Merge staging-next into staging

58 files changed, 458 insertions, 357 deletions

diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index a5b624fcfdb..4a8f2f61caa 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -364,55 +364,49 @@ in
         '';
       };
 
-      xkb = mkOption {
-        default = { };
-        description = "X keyboard extension (XKB) configuration";
-        type = types.submodule {
-          options = {
-            layout = mkOption {
-              type = types.str;
-              default = "us";
-              description = lib.mdDoc ''
-                Keyboard layout, or multiple keyboard layouts separated by commas.
-              '';
-            };
-
-            model = mkOption {
-              type = types.str;
-              default = "pc104";
-              example = "presario";
-              description = lib.mdDoc ''
-                Keyboard model.
-              '';
-            };
-
-            options = mkOption {
-              type = types.commas;
-              default = "terminate:ctrl_alt_bksp";
-              example = "grp:caps_toggle,grp_led:scroll";
-              description = lib.mdDoc ''
-                X keyboard options; layout switching goes here.
-              '';
-            };
-
-            variant = mkOption {
-              type = types.str;
-              default = "";
-              example = "colemak";
-              description = lib.mdDoc ''
-                X keyboard variant.
-              '';
-            };
-
-            dir = mkOption {
-              type = types.path;
-              default = "${pkgs.xkeyboard_config}/etc/X11/xkb";
-              defaultText = literalExpression ''"''${pkgs.xkeyboard_config}/etc/X11/xkb"'';
-              description = lib.mdDoc ''
-                Path used for -xkbdir xserver parameter.
-              '';
-            };
-          };
+      xkb = {
+        layout = mkOption {
+          type = types.str;
+          default = "us";
+          description = lib.mdDoc ''
+            X keyboard layout, or multiple keyboard layouts separated by commas.
+          '';
+        };
+
+        model = mkOption {
+          type = types.str;
+          default = "pc104";
+          example = "presario";
+          description = lib.mdDoc ''
+            X keyboard model.
+          '';
+        };
+
+        options = mkOption {
+          type = types.commas;
+          default = "terminate:ctrl_alt_bksp";
+          example = "grp:caps_toggle,grp_led:scroll";
+          description = lib.mdDoc ''
+            X keyboard options; layout switching goes here.
+          '';
+        };
+
+        variant = mkOption {
+          type = types.str;
+          default = "";
+          example = "colemak";
+          description = lib.mdDoc ''
+            X keyboard variant.
+          '';
+        };
+
+        dir = mkOption {
+          type = types.path;
+          default = "${pkgs.xkeyboard_config}/etc/X11/xkb";
+          defaultText = literalExpression ''"''${pkgs.xkeyboard_config}/etc/X11/xkb"'';
+          description = lib.mdDoc ''
+            Path used for -xkbdir xserver parameter.
+          '';
         };
       };
 
diff --git a/nixos/modules/tasks/network-interfaces-scripted.nix b/nixos/modules/tasks/network-interfaces-scripted.nix
index 67ef152c4b6..da4aa916d65 100644
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@@ -61,8 +61,6 @@ let
           MACAddress = i.macAddress;
         } // optionalAttrs (i.mtu != null) {
           MTUBytes = toString i.mtu;
-        } // optionalAttrs (i.wakeOnLan.enable == true) {
-          WakeOnLan = concatStringsSep " " i.wakeOnLan.policy;
         };
       };
     in listToAttrs (map createNetworkLink interfaces);
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 4900b77de37..eda036cb726 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1463,6 +1463,16 @@ in
       ]
       ++ bridgeStp;
 
+    # Wake-on-LAN configuration is shared by the scripted and networkd backends.
+    systemd.network.links = pipe interfaces [
+      (filter (i: i.wakeOnLan.enable))
+      (map (i: nameValuePair "40-${i.name}" {
+        matchConfig.OriginalName = i.name;
+        linkConfig.WakeOnLan = concatStringsSep " " i.wakeOnLan.policy;
+      }))
+      listToAttrs
+    ];
+
     # The network-interfaces target is kept for backwards compatibility.
     # New modules must NOT use it.
     systemd.targets.network-interfaces =
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 29dcdab7d18..9c46409312a 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -67,8 +67,15 @@ in rec {
         (onSystems ["x86_64-linux"] "nixos.tests.docker")
         (onFullSupported "nixos.tests.ecryptfs")
         (onFullSupported "nixos.tests.env")
-        (onFullSupported "nixos.tests.firefox-esr")
-        (onFullSupported "nixos.tests.firefox")
+
+        # Way too many manual retries required on Hydra.
+        #  Apparently it's hard to track down the cause.
+        #  So let's depend just on the packages for now.
+        #(onFullSupported "nixos.tests.firefox-esr")
+        #(onFullSupported "nixos.tests.firefox")
+        (onFullSupported "nixpkgs.firefox-esr")
+        (onFullSupported "nixpkgs.firefox")
+
         (onFullSupported "nixos.tests.firewall")
         (onFullSupported "nixos.tests.fontconfig-default-fonts")
         (onFullSupported "nixos.tests.gnome")
diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index 5ff07f2fa61..2d9b8c9db48 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lsp-plugins";
-  version = "1.2.11";
+  version = "1.2.12";
 
   src = fetchurl {
     url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "sha256-9zLs1J7rZkMaVQxOwihjCsKSLyb9q64pTZLVg/UVf2o=";
+    sha256 = "sha256-a3ts+7wiEwcoLPj6KsfP9lvTNTDSr9t+qEujSgpotXo=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/applications/blockchains/exodus/default.nix b/pkgs/applications/blockchains/exodus/default.nix
index c85008cbcff..2d778a059f2 100644
--- a/pkgs/applications/blockchains/exodus/default.nix
+++ b/pkgs/applications/blockchains/exodus/default.nix
@@ -1,16 +1,42 @@
-{ stdenv, lib, fetchzip, glib, systemd, nss, nspr, gtk3-x11, pango,
-atk, cairo, gdk-pixbuf, xorg, xorg_sys_opengl, util-linux, alsa-lib, dbus, at-spi2-atk,
-cups, vivaldi-ffmpeg-codecs, libpulseaudio, at-spi2-core, libxkbcommon, mesa }:
+{ stdenv
+, lib
+, requireFile
+, unzip
+, glib
+, systemd
+, nss
+, nspr
+, gtk3-x11
+, pango
+, atk
+, cairo
+, gdk-pixbuf
+, xorg
+, xorg_sys_opengl
+, util-linux
+, alsa-lib
+, dbus
+, at-spi2-atk
+, cups
+, vivaldi-ffmpeg-codecs
+, libpulseaudio
+, at-spi2-core
+, libxkbcommon
+, mesa
+}:
 
 stdenv.mkDerivation rec {
   pname = "exodus";
-  version = "23.5.22";
+  version = "23.9.25";
 
-  src = fetchzip {
+  src = requireFile {
+    name = "exodus-linux-x64-${version}.zip";
     url = "https://downloads.exodus.com/releases/${pname}-linux-x64-${version}.zip";
-    sha256 = "sha256-CZuT0nlKyF7LRGqNezm98MHcQa2Uhd8y+NiKE5mi0jk=";
+    sha256 = "a3e314de257e1ec01baa1023886f327ade4b233d833f7fe79f6c3e0f26d07ced";
   };
 
+  nativeBuildInputs = [ unzip ];
+
   installPhase = ''
     mkdir -p $out/bin $out/share/applications
     cp -r . $out
@@ -24,48 +50,50 @@ stdenv.mkDerivation rec {
   dontPatchELF = true;
   dontBuild = true;
 
