summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/team-list.nix8
-rw-r--r--nixos/doc/manual/release-notes/rl-2311.section.md8
-rw-r--r--nixos/modules/config/console.nix3
-rw-r--r--nixos/modules/image/repart.nix3
-rw-r--r--nixos/modules/programs/environment.nix2
-rw-r--r--nixos/modules/services/security/vaultwarden/default.nix6
-rw-r--r--nixos/modules/system/boot/systemd.nix1
-rw-r--r--nixos/modules/system/boot/systemd/initrd.nix1
-rw-r--r--pkgs/applications/audio/giada/default.nix1
-rw-r--r--pkgs/applications/audio/ncmpc/default.nix4
-rw-r--r--pkgs/applications/audio/sfizz/default.nix2
-rw-r--r--pkgs/applications/audio/spotify-qt/default.nix2
-rw-r--r--pkgs/applications/blockchains/aeon/default.nix1
-rw-r--r--pkgs/applications/blockchains/bitcoin/default.nix17
-rw-r--r--pkgs/applications/blockchains/haven-cli/default.nix1
-rw-r--r--pkgs/applications/blockchains/monero-cli/default.nix1
-rw-r--r--pkgs/applications/blockchains/oxen/default.nix1
-rw-r--r--pkgs/applications/editors/rstudio/default.nix1
-rw-r--r--pkgs/applications/editors/vim/common.nix4
-rw-r--r--pkgs/applications/emulators/vbam/default.nix1
-rw-r--r--pkgs/applications/graphics/brlcad/default.nix1
-rw-r--r--pkgs/applications/graphics/krita/generic.nix3
-rw-r--r--pkgs/applications/graphics/paraview/default.nix1
-rw-r--r--pkgs/applications/misc/harsh/default.nix4
-rw-r--r--pkgs/applications/misc/huggle/default.nix3
-rw-r--r--pkgs/applications/misc/keyleds/default.nix4
-rw-r--r--pkgs/applications/misc/metadata-cleaner/default.nix4
-rw-r--r--pkgs/applications/misc/opentrack/default.nix1
-rw-r--r--pkgs/applications/misc/sway-launcher-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/cilium/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/fluffychat/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/fluffychat/deps.json344
-rw-r--r--pkgs/applications/networking/qv2ray/default.nix1
-rw-r--r--pkgs/applications/radio/soapysdr/default.nix4
-rw-r--r--pkgs/applications/science/biology/sortmerna/default.nix1
-rw-r--r--pkgs/applications/science/electronics/kicad/base.nix3
-rw-r--r--pkgs/applications/science/electronics/openboardview/default.nix1
-rw-r--r--pkgs/applications/science/logic/cvc4/default.nix5
-rw-r--r--pkgs/applications/science/logic/cvc5/default.nix3
-rw-r--r--pkgs/applications/science/logic/klee/default.nix3
-rw-r--r--pkgs/applications/version-management/gh/default.nix4
-rw-r--r--pkgs/applications/video/hyperion-ng/default.nix1
-rw-r--r--pkgs/applications/video/jellyfin-media-player/default.nix1
-rw-r--r--pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix4
-rw-r--r--pkgs/applications/video/plex-media-player/default.nix4
-rw-r--r--pkgs/applications/virtualization/cloud-hypervisor/default.nix3
-rw-r--r--pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix2
-rw-r--r--pkgs/build-support/deterministic-uname/deterministic-uname.sh35
-rw-r--r--pkgs/by-name/ou/outputcheck/package.nix52
-rw-r--r--pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix1
-rw-r--r--pkgs/development/compilers/ldc/generic.nix1
-rw-r--r--pkgs/development/compilers/llvm/10/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/11/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/12/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/13/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/14/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/16/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/5/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/6/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/7/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/8/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/9/llvm/default.nix3
-rw-r--r--pkgs/development/compilers/llvm/git/llvm/default.nix3
-rw-r--r--pkgs/development/interpreters/python/hooks/default.nix14
-rw-r--r--pkgs/development/interpreters/python/hooks/pypa-build-hook-test.nix32
-rw-r--r--pkgs/development/interpreters/python/hooks/pypa-build-hook.sh2
-rw-r--r--pkgs/development/libraries/cracklib/default.nix6
-rw-r--r--pkgs/development/libraries/ffmpeg/4.nix12
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix8
-rw-r--r--pkgs/development/libraries/flatcc/default.nix1
-rw-r--r--pkgs/development/libraries/gtk/3.x.nix7
-rw-r--r--pkgs/development/libraries/gtk/4.x.nix9
-rw-r--r--pkgs/development/libraries/imlib2/default.nix6
-rw-r--r--pkgs/development/libraries/libavif/default.nix4
-rw-r--r--pkgs/development/libraries/libbsd/darwin-fix-libbsd.sym.patch15
-rw-r--r--pkgs/development/libraries/libbsd/darwin.patch309
-rw-r--r--pkgs/development/libraries/libbsd/default.nix45
-rw-r--r--pkgs/development/libraries/libhwy/default.nix22
-rw-r--r--pkgs/development/libraries/libimagequant/Cargo.lock70
-rw-r--r--pkgs/development/libraries/libimagequant/default.nix4
-rw-r--r--pkgs/development/libraries/libksba/default.nix4
-rw-r--r--pkgs/development/libraries/libmd/default.nix27
-rw-r--r--pkgs/development/libraries/libmodplug/default.nix5
-rw-r--r--pkgs/development/libraries/libpng/default.nix10
-rw-r--r--pkgs/development/libraries/libwebp/CVE-2023-4863.patch361
-rw-r--r--pkgs/development/libraries/libwebp/default.nix12
-rw-r--r--pkgs/development/libraries/libyang/default.nix1
-rw-r--r--pkgs/development/libraries/mesa-glu/default.nix22
-rw-r--r--pkgs/development/libraries/muparserx/default.nix4
-rw-r--r--pkgs/development/libraries/onnxruntime/default.nix1
-rw-r--r--pkgs/development/libraries/phonon/backends/gstreamer.nix4
-rw-r--r--pkgs/development/libraries/phonon/backends/vlc.nix4
-rw-r--r--pkgs/development/libraries/phonon/default.nix4
-rw-r--r--pkgs/development/libraries/pipewire/default.nix23
-rw-r--r--pkgs/development/libraries/polkit/default.nix4
-rw-r--r--pkgs/development/libraries/protobuf/3.24.nix4
-rw-r--r--pkgs/development/libraries/protobuf/generic-v3-cmake.nix150
-rw-r--r--pkgs/development/libraries/qpdf/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwayland.nix4
-rw-r--r--pkgs/development/libraries/re2/default.nix4
