. To run the script, one can
diff --git a/doc/packages/steam.section.md b/doc/packages/steam.section.md
index 25728aa52ae..a1e88b0d971 100644
--- a/doc/packages/steam.section.md
+++ b/doc/packages/steam.section.md
@@ -11,7 +11,7 @@ Nix problems and constraints:
 - The `steam.sh` script in `$HOME` cannot be patched, as it is checked and rewritten by steam.
 - The steam binary cannot be patched, it's also checked.
 
-The current approach to deploy Steam in NixOS is composing a FHS-compatible chroot environment, as documented [here](http://sandervanderburg.blogspot.nl/2013/09/composing-fhs-compatible-chroot.html). This allows us to have binaries in the expected paths without disrupting the system, and to avoid patching them to work in a non FHS environment.
+The current approach to deploy Steam in NixOS is composing a FHS-compatible chroot environment, as documented [here](https://sandervanderburg.blogspot.com/2013/09/composing-fhs-compatible-chroot.html). This allows us to have binaries in the expected paths without disrupting the system, and to avoid patching them to work in a non FHS environment.
 
 ## How to play {#sec-steam-play}
 
diff --git a/doc/using/overlays.chapter.md b/doc/using/overlays.chapter.md
index 1e965e5f0c7..1bec6586f28 100644
--- a/doc/using/overlays.chapter.md
+++ b/doc/using/overlays.chapter.md
@@ -77,7 +77,7 @@ In Nixpkgs, we have multiple implementations of the BLAS/LAPACK numerical linear
 
     The Nixpkgs attribute is `openblas` for ILP64 (integer width = 64 bits) and `openblasCompat` for LP64 (integer width = 32 bits).  `openblasCompat` is the default.
 
--   [LAPACK reference](http://www.netlib.org/lapack/) (also provides BLAS and CBLAS)
+-   [LAPACK reference](https://www.netlib.org/lapack/) (also provides BLAS and CBLAS)
 
     The Nixpkgs attribute is `lapack-reference`.
 
diff --git a/lib/licenses.nix b/lib/licenses.nix
index a90bab0b15d..ad6922498ab 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -516,17 +516,17 @@ in mkLicense lset) ({
 
   generaluser = {
     fullName = "GeneralUser GS License v2.0";
-    url = "http://www.schristiancollins.com/generaluser.php"; # license included in sources
+    url = "https://www.schristiancollins.com/generaluser.php"; # license included in sources
   };
 
   gfl = {
     fullName = "GUST Font License";
-    url = "http://www.gust.org.pl/fonts/licenses/GUST-FONT-LICENSE.txt";
+    url = "https://www.gust.org.pl/projects/e-foundry/licenses/GUST-FONT-LICENSE.txt";
   };
 
   gfsl = {
     fullName = "GUST Font Source License";
-    url = "http://www.gust.org.pl/fonts/licenses/GUST-FONT-SOURCE-LICENSE.txt";
+    url = "https://www.gust.org.pl/projects/e-foundry/licenses/GUST-FONT-SOURCE-LICENSE.txt";
   };
 
   gpl1Only = {
@@ -613,7 +613,7 @@ in mkLicense lset) ({
   info-zip = {
     spdxId = "Info-ZIP";
     fullName = "Info-ZIP License";
-    url = "http://www.info-zip.org/pub/infozip/license.html";
+    url = "https://infozip.sourceforge.net/license.html";
   };
 
   inria-compcert = {
@@ -1182,7 +1182,7 @@ in mkLicense lset) ({
 
   xfig = {
     fullName = "xfig";
-    url = "http://mcj.sourceforge.net/authors.html#xfig"; # https is broken
+    url = "https://mcj.sourceforge.net/authors.html#xfig";
   };
 
   zlib = {
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 7c1d6d5ed9e..ead9eb41d1d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -12478,6 +12478,11 @@
     githubId = 6709831;
     name = "Jake Hill";
   };
+  nasageek = {
+    github = "NasaGeek";
+    githubId = 474937;
+    name = "Chris Roberts";
+  };
   nasirhm = {
     email = "nasirhussainm14@gmail.com";
     github = "nasirhm";
diff --git a/maintainers/scripts/haskell/upload-nixos-package-list-to-hackage.sh b/maintainers/scripts/haskell/upload-nixos-package-list-to-hackage.sh
index 86fecbc3d87..9130941a536 100755
--- a/maintainers/scripts/haskell/upload-nixos-package-list-to-hackage.sh
+++ b/maintainers/scripts/haskell/upload-nixos-package-list-to-hackage.sh
@@ -39,5 +39,5 @@ fi
 package_list="$(nix-build -A haskell.package-list)/nixos-hackage-packages.csv"
 username=$(grep "^username:" "$CABAL_DIR/config" | sed "s/^username: //")
 password_command=$(grep "^password-command:" "$CABAL_DIR/config" | sed "s/^password-command: //")
-curl -u "$username:$($password_command | head -n1)" --digest -H "Content-type: text/csv" -T "$package_list" http://hackage.haskell.org/distro/NixOS/packages.csv
+curl -u "$username:$($password_command | head -n1)" --digest -H "Content-type: text/csv" -T "$package_list" https://hackage.haskell.org/distro/NixOS/packages.csv
 echo
diff --git a/nixos/doc/manual/configuration/subversion.chapter.md b/nixos/doc/manual/configuration/subversion.chapter.md
index 84f9c270337..ff870f5c40b 100644
--- a/nixos/doc/manual/configuration/subversion.chapter.md
+++ b/nixos/doc/manual/configuration/subversion.chapter.md
@@ -2,7 +2,7 @@
 
 [Subversion](https://subversion.apache.org/) is a centralized
 version-control system. It can use a [variety of
-protocols](http://svnbook.red-bean.com/en/1.7/svn-book.html#svn.serverconfig.choosing)
+protocols](https://svnbook.red-bean.com/en/1.7/svn-book.html#svn.serverconfig.choosing)
 for communication between client and server.
 
 ## Subversion inside Apache HTTP {#module-services-subversion-apache-httpd}
@@ -14,7 +14,7 @@ for communication.
 
 For more information on the general setup, please refer to the [the
 appropriate section of the Subversion
-book](http://svnbook.red-bean.com/en/1.7/svn-book.html#svn.serverconfig.httpd).
+book](https://svnbook.red-bean.com/en/1.7/svn-book.html#svn.serverconfig.httpd).
 
 To configure, include in `/etc/nixos/configuration.nix` code to activate
 Apache HTTP, setting [](#opt-services.httpd.adminAddr)
diff --git a/nixos/doc/manual/development/running-nixos-tests-interactively.section.md b/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
index a816213f37d..4b8385d7e0d 100644
--- a/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
+++ b/nixos/doc/manual/development/running-nixos-tests-interactively.section.md
@@ -62,7 +62,7 @@ where socat is running.
 If your test has only a single VM, you may use e.g.
 
 ```ShellSession
-$ QEMU_NET_OPTS="hostfwd=tcp:127.0.0.1:2222-127.0.0.1:22" ./result/bin/nixos-test-driver
+$ QEMU_NET_OPTS="hostfwd=tcp:127.0.0.1:2222-:22" ./result/bin/nixos-test-driver
 ```
 
 to port-forward a port in the VM (here `22`) to the host machine (here port `2222`).
@@ -73,6 +73,11 @@ since a single port on the host cannot forward to multiple VMs.
 If the test defines multiple machines, you may opt to _temporarily_ set
 `virtualisation.forwardPorts` in the test definition for debugging.
 
+Such port forwardings connect via the VM's virtual network interface.
+Thus they cannot connect to ports that are only bound to the VM's
+loopback interface (`127.0.0.1`), and the VM's NixOS firewall
+must be configured to allow these connections.
+
 ## Reuse VM state {#sec-nixos-test-reuse-vm-state}
 
 You can re-use the VM states coming from a previous run by setting the
diff --git a/nixos/doc/manual/development/writing-documentation.chapter.md b/nixos/doc/manual/development/writing-documentation.chapter.md
index c07a2618c07..3d9bd318cf3 100644
--- a/nixos/doc/manual/development/writing-documentation.chapter.md
+++ b/nixos/doc/manual/development/writing-documentation.chapter.md
@@ -33,13 +33,13 @@ symlink at `./result/share/doc/nixos/index.html`.
 ## Editing DocBook XML {#sec-writing-docs-editing-docbook-xml}
 
 For general information on how to write in DocBook, see [DocBook 5: The
-Definitive Guide](http://www.docbook.org/tdg5/en/html/docbook.html).
+Definitive Guide](https://tdg.docbook.org/tdg/5.1/).
 
 Emacs nXML Mode is very helpful for editing DocBook XML because it
 validates the document as you write, and precisely locates errors. To
 use it, see [](#sec-emacs-docbook-xml).
 
-[Pandoc](http://pandoc.org) can generate DocBook XML from a multitude of
+[Pandoc](https://pandoc.org/) can generate DocBook XML from a multitude of
 formats, which makes a good starting point. Here is an example of Pandoc
 invocation to convert GitHub-Flavoured MarkDown to DocBook 5 XML:
 
@@ -62,9 +62,9 @@ topic from scratch.
 
 Keep the following guidelines in mind when you create and add a topic:
 
--   The NixOS [`book`](http://www.docbook.org/tdg5/en/html/book.html)
+-   The NixOS [`book`](https://tdg.docbook.org/tdg/5.0/book.html)
     element is in `nixos/doc/manual/manual.xml`. It includes several
-    [`parts`](http://www.docbook.org/tdg5/en/html/book.html) which are in
+    [`parts`](https://tdg.docbook.org/tdg/5.0/book.html) which are in
     subdirectories.
 
 -   Store the topic file in the same directory as the `part` to which it
diff --git a/nixos/doc/manual/installation/changing-config.chapter.md b/nixos/doc/manual/installation/changing-config.chapter.md
index f2ffea9088a..12abf90b718 100644
--- a/nixos/doc/manual/installation/changing-config.chapter.md
+++ b/nixos/doc/manual/installation/changing-config.chapter.md
@@ -89,7 +89,7 @@ guest. For instance, the following will forward host port 2222 to guest
 port 22 (SSH):
 
 ```ShellSession
-$ QEMU_NET_OPTS="hostfwd=tcp:127.0.0.1:2222-127.0.0.1:22" ./result/bin/run-*-vm
+$ QEMU_NET_OPTS="hostfwd=tcp:127.0.0.1:2222-:22" ./result/bin/run-*-vm
 ```
 
 allowing you to log in via SSH (assuming you have set the appropriate
@@ -98,3 +98,8 @@ passwords or SSH authorized keys):
 ```ShellSession
 $ ssh -p 2222 localhost
 ```
+
+Such port forwardings connect via the VM's virtual network interface.
+Thus they cannot connect to ports that are only bound to the VM's
+loopback interface (`127.0.0.1`), and the VM's NixOS firewall
+must be configured to allow these connections.
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index b4251214876..39aac9fb821 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -153,7 +153,7 @@ let
           {file}`pam_mount.conf.xml`.
           Useful attributes might include `path`,
           `options`, `fstype`, and `server`.
-          See <http://pam-mount.sourceforge.net/pam_mount.conf.5.html>
+          See <https://pam-mount.sourceforge.net/pam_mount.conf.5.html>
           for more information.
         '';
       };
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 164c868a9f0..2f9edba4f0c 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -130,7 +130,7 @@ sub pciCheck {
     debug "\n";
 
     if (defined $module) {
-        # See the bottom of http://pciids.sourceforge.net/pci.ids for
+        # See the bottom of https://pciids.sourceforge.net/pci.ids for
         # device classes.
         if (# Mass-storage controller.  Definitely important.
             $class =~ /^0x01/ ||
diff --git a/nixos/modules/programs/npm.nix b/nixos/modules/programs/npm.nix
index 48dc48e668f..c41fea32614 100644
--- a/nixos/modules/programs/npm.nix
+++ b/nixos/modules/programs/npm.nix
@@ -34,7 +34,7 @@ in
           prefix = ''${HOME}/.npm
           https-proxy=proxy.example.com
           init-license=MIT
-          init-author-url=http://npmjs.org
+          init-author-url=https://www.npmjs.com/
           color=true
         '';
       };
diff --git a/nixos/modules/programs/zsh/oh-my-zsh.md b/nixos/modules/programs/zsh/oh-my-zsh.md
index 73d425244ce..6a310006edb 100644
--- a/nixos/modules/programs/zsh/oh-my-zsh.md
+++ b/nixos/modules/programs/zsh/oh-my-zsh.md
@@ -78,7 +78,7 @@ If third-party customizations (e.g. new themes) are supposed to be added to
 
   - Completion scripts are supposed to be stored at
     `$out/share/zsh/site-functions`. This directory is part of the
-    [`fpath`](http://zsh.sourceforge.net/Doc/Release/Functions.html)
+    [`fpath`](https://zsh.sourceforge.io/Doc/Release/Functions.html)
     and the package should be compatible with pure `ZSH`
     setups. The module will automatically link the contents of
     `site-functions` to completions directory in the proper
diff --git a/nixos/modules/security/google_oslogin.nix b/nixos/modules/security/google_oslogin.nix
index f75b4df1851..95975943ff8 100644
--- a/nixos/modules/security/google_oslogin.nix
+++ b/nixos/modules/security/google_oslogin.nix
@@ -42,6 +42,10 @@ in
     security.sudo.extraConfig = ''
       #includedir /run/google-sudoers.d
     '';
+    security.sudo-rs.extraConfig = ''
+      #includedir /run/google-sudoers.d
+    '';
+
     systemd.tmpfiles.rules = [
       "d /run/google-sudoers.d 750 root root -"
       "d /var/google-users.d 750 root root -"
diff --git a/nixos/modules/security/pam_mount.nix b/nixos/modules/security/pam_mount.nix
index ad78f38b086..26f906f2a76 100644
--- a/nixos/modules/security/pam_mount.nix
+++ b/nixos/modules/security/pam_mount.nix
@@ -33,7 +33,7 @@ in
         default = [];
         description = lib.mdDoc ''
           List of volume definitions for pam_mount.
-          For more information, visit <http://pam-mount.sourceforge.net/pam_mount.conf.5.html>.
+          For more information, visit <https://pam-mount.sourceforge.net/pam_mount.conf.5.html>.
         '';
       };
 
@@ -78,7 +78,7 @@ in
         description = lib.mdDoc ''
           Sets the Debug-Level. 0 disables debugging, 1 enables pam_mount tracing,
           and 2 additionally enables tracing in mount.crypt. The default is 0.
-          For more information, visit <http://pam-mount.sourceforge.net/pam_mount.conf.5.html>.
+          For more information, visit <https://pam-mount.sourceforge.net/pam_mount.conf.5.html>.
         '';
       };
 
@@ -88,7 +88,7 @@ in
         description = lib.mdDoc ''
           Amount of microseconds to wait until killing remaining processes after
           final logout.
-          For more information, visit <http://pam-mount.sourceforge.net/pam_mount.conf.5.html>.
+          For more information, visit <https://pam-mount.sourceforge.net/pam_mount.conf.5.html>.
         '';
       };
 
diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix
index de427ccb295..327f49c0b63 100644
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@@ -35,7 +35,7 @@ in
       description = lib.mdDoc
         ''
           Any polkit rules to be added to config (in JavaScript ;-). See:
-          http://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html#polkit-rules
+          <https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html#polkit-rules>
         '';
     };
 
@@ -117,4 +117,3 @@ in
   };
 
 }
-
diff --git a/nixos/modules/services/audio/jack.nix b/nixos/modules/services/audio/jack.nix
index 105e99cb2f5..b51f2a78c98 100644
--- a/nixos/modules/services/audio/jack.nix
+++ b/nixos/modules/services/audio/jack.nix
@@ -225,7 +225,7 @@ in {
         description = "JACK Audio system service user";
         isSystemUser = true;
       };
-      # http://jackaudio.org/faq/linux_rt_config.html
+      # https://jackaudio.org/faq/linux_rt_config.html
       security.pam.loginLimits = [
         { domain = "@jackaudio"; type = "-"; item = "rtprio"; value = "99"; }
         { domain = "@jackaudio"; type = "-"; item = "memlock"; value = "unlimited"; }
diff --git a/nixos/modules/services/computing/boinc/client.nix b/nixos/modules/services/computing/boinc/client.nix
index 51475171bf3..ff16795c820 100644
--- a/nixos/modules/services/computing/boinc/client.nix
+++ b/nixos/modules/services/computing/boinc/client.nix
@@ -54,7 +54,7 @@ in
           only the hosts listed in {var}`dataDir`/remote_hosts.cfg will be allowed to
           connect.
 
-          See also: <http://boinc.berkeley.edu/wiki/Controlling_BOINC_remotely#Remote_access>
+          See also: <https://boinc.berkeley.edu/wiki/Controlling_BOINC_remotely#Remote_access>
         '';
       };
 
diff --git a/nixos/modules/services/computing/slurm/slurm.nix b/nixos/modules/services/computing/slurm/slurm.nix
index 344c43a429b..1cbe7b893f8 100644
--- a/nixos/modules/services/computing/slurm/slurm.nix
+++ b/nixos/modules/services/computing/slurm/slurm.nix
@@ -6,7 +6,7 @@ let
 
   cfg = config.services.slurm;
   opt = options.services.slurm;
-  # configuration file can be generated by http://slurm.schedmd.com/configurator.html
+  # configuration file can be generated by https://slurm.schedmd.com/configurator.html
 
   defaultUser = "slurm";
 
diff --git a/nixos/modules/services/databases/couchdb.nix b/nixos/modules/services/databases/couchdb.nix
index 0a81a8dceee..bfecfbb3664 100644
--- a/nixos/modules/services/databases/couchdb.nix
+++ b/nixos/modules/services/databases/couchdb.nix
@@ -79,7 +79,7 @@ in {
         '';
       };
 
-      # couchdb options: http://docs.couchdb.org/en/latest/config/index.html
+      # couchdb options: https://docs.couchdb.org/en/latest/config/index.html
 
       databaseDir = mkOption {
         type = types.path;
diff --git a/nixos/modules/services/databases/firebird.nix b/nixos/modules/services/databases/firebird.nix
index 26ed46f0e60..3927c81d953 100644
--- a/nixos/modules/services/databases/firebird.nix
+++ b/nixos/modules/services/databases/firebird.nix
@@ -17,7 +17,7 @@
 # There are at least two ways to run firebird. superserver has been chosen
 # however there are no strong reasons to prefer this or the other one AFAIK
 # Eg superserver is said to be most efficiently using resources according to
-# http://www.firebirdsql.org/manual/qsg25-classic-or-super.html
+# https://www.firebirdsql.org/manual/qsg25-classic-or-super.html
 
 with lib;
 
diff --git a/nixos/modules/services/databases/pgmanage.nix b/nixos/modules/services/databases/pgmanage.nix
index 12c8253ab49..a0933a5ffc4 100644
--- a/nixos/modules/services/databases/pgmanage.nix
+++ b/nixos/modules/services/databases/pgmanage.nix
@@ -66,7 +66,7 @@ in {
         pgmanage requires at least one PostgreSQL server be defined.
 