-  preFixup = let
-    libPath = lib.makeLibraryPath [
-      glib
-      nss
-      nspr
-      gtk3-x11
-      pango
-      atk
-      cairo
-      gdk-pixbuf
-      xorg.libX11
-      xorg.libxcb
-      xorg.libXcomposite
-      xorg.libXcursor
-      xorg.libXdamage
-      xorg.libXext
-      xorg.libXfixes
-      xorg.libXi
-      xorg.libXrender
-      xorg.libxshmfence
-      xorg.libXtst
-      xorg_sys_opengl
-      util-linux
-      xorg.libXrandr
-      xorg.libXScrnSaver
-      alsa-lib
-      dbus.lib
-      at-spi2-atk
-      at-spi2-core
-      cups.lib
-      libpulseaudio
-      systemd
-      vivaldi-ffmpeg-codecs
-      libxkbcommon
-      mesa
-    ];
-  in ''
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath}" \
-      $out/Exodus
-  '';
+  preFixup =
+    let
+      libPath = lib.makeLibraryPath [
+        glib
+        nss
+        nspr
+        gtk3-x11
+        pango
+        atk
+        cairo
+        gdk-pixbuf
+        xorg.libX11
+        xorg.libxcb
+        xorg.libXcomposite
+        xorg.libXcursor
+        xorg.libXdamage
+        xorg.libXext
+        xorg.libXfixes
+        xorg.libXi
+        xorg.libXrender
+        xorg.libxshmfence
+        xorg.libXtst
+        xorg_sys_opengl
+        util-linux
+        xorg.libXrandr
+        xorg.libXScrnSaver
+        alsa-lib
+        dbus.lib
+        at-spi2-atk
+        at-spi2-core
+        cups.lib
+        libpulseaudio
+        systemd
+        vivaldi-ffmpeg-codecs
+        libxkbcommon
+        mesa
+      ];
+    in
+    ''
+      patchelf \
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "${libPath}" \
+        $out/Exodus
+    '';
 
   meta = with lib; {
     homepage = "https://www.exodus.io/";
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 8b64723db84..720718cb7bb 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -17,12 +17,14 @@
 , expat
 , libxcrypt-legacy
 , fontconfig
+, libxml2
+, xz
 , vmopts ? null
 }:
 
 let
   platforms = lib.platforms.linux ++ [ "x86_64-darwin" "aarch64-darwin" ];
-  ideaPlatforms = [ "x86_64-darwin" "i686-darwin" "i686-linux" "x86_64-linux" "aarch64-darwin" ];
+  ideaPlatforms = [ "x86_64-darwin" "i686-darwin" "i686-linux" "x86_64-linux" "aarch64-darwin" "aarch64-linux" ];
 
   inherit (stdenv.hostPlatform) system;
 
@@ -58,6 +60,9 @@ let
         openssl.out
         expat
         libxcrypt-legacy
+      ] ++ lib.optionals (stdenv.isLinux && stdenv.isAarch64) [
+        libxml2
+        xz
       ];
       dontAutoPatchelf = true;
       postFixup = (attrs.postFixup or "") + lib.optionalString (stdenv.isLinux) ''
@@ -65,12 +70,12 @@ let
           cd $out/clion
 
           # I think the included gdb has a couple of patches, so we patch it instead of replacing
-          ls -d $PWD/bin/gdb/linux/x64/lib/python3.8/lib-dynload/* |
+          ls -d $PWD/bin/gdb/linux/*/lib/python3.8/lib-dynload/* |
           xargs patchelf \
             --replace-needed libssl.so.10 libssl.so \
             --replace-needed libcrypto.so.10 libcrypto.so
 
-          ls -d $PWD/bin/lldb/linux/x64/lib/python3.8/lib-dynload/* |
+          ls -d $PWD/bin/lldb/linux/*/lib/python3.8/lib-dynload/* |
           xargs patchelf \
             --replace-needed libssl.so.10 libssl.so \
             --replace-needed libcrypto.so.10 libcrypto.so
@@ -271,7 +276,7 @@ let
       buildInputs = (attrs.buildInputs or [ ]) ++ lib.optionals (stdenv.isLinux) [
         stdenv.cc.cc
         zlib
-        fontconfig  # plugins/dotTrace/DotFiles/linux-x64/libSkiaSharp.so
+        fontconfig  # plugins/dotTrace/DotFiles/linux-*/libSkiaSharp.so
       ];
       dontAutoPatchelf = true;
       postFixup = (attrs.postFixup or "") + lib.optionalString (stdenv.isLinux) ''
@@ -279,12 +284,15 @@ let
           cd $out/rider
 
           # Remove dotnet copy first so it's not considered by autoPatchElf
-          rm -rf lib/ReSharperHost/linux-x64/dotnet
+          rm -rf lib/ReSharperHost/linux-*/dotnet
           autoPatchelf \
-            lib/ReSharperHost/linux-x64/ \
-            plugins/dotCommon/DotFiles/linux-x64/ \
-            plugins/dotTrace/DotFiles/linux-x64/
-          ln -s ${dotnet-sdk_7} lib/ReSharperHost/linux-x64/dotnet
+            lib/ReSharperHost/linux-*/ \
+            plugins/dotCommon/DotFiles/linux-*/ \
+            plugins/dotTrace/DotFiles/linux-*/
+
+          for dir in lib/ReSharperHost/linux-*; do
+            ln -s ${dotnet-sdk_7} $dir/dotnet
+          done
         )
       '';
     });
@@ -320,6 +328,10 @@ let
         libdbusmenu
         openssl.out
         libxcrypt-legacy
+      ] ++ lib.optionals (stdenv.isLinux && stdenv.isAarch64) [
+        expat
+        libxml2
+        xz
       ];
       dontAutoPatchelf = true;
       postFixup = (attrs.postFixup or "") + lib.optionalString (stdenv.isLinux) ''
@@ -327,12 +339,12 @@ let
           cd $out/rust-rover
 
           # Copied over from clion (gdb seems to have a couple of patches)
-          ls -d $PWD/bin/gdb/linux/x64/lib/python3.8/lib-dynload/* |
+          ls -d $PWD/bin/gdb/linux/*/lib/python3.8/lib-dynload/* |
           xargs patchelf \
             --replace-needed libssl.so.10 libssl.so \
             --replace-needed libcrypto.so.10 libcrypto.so
 
-          ls -d $PWD/bin/lldb/linux/x64/lib/python3.8/lib-dynload/* |
+          ls -d $PWD/bin/lldb/linux/*/lib/python3.8/lib-dynload/* |
           xargs patchelf \
             --replace-needed libssl.so.10 libssl.so \
             --replace-needed libcrypto.so.10 libcrypto.so
@@ -340,8 +352,8 @@ let
           autoPatchelf $PWD/bin
 
           interp="$(cat $NIX_CC/nix-support/dynamic-linker)"
-          patchelf --set-interpreter $interp $PWD/plugins/intellij-rust/bin/linux/x86-64/intellij-rust-native-helper
-          chmod +x $PWD/plugins/intellij-rust/bin/linux/x86-64/intellij-rust-native-helper
+          patchelf --set-interpreter $interp $PWD/plugins/intellij-rust/bin/linux/*/intellij-rust-native-helper
+          chmod +x $PWD/plugins/intellij-rust/bin/linux/*/intellij-rust-native-helper
         )
       '';
     });
diff --git a/pkgs/applications/graphics/lutgen/default.nix b/pkgs/applications/graphics/lutgen/default.nix
index 5b5af34cdc9..be93d964337 100644
--- a/pkgs/applications/graphics/lutgen/default.nix
+++ b/pkgs/applications/graphics/lutgen/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lutgen";
-  version = "0.8.3";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "ozwaldorf";
     repo = "lutgen-rs";
     rev = "v${version}";
-    hash = "sha256-9olBUPOi6ZQorgPxQX2lqZSlYjEPMwfhUF/Ze34v0nc=";
+    hash = "sha256-tKSPk0V11pnKFV4E08H4CUnjw9nAonTRI6W3mGipd9I=";
   };
 
-  cargoHash = "sha256-hMbrzjfLSawrm+GmtLx7sQ7atr1aV2RU9rJXgun6HR8=";
+  cargoHash = "sha256-DiorrgTH9lIdmaZL7451uCXj9X7M6eHf4MQc85MpU7s=";
 
