Merge staging-next into staging

59 files changed, 489 insertions, 96 deletions

diff --git a/pkgs/applications/audio/ft2-clone/default.nix b/pkgs/applications/audio/ft2-clone/default.nix
index be3845be656..50993b056a8 100644
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ft2-clone";
-  version = "1.72.1";
+  version = "1.73";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${version}";
-    hash = "sha256-dGoldr0JvXri4XfSn/DKeJw/wsBaj+AKoKWdbEgo8lg=";
+    hash = "sha256-f5deXMSyZIDKPO7hsNONes/kTFLFodx4nuEjZzkR5Aw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/audio/pt2-clone/default.nix b/pkgs/applications/audio/pt2-clone/default.nix
index 940a281a1ce..276fdbf32e2 100644
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.64";
+  version = "1.65.1";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "sha256-b/1YksgXKXi6Tyntd03yWKZAAjvmG4HxsVYLVXoiMaA=";
+    sha256 = "sha256-0bZGiulLeAZ8bR0lj0Bm7te3T3YhxSOBFgMgWADRkIY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/misc/visidata/default.nix b/pkgs/applications/misc/visidata/default.nix
index 7eaef8b202e..93062a7c9a5 100644
--- a/pkgs/applications/misc/visidata/default.nix
+++ b/pkgs/applications/misc/visidata/default.nix
@@ -45,13 +45,13 @@
 }:
 buildPythonApplication rec {
   pname = "visidata";
-  version = "2.11";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "saulpw";
     repo = "visidata";
     rev = "v${version}";
-    hash = "sha256-G/9paJFJsRfIxMJ2hbuVS7pxCfSUCK69DNV2DHi60qA=";
+    hash = "sha256-A8iYFdW30Em5pjGn3DRpaV0A7ixwfSzmIp8AgtPkBCI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/science/biology/mmseqs2/default.nix b/pkgs/applications/science/biology/mmseqs2/default.nix
index 253f4a43a81..3e39fcb2918 100644
--- a/pkgs/applications/science/biology/mmseqs2/default.nix
+++ b/pkgs/applications/science/biology/mmseqs2/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mmseqs2";
-  version = "14-7e284";
+  version = "15-6f452";
 
   src = fetchFromGitHub {
     owner = "soedinglab";
     repo = pname;
     rev = version;
-    sha256 = "sha256-pVryZGblgMEqJl5M20CHxav269yGY6Y4ci+Gxt6SHOU=";
+    sha256 = "sha256-L+zOWrGkCLz/wqpBuji8H4/93sDFpcfnDOE8FHq1j84=";
   };
 
   nativeBuildInputs = [ cmake xxd perl installShellFiles ];
diff --git a/pkgs/applications/science/math/sage/sage-src.nix b/pkgs/applications/science/math/sage/sage-src.nix
index 8064a965bd1..97754c04d95 100644
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@@ -104,11 +104,11 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-GqMgoi0tsP7zcCcPumhdsbvhPB6fgw1ufx6gHlc6iSc=";
     })
 
-    # https://github.com/sagemath/sage/pull/36006, positively reviewed
+    # https://github.com/sagemath/sage/pull/36006, landed in 10.2.beta2
     (fetchpatch {
       name = "gmp-6.3-upgrade.patch";
-      url = "https://github.com/sagemath/sage/commit/d88bc3815c0901bfdeaa3e4a31107c084199f614.diff";
-      sha256 = "sha256-dXaEwk2wXxmx02sCw4Vu9mF0ZrydhFD4LRwNAiQsPgM=";
+      url = "https://github.com/sagemath/sage/commit/5e841de46c3baa99cd1145b36ff9163e9340a55c.diff";
+      sha256 = "sha256-fJPDryLtGBQz9qHDiCkBwjiW2lN6v7HiHgxY7CTeHcs=";
     })
 
     # https://github.com/sagemath/sage/pull/36279, landed in 10.2.beta4
@@ -117,6 +117,20 @@ stdenv.mkDerivation rec {
        url = "https://github.com/sagemath/sage/commit/0fcf88935908440930c5f79202155aca4ad57518.diff";
        sha256 = "sha256-mvqAHaTCXsxPv901L8HSTnrfghfXYdq0wfLoP/cYQZI=";
     })
+
+    # https://github.com/sagemath/sage/pull/35658, landed in 10.1.beta2
+    (fetchpatch {
+      name = "sphinx-7-upgrade.patch";
+      url = "https://github.com/sagemath/sage/commit/cacd9a89b5c4fdcf84a8dd2b7d5bdc10cc78109a.diff";
+      sha256 = "sha256-qJvliTJjR3XBc5pH6Q0jtm8c4bhtZcTcF3O04Ro1uaU=";
+    })
+
+    # https://github.com/sagemath/sage/pull/36296, landed in 10.2.beta4
+    (fetchpatch {
+      name = "duplicate-args-region_plot.patch";
+      url = "https://github.com/sagemath/sage/commit/461727b453712550a2c5dc0ae11933523255aaed.diff";
+      sha256 = "sha256-mC8084VQoUBk4hocALF+Y9Cwb38Zt360eldi/SSjna8=";
+    })
   ];
 
   patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
diff --git a/pkgs/applications/video/mkvtoolnix/default.nix b/pkgs/applications/video/mkvtoolnix/default.nix
index 70ed0976f7e..96c4113f4bf 100644
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@@ -46,13 +46,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mkvtoolnix";
-  version = "79.0";
+  version = "80.0";
 