-rw-r--r--pkgs/development/libraries/reproc/default.nix1
-rw-r--r--pkgs/development/libraries/rnnoise-plugin/default.nix2
-rw-r--r--pkgs/development/libraries/s2n-tls/default.nix4
-rw-r--r--pkgs/development/libraries/sentry-native/default.nix3
-rw-r--r--pkgs/development/libraries/sqlite/default.nix21
-rw-r--r--pkgs/development/libraries/sqlite/tools.nix4
-rw-r--r--pkgs/development/libraries/taglib/default.nix12
-rw-r--r--pkgs/development/libraries/unixODBC/default.nix4
-rw-r--r--pkgs/development/libraries/webrtc-audio-processing/default.nix34
-rw-r--r--pkgs/development/ocaml-modules/batteries/default.nix22
-rw-r--r--pkgs/development/ocaml-modules/telegraml/default.nix5
-rw-r--r--pkgs/development/python-modules/bootstrap/build/default.nix33
-rw-r--r--pkgs/development/python-modules/django-ninja/default.nix45
-rw-r--r--pkgs/development/python-modules/django/4.nix4
-rw-r--r--pkgs/development/python-modules/easyocr/default.nix4
-rw-r--r--pkgs/development/python-modules/geopandas/default.nix2
-rw-r--r--pkgs/development/python-modules/gudhi/default.nix1
-rw-r--r--pkgs/development/python-modules/jax/default.nix8
-rw-r--r--pkgs/development/python-modules/jaxlib/bin.nix10
-rw-r--r--pkgs/development/python-modules/jaxlib/default.nix14
-rw-r--r--pkgs/development/python-modules/jq/default.nix10
-rw-r--r--pkgs/development/python-modules/mypy/default.nix3
-rw-r--r--pkgs/development/python-modules/ossfs/default.nix4
-rw-r--r--pkgs/development/python-modules/pytube/default.nix10
-rw-r--r--pkgs/development/python-modules/qdrant-client/default.nix4
-rw-r--r--pkgs/development/python-modules/scipy/default.nix50
-rw-r--r--pkgs/development/python-modules/skorch/default.nix38
-rw-r--r--pkgs/development/python-modules/svg2tikz/default.nix13
-rw-r--r--pkgs/development/python-modules/systemd/default.nix6
-rw-r--r--pkgs/development/tools/analysis/actionlint/default.nix6
-rw-r--r--pkgs/development/tools/argc/default.nix6
-rw-r--r--pkgs/development/tools/biome/default.nix6
-rw-r--r--pkgs/development/tools/code-maat/default.nix4
-rw-r--r--pkgs/development/tools/jq/default.nix25
-rw-r--r--pkgs/development/tools/jq/fix-tests-when-building-without-regex-supports.patch38
-rw-r--r--pkgs/development/tools/misc/autoconf-archive/default.nix4
-rw-r--r--pkgs/development/tools/misc/gperf/3.0.x.nix13
-rw-r--r--pkgs/development/tools/rust/cargo-shuttle/Cargo.lock62
-rw-r--r--pkgs/development/tools/rust/cargo-shuttle/default.nix4
-rw-r--r--pkgs/development/tools/rust/maturin/default.nix6
-rw-r--r--pkgs/development/tools/sd-local/default.nix4
-rw-r--r--pkgs/development/tools/wasmedge/default.nix1
-rwxr-xr-xpkgs/games/dwarf-fortress/update.sh2
-rw-r--r--pkgs/games/etlegacy/default.nix1
-rw-r--r--pkgs/games/lzwolf/default.nix1
-rw-r--r--pkgs/games/nanosaur/default.nix2
-rw-r--r--pkgs/games/nanosaur2/default.nix2
-rw-r--r--pkgs/games/openmw/tes3mp.nix1
-rw-r--r--pkgs/games/otto-matic/default.nix2
-rw-r--r--pkgs/games/prismlauncher/default.nix1
-rw-r--r--pkgs/games/prismlauncher/wrapper.nix3
-rw-r--r--pkgs/misc/drivers/epsonscan2/default.nix1
-rw-r--r--pkgs/misc/dumb/default.nix1
-rw-r--r--pkgs/os-specific/linux/ell/default.nix16
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/iwd/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel-headers/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json20
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.10.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.15.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-6.1.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-6.5.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.1.nix4
-rw-r--r--pkgs/os-specific/linux/shadow/default.nix18
-rw-r--r--pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch2
-rw-r--r--pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch32
-rw-r--r--pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch26
-rw-r--r--pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch20
-rw-r--r--pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch28
-rw-r--r--pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch2
-rw-r--r--pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0019-bootctl-also-print-efi-files-not-owned-by-systemd-in.patch46
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix44
-rw-r--r--pkgs/servers/bloat/default.nix8
-rw-r--r--pkgs/servers/domoticz/default.nix1
-rw-r--r--pkgs/servers/nosql/arangodb/default.nix3
-rw-r--r--pkgs/servers/pocketbase/default.nix6
-rw-r--r--pkgs/servers/tarantool/default.nix3
-rw-r--r--pkgs/shells/bash/5.nix7
-rw-r--r--pkgs/tools/X11/inputplug/default.nix4
-rw-r--r--pkgs/tools/X11/xdg-utils/default.nix5
-rw-r--r--pkgs/tools/admin/eksctl/default.nix6
-rw-r--r--pkgs/tools/audio/abcmidi/default.nix4
-rw-r--r--pkgs/tools/compression/brotli/default.nix35
-rw-r--r--pkgs/tools/graphics/astc-encoder/default.nix3
-rw-r--r--pkgs/tools/misc/aspcud/default.nix1
-rw-r--r--pkgs/tools/misc/calamares/default.nix1
-rw-r--r--pkgs/tools/misc/clipboard-jh/default.nix3
-rw-r--r--pkgs/tools/misc/trdl-client/default.nix4
-rw-r--r--pkgs/tools/networking/bandwhich/Cargo.lock141
-rw-r--r--pkgs/tools/networking/bandwhich/default.nix11
-rw-r--r--pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch13
-rw-r--r--pkgs/tools/networking/curl/default.nix6
-rw-r--r--pkgs/tools/networking/ebpf-verifier/default.nix2
-rw-r--r--pkgs/tools/security/sirikali/default.nix1
-rw-r--r--pkgs/tools/system/nvtop/default.nix1
-rw-r--r--pkgs/tools/system/systeroid/default.nix6
-rw-r--r--pkgs/tools/system/which/default.nix7
-rw-r--r--pkgs/tools/text/ruplacer/default.nix6
-rw-r--r--pkgs/top-level/all-packages.nix11
-rw-r--r--pkgs/top-level/perl-packages.nix21
-rw-r--r--pkgs/top-level/python-packages.nix2
213 files changed, 1334 insertions, 1722 deletions
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 7bad8e74a21..6b90ce30588 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -649,15 +649,13 @@ with lib.maintainers; {
     enableFeatureFreezePing = true;
   };
 