   meta = with lib; {
     description = "A blazingly fast interpolated LUT generator and applicator for arbitrary and popular color palettes";
diff --git a/pkgs/applications/misc/llpp/default.nix b/pkgs/applications/misc/llpp/default.nix
index 427be603158..ba004e34384 100644
--- a/pkgs/applications/misc/llpp/default.nix
+++ b/pkgs/applications/misc/llpp/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
       url = "https://aur.archlinux.org/cgit/aur.git/plain/system-makedeps.patch?h=llpp&id=0d2913056aaf3dbf7431e57b7b08b55568ba076c";
       hash = "sha256-t9PLXsM8+exCeYqJBe0LSDK0D2rpktmozS8qNcEAcHo=";
     })
+    ./fix-mupdf.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/misc/llpp/fix-build-bash.patch b/pkgs/applications/misc/llpp/fix-build-bash.patch
deleted file mode 100644
index c12828f2d94..00000000000
--- a/pkgs/applications/misc/llpp/fix-build-bash.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-diff --git a/build.bash b/build.bash
-index 7c278b6..41494c5 100755
-with manual adjustments
---- a/build.bash
-+++ b/build.bash
-@@ -30,7 +30,6 @@ srcd="$(dirname $0)"
- mudir=$outd/mupdf
- muinc="-I $mudir/include -I $mudir/thirdparty/freetype/include"
- 
--test -d "$mudir" || die muPDF not found, consult $(dirname $0)/BUILDING
- 
- mkdir -p $outd/{$wsid,lablGL}
- :>$outd/ordered
-@@ -41,12 +40,6 @@ isfresh() { test -r "$1.past" && . "$1.past" && test "$k" = "$2"; }
- mulibst="$mudir/build/$mbt/libs"
- mulibs="$mudir/build/$mbt/libmupdf.a $mudir/build/$mbt/libmupdf-third.a"
- 
--keycmd="(cd $mudir && make -q build=$mbt libs && echo); digest $mulibs"
--isfresh "$mulibst" "$(eval $keycmd)" || (
--    make -C "$mudir" build=$mbt -j $mjobs libs
--    eval $keycmd >${mulibst}.past
--) && vecho "fresh mupdf"
--
- oincs() {
-     local i=
-     local incs1=
-@@ -100,35 +93,6 @@ mflags() {
- }
- 
- overs="$(ocamlc -vnum 2>/dev/null)" || overs=""
--test "$overs" = "4.11.1" || {
--    url=https://caml.inria.fr/pub/distrib/ocaml-4.11/ocaml-4.11.1.tar.xz
--    txz=$outd/$(basename $url)
--    keycmd="printf $url; digest $txz;"
--    isfresh $txz "$(eval $keycmd)" || {
--        executable_p() { command -v "$1" >/dev/null 2>&1; }
--        if executable_p wget; then dl() { wget -q "$1" -O "$2"; }
--        elif executable_p curl; then dl() { curl -L "$1" -o "$2"; }
--        else die "no program to fetch remote urls found"
--        fi
--        dl $url $txz
--        eval $keycmd >$txz.past
--    } && vecho "fresh $txz"
--    absprefix=$(cd $outd &>/dev/null; pwd -P)
--    export PATH=$absprefix/bin:$PATH
--    ocamlc=$absprefix/bin/ocamlc
--    keycmd="printf $url; digest $ocamlc;"
--    isfresh $ocamlc "$(eval $keycmd)" || (
--        tar xf $txz -C $outd
--        bn=$(basename $url)
--        cd $outd/${bn%.tar.xz}
--        ./configure --disable-ocamldoc --disable-ocamltest      \
--                    --enable-debugger=no --prefix=$absprefix
--        make -j $mjobs world
--        make install
--        eval $keycmd >$absprefix/bin/ocamlc.past
--    ) && vecho "fresh ocamlc"
--    overs=$(ocamlc -vnum 2>/dev/null)
--}
- 
- ccomp=${LLPP_CC-$(ocamlc -config | grep "^c_compiler: " | \
-                       { read _ c; echo $c; })}
-@@ -243,7 +208,7 @@ bobjc() {
-     } && vecho "fresh $o"
- }
- 
--ver=$(cd $srcd && git describe --tags --dirty) || ver=unknown
-+ver=@version@
- 
- cmd="(. $srcd/genconfstr.sh >$outd/confstruct.ml)"
- keycmd="digest $srcd/genconfstr.sh $outd/confstruct.ml"
-@@ -291,7 +256,7 @@ for m in ml_gl ml_glarray ml_raw; do
- done
- 
- libs="str.cma unix.cma"
--clibs="-L$mudir/build/$mbt -lmupdf -lmupdf-third -lpthread"
-+clibs="-lmupdf -lmupdf-third -lfreetype -lgumbo -ljpeg -lopenjp2 -ljbig2dec -llcms2 -lharfbuzz -lpthread -lz"
- if $darwin; then
-     mcomp=$(ocamlc -config | grep bytecomp_c_co | { read _ c; echo $c; })
-     clibs="$clibs -framework Cocoa -framework OpenGL"
diff --git a/pkgs/applications/misc/llpp/fix-mupdf.patch b/pkgs/applications/misc/llpp/fix-mupdf.patch
new file mode 100644
index 00000000000..1a3c2516fc1
--- /dev/null
+++ b/pkgs/applications/misc/llpp/fix-mupdf.patch
@@ -0,0 +1,13 @@
+--- a/link.c
++++ b/link.c
+@@ -1522,8 +1522,9 @@ static void *mainloop (void UNUSED_ATTR *unused)
+             if (pdf && nameddest && *nameddest) {
+                 fz_point xy;
+                 struct pagedim *pdim;
+-                int pageno = pdf_lookup_anchor (state.ctx, pdf, nameddest,
++                fz_location location = fz_resolve_link (state.ctx, state.doc, nameddest,
+                                                 &xy.x, &xy.y);
++                int pageno = location.page;
+                 pdim = pdimofpageno (pageno);
+                 xy = fz_transform_point (xy, pdim->ctm);
+                 printd ("a %d %d %d", pageno, (int) xy.x, (int) xy.y);
diff --git a/pkgs/applications/misc/merkaartor/default.nix b/pkgs/applications/misc/merkaartor/default.nix
index 9d474ca91f0..52b4d78bb5a 100644
--- a/pkgs/applications/misc/merkaartor/default.nix
+++ b/pkgs/applications/misc/merkaartor/default.nix
@@ -2,7 +2,8 @@
 , stdenv
 , fetchFromGitHub
 , fetchpatch
-, qmake
+, cmake
+, pkg-config
 , qttools
 , wrapQtAppsHook
 , gdal
@@ -32,9 +33,14 @@ stdenv.mkDerivation rec {
       url = "https://github.com/openstreetmap/merkaartor/commit/1e20d2ccd743ea5f8c2358e4ae36fead8b9390fd.patch";
       hash = "sha256-aHjJLKYvqz7V0QwUIg0SbentBe+DaCJusVqy4xRBVWo=";
     })
+    # https://github.com/openstreetmap/merkaartor/pull/290
+    (fetchpatch {
+      url = "https://github.com/openstreetmap/merkaartor/commit/7dede77370d89e8e7586f6ed5af225f9b5bde6cf.patch";
+      hash = "sha256-3oDRPysVNvA50t/b9xOcVQgac3U1lDPrencanl4c6Zk=";
+    })
   ];
 
-  nativeBuildInputs = [ qmake qttools wrapQtAppsHook ];
+  nativeBuildInputs = [ cmake pkg-config qttools wrapQtAppsHook ];
 
   buildInputs = [ gdal proj qtsvg qtwebengine ]
     ++ lib.optional withGeoimage exiv2
@@ -42,27 +48,25 @@ stdenv.mkDerivation rec {
     ++ lib.optional withLibproxy libproxy
     ++ lib.optional withZbar zbar;
 
-  preConfigure = ''
-    lrelease src/src.pro
-  '';
-
-  qmakeFlags = [
-    "USEWEBENGINE=1"
-  ] ++ lib.optional withGeoimage "GEOIMAGE=1"
-    ++ lib.optional withGpsdlib "GPSDLIB=1"
-    ++ lib.optional withLibproxy "LIBPROXY=1"
-    ++ lib.optional withZbar "ZBAR=1";
+  cmakeFlags = [
+    (lib.cmakeBool "GEOIMAGE" withGeoimage)
+    (lib.cmakeBool "GPSD" withGpsdlib)
+    (lib.cmakeBool "LIBPROXY" withLibproxy)
+    (lib.cmakeBool "WEBENGINE" true)
+    (lib.cmakeBool "ZBAR" withZbar)
+  ];
 
   postInstall = lib.optionalString stdenv.isDarwin ''
-    mkdir -p $out/Applications
-    mv binaries/bin/merkaartor.app $out/Applications
-    mv binaries/bin/plugins $out/Applications/merkaartor.app/Contents
+    mkdir -p $out/{Applications,bin}
+    mv $out/merkaartor.app $out/Applications
+    makeWrapper $out/{Applications/merkaartor.app/Contents/MacOS,bin}/merkaartor
   '';
 