         Detailed information about PostgreSQL connection strings is available at:
-        <http://www.postgresql.org/docs/current/static/libpq-connect.html>
+        <https://www.postgresql.org/docs/current/libpq-connect.html>
 
         Note that you should not specify your user name or password. That
         information will be entered on the login screen. If you specify a
diff --git a/nixos/modules/services/databases/postgresql.md b/nixos/modules/services/databases/postgresql.md
index e4b679a3eee..d65d9616e2f 100644
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@@ -5,7 +5,7 @@
 
 *Source:* {file}`modules/services/databases/postgresql.nix`
 
-*Upstream documentation:* <http://www.postgresql.org/docs/>
+*Upstream documentation:* <https://www.postgresql.org/docs/>
 
 <!-- FIXME: more stuff, like maintainer? -->
 
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index 21e6a60e32a..af4db5c9611 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -588,7 +588,7 @@ in
                    else "simple";
 
             # Shut down Postgres using SIGINT ("Fast Shutdown mode").  See
-            # http://www.postgresql.org/docs/current/static/server-shutdown.html
+            # https://www.postgresql.org/docs/current/server-shutdown.html
             KillSignal = "SIGINT";
             KillMode = "mixed";
 
diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index 86b295dadf4..315a0282cd7 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -63,7 +63,7 @@ in {
 
       vmOverCommit = mkEnableOption (lib.mdDoc ''
         setting of vm.overcommit_memory to 1
-        (Suggested for Background Saving: http://redis.io/topics/faq)
+        (Suggested for Background Saving: <https://redis.io/docs/get-started/faq/>)
       '');
 
       servers = mkOption {
diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index 24987374ab0..08ca7a0d247 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -279,7 +279,7 @@ in
       default = true;
       type = types.bool;
       description = lib.mdDoc ''
-        Whether to assign [predictable names to network interfaces](http://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames).
+        Whether to assign [predictable names to network interfaces](https://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/).
         If enabled, interfaces
         are assigned names that contain topology information
         (e.g. `wlp3s0`) and thus should be stable
diff --git a/nixos/modules/services/logging/logstash.nix b/nixos/modules/services/logging/logstash.nix
index e9e3ae1f14c..42d52a61639 100644
--- a/nixos/modules/services/logging/logstash.nix
+++ b/nixos/modules/services/logging/logstash.nix
@@ -123,7 +123,7 @@ in
         example = ''
           if [type] == "syslog" {
             # Keep only relevant systemd fields
-            # http://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html
+            # https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html
             prune {
               whitelist_names => [
                 "type", "@timestamp", "@version",
diff --git a/nixos/modules/services/misc/mediatomb.nix b/nixos/modules/services/misc/mediatomb.nix
index 632b7caaac4..335b1b684b1 100644
--- a/nixos/modules/services/misc/mediatomb.nix
+++ b/nixos/modules/services/misc/mediatomb.nix
@@ -186,7 +186,7 @@ let
   defaultFirewallRules = {
     # udp 1900 port needs to be opened for SSDP (not configurable within
     # mediatomb/gerbera) cf.
-    # http://docs.gerbera.io/en/latest/run.html?highlight=udp%20port#network-setup
+    # https://docs.gerbera.io/en/latest/run.html?highlight=udp%20port#network-setup
     allowedUDPPorts = [ 1900 cfg.port ];
     allowedTCPPorts = [ cfg.port ];
   };
diff --git a/nixos/modules/services/monitoring/bosun.nix b/nixos/modules/services/monitoring/bosun.nix
index dc75fda6ed8..1dc19743461 100644
--- a/nixos/modules/services/monitoring/bosun.nix
+++ b/nixos/modules/services/monitoring/bosun.nix
@@ -108,7 +108,7 @@ in {
           option.
 
           A detailed description of the supported syntax can be found at-spi2-atk
-          http://bosun.org/configuration.html
+          https://bosun.org/configuration.html
         '';
       };
 
diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index e90a0e9d16d..5e21407042b 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -88,7 +88,7 @@ let
   # Get a submodule without any embedded metadata:
   _filter = x: filterAttrs (k: v: k != "_module") x;
 
-  # http://docs.grafana.org/administration/provisioning/#datasources
+  # https://grafana.com/docs/grafana/latest/administration/provisioning/#datasources
   grafanaTypes.datasourceConfig = types.submodule {
     freeformType = provisioningSettingsFormat.type;
 
@@ -140,7 +140,7 @@ let
     };
   };
 
-  # http://docs.grafana.org/administration/provisioning/#dashboards
+  # https://grafana.com/docs/grafana/latest/administration/provisioning/#dashboards
   grafanaTypes.dashboardConfig = types.submodule {
     freeformType = provisioningSettingsFormat.type;
 
diff --git a/nixos/modules/services/monitoring/graphite.nix b/nixos/modules/services/monitoring/graphite.nix
index 65c91b8f79b..cc3d7097620 100644
--- a/nixos/modules/services/monitoring/graphite.nix
+++ b/nixos/modules/services/monitoring/graphite.nix
@@ -102,7 +102,7 @@ in {
         default = "";
         description = lib.mdDoc ''
           Graphite webapp settings. See:
-          <http://graphite.readthedocs.io/en/latest/config-local-settings.html>
+          <https://graphite.readthedocs.io/en/latest/config-local-settings.html>
         '';
       };
     };
diff --git a/nixos/modules/services/monitoring/munin.nix b/nixos/modules/services/monitoring/munin.nix
index 90a51181ac3..5ed7cac48ae 100644
--- a/nixos/modules/services/monitoring/munin.nix
+++ b/nixos/modules/services/monitoring/munin.nix
@@ -4,7 +4,7 @@
 # TODO: LWP/Pg perl libs aren't recognized
 
 # TODO: support fastcgi
-# http://guide.munin-monitoring.org/en/latest/example/webserver/apache-cgi.html
+# https://guide.munin-monitoring.org/en/latest/example/webserver/apache-cgi.html
 # spawn-fcgi -s /run/munin/fastcgi-graph.sock -U www-data   -u munin -g munin /usr/lib/munin/cgi/munin-cgi-graph
 # spawn-fcgi -s /run/munin/fastcgi-html.sock  -U www-data   -u munin -g munin /usr/lib/munin/cgi/munin-cgi-html
 # https://paste.sh/vofcctHP#-KbDSXVeWoifYncZmLfZzgum
@@ -147,7 +147,7 @@ in
           Enable Munin Node agent. Munin node listens on 0.0.0.0 and
           by default accepts connections only from 127.0.0.1 for security reasons.
 
-          See <http://guide.munin-monitoring.org/en/latest/architecture/index.html>.
+          See <https://guide.munin-monitoring.org/en/latest/architecture/index.html>.
         '';
       };
 
@@ -156,7 +156,7 @@ in
         type = types.lines;
         description = lib.mdDoc ''
           {file}`munin-node.conf` extra configuration. See
-          <http://guide.munin-monitoring.org/en/latest/reference/munin-node.conf.html>
+          <https://guide.munin-monitoring.org/en/latest/reference/munin-node.conf.html>
         '';
       };
 
@@ -165,7 +165,7 @@ in
         type = types.lines;
         description = lib.mdDoc ''
           {file}`plugin-conf.d` extra plugin configuration. See
-          <http://guide.munin-monitoring.org/en/latest/plugin/use.html>
+          <https://guide.munin-monitoring.org/en/latest/plugin/use.html>
         '';
         example = ''
           [fail2ban_*]
@@ -273,9 +273,9 @@ in
         type = types.lines;
         description = lib.mdDoc ''
           {file}`munin.conf` extra global configuration.
-          See <http://guide.munin-monitoring.org/en/latest/reference/munin.conf.html>.
+          See <https://guide.munin-monitoring.org/en/latest/reference/munin.conf.html>.
           Useful to setup notifications, see
-          <http://guide.munin-monitoring.org/en/latest/tutorial/alert.html>
+          <https://guide.munin-monitoring.org/en/latest/tutorial/alert.html>
         '';
         example = ''
           contact.email.command mail -s "Munin notification for ''${var:host}" someone@example.com
@@ -288,7 +288,7 @@ in
         description = lib.mdDoc ''
           Definitions of hosts of nodes to collect data from. Needs at least one
           host for cron to succeed. See
-          <http://guide.munin-monitoring.org/en/latest/reference/munin.conf.html>
+          <https://guide.munin-monitoring.org/en/latest/reference/munin.conf.html>
         '';
         example = literalExpression ''
           '''
diff --git a/nixos/modules/services/monitoring/nagios.nix b/nixos/modules/services/monitoring/nagios.nix
index 8feff22c118..dc5fa1be292 100644
--- a/nixos/modules/services/monitoring/nagios.nix
+++ b/nixos/modules/services/monitoring/nagios.nix
@@ -88,7 +88,7 @@ in
 
   options = {
     services.nagios = {
-      enable = mkEnableOption (lib.mdDoc ''[Nagios](http://www.nagios.org/) to monitor your system or network.'');
+      enable = mkEnableOption (lib.mdDoc ''[Nagios](https://www.nagios.org/) to monitor your system or network.'');
 
       objectDefs = mkOption {
         description = lib.mdDoc ''
diff --git a/nixos/modules/services/network-filesystems/xtreemfs.nix b/nixos/modules/services/network-filesystems/xtreemfs.nix
index 926c3c3bd52..866661cf4e6 100644
--- a/nixos/modules/services/network-filesystems/xtreemfs.nix
+++ b/nixos/modules/services/network-filesystems/xtreemfs.nix
@@ -176,7 +176,7 @@ in
           description = lib.mdDoc ''
             Configuration of XtreemFS DIR service.
             WARNING: configuration is saved as plaintext inside nix store.
-            For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+            For more options: https://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
           '';
         };
         replication = {
@@ -218,7 +218,7 @@ in
             description = lib.mdDoc ''
               Configuration of XtreemFS DIR replication plugin.
               WARNING: configuration is saved as plaintext inside nix store.
-              For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+              For more options: https://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
             '';
           };
         };
@@ -319,7 +319,7 @@ in
           description = lib.mdDoc ''
             Configuration of XtreemFS MRC service.
             WARNING: configuration is saved as plaintext inside nix store.
-            For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+            For more options: https://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
           '';
         };
         replication = {
@@ -361,7 +361,7 @@ in
             description = lib.mdDoc ''
               Configuration of XtreemFS MRC replication plugin.
               WARNING: configuration is saved as plaintext inside nix store.
-              For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+              For more options: https://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
             '';
           };
         };
@@ -438,7 +438,7 @@ in
           description = lib.mdDoc ''
             Configuration of XtreemFS OSD service.
             WARNING: configuration is saved as plaintext inside nix store.
-            For more options: http://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
+            For more options: https://www.xtreemfs.org/xtfs-guide-1.5.1/index.html
           '';
         };
       };
diff --git a/nixos/modules/services/networking/asterisk.nix b/nixos/modules/services/networking/asterisk.nix
index 5a1d03f0721..279927781ed 100644
--- a/nixos/modules/services/networking/asterisk.nix
+++ b/nixos/modules/services/networking/asterisk.nix
@@ -139,7 +139,7 @@ in
           path.
 
           See
-          <http://www.asterisk.org/community/documentation>
+          <https://www.asterisk.org/community/documentation/>
           for more examples of what is possible here.
         '';
       };
diff --git a/nixos/modules/services/networking/i2pd.nix b/nixos/modules/services/networking/i2pd.nix
index f872daf05b8..808e7b66d36 100644
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@@ -239,7 +239,7 @@ in
       enable = mkEnableOption (lib.mdDoc "I2Pd daemon") // {
         description = lib.mdDoc ''
           Enables I2Pd as a running service upon activation.
-          Please read http://i2pd.readthedocs.io/en/latest/ for further
+          Please read <https://i2pd.readthedocs.io/en/latest/> for further
           configuration help.
         '';
       };
diff --git a/nixos/modules/services/networking/ntp/ntpd.nix b/nixos/modules/services/networking/ntp/ntpd.nix
index 036a8df635d..2bc690cacf0 100644
--- a/nixos/modules/services/networking/ntp/ntpd.nix
+++ b/nixos/modules/services/networking/ntp/ntpd.nix
@@ -56,7 +56,7 @@ in
           The default flags prevent external hosts from using ntpd as a DDoS
           reflector, setting system time, and querying OS/ntpd version. As
           recommended in section 6.5.1.1.3, answer "No" of
-          http://support.ntp.org/bin/view/Support/AccessRestrictions
+          https://support.ntp.org/Support/AccessRestrictions
         '';
         default = [ "limited" "kod" "nomodify" "notrap" "noquery" "nopeer" ];
       };
diff --git a/nixos/modules/services/networking/tox-bootstrapd.nix b/nixos/modules/services/networking/tox-bootstrapd.nix
index 5c7e7a4c220..0f310a28d26 100644
--- a/nixos/modules/services/networking/tox-bootstrapd.nix
+++ b/nixos/modules/services/networking/tox-bootstrapd.nix
@@ -47,7 +47,7 @@ in
               lib.mdDoc ''
                 Configuration for bootstrap daemon.
                 See <https://github.com/irungentoo/toxcore/blob/master/other/bootstrap_daemon/tox-bootstrapd.conf>
-                and <http://wiki.tox.im/Nodes>.
+                and <https://wiki.tox.chat/users/nodes>.
              '';
           };
       };
diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix
index b98cb5283a1..5efb9334ea0 100644
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@@ -148,7 +148,7 @@ in
             type = types.bool;
             default = true;
             description = lib.mdDoc ''
-              Whether to enable [Micro Transport Protocol (µTP)](http://en.wikipedia.org/wiki/Micro_Transport_Protocol).
+              Whether to enable [Micro Transport Protocol (µTP)](https://en.wikipedia.org/wiki/Micro_Transport_Protocol).
             '';
           };
           options.watch-dir = mkOption {
diff --git a/nixos/modules/services/video/unifi-video.nix b/nixos/modules/services/video/unifi-video.nix
index cb438a08150..5c93f60cbd7 100644
--- a/nixos/modules/services/video/unifi-video.nix
+++ b/nixos/modules/services/video/unifi-video.nix
@@ -32,7 +32,7 @@ let
     name = "mongo.conf";
     executable = false;
     text = ''
-      # for documentation of all options, see http://docs.mongodb.org/manual/reference/configuration-options/
+      # for documentation of all options, see https://www.mongodb.com/docs/manual/reference/configuration-options/
 
       storage:
          dbPath: ${cfg.dataDir}/db
@@ -63,7 +63,7 @@ let
     executable = false;
     text = ''
       # for documentation of all options, see:
-      #   http://docs.mongodb.org/manual/reference/configuration-options/
+      #   https://www.mongodb.com/docs/manual/reference/configuration-options/
 
       storage:
          dbPath: ${cfg.dataDir}/db-wt
diff --git a/nixos/modules/services/web-apps/akkoma.nix b/nixos/modules/services/web-apps/akkoma.nix
index 5f9bbbd6637..8a8ed49115f 100644
--- a/nixos/modules/services/web-apps/akkoma.nix
+++ b/nixos/modules/services/web-apps/akkoma.nix
@@ -909,7 +909,7 @@ in {
   };
 
   config = mkIf cfg.enable {
-    warnings = optionals (!config.security.sudo.enable) [''
+    warnings = optionals (with config.security; (!sudo.enable) && (!sudo-rs.enable)) [''
       The pleroma_ctl wrapper enabled by the installWrapper option relies on
       sudo, which appears to have been disabled through security.sudo.enable.
     ''];
diff --git a/nixos/modules/services/web-apps/discourse.nix b/nixos/modules/services/web-apps/discourse.nix
index f80eb6b4c7f..da1dba7d940 100644
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@@ -407,7 +407,7 @@ in
             type = with lib.types; nullOr (enum ["plain" "login" "cram_md5"]);
             default = null;
             description = lib.mdDoc ''
-              Authentication type to use, see http://api.rubyonrails.org/classes/ActionMailer/Base.html
+              Authentication type to use, see https://api.rubyonrails.org/classes/ActionMailer/Base.html
             '';
           };
 
@@ -423,7 +423,7 @@ in
             type = lib.types.str;
             default = "peer";
             description = lib.mdDoc ''
-              How OpenSSL checks the certificate, see http://api.rubyonrails.org/classes/ActionMailer/Base.html
+              How OpenSSL checks the certificate, see https://api.rubyonrails.org/classes/ActionMailer/Base.html
             '';
           };
 
diff --git a/nixos/modules/services/web-apps/nextcloud.md b/nixos/modules/services/web-apps/nextcloud.md
index a25bed30e47..ecc7f380592 100644
--- a/nixos/modules/services/web-apps/nextcloud.md
+++ b/nixos/modules/services/web-apps/nextcloud.md
@@ -49,7 +49,7 @@ used by the imperative installer and all values are written to an additional fil
 to ensure that changes can be applied by changing the module's options.
 
 In case the application serves multiple domains (those are checked with
-[`$_SERVER['HTTP_HOST']`](http://php.net/manual/en/reserved.variables.server.php))
+[`$_SERVER['HTTP_HOST']`](https://www.php.net/manual/en/reserved.variables.server.php))
 it's needed to add them to
 [`services.nextcloud.config.extraTrustedDomains`](#opt-services.nextcloud.config.extraTrustedDomains).
 
diff --git a/nixos/modules/services/web-apps/tt-rss.nix b/nixos/modules/services/web-apps/tt-rss.nix
index 592ab253f7d..7b2e3be4295 100644
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@@ -430,7 +430,7 @@ let
           background processes while not running tt-rss, this method is generally
           viable to keep your feeds up to date.
           Still, there are more robust (and recommended) updating methods
-          available, you can read about them here: http://tt-rss.org/wiki/UpdatingFeeds
+          available, you can read about them here: <https://tt-rss.org/wiki/UpdatingFeeds>
         '';
       };
 
diff --git a/nixos/modules/services/web-servers/lighttpd/default.nix b/nixos/modules/services/web-servers/lighttpd/default.nix
index 729a633a36c..eaa113c0d52 100644
--- a/nixos/modules/services/web-servers/lighttpd/default.nix
+++ b/nixos/modules/services/web-servers/lighttpd/default.nix
@@ -10,7 +10,7 @@ let
 
   # List of known lighttpd modules, ordered by how the lighttpd documentation
   # recommends them being imported:
-  # http://redmine.lighttpd.net/projects/1/wiki/Server_modulesDetails
+  # https://redmine.lighttpd.net/projects/1/wiki/Server_modulesDetails
   #
   # Some modules are always imported and should not appear in the config:
   # disallowedModules = [ "mod_indexfile" "mod_dirlisting" "mod_staticfile" ];
@@ -84,8 +84,8 @@ let
       # server.modules += () entries in each sub-service extraConfig snippet,
       # read this:
       #
-      #   http://redmine.lighttpd.net/projects/1/wiki/Server_modulesDetails
-      #   http://redmine.lighttpd.net/issues/2337
+      #   https://redmine.lighttpd.net/projects/1/wiki/Server_modulesDetails
+      #   https://redmine.lighttpd.net/issues/2337
       #
       # Basically, lighttpd doesn't want to load (or even silently ignore) a
       # module for a second time, and there is no way to check if a module has
diff --git a/nixos/modules/services/web-servers/mighttpd2.nix b/nixos/modules/services/web-servers/mighttpd2.nix
index 2d887af87c7..bdd6d8b62aa 100644
--- a/nixos/modules/services/web-servers/mighttpd2.nix
+++ b/nixos/modules/services/web-servers/mighttpd2.nix
@@ -44,7 +44,7 @@ in {
       type = types.lines;
       description = lib.mdDoc ''
         Verbatim config file to use
-        (see http://www.mew.org/~kazu/proj/mighttpd/en/config.html)
+        (see https://kazu-yamamoto.github.io/mighttpd2/config.html)
       '';
     };
 
@@ -78,7 +78,7 @@ in {
       type = types.lines;
       description = lib.mdDoc ''
         Verbatim routing file to use
-        (see http://www.mew.org/~kazu/proj/mighttpd/en/config.html)
+        (see https://kazu-yamamoto.github.io/mighttpd2/config.html)
       '';
     };
 
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index f2e8585a936..cf70dc32594 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -955,7 +955,7 @@ in
         default = {};
         description = lib.mdDoc ''
           Configure a proxy cache path entry.
-          See <http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_path> for documentation.
+          See <https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_path> for documentation.
         '';
       };
 
diff --git a/nixos/modules/services/x11/desktop-managers/enlightenment.nix b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
index d4b2a50cb8a..28dd408c923 100644
--- a/nixos/modules/services/x11/desktop-managers/enlightenment.nix
+++ b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
@@ -63,7 +63,7 @@ in
         # make available for D-BUS user services
         #export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}:${config.system.path}/share:${e.efl}/share
 