   src = fetchFromGitLab {
     owner = "mbunkus";
     repo = "mkvtoolnix";
     rev = "release-${version}";
-    sha256 = "sha256-M+CST7A/obfuGH4lyV68vrhmzEIFCa7DRgApKbPh/uQ=";
+    hash = "sha256-/RqTfnxivghViFryCvj5RXSBziztb1Drb7tT89cGZ3o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ci/circom/package.nix b/pkgs/by-name/ci/circom/package.nix
new file mode 100644
index 00000000000..6d74c5e268e
--- /dev/null
+++ b/pkgs/by-name/ci/circom/package.nix
@@ -0,0 +1,27 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "circom";
+  version = "2.1.6";
+
+  src = fetchFromGitHub {
+    owner = "iden3";
+    repo = "circom";
+    rev = "v${version}";
+    hash = "sha256-2YusBWAYDrTvFHYIjKpALphhmtsec7jjKHb1sc9lt3Q=";
+  };
+
+  cargoHash = "sha256-G6z+DxIhmm1Kzv8EQCqvfGAhQn5Vrx9LXrl+bWBVKaM=";
+  doCheck = false;
+
+  meta = with lib; {
+    description = "zkSnark circuit compiler";
+    homepage = "https://github.com/iden3/circom";
+    changelog = "https://github.com/iden3/circom/blob/${src.rev}/RELEASES.md";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/by-name/li/libaribcaption/package.nix b/pkgs/by-name/li/libaribcaption/package.nix
new file mode 100644
index 00000000000..7d39841ec6f
--- /dev/null
+++ b/pkgs/by-name/li/libaribcaption/package.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+
+, fontconfig
+, freetype
+
+, ApplicationServices
+, CoreFoundation
+, CoreGraphics
+, CoreText
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libaribcaption";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "xqq";
+    repo = "libaribcaption";
+    rev = "v${version}";
+    hash = "sha256-x6l0ZrTktSsqfDLVRXpQtUOruhfc8RF3yT991UVZiKA=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
+
+  buildInputs = lib.optionals (!stdenv.isDarwin) [
+    fontconfig
+    freetype
+  ] ++ lib.optionals stdenv.isDarwin [
+    ApplicationServices
+    CoreFoundation
+    CoreGraphics
+    CoreText
+  ];
+
+  meta = with lib; {
+    description = "Portable ARIB STD-B24 Caption Decoder/Renderer";
+    homepage = "https://github.com/xqq/libaribcaption";
+    changelog = "https://github.com/xqq/libaribcaption/releases/tag/${src.rev}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ chayleaf ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/zp/zpix-pixel-font/package.nix b/pkgs/by-name/zp/zpix-pixel-font/package.nix
new file mode 100644
index 00000000000..6a785c9d8fa
--- /dev/null
+++ b/pkgs/by-name/zp/zpix-pixel-font/package.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "zpix-pixel-font";
+  version = "3.1.8";
+
+  srcs = [
+    (fetchurl {
+      name = "zpix-pixel-font.bdf";
+      url = "https://github.com/SolidZORO/zpix-pixel-font/releases/download/v${version}/zpix.bdf";
+      hash = "sha256-qE6YPKuk1FRRrTvmy4YIDuxRfslma264piUDj1FWtk4=";
+    })
+    (fetchurl {
+      name = "zpix-pixel-font.ttf";
+      url = "https://github.com/SolidZORO/zpix-pixel-font/releases/download/v${version}/zpix.ttf";
+      hash = "sha256-UIgLGsVTbyhYMKfTYiA+MZmV4dFT9HX3sxTdrcc4vE0=";
+    })
+  ];
+
+  dontUnpack = true;
+  __structuredAttrs = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm444 ''${srcs[0]} $out/share/fonts/misc/zpix.bdf
+    install -Dm444 ''${srcs[1]} $out/share/fonts/truetype/zpix.ttf
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A pixel font supporting multiple languages like English, Chinese and Japanese";
+    homepage = "https://github.com/SolidZORO/zpix-pixel-font/";
+    changelog = "https://github.com/SolidZORO/zpix-pixel-font/blob/master/CHANGELOG.md";
+    license = licenses.unfree;
+    maintainers = [ maintainers.adriangl ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/compilers/llvm/12/openmp/default.nix b/pkgs/development/compilers/llvm/12/openmp/default.nix
index e0bcf03e00e..6040f3d1621 100644
--- a/pkgs/development/compilers/llvm/12/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/12/openmp/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , llvm_meta
 , fetch
+, fetchpatch
 , cmake
 , llvm
 , targetLlvm
@@ -15,6 +16,16 @@ stdenv.mkDerivation rec {
 
   src = fetch pname "14dh0r6h2xh747ffgnsl4z08h0ri04azi9vf79cbz7ma1r27kzk0";
 
+  patches = [
+    # Fix cross.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5e2358c781b85a18d1463fd924d2741d4ae5e42e.patch";
+      hash = "sha256-UxIlAifXnexF/MaraPW0Ut6q+sf3e7y1fMdEv1q103A=";
+    })
+  ];
+
+  patchFlags = [ "-p2" ];
+
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [
     (if stdenv.buildPlatform == stdenv.hostPlatform then llvm else targetLlvm)
diff --git a/pkgs/development/compilers/llvm/13/openmp/default.nix b/pkgs/development/compilers/llvm/13/openmp/default.nix
index 8eca980d601..7b461df438f 100644
--- a/pkgs/development/compilers/llvm/13/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/13/openmp/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , llvm_meta
 , src
+, fetchpatch
 , cmake
 , llvm
 , targetLlvm
@@ -16,6 +17,16 @@ stdenv.mkDerivation rec {
   inherit src;
   sourceRoot = "${src.name}/${pname}";
 
+  patches = [
+    # Fix cross.
+    (fetchpatch {
+      url = "https://github.com/llvm/llvm-project/commit/5e2358c781b85a18d1463fd924d2741d4ae5e42e.patch";
+      hash = "sha256-UxIlAifXnexF/MaraPW0Ut6q+sf3e7y1fMdEv1q103A=";
+    })
+  ];
+
+  patchFlags = [ "-p2" ];
+
   nativeBuildInputs = [ cmake perl ];
   buildInputs = [
     (if stdenv.buildPlatform == stdenv.hostPlatform then llvm else targetLlvm)
diff --git a/pkgs/development/coq-modules/VST/default.nix b/pkgs/development/coq-modules/VST/default.nix
index 72d88dec6f1..150148cfe00 100644
--- a/pkgs/development/coq-modules/VST/default.nix
+++ b/pkgs/development/coq-modules/VST/default.nix
@@ -23,11 +23,12 @@ mkCoqDerivation {
   repo = "VST";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.15" "8.16"; out = "2.11.1"; }
+    { case = range "8.15" "8.17"; out = "2.12"; }
     { case = range "8.14" "8.16"; out = "2.10"; }
     { case = range "8.13" "8.15"; out = "2.9"; }
     { case = range "8.12" "8.13"; out = "2.8"; }
   ] null;
+  release."2.12".sha256 = "sha256-4HL0U4HA5/usKNXC0Dis1UZY/Hb/LRd2IGOrqrvdWkw=";
   release."2.11.1".sha256 = "sha256-unpNstZBnRT4dIqAYOv9n1J0tWJMeRuaaa2RG1U0Xs0=";
   release."2.10".sha256 = "sha256-RIxfPWoHnV1CFkpxCusoGY/LIk07TgC7wWGRP4BSq8w=";
   release."2.9".sha256 = "sha256:1adwzbl1pprrrwrm7cm493098fizxanxpv7nyfbvwdhgbhcnv6qf";
@@ -39,7 +40,7 @@ mkCoqDerivation {
   preConfigure = ''
     patchShebangs util
     substituteInPlace Makefile \
-      --replace 'COQVERSION= ' 'COQVERSION= 8.16.1 or-else 8.16.0 or-else 8.15.2 or-else 8.15.1 or-else '\
+      --replace 'COQVERSION= ' 'COQVERSION= 8.17.1 or-else 8.16.1 or-else 8.16.0 or-else 8.15.2 or-else 8.15.1 or-else '\
       --replace 'FLOYD_FILES=' 'FLOYD_FILES= ${toString extra_floyd_files}'
   '';
 