   meta = with lib; {
     description = "OpenStreetMap editor";
     homepage = "http://merkaartor.be/";
     license = licenses.gpl2Plus;
+    mainProgram = "merkaartor";
     maintainers = with maintainers; [ sikmir ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/default.nix b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
index 821348794bb..47163c0aa8b 100644
--- a/pkgs/applications/networking/browsers/microsoft-edge/default.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
@@ -1,20 +1,20 @@
 {
   stable = import ./browser.nix {
     channel = "stable";
-    version = "117.0.2045.47";
+    version = "118.0.2088.46";
     revision = "1";
-    sha256 = "sha256-h4iw+H8f62JEih1tWTpjxNC9+wu3hHQOM2VJid1kHNQ=";
+    sha256 = "sha256-/3lo/y/LhAmGqiOhZgDoJVS+c2631NB/Z/lBNFunU30=";
   };
   beta = import ./browser.nix {
     channel = "beta";
-    version = "118.0.2088.17";
+    version = "118.0.2088.46";
     revision = "1";
-    sha256 = "sha256-3Z37M2ZQRJ5uA7NcinMlF1XEsYVv9A+ppPZZf34ye6Q=";
+    sha256 = "sha256-u0w7COYoAgcpqVEsB0t27iMD2AGVYFCJyE72uWKIY70=";
   };
   dev = import ./browser.nix {
     channel = "dev";
-    version = "119.0.2116.0";
+    version = "119.0.2151.2";
     revision = "1";
-    sha256 = "sha256-raLRFSHZyHaxKi6EG62VIbcW29HTjTnBFw7IJFVbm5I=";
+    sha256 = "sha256-42wbnA9i1FdBq14Y+xxstAe9ciWDzEBVMULCSURQzj0=";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/caprine-bin/default.nix b/pkgs/applications/networking/instant-messengers/caprine-bin/default.nix
index ed8fab4473c..73d13218501 100644
--- a/pkgs/applications/networking/instant-messengers/caprine-bin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/caprine-bin/default.nix
@@ -1,7 +1,7 @@
 { lib, callPackage, stdenvNoCC }:
 let
   pname = "caprine";
-  version = "2.58.3";
+  version = "2.59.1";
   metaCommon = with lib; {
     description = "An elegant Facebook Messenger desktop app";
     homepage = "https://sindresorhus.com/caprine";
@@ -10,11 +10,11 @@ let
   };
   x86_64-appimage = callPackage ./build-from-appimage.nix {
     inherit pname version metaCommon;
-    sha256 = "sha256-w0nBQhHYzFLsNu0MxWhoju6fh4JpAKC7MWWVxwDkRYk=";
+    sha256 = "sha256-stMv4KQoWPmK5jcfdhamC27Rb51zjbeEn40u6YUvXz4=";
   };
   x86_64-dmg = callPackage ./build-from-dmg.nix {
     inherit pname version metaCommon;
-    sha256 = "sha256-6Mx2ZkT2hdnaSVt2hKMMV9xc7rYPFFbxcj6vb84ojYU=";
+    sha256 = "sha256-WMT4yrLjDSMsI/lFbYODu3/0whcF+++4ShoChfMyLfQ=";
   };
 in
 (if stdenvNoCC.isDarwin then x86_64-dmg else x86_64-appimage).overrideAttrs (oldAttrs: {
diff --git a/pkgs/applications/networking/p2p/pyrosimple/default.nix b/pkgs/applications/networking/p2p/pyrosimple/default.nix
index 41eedcc1b44..9e3ce81e339 100644
--- a/pkgs/applications/networking/p2p/pyrosimple/default.nix
+++ b/pkgs/applications/networking/p2p/pyrosimple/default.nix
@@ -10,14 +10,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "pyrosimple";
-  version = "2.11.3";
+  version = "2.11.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "kannibalox";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-P12Tx9lEGp9OINL6vJIdyL3+pJbR/uaYe8k7v9kSz/A=";
+    hash = "sha256-jzLckRFdjivWcyM3NWSVBauT5/7A1jTICtK2j65Wojo=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/applications/science/biology/bowtie2/default.nix b/pkgs/applications/science/biology/bowtie2/default.nix
index 954b704be0c..e5c9c286422 100644
--- a/pkgs/applications/science/biology/bowtie2/default.nix
+++ b/pkgs/applications/science/biology/bowtie2/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bowtie2";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "BenLangmead";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HaiZmWU6akHXJVWBmCvkG2E61NDrAP7UIxx9DNCEZqE=";
+    sha256 = "sha256-Bem4SHY/74suZPDbw/rwKMLBn3bRq5ooHbBoVnKuYk0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/virtualization/lima/default.nix b/pkgs/applications/virtualization/lima/default.nix
index 9dc433c1716..b20bf2497fa 100644
--- a/pkgs/applications/virtualization/lima/default.nix
+++ b/pkgs/applications/virtualization/lima/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "lima";
-  version = "0.17.2";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "lima-vm";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0yWQhyDSDGZT6K/SeVntTdqnDzyGD244+r5kG1MFh1c=";
+    sha256 = "sha256-sOOpqgEvDBVvD/o1wFL3ebqWw0XpSdEqY8cZmtdXyxE=";
   };
 
-  vendorHash = "sha256-yA6qwnbRFR/V2Aaf53jLTejPKuNzbod2dVnLEQLoQkM=";
+  vendorHash = "sha256-vJlnptEja3nBfj/c1hSZjY9DZPQ970ZIMnHBPndd2vQ=";
 
   nativeBuildInputs = [ makeWrapper installShellFiles ]
     ++ lib.optionals stdenv.isDarwin [ xcbuild.xcrun sigtool ];
diff --git a/pkgs/by-name/co/codeium/package.nix b/pkgs/by-name/co/codeium/package.nix
new file mode 100644
index 00000000000..38ad126e5ce
--- /dev/null
+++ b/pkgs/by-name/co/codeium/package.nix
@@ -0,0 +1,69 @@
+{ stdenv, lib, fetchurl, gzip, autoPatchelfHook }:
+let
+
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "Unsupported system: ${system}";
+
+  plat = {
+    x86_64-linux = "linux_x64";
+    aarch64-linux = "linux_arm";
+    x86_64-darwin = "macos_x64";
+    aarch64-darwin = "macos_arm";
+
+  }.${system} or throwSystem;
+
+  hash = {
+    x86_64-linux = "sha256-9EGoJ5DoGgVfbhCDeTvn1D7misJEj9jPwuiOK7z95Ts=";
+    aarch64-linux = "sha256-lO0YOSiO8AUrkbV+3Uyvg6p3bdAcTze3La2g5IcK1f0=";
+    x86_64-darwin = "sha256-WjvC3pt8Gd4q+BzrOhyGeYwZIbv2m5O3pSXe1N7Najw=";
+    aarch64-darwin = "sha256-IRm5m/Jaf4pmAzx+MXwmHLejo6Gv2OL56R1IEr/NlZU=";
+  }.${system} or throwSystem;
+
+  bin = "$out/bin/codeium_language_server";
+
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "codeium";
+  version = "1.2.104";
+  src = fetchurl {
+    name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
+    url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";
+    inherit hash;
+  };
+
+  nativeBuildInputs = [ gzip ] ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    gzip -dc $src > ${bin}
+    chmod +x ${bin}
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = rec {
+    description = "Codeium language server";
+    longDescription = ''
+      Codeium proprietary language server, patched for Nix(OS) compatibility.
+      bin/language_server_x must be symlinked into the plugin directory, replacing the existing binary.
+      For example:
+      ```shell
+      ln -s "$(which codeium_language_server)" /home/a/.local/share/JetBrains/Rider2023.1/codeium/662505c9b23342478d971f66a530cd102ae35df7/language_server_linux_x64
+      ```
+    '';
+    homepage = "https://codeium.com/";
+    downloadPage = homepage;
+    changelog = homepage;
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ anpin ];
+    mainProgram = "codeium";
+    platforms = [ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/co/codeium/update.sh b/pkgs/by-name/co/codeium/update.sh
new file mode 100755
index 00000000000..268886b576a
--- /dev/null
+++ b/pkgs/by-name/co/codeium/update.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused gawk nix-prefetch jq
+
+set -euo pipefail
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+NIX_DRV="$ROOT/package.nix"
+if [ ! -f "$NIX_DRV" ]; then
+  echo "ERROR: cannot find package.nix in $ROOT"
+  exit 1
+fi
+
+fetch_arch() {
+  VER="$1"; ARCH="$2"
+  URL="https://github.com/Exafunction/codeium/releases/download/language-server-v${VER}/language_server_${ARCH}.gz"
+  nix-hash --to-sri --type sha256 "$(nix-prefetch-url --type sha256 "$URL")"
+}
+
+replace_hash() {
+  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
+}
+
+CODEIUM_VER=$(curl -s "https://api.github.com/repos/Exafunction/codeium/releases/latest" | jq -r .tag_name | grep -oP '\d+\.\d+\.\d+' )
+
+CODEIUM_LINUX_X64_HASH=$(fetch_arch "$CODEIUM_VER" "linux_x64")
+CODEIUM_LINUX_AARCH64_HASH=$(fetch_arch "$CODEIUM_VER" "linux_arm")
+CODEIUM_DARWIN_X64_HASH=$(fetch_arch "$CODEIUM_VER" "macos_x64")
+CODEIUM_DARWIN_AARCH64_HASH=$(fetch_arch "$CODEIUM_VER" "macos_arm")
+
+sed -i "s/version = \".*\"/version = \"$CODEIUM_VER\"/" "$NIX_DRV"
+
+replace_hash "x86_64-linux" "$CODEIUM_LINUX_X64_HASH"
+replace_hash "aarch64-linux" "$CODEIUM_LINUX_AARCH64_HASH"
+replace_hash "x86_64-darwin" "$CODEIUM_DARWIN_X64_HASH"
+replace_hash "aarch64-darwin" "$CODEIUM_DARWIN_AARCH64_HASH"
diff --git a/pkgs/by-name/gu/guile-lzlib/package.nix b/pkgs/by-name/gu/guile-lzlib/package.nix
new file mode 100644
index 00000000000..f60a03b6da9
--- /dev/null
+++ b/pkgs/by-name/gu/guile-lzlib/package.nix
@@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, fetchurl
+, autoreconfHook
+, guile
+, pkg-config
+, texinfo
+, lzlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "guile-lzlib";
+  version = "0.0.2";
+
+  src = fetchurl {
+    url = "https://notabug.org/guile-lzlib/guile-lzlib/archive/${version}.tar.gz";
+    hash = "sha256-hiPbd9RH57n/v8vCiDkOcGprGomxFx2u1gh0z+x+T4c=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ autoreconfHook guile pkg-config texinfo ];
+  propagatedBuildInputs = [ guile lzlib ];
+
+  makeFlags = [ "GUILE_AUTO_COMPILE=0" ];
+
+  # tests fail on darwin
+  doCheck = !stdenv.isDarwin;
+
+  meta = with lib; {
+    description = "A GNU Guile library providing bindings to lzlib";
+    homepage = "https://notabug.org/guile-lzlib/guile-lzlib";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ foo-dogsquared ];
+    platforms = guile.meta.platforms;
+  };
+}
diff --git a/pkgs/by-name/or/orchard/package.nix b/pkgs/by-name/or/orchard/package.nix
index 17220ed7929..a0aa3866535 100644
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "orchard";
-  version = "0.13.1";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = version;
-    hash = "sha256-b9AHsyMiR3gTXGRbmIUX9uSd7u3dFoUZ/CtKrYpuzno=";
+    hash = "sha256-u4aGjEkQ9H7caW2Y5ZbiGhCV47I0Afi5NC/apJB5qvU=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/by-name/ui/uiua/package.nix b/pkgs/by-name/ui/uiua/package.nix
index cb8137b38f5..cd44df2a01b 100644
--- a/pkgs/by-name/ui/uiua/package.nix
+++ b/pkgs/by-name/ui/uiua/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uiua";
-  version = "0.0.18";
+  version = "0.0.19";
 