-  nixos-modules = {
+  module-system = {
     members = [
-      ericson2314
       infinisil
-      qyliss
       roberth
     ];
-    scope = "Maintain nixpkgs module system internals.";
-    shortName = "NixOS Modules / internals";
+    scope = "Maintain the Nixpkgs module system.";
+    shortName = "Module system";
     enableFeatureFreezePing = true;
   };
 
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 58d98b0f0ca..37225b55069 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -10,6 +10,12 @@
 
 - The `nixos-rebuild` command has been given a `list-generations` subcommand. See `man nixos-rebuild` for more details.
 
+- [systemd](https://systemd.io) has been updated from v253 to v254, see [the release notes](https://github.com/systemd/systemd/blob/v254/NEWS#L3-L659) for more information on the changes.
+    - `boot.resumeDevice` **must be specified** when hibernating if not in EFI mode.
+    - systemd may warn your system about the permissions of your ESP partition (often `/boot`), this warning can be ignored for now, we are looking
+      into a satisfying solution regarding this problem.
+    - Updating with `nixos-rebuild boot` and rebooting is recommended, since in some rare cases the `nixos-rebuild switch` into the new generation on a live system might fail due to missing mount units.
+
 ## New Services {#sec-release-23.11-new-services}
 
 - [MCHPRS](https://github.com/MCHPR/MCHPRS), a multithreaded Minecraft server built for redstone. Available as [services.mchprs](#opt-services.mchprs.enable).
@@ -226,6 +232,8 @@
 
 - New options were added to `services.searx` for better SearXNG support, including options for the built-in rate limiter and bot protection and automatically configuring a local redis server.
 
+- `jq` was updated to 1.7, its [first release in 5 years](https://github.com/jqlang/jq/releases/tag/jq-1.7).
+
 - A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.
 
 - DocBook option documentation is no longer supported, all module documentation now uses markdown.
diff --git a/nixos/modules/config/console.nix b/nixos/modules/config/console.nix
index 1e8bb78f302..d06ec0051c4 100644
--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@@ -168,6 +168,9 @@ in
           # ...but only the keymaps if we don't
           "/etc/kbd/keymaps" = lib.mkIf (!cfg.earlySetup) { source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/keymaps"; };
         };
+        boot.initrd.systemd.additionalUpstreamUnits = [
+          "systemd-vconsole-setup.service"
+        ];
         boot.initrd.systemd.storePaths = [
           "${config.boot.initrd.systemd.package}/lib/systemd/systemd-vconsole-setup"
           "${config.boot.initrd.systemd.package.kbd}/bin/setfont"
diff --git a/nixos/modules/image/repart.nix b/nixos/modules/image/repart.nix
index 4a0021e9a56..e567485c9d3 100644
--- a/nixos/modules/image/repart.nix
+++ b/nixos/modules/image/repart.nix
@@ -188,6 +188,7 @@ in
           nativeBuildInputs = [
             cfg.package
             pkgs.fakeroot
+            pkgs.util-linux
           ] ++ fileSystemTools;
         } ''
         amendedRepartDefinitions=$(${amendRepartDefinitions} ${partitions} ${definitionsDirectory})
@@ -195,7 +196,7 @@ in
         mkdir -p $out
         cd $out
 