diff --git a/pkgs/development/libraries/gspell/default.nix b/pkgs/development/libraries/gspell/default.nix
index fa7eb93fe0c..c4d15352020 100644
--- a/pkgs/development/libraries/gspell/default.nix
+++ b/pkgs/development/libraries/gspell/default.nix
@@ -46,6 +46,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gtk3
     icu
+    vala # for share/vala/Makefile.vapigen (PKG_CONFIG_VAPIGEN_VAPIGEN)
   ];
 
   propagatedBuildInputs = [
@@ -56,6 +57,9 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "GLIB_COMPILE_RESOURCES=${lib.getDev buildPackages.glib}/bin/glib-compile-resources"
     "GLIB_MKENUMS=${lib.getDev buildPackages.glib}/bin/glib-mkenums"
+    "PKG_CONFIG_VAPIGEN_VAPIGEN=${lib.getBin buildPackages.vala}/bin/vapigen"
+    "--enable-introspection=yes"
+    "--enable-vala=yes"
   ];
 
   passthru = {
diff --git a/pkgs/development/libraries/gvfs/default.nix b/pkgs/development/libraries/gvfs/default.nix
index 7fd4572e0b7..b88daae22db 100644
--- a/pkgs/development/libraries/gvfs/default.nix
+++ b/pkgs/development/libraries/gvfs/default.nix
@@ -5,6 +5,7 @@
 , meson
 , ninja
 , pkg-config
+, substituteAll
 , gettext
 , dbus
 , glib
@@ -53,12 +54,9 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    # Hardcode the ssh path again.
-    # https://gitlab.gnome.org/GNOME/gvfs/-/issues/465
-    (fetchpatch2 {
-      url = "https://gitlab.gnome.org/GNOME/gvfs/-/commit/8327383e262e1e7f32750a8a2d3dd708195b0f53.patch";
-      hash = "sha256-ReD7qkezGeiJHyo9jTqEQNBjECqGhV9nSD+dYYGZWJ8=";
-      revert = true;
+    (substituteAll {
+      src = ./hardcode-ssh-path.patch;
+      ssh_program = "${lib.getBin openssh}/bin/ssh";
     })
   ];
 
@@ -76,7 +74,6 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     wrapGAppsHook
-    libxml2
     libxslt
     docbook_xsl
     docbook_xml_dtd_42
@@ -92,7 +89,7 @@ stdenv.mkDerivation rec {
     libimobiledevice
     libbluray
     libnfs
-    openssh
+    libxml2
     gsettings-desktop-schemas
     libsoup_3
   ] ++ lib.optionals udevSupport [
diff --git a/pkgs/development/libraries/gvfs/hardcode-ssh-path.patch b/pkgs/development/libraries/gvfs/hardcode-ssh-path.patch
new file mode 100644
index 00000000000..aaf8e291aa8
--- /dev/null
+++ b/pkgs/development/libraries/gvfs/hardcode-ssh-path.patch
@@ -0,0 +1,13 @@
+diff --git a/daemon/meson.build b/daemon/meson.build
+index 72a16890..718944e1 100644
+--- a/daemon/meson.build
++++ b/daemon/meson.build
+@@ -256,7 +256,7 @@ if enable_sftp
+     '-DDEFAULT_BACKEND_TYPE=sftp',
+     '-DBACKEND_TYPES="sftp", G_VFS_TYPE_BACKEND_SFTP,',
+     '-DMAX_JOB_THREADS=1',
+-    '-DSSH_PROGRAM="ssh"',
++    '-DSSH_PROGRAM="@ssh_program@"',
+   ]
+
+   programs += {'gvfsd-sftp': {'sources': sources, 'dependencies': deps, 'c_args': cflags}}
diff --git a/pkgs/development/libraries/lief/default.nix b/pkgs/development/libraries/lief/default.nix
index 44f82f15852..4b691ba3d88 100644
--- a/pkgs/development/libraries/lief/default.nix
+++ b/pkgs/development/libraries/lief/default.nix
@@ -33,14 +33,16 @@ stdenv.mkDerivation rec {
     python
   ];
 
+  env.CXXFLAGS = toString (lib.optional stdenv.isDarwin [ "-faligned-allocation" "-fno-aligned-new" "-fvisibility=hidden" ]);
+
   postBuild = ''
-    pushd /build/source/api/python
+    pushd ../api/python
     ${pyEnv.interpreter} setup.py build --parallel=$NIX_BUILD_CORES
     popd
   '';
 
   postInstall = ''
-    pushd /build/source/api/python
+    pushd ../api/python
     ${pyEnv.interpreter} setup.py install --skip-build --root=/ --prefix=$py
     popd
   '';
diff --git a/pkgs/development/libraries/mvapich/default.nix b/pkgs/development/libraries/mvapich/default.nix
index 9c5046415e6..2182c408337 100644
--- a/pkgs/development/libraries/mvapich/default.nix
+++ b/pkgs/development/libraries/mvapich/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     "FFLAGS=-fallow-argument-mismatch" # fix build with gfortran 10
   ] ++ optional useSlurm "--with-pm=slurm"
     ++ optional (network == "ethernet") "--with-device=ch3:sock"
-    ++ optionals (network == "infiniband") [ "--with-device=ch3:mrail" "--with-rdma=gen2" ]
+    ++ optionals (network == "infiniband") [ "--with-device=ch3:mrail" "--with-rdma=gen2" "--disable-ibv-dlopen" ]
     ++ optionals (network == "omnipath") ["--with-device=ch3:psm" "--with-psm2=${libpsm2}"];
 
   doCheck = true;
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     # /tmp/nix-build... ends up in the RPATH, fix it manually
     for entry in $out/bin/mpichversion $out/bin/mpivars; do
       echo "fix rpath: $entry"
-      patchelf --set-rpath "$out/lib" $entry
+      patchelf --allowed-rpath-prefixes ${builtins.storeDir} --shrink-rpath $entry
     done
 