   src = fetchFromGitHub {
     owner = "uiua-lang";
     repo = "uiua";
     rev = "refs/tags/${version}";
-    hash = "sha256-EXOBEvUAS0jCj9BAmy63dh0Dy30VOW0PBdsoa/2Jcx0=";
+    hash = "sha256-2DopXsYhEyD6JHEJgtiCGCzpcl/6nOQCDp0uHDCSEcs=";
   };
 
-  cargoHash = "sha256-8Cbks0oo8fgWj9Lxp0bwydYXkJD+fz3y+dZ7ne+RXdU=";
+  cargoHash = "sha256-WWIxXXuMbk7QqldJIxjWaaM946WGLuMl6mSw7Vc8LKo=";
 
   nativeBuildInputs = lib.optionals stdenv.isDarwin [
     rustPlatform.bindgenHook
diff --git a/pkgs/development/interpreters/erlang/24.nix b/pkgs/development/interpreters/erlang/24.nix
index da1ab11a524..c66d829433b 100644
--- a/pkgs/development/interpreters/erlang/24.nix
+++ b/pkgs/development/interpreters/erlang/24.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "24.3.4.13";
-  sha256 = "sha256-2+Fmj6qUJoutLXbexgPRpJbspnzuwSfu4OpyRd+7N3Y=";
+  version = "24.3.4.14";
+  sha256 = "sha256-+OEA7bVomZox/iHhkRQPt91WayyxZQDkDI92B5Ez24Q=";
 }
diff --git a/pkgs/development/interpreters/erlang/25.nix b/pkgs/development/interpreters/erlang/25.nix
index ee9a58c4e42..dc129ecdece 100644
--- a/pkgs/development/interpreters/erlang/25.nix
+++ b/pkgs/development/interpreters/erlang/25.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "25.3.2.6";
-  sha256 = "iImrVaoS5bajaZZQoZoG3VzWHFmWvId8xQPKLhl9iQo=";
+  version = "25.3.2.7";
+  sha256 = "sha256-JMHfnnvjAIrJ2YhSzk1qVeS7qGx2HDf2J+8+WFD5Bv8=";
 }
diff --git a/pkgs/development/interpreters/erlang/26.nix b/pkgs/development/interpreters/erlang/26.nix
index 5df6e999779..a0e55bad3c5 100644
--- a/pkgs/development/interpreters/erlang/26.nix
+++ b/pkgs/development/interpreters/erlang/26.nix
@@ -1,7 +1,6 @@
-{ lib, mkDerivation }:
+{ mkDerivation }:
 
 mkDerivation {
-  version = "26.1.1";
-  sha256 = "sha256-Y0sArUFkGxlAAgrgUxn5Rjnd72geG08VO9FBxg/fJAg=";
+  version = "26.1.2";
+  sha256 = "sha256-exLLdg7z/HKJI81w33vcQUDF6NG5n2WKtcYwdPxN+0A=";
 }
-
diff --git a/pkgs/development/libraries/quarto/default.nix b/pkgs/development/libraries/quarto/default.nix
index e87243fe8ef..47cfae64829 100644
--- a/pkgs/development/libraries/quarto/default.nix
+++ b/pkgs/development/libraries/quarto/default.nix
@@ -13,6 +13,7 @@
 , python3
 , quarto
 , extraPythonPackages ? ps: with ps; []
+, sysctl
 }:
 
 stdenv.mkDerivation (final: {
@@ -60,11 +61,13 @@ stdenv.mkDerivation (final: {
       mv bin/* $out/bin
       mv share/* $out/share
 
-      runHook preInstall
+      runHook postInstall
   '';
 
   passthru.tests = {
-    quarto-check = runCommand "quarto-check" {} ''
+    quarto-check = runCommand "quarto-check" {
+      nativeBuildInputs = lib.optionals stdenv.isDarwin [ sysctl ];
+    } ''
       export HOME="$(mktemp -d)"
       ${quarto}/bin/quarto check
       touch $out
@@ -81,7 +84,7 @@ stdenv.mkDerivation (final: {
     changelog = "https://github.com/quarto-dev/quarto-cli/releases/tag/v${version}";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ minijackson mrtarantoga ];
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.all;
     sourceProvenance = with sourceTypes; [ binaryNativeCode binaryBytecode ];
   };
 })
diff --git a/pkgs/development/python-modules/aiomqtt/default.nix b/pkgs/development/python-modules/aiomqtt/default.nix
index b4d39350ba4..c7d7b5dd7a9 100644
--- a/pkgs/development/python-modules/aiomqtt/default.nix
+++ b/pkgs/development/python-modules/aiomqtt/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aiomqtt";
-  version = "1.2.0";
+  version = "1.2.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "sbtinstruments";
     repo = "aiomqtt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WfHyCjNowtgTBADKeGyBBbO2JQ6YXJFvAtSq0iLzSbw=";
+    hash = "sha256-P8p21wjmFDvI0iobpQsWkKYleY4M0R3yod3/mJ7V+Og=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ansible/core.nix b/pkgs/development/python-modules/ansible/core.nix
index 633811c34c5..12002f4933c 100644
--- a/pkgs/development/python-modules/ansible/core.nix
+++ b/pkgs/development/python-modules/ansible/core.nix
@@ -28,11 +28,11 @@
 
 buildPythonPackage rec {
   pname = "ansible-core";
-  version = "2.15.4";
+  version = "2.15.5";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-waiq7emF955ZMrohY2OTeffYAlv9myg3jbFkmk71Qe0=";
+    hash = "sha256-jMU5y41DSa8//ZAccHIvenogOuZCfdrJX/31RqbkFgI=";
   };
 