-        fakeroot systemd-repart \
+        unshare --map-root-user fakeroot systemd-repart \
           --dry-run=no \
           --empty=create \
           --size=auto \
diff --git a/nixos/modules/programs/environment.nix b/nixos/modules/programs/environment.nix
index 6dad0cc5245..324b1918474 100644
--- a/nixos/modules/programs/environment.nix
+++ b/nixos/modules/programs/environment.nix
@@ -37,8 +37,6 @@ in
     environment.profileRelativeSessionVariables =
       { PATH = [ "/bin" ];
         INFOPATH = [ "/info" "/share/info" ];
-        KDEDIRS = [ "" ];
-        QT_PLUGIN_PATH = [ "/lib/qt4/plugins" "/lib/kde4/plugins" ];
         QTWEBKIT_PLUGIN_PATH = [ "/lib/mozilla/plugins/" ];
         GTK_PATH = [ "/lib/gtk-2.0" "/lib/gtk-3.0" "/lib/gtk-4.0" ];
         XDG_CONFIG_DIRS = [ "/etc/xdg" ];
diff --git a/nixos/modules/services/security/vaultwarden/default.nix b/nixos/modules/services/security/vaultwarden/default.nix
index d22e6b5b40c..0517615a4c6 100644
--- a/nixos/modules/services/security/vaultwarden/default.nix
+++ b/nixos/modules/services/security/vaultwarden/default.nix
@@ -60,10 +60,8 @@ in {
     config = mkOption {
       type = attrsOf (nullOr (oneOf [ bool int str ]));
       default = {
-        config = {
-          ROCKET_ADDRESS = "::1"; # default to localhost
-          ROCKET_PORT = 8222;
-        };
+        ROCKET_ADDRESS = "::1"; # default to localhost
+        ROCKET_PORT = 8222;
       };
       example = literalExpression ''
         {
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index b6c3085c4f1..8e38072b4c6 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -48,6 +48,7 @@ let
       "rescue.service"
 
       # Udev.
+      "systemd-tmpfiles-setup-dev-early.service"
       "systemd-udevd-control.socket"
       "systemd-udevd-kernel.socket"
       "systemd-udevd.service"
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 5d9fca7a605..b20b0168e40 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -57,7 +57,6 @@ let
     "systemd-ask-password-console.service"
     "systemd-fsck@.service"
     "systemd-halt.service"
-    "systemd-hibernate-resume@.service"
     "systemd-journald-audit.socket"
     "systemd-journald-dev-log.socket"
     "systemd-journald.service"
diff --git a/pkgs/applications/audio/giada/default.nix b/pkgs/applications/audio/giada/default.nix
index d2ccb6d4747..b277175ec10 100644
--- a/pkgs/applications/audio/giada/default.nix
+++ b/pkgs/applications/audio/giada/default.nix
@@ -41,7 +41,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_BINDIR=bin"
-    "-DCMAKE_BUILD_TYPE=Release"
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/ncmpc/default.nix b/pkgs/applications/audio/ncmpc/default.nix
index 0333f95710e..7459becc08d 100644
--- a/pkgs/applications/audio/ncmpc/default.nix
+++ b/pkgs/applications/audio/ncmpc/default.nix
@@ -16,13 +16,13 @@ assert pcreSupport -> pcre != null;
 
 stdenv.mkDerivation rec {
   pname = "ncmpc";
-  version = "0.48";
+  version = "0.49";
 
   src = fetchFromGitHub {
     owner  = "MusicPlayerDaemon";
     repo   = "ncmpc";
     rev    = "v${version}";
-    sha256 = "sha256-89hBaWFwMPBqSWDmsXND0PEc1a9Fte+p1ho5tWuZFlY=";
+    sha256 = "sha256-rqIlQQ9RhFrhPwUd9dZmMZiqwFinNoV46VaJ3pbyUI8=";
   };
 
   buildInputs = [ glib ncurses libmpdclient boost ]
diff --git a/pkgs/applications/audio/sfizz/default.nix b/pkgs/applications/audio/sfizz/default.nix
index 05957bf38f2..4f203a77dc8 100644
--- a/pkgs/applications/audio/sfizz/default.nix
+++ b/pkgs/applications/audio/sfizz/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
       --replace '/usr/bin/zenity' '${gnome.zenity}/bin/zenity'
   '';
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" "-DSFIZZ_TESTS=ON" ];
+  cmakeFlags = [ "-DSFIZZ_TESTS=ON" ];
 
   doCheck = true;
 
diff --git a/pkgs/applications/audio/spotify-qt/default.nix b/pkgs/applications/audio/spotify-qt/default.nix
index 65a921ed5bf..d302643eb47 100644
--- a/pkgs/applications/audio/spotify-qt/default.nix
+++ b/pkgs/applications/audio/spotify-qt/default.nix
@@ -22,7 +22,7 @@ mkDerivation rec {
 
    nativeBuildInputs = [ cmake ];
 