     # Ensure the default compilers are the ones mvapich was built with
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index 6629f618a2e..987e31b9ed5 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -9,6 +9,7 @@
 , gst_all_1
 , libglvnd
 , darwin
+, overrideSDK
 , buildPackages
 , python3
 
@@ -141,13 +142,18 @@ let
       qtwebchannel = callPackage ./modules/qtwebchannel.nix { };
       qtwebengine = callPackage ./modules/qtwebengine.nix {
         inherit (darwin) bootstrap_cmds cctools xnu;
-        inherit (darwin.apple_sdk_11_0) libpm libunwind llvmPackages_14;
+        inherit (darwin.apple_sdk_11_0) libpm libunwind;
         inherit (darwin.apple_sdk_11_0.libs) sandbox;
         inherit (darwin.apple_sdk_11_0.frameworks)
           AGL AVFoundation Accelerate Cocoa CoreLocation CoreML ForceFeedback
           GameController ImageCaptureCore LocalAuthentication
           MediaAccessibility MediaPlayer MetalKit Network OpenDirectory Quartz
           ReplayKit SecurityInterface Vision;
+        qtModule = qtModule.override {
+          stdenv = if stdenv.isDarwin
+            then overrideSDK stdenv { darwinMinVersion = "10.13"; darwinSdkVersion = "11.0"; }
+            else stdenv;
+        };
         xcbuild = buildPackages.xcbuild.override {
           productBuildVer = "20A2408";
         };
diff --git a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
index 8670fba6bb2..4b4172897e0 100644
--- a/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtwebengine.nix
@@ -60,7 +60,6 @@
 , mesa
 , enableProprietaryCodecs ? true
   # darwin
-, llvmPackages_14
 , bootstrap_cmds
 , cctools
 , xcbuild
@@ -106,7 +105,6 @@ qtModule {
     gn
     nodejs
   ] ++ lib.optionals stdenv.isDarwin [
-    llvmPackages_14.clang
     bootstrap_cmds
     cctools
     xcbuild
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index a62031c079d..4b301548b43 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.74";
+  version = "9.2.75";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-lZJLYIZ44FXGavDCrO90DYSl4yaNDpAYeIIihk5Bk14=";
+    hash = "sha256-k3CX0ntqbKBL9xLTPifwjTqwYEDLlNdEHlIPiokkkPA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioelectricitymaps/default.nix b/pkgs/development/python-modules/aioelectricitymaps/default.nix
index 502363de13c..8aca66a80b4 100644
--- a/pkgs/development/python-modules/aioelectricitymaps/default.nix
+++ b/pkgs/development/python-modules/aioelectricitymaps/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aioelectricitymaps";
-  version = "0.1.3";
+  version = "0.1.4";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "jpbede";
     repo = "aioelectricitymaps";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2Ou3obpGRJ/iUPuaoBGlmDTJLx6+S8ivK9PbrbSvYyg=";
+    hash = "sha256-Whg3F4Oyfqn2Lod44e15Pxc3m0dEB2F+MK0bvEM7c7w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index de5d1184b2b..ca577acc283 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "18.2.0";
+  version = "18.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-uOF9VSASzGA4pVW3puQtGrr2dy7sRESa1a6DPUsMmL4=";
+    hash = "sha256-PW3/V4PTm+UxTsfSSvOEX+FGcuF4m+mDOz6Z/AzB2qk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index a4bd117d8e6..5b142f2be1e 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.74";
+  version = "9.2.75";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "angr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8t7S+VR9AqYpaAP772Wn1foVy/XN9MiEUZb5+u47G+k=";
+    hash = "sha256-tDOO0wn5gYxK1CuMWhu/i4Xk3CfcuhPvxsG0LI7BlA4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 1e059d7c82b..14fea5e4835 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.74";
+  version = "9.2.75";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-n/51N1D5UI2FTKv7GBN/iPYE/+/o/2JnFTRee+1FVWg=";
+    hash = "sha256-t8kxGwLEVVp1WMFA+yFLMAPJBT46m0ZFG2lhWMxoolw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/asana/default.nix b/pkgs/development/python-modules/asana/default.nix
index f3b6787dd66..87a996a4552 100644
--- a/pkgs/development/python-modules/asana/default.nix
+++ b/pkgs/development/python-modules/asana/default.nix
@@ -6,6 +6,7 @@
 , requests
 , requests-oauthlib
 , responses
+, six
 }:
 
 buildPythonPackage rec {
@@ -25,6 +26,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     requests
     requests-oauthlib
+    six
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 14e6cbd811f..8907b8b8ac2 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.74";
+  version = "9.2.75";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "claripy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-TNnv2V8QtSA5oiCHVqIuvbgGNTjfIw4WS1K2MxXfJIw=";
+    hash = "sha256-ErPk93hDKV1QyGOjxYNaLzNuq6Od374G8qOxWiJwpuo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 6dbaac73b6b..3f4e7addb77 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,14 +16,14 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.74";
+  version = "9.2.75";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
     owner = "angr";
     repo = "binaries";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KaHAgGPspFGFPNULfXcVwXpl5RdkKHAQV/coJeMSGLQ=";
+    hash = "sha256-xiYkXC3/JPgXJ23ISl0LVrdm368hDPCG5NqQM6lDXf4=";
   };
 
 in
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "cle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-e13tsrLAZu67eyUvBYtfkBASEsxdcVwJmKCHBiU78Dg=";
+    hash = "sha256-F2kgEffFWK7i1BgU5ulsNJitGcGcEziYRU+y86wKgXU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cohere/default.nix b/pkgs/development/python-modules/cohere/default.nix
index 0966ba8ae28..36e7a274468 100644
--- a/pkgs/development/python-modules/cohere/default.nix
+++ b/pkgs/development/python-modules/cohere/default.nix
@@ -9,18 +9,19 @@
 , fastavro
 , importlib-metadata
 , requests
+, urllib3
 }:
 
 buildPythonPackage rec {
   pname = "cohere";
-  version = "4.26.1";
+  version = "4.32";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kiU5VooOWhqnjdhSHAIGV+D4pm9Qupz2oo0TZz9ASY8=";
+    hash = "sha256-OAd0e+mE8hHc6RHBM1vXE68qwrcPcpZ4OB5v9uRQ5oE=";
   };
 
   patches = [
@@ -42,6 +43,7 @@ buildPythonPackage rec {
     fastavro
     importlib-metadata
     requests
+    urllib3
   ];
 