-        # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
+        # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
         ${pkgs.xdg-user-dirs}/bin/xdg-user-dirs-update
       fi
     '';
diff --git a/nixos/modules/services/x11/desktop-managers/gnome.nix b/nixos/modules/services/x11/desktop-managers/gnome.nix
index 8b5daf83de1..12bdd933337 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome.nix
@@ -455,7 +455,7 @@ in
             pkgs.glib # for gsettings program
             pkgs.gnome-menus
             pkgs.gtk3.out # for gtk-launch program
-            pkgs.xdg-user-dirs # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
+            pkgs.xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
           ];
         in
         mandatoryPackages
diff --git a/nixos/modules/services/x11/desktop-managers/pantheon.nix b/nixos/modules/services/x11/desktop-managers/pantheon.nix
index eef7aa14057..d82d19b26cd 100644
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@@ -201,7 +201,7 @@ in
         onboard
         orca # elementary/greeter#668
         sound-theme-freedesktop
-        xdg-user-dirs # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
+        xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
       ]) ++ (with pkgs.pantheon; [
         # Artwork
         elementary-gtk-theme
diff --git a/nixos/modules/services/x11/display-managers/default.nix b/nixos/modules/services/x11/display-managers/default.nix
index 1f08ded7c96..16a7ff1a4bd 100644
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@@ -96,7 +96,7 @@ let
       )}
 
       # Speed up application start by 50-150ms according to
-      # http://kdemonkey.blogspot.nl/2008/04/magic-trick.html
+      # https://kdemonkey.blogspot.com/2008/04/magic-trick.html
       compose_cache="''${XCOMPOSECACHE:-$HOME/.compose-cache}"
       mkdir -p "$compose_cache"
       # To avoid accidentally deleting a wrongly set up XCOMPOSECACHE directory,
diff --git a/nixos/modules/services/x11/display-managers/xpra.nix b/nixos/modules/services/x11/display-managers/xpra.nix
index cb78f52d9b6..0861530f21e 100644
--- a/nixos/modules/services/x11/display-managers/xpra.nix
+++ b/nixos/modules/services/x11/display-managers/xpra.nix
@@ -60,11 +60,11 @@ in
       VertRefresh 1.0 - 200.0
       #To add your own modes here, use a modeline calculator, like:
       # cvt:
-      # http://www.x.org/archive/X11R7.5/doc/man/man1/cvt.1.html
+      # https://www.x.org/archive/X11R7.5/doc/man/man1/cvt.1.html
       # xtiming:
-      # http://xtiming.sourceforge.net/cgi-bin/xtiming.pl
+      # https://xtiming.sourceforge.net/cgi-bin/xtiming.pl
       # gtf:
-      # http://gtf.sourceforge.net/
+      # https://gtf.sourceforge.net/
       #This can be used to get a specific DPI, but only for the default resolution:
       #DisplaySize 508 317
       #NOTE: the highest modes will not work without increasing the VideoRam
diff --git a/nixos/modules/services/x11/imwheel.nix b/nixos/modules/services/x11/imwheel.nix
index 133e64c65cd..bd2bcb7bcd0 100644
--- a/nixos/modules/services/x11/imwheel.nix
+++ b/nixos/modules/services/x11/imwheel.nix
@@ -37,7 +37,7 @@ in
             Window class translation rules.
             /etc/X11/imwheelrc is generated based on this config
             which means this config is global for all users.
-            See [official man pages](http://imwheel.sourceforge.net/imwheel.1.html)
+            See [official man pages](https://imwheel.sourceforge.net/imwheel.1.html)
             for more information.
           '';
         };
diff --git a/nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix b/nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix
index 5ef3c5cd52a..13df6090711 100644
--- a/nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix
+++ b/nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix
@@ -25,7 +25,7 @@ in
           under `/boot/extlinux.conf`.  For instance,
           U-Boot's generic distro boot support uses this file format.
 
-          See [U-boot's documentation](http://git.denx.de/?p=u-boot.git;a=blob;f=doc/README.distro;hb=refs/heads/master)
+          See [U-boot's documentation](https://u-boot.readthedocs.io/en/latest/develop/distro.html)
           for more information.
         '';
       };
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
index 468f701ae5b..7097e1d83dc 100644
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -339,7 +339,7 @@ in
           See the
           [
           GRUB source code
-          ](http://git.savannah.gnu.org/cgit/grub.git/tree/grub-core/commands/nativedisk.c?h=grub-2.04#n326)
+          ](https://git.savannah.gnu.org/cgit/grub.git/tree/grub-core/commands/nativedisk.c?h=grub-2.04#n326)
           for which disk modules are available.
 
           The list elements are passed directly as `argv`
diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 06c329e006b..ca560d63f3b 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -537,7 +537,7 @@ in
       description = lib.mdDoc ''
         Unless enabled, encryption keys can be easily recovered by an attacker with physical
         access to any machine with PCMCIA, ExpressCard, ThunderBolt or FireWire port.
-        More information is available at <http://en.wikipedia.org/wiki/DMA_attack>.
+        More information is available at <https://en.wikipedia.org/wiki/DMA_attack>.
 
         This option blacklists FireWire drivers, but doesn't remove them. You can manually
         load the drivers if you need to use a FireWire device, but don't forget to unload them!
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index 322a234e0c4..13c71e1495e 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -284,7 +284,7 @@ let
       # in the NixOS installation CD, so use ID_CDROM_MEDIA in the
       # corresponding udev rules for now.  This was the behaviour in
       # udev <= 154.  See also
-      #   http://www.spinics.net/lists/hotplug/msg03935.html
+      #   https://www.spinics.net/lists/hotplug/msg03935.html
       substituteInPlace $out/60-persistent-storage.rules \
         --replace ID_CDROM_MEDIA_TRACK_COUNT_DATA ID_CDROM_MEDIA
     ''; # */
diff --git a/nixos/modules/virtualisation/google-compute-config.nix b/nixos/modules/virtualisation/google-compute-config.nix
index 3c503f027d7..887af26949f 100644
--- a/nixos/modules/virtualisation/google-compute-config.nix
+++ b/nixos/modules/virtualisation/google-compute-config.nix
@@ -84,6 +84,10 @@ in
     { groups = [ "google-sudoers" ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ]; }
   ];
 
+  security.sudo-rs.extraRules = mkIf config.users.mutableUsers [
+    { groups = [ "google-sudoers" ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ]; }
+  ];
+
   users.groups.google-sudoers = mkIf config.users.mutableUsers { };
 
   boot.extraModprobeConfig = readFile "${pkgs.google-guest-configs}/etc/modprobe.d/gce-blacklist.conf";
diff --git a/pkgs/applications/audio/pbpctrl/default.nix b/pkgs/applications/audio/pbpctrl/default.nix
index 3ce65da9f34..0a258b0cb9c 100644
--- a/pkgs/applications/audio/pbpctrl/default.nix
+++ b/pkgs/applications/audio/pbpctrl/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pbpctrl";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "qzed";
     repo = "${pname}";
     rev = "v${version}";
-    hash = "sha256-91sdlnffL/HX+Y8e6T+ZCa7MAcf4fWE0NJGLgmK47o8=";
+    hash = "sha256-tOdKXYfeO+HsYIDDU3fDb76ytRHVOcIqffEjFnLwOTI=";
   };
 
-  cargoHash = "sha256-U4//GvAEhrfOrivwW/6PbKHdWXGIuilPl7Zo17wnwDY=";
+  cargoHash = "sha256-yP4tsXCAPE1KUDU5oBIejL4kACK1dNXK7Kmw37VMexM=";
 
   nativeBuildInputs = [ pkg-config protobuf ];
   buildInputs = [ dbus ];
diff --git a/pkgs/applications/emulators/gxemul/default.nix b/pkgs/applications/emulators/gxemul/default.nix
index cacb521c2fb..05f837b1876 100644
--- a/pkgs/applications/emulators/gxemul/default.nix
+++ b/pkgs/applications/emulators/gxemul/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   version = "0.7.0";
 
   src = fetchurl {
-    url = "http://gavare.se/gxemul/src/${pname}-${version}.tar.gz";
+    url = "https://gavare.se/gxemul/src/${pname}-${version}.tar.gz";
     sha256 = "sha256-ecRDfG+MqQT0bTOsNgYqZf3PSpKiSEeOQIqxEpXPjoM=";
   };
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "http://gavare.se/gxemul/";
+    homepage = "https://gavare.se/gxemul/";
     description = "Gavare's experimental emulator";
     longDescription = ''
       GXemul is a framework for full-system computer architecture
diff --git a/pkgs/applications/file-managers/dfilemanager/default.nix b/pkgs/applications/file-managers/dfilemanager/default.nix
index 2c374511af5..6c5544aded3 100644
--- a/pkgs/applications/file-managers/dfilemanager/default.nix
+++ b/pkgs/applications/file-managers/dfilemanager/default.nix
@@ -17,7 +17,7 @@ mkDerivation {
   cmakeFlags = [ "-DQT5BUILD=true" ];
 
   meta = {
-    homepage = "http://dfilemanager.sourceforge.net/";
+    homepage = "https://github.com/probonopd/dfilemanager";
     description = "File manager written in Qt/C++";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.unix;
diff --git a/pkgs/applications/graphics/freecad/0001-NIXOS-don-t-ignore-PYTHONPATH.patch b/pkgs/applications/graphics/freecad/0001-NIXOS-don-t-ignore-PYTHONPATH.patch
index 371da24680e..27e5fb81b8d 100644
--- a/pkgs/applications/graphics/freecad/0001-NIXOS-don-t-ignore-PYTHONPATH.patch
+++ b/pkgs/applications/graphics/freecad/0001-NIXOS-don-t-ignore-PYTHONPATH.patch
@@ -24,12 +24,13 @@ diff --git a/src/Base/Interpreter.cpp b/src/Base/Interpreter.cpp
 index 52c47168af..9966bd0013 100644
 --- a/src/Base/Interpreter.cpp
 +++ b/src/Base/Interpreter.cpp
-@@ -554,7 +554,7 @@ void initInterpreter(int argc,char *argv[])
+@@ -554,7 +554,9 @@ void initInterpreter(int argc,char *argv[])
  {

      PyStatus status;

      PyConfig config;

--    PyConfig_InitIsolatedConfig(&config);

-+    PyConfig_InitPythonConfig(&config);

+     PyConfig_InitIsolatedConfig(&config);

++    config.isolated = 0;

++    config.use_environment = 1;

  

      status = PyConfig_SetBytesArgv(&config, argc, argv);

      if (PyStatus_Exception(status)) {

diff --git a/pkgs/applications/graphics/freecad/default.nix b/pkgs/applications/graphics/freecad/default.nix
index 76b2a38320d..857365cd66d 100644
--- a/pkgs/applications/graphics/freecad/default.nix
+++ b/pkgs/applications/graphics/freecad/default.nix
@@ -9,6 +9,7 @@
 , boost
 , coin3d
 , eigen
+, freecad  # for passthru.tests
 , gfortran
 , gts
 , hdf5
@@ -35,6 +36,7 @@
 , qtwebengine
 , qtx11extras
 , qtxmlpatterns
+, runCommand  # for passthru.tests
 , scipy
 , shiboken2
 , soqt
@@ -147,6 +149,21 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $out/bin/FreeCADCmd $out/bin/freecadcmd
   '';
 
+  passthru.tests = {
+    # Check that things such as argument parsing still work correctly with
+    # the above PYTHONPATH patch. Previously the patch used above changed
+    # the `PyConfig_InitIsolatedConfig` to `PyConfig_InitPythonConfig`,
+    # which caused the built-in interpreter to attempt (and fail) to doubly
+    # parse argv. This should catch if that ever regresses and also ensures
+    # that PYTHONPATH is still respected enough for the FreeCAD console to
+    # successfully run and check that it was included in `sys.path`.
+    python-path = runCommand "freecad-test-console" {
+      nativeBuildInputs = [ freecad ];
+    } ''
+      HOME="$(mktemp -d)" PYTHONPATH="$(pwd)/test" FreeCADCmd --log-file $out -c "if not '$(pwd)/test' in sys.path: sys.exit(1)" </dev/null
+    '';
+  };
+
   meta = {
     homepage = "https://www.freecad.org";
     description = "General purpose Open Source 3D CAD/MCAD/CAx/CAE/PLM modeler";
diff --git a/pkgs/applications/graphics/openscad/default.nix b/pkgs/applications/graphics/openscad/default.nix
index 37fcc0eb48e..fc048d4acae 100644
--- a/pkgs/applications/graphics/openscad/default.nix
+++ b/pkgs/applications/graphics/openscad/default.nix
@@ -105,7 +105,7 @@ mkDerivation rec {
       machine parts but pretty sure is not what you are looking for when you are more
       interested in creating computer-animated movies.
     '';
-    homepage = "http://openscad.org/";
+    homepage = "https://openscad.org/";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ bjornfor raskin gebner ];
diff --git a/pkgs/applications/graphics/pikopixel/default.nix b/pkgs/applications/graphics/pikopixel/default.nix
index 58a52aee494..0463958b4c6 100644
--- a/pkgs/applications/graphics/pikopixel/default.nix
+++ b/pkgs/applications/graphics/pikopixel/default.nix
@@ -13,7 +13,7 @@ in gnustep'.gsmakeDerivation rec {
   version = "1.0-b10";
 
   src = fetchurl {
-    url = "http://twilightedge.com/downloads/PikoPixel.Sources.${version}.tar.gz";
+    url = "https://twilightedge.com/downloads/PikoPixel.Sources.${version}.tar.gz";
     sha256 = "1b27npgsan2nx1p581b9q2krx4506yyd6s34r4sf1r9x9adshm77";
   };
 
@@ -38,8 +38,8 @@ in gnustep'.gsmakeDerivation rec {
 
   meta = with lib; {
     description = "Application for drawing and editing pixel-art images";
-    homepage = "http://twilightedge.com/mac/pikopixel/";
-    downloadPage = "http://twilightedge.com/mac/pikopixel/";
+    homepage = "https://twilightedge.com/mac/pikopixel/";
+    downloadPage = "https://twilightedge.com/mac/pikopixel/";
     license = licenses.agpl3;
     maintainers = with maintainers; [ fgaz ];
     platforms = platforms.all;
diff --git a/pkgs/applications/graphics/viewnior/default.nix b/pkgs/applications/graphics/viewnior/default.nix
index 74cc2bdc4e8..7f90c815837 100644
--- a/pkgs/applications/graphics/viewnior/default.nix
+++ b/pkgs/applications/graphics/viewnior/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
          in mind (follows Gnome HIG2).
       '';
     license = licenses.gpl3;
-    homepage = "http://siyanpanayotov.com/project/viewnior/";
+    homepage = "https://siyanpanayotov.com/project/viewnior/";
     maintainers = with maintainers; [ smironov artturin ];
     platforms = platforms.gnu ++ platforms.linux;
   };
diff --git a/pkgs/applications/misc/syncthingtray/default.nix b/pkgs/applications/misc/syncthingtray/default.nix
index 93d539b9f42..4f1a5fdef6b 100644
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@@ -33,14 +33,14 @@ https://github.com/NixOS/nixpkgs/issues/199596#issuecomment-1310136382 */
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.4.7";
+  version = "1.4.8";
   pname = "syncthingtray";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "syncthingtray";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-ddOyAyvFifsdNMbwcMZTyhA+5pvz6/Eu/VoBmdsHi54=";
+    sha256 = "sha256-Fy3cy6c36Qsi8F7cC/MI8g6tdfkn8fDBncL+ZOoiGcs=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/misc/yate/default.nix b/pkgs/applications/misc/yate/default.nix
index 07857fbf5e9..76eb27a624c 100644
--- a/pkgs/applications/misc/yate/default.nix
+++ b/pkgs/applications/misc/yate/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Yet another telephony engine";
-    homepage = "http://yate.ro/";
+    homepage = "https://yate.ro/";
     # Yate's license is GPL with an exception for linking with
     # OpenH323 and PWlib (licensed under MPL).
     license = lib.licenses.gpl2Only;
diff --git a/pkgs/applications/networking/clash-verge/default.nix b/pkgs/applications/networking/clash-verge/default.nix
index 82a31f3e5e2..f83583283d4 100644
--- a/pkgs/applications/networking/clash-verge/default.nix
+++ b/pkgs/applications/networking/clash-verge/default.nix
@@ -4,7 +4,6 @@
 , dpkg
 , wrapGAppsHook
 , autoPatchelfHook
-, clash
 , clash-meta
 , openssl
 , webkitgtk
@@ -49,7 +48,6 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    ln -s ${lib.getExe clash} $out/bin/clash
     ln -s ${lib.getExe clash-meta} $out/bin/clash-meta
   '';
 
diff --git a/pkgs/applications/networking/cluster/fn-cli/default.nix b/pkgs/applications/networking/cluster/fn-cli/default.nix
index 572c05e2a78..8e3b5d297b7 100644
--- a/pkgs/applications/networking/cluster/fn-cli/default.nix
+++ b/pkgs/applications/networking/cluster/fn-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fn";
-  version = "0.6.26";
+  version = "0.6.28";
 
   src = fetchFromGitHub {
     owner = "fnproject";
     repo = "cli";
     rev = version;
-    hash = "sha256-Tj64/8uYEy4qZISjmtpOGTMzgSkBB516/Dej6/biYRY=";
+    hash = "sha256-/ifr/sSaChZKRe9wCcjURhqZl2/JhIMewZSlJiit/7w=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/opentofu/default.nix b/pkgs/applications/networking/cluster/opentofu/default.nix
index 1a27df9b36d..228b52e800c 100644
--- a/pkgs/applications/networking/cluster/opentofu/default.nix
+++ b/pkgs/applications/networking/cluster/opentofu/default.nix
@@ -14,15 +14,15 @@
 let
   package =  buildGoModule rec {
     pname = "opentofu";
-    version = "1.6.0-alpha3";
+    version = "1.6.0-alpha4";
 
     src = fetchFromGitHub {
       owner = "opentofu";
       repo = "opentofu";
       rev = "v${version}";
-      hash = "sha256-D95YzliadhhcOx8gW+lhECiYBtezsS8rj0Tz/29azlA=";
+      hash = "sha256-JkYMGD6hNMcMYPXnFUm/6T0EfzeAfG4oQuyqcNv3hVE=";
     };
-    vendorHash = "sha256-SbGdmPTJRSMDhqg0GEfdiQ+2Uw7xmz0Kcyrr1ANlKo4=";
+    vendorHash = "sha256-kE61inSQ8aCFnPf8plVRUJgruSFVOsogJAbI1zvJdb4=";
     ldflags = [ "-s" "-w" ];
 
     postConfigure = ''
diff --git a/pkgs/applications/networking/cluster/pluto/default.nix b/pkgs/applications/networking/cluster/pluto/default.nix
index 3cb89329990..b496d5a8015 100644
--- a/pkgs/applications/networking/cluster/pluto/default.nix
+++ b/pkgs/applications/networking/cluster/pluto/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pluto";
-  version = "5.18.5";
+  version = "5.18.6";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${version}";
-    hash = "sha256-zdfzGmEL1ZsU3g3jmkgOfxcIGyffkC9UeiU18jPOr7Y=";
+    hash = "sha256-PQf1gEFlZ6Y9KMQjKeXAZy/OfxCbiKfST3pr9xp0/vg=";
   };
 
   vendorHash = "sha256-8ZOYp/vM16PugmE+3QK7ZRDwIwRCMEwD0NRyiOBlh14=";
diff --git a/pkgs/applications/networking/irc/kirc/default.nix b/pkgs/applications/networking/irc/kirc/default.nix
index b0e771a80f4..c21a444b61c 100644
--- a/pkgs/applications/networking/irc/kirc/default.nix
+++ b/pkgs/applications/networking/irc/kirc/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   installFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
-    homepage = "http://kirc.io/";
+    homepage = "https://mcpcpc.github.io/kirc/";
     description = "Tiny IRC client written in C99";
     longDescription = ''
       kirc is a tiny open-source Internet Relay Chat (IRC) client designed with
diff --git a/pkgs/applications/networking/irc/kvirc/default.nix b/pkgs/applications/networking/irc/kvirc/default.nix
index 8c1a96d5234..eb443666764 100644
--- a/pkgs/applications/networking/irc/kvirc/default.nix
+++ b/pkgs/applications/networking/irc/kvirc/default.nix
@@ -24,7 +24,7 @@ mkDerivation rec {
 
   meta = with lib; {
     description = "Advanced IRC Client";
-    homepage = "http://www.kvirc.net/";
+    homepage = "https://www.kvirc.net/";
     license = licenses.gpl2;
     maintainers = [ maintainers.suhr ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/networking/p2p/mldonkey/default.nix b/pkgs/applications/networking/p2p/mldonkey/default.nix
index 7bc5e2f5967..81a625e5210 100644
--- a/pkgs/applications/networking/p2p/mldonkey/default.nix
+++ b/pkgs/applications/networking/p2p/mldonkey/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   meta = {
     broken = stdenv.isDarwin;
     description = "Client for many p2p networks, with multiple frontends";
-    homepage = "http://mldonkey.sourceforge.net/";
+    homepage = "https://github.com/ygrek/mldonkey";
     license = lib.licenses.gpl2Only;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/applications/radio/ebook2cw/default.nix b/pkgs/applications/radio/ebook2cw/default.nix
index 6c3fbc16c40..329d87d80f4 100644
--- a/pkgs/applications/radio/ebook2cw/default.nix
+++ b/pkgs/applications/radio/ebook2cw/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Convert ebooks to Morse MP3s/OGGs";
-    homepage = "http://fkurz.net/ham/ebook2cw.html";
+    homepage = "https://fkurz.net/ham/ebook2cw.html";
     license = licenses.gpl2;
     platforms = platforms.all;
     maintainers = with maintainers; [ earldouglas ];
diff --git a/pkgs/applications/science/logic/aiger/default.nix b/pkgs/applications/science/logic/aiger/default.nix
index 972bea3fbc3..5b9e8f62aa0 100644
--- a/pkgs/applications/science/logic/aiger/default.nix
+++ b/pkgs/applications/science/logic/aiger/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "1.9.9";
 
   src = fetchurl {
-    url    = "http://fmv.jku.at/aiger/${pname}-${version}.tar.gz";
+    url    = "https://fmv.jku.at/aiger/${pname}-${version}.tar.gz";
     sha256 = "1ish0dw0nf9gyghxsdhpy1jjiy5wp54c993swp85xp7m6vdx6l0y";
   };
 