   # ansible_connection is already wrapped, so don't pass it through
diff --git a/pkgs/development/python-modules/async-tkinter-loop/default.nix b/pkgs/development/python-modules/async-tkinter-loop/default.nix
index 2bc90494ccf..d376ec15426 100644
--- a/pkgs/development/python-modules/async-tkinter-loop/default.nix
+++ b/pkgs/development/python-modules/async-tkinter-loop/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "async-tkinter-loop";
-  version = "0.9.1";
+  version = "0.9.2";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "async_tkinter_loop";
-    hash = "sha256-Phxx9RovjU5JOonMt7Zhum0/BGRS5OLRAkLTl4L/BW4=";
+    hash = "sha256-YwmW+zXAx9TAxgoRLEr7/3o1rrO4eSNScuoTh3ud2Vo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-eventgrid/default.nix b/pkgs/development/python-modules/azure-eventgrid/default.nix
index 56d27d60d26..07914459837 100644
--- a/pkgs/development/python-modules/azure-eventgrid/default.nix
+++ b/pkgs/development/python-modules/azure-eventgrid/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "azure-eventgrid";
-  version = "4.14.0";
+  version = "4.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Nati9XRCNJgt/cmhj2t1l+oijsR6SC1UVZ35VANd0l8=";
+    hash = "sha256-hVPCQgVu5NkEMJBJcfaER8JGtjnIEWquIcBX6vFSiAc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-redhatopenshift/default.nix b/pkgs/development/python-modules/azure-mgmt-redhatopenshift/default.nix
index 385d55248ec..fd6fe1b3e65 100644
--- a/pkgs/development/python-modules/azure-mgmt-redhatopenshift/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-redhatopenshift/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-redhatopenshift";
-  version = "1.3.0";
+  version = "1.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LOJldUyWdVShpN8lD8zGdFeYFiKSmODk3WNOP1fJfcs=";
+    hash = "sha256-BL2a2L2AwJWvs0V+VpSGaS8//AWMy5m6rdAPDJPbrEo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 369d722b2e3..fd8984a1e50 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -363,12 +363,12 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.28.58";
+  version = "1.28.63";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LQxPd+RhC/W6z2/BNuyqQmaATi4APVHQf8F2dI21OQc=";
+    hash = "sha256-7PT7K1txvlLPyXDuBZ/hdDntGQTQOVUI9VRcOA1NlR0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index a00a32db490..b329214a743 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.31.62";
+  version = "1.31.63";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-LOVV5d/y6R/CK9ZxBlNL8+BZO4ONh/iknTuOh/qDpEA=";
+    hash = "sha256-hzcVpcIdD0WTYoOTx45Hz5TlOkPkCGOp718WX83PkA8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/btrees/default.nix b/pkgs/development/python-modules/btrees/default.nix
index 308bba80b31..930ede2cd12 100644
--- a/pkgs/development/python-modules/btrees/default.nix
+++ b/pkgs/development/python-modules/btrees/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "btrees";
-  version = "5.0";
+  version = "5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "BTrees";
     inherit version;
-    hash = "sha256-/d+KTcwCU+OQJ7qzgKLiDUeuNwoySFQW8qZq2a4aQ/o=";
+    hash = "sha256-raDzHpMloEeV0dJOAn7ZsrZdpNZqz/i4eVWzUo1/w2k=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bytecode/default.nix b/pkgs/development/python-modules/bytecode/default.nix
index 95b28f4190f..4df83b9e45d 100644
--- a/pkgs/development/python-modules/bytecode/default.nix
+++ b/pkgs/development/python-modules/bytecode/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "bytecode";
-  version = "0.15.0";
+  version = "0.15.1";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "vstinner";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-A8S3U07P4Olq9f7/q20aHOPAQsQp3OuGHtIAs8B8VEQ=";
+    hash = "sha256-Jzsh0m00SiJjTP7hXMDmuR4XHmsCYdURuFDkVopGyIE=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/clickgen/default.nix b/pkgs/development/python-modules/clickgen/default.nix
index 026acd33caa..e9296435e05 100644
--- a/pkgs/development/python-modules/clickgen/default.nix
+++ b/pkgs/development/python-modules/clickgen/default.nix
@@ -3,18 +3,17 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, attrs
 , pillow
-, pyyaml
 , toml
 , numpy
+, pyyaml
 , python
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "clickgen";
-  version = "2.1.8";
+  version = "2.1.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -23,29 +22,19 @@ buildPythonPackage rec {
     owner = "ful1e5";
     repo = "clickgen";
     rev = "refs/tags/v${version}";
-    hash = "sha256-74nOqaRZXLOSF4sjydAbF3sRMrw+21+fYDs3hiVSszA=";
+    hash = "sha256-mSaltlX2eNRLJ09zN5Tim8mW8mnjPi10W4QIEpiBQvI=";
   };
 
-  propagatedBuildInputs = [
-    attrs
-    numpy
-    pillow
-    pyyaml
-    toml
-  ];
+  propagatedBuildInputs = [ pillow toml numpy pyyaml ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   postInstall = ''
     # Copying scripts directory needed by clickgen script at $out/bin/
     cp -R src/clickgen/scripts $out/${python.sitePackages}/clickgen/scripts
   '';
 
-  pythonImportsCheck = [
-    "clickgen"
-  ];
+  pythonImportsCheck = [ "clickgen" ];
 
   meta = with lib; {
     homepage = "https://github.com/ful1e5/clickgen";
diff --git a/pkgs/development/python-modules/crc/default.nix b/pkgs/development/python-modules/crc/default.nix
index eee1f058366..47c2da0f850 100644
--- a/pkgs/development/python-modules/crc/default.nix
+++ b/pkgs/development/python-modules/crc/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "crc";
-  version = "4.3.0";
+  version = "5.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Nicoretti";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-rH/jc6/gxww3NSCYrhu+InZX1HTTdJFfa52ioU8AclY=";
+    hash = "sha256-+C4cUKXZCpAXil8X4gTK3AhqNVWDrBQYY2Kgkd3+gqc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django-simple-captcha/default.nix b/pkgs/development/python-modules/django-simple-captcha/default.nix
index 0f505b21d3d..4b61d523a5a 100644
--- a/pkgs/development/python-modules/django-simple-captcha/default.nix
+++ b/pkgs/development/python-modules/django-simple-captcha/default.nix
@@ -12,11 +12,11 @@
 
 buildPythonPackage rec {
   pname = "django-simple-captcha";
-  version = "0.5.18";
+  version = "0.5.20";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bh/MT0AF99ae56Llmn6GO105GPNqhaTYEUmJhK7MSM4=";
+    hash = "sha256-ICcwCae+tEKX6fbHpr0hraPS+pPDFNL2v145TO62opc=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/elasticsearch8/default.nix b/pkgs/development/python-modules/elasticsearch8/default.nix
index 5df9db98fab..3ab17cb180d 100644
--- a/pkgs/development/python-modules/elasticsearch8/default.nix
+++ b/pkgs/development/python-modules/elasticsearch8/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch8";
-  version = "8.10.0";
+  version = "8.10.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Wb2l0FL7rm9Ck7HSWs9PmPyeShn9Hd9fCKnh/jWVy3o=";
+    hash = "sha256-naLy7xSqHlz8QNbQhM+iydJi8m6DQqBWlDLijOOT7ak=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/gocardless-pro/default.nix b/pkgs/development/python-modules/gocardless-pro/default.nix
index c81a9e2aa6f..06e22f0a9cf 100644
--- a/pkgs/development/python-modules/gocardless-pro/default.nix
+++ b/pkgs/development/python-modules/gocardless-pro/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "gocardless-pro";
-  version = "1.46.0";
+  version = "1.47.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "gocardless";
     repo = "gocardless-pro-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tfaV/pohDu7IIzDa9B3GpnzOs6U+MVoFM3YZ0ErC7zQ=";
+    hash = "sha256-YCHI4MvdTlpDavXTTU4AESBUOBKt23IPxvGI+BGo2EI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gsd/default.nix b/pkgs/development/python-modules/gsd/default.nix
index 922a892be59..3040102f877 100644
--- a/pkgs/development/python-modules/gsd/default.nix
+++ b/pkgs/development/python-modules/gsd/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "gsd";
-  version = "3.1.1";
+  version = "3.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "glotzerlab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-YeMdBELr5kfymVUEE8+cqGLgOPBqbbD+vh1e9XbRLB8=";
+    hash = "sha256-ceoHHEX44DrVgatV2EIS6gT9oVZkAx6OTFMZG/x4q64=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/hdfs/default.nix b/pkgs/development/python-modules/hdfs/default.nix
index 45bd4faf446..9b9268c13ea 100644
--- a/pkgs/development/python-modules/hdfs/default.nix
+++ b/pkgs/development/python-modules/hdfs/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "hdfs";
-  version = "2.7.2";
+  version = "2.7.3";
 