   # tests require CO_API_KEY
diff --git a/pkgs/development/python-modules/db-dtypes/default.nix b/pkgs/development/python-modules/db-dtypes/default.nix
index d3fc32ab01d..a7fbfd1b378 100644
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , numpy
 , packaging
 , pandas
@@ -23,6 +24,21 @@ buildPythonPackage rec {
     hash = "sha256-OAVHx/a4uupVGXSWN2/3uem9/4i+TUkzTX4kp0uLY44=";
   };
 
+  patches = [
+    # on master branch, to be released as 1.1.2
+    (fetchpatch {
+      name = "xfail-tests-that-are-known-to-fail.patch";
+      url = "https://github.com/googleapis/python-db-dtypes-pandas/commit/4a56b766b0ccba900a555167863f1081a76c4c0d.patch";
+      hash = "sha256-ra1d8Vewvwhkr7PBHc3KM6IUCWsHxE+B7UP2duTgjew=";
+    })
+    # on master branch, to be released as 1.1.2
+    (fetchpatch {
+      name = "add-import-and-object-reference-due-to-upstream-changes.patch";
+      url = "https://github.com/googleapis/python-db-dtypes-pandas/commit/8a7b25f3e708df5cd32afcb702fe16130846b165.patch";
+      hash = "sha256-JVbhiOIr5gKMSQpIQ+DgIRqq8V5x5ClQhkQzAmIYqEU=";
+    })
+  ];
+
   propagatedBuildInputs = [
     numpy
     packaging
diff --git a/pkgs/development/python-modules/diff-cover/default.nix b/pkgs/development/python-modules/diff-cover/default.nix
index 6990105b757..bab6cd3f6c7 100644
--- a/pkgs/development/python-modules/diff-cover/default.nix
+++ b/pkgs/development/python-modules/diff-cover/default.nix
@@ -3,7 +3,7 @@
 , chardet
 , fetchPypi
 , jinja2
-, jinja2_pluralize
+, jinja2-pluralize
 , pluggy
 , pycodestyle
 , pyflakes
@@ -32,7 +32,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     chardet
     jinja2
-    jinja2_pluralize
+    jinja2-pluralize
     pluggy
     pygments
     tomli
diff --git a/pkgs/development/python-modules/google-cloud-translate/default.nix b/pkgs/development/python-modules/google-cloud-translate/default.nix
index 0dcee5eea4e..bc5ab67b018 100644
--- a/pkgs/development/python-modules/google-cloud-translate/default.nix
+++ b/pkgs/development/python-modules/google-cloud-translate/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-translate";
-  version = "3.12.0";
+  version = "3.12.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-l0I8HDv2FBAvHUJ4F1oDxSPltKzWSLAKNAfQIwKqzNk=";
+    hash = "sha256-Zhy4h5qjxjovclo+po+QGZvTVMlcoWnMLoOlEFmH0p4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/jinja2_pluralize/default.nix b/pkgs/development/python-modules/jinja2-pluralize/default.nix
index db196403822..2187c1a2414 100644
--- a/pkgs/development/python-modules/jinja2_pluralize/default.nix
+++ b/pkgs/development/python-modules/jinja2-pluralize/default.nix
@@ -1,12 +1,19 @@
-{ lib, buildPythonPackage, fetchPypi, jinja2, inflect }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, jinja2
+, inflect
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
-  pname = "jinja2_pluralize";
+  pname = "jinja2-pluralize";
   version = "0.3.0";
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "071wnzzz20wjb0iw7grxgj1lb2f0kz50qyfbcq54rddr2x82sp6z";
+    pname = "jinja2_pluralize";
+    inherit version;
+    hash = "sha256-31wtUBe5tUwKZst5DMqfwIlFg3w9v8MjWJID8f+3PBw=";
   };
 
   propagatedBuildInputs = [
@@ -14,6 +21,14 @@ buildPythonPackage rec {
     inflect
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "jinja2_pluralize"
+  ];
+
   meta = with lib; {
     description = "Jinja2 pluralize filters";
     homepage = "https://github.com/audreyr/jinja2_pluralize";
diff --git a/pkgs/development/python-modules/localstack/default.nix b/pkgs/development/python-modules/localstack/default.nix
index e44f6e609d2..03af7530a26 100644
--- a/pkgs/development/python-modules/localstack/default.nix
+++ b/pkgs/development/python-modules/localstack/default.nix
@@ -20,13 +20,13 @@
 
 buildPythonPackage rec {
   pname = "localstack";
-  version = "2.3.0";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "localstack";
     repo = "localstack";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Sdyl/ccyhKRP5eb866ly1ZJrrFSQMLdX22R7UNRfDCA=";
+    hash = "sha256-8HrPnMmzoxgAhu3Qm18FBJ3kNoGOD7bGmI1t7tcETwM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index b41e21c83e0..63a5a15e259 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "lxmf";
-  version = "0.3.6";
+  version = "0.3.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "lxmf";
     rev = "refs/tags/${version}";
-    hash = "sha256-s5+hfn/NfuL7B5c1LElZ10B+O5xr98D0eBYfLhPt6uU=";
+    hash = "sha256-iiGxAIHZcq3VaSSmGrB16IutJf8JEAeFkvZsEuIbR3g=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/nomadnet/default.nix b/pkgs/development/python-modules/nomadnet/default.nix
index 62af8da7eb6..150b323d0f2 100644
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "nomadnet";
-  version = "0.4.0";
+  version = "0.4.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "NomadNet";
     rev = "refs/tags/${version}";
-    hash = "sha256-xXVur2ibctRCfQ1zKnPeLrNoukTmFT8exTbm2ukByYY=";
+    hash = "sha256-+UWHYhPX54Jc9gnrb2Az5Nc3/kt42/wa+zhUnCWdVU4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/praw/default.nix b/pkgs/development/python-modules/praw/default.nix
index 0ce6027c1bf..0243ef1bd1b 100644
--- a/pkgs/development/python-modules/praw/default.nix
+++ b/pkgs/development/python-modules/praw/default.nix
@@ -42,6 +42,11 @@ buildPythonPackage rec {
     requests-toolbelt
   ];
 