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "And-Inverter Graph (AIG) utilities";
-    homepage    = "http://fmv.jku.at/aiger/";
+    homepage    = "https://fmv.jku.at/aiger/";
     license     = lib.licenses.mit;
     maintainers = with lib.maintainers; [ thoughtpolice ];
     platforms   = lib.platforms.unix;
diff --git a/pkgs/applications/science/logic/cadical/default.nix b/pkgs/applications/science/logic/cadical/default.nix
index 9bfadc41f60..a9b27877ab1 100644
--- a/pkgs/applications/science/logic/cadical/default.nix
+++ b/pkgs/applications/science/logic/cadical/default.nix
@@ -43,6 +43,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ shnarazk ];
     platforms = platforms.unix;
     license = licenses.mit;
-    homepage = "http://fmv.jku.at/cadical";
+    homepage = "https://fmv.jku.at/cadical/";
   };
 }
diff --git a/pkgs/applications/science/logic/cvc3/default.nix b/pkgs/applications/science/logic/cvc3/default.nix
index cfa8f62990c..0385909610e 100644
--- a/pkgs/applications/science/logic/cvc3/default.nix
+++ b/pkgs/applications/science/logic/cvc3/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
     version = "2.4.1";
 
     src = fetchurl {
-      url = "http://www.cs.nyu.edu/acsys/cvc3/releases/${version}/${pname}-${version}.tar.gz";
+      url = "https://cs.nyu.edu/acsys/cvc3/releases/${version}/${pname}-${version}.tar.gz";
       sha256 = "1xxcwhz3y6djrycw8sm6xz83wb4hb12rd1n0skvc7fng0rh1snym";
     };
 
@@ -32,11 +32,11 @@ stdenv.mkDerivation rec {
       [ raskin ];
     platforms = platforms.unix;
     license = licenses.free;
-    homepage = "http://www.cs.nyu.edu/acsys/cvc3/index.html";
+    homepage = "https://cs.nyu.edu/acsys/cvc3/index.html";
   };
   passthru = {
     updateInfo = {
-      downloadPage = "http://www.cs.nyu.edu/acsys/cvc3/download.html";
+      downloadPage = "https://cs.nyu.edu/acsys/cvc3/download.html";
     };
   };
 }
diff --git a/pkgs/applications/science/logic/kissat/default.nix b/pkgs/applications/science/logic/kissat/default.nix
index 2941952287b..d1703340527 100644
--- a/pkgs/applications/science/logic/kissat/default.nix
+++ b/pkgs/applications/science/logic/kissat/default.nix
@@ -48,6 +48,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ shnarazk ];
     platforms = platforms.unix;
     license = licenses.mit;
-    homepage = "http://fmv.jku.at/kissat";
+    homepage = "https://fmv.jku.at/kissat";
   };
 }
diff --git a/pkgs/applications/science/logic/picosat/default.nix b/pkgs/applications/science/logic/picosat/default.nix
index 48def5fc2e4..1fef05069a6 100644
--- a/pkgs/applications/science/logic/picosat/default.nix
+++ b/pkgs/applications/science/logic/picosat/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "965";
 
   src = fetchurl {
-    url = "http://fmv.jku.at/picosat/${pname}-${version}.tar.gz";
+    url = "https://fmv.jku.at/picosat/${pname}-${version}.tar.gz";
     sha256 = "0m578rpa5rdn08d10kr4lbsdwp4402hpavrz6n7n53xs517rn5hm";
   };
 
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "SAT solver with proof and core support";
-    homepage    = "http://fmv.jku.at/picosat/";
+    homepage    = "https://fmv.jku.at/picosat/";
     license     = lib.licenses.mit;
     platforms   = lib.platforms.unix;
     maintainers = with lib.maintainers; [ roconnor thoughtpolice ];
diff --git a/pkgs/applications/science/math/colpack/default.nix b/pkgs/applications/science/math/colpack/default.nix
index 3cc9290a762..d5ab38ff751 100644
--- a/pkgs/applications/science/math/colpack/default.nix
+++ b/pkgs/applications/science/math/colpack/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A package comprising of implementations of algorithms for
     vertex coloring and derivative computation";
-    homepage = "http://cscapes.cs.purdue.edu/coloringpage/software.htm#functionalities";
+    homepage = "https://cscapes.cs.purdue.edu/coloringpage/software.htm#functionalities";
     license = licenses.lgpl3Plus;
     platforms = platforms.unix;
     maintainers = with maintainers; [ edwtjo ];
diff --git a/pkgs/applications/video/mpv/scripts/default.nix b/pkgs/applications/video/mpv/scripts/default.nix
index 562e3de1645..94c59fa8b06 100644
--- a/pkgs/applications/video/mpv/scripts/default.nix
+++ b/pkgs/applications/video/mpv/scripts/default.nix
@@ -14,14 +14,14 @@ in lib.recurseIntoAttrs
     convert = callPackage ./convert.nix { };
     inhibit-gnome = callPackage ./inhibit-gnome.nix { };
     mpris = callPackage ./mpris.nix { };
-    mpv-playlistmanager = callPackage ./mpv-playlistmanager.nix { };
+    mpv-playlistmanager = callPackage ./mpv-playlistmanager.nix { inherit buildLua; };
     mpv-webm = callPackage ./mpv-webm.nix { };
     mpvacious = callPackage ./mpvacious.nix { };
-    quality-menu = callPackage ./quality-menu.nix { };
+    quality-menu = callPackage ./quality-menu.nix { inherit buildLua; };
     simple-mpv-webui = callPackage ./simple-mpv-webui.nix { };
     sponsorblock = callPackage ./sponsorblock.nix { };
     thumbfast = callPackage ./thumbfast.nix { };
-    thumbnail = callPackage ./thumbnail.nix { };
+    thumbnail = callPackage ./thumbnail.nix { inherit buildLua; };
     uosc = callPackage ./uosc.nix { };
     visualizer = callPackage ./visualizer.nix { };
     vr-reversal = callPackage ./vr-reversal.nix { };
diff --git a/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix b/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
index 720fdaae5b3..8ec05a3cf69 100644
--- a/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
+++ b/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
@@ -1,6 +1,6 @@
-{ lib, stdenvNoCC, fetchFromGitHub, yt-dlp }:
+{ lib, buildLua, fetchFromGitHub, yt-dlp }:
 
-stdenvNoCC.mkDerivation rec {
+buildLua rec {
   pname = "mpv-playlistmanager";
   version = "unstable-2023-08-09";
 
@@ -17,21 +17,12 @@ stdenvNoCC.mkDerivation rec {
       'youtube_dl_executable = "${lib.getBin yt-dlp}/bin/yt-dlp"',
   '';
 
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-    install -D -t $out/share/mpv/scripts playlistmanager.lua
-    runHook postInstall
-  '';
-
-  passthru.scriptName = "playlistmanager.lua";
+  scriptPath = "playlistmanager.lua";
 
   meta = with lib; {
     description = "Mpv lua script to create and manage playlists";
     homepage = "https://github.com/jonniek/mpv-playlistmanager";
     license = licenses.unlicense;
-    platforms = platforms.all;
     maintainers = with maintainers; [ lunik1 ];
   };
 }
diff --git a/pkgs/applications/video/mpv/scripts/quality-menu.nix b/pkgs/applications/video/mpv/scripts/quality-menu.nix
index 45d358843b3..d0eb2ca0119 100644
--- a/pkgs/applications/video/mpv/scripts/quality-menu.nix
+++ b/pkgs/applications/video/mpv/scripts/quality-menu.nix
@@ -1,33 +1,22 @@
 { lib
-, stdenvNoCC
+, buildLua
 , fetchFromGitHub
 , oscSupport ? false
 }:
 
-stdenvNoCC.mkDerivation rec {
+buildLua rec {
   pname = "mpv-quality-menu";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "christoph-heinrich";
     repo = "mpv-quality-menu";
     rev = "v${version}";
-    hash = "sha256-93WoTeX61xzbjx/tgBgUVuwyR9MkAUzCfVSrbAC7Ddc=";
+    hash = "sha256-yrcTxqpLnOI1Tq3khhflO3wzhyeTPuvKifyH5/P57Ns=";
   };
 
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/share/mpv/scripts
-    cp quality-menu.lua $out/share/mpv/scripts
-  '' + lib.optionalString oscSupport ''
-    cp quality-menu-osc.lua $out/share/mpv/scripts
-  '' + ''
-    runHook postInstall
-  '';
-
   passthru.scriptName = "quality-menu.lua";
+  scriptPath = if oscSupport then "*.lua" else passthru.scriptName;
 
   meta = with lib; {
     description = "A userscript for MPV that allows you to change youtube video quality (ytdl-format) on the fly";
diff --git a/pkgs/applications/video/mpv/scripts/thumbnail.nix b/pkgs/applications/video/mpv/scripts/thumbnail.nix
index 291db71dc75..29509bd033f 100644
--- a/pkgs/applications/video/mpv/scripts/thumbnail.nix
+++ b/pkgs/applications/video/mpv/scripts/thumbnail.nix
@@ -1,6 +1,6 @@
-{ lib, stdenvNoCC, fetchFromGitHub, python3 }:
+{ lib, buildLua, fetchFromGitHub, python3 }:
 
-stdenvNoCC.mkDerivation rec {
+buildLua rec {
   pname = "mpv-thumbnail-script";
   version = "0.5.3";
 
@@ -12,19 +12,10 @@ stdenvNoCC.mkDerivation rec {
   };
 
   nativeBuildInputs = [ python3 ];
+  postPatch = "patchShebangs concat_files.py";
+  dontBuild = false;
 
-  postPatch = ''
-    patchShebangs concat_files.py
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/share/mpv/scripts
-    cp mpv_thumbnail_script_{client_osc,server}.lua $out/share/mpv/scripts
-    runHook postInstall
-  '';
-
-  passthru.scriptName = "mpv_thumbnail_script_{client_osc,server}.lua";
+  scriptPath = "mpv_thumbnail_script_{client_osc,server}.lua";
 
   meta = with lib; {
     description = "A lua script to show preview thumbnails in mpv's OSC seekbar";
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix b/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
index ecfe1376eea..f418e997333 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-vkcapture";
-  version = "1.4.4";
+  version = "1.4.5";
 
   src = fetchFromGitHub {
     owner = "nowrep";
     repo = finalAttrs.pname;
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sDgYHa6zwUsGAinWptFeeaTG5n9t7SCLYgjDurdMT6g=";
+    hash = "sha256-C5dMDfCFkUNENA4qQlmGeavKqYpbRHkUz79LVM5aVao=";
   };
 
   cmakeFlags = lib.optionals stdenv.isi686 [
diff --git a/pkgs/applications/virtualization/crosvm/default.nix b/pkgs/applications/virtualization/crosvm/default.nix
index 59cc830844c..23d6f35cabf 100644
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@@ -1,4 +1,5 @@
-{ lib, rustPlatform, fetchgit, pkg-config, protobuf, python3, wayland-scanner
+{ lib, rustPlatform, fetchgit, fetchpatch
+, pkg-config, protobuf, python3, wayland-scanner
 , libcap, libdrm, libepoxy, minijail, virglrenderer, wayland, wayland-protocols
 }:
 
@@ -13,6 +14,16 @@ rustPlatform.buildRustPackage rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    (fetchpatch {
+      name = "test-page-size-fix.patch";
+      url = "https://chromium.googlesource.com/crosvm/crosvm/+/d9bc6e99ff5ac31d7d88b684c938af01a0872fc1%5E%21/?format=TEXT";
+      decode = "base64 -d";
+      includes = [ "src/crosvm/config.rs" ];
+      hash = "sha256-3gfNzp0WhtNr+8CWSISCJau208EMIo3RJhM+4SyeV3o=";
+    })
+  ];
+
   separateDebugInfo = true;
 
   cargoHash = "sha256-yRujLgPaoKx/wkG3yMwQ5ndy9X5xDWSKtCr8DypXvEA=";
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index ea96f7f241b..0dc91af767f 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -266,11 +266,8 @@ stdenv.mkDerivation (finalAttrs: {
   requiredSystemFeatures = [ "big-parallel" ];
 
   meta = with lib; {
-    homepage = "http://www.qemu.org/";
-    description =
-      if toolsOnly
-      then "Support tools for qemu, a machine emulator and virtualizer"
-      else "A generic and open source machine emulator and virtualizer";
+    homepage = "https://www.qemu.org/";
+    description = "A generic and open source machine emulator and virtualizer";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ eelco qyliss ];
     platforms = platforms.unix;
diff --git a/pkgs/applications/virtualization/virt-manager/default.nix b/pkgs/applications/virtualization/virt-manager/default.nix
index 163812bdccf..4e4d7e7d0a9 100644
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@@ -83,7 +83,7 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   meta = with lib; {
-    homepage = "http://virt-manager.org";
+    homepage = "https://virt-manager.org";
     description = "Desktop user interface for managing virtual machines";
     longDescription = ''
       The virt-manager application is a desktop user interface for managing
diff --git a/pkgs/applications/virtualization/virt-viewer/default.nix b/pkgs/applications/virtualization/virt-viewer/default.nix
index 0e24dd9b08f..58d9edb269a 100644
--- a/pkgs/applications/virtualization/virt-viewer/default.nix
+++ b/pkgs/applications/virtualization/virt-viewer/default.nix
@@ -104,7 +104,7 @@ stdenv.mkDerivation rec {
   };
   passthru = {
     updateInfo = {
-      downloadPage = "http://virt-manager.org/download.html";
+      downloadPage = "https://virt-manager.org/download.html";
     };
   };
 }
diff --git a/pkgs/by-name/si/signal-export/package.nix b/pkgs/by-name/si/signal-export/package.nix
new file mode 100644
index 00000000000..d1e20fa68a0
--- /dev/null
+++ b/pkgs/by-name/si/signal-export/package.nix
@@ -0,0 +1,40 @@
+{ lib
+, python3
+, fetchPypi
+, nix-update-script
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "signal-export";
+  version = "1.6.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-1efc8jclXE4PQ/K9q1GC0mGqYo5lXXOIYEzz3RDNBGA=";
+  };
+
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    setuptools
+    typer
+    beautifulsoup4
+    emoji
+    markdown
+    pysqlcipher3
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    mainProgram = "sigexport";
+    homepage = "https://github.com/carderne/signal-export";
+    description = "Export your Signal chats to markdown files with attachments.";
+    platforms = platforms.unix;
+    license = licenses.mit;
+    maintainers = with maintainers; [ phaer picnoir ];
+  };
+}
diff --git a/pkgs/by-name/zp/zpaqfranz/package.nix b/pkgs/by-name/zp/zpaqfranz/package.nix
index 26fa5ec6707..afb7ba4c069 100644
--- a/pkgs/by-name/zp/zpaqfranz/package.nix
+++ b/pkgs/by-name/zp/zpaqfranz/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zpaqfranz";
-  version = "58.10";
+  version = "58.11";
 
   src = fetchFromGitHub {
     owner = "fcorbelli";
     repo = "zpaqfranz";
     rev = finalAttrs.version;
-    hash = "sha256-eBokpah7j3QQChprvjeigt2/sEpkq6ZS4rQhIP5cAYo=";
+    hash = "sha256-XewHMsHF65LvoRzPFiDQcClVSTfSCn69iDRjwKTLpRs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/soundfonts/generaluser/default.nix b/pkgs/data/soundfonts/generaluser/default.nix
index 5191199e647..abe1ea4ceac 100644
--- a/pkgs/data/soundfonts/generaluser/default.nix
+++ b/pkgs/data/soundfonts/generaluser/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   # we can't use fetchurl since stdenv does not handle unpacking *.zip's by default.
   src = fetchzip {
-    # Linked on http://www.schristiancollins.com/generaluser.php:
+    # Linked on https://www.schristiancollins.com/generaluser.php:
     url = "https://www.dropbox.com/s/4x27l49kxcwamp5/GeneralUser_GS_${version}.zip";
     sha256 = "sha256-lwUlWubXiVZ8fijKuNF54YQjT0uigjNAbjKaNjmC51s=";
   };
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "a SoundFont bank featuring 259 instrument presets and 11 drum kits";
-    homepage = "http://www.schristiancollins.com/generaluser.php";
+    homepage = "https://www.schristiancollins.com/generaluser.php";
     license = licenses.generaluser;
     platforms = platforms.all;
     maintainers = with maintainers; [ ckie ];
diff --git a/pkgs/development/beam-modules/mix-release.nix b/pkgs/development/beam-modules/mix-release.nix
index d48dc38a4b8..e5b44bc5dcd 100644
--- a/pkgs/development/beam-modules/mix-release.nix
+++ b/pkgs/development/beam-modules/mix-release.nix
@@ -1,4 +1,19 @@
-{ stdenv, lib, elixir, erlang, findutils, hex, rebar, rebar3, fetchMixDeps, makeWrapper, git, ripgrep }@inputs:
+{ stdenv
+, lib
+, elixir
+, erlang
+, hex
+, git
+, rebar
+, rebar3
+, fetchMixDeps
+, findutils
+, makeWrapper
+, coreutils
+, gnused
+, gnugrep
+, gawk
+}@inputs:
 
 { pname
 , version
@@ -10,80 +25,104 @@
 , mixEnv ? "prod"
 , compileFlags ? [ ]
 
-  # mix fixed output derivation dependencies
+  # Mix dependencies provided as a fixed output derivation
 , mixFodDeps ? null
 
-  # mix dependencies generated by mix2nix
-  # this assumes each dependency is built by buildMix or buildRebar3
-  # each dependency needs to have a setup hook to add the lib path to $ERL_LIBS
-  # this is how mix will find dependencies
+  # Mix dependencies generated by mix2nix
+  #
+  # This assumes each dependency is built by buildMix or buildRebar3. Each
+  # dependency needs to have a setup hook to add the lib path to $ERL_LIBS.
+  # This is how Mix finds dependencies.
 , mixNixDeps ? { }
 