   src = fetchFromGitHub {
     owner = "mtth";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-KXJDQEc4+T9r8sB41SOgcx8Gth3qAOZceoOpsLbJ+ak=";
+    hash = "sha256-Pm2E8hB0wbu7npi/sLt9D8jQsH69qNOHLji9CYqST/8=";
   };
 
   propagatedBuildInputs = [ docopt requests six ];
diff --git a/pkgs/development/python-modules/imap-tools/default.nix b/pkgs/development/python-modules/imap-tools/default.nix
index a93b13f8180..94f2257cc12 100644
--- a/pkgs/development/python-modules/imap-tools/default.nix
+++ b/pkgs/development/python-modules/imap-tools/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "imap-tools";
-  version = "1.3.0";
+  version = "1.4.0";
 
   disabled = pythonOlder "3.5";
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "ikvk";
     repo = "imap_tools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dlCPJQDkHW4zNIHwhyKkgk+rI2t+Xn+Fbf3xJPRtaiY=";
+    hash = "sha256-bTYfAXc/2bRj8TBd9mmg0EGjUcUu6aiZXl8MF0+1xcs=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index 1e75776f0c3..ee707875bff 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -8,7 +8,7 @@
 , tiktoken
 }:
 let
-  version = "0.1.590";
+  version = "0.1.738";
 in
 buildPythonPackage rec {
   pname = "litellm";
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "BerriAI";
     repo = "litellm";
-    rev = "7cb96e86b4753008cbf8d116aca514750e98d360";
-    hash = "sha256-ITMcwGjelNfNGnfBmmdu0Xwph4u0mxiFSfHnysUxWCQ=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-1Ft2E5I3OkVZUfmQHN1Qe/Z3cvLid8ie3BCeZoAii8U=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pynina/default.nix b/pkgs/development/python-modules/pynina/default.nix
index acdb8f0b14c..73e611d0f50 100644
--- a/pkgs/development/python-modules/pynina/default.nix
+++ b/pkgs/development/python-modules/pynina/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "pynina";
-  version = "0.3.2";
+  version = "0.3.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "PyNINA";
     inherit version;
-    hash = "sha256-uiNUkNL/3FGGhqctE9AZNdSD4o7jTk829GAT5Gy2Xeo=";
+    hash = "sha256-6HJ78tKl6If/ezwOrGl3VEYO4eMh/6cZq2j2AMBr0I8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/screenlogicpy/default.nix b/pkgs/development/python-modules/screenlogicpy/default.nix
index fef2b05f9e8..e7eca13d730 100644
--- a/pkgs/development/python-modules/screenlogicpy/default.nix
+++ b/pkgs/development/python-modules/screenlogicpy/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "screenlogicpy";
-  version = "0.9.1";
+  version = "0.9.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "dieselrabbit";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-bBdOaAr9VH7UeY/UdeKS9oOevJwW2HChJiTGCNbbikM=";
+    hash = "sha256-0qB+FWqlh5qdy/jKLPYCXl3DewurLSOlYgcdiDtzeYE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix b/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
index 8b9a108d3db..f32c5b138ab 100644
--- a/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
@@ -7,17 +7,17 @@
 
 buildGoModule rec {
   pname = "forgejo-actions-runner";
-  version = "2.4.0";
+  version = "3.0.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-EEwXo2MvdBlSMho4rrYD4wXLccS/30NbCuxO0CUktgE=";
+    hash = "sha256-idA74R6kbI7Bk0XvT7BOyctT0IKymsJoFCWgYrtZstU=";
   };
 
-  vendorHash = "sha256-FspNmiphGHSeZFmdlWIDsEUrCc8THfb0Wm67cMCTtHI=";
+  vendorHash = "sha256-HE//SD/doMf42y2KF10JAuUe86hpFhCUM61da2NC5CE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/lurk/default.nix b/pkgs/development/tools/lurk/default.nix
index cdfb4f0d5db..b7ab1f95dea 100644
--- a/pkgs/development/tools/lurk/default.nix
+++ b/pkgs/development/tools/lurk/default.nix
@@ -1,38 +1,20 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
-, fetchpatch
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "lurk";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "jakwai01";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-D/wJAmlc6OUuD8kSfGevG+UoPKy58X0lObL7mjiBG+c=";
+    hash = "sha256-7Yi77IsP/tmzrTvBVgIj2+fOXYKCT59pILeEuGuk4Y4=";
   };
 
-  cargoHash = "sha256-PFR6jMAvEybT/XOfLrv21F8ZxSX0BZDiEFtgQL5fL18=";
-
-  cargoPatches = [
-    # update the version to 0.3.3
-    (fetchpatch {
-      name = "chore-prepare-release.patch";
-      url = "https://github.com/JakWai01/lurk/commit/cb4355674159255ac4186283a93de294de057d1b.patch";
-      hash = "sha256-N+/8AGEToEqhkQ6BYGQP279foZbt6DzUBmAUaHm9hW4=";
-    })
-  ];
-
-  patches = [
-    (fetchpatch {
-      name = "fix-tests.patch";
-      url = "https://github.com/JakWai01/lurk/commit/87eb4aa8bf9a551b24cec2146699cb2c22d62019.patch";
-      hash = "sha256-m44m1338VODX+HGEVMLozKfVvXsQxvLIpo28VBK//vM=";
-    })
-  ];
+  cargoHash = "sha256-Cvtg9msoYkIIlaUw4hxWy2wSrE1uORR/2R2Geq4SI4w=";
 
   meta = with lib; {
     description = "A simple and pretty alternative to strace";
diff --git a/pkgs/development/tools/rust/cargo-wasi/default.nix b/pkgs/development/tools/rust/cargo-wasi/default.nix
index cbc1e419459..7fcdf761ad2 100644
--- a/pkgs/development/tools/rust/cargo-wasi/default.nix
+++ b/pkgs/development/tools/rust/cargo-wasi/default.nix
@@ -9,15 +9,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-wasi";
-  version = "0.1.27";
+  version = "0.1.28";
 
   src = fetchCrate {
     inherit version;
     pname = "cargo-wasi-src";
-    sha256 = "sha256-u6+Fn/j2cvpBqTIfyPC8jltcCKGimFcu4NiMFCAfmwg=";
+    sha256 = "sha256-fmQ23BtcBUPNcgZgvNq85iqdY6WRUhqwAp4aIobqMIw=";
   };
 
-  cargoHash = "sha256-Hi5Z5TmiHXp7YrqXfbwACKEximksQRhdoMGU1iLmXOk=";
+  cargoHash = "sha256-yXtxznUp2gECq2CvRByiFzbTjYtWvTheDjGoynJWb+o=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
 
   # Checks need to be disabled here because the current test suite makes assumptions
   # about the surrounding environment that aren't Nix friendly. See these lines for specifics:
-  # https://github.com/bytecodealliance/cargo-wasi/blob/0.1.27/tests/tests/support.rs#L13-L18
+  # https://github.com/bytecodealliance/cargo-wasi/blob/0.1.28/tests/tests/support.rs#L13-L18
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/servers/monitoring/mackerel-agent/default.nix b/pkgs/servers/monitoring/mackerel-agent/default.nix
index ba061dbd93c..47237a3eeb1 100644
--- a/pkgs/servers/monitoring/mackerel-agent/default.nix
+++ b/pkgs/servers/monitoring/mackerel-agent/default.nix
@@ -2,20 +2,20 @@
 
 buildGoModule rec {
   pname = "mackerel-agent";
-  version = "0.77.1";
+  version = "0.78.0";
 
   src = fetchFromGitHub {
     owner = "mackerelio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-BPLAAl4V3LN0I+ReiQX3hJcgdZZ6/7lLfBdwl9HzTHc=";
+    sha256 = "sha256-L8kYbJ9RmCoec9keBHv61K94rjnH+Q4dRkn6PCtjgJI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
   nativeCheckInputs = lib.optionals (!stdenv.isDarwin) [ nettools ];
   buildInputs = lib.optionals (!stdenv.isDarwin) [ iproute2 ];
 