+  disabledTestPaths = [
+    # tests requiring network
+    "tests/integration"
+  ];
+
   pythonImportsCheck = [
     "praw"
   ];
diff --git a/pkgs/development/python-modules/prawcore/default.nix b/pkgs/development/python-modules/prawcore/default.nix
index 9a8ecea7b3c..6231ff2b812 100644
--- a/pkgs/development/python-modules/prawcore/default.nix
+++ b/pkgs/development/python-modules/prawcore/default.nix
@@ -45,6 +45,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTestPaths = [
+    # tests requiring network
+    "tests/integration"
+  ];
+
   pythonImportsCheck = [
     "prawcore"
   ];
diff --git a/pkgs/development/python-modules/pyftpdlib/default.nix b/pkgs/development/python-modules/pyftpdlib/default.nix
index f40dc187124..2ada48a2be0 100644
--- a/pkgs/development/python-modules/pyftpdlib/default.nix
+++ b/pkgs/development/python-modules/pyftpdlib/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pyftpdlib";
-  version = "1.5.8";
+  version = "1.5.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-v22rtn3/MrP/BA4oJf/7xrjecDc7ydm1U0gMxNdQTWw=";
+    hash = "sha256-Mj1MQvFAau203xj69oD2TzLAgP9m9sJgkLpZL1v8Sg8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index db2d65450f8..c19e16cae96 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.74";
+  version = "9.2.75";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-49Vcm6JkIpOm+U1Q/BrTi8jiEWZdaNs77TaCMjOLpyw=";
+    hash = "sha256-8P8xOb4P1JsbPZya8s1Bl16VsYtHQdAD05sc8EAcEpM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/reolink-aio/default.nix b/pkgs/development/python-modules/reolink-aio/default.nix
index 93492852d02..f773c33307a 100644
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "reolink-aio";
-  version = "0.7.11";
+  version = "0.7.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "starkillerOG";
     repo = "reolink_aio";
     rev = "refs/tags/${version}";
-    hash = "sha256-SPmLzTJQNDaQ6AofIET7eZkxJxxfJ00/wNpInXo0u2I=";
+    hash = "sha256-molHdZ51irWEE3OHywP5n0bCClK8z67JGiYRwvHAOxs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 031c44ebb2e..83980ecdcd0 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.6.2";
+  version = "0.6.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "Reticulum";
     rev = "refs/tags/${version}";
-    hash = "sha256-Z3vFQB6/z3dWtYikN02QviG+0aDRzt8kk6IOpl/VmF0=";
+    hash = "sha256-3pcQsSUBHlgHKuZt5kb4ozvIujP6dsaYMab/+fri4a4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/selenium/default.nix b/pkgs/development/python-modules/selenium/default.nix
index fdb052a4749..086c5310897 100644
--- a/pkgs/development/python-modules/selenium/default.nix
+++ b/pkgs/development/python-modules/selenium/default.nix
@@ -8,12 +8,15 @@
 , trio
 , trio-websocket
 , urllib3
+, pytest-trio
 , nixosTests
+, stdenv
+, python
 }:
 
 buildPythonPackage rec {
   pname = "selenium";
-  version = "4.12.0";
+  version = "4.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,18 +26,30 @@ buildPythonPackage rec {
     repo = "selenium";
     # check if there is a newer tag with or without -python suffix
     rev = "refs/tags/selenium-${version}";
-    hash = "sha256-A2lI40bPSIri/0yp6C3aJZBX5p6ON1fWGfJTcul9/2o=";
+    hash = "sha256-cTMCKfFLUlJDbTUQA3Z/pKCE1RQQRMb4K8hKKn9HqvU=";
   };
 
-  postPatch = ''
-    substituteInPlace py/selenium/webdriver/firefox/service.py \
-      --replace 'DEFAULT_EXECUTABLE_PATH = "geckodriver"' 'DEFAULT_EXECUTABLE_PATH = "${geckodriver}/bin/geckodriver"'
-  '';
-
   preConfigure = ''
     cd py
   '';
 
+  postInstall = ''
+    DST_PREFIX=$out/lib/${python.libPrefix}/site-packages/selenium/webdriver/
+    DST_REMOTE=$DST_PREFIX/remote/
+    DST_FF=$DST_PREFIX/firefox
+    cp ../rb/lib/selenium/webdriver/atoms/getAttribute.js $DST_REMOTE
+    cp ../rb/lib/selenium/webdriver/atoms/isDisplayed.js $DST_REMOTE
+    cp ../rb/lib/selenium/webdriver/atoms/findElements.js $DST_REMOTE
+    cp ../javascript/cdp-support/mutation-listener.js $DST_REMOTE
+    cp ../third_party/js/selenium/webdriver.json $DST_FF/webdriver_prefs.json
+  '' + lib.optionalString stdenv.isDarwin ''
+    mkdir -p $DST_PREFIX/common/macos
+    cp ../common/manager/macos/selenium-manager $DST_PREFIX/common/macos
+  '' + lib.optionalString stdenv.isLinux ''
+    mkdir -p $DST_PREFIX/common/linux/
+    cp ../common/manager/linux/selenium-manager $DST_PREFIX/common/linux/
+  '';
+
   propagatedBuildInputs = [
     certifi
     trio
@@ -44,6 +59,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    pytest-trio
   ];
 
   passthru.tests = {
diff --git a/pkgs/development/python-modules/sqlite-migrate/default.nix b/pkgs/development/python-modules/sqlite-migrate/default.nix
new file mode 100644
index 00000000000..b19d3e590f5
--- /dev/null
+++ b/pkgs/development/python-modules/sqlite-migrate/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, sqlite-utils
+}:
+
+buildPythonPackage rec {
+  pname = "sqlite-migrate";
+  version = "0.1a2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-wztAqe3TW0SQ4JX1XPWeA4KNJci5c3fNih97cmlPwRE=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    sqlite-utils
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "sqlite_migrate"
+  ];
+
+  meta = with lib; {
+    description = "A simple database migration system for SQLite, based on sqlite-utils";
+    homepage = "https://github.com/simonw/sqlite-migrate";
+    changelog = "https://github.com/simonw/sqlite-migrate/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ aldoborrero ];
+  };
+}
diff --git a/pkgs/development/python-modules/yattag/default.nix b/pkgs/development/python-modules/yattag/default.nix
index 9fd5e993ec9..c66f85cc158 100644
--- a/pkgs/development/python-modules/yattag/default.nix
+++ b/pkgs/development/python-modules/yattag/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "yattag";
-  version = "1.15.1";
+  version = "1.15.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lg+lS+EinZb0MXgTPgsZXAAzkf3Ens22tptzdNtr5BY=";
+    hash = "sha256-qtn1QL0i3FA+W1UGzEeFb6zwgapx/TX3JzcbY+HkAr8=";
   };
 