-   cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" "-DCMAKE_INSTALL_PREFIX=" ];
+   cmakeFlags = [ "-DCMAKE_INSTALL_PREFIX=" ];
 
    installFlags = [ "DESTDIR=$(out)" ];
 
diff --git a/pkgs/applications/blockchains/aeon/default.nix b/pkgs/applications/blockchains/aeon/default.nix
index 13928c856b9..7928a63b826 100644
--- a/pkgs/applications/blockchains/aeon/default.nix
+++ b/pkgs/applications/blockchains/aeon/default.nix
@@ -26,7 +26,6 @@ stdenv.mkDerivation {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DBUILD_GUI_DEPS=ON"
     "-DReadline_ROOT_DIR=${readline.dev}"
   ];
diff --git a/pkgs/applications/blockchains/bitcoin/default.nix b/pkgs/applications/blockchains/bitcoin/default.nix
index 01a3f3e1587..24f7d78e4f5 100644
--- a/pkgs/applications/blockchains/bitcoin/default.nix
+++ b/pkgs/applications/blockchains/bitcoin/default.nix
@@ -3,6 +3,7 @@
 , fetchurl
 , autoreconfHook
 , pkg-config
+, installShellFiles
 , util-linux
 , hexdump
 , autoSignDarwinBinariesHook
@@ -43,7 +44,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs =
-    [ autoreconfHook pkg-config ]
+    [ autoreconfHook pkg-config installShellFiles ]
     ++ lib.optionals stdenv.isLinux [ util-linux ]
     ++ lib.optionals stdenv.isDarwin [ hexdump ]
     ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [ autoSignDarwinBinariesHook ]
@@ -53,7 +54,19 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withWallet [ db48 sqlite ]
     ++ lib.optionals withGui [ qrencode qtbase qttools ];
 
-  postInstall = lib.optionalString withGui ''
+  postInstall = ''
+    installShellCompletion --cmd bitcoin-cli --bash contrib/completions/bash/bitcoin-cli.bash-completion
+    installShellCompletion --cmd bitcoind --bash contrib/completions/bash/bitcoind.bash-completion
+    installShellCompletion --cmd bitcoin-tx --bash contrib/completions/bash/bitcoin-tx.bash-completion
+
+    installShellCompletion --fish contrib/completions/fish/bitcoin-cli.fish
+    installShellCompletion --fish contrib/completions/fish/bitcoind.fish
+    installShellCompletion --fish contrib/completions/fish/bitcoin-tx.fish
+    installShellCompletion --fish contrib/completions/fish/bitcoin-util.fish
+    installShellCompletion --fish contrib/completions/fish/bitcoin-wallet.fish
+  '' + lib.optionalString withGui ''
+    installShellCompletion --fish contrib/completions/fish/bitcoin-qt.fish
+
     install -Dm644 ${desktop} $out/share/applications/bitcoin-qt.desktop
     substituteInPlace $out/share/applications/bitcoin-qt.desktop --replace "Icon=bitcoin128" "Icon=bitcoin"
     install -Dm644 share/pixmaps/bitcoin256.png $out/share/pixmaps/bitcoin.png
diff --git a/pkgs/applications/blockchains/haven-cli/default.nix b/pkgs/applications/blockchains/haven-cli/default.nix
index 2bc3a683ef5..066bbde363a 100644
--- a/pkgs/applications/blockchains/haven-cli/default.nix
+++ b/pkgs/applications/blockchains/haven-cli/default.nix
@@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals trezorSupport [ libusb1 protobuf python3 ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DUSE_DEVICE_TREZOR=ON"
     "-DBUILD_GUI_DEPS=ON"
     "-DReadline_ROOT_DIR=${readline.dev}"
diff --git a/pkgs/applications/blockchains/monero-cli/default.nix b/pkgs/applications/blockchains/monero-cli/default.nix
index 4d07a964af1..0dc220ac66d 100644
--- a/pkgs/applications/blockchains/monero-cli/default.nix
+++ b/pkgs/applications/blockchains/monero-cli/default.nix
@@ -58,7 +58,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals trezorSupport [ libusb1 protobuf python3 ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DUSE_DEVICE_TREZOR=ON"
     "-DBUILD_GUI_DEPS=ON"
     "-DReadline_ROOT_DIR=${readline.dev}"
diff --git a/pkgs/applications/blockchains/oxen/default.nix b/pkgs/applications/blockchains/oxen/default.nix
index a8948d7df5a..0136bc910da 100644
--- a/pkgs/applications/blockchains/oxen/default.nix
+++ b/pkgs/applications/blockchains/oxen/default.nix
@@ -47,7 +47,6 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals trezorSupport [ libusb1 protobuf python3 ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     # "-DUSE_DEVICE_TREZOR=ON"
     # "-DBUILD_GUI_DEPS=ON"
     "-DReadline_ROOT_DIR=${readline.dev}"
diff --git a/pkgs/applications/editors/rstudio/default.nix b/pkgs/applications/editors/rstudio/default.nix
index e854291310b..a619c636cd5 100644
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@@ -115,7 +115,6 @@ in
 