 , elixir ? inputs.elixir
 , hex ? inputs.hex.override { inherit elixir; }
 
-# This reduces closure size, but can lead to some hard to understand runtime
-# errors, so use with caution. See e.g.
-# https://github.com/whitfin/cachex/issues/205
-# https://framagit.org/framasoft/mobilizon/-/issues/1169
+  # Remove releases/COOKIE
+  #
+  # People have different views on the nature of cookies. Some believe that they are
+  # secrets, while others believe they are just ids for clustering nodes instead of
+  # secrets.
+  #
+  # If you think cookie is secret, you can set this attr to true, then it will be
+  # removed from nix store. If not, you can set it to false.
+  #
+  # For backward compatibility, it is set to true by default.
+  #
+  # You can always specify a custom cookie by using RELEASE_COOKIE environment
+  # variable, regardless of the value of this attr.
+, removeCookie ? true
+
+  # This reduces closure size, but can lead to some hard to understand runtime
+  # errors, so use with caution. See e.g.
+  # https://github.com/whitfin/cachex/issues/205
+  # https://framagit.org/framasoft/mobilizon/-/issues/1169
 , stripDebug ? false
 
 , ...
 }@attrs:
 let
-  # remove non standard attributes that cannot be coerced to strings
+  # Remove non standard attributes that cannot be coerced to strings
   overridable = builtins.removeAttrs attrs [ "compileFlags" "mixNixDeps" ];
 in
 assert mixNixDeps != { } -> mixFodDeps == null;
 assert stripDebug -> !enableDebugInfo;
 
 stdenv.mkDerivation (overridable // {
-  # rg is used as a better grep to search for erlang references in the final release
-  nativeBuildInputs = nativeBuildInputs ++ [ erlang hex elixir makeWrapper git ripgrep ];
-  buildInputs = buildInputs ++ builtins.attrValues mixNixDeps;
+  nativeBuildInputs = nativeBuildInputs ++
+    # Erlang/Elixir deps
+    [ erlang elixir hex git ] ++
+    # Mix deps
+    (builtins.attrValues mixNixDeps) ++
+    # other compile-time deps
+    [ findutils makeWrapper ];
+
+  buildInputs = buildInputs;
 
   MIX_ENV = mixEnv;
   MIX_DEBUG = if enableDebugInfo then 1 else 0;
   HEX_OFFLINE = 1;
+
   DEBUG = if enableDebugInfo then 1 else 0; # for Rebar3 compilation
-  # the api with `mix local.rebar rebar path` makes a copy of the binary
-  # some older dependencies still use rebar
+  # The API with `mix local.rebar rebar path` makes a copy of the binary
+  # some older dependencies still use rebar.
   MIX_REBAR = "${rebar}/bin/rebar";
   MIX_REBAR3 = "${rebar3}/bin/rebar3";
+
   LC_ALL = "C.UTF-8";
 
   postUnpack = ''
-    export HEX_HOME="$TEMPDIR/hex"
+    # Mix and Hex
     export MIX_HOME="$TEMPDIR/mix"
+    export HEX_HOME="$TEMPDIR/hex"
 
     # Rebar
     export REBAR_GLOBAL_CONFIG_DIR="$TEMPDIR/rebar3"
     export REBAR_CACHE_DIR="$TEMPDIR/rebar3.cache"
 
     ${lib.optionalString (mixFodDeps != null) ''
-      # compilation of the dependencies will require
-      # that the dependency path is writable
-      # thus a copy to the TEMPDIR is inevitable here
+      # Compilation of the dependencies will require that the dependency path is
+      # writable, thus a copy to the $TEMPDIR is inevitable here.
       export MIX_DEPS_PATH="$TEMPDIR/deps"
       cp --no-preserve=mode -R "${mixFodDeps}" "$MIX_DEPS_PATH"
-    ''
-    }
-
+    ''}
   '' + (attrs.postUnpack or "");
 
   configurePhase = attrs.configurePhase or ''
     runHook preConfigure
 
     ${./mix-configure-hook.sh}
-    # this is needed for projects that have a specific compile step
+
+    # This is needed for projects that have a specific compile step
     # the dependency needs to be compiled in order for the task
-    # to be available
-    # Phoenix projects for example will need compile.phoenix
+    # to be available.
+    #
+    # Phoenix projects for example will need compile.phoenix.
     mix deps.compile --no-deps-check --skip-umbrella-children
 
     # Symlink dependency sources. This is needed for projects that require
     # access to the source of their dependencies. For example, Phoenix
-    # applications need javascript assets to build asset bundles.
+    # projects need javascript assets to build asset bundles.
     ${lib.optionalString (mixNixDeps != { }) ''
       mkdir -p deps
 
@@ -113,7 +152,6 @@ stdenv.mkDerivation (overridable // {
     runHook postBuild
   '';
 
-
   installPhase = attrs.installPhase or ''
     runHook preInstall
 
@@ -122,42 +160,50 @@ stdenv.mkDerivation (overridable // {
     runHook postInstall
   '';
 
-  # Stripping of the binary is intentional
-  # even though it does not affect beam files
-  # it is necessary for NIFs binaries
   postFixup = ''
-    if [ -e "$out/bin/${pname}.bat" ]; then # absent in special cases, i.e. elixir-ls
-      rm "$out/bin/${pname}.bat" # windows file
-    fi
-    # contains secrets and should not be in the nix store
-    # TODO document how to handle RELEASE_COOKIE
-    # secrets should not be in the nix store.
-    # This is only used for connecting multiple nodes
-    if [ -e $out/releases/COOKIE ]; then # absent in special cases, i.e. elixir-ls
+    # Remove files for Microsoft Windows
+    rm -f "$out"/bin/*.bat
+
+    # Wrap programs in $out/bin with their runtime deps
+    for f in $(find $out/bin/ -type f -executable); do
+      wrapProgram "$f" \
+        --prefix PATH : ${lib.makeBinPath [
+          coreutils
+          gnused
+          gnugrep
+          gawk
+        ]}
+    done
+  '' + lib.optionalString removeCookie ''
+    if [ -e $out/releases/COOKIE ]; then
       rm $out/releases/COOKIE
     fi
-    # removing unused erlang reference from resulting derivation to reduce
-    # closure size
-    if [ -e $out/erts-* ]; then
-      echo "ERTS found in $out - removing references to erlang to reduce closure size"
-      # there is a link in $out/erts-*/bin/start always
-      # TODO:
-      # sometimes there are links in dependencies like bcrypt compiled binaries
-      # at the moment those are not removed since substituteInPlace will
-      # error on binaries
-      for file in $(rg "${erlang}/lib/erlang" "$out" --files-with-matches); do
-        echo "removing reference to erlang in $file"
-        substituteInPlace "$file" --replace "${erlang}/lib/erlang" "$out"
-      done
-    fi
   '' + lib.optionalString stripDebug ''
-    # strip debug symbols to avoid hardreferences to "foreign" closures actually
+    # Strip debug symbols to avoid hardreferences to "foreign" closures actually
     # not needed at runtime, while at the same time reduce size of BEAM files.
     erl -noinput -eval 'lists:foreach(fun(F) -> io:format("Stripping ~p.~n", [F]), beam_lib:strip(F) end, filelib:wildcard("'"$out"'/**/*.beam"))' -s init stop
   '';
 
-  # TODO investigate why the resulting closure still has
-  # a reference to erlang.
-  # uncommenting the following will fail the build
-  # disallowedReferences = [ erlang ];
+  # TODO: remove erlang references in resulting derivation
+  #
+  # # Step 1 - investigate why the resulting derivation still has references to erlang.
+  #
+  # The reason is that the generated binaries contains erlang reference. Here's a repo to
+  # demonstrate the problem - <https://github.com/plastic-gun/nix-mix-release-unwanted-references>.
+  #
+  #
+  # # Step 2 - remove erlang references from the binaries
+  #
+  # As said in above repo, it's hard to remove erlang references from `.beam` binaries.
+  #
+  # We need more experienced developers to resolve this issue.
+  #
+  #
+  # # Tips
+  #
+  # When resolving this issue, it is convenient to fail the build when erlang is referenced,
+  # which can be achieved by using:
+  #
+  #   disallowedReferences = [ erlang ];
+  #
 })
diff --git a/pkgs/development/compilers/pforth/default.nix b/pkgs/development/compilers/pforth/default.nix
index d0766fe1376..aadc72c174e 100644
--- a/pkgs/development/compilers/pforth/default.nix
+++ b/pkgs/development/compilers/pforth/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "http://www.softsynth.com/pforth/";
+    homepage = "https://www.softsynth.com/pforth/";
     description = "Portable Portable ANS-like Forth written in ANSI 'C'";
     changelog = "https://github.com/philburk/pforth/blob/v${finalAttrs.version}/RELEASES.md";
     license = lib.licenses.bsd0;
diff --git a/pkgs/development/compilers/uasm/default.nix b/pkgs/development/compilers/uasm/default.nix
index cae9a17ccca..9fe0e42cb13 100644
--- a/pkgs/development/compilers/uasm/default.nix
+++ b/pkgs/development/compilers/uasm/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
-    homepage = "http://www.terraspace.co.uk/uasm.html";
+    homepage = "https://www.terraspace.co.uk/uasm.html";
     description = "A free MASM-compatible assembler based on JWasm";
     platforms = platforms.unix;
     maintainers = with maintainers; [ thiagokokada ];
diff --git a/pkgs/development/interpreters/luau/default.nix b/pkgs/development/interpreters/luau/default.nix
index 56f5eb10b92..bf81832f464 100644
--- a/pkgs/development/interpreters/luau/default.nix
+++ b/pkgs/development/interpreters/luau/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luau";
-  version = "0.601";
+  version = "0.603";
 
   src = fetchFromGitHub {
-    owner = "Roblox";
+    owner = "luau-lang";
     repo = "luau";
     rev = version;
-    hash = "sha256-RkclNY5ZDP0Urht/JBx00SbeQ958CJCTIru2YUIYFa4=";
+    hash = "sha256-8jm58F2AQcmjy19fydGLOD5fehaaNHGqXtDPu121jmw=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A fast, small, safe, gradually typed embeddable scripting language derived from Lua";
     homepage = "https://luau-lang.org/";
-    changelog = "https://github.com/Roblox/luau/releases/tag/${version}";
+    changelog = "https://github.com/luau-lang/luau/releases/tag/${version}";
     license = licenses.mit;
     platforms = platforms.all;
     maintainers = [ maintainers.marsam ];
diff --git a/pkgs/development/interpreters/picolisp/default.nix b/pkgs/development/interpreters/picolisp/default.nix
index b85f99a7b52..4e589cb722e 100644
--- a/pkgs/development/interpreters/picolisp/default.nix
+++ b/pkgs/development/interpreters/picolisp/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateInfo = {
-      downloadPage = "http://www.software-lab.de/down.html";
+      downloadPage = "https://www.software-lab.de/down.html";
     };
   };
 }
diff --git a/pkgs/development/interpreters/supercollider/default.nix b/pkgs/development/interpreters/supercollider/default.nix
index 6aaecc9bd14..79cad7fe644 100644
--- a/pkgs/development/interpreters/supercollider/default.nix
+++ b/pkgs/development/interpreters/supercollider/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, mkDerivation, fetchurl, cmake
+{ lib, stdenv, mkDerivation, fetchurl, cmake, runtimeShell
 , pkg-config, alsa-lib, libjack2, libsndfile, fftw
 , curl, gcc, libXt, qtbase, qttools, qtwebengine
 , readline, qtwebsockets, useSCEL ? false, emacs
@@ -20,6 +20,10 @@ mkDerivation rec {
     ./supercollider-3.12.0-env-dirs.patch
   ];
 
+  postPatch = ''
+    substituteInPlace common/sc_popen.cpp --replace '/bin/sh' '${runtimeShell}'
+  '';
+
   strictDeps = true;
 
   nativeBuildInputs = [ cmake pkg-config qttools ];
diff --git a/pkgs/development/libraries/ctpp2/default.nix b/pkgs/development/libraries/ctpp2/default.nix
index c8bc708a2aa..5aac0850a74 100644
--- a/pkgs/development/libraries/ctpp2/default.nix
+++ b/pkgs/development/libraries/ctpp2/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "2.8.3";
 
   src = fetchurl {
-    url = "http://ctpp.havoc.ru/download/${pname}-${version}.tar.gz";
+    url = "https://ctpp.havoc.ru/download/${pname}-${version}.tar.gz";
     sha256 = "1z22zfw9lb86z4hcan9hlvji49c9b7vznh7gjm95gnvsh43zsgx8";
   };
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A high performance templating engine";
-    homepage = "http://ctpp.havoc.ru";
+    homepage = "https://ctpp.havoc.ru/";
     maintainers = [ maintainers.robbinch ];
     platforms = platforms.linux;
     license = licenses.bsd2;
diff --git a/pkgs/development/libraries/ctranslate2/default.nix b/pkgs/development/libraries/ctranslate2/default.nix
index 04bbcf6e6b1..c2799b97e2a 100644
--- a/pkgs/development/libraries/ctranslate2/default.nix
+++ b/pkgs/development/libraries/ctranslate2/default.nix
@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ctranslate2";
-  version = "3.20.0";
+  version = "3.21.0";
 
   src = fetchFromGitHub {
     owner = "OpenNMT";
     repo = "CTranslate2";
     rev = "v${version}";
-    hash = "sha256-PdCjzLyc5O1rrTtPz8JD08unY7uMNS5fcD3ZLHJDeYg=";
+    hash = "sha256-ehybfwwMYMKPPeyv05zgDxmw0zr35eoY8wc/tb7DQw0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index e9f0f013fe2..a809eda31c0 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -114,7 +114,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Simple interprocess messaging system";
-    homepage = "http://www.freedesktop.org/wiki/Software/dbus/";
+    homepage = "https://www.freedesktop.org/wiki/Software/dbus/";
     changelog = "https://gitlab.freedesktop.org/dbus/dbus/-/blob/dbus-${version}/NEWS";
     license = licenses.gpl2Plus; # most is also under AFL-2.1
     maintainers = teams.freedesktop.members ++ (with maintainers; [ ]);
diff --git a/pkgs/development/libraries/gusb/default.nix b/pkgs/development/libraries/gusb/default.nix
index 9c6ec5ad283..d6fe7044013 100644
--- a/pkgs/development/libraries/gusb/default.nix
+++ b/pkgs/development/libraries/gusb/default.nix
@@ -23,7 +23,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gusb";
-  version = "0.4.7";
+  version = "0.4.8";
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     owner = "hughsie";
     repo = "libgusb";
     rev = "refs/tags/${version}";
-    hash = "sha256-E0H3MqNxYXP40wKMcI1cwLKWGVOnPNazbH6K3TbzpCQ=";
+    hash = "sha256-xhWx45uOh8Yokd3/32CQ6tsdkgGaYUOvaylrq/jmoP0=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/irrlicht/default.nix b/pkgs/development/libraries/irrlicht/default.nix
index 7a68f130663..fa5d2b3b0c9 100644
--- a/pkgs/development/libraries/irrlicht/default.nix
+++ b/pkgs/development/libraries/irrlicht/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional stdenv.isAarch64 zlib;
 
   meta = {
-    homepage = "http://irrlicht.sourceforge.net/";
+    homepage = "https://irrlicht.sourceforge.io/";
     license = lib.licenses.zlib;
     description = "Open source high performance realtime 3D engine written in C++";
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
diff --git a/pkgs/development/libraries/irrlicht/mac.nix b/pkgs/development/libraries/irrlicht/mac.nix
index a7901466081..b3ef27e3877 100644
--- a/pkgs/development/libraries/irrlicht/mac.nix
+++ b/pkgs/development/libraries/irrlicht/mac.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ OpenGL Cocoa IOKit ];
 
   meta = {
-    homepage = "http://irrlicht.sourceforge.net/";
+    homepage = "https://irrlicht.sourceforge.net/";
     license = lib.licenses.zlib;
     description = "Open source high performance realtime 3D engine written in C++";
     platforms = lib.platforms.darwin;
diff --git a/pkgs/development/libraries/libcdr/default.nix b/pkgs/development/libraries/libcdr/default.nix
index b3087f0abea..64695aaa55d 100644
--- a/pkgs/development/libraries/libcdr/default.nix
+++ b/pkgs/development/libraries/libcdr/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "A library providing ability to interpret and import Corel Draw drawings into various applications";
-    homepage = "http://www.freedesktop.org/wiki/Software/libcdr";
+    homepage = "https://wiki.documentfoundation.org/DLP/Libraries/libcdr";
     platforms = lib.platforms.all;
     license = lib.licenses.mpl20;
   };
diff --git a/pkgs/development/libraries/libevdev/default.nix b/pkgs/development/libraries/libevdev/default.nix
index 90853d5f2db..c8db600dce8 100644
--- a/pkgs/development/libraries/libevdev/default.nix
+++ b/pkgs/development/libraries/libevdev/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Wrapper library for evdev devices";
-    homepage = "http://www.freedesktop.org/software/libevdev/doc/latest/index.html";
+    homepage = "https://www.freedesktop.org/software/libevdev/doc/latest/index.html";
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = [ maintainers.amorsillo ];
diff --git a/pkgs/development/libraries/libproxy/default.nix b/pkgs/development/libraries/libproxy/default.nix
index 62ddcd67390..5c7a3162502 100644
--- a/pkgs/development/libraries/libproxy/default.nix
+++ b/pkgs/development/libraries/libproxy/default.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     platforms = platforms.linux ++ platforms.darwin;
     license = licenses.lgpl21;
-    homepage = "http://libproxy.github.io/libproxy/";
+    homepage = "https://libproxy.github.io/libproxy/";
     description = "A library that provides automatic proxy configuration management";
   };
 }
diff --git a/pkgs/development/libraries/libsodium/default.nix b/pkgs/development/libraries/libsodium/default.nix
index 14e730d69e5..b4eeed32d59 100644
--- a/pkgs/development/libraries/libsodium/default.nix
+++ b/pkgs/development/libraries/libsodium/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = with lib; {
     description = "A modern and easy-to-use crypto library";
-    homepage = "http://doc.libsodium.org/";
+    homepage = "https://doc.libsodium.org/";
     license = licenses.isc;
     maintainers = with maintainers; [ raskin ];
     pkgConfigModules = [ "libsodium" ];
diff --git a/pkgs/development/libraries/libtsm/default.nix b/pkgs/development/libraries/libtsm/default.nix
index 75773296fab..c8e00cf4a94 100644
--- a/pkgs/development/libraries/libtsm/default.nix
+++ b/pkgs/development/libraries/libtsm/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Terminal-emulator State Machine";
-    homepage = "http://www.freedesktop.org/wiki/Software/kmscon/libtsm/";
+    homepage = "https://www.freedesktop.org/wiki/Software/kmscon/libtsm/";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
     platforms = platforms.linux;
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 658a24b8d81..c36e3116dad 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -114,13 +114,13 @@ stdenv.mkDerivation rec {
   # NOTE: You must also bump:
   # <nixpkgs/pkgs/development/python-modules/libvirt/default.nix>
   # SysVirt in <nixpkgs/pkgs/top-level/perl-packages.nix>
-  version = "9.7.0";
+  version = "9.9.0";
 
   src = fetchFromGitLab {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7huo2UsbNG/HG2dpdVT5qcJuFmYZE6Jdave8Gb1kHME=";
+    sha256 = "sha256-8Tmn99wDkRoA+pnOjeCzHoCeR3P3MwCA1kqY6SZpkqw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/openfx/default.nix b/pkgs/development/libraries/openfx/default.nix
index 201bf16ad64..2bfb0870858 100644
--- a/pkgs/development/libraries/openfx/default.nix
+++ b/pkgs/development/libraries/openfx/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation {
   version = "1.4";
 
   src = fetchFromGitHub {
-    owner = "ofxa";
+    owner = "AcademySoftwareFoundation";
     repo = "openfx";
     rev = "OFX_Release_1_4_TAG";
     sha256 = "0k9ggzr6bisn77mipjfvawg3mv4bz50b63v8f7w1jhldi1sfy548";
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "Image processing plug-in standard";
-    homepage = "http://openeffects.org/";
+    homepage = "https://openeffects.org/";
     license = licenses.bsd3;
     platforms = platforms.all;
     maintainers = [ maintainers.guibou ];
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index 5dbb7dc98b2..80badcdd4db 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -181,7 +181,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "http://www.freedesktop.org/wiki/Software/polkit";
+    homepage = "https://gitlab.freedesktop.org/polkit/polkit/";
     description = "A toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes";
     license = licenses.lgpl2Plus;
     platforms = platforms.linux;
diff --git a/pkgs/development/libraries/portaudio/default.nix b/pkgs/development/libraries/portaudio/default.nix
index 589cf7cdf95..a109aad97b9 100644
--- a/pkgs/development/libraries/portaudio/default.nix
+++ b/pkgs/development/libraries/portaudio/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   version = "190700_20210406";
 
   src = fetchurl {
-    url = "http://files.portaudio.com/archives/pa_stable_v${version}.tgz";
+    url = "https://files.portaudio.com/archives/pa_stable_v${version}.tgz";
     sha256 = "1vrdrd42jsnffh6rq8ap2c6fr4g9fcld89z649fs06bwqx1bzvs7";
   };
 