   pythonImportsCheck = [
diff --git a/pkgs/os-specific/linux/nct6687d/default.nix b/pkgs/os-specific/linux/nct6687d/default.nix
new file mode 100644
index 00000000000..493d0e6af10
--- /dev/null
+++ b/pkgs/os-specific/linux/nct6687d/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nct6687d";
+  version = "unstable-2023-09-22";
+
+  src = fetchFromGitHub {
+    owner = "Fred78290";
+    repo = "nct6687d";
+    rev = "cdfe855342a9383a9c4c918d51576c36d989070d";
+    hash = "sha256-iOLWxj4I6oYkNXFSkmw7meTQEnrIfb4Mw+/LkzgzDxM=";
+  };
+
+  setSourceRoot = ''
+    export sourceRoot=$(pwd)/source
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "-C" "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(sourceRoot)"
+  ];
+
+  buildFlags = [ "modules" ];
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  meta = with lib; {
+    description = "Kernel module for the Nuvoton NCT6687-R chipset found on many B550/B650 motherboards from ASUS and MSI";
+    license = with licenses; [ gpl2Only ];
+    homepage = "https://github.com/Fred78290/nct6687d/";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ atemu ];
+  };
+}
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index a7985b474ed..dd3dcfd6f3a 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -323,8 +323,27 @@ rec {
           then sdk.frameworks."${framework}"
           else replacePropagatedFrameworks pkg;
 
+      mapRuntimeToSDK = pkg:
+        # Only remap xcbuild for now, which exports the SDK used to build it.
+        if pkg != null && lib.getName pkg == "xcodebuild"
+          then pkg.override { stdenv = overrideSDK stdenv { inherit darwinMinVersion darwinSdkVersion; }; }
+          else pkg;
+
       mapInputsToSDK = inputs: args:
-        lib.genAttrs inputs (input: map mapPackageToSDK (args."${input}" or [ ]));
+        let
+          runsAtBuild = lib.flip lib.elem [
+            "depsBuildBuild"
+            "depsBuildBuildPropagated"
+            "nativeBuildInputs"
+            "propagatedNativeBuildInputs"
+            "depsBuildTarget"
+            "depsBuildTargetPropagated"
+          ];
+          atBuildInputs = lib.filter runsAtBuild inputs;
+          atRuntimeInputs = lib.subtractLists atBuildInputs inputs;
+        in
+        lib.genAttrs atRuntimeInputs (input: map mapPackageToSDK (args."${input}" or [ ]))
+        // lib.genAttrs atBuildInputs (input: map mapRuntimeToSDK (args."${input}" or [ ]));
 
       mkCC = cc: cc.override {
         bintools = cc.bintools.override { libc = sdk.Libsystem; };
@@ -343,6 +362,8 @@ rec {
       extraBuildInputs = [sdk.frameworks.CoreFoundation ];
       mkDerivationFromStdenv = extendMkDerivationArgs old (mapInputsToSDK [
         "buildInputs"
+        "nativeBuildInputs"
+        "propagatedNativeBuildInputs"
       ]);
     });
 }
diff --git a/pkgs/tools/filesystems/9pfs/default.nix b/pkgs/tools/filesystems/9pfs/default.nix
index abb8f695ebc..7b652bd68aa 100644
--- a/pkgs/tools/filesystems/9pfs/default.nix
+++ b/pkgs/tools/filesystems/9pfs/default.nix
@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-ywWG/H2ilt36mjlDSgIzYpardCFXpmbLiml6wy47XuA=";
   };
 
+  postPatch = ''
+    substituteInPlace Makefile --replace "pkg-config" "$PKG_CONFIG"
+  '';
+
   makeFlags = [ "BIN=$(out)/bin" "MAN=$(out)/share/man/man1" ];
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ fuse ];
diff --git a/pkgs/tools/filesystems/duperemove/default.nix b/pkgs/tools/filesystems/duperemove/default.nix
index f32d026ac1c..b13f216b8db 100644
--- a/pkgs/tools/filesystems/duperemove/default.nix
+++ b/pkgs/tools/filesystems/duperemove/default.nix
@@ -1,6 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, libgcrypt
-, pkg-config, glib, linuxHeaders ? stdenv.cc.libc.linuxHeaders, sqlite
-, util-linux, testers, duperemove }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch2
+, libgcrypt
+, pkg-config
+, glib
+, linuxHeaders ? stdenv.cc.libc.linuxHeaders
+, sqlite
+, util-linux
+, testers
+, duperemove
+}:
 
 stdenv.mkDerivation rec {
   pname = "duperemove";
@@ -13,6 +23,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-D3+p8XgokKIHEwZnvOkn7cionVH1gsypcURF+PBpugY=";
   };
 
+  patches = [
+    # Use variable instead of hardcoding pkg-config
+    # https://github.com/markfasheh/duperemove/pull/315
+    (fetchpatch2 {
+      url = "https://github.com/markfasheh/duperemove/commit/0e1c62d79a9a79d7bb3e80f1bd528dbf7cb75e22.patch";
+      hash = "sha256-YMMu6LCkBlipEJALukQMwIMcjQEAG5pjGEGeTW9OEJk=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace util.c --replace \
       "lscpu" "${lib.getBin util-linux}/bin/lscpu"
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
index b41dd761661..52b50b7cbb4 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@@ -13,13 +13,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus-typing-booster";
-  version = "2.24.2";
+  version = "2.24.4";
 
   src = fetchFromGitHub {
     owner = "mike-fabian";
     repo = "ibus-typing-booster";
     rev = version;
-    hash = "sha256-h/8fFo7X5p6loDKxcPjOYWg1P0m0tVqR2IX/QSfvrzQ=";
+    hash = "sha256-f/KtHm8R1MJORWKmv487hm80MeX2l0Ybd1ZjKHGFq0A=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook gobject-introspection ];
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index 39790d65381..de0fd1a1155 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.26.1";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IqDcE6P4DSH/A4TKzPoLZsO00t0zGPCutM0yVI41nrM=";
+    hash = "sha256-yZsb/G+8XoJS4Fg6WFuEk1v3Ht5i3G3p+sKi+Z3jeGU=";
   };
 