     cmakeFlags = [
       "-DRSTUDIO_TARGET=${if server then "Server" else "Desktop"}"
-      "-DCMAKE_BUILD_TYPE=Release"
       "-DRSTUDIO_USE_SYSTEM_SOCI=ON"
       "-DRSTUDIO_USE_SYSTEM_BOOST=ON"
       "-DRSTUDIO_USE_SYSTEM_YAML_CPP=ON"
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 0abb7db9d99..0179dabe394 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.1811";
+  version = "9.0.1897";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-b/fATWaHcIZIvkmr/UQ4R45ii9N0kWJMb7DerF/JYIA=";
+    hash = "sha256-ywxJ9evXWbqZ6o6EqDIQWK16J05McAdvPl0Y9cW5Zvc=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/emulators/vbam/default.nix b/pkgs/applications/emulators/vbam/default.nix
index f0cd38de894..b090864d0d0 100644
--- a/pkgs/applications/emulators/vbam/default.nix
+++ b/pkgs/applications/emulators/vbam/default.nix
@@ -44,7 +44,6 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE='Release'"
     "-DENABLE_FFMPEG='true'"
     "-DENABLE_LINK='true'"
     "-DSYSCONFDIR=etc"
diff --git a/pkgs/applications/graphics/brlcad/default.nix b/pkgs/applications/graphics/brlcad/default.nix
index 2a0853fb221..f30a6acbbbe 100644
--- a/pkgs/applications/graphics/brlcad/default.nix
+++ b/pkgs/applications/graphics/brlcad/default.nix
@@ -34,7 +34,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DBRLCAD_ENABLE_STRICT=OFF"
-    "-DCMAKE_BUILD_TYPE=Release"
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/graphics/krita/generic.nix b/pkgs/applications/graphics/krita/generic.nix
index 4f16661cedb..4a946ef8c15 100644
--- a/pkgs/applications/graphics/krita/generic.nix
+++ b/pkgs/applications/graphics/krita/generic.nix
@@ -47,10 +47,11 @@ mkDerivation rec {
       --replace 'PYTHONPATH=''${_krita_python_path}' 'PYTHONPATH=${pythonPath}'
   '';
 
+  cmakeBuildType = "RelWithDebInfo";
+
   cmakeFlags = [
     "-DPYQT5_SIP_DIR=${python3Packages.pyqt5}/${python3Packages.python.sitePackages}/PyQt5/bindings"
     "-DPYQT_SIP_DIR_OVERRIDE=${python3Packages.pyqt5}/${python3Packages.python.sitePackages}/PyQt5/bindings"
-    "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
   ];
 
   preInstall = ''
diff --git a/pkgs/applications/graphics/paraview/default.nix b/pkgs/applications/graphics/paraview/default.nix
index c50a0ebb749..14c86082e67 100644
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@@ -45,7 +45,6 @@ in stdenv.mkDerivation rec {
   '';
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DPARAVIEW_ENABLE_FFMPEG=ON"
     "-DPARAVIEW_ENABLE_GDAL=ON"
     "-DPARAVIEW_ENABLE_MOTIONFX=ON"
diff --git a/pkgs/applications/misc/harsh/default.nix b/pkgs/applications/misc/harsh/default.nix
index bf38ae4ffe0..129de17fb18 100644
--- a/pkgs/applications/misc/harsh/default.nix
+++ b/pkgs/applications/misc/harsh/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "harsh";
-  version = "0.8.28";
+  version = "0.8.29";
 
   src = fetchFromGitHub {
     owner = "wakatara";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-6BeGyyy4RFBy4TvB3bLTyDtQGljG9xE3VFfbnq9KWcs=";
+    hash = "sha256-LftLlKevxvjxnRUMaRXnh3TXQSauvnfuX6voglwZmZE=";
   };
 
   vendorHash = "sha256-zkz7X/qj8FwtQZXGuq4Oaoe5G9a4AJE1kv3j7wwQEp4=";
diff --git a/pkgs/applications/misc/huggle/default.nix b/pkgs/applications/misc/huggle/default.nix
index a136f1f678a..3a6f25ede69 100644
--- a/pkgs/applications/misc/huggle/default.nix
+++ b/pkgs/applications/misc/huggle/default.nix
@@ -40,9 +40,10 @@ stdenv.mkDerivation rec {
     substituteInPlace src/CMakeLists.txt --replace '@libirc_includes@' '${libirc.out}'
   '';
 
+  cmakeBuildType = "None";
+
   cmakeFlags = [
     "-S" "/build/source/src"
-    "-DCMAKE_BUILD_TYPE=None"
     "-DINSTALL_DATA_DIR=bin"
     "-DQT5_BUILD=ON"
     "-DWEB_ENGINE=ON"
diff --git a/pkgs/applications/misc/keyleds/default.nix b/pkgs/applications/misc/keyleds/default.nix
index c48b30b34dc..a759b8e393e 100644
--- a/pkgs/applications/misc/keyleds/default.nix
+++ b/pkgs/applications/misc/keyleds/default.nix
@@ -52,9 +52,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=MinSizeRel"
-  ];
+  cmakeBuildType = "MinSizeRel";
 
   meta = {
     homepage = "https://github.com/keyleds/keyleds";
diff --git a/pkgs/applications/misc/metadata-cleaner/default.nix b/pkgs/applications/misc/metadata-cleaner/default.nix
index 8d88612b728..88df68f5597 100644
--- a/pkgs/applications/misc/metadata-cleaner/default.nix
+++ b/pkgs/applications/misc/metadata-cleaner/default.nix
@@ -18,7 +18,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "metadata-cleaner";
-  version = "2.5.0";
+  version = "2.5.4";
 
   format = "other";
 