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Portable cross-platform Audio API";
-    homepage    = "http://www.portaudio.com/";
+    homepage    = "https://www.portaudio.com/";
     # Not exactly a bsd license, but alike
     license     = licenses.mit;
     maintainers = with maintainers; [ lovek323 ];
diff --git a/pkgs/development/libraries/qtutilities/default.nix b/pkgs/development/libraries/qtutilities/default.nix
index de80fc0709d..860e3922751 100644
--- a/pkgs/development/libraries/qtutilities/default.nix
+++ b/pkgs/development/libraries/qtutilities/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qtutilities";
-  version = "6.13.1";
+  version = "6.13.2";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "qtutilities";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ic1Xnle1fGZ5elf0yH0BF+3spAmIo9kP62WhXLmBVNc=";
+    hash = "sha256-Kdvr3T9hynLCj99+Rc1L0Gq7xkiM0a6xovuqhAncrek=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/startup-notification/default.nix b/pkgs/development/libraries/startup-notification/default.nix
index 001123ead60..c1c5819ad42 100644
--- a/pkgs/development/libraries/startup-notification/default.nix
+++ b/pkgs/development/libraries/startup-notification/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libX11 libxcb xcbutil ];
 
   meta = {
-    homepage = "http://www.freedesktop.org/software/startup-notification";
+    homepage = "https://www.freedesktop.org/software/startup-notification";
     description = "Application startup notification and feedback library";
     license = lib.licenses.lgpl2;
   };
diff --git a/pkgs/development/libraries/vcg/default.nix b/pkgs/development/libraries/vcg/default.nix
index 8b86df2e1c1..e7e818cbea5 100644
--- a/pkgs/development/libraries/vcg/default.nix
+++ b/pkgs/development/libraries/vcg/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "http://vcg.isti.cnr.it/vcglib/install.html";
+    homepage = "https://vcg.isti.cnr.it/vcglib/install.html";
     description = "C++ library for manipulation, processing and displaying with OpenGL of triangle and tetrahedral meshes";
     license = licenses.gpl3;
     platforms = platforms.all;
diff --git a/pkgs/development/libraries/wolfssl/default.nix b/pkgs/development/libraries/wolfssl/default.nix
index 2065ae2f875..ceb5bf0303b 100644
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , Security
 , autoreconfHook
 , util-linux
@@ -22,6 +23,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-UN4zs+Rxh/bsLD1BQA+f1YN/UOJ6OB2HduhoetEp10Y=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-expected-test-response.patch";
+      url = "https://github.com/wolfSSL/wolfssl/commit/ca694938fd053a8557f9f08b1b4265292d8bef65.patch";
+      hash = "sha256-ETxszjjEMk0WdYgXHWTxTaWZPpyDs9jdko0jtkjzgwI=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs ./scripts
     # ocsp stapling tests require network access, so skip them
diff --git a/pkgs/development/lisp-modules-new-obsolete/examples/bordeaux-threads.nix b/pkgs/development/lisp-modules-new-obsolete/examples/bordeaux-threads.nix
index 42afb6d2706..31a53b0f949 100644
--- a/pkgs/development/lisp-modules-new-obsolete/examples/bordeaux-threads.nix
+++ b/pkgs/development/lisp-modules-new-obsolete/examples/bordeaux-threads.nix
@@ -33,7 +33,7 @@ let
     pname = "bordeaux-threads";
     version = "0.8.8";
     src = pkgs.fetchzip {
-      url = "http://github.com/sionescu/bordeaux-threads/archive/v0.8.8.tar.gz";
+      url = "https://github.com/sionescu/bordeaux-threads/archive/v0.8.8.tar.gz";
       sha256 = "19i443fz3488v1pbbr9x24y8h8vlyhny9vj6c9jk5prm702awrp6";
     };
     lisp = sbcl;
diff --git a/pkgs/development/python-modules/cvxopt/default.nix b/pkgs/development/python-modules/cvxopt/default.nix
index 0a2b13ad4c8..f6135ecba74 100644
--- a/pkgs/development/python-modules/cvxopt/default.nix
+++ b/pkgs/development/python-modules/cvxopt/default.nix
@@ -68,7 +68,7 @@ buildPythonPackage rec {
   unittestFlagsArray = [ "-s" "tests" ];
 
   meta = with lib; {
-    homepage = "http://cvxopt.org/";
+    homepage = "https://cvxopt.org/";
     description = "Python Software for Convex Optimization";
     longDescription = ''
       CVXOPT is a free software package for convex optimization based on the
diff --git a/pkgs/development/python-modules/jupyterlab_launcher/default.nix b/pkgs/development/python-modules/jupyterlab_launcher/default.nix
deleted file mode 100644
index 15b53f523b5..00000000000
--- a/pkgs/development/python-modules/jupyterlab_launcher/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi, jsonschema, notebook, pythonOlder }:
-buildPythonPackage rec {
-  pname = "jupyterlab_launcher";
-  version = "0.13.1";
-  disabled = pythonOlder "3.5";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "f880eada0b8b1f524d5951dc6fcae0d13b169897fc8a247d75fb5beadd69c5f0";
-  };
-
-  propagatedBuildInputs = [
-    jsonschema
-    notebook
-  ];
-
-  # depends on requests and a bunch of other libraries
-  doCheck = false;
-
-  meta = with lib; {
-    description = "This package is used to launch an application built using JupyterLab";
-    license = with licenses; [ bsd3 ];
-    homepage = "https://jupyter.org/";
-    maintainers = with maintainers; [ zimbatm ];
-  };
-}
diff --git a/pkgs/development/python-modules/python-jwt/default.nix b/pkgs/development/python-modules/jwt/default.nix
index 7e21b4f45a2..7e21b4f45a2 100644
--- a/pkgs/development/python-modules/python-jwt/default.nix
+++ b/pkgs/development/python-modules/jwt/default.nix
diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index e14f008d0cb..c2fabc40c03 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -42,7 +42,6 @@
 , librosa
 , lxml
 , manifest-ml
-, markdownify
 , neo4j
 , networkx
 , nlpcloud
@@ -76,8 +75,8 @@
 , pytest-asyncio
 , pytest-mock
 , pytest-socket
-, pytest-vcr
 , pytestCheckHook
+, requests-mock
 , responses
 , syrupy
 , toml
@@ -85,7 +84,7 @@
 
 buildPythonPackage rec {
   pname = "langchain";
-  version = "0.0.325";
+  version = "0.0.334";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -94,7 +93,7 @@ buildPythonPackage rec {
     owner = "hwchase17";
     repo = "langchain";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/bk4RafDDL4nozyFOiikyU4auBSftej21m5/FnEtDog=";
+    hash = "sha256-mXPqc8wF9DhEtITm8h5R9kHBcMJ7AEK4kL5Z7V2p8NE=";
   };
 
   sourceRoot = "${src.name}/libs/langchain";
@@ -253,21 +252,22 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     freezegun
-    markdownify
+    lark
     pandas
     pytest-asyncio
     pytest-mock
     pytest-socket
-    pytest-vcr
     pytestCheckHook
+    requests-mock
     responses
     syrupy
     toml
-  ] ++ passthru.optional-dependencies.all;
+  ];
 
   pytestFlagsArray = [
     # integration_tests have many network, db access and require `OPENAI_API_KEY`, etc.
     "tests/unit_tests"
+    "--only-core"
   ];
 
   disabledTests = [
@@ -279,6 +279,10 @@ buildPythonPackage rec {
     "test_socket_disabled"
   ];
 
+  pythonImportsCheck = [
+    "langchain"
+  ];
+
   meta = with lib; {
     description = "Building applications with LLMs through composability";
     homepage = "https://github.com/hwchase17/langchain";
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index a2961ccf640..3b81c612888 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.0.57";
+  version = "0.0.63";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3P0vB7wz/K3skejyPwtFZN17mFrOw9TGLHTJHvu4m7M=";
+    hash = "sha256-KE+WMnuWAq1stZuuwZkOPOKQ2lZNKtxzNbZMRoOdmz0=";
   };
 
   sourceRoot = "${src.name}/python";
@@ -60,6 +60,8 @@ buildPythonPackage rec {
     "langsmith"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
     description = "Client library to connect to the LangSmith LLM Tracing and Evaluation Platform";
     homepage = "https://github.com/langchain-ai/langsmith-sdk";
diff --git a/pkgs/development/python-modules/libvirt/default.nix b/pkgs/development/python-modules/libvirt/default.nix
index abc87f9d787..3e5d6af48af 100644
--- a/pkgs/development/python-modules/libvirt/default.nix
+++ b/pkgs/development/python-modules/libvirt/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "libvirt";
-  version = "9.7.0";
+  version = "9.9.0";
 
   src = fetchFromGitLab {
     owner = "libvirt";
     repo = "libvirt-python";
     rev = "v${version}";
-    hash = "sha256-DFZPZx+jkxdNha+h50IXxl6wOwA1VjudRICgxD2V4+k=";
+    hash = "sha256-cajKzRRhKCUKWm+1p3xvCyEbVB2R/70WY584o7V+XaY=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/python-modules/nibe/default.nix b/pkgs/development/python-modules/nibe/default.nix
index bec644ecaae..b122c7bbbf5 100644
--- a/pkgs/development/python-modules/nibe/default.nix
+++ b/pkgs/development/python-modules/nibe/default.nix
@@ -16,16 +16,16 @@
 
 buildPythonPackage rec {
   pname = "nibe";
-  version = "2.4.1";
-  format = "pyproject";
+  version = "2.5.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "yozik04";
-    repo = pname;
+    repo = "nibe";
     rev = "refs/tags/${version}";
-    hash = "sha256-6WXn8W7C6QCy9afGMTL2NaSYuxQy+u2OYYa0Vc8sbV8=";
+    hash = "sha256-PCfodp8gyjOUgb4FthMlbanbEtJuc6axM8DkQJ/ykLg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/nlpcloud/default.nix b/pkgs/development/python-modules/nlpcloud/default.nix
index 49fdb5e528f..55e9233bb52 100644
--- a/pkgs/development/python-modules/nlpcloud/default.nix
+++ b/pkgs/development/python-modules/nlpcloud/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "nlpcloud";
-  version = "1.1.44";
+  version = "1.1.45";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dOW/M9FJJiCii4+lZJ6Pg2bAdSpul4JRtzYdI7VgJbM=";
+    hash = "sha256-W/O7GhZuACUFCSCCJUUB6UfMB9WSF8uU7Yd/tgPsE0Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/polling/default.nix b/pkgs/development/python-modules/polling/default.nix
index 22e7e0c3916..ee816585893 100644
--- a/pkgs/development/python-modules/polling/default.nix
+++ b/pkgs/development/python-modules/polling/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Powerful polling utility in Python";
-    homepage = "http://github.com/justiniso/polling";
+    homepage = "https://github.com/justiniso/polling";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/pydexcom/default.nix b/pkgs/development/python-modules/pydexcom/default.nix
index 57031c90f97..3a224354129 100644
--- a/pkgs/development/python-modules/pydexcom/default.nix
+++ b/pkgs/development/python-modules/pydexcom/default.nix
@@ -1,21 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
+, requests
 , setuptools
 , setuptools-scm
-, requests
 }:
 
 buildPythonPackage rec {
   pname = "pydexcom";
-  version = "0.3.1";
-  format = "pyproject";
+  version = "0.3.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "gagebenne";
-    repo = pname;
+    repo = "pydexcom";
     rev = "refs/tags/${version}";
-    hash = "sha256-VZ8Y8W3oEQ3W8eubMbHLfQAXK8cL6+OTyBFwtEe0cBE=";
+    hash = "sha256-46+Ml73F6EUbMwRJB93FD+No/g65RJwnCnFzH4Pb5ek=";
   };
 
   env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -25,15 +28,21 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [ requests ];
+  propagatedBuildInputs = [
+    requests
+  ];
 
-  # tests are interacting with the Dexcom API
+  # Tests are interacting with the Dexcom API
   doCheck = false;
-  pythonImportsCheck = [ "pydexcom" ];
+
+  pythonImportsCheck = [
+    "pydexcom"
+  ];
 
   meta = with lib; {
     description = "Python API to interact with Dexcom Share service";
     homepage = "https://github.com/gagebenne/pydexcom";
+    changelog = "https://github.com/gagebenne/pydexcom/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/pyjnius/default.nix b/pkgs/development/python-modules/pyjnius/default.nix
index e4cebb02c66..98496bf4a54 100644
--- a/pkgs/development/python-modules/pyjnius/default.nix
+++ b/pkgs/development/python-modules/pyjnius/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyjnius";
-  version = "1.6.0";
+  version = "1.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-C32+PY9Yu7e+wwyFjz+nibzBwexJMZWOn3uH9F6hQDM=";
+    hash = "sha256-0qfs5u15vx1/l6T21hMC2fHXZSGCo+TIpp267zE5bmA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-testmon/default.nix b/pkgs/development/python-modules/pytest-testmon/default.nix
index 28f45c02dd8..3c0b0ec629b 100644
--- a/pkgs/development/python-modules/pytest-testmon/default.nix
+++ b/pkgs/development/python-modules/pytest-testmon/default.nix
@@ -10,16 +10,16 @@
 
 buildPythonPackage rec {
   pname = "pytest-testmon";
-  version = "2.0.13";
+  version = "2.1.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "tarpas";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-WJ0Br8O7p5Zru4Fr9+adXp5qjR7sZxBZVtBJghecm9E=";
+    hash = "sha256-M4636yqzChRI37UdGPOZTjj8POLdrOoJtzmECtZZi4k=";
   };
 
   nativeBuildInputs = [
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     description = "Pytest plug-in which automatically selects and re-executes only tests affected by recent changes";
     homepage = "https://github.com/tarpas/pytest-testmon/";
     changelog = "https://github.com/tarpas/pytest-testmon/releases/tag/v${version}";
-    license = licenses.agpl3Only;
+    license = licenses.mit;
     maintainers = with maintainers; [ dmvianna ];
   };
 }
diff --git a/pkgs/development/python-modules/python-lsp-ruff/default.nix b/pkgs/development/python-modules/python-lsp-ruff/default.nix
index 07a389268e7..eae9047c9f9 100644
--- a/pkgs/development/python-modules/python-lsp-ruff/default.nix
+++ b/pkgs/development/python-modules/python-lsp-ruff/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "python-lsp-ruff";
-  version = "1.5.2";
+  version = "1.6.0";
   format = "pyproject";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit version;
     pname = "python-lsp-ruff";
-    sha256 = "sha256-7vilIo1PHgHZ6yaRxTVt/bPwGt9g7rGvrq84eyIDIBw=";
+    sha256 = "sha256-vf3ZNZyen1W29qk4ST1sus5VTcys9F3067NlUr406bg=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-lsp-server/default.nix b/pkgs/development/python-modules/python-lsp-server/default.nix
index 4886ba27bad..76315473294 100644
--- a/pkgs/development/python-modules/python-lsp-server/default.nix
+++ b/pkgs/development/python-modules/python-lsp-server/default.nix
@@ -35,7 +35,7 @@
 
 buildPythonPackage rec {
   pname = "python-lsp-server";
-  version = "1.8.2";
+  version = "1.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     owner = "python-lsp";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-jD/8Xy/o9U/qtjz5FABg5krMIvbnrT+MlK0OvXFTJkI=";
+    hash = "sha256-9za0et/W+AwrjqUVoHwk8oqLXk4eqgRON8Z4F5GSKXM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-pptx/default.nix b/pkgs/development/python-modules/python-pptx/default.nix
index d783efa7142..e49dccec820 100644
--- a/pkgs/development/python-modules/python-pptx/default.nix
+++ b/pkgs/development/python-modules/python-pptx/default.nix
@@ -7,11 +7,11 @@
 }:
 buildPythonPackage rec {
   pname = "python-pptx";
-  version = "0.6.22";
+  version = "0.6.23";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OPjukt3jHSS0ViVg5hsDV+XZfs91xDUq5mFtWjKXhlQ=";
+    hash = "sha256-WHSX/yjneasY27B09tQFKJPIXe3JXtdd8xk2TzMf7e4=";
   };
 
   # postPatch = ''
diff --git a/pkgs/development/python-modules/setuptoolstrial/default.nix b/pkgs/development/python-modules/setuptools-trial/default.nix
index 9304fee0e42..14f666d311a 100644
--- a/pkgs/development/python-modules/setuptoolstrial/default.nix
+++ b/pkgs/development/python-modules/setuptools-trial/default.nix
@@ -2,13 +2,14 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
+, setuptools
 , twisted
 }:
 
 buildPythonPackage rec {
   pname = "setuptools-trial";
   version = "0.6.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -18,6 +19,10 @@ buildPythonPackage rec {
     hash = "sha256-FCIPj3YcSLoeJSbwhxlQd89U+tcJizgs4iBCLw/1mxI=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     twisted
   ];
diff --git a/pkgs/development/python-modules/sqlobject/default.nix b/pkgs/development/python-modules/sqlobject/default.nix
index 6a4ea78b82e..06d2534eb23 100644
--- a/pkgs/development/python-modules/sqlobject/default.nix
+++ b/pkgs/development/python-modules/sqlobject/default.nix
@@ -44,7 +44,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Object Relational Manager for providing an object interface to your database";
-    homepage = "http://www.sqlobject.org/";
+    homepage = "https://www.sqlobject.org/";
     changelog = "https://github.com/sqlobject/sqlobject/blob/${version}/docs/News.rst";
     license = licenses.lgpl21Only;
     maintainers = with maintainers; [ ];
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index 317ed53828a..a380f9734bf 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -334,6 +334,13 @@ in
     '';
   };
 
+  google-protobuf = attrs:
+    lib.optionalAttrs (lib.versionAtLeast attrs.version "3.25.0") {
+    # Fails on 3.25.0 with:
+    #   convert.c:312:32: error: format string is not a string literal (potentially insecure) [-Werror,-Wformat-security]
+    hardeningDisable = [ "format" ];
+  };
+
   grpc = attrs: {
     nativeBuildInputs = [ pkg-config ]
       ++ lib.optional stdenv.isDarwin cctools
diff --git a/pkgs/development/tools/continuous-integration/buildbot/master.nix b/pkgs/development/tools/continuous-integration/buildbot/master.nix
index d14486f8aed..4195a845303 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/master.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/master.nix
@@ -24,7 +24,7 @@
 , moto
 , markdown
 , lz4
-, setuptoolsTrial
+, setuptools-trial
 , buildbot-worker
 , buildbot-plugins
 , buildbot-pkg
@@ -103,7 +103,7 @@ let
       moto
       markdown
       lz4
-      setuptoolsTrial
+      setuptools-trial
       buildbot-worker
       buildbot-pkg
       buildbot-plugins.www
diff --git a/pkgs/development/tools/continuous-integration/buildbot/worker.nix b/pkgs/development/tools/continuous-integration/buildbot/worker.nix
index 5f3c0efab41..29d0bcf7fb7 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/worker.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/worker.nix
@@ -15,7 +15,7 @@
 # tests
 , parameterized
 , psutil
-, setuptoolsTrial
+, setuptools-trial
 