-  cargoHash = "sha256-Lo/O/q2kGioWxkRJ/c9jWAHSm2Y839RsK4NM4qP576c=";
+  cargoHash = "sha256-xHmrFIXXkuhYGApgNoJxcL1Kpf8ellwQgiH8AEZvDRU=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix
index 2188cf99a3c..3f0daa8d945 100644
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clamav";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchurl {
     url = "https://www.clamav.net/downloads/production/${pname}-${version}.tar.gz";
-    hash = "sha256-l6GS3/4UFIC1bKvxBj15qfxVzVkgMkH6Qb/HqYpUgCA=";
+    hash = "sha256-mhT+hwy7j1959mi3idyg8lzGviKr4y9PfTZ35O45NbA=";
   };
 
   patches = [
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 4212d86afb9..7ffb834279c 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-10-26";
+  version = "2023-11-01";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-P+T3TM2MeHaN+ApgOMEFmyWv+AzQshVUfhbI+n/vozs=";
+    hash = "sha256-nejoCvmhxkCkF1UpRTHioP2g0jaegNpAzAZbX9s/6cE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index dfa556b2948..424f5811a48 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.62.0";
+  version = "3.62.1";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lG3gU5cDbrvYejLC4YFAHwBne7OicGCY5XPJtte7rGo=";
+    hash = "sha256-dDz8czTYRxmhyFaYuSoqnBwT7lMZDENBuH+F0HpaouE=";
   };
 
-  vendorHash = "sha256-jdJ0Avh1wNisO6f3qvUV1rNX5nKnmP7EHVTL79sE4A0=";
+  vendorHash = "sha256-+Boe/bzCsmihspGqmiJ3jOcRJ9KPjkzu6MBmgtAgwjE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/wayland/sov/default.nix b/pkgs/tools/wayland/sov/default.nix
index 31451d82d4b..c8ddc6524f2 100644
--- a/pkgs/tools/wayland/sov/default.nix
+++ b/pkgs/tools/wayland/sov/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch2
 , meson
 , ninja
 , pkg-config
@@ -23,13 +24,28 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-1L5D0pzcXbkz3VS7VB6ID8BJEbGeNxjo3xCr71CGcIo=";
   };
 
+  patches = [
+    # mark wayland-scanner as build-time dependency
+    # https://github.com/milgra/sov/pull/45
+    (fetchpatch2 {
+      url = "https://github.com/milgra/sov/commit/8677dcfc47e440157388a8f15bdda9419d84db04.patch";
+      hash = "sha256-P1k1zosHcVO7hyhD1JWbj07h7pQ7ybgDHfoufBinEys=";
+    })
+  ];
+
   strictDeps = true;
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     wayland-scanner
   ];
+
   buildInputs = [
     freetype
     libglvnd
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0504a48c4e9..4da4fbae891 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22454,6 +22454,10 @@ with pkgs;
 
   libarchive-qt = libsForQt5.callPackage ../development/libraries/libarchive-qt { };
 
+  libaribcaption = callPackage ../by-name/li/libaribcaption/package.nix {
+    inherit (darwin.apple_sdk.frameworks) ApplicationServices CoreFoundation CoreGraphics CoreText;
+  };
+
   libasn1c = callPackage ../servers/osmocom/libasn1c/default.nix { };
 
   libasr = callPackage ../development/libraries/libasr { };
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index 078bbb80942..5ca5e3867d5 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -125,7 +125,13 @@ let
       Verdi = callPackage ../development/coq-modules/Verdi {};
       VST = callPackage ../development/coq-modules/VST ((lib.optionalAttrs
         (lib.versionAtLeast self.coq.version "8.14") {
-          compcert = self.compcert.override { version = "3.11"; };
+          compcert = self.compcert.override {
+            version = with lib.versions; lib.switch self.coq.version [
+              { case = isEq "8.17"; out = "3.13"; }
+              { case = range "8.15" "8.16"; out = "3.12"; }
+              { case = isEq "8.14"; out = "3.11"; }
+            ] null;
+          };
         }) // (lib.optionalAttrs (lib.versions.isEq self.coq.coq-version "8.13") {
           ITree = self.ITree.override {
             version = "4.0.0";
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index e3ced10620b..1666964ca63 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -387,6 +387,8 @@ in {
 
     mbp2018-bridge-drv = callPackage ../os-specific/linux/mbp-modules/mbp2018-bridge-drv { };
 
+    nct6687d = callPackage ../os-specific/linux/nct6687d { };
+
     new-lg4ff = callPackage ../os-specific/linux/new-lg4ff { };
 
     nvidiabl = callPackage ../os-specific/linux/nvidiabl { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index d6c794de8b5..3b71e907a66 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -203,6 +203,7 @@ mapAliases ({
   jaraco_text = jaraco-text; # added 2023-07-14
   jaraco_stream = jaraco-stream; # added 2023-07-14
   JayDeBeApi = jaydebeapi; # added 2023-02-19
+  jinja2_pluralize = jinja2-pluralize; # added 2023-11-01
   jinja2_time = jinja2-time; # added 2022-11-07
   JPype1 = jpype1; # added 2023-02-19
   jsonschema_3 = throw "jsonschema 3 is neither the latest version nor needed inside nixpkgs anymore"; # added 2023-06-28
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8657089250a..3b50edc3c1a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5637,7 +5637,7 @@ self: super: with self; {
 
   jinja2-git = callPackage ../development/python-modules/jinja2-git { };
 
-  jinja2_pluralize = callPackage ../development/python-modules/jinja2_pluralize { };
+  jinja2-pluralize = callPackage ../development/python-modules/jinja2-pluralize { };
 
   jinja2-time = callPackage ../development/python-modules/jinja2-time { };
 
@@ -13332,6 +13332,8 @@ self: super: with self; {
 
   sqlitedict = callPackage ../development/python-modules/sqlitedict { };
 
+  sqlite-migrate = callPackage ../development/python-modules/sqlite-migrate { };
+
   sqlite-fts4 = callPackage ../development/python-modules/sqlite-fts4 { };
 
   sqlite-utils = callPackage ../development/python-modules/sqlite-utils { };