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "rmnvgr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-15qs2EsvEmQQPsarozP4HVpa0/3YJBSZ9M+1s/w5LaA=";
+    hash = "sha256-2+ZY+ca/CTIdCiFrBOkMWKflzKjSYJ8yfwFkULNg7Xk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/opentrack/default.nix b/pkgs/applications/misc/opentrack/default.nix
index b4c455c0ce0..84edbc567b4 100644
--- a/pkgs/applications/misc/opentrack/default.nix
+++ b/pkgs/applications/misc/opentrack/default.nix
@@ -46,7 +46,6 @@ in
     dontWrapQtApps = true;
 
     cmakeFlags = [
-      "-DCMAKE_BUILD_TYPE=RELEASE"
       "-DSDK_ARUCO_LIBPATH=${aruco}/lib/libaruco.a"
       "-DSDK_XPLANE=${xplaneSdk}"
     ];
diff --git a/pkgs/applications/misc/sway-launcher-desktop/default.nix b/pkgs/applications/misc/sway-launcher-desktop/default.nix
index 174b95df67b..525e25ae7e0 100644
--- a/pkgs/applications/misc/sway-launcher-desktop/default.nix
+++ b/pkgs/applications/misc/sway-launcher-desktop/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sway-launcher-desktop";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "Biont";
     repo = "sway-launcher-desktop";
     rev = "v${version}";
-    sha256 = "HCGUFXrj6b9Pb6b5y9yupBumFLQyH1QVMrfoBM4HbMg=";
+    hash = "sha256-lv1MLPJsJJjm6RLzZXWEz1JO/4EXTQ8wj225Di+98G4=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/cluster/cilium/default.nix b/pkgs/applications/networking/cluster/cilium/default.nix
index 8b418333705..acb4ce14a8e 100644
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.15.7";
+  version = "0.15.8";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-kQpQszKyesM9qFlpgwYElrC9B4YBig62Pf9FoZJ2epM=";
+    hash = "sha256-iIE4jqvlkgf8+IrP0t+o0bZwlB5v61HzbyQy6ExAobE=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
index 66ba7d3ae41..2e47aa8ab66 100644
--- a/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fluffychat/default.nix
@@ -14,17 +14,17 @@ let
 in
 flutter.buildFlutterApplication rec {
   pname = "fluffychat";
-  version = "1.13.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "krille-chan";
     repo = "fluffychat";
     rev = "refs/tags/v${version}";
-    hash = "sha256-w29Nxs/d0b18jMvWnrRUjEGqY4jGtuEGodg+ncCAaVc=";
+    hash = "sha256-VTpZvoyZXJ5SCKr3Ocfm4iT6Z/+AWg+SCw/xmp68kMg=";
   };
 
   depsListFile = ./deps.json;
-  vendorHash = "sha256-dkH+iI1KLsAJtSt6ndc3ZRBllZ9n21RNONqeeUzNQCE=";
+  vendorHash = "sha256-uGrz7QwETZGlwLbfKr1vDo0p/emK1ZCjCX2w0nNVJsA=";
 