 # passthru
 , nixosTests
@@ -36,7 +36,7 @@ buildPythonPackage (rec {
   '';
 
   nativeBuildInputs = [
-    setuptoolsTrial
+    setuptools-trial
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/fx/default.nix b/pkgs/development/tools/fx/default.nix
index 9af1c4d8ee0..05589b5c974 100644
--- a/pkgs/development/tools/fx/default.nix
+++ b/pkgs/development/tools/fx/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fx";
-  version = "30.2.0";
+  version = "31.0.0";
 
   src = fetchFromGitHub {
     owner = "antonmedv";
     repo = pname;
     rev = version;
-    hash = "sha256-1U3XaqRJpwC41R8hiF7vQ32DOTGGxhaU1ZWiXzys8/M=";
+    hash = "sha256-AVaMViu+65xyYW3TzIigNXf5FfKb2v+TU/BMZqCX/Js=";
   };
 
-  vendorHash = "sha256-6wVcdzTYnB0Bd/YLPcbryKxCXu5genzQQ96znbn2ahw=";
+  vendorHash = "sha256-kE6JotKP3YQ0B3HvyNU3fTvuwbnqTW8cwGVBYpiBvso=";
 
   meta = with lib; {
     description = "Terminal JSON viewer";
diff --git a/pkgs/development/tools/misc/texlab/default.nix b/pkgs/development/tools/misc/texlab/default.nix
index 9bc36338ff2..1948b6f8768 100644
--- a/pkgs/development/tools/misc/texlab/default.nix
+++ b/pkgs/development/tools/misc/texlab/default.nix
@@ -15,16 +15,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "texlab";
-  version = "5.10.1";
+  version = "5.11.0";
 
   src = fetchFromGitHub {
     owner = "latex-lsp";
     repo = "texlab";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ACdiFkV138jDIrRe+baYo+r9vCO4cyRyO2ck7OKakFY=";
+    hash = "sha256-bN2LvuB/BD21SL5fG9QNPpR9hUk52U2BJJ6TFMhwDBk=";
   };
 
-  cargoHash = "sha256-bEeQOOucXd4HNTR6SmidAfDkZ1tT7ORmUxrNx+3FNRw=";
+  cargoHash = "sha256-V4hANIkReF7EEtFsBv1hA/Ftre6YQPs69LpG/GR0Egc=";
 
   outputs = [ "out" ] ++ lib.optional (!isCross) "man";
 
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage rec {
   # generate the man page
   postInstall = lib.optionalString (!isCross) ''
     # TexLab builds man page separately in CI:
-    # https://github.com/latex-lsp/texlab/blob/v5.10.1/.github/workflows/publish.yml#L117-L121
+    # https://github.com/latex-lsp/texlab/blob/v5.11.0/.github/workflows/publish.yml#L117-L121
     help2man --no-info "$out/bin/texlab" > texlab.1
     installManPage texlab.1
   '';
@@ -51,6 +51,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "An implementation of the Language Server Protocol for LaTeX";
     homepage = "https://github.com/latex-lsp/texlab";
+    changelog = "https://github.com/latex-lsp/texlab/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ doronbehar kira-bruneau ];
     platforms = platforms.all;
diff --git a/pkgs/development/tools/nailgun/default.nix b/pkgs/development/tools/nailgun/default.nix
index 2d8b075a685..6c71e374ffc 100644
--- a/pkgs/development/tools/nailgun/default.nix
+++ b/pkgs/development/tools/nailgun/default.nix
@@ -11,7 +11,7 @@ let
 
   commonMeta = {
     license = lib.licenses.asl20;
-    homepage = "http://www.martiansoftware.com/nailgun/";
+    homepage = "https://www.martiansoftware.com/nailgun/";
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ ];
   };
diff --git a/pkgs/development/tools/protoc-gen-grpc-web/default.nix b/pkgs/development/tools/protoc-gen-grpc-web/default.nix
index 28a83a07d81..7308414504e 100644
--- a/pkgs/development/tools/protoc-gen-grpc-web/default.nix
+++ b/pkgs/development/tools/protoc-gen-grpc-web/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "protoc-gen-grpc-web";
-  version = "1.4.2";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc-web";
     rev = finalAttrs.version;
-    sha256 = "sha256-OetDAZ6zC8r7e82FILpQQnM+JHG9eludwhEuPaklrnw=";
+    sha256 = "sha256-yqiSuqan4vynE3AS8OnYdzA+3AVlVFTBkxTuJe17114=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/javascript/net/grpc/web/generator";
diff --git a/pkgs/development/tools/rust/cargo-mommy/default.nix b/pkgs/development/tools/rust/cargo-mommy/default.nix
index b05282f4f77..556446af316 100644
--- a/pkgs/development/tools/rust/cargo-mommy/default.nix
+++ b/pkgs/development/tools/rust/cargo-mommy/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-mommy";
-  version = "0.1.1";
+  version = "0.2.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-p1SAYUQu1HpYJ6TbLJ3lfA9VlKHvB7z5yiFXmTQOCXA=";
+    sha256 = "sha256-/f6jHXwUJqAlqmVvvxfB4tvKkYwCmqI8GgPBHf5Qg1E=";
   };
 
-  cargoSha256 = "sha256-5RidY+6EF23UNzz1suSdA4LL59FalipaJ+ISSsmiCXM=";
+  cargoSha256 = "sha256-hj6oRuTlCxGq5SosVBkVwrG0Sgv5iDz5naCXPueYFqM=";
 
   meta = with lib; {
     description = "Cargo wrapper that encourages you after running commands";
diff --git a/pkgs/development/tools/sqlint/Gemfile.lock b/pkgs/development/tools/sqlint/Gemfile.lock
index 2449a6038ec..dab324f352f 100644
--- a/pkgs/development/tools/sqlint/Gemfile.lock
+++ b/pkgs/development/tools/sqlint/Gemfile.lock
@@ -1,11 +1,11 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    google-protobuf (3.21.2)
-    pg_query (2.1.3)
-      google-protobuf (>= 3.19.2)
-    sqlint (0.2.1)
-      pg_query (~> 2)
+    google-protobuf (3.25.0)
+    pg_query (4.2.3)
+      google-protobuf (>= 3.22.3)
+    sqlint (0.3.0)
+      pg_query (>= 1)
 
 PLATFORMS
   ruby
@@ -14,4 +14,4 @@ DEPENDENCIES
   sqlint
 
 BUNDLED WITH
-   2.3.9
+   2.4.20
diff --git a/pkgs/development/tools/sqlint/gemset.nix b/pkgs/development/tools/sqlint/gemset.nix
index 0bbd8fe0057..05925a45e69 100644
--- a/pkgs/development/tools/sqlint/gemset.nix
+++ b/pkgs/development/tools/sqlint/gemset.nix
@@ -4,10 +4,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i5g23mjc4fiwymrfkvgcmsym50rapw7vm988fm46rlpg3zijgl1";
+      sha256 = "18d1w5j7vjaza3v1ig9j7zyis04kxqdkb1272vbgncxn03ck45mm";
       type = "gem";
     };
-    version = "3.21.2";
+    version = "3.25.0";
   };
   pg_query = {
     dependencies = ["google-protobuf"];
@@ -15,10 +15,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00bhwkhjy6bkp04313m5il7vd165i3fz0x4jissflf66i164ppgk";
+      sha256 = "15ynrzqsmmbmxib8ri8n9k6z3l6rwd91j7y1mghm33nfgdf9bj8w";
       type = "gem";
     };
-    version = "2.1.3";
+    version = "4.2.3";
   };
   sqlint = {
     dependencies = ["pg_query"];
@@ -26,9 +26,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1wbsi0ivashmpgavz7j22qns3zcya8j6sd2f9y8hk8bnqx7i3ak0";
+      sha256 = "06gljzjhbfvxs85699jr1p7y2j8hhi629kfarad7yjqy7ssl541n";
       type = "gem";
     };
-    version = "0.2.1";
+    version = "0.3.0";
   };
 }
diff --git a/pkgs/development/tools/subxt/default.nix b/pkgs/development/tools/subxt/default.nix
new file mode 100644
index 00000000000..fdf103f190e
--- /dev/null
+++ b/pkgs/development/tools/subxt/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, cmake
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "subxt";
+  version = "0.31.0";
+
+  src = fetchFromGitHub {
+    owner = "paritytech";
+    repo = "subxt";
+    rev = "v${version}";
+    hash = "sha256-eEsb88f16Ug9h7JNkzwSTxJZEV5r4XmmzsTxTQGk+j8=";
+  };
+
+  cargoHash = "sha256-kcs55NgwsqgZXcx+a6g0o9KdUG4tt0ZBv3dU/Pb0NJk=";
+
+  # Only build the command line client
+  cargoBuildFlags = [ "--bin" "subxt" ];
+
+  # Needed by wabt-sys
+  nativeBuildInputs = [ cmake ];
+
+  # Requires a running substrate node
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/paritytech/subxt";
+    description = "Submit transactions to a substrate node via RPC.";
+    license = with licenses; [ gpl3Plus asl20 ];
+    maintainers = [ maintainers.FlorianFranzen ];
+  };
+}
diff --git a/pkgs/games/hedgewars/default.nix b/pkgs/games/hedgewars/default.nix
index 6674c85c332..94f8a28add9 100644
--- a/pkgs/games/hedgewars/default.nix
+++ b/pkgs/games/hedgewars/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Turn-based strategy artillery game similar to Worms";
-    homepage = "http://hedgewars.org/";
+    homepage = "https://hedgewars.org/";
     license = licenses.gpl2;
     longDescription = ''
        Each player controls a team of several hedgehogs. During the course of
diff --git a/pkgs/games/hyperrogue/default.nix b/pkgs/games/hyperrogue/default.nix
index cd24a44f92a..2735cfff194 100644
--- a/pkgs/games/hyperrogue/default.nix
+++ b/pkgs/games/hyperrogue/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with lib; {
-    homepage = "http://www.roguetemple.com/z/hyper/";
+    homepage = "https://www.roguetemple.com/z/hyper/";
     description = "A roguelike game set in hyperbolic geometry";
     maintainers = with maintainers; [ rardiol ];
     license = licenses.gpl2;
diff --git a/pkgs/games/xskat/default.nix b/pkgs/games/xskat/default.nix
index 74c2be586ce..6baf397ad67 100644
--- a/pkgs/games/xskat/default.nix
+++ b/pkgs/games/xskat/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libX11 imake ];
 
   src = fetchurl {
-    url = "http://www.xskat.de/xskat-${version }.tar.gz";
+    url = "https://web.archive.org/web/20220331112433if_/https://www.xskat.de/xskat-${version}.tar.gz";
     sha256 = "8ba52797ccbd131dce69b96288f525b0d55dee5de4008733f7a5a51deb831c10";
   };
 
@@ -25,6 +25,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     license = licenses.free;
     longDescription = "Play the german card game Skat against the AI or over IRC.";
-    homepage = "http://www.xskat.de/";
+    homepage = "https://web.archive.org/web/20221003060115/https://www.xskat.de/xskat.html";
   };
 }
diff --git a/pkgs/misc/cups/cups-pk-helper.nix b/pkgs/misc/cups/cups-pk-helper.nix
index f5edc729340..1a3b4ebfbef 100644
--- a/pkgs/misc/cups/cups-pk-helper.nix
+++ b/pkgs/misc/cups/cups-pk-helper.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "PolicyKit helper to configure cups with fine-grained privileges";
-    homepage = "http://www.freedesktop.org/wiki/Software/cups-pk-helper/";
+    homepage = "https://www.freedesktop.org/wiki/Software/cups-pk-helper/";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = [ maintainers.bjornfor ];
diff --git a/pkgs/os-specific/linux/ch9344/default.nix b/pkgs/os-specific/linux/ch9344/default.nix
index 8f258d227bb..e7da864b90c 100644
--- a/pkgs/os-specific/linux/ch9344/default.nix
+++ b/pkgs/os-specific/linux/ch9344/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "http://www.wch-ic.com/";
+    homepage = "https://www.wch-ic.com/";
     downloadPage = "https://www.wch.cn/downloads/CH9344SER_LINUX_ZIP.html";
     description = "WCH CH9344/CH348 UART driver";
     longDescription = ''
diff --git a/pkgs/os-specific/linux/kmscon/default.nix b/pkgs/os-specific/linux/kmscon/default.nix
index 0d146613542..4762b63eda9 100644
--- a/pkgs/os-specific/linux/kmscon/default.nix
+++ b/pkgs/os-specific/linux/kmscon/default.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "KMS/DRM based System Console";
-    homepage = "http://www.freedesktop.org/wiki/Software/kmscon/";
+    homepage = "https://www.freedesktop.org/wiki/Software/kmscon/";
     license = licenses.mit;
     maintainers = with maintainers; [ omasanori ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index b58d471680b..c489e746886 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "http://www.intel.com/";
+    homepage = "https://www.intel.com/";
     description = "Microcode for Intel processors";
     license = licenses.unfreeRedistributableFirmware;
     platforms = platforms.linux;
diff --git a/pkgs/servers/openafs/1.8/module.nix b/pkgs/servers/openafs/1.8/module.nix
index 3af259d0e72..04db11a9a5a 100644
--- a/pkgs/servers/openafs/1.8/module.nix
+++ b/pkgs/servers/openafs/1.8/module.nix
@@ -32,6 +32,69 @@ stdenv.mkDerivation {
   version = "${version}-${kernel.modDirVersion}";
   inherit src;
 
+  patches = [
+    # cf: Fix cast-function-type err w/disable-checking
+    (fetchpatch {
+      url = "https://git.openafs.org?p=openafs.git;a=patch;h=6867a3e8429f37fb748575df52256227ae9e5b53";
+      hash = "sha256-FDvOFDzl2eFN7ZKUqQBQSWGo0ntayc8NCYh/haVi8Ng=";
+    })
+    # LINUX: Make 'fs flush*' invalidate dentry
+    (fetchpatch {
+      url = "https://git.openafs.org?p=openafs.git;a=patch;h=898098e01e19970f80f60a0551252b2027246038";
+      hash = "sha256-ehwRrzpqB8iJKuZ/18oJsrHVlKQs6EzCNaPtSG1m0sw=";
+    })
+    # Linux 6.5: Replace generic_file_splice_read
+    (fetchpatch {
+      url = "https://git.openafs.org?p=openafs.git;a=patch;h=fef245769366efe8694ddadd1e1f2ed5ef8608f4";
+      hash = "sha256-TD1xYvlc9aJyravNZLPhceeOwBawvn0Ndxd50rszTJU=";
+    })
+    # LINUX: Make sysctl definitions more concise
+    (fetchpatch {
+      url = "https://git.openafs.org?p=openafs.git;a=patch;h=d15c7ab50c92671052cbe9a93b0440c81156d8aa";
+      hash = "sha256-6K593AJvgC34RfnIqW8+0A/v9cF6tsbVMeKpCv+QrK4=";
+    })
+    # Linux 6.5: Use register_sysctl()
+    (fetchpatch {
+      url = "https://git.openafs.org?p=openafs.git;a=patch;h=63801cfd1fc06ec3259fcfd67229f3a3c70447ed";
+      hash = "sha256-eoQxaZ28OanSoaHRJcfvXQORbe21YLhwPLoJUILjMkU=";
+    })
+    # hcrypto: rename abort to _afscrypto_abort
+    (fetchpatch {
+      url = "https://git.openafs.org?p=openafs.git;a=patch;h=538f450033a67e251b473ff92238b3124b85fc72";
+      hash = "sha256-ztfJQKvGHGdWQe/0+BGkgRFxOi3n4YY+EFxgbD3DO1E=";
+    })
+    # cf: Avoid nested C functions built by autoconf
+    (fetchpatch {
+      url = "https://git.openafs.org?p=openafs.git;a=patch;h=d50ced2a17e05884ea18bb3dfcde6378b2531dc7";
+      hash = "sha256-dK2/9bGhlXCPCB9t9T/K2dKdRBShVKXtYXWPttsOhAM=";
+    })
+    # cf: Use static allocated structs for cf tests
+    (fetchpatch {
+      url = "https://git.openafs.org?p=openafs.git;a=patch;h=00f13c45d637249a0d698458e08c1b8e2da8e219";
+      hash = "sha256-YNszJIxBDIsl3RgBcHEpNtYIrNLC0tnSbIOQvX0oZ+s=";
+    })
+    # LINUX: Pass an array of structs to register_sysctl
+    (fetchpatch {
+      url = "https://git.openafs.org?p=openafs.git;a=patch;h=5b647bf17a878271e1ce9882e41663770ee73528";
+      hash = "sha256-9o4cr/KORtanTfuKMAMAOvePB+vK579rR85rY+m8VNM=";
+    })
+    # linux: Replace fop iterate with fop iterate_shared
+    (fetchpatch {
+      url = "https://git.openafs.org?p=openafs.git;a=patch;h=6de0a646036283266e1d4aeb583e426005ca5ad4";
+      hash = "sha256-cL3ByjUS3QU8fSbuN7ZEEKyjb+6TbbZL10UKbSgNl6c=";
+    })
+    # Linux 6.6: convert to ctime accessor functions
+    (fetchpatch {
+      url = "https://git.openafs.org?p=openafs.git;a=patch;h=6413fdbc913834f2884989e5811841f4ccea2b5f";
+      hash = "sha256-vdK25vfS5Yr0xQufzUk431FXHwMIWlP2UpLjqnobJWI=";
+    })
+    # Linux 6.6: Pass request_mask to generic_fillattr
+    (fetchpatch {
+      url = "https://git.openafs.org?p=openafs.git;a=patch;h=4f1d8104d17d2b4e95c7abaf5498db6b80aefa8f";
+      hash = "sha256-XJpqbDB/LOuqZj3gPHlcLeGzAQCGvPH8ArgWf+sbBJU=";
+    })
+  ];
+
   nativeBuildInputs = [ autoconf automake flex libtool_2 perl which bison ]
     ++ kernel.moduleBuildDependencies;
 
diff --git a/pkgs/servers/web-apps/slskd/default.nix b/pkgs/servers/web-apps/slskd/default.nix
index bff64dd3bb0..c1a68f2d5e6 100644
--- a/pkgs/servers/web-apps/slskd/default.nix
+++ b/pkgs/servers/web-apps/slskd/default.nix
@@ -1,8 +1,6 @@
-{ lib, stdenv
+{ lib
 , buildNpmPackage
 , fetchFromGitHub
-, fetchurl
-, unzip
 , dotnetCorePackages
 , buildDotnetModule
 , mono
@@ -27,14 +25,13 @@ let
     platforms = platforms.linux;
   };
 
-  buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs_18; };
-
-  wwwroot = buildNpmPackage' {
+  wwwroot = buildNpmPackage {
     inherit meta version;
 
     pname = "slskd-web";
     src = "${src}/src/web";
     npmFlags = [ "--legacy-peer-deps" ];
+    nodejs = nodejs_18;
     npmDepsHash = "sha256-+2g3pCaGFbzQjKwhjmD6viuzVE5pRg+qSOXMrCtLQkI=";
     installPhase = ''
       cp -r build $out
diff --git a/pkgs/servers/web-apps/whitebophir/default.nix b/pkgs/servers/web-apps/whitebophir/default.nix
index 464d499cf1f..b3401ff78fc 100644
--- a/pkgs/servers/web-apps/whitebophir/default.nix
+++ b/pkgs/servers/web-apps/whitebophir/default.nix
@@ -7,7 +7,7 @@
 
 let
   nodejs = nodejs_20;
-in buildNpmPackage.override { nodejs = nodejs_20; } rec {
+in buildNpmPackage rec {
   pname = "whitebophir";
   version = "1.19.1";
 
@@ -18,6 +18,8 @@ in buildNpmPackage.override { nodejs = nodejs_20; } rec {
     hash = "sha256-4T7s9WrpyHVPcw0QY0C0sczDJYKzA4bAAfEv8q2pOy4=";
   };
 
+  inherit nodejs;
+
   npmDepsHash = "sha256-mKDkkX7vWrnfEg1D65bqn/MtyUS0DKjTtkDW6ebso7g=";
 