-  vendorHash = "sha256-K+T6DxOvVotvTZE8WhWZ0v/T6UqJ5N6xxsdJrr8DQt4=";
+  vendorHash = "sha256-A3e6qd6yjKsNUaXiltbS9G4WEMd3F1FxaxqMMVuBCUI=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/servers/monitoring/prometheus/zfs-exporter.nix b/pkgs/servers/monitoring/prometheus/zfs-exporter.nix
index 49854d0960e..3e5ec75a292 100644
--- a/pkgs/servers/monitoring/prometheus/zfs-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/zfs-exporter.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "zfs_exporter";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "pdf";
     repo = pname;
     rev = "v" + version;
-    hash = "sha256-EM7CHvpqPwCKgb5QU+jYmMaovHp12hJD1zVxcYygHdU=";
+    hash = "sha256-JpLrCkPg0vVR0bKKHY5qf1/OD+O7yvWxS7kb7Yg3+c4=";
   };
 
-  vendorHash = "sha256-AgZo+5gYJ2EaxSI+Jxl7ldu6iZ+uSncYR0n+D2mMC4w=";
+  vendorHash = "sha256-uIilESEmAxANxFOy7qvYxlF/bId/Kqh4jUspNknlhlc=";
 
   postInstall = ''
     install -Dm444 -t $out/share/doc/${pname} *.md
diff --git a/pkgs/servers/monitoring/uptime-kuma/default.nix b/pkgs/servers/monitoring/uptime-kuma/default.nix
index 2bebed16c73..917343ffecd 100644
--- a/pkgs/servers/monitoring/uptime-kuma/default.nix
+++ b/pkgs/servers/monitoring/uptime-kuma/default.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "uptime-kuma";
-  version = "1.23.2";
+  version = "1.23.3";
 
   src = fetchFromGitHub {
     owner = "louislam";
     repo = "uptime-kuma";
     rev = version;
-    hash = "sha256-AJAnWMJDIPbZyVcz6lGMSIq/EuwL2xgj9+4jySNzUb8=";
+    hash = "sha256-YffkCFws/61uX6BwYqTeuAq5vqLOC+FeUt6rtQG6xws=";
   };
 
-  npmDepsHash = "sha256-ABVCpJH0cS8zPNdPLlNVgAKYd1zSinS3rLJHj4hiMEY=";
+  npmDepsHash = "sha256-USyLvC6ior1YhiZz6YySaG7xiYziHB01SHC9BPwuvJo=";
 
   patches = [
     # Fixes the permissions of the database being not set correctly
diff --git a/pkgs/tools/admin/aws-sso-cli/default.nix b/pkgs/tools/admin/aws-sso-cli/default.nix
index 94d993bd2c6..034f88ec732 100644
--- a/pkgs/tools/admin/aws-sso-cli/default.nix
+++ b/pkgs/tools/admin/aws-sso-cli/default.nix
@@ -6,15 +6,15 @@
 }:
 buildGoModule rec {
   pname = "aws-sso-cli";
-  version = "1.13.1";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "synfinatic";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-QwixApaGUzTmvc9TfFk8bdMU7dxyaeUo5aWucV4tH1c=";
+    hash = "sha256-4LgTAoPly551vzZ8StF01+zpBGAO7fpcyq3IrSrDhlg=";
   };
-  vendorHash = "sha256-/6DCrjOqjbz+olRp7rs8ui4uUrcor0zAc0yOIz+ZcEo=";
+  vendorHash = "sha256-YZ9/eqKZ0PDHZL6f3J7Obfq34Xk3swU/gGwzWJ2QsKs=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/misc/boxxy/default.nix b/pkgs/tools/misc/boxxy/default.nix
index 8bf9ed26a73..27e38475978 100644
--- a/pkgs/tools/misc/boxxy/default.nix
+++ b/pkgs/tools/misc/boxxy/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "boxxy";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "queer";
     repo = "boxxy";
     rev = "v${version}";
-    hash = "sha256-I7VQfLCD+nfFllbns7yjYMl9hNwM8AgUbiHte4vMciM=";
+    hash = "sha256-vggerp66ALH7aqC6daH1a82ajJg5ZmEZTqC98IHhzFU=";
   };
 
-  cargoHash = "sha256-xtyiJZ9jPP2M0pUpMwQlUa9QgsRhFLqEm+hE3K4WO88=";
+  cargoHash = "sha256-nKuxeVFCc4Etl5x5vgpCXbU7WkLVaL9wRCVSWhffPzU=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/misc/pkgtop/default.nix b/pkgs/tools/misc/pkgtop/default.nix
index 1d2f0c048f2..464e22724c7 100644
--- a/pkgs/tools/misc/pkgtop/default.nix
+++ b/pkgs/tools/misc/pkgtop/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "pkgtop";
-  version = "2.4.1";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "pkgtop";
     rev = version;
-    hash = "sha256-Skk7Zur2UMxNjrJmcp+FvUuNvbh9HmzuZ5mWcvhxcKk=";
+    hash = "sha256-NY8nx4BKAUq1nGBlzRzm2OH1k01TV6qs2IcoErhuxTc=";
   };
 
   vendorHash = "sha256-dlDbNym7CNn5088znMNgGAr2wBM3+nYv3q362353aLs=";
diff --git a/pkgs/tools/misc/yt-dlp/default.nix b/pkgs/tools/misc/yt-dlp/default.nix
index 00fee804206..c39832be656 100644
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@@ -22,11 +22,11 @@ buildPythonPackage rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2023.10.7";
+  version = "2023.10.13";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/IZlepskDPZf7z/2J+Sg3jNeclk2/nDUQCxx3ZdFLzY=";
+    hash = "sha256-4CbqHENf827vEhW8TFu4xHmTi5AFSZe6mfY6RUH+Y7Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/networking/xh/default.nix b/pkgs/tools/networking/xh/default.nix
index 06cda849002..c4dc973a81d 100644
--- a/pkgs/tools/networking/xh/default.nix
+++ b/pkgs/tools/networking/xh/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xh";
-  version = "0.18.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "ducaale";
     repo = "xh";
     rev = "v${version}";
-    sha256 = "sha256-2qZ+FGc8Y8HLJaQluVv036NG77lvaqsc3I5cmkD+r/M=";
+    sha256 = "sha256-R15l73ApQ5apZsJ9+wLuse50nqZObTLurt0pXu5p5BE=";
   };
 
-  cargoSha256 = "sha256-0lPEZ8Th3PAw6AEnb+ciKMhi5wysFCvYwiHd9/o8VVc=";
+  cargoSha256 = "sha256-GGn5cNOIgCBl4uEIYxw5CIgd6uPHkid9MHnLCpuNX7I=";
 
   buildFeatures = lib.optional withNativeTls "native-tls";
 
diff --git a/pkgs/tools/text/xml/xq/default.nix b/pkgs/tools/text/xml/xq/default.nix
index 9c6db5bd5fe..84dc36511bb 100644
--- a/pkgs/tools/text/xml/xq/default.nix
+++ b/pkgs/tools/text/xml/xq/default.nix
@@ -2,21 +2,21 @@
 , buildGoModule
 , fetchFromGitHub
 , testers
-, xq
+, xq-xml
 }:
 
 buildGoModule rec {
   pname = "xq";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "sibprogrammer";
     repo = "xq";
     rev = "v${version}";
-    hash = "sha256-Z14x1b25wKNm9fECkNqGJglK/Z8Xq8VHmYfp5aEvvMU=";
+    hash = "sha256-bhJ8zMZQZn/VzhulkfGOW+uyS8E43TIREAvKIsEPonA=";
   };
 
-  vendorHash = "sha256-CP4QsrTkFcOLDxnFc0apevXRmXHA9aJSU4AK9+TAxOU=";
+  vendorHash = "sha256-iJ1JMvIJqXLkZXuzn2rzKnLbiagTocg/6mJN3Pgd/4w=";
 
   ldflags = [
     "-s"
@@ -27,7 +27,7 @@ buildGoModule rec {
 
   passthru.tests = {
     version = testers.testVersion {
-      package = xq;
+      package = xq-xml;
     };
   };