   # geckodriver tries to access network
diff --git a/pkgs/tools/bootloaders/refind/default.nix b/pkgs/tools/bootloaders/refind/default.nix
index 2381402534e..de2399adb52 100644
--- a/pkgs/tools/bootloaders/refind/default.nix
+++ b/pkgs/tools/bootloaders/refind/default.nix
@@ -14,23 +14,16 @@ in
 
 stdenv.mkDerivation rec {
   pname = "refind";
-  version = "0.13.3.1";
+  version = "0.14.0.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/refind/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "1lfgqqiyl6isy25wrxzyi3s334ii057g88714igyjjmxh47kygks";
+    hash = "sha256-JqDFXf01ZUmeH4LY/ldGTb7xnKiGzm0BqBUii478iw8=";
   };
 
   patches = [
     # Removes hardcoded toolchain for aarch64, allowing successful aarch64 builds.
     ./0001-toolchain.patch
-
-    # Fixes issue with null dereference in ReadHiddenTags
-    # Upstream: https://sourceforge.net/p/refind/code/merge-requests/45/
-    (fetchpatch {
-      url = "https://github.com/samueldr/rEFInd/commit/29cd79dedabf84d5ddfe686f5692278cae6cc4d6.patch";
-      sha256 = "sha256-/jAmOwvMmFWazyukN+ru1tQDiIBtgGk/e/pczsl1Xc8=";
-    })
   ];
 
   buildInputs = [ gnu-efi ];
diff --git a/pkgs/tools/filesystems/unionfs-fuse/default.nix b/pkgs/tools/filesystems/unionfs-fuse/default.nix
index 8f008c3a346..4dc9ca9de6e 100644
--- a/pkgs/tools/filesystems/unionfs-fuse/default.nix
+++ b/pkgs/tools/filesystems/unionfs-fuse/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   patches = [
     # Prevent the unionfs daemon from being killed during
     # shutdown. See
-    # http://www.freedesktop.org/wiki/Software/systemd/RootStorageDaemons/
+    # https://www.freedesktop.org/wiki/Software/systemd/RootStorageDaemons/
     # for details.
     ./prevent-kill-on-shutdown.patch
   ];
diff --git a/pkgs/tools/misc/ccal/default.nix b/pkgs/tools/misc/ccal/default.nix
index 55ccb7f774c..e7a01795f0d 100644
--- a/pkgs/tools/misc/ccal/default.nix
+++ b/pkgs/tools/misc/ccal/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   pname = "ccal";
   version = "2.5.3";
   src = fetchurl {
-    url = "http://ccal.chinesebay.com/ccal/${pname}-${version}.tar.gz";
+    url = "https://ccal.chinesebay.com/${pname}-${version}.tar.gz";
     sha256 = "sha256-PUy9yfkFzgKrSEBB+79/C3oxmuajUMbBbWNuGlpQ35Y=";
   };
 
@@ -25,11 +25,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = "http://ccal.chinesebay.com/ccal.htm";
+    homepage = "https://ccal.chinesebay.com/ccal.htm";
     description = "Command line Chinese calendar viewer, similar to cal";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ sharzy ];
     platforms = lib.platforms.all;
   };
 }
-
diff --git a/pkgs/tools/misc/desktop-file-utils/default.nix b/pkgs/tools/misc/desktop-file-utils/default.nix
index 218eed5eb8b..b58a7d819ba 100644
--- a/pkgs/tools/misc/desktop-file-utils/default.nix
+++ b/pkgs/tools/misc/desktop-file-utils/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
   setupHook = ./setup-hook.sh;
 
   meta = with lib; {
-    homepage = "http://www.freedesktop.org/wiki/Software/desktop-file-utils";
+    homepage = "https://www.freedesktop.org/wiki/Software/desktop-file-utils";
     description = "Command line utilities for working with .desktop files";
     platforms = platforms.linux ++ platforms.darwin;
     license = licenses.gpl2Plus;
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index f737b78bb6d..8926b971429 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -78,11 +78,11 @@
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python3.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "250";
+  version = "251";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-M73txRNzYARVdtUXHy4k92akgxfA6Now83KdqS/rHCI=";
+    hash = "sha256-7oAFxzLLEds9SI14F88QRhirb/3pjXhmGaW0SWUgpv4=";
   };
 
   outputs = [
diff --git a/pkgs/tools/misc/nb/default.nix b/pkgs/tools/misc/nb/default.nix
index 55f4682fb99..79796255a84 100644
--- a/pkgs/tools/misc/nb/default.nix
+++ b/pkgs/tools/misc/nb/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nb";
-  version = "7.7.1";
+  version = "7.8.0";
 
   src = fetchFromGitHub {
     owner = "xwmx";
     repo = "nb";
     rev = version;
-    sha256 = "sha256-v5HBz3N8H1LBtCRjw+033TRokgVPX5MQ+f7fPvCGBpA=";
+    sha256 = "sha256-8TOEPPtwxbTlm5nGMjOmH8lvsDu0vNgvxaUOgKS1l/g=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/tools/misc/plantuml/default.nix b/pkgs/tools/misc/plantuml/default.nix
index 9a6698ecfd4..eb6cfb7ebcb 100644
--- a/pkgs/tools/misc/plantuml/default.nix
+++ b/pkgs/tools/misc/plantuml/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Draw UML diagrams using a simple and human readable text description";
-    homepage = "http://plantuml.sourceforge.net/";
+    homepage = "https://plantuml.com/";
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     # "plantuml -license" says GPLv3 or later
     license = licenses.gpl3Plus;
diff --git a/pkgs/tools/networking/clash/default.nix b/pkgs/tools/networking/clash/default.nix
deleted file mode 100644
index 6cce7d247a5..00000000000
--- a/pkgs/tools/networking/clash/default.nix
+++ /dev/null
@@ -1,49 +0,0 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
-, testers
-, clash
-}:
-
-buildGoModule rec {
-  pname = "clash";
-  version = "1.18.0";
-
-  src = fetchFromGitHub {
-    owner = "Dreamacro";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-LqjSPlPkR5sB4Z1pmpdE9r66NN7pwgE9GK4r1zSFlxs=";
-  };
-
-  vendorHash = "sha256-EWAbEFYr15RiJk9IXF6KaaX4GaSCa6E4+8rKL4/XG8Y=";
-
-  # Do not build testing suit
-  excludedPackages = [ "./test" ];
-
-  CGO_ENABLED = 0;
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/Dreamacro/clash/constant.Version=${version}"
-  ];
-
-  checkFlags = [
-    "-skip=TestParseRule" # Flaky tests
-  ];
-
-  passthru.tests.version = testers.testVersion {
-    package = clash;
-    command = "clash -v";
-  };
-
-  meta = with lib; {
-    description = "A rule-based tunnel in Go";
-    homepage = "https://dreamacro.github.io/clash/";
-    changelog = "https://github.com/Dreamacro/clash/releases/tag/v${version}";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ contrun Br1ght0ne ];
-    mainProgram = "clash";
-  };
-}
diff --git a/pkgs/tools/networking/redsocks/default.nix b/pkgs/tools/networking/redsocks/default.nix
index 9b8989f30c2..cebec2cb2b6 100644
--- a/pkgs/tools/networking/redsocks/default.nix
+++ b/pkgs/tools/networking/redsocks/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Transparent redirector of any TCP connection to proxy";
-    homepage = "http://darkk.net.ru/redsocks/";
+    homepage = "https://darkk.net.ru/redsocks/";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.ekleog ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/tools/networking/ripmime/default.nix b/pkgs/tools/networking/ripmime/default.nix
index 6584edca5e6..7cfb31ff985 100644
--- a/pkgs/tools/networking/ripmime/default.nix
+++ b/pkgs/tools/networking/ripmime/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "ripmime";
   version = "1.4.0.10";
   src = fetchurl {
-    url = "http://www.pldaniels.com/${pname}/${pname}-${version}.tar.gz";
+    url = "https://pldaniels.com/${pname}/${pname}-${version}.tar.gz";
     sha256 = "0sj06ibmlzy34n8v0mnlq2gwidy7n2aqcwgjh0xssz3vi941aqc9";
   };
 
@@ -19,13 +19,13 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Attachment extractor for MIME messages";
     maintainers = with maintainers; [ raskin ];
-    homepage = "http://www.pldaniels.com/ripmime/";
+    homepage = "https://pldaniels.com/ripmime/";
     platforms = platforms.all;
   };
 
   passthru = {
     updateInfo = {
-      downloadPage = "http://www.pldaniels.com/ripmime/";
+      downloadPage = "https://pldaniels.com/ripmime/";
     };
   };
 }
diff --git a/pkgs/tools/networking/whois/clang.patch b/pkgs/tools/networking/whois/clang.patch
deleted file mode 100644
index 3091b9a3eee..00000000000
--- a/pkgs/tools/networking/whois/clang.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/utils.h
-+++ b/utils.h
-@@ -15,7 +15,7 @@
- #endif
- 
- /* Portability macros */
--#ifdef __GNUC__
-+#if defined __GNUC__ && ! defined __clang__
- # define NORETURN __attribute__((noreturn))
- # define MALLOC_FREE __attribute__((malloc(free)))
- # define NONNULL __attribute__((returns_nonnull))
diff --git a/pkgs/tools/networking/whois/default.nix b/pkgs/tools/networking/whois/default.nix
index 465ab765013..fe4950d5c24 100644
--- a/pkgs/tools/networking/whois/default.nix
+++ b/pkgs/tools/networking/whois/default.nix
@@ -1,20 +1,16 @@
 { lib, stdenv, fetchFromGitHub, perl, gettext, pkg-config, libidn2, libiconv }:
 
 stdenv.mkDerivation rec {
-  version = "5.5.19";
+  version = "5.5.20";
   pname = "whois";
 
   src = fetchFromGitHub {
     owner = "rfc1036";
     repo = "whois";
     rev = "v${version}";
-    hash = "sha256-4mFn5cY7ipAU4vOiHC2s69fxYJwShQEQ1eA8t5JvOP0=";
+    hash = "sha256-0vQ6GBBtNA6Phlqhl3NZvEJqoyZ1um7VdkpsIRKhsm4=";
   };
 
-  patches = [
-    ./clang.patch
-  ];
-
   nativeBuildInputs = [ perl gettext pkg-config ];
   buildInputs = [ libidn2 libiconv ];
 
diff --git a/pkgs/tools/security/afl/qemu.nix b/pkgs/tools/security/afl/qemu.nix
index 9a8b4b3ca36..845d9fa3e6f 100644
--- a/pkgs/tools/security/afl/qemu.nix
+++ b/pkgs/tools/security/afl/qemu.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   srcs = [
     (fetchurl {
-      url = "http://wiki.qemu.org/download/qemu-${version}.tar.bz2";
+      url = "https://download.qemu.org/qemu-${version}.tar.bz2";
       sha256 = "0j3dfxzrzdp1w21k21fjvmakzc6lcha1rsclaicwqvbf63hkk7vy";
     })
     afl.src
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
     ];
 
   meta = with lib; {
-    homepage = "http://www.qemu.org/";
+    homepage = "https://www.qemu.org/";
     description = "Fork of QEMU with AFL instrumentation support";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ thoughtpolice ];
diff --git a/pkgs/tools/security/bitwarden/cli.nix b/pkgs/tools/security/bitwarden/cli.nix
index 750237a4e2e..dd35294ba34 100644
--- a/pkgs/tools/security/bitwarden/cli.nix
+++ b/pkgs/tools/security/bitwarden/cli.nix
@@ -8,9 +8,7 @@
 , nixosTests
 }:
 
-let
-  buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs_18; };
-in buildNpmPackage' rec {
+buildNpmPackage rec {
   pname = "bitwarden-cli";
   version = "2023.10.0";
 
@@ -21,6 +19,8 @@ in buildNpmPackage' rec {
     hash = "sha256-egXToXWfb9XV7JuCRBYJO4p/e+WOwMncPKz0oBgeALQ=";
   };
 
+  nodejs = nodejs_18;
+
   npmDepsHash = "sha256-iO8ZozVl1vOOqowQARnRJWSFUFnau46+dKfcMSkyU3o=";
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/bitwarden/default.nix b/pkgs/tools/security/bitwarden/default.nix
index e48f5945ca6..67ed396b538 100644
--- a/pkgs/tools/security/bitwarden/default.nix
+++ b/pkgs/tools/security/bitwarden/default.nix
@@ -24,10 +24,8 @@
 let
   description = "A secure and free password manager for all of your devices";
   icon = "bitwarden";
-
-  buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs_18; };
   electron = electron_25;
-in buildNpmPackage' rec {
+in buildNpmPackage rec {
   pname = "bitwarden";
   version = "2023.10.0";
 
@@ -38,6 +36,8 @@ in buildNpmPackage' rec {
     hash = "sha256-egXToXWfb9XV7JuCRBYJO4p/e+WOwMncPKz0oBgeALQ=";
   };
 
+  nodejs = nodejs_18;
+
   makeCacheWritable = true;
   npmWorkspace = "apps/desktop";
   npmDepsHash = "sha256-iO8ZozVl1vOOqowQARnRJWSFUFnau46+dKfcMSkyU3o=";
diff --git a/pkgs/tools/security/chkrootkit/default.nix b/pkgs/tools/security/chkrootkit/default.nix
index b365fa62f95..7c3af075a55 100644
--- a/pkgs/tools/security/chkrootkit/default.nix
+++ b/pkgs/tools/security/chkrootkit/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "0.55";
 
   src = fetchurl {
-    url = "ftp://ftp.pangeia.com.br/pub/seg/pac/${pname}-${version}.tar.gz";
+    url = "ftp://ftp.chkrootkit.org/pub/seg/pac/${pname}-${version}.tar.gz";
     sha256 = "sha256-qBwChuxEkxP5U3ASAqAOgbIE/Cz0PieFhaEcEqXgJYs=";
   };
 
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Locally checks for signs of a rootkit";
-    homepage = "http://www.chkrootkit.org/";
+    homepage = "https://www.chkrootkit.org/";
     license = licenses.bsd2;
     platforms = with platforms; linux;
   };
diff --git a/pkgs/tools/system/supercronic/default.nix b/pkgs/tools/system/supercronic/default.nix
new file mode 100644
index 00000000000..3b3f285a086
--- /dev/null
+++ b/pkgs/tools/system/supercronic/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, python3
+, bash
+, coreutils
+}:
+
+buildGoModule rec {
+  pname = "supercronic";
+  version = "0.2.27";
+
+  src = fetchFromGitHub {
+    owner = "aptible";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-sgKvE8Ze2qKPgdaAwN1sB0wX7k5VRx8+llkT54xXvrM=";
+  };
+
+  vendorHash = "sha256-j1iduvu+dKmhvPN8pe50fGQU5cC9N3gfoMh9gSQDbf8=";
+
+  excludedPackages = [ "cronexpr/cronexpr" ];
+
+  nativeCheckInputs = [ python3 bash coreutils ];
+
+  postConfigure = ''
+    # There are tests that set the shell to various paths
+    substituteInPlace cron/cron_test.go --replace /bin/sh ${bash}/bin/sh
+    substituteInPlace cron/cron_test.go --replace /bin/false ${coreutils}/bin/false
+  '';
+
+  meta = with lib; {
+    description = "Cron tool designed for use in containers";
+    homepage = "https://github.com/aptible/supercronic";
+    license = licenses.mit;
+    maintainers = with maintainers; [ nasageek ];
+  };
+}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 0aea2d540e0..42e3b2e51b0 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -146,6 +146,7 @@ mapAliases ({
   composable_kernel = throw "'composable_kernel' has been replaced with 'rocmPackages.composable_kernel'"; # Added 2023-10-08
   cpp-ipfs-api = cpp-ipfs-http-client; # Project has been renamed. Added 2022-05-15
   crispyDoom = crispy-doom; # Added 2023-05-01
+  clash = throw "'clash' has been removed, upstream gone. Consider using 'clash-meta' instead."; # added 2023-11-10
   clasp = clingo; # added 2022-12-22
   claws-mail-gtk3 = claws-mail; # Added 2021-07-10
   cntk = throw "'cntk' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2023-10-09
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 674d32cb7d2..2e850e9368e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2055,6 +2055,8 @@ with pkgs;
 
   steamtinkerlaunch = callPackage ../tools/games/steamtinkerlaunch { };
 
+  supercronic = callPackage ../tools/system/supercronic { };
+
   supermin = callPackage ../tools/virtualization/supermin { };
 
   sx-go = callPackage ../tools/security/sx-go { };
@@ -4668,8 +4670,6 @@ with pkgs;
 
   map-cmd = callPackage ../tools/misc/map { };
 
-  clash = callPackage ../tools/networking/clash { };
-
   clash-geoip = callPackage ../data/misc/clash-geoip { };
 
   clash-meta = callPackage ../tools/networking/clash-meta { };
@@ -25259,6 +25259,8 @@ with pkgs;
 
   subtitleeditor = callPackage ../applications/video/subtitleeditor { };
 
+  subxt = callPackage ../development/tools/subxt { };
+
   suil = darwin.apple_sdk_11_0.callPackage ../development/libraries/audio/suil { };
 
   sundials = callPackage ../development/libraries/sundials {
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index aeecbb99d3f..640fcaefa4c 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -212,6 +212,7 @@ mapAliases ({
   jupyter_core = jupyter-core; # added 2023-01-05
   jupyter_server = jupyter-server; # added 2023-01-05
   jupyter-server-ydoc = jupyter-collaboration; # added 2023-07-18
+  jupyterlab_launcher = throw "jupyterlab_launcher has been removed as it's abandoned for over 5 years and broken"; # added 2023-11-11
   Kajiki = kajiki; # added 2023-02-19
   Keras = keras; # added 2021-11-25
   ldap = python-ldap; # added 2022-09-16
@@ -393,6 +394,7 @@ mapAliases ({
   selectors34 = throw "selectors34 has been removed: functionality provided by Python itself; archived by upstream."; # added 2021-06-10
   sequoia = throw "python3Packages.sequoia was replaced by pysequoia - built from a dedicated repository, with a new API."; # added 2023-06-24
   setuptools_scm = setuptools-scm; # added 2021-06-03
+  setuptoolsTrial = setuptools-trial; # added 2023-11-11
   sharkiqpy = sharkiq; # added 2022-05-21
   ssh-mitm = throw "ssh-mitm was removed in favor of the top-level ssh-mitm"; # added 2023-05-09
   smart_open = smart-open; # added 2021-03-14
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 45a94e4be22..dc62190efc7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5823,8 +5823,6 @@ self: super: with self; {
 
   jupyterlab-git = callPackage ../development/python-modules/jupyterlab-git { };
 
-  jupyterlab_launcher = callPackage ../development/python-modules/jupyterlab_launcher { };
-
   jupyterlab-pygments = callPackage ../development/python-modules/jupyterlab-pygments { };
 
   jupyterlab_server = callPackage ../development/python-modules/jupyterlab_server { };
@@ -5857,6 +5855,8 @@ self: super: with self; {
 
   jwcrypto = callPackage ../development/python-modules/jwcrypto { };
 
+  jwt = callPackage ../development/python-modules/jwt { };
+
   jxmlease = callPackage ../development/python-modules/jxmlease { };
 
   k-diffusion = callPackage ../development/python-modules/k-diffusion { };
@@ -8287,8 +8287,6 @@ self: super: with self; {
 
   nxt-python = callPackage ../development/python-modules/nxt-python { };
 
-  python-jwt = callPackage ../development/python-modules/python-jwt { };
-
   python-ndn = callPackage ../development/python-modules/python-ndn { };
 
   python-nvd3 = callPackage ../development/python-modules/python-nvd3 { };
@@ -12772,7 +12770,7 @@ self: super: with self; {
 
   setuptools-scm-git-archive = callPackage ../development/python-modules/setuptools-scm-git-archive { };
 
-  setuptoolsTrial = callPackage ../development/python-modules/setuptoolstrial { };
+  setuptools-trial = callPackage ../development/python-modules/setuptools-trial { };
 
   seventeentrack = callPackage ../development/python-modules/seventeentrack { };