   desktopItem = makeDesktopItem {
     name = "Fluffychat";
diff --git a/pkgs/applications/networking/instant-messengers/fluffychat/deps.json b/pkgs/applications/networking/instant-messengers/fluffychat/deps.json
index 80e26e4883b..b1fd21c1086 100644
--- a/pkgs/applications/networking/instant-messengers/fluffychat/deps.json
+++ b/pkgs/applications/networking/instant-messengers/fluffychat/deps.json
@@ -1,7 +1,7 @@
 [
   {
     "name": "fluffychat",
-    "version": "1.13.0+3514",
+    "version": "1.14.1+3516",
     "kind": "root",
     "source": "root",
     "dependencies": [
@@ -47,14 +47,13 @@
       "flutter_webrtc",
       "future_loading_dialog",
       "geolocator",
-      "handy_window",
+      "go_router",
       "hive",
       "hive_flutter",
       "http",
       "image_picker",
       "intl",
       "just_audio",
-      "just_audio_mpv",
       "keyboard_shortcuts",
       "latlong2",
       "linkify",
@@ -85,7 +84,6 @@
       "vibration",
       "video_compress",
       "video_player",
-      "vrouter",
       "wakelock",
       "webrtc_interface",
       "dart_code_metrics",
@@ -113,7 +111,7 @@
   },
   {
     "name": "win32",
-    "version": "5.0.5",
+    "version": "5.0.6",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -122,7 +120,7 @@
   },
   {
     "name": "ffi",
-    "version": "2.0.2",
+    "version": "2.1.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": []
@@ -227,7 +225,7 @@
   },
   {
     "name": "plugin_platform_interface",
-    "version": "2.1.4",
+    "version": "2.1.5",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -320,7 +318,7 @@
   },
   {
     "name": "msix",
-    "version": "3.15.0",
+    "version": "3.16.1",
     "kind": "dev",
     "source": "hosted",
     "dependencies": [
@@ -397,7 +395,7 @@
   },
   {
     "name": "archive",
-    "version": "3.3.7",
+    "version": "3.3.9",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -730,7 +728,7 @@
   },
   {
     "name": "flutter_native_splash",
-    "version": "2.3.1",
+    "version": "2.3.2",
     "kind": "dev",
     "source": "hosted",
     "dependencies": [
@@ -810,7 +808,7 @@
   },
   {
     "name": "dart_code_metrics",
-    "version": "5.7.5",
+    "version": "5.7.6",
     "kind": "dev",
     "source": "hosted",
     "dependencies": [
@@ -969,7 +967,7 @@
   },
   {
     "name": "webrtc_interface",
-    "version": "1.1.0",
+    "version": "1.1.1",
     "kind": "direct",
     "source": "hosted",
     "dependencies": []
@@ -1012,150 +1010,145 @@
     ]
   },
   {
-    "name": "vrouter",
-    "version": "1.2.1",
+    "name": "video_player",
+    "version": "2.7.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
       "flutter",
-      "url_strategy",
-      "url_launcher",
-      "move_to_background"
+      "html",
+      "video_player_android",
+      "video_player_avfoundation",
+      "video_player_platform_interface",
+      "video_player_web"
     ]
   },
   {
-    "name": "move_to_background",
-    "version": "1.0.2",
+    "name": "video_player_web",
+    "version": "2.0.16",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
-      "flutter"
-    ]
-  },
-  {
-    "name": "url_launcher",
-    "version": "6.1.12",
-    "kind": "direct",
-    "source": "hosted",
-    "dependencies": [
       "flutter",
-      "url_launcher_android",
-      "url_launcher_ios",
-      "url_launcher_linux",
-      "url_launcher_macos",
-      "url_launcher_platform_interface",
-      "url_launcher_web",
-      "url_launcher_windows"
+      "flutter_web_plugins",
+      "video_player_platform_interface"
     ]
   },
   {
-    "name": "url_launcher_windows",
-    "version": "3.0.7",
+    "name": "video_player_platform_interface",
+    "version": "6.2.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
       "flutter",
-      "url_launcher_platform_interface"
+      "plugin_platform_interface"
     ]
   },
   {
-    "name": "url_launcher_platform_interface",
-    "version": "2.1.3",
+    "name": "video_player_avfoundation",
+    "version": "2.4.9",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
       "flutter",
-      "plugin_platform_interface"
+      "video_player_platform_interface"
     ]
   },
   {
-    "name": "url_launcher_web",
-    "version": "2.0.18",
+    "name": "video_player_android",
+    "version": "2.4.9",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
       "flutter",
-      "flutter_web_plugins",
-      "url_launcher_platform_interface"
+      "video_player_platform_interface"
     ]
   },
   {
-    "name": "url_launcher_macos",
-    "version": "3.0.5",
-    "kind": "transitive",
+    "name": "video_compress",
+    "version": "3.1.2",
+    "kind": "direct",
     "source": "hosted",
     "dependencies": [
-      "flutter",
-      "url_launcher_platform_interface"
+      "flutter"
     ]
   },
   {
-    "name": "url_launcher_linux",
-    "version": "3.0.5",
-    "kind": "transitive",
+    "name": "vibration",
+    "version": "1.8.1",
+    "kind": "direct",
     "source": "hosted",
     "dependencies": [
       "flutter",
-      "url_launcher_platform_interface"
+      "device_info_plus"
     ]
   },
   {
-    "name": "url_launcher_ios",
-    "version": "6.1.4",
-    "kind": "transitive",
+    "name": "device_info_plus",
+    "version": "9.0.3",
+    "kind": "direct",
     "source": "hosted",
     "dependencies": [
+      "device_info_plus_platform_interface",
+      "ffi",
+      "file",
       "flutter",
-      "url_launcher_platform_interface"
+      "flutter_web_plugins",
+      "meta",
+      "win32",
+      "win32_registry"
     ]
   },
   {
-    "name": "url_launcher_android",
-    "version": "6.0.36",
+    "name": "win32_registry",
+    "version": "1.1.1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
-      "flutter",
-      "url_launcher_platform_interface"
+      "ffi",
+      "win32"
     ]
   },
   {
-    "name": "url_strategy",
-    "version": "0.2.0",
+    "name": "device_info_plus_platform_interface",
+    "version": "7.0.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
-      "flutter_web_plugins"
+      "flutter",
+      "meta",
+      "plugin_platform_interface"
     ]
   },
   {
-    "name": "video_player",
-    "version": "2.7.0",
+    "name": "url_launcher",
+    "version": "6.1.12",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
       "flutter",
-      "html",
-      "video_player_android",
-      "video_player_avfoundation",
-      "video_player_platform_interface",
-      "video_player_web"
+      "url_launcher_android",
+      "url_launcher_ios",
+      "url_launcher_linux",
+      "url_launcher_macos",
+      "url_launcher_platform_interface",
+      "url_launcher_web",
+      "url_launcher_windows"
     ]
   },
   {
-    "name": "video_player_web",
-    "version": "2.0.16",
+    "name": "url_launcher_windows",
+    "version": "3.0.7",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
       "flutter",
-      "flutter_web_plugins",
-      "video_player_platform_interface"
+      "url_launcher_platform_interface"
     ]
   },
   {
-    "name": "video_player_platform_interface",
-    "version": "6.1.0",
+    "name": "url_launcher_platform_interface",
+    "version": "2.1.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1164,79 +1157,54 @@
     ]
   },
   {
-    "name": "video_player_avfoundation",
-    "version": "2.4.6",
+    "name": "url_launcher_web",
+    "version": "2.0.18",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
       "flutter",
-      "video_player_platform_interface"
+      "flutter_web_plugins",
+      "url_launcher_platform_interface"
     ]
   },
   {
-    "name": "video_player_android",
-    "version": "2.4.9",
+    "name": "url_launcher_macos",
+    "version": "3.0.6",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
       "flutter",
-      "video_player_platform_interface"
-    ]
-  },
-  {
-    "name": "video_compress",
-    "version": "3.1.2",
-    "kind": "direct",
-    "source": "hosted",
-    "dependencies": [
-      "flutter"
-    ]
-  },
-  {
-    "name": "vibration",
-    "version": "1.8.1",
-    "kind": "direct",
-    "source": "hosted",
-    "dependencies": [
-      "flutter",
-      "device_info_plus"
+      "url_launcher_platform_interface"
     ]
   },
   {
-    "name": "device_info_plus",
-    "version": "9.0.2",
-    "kind": "direct",
+    "name": "url_launcher_linux",
+    "version": "3.0.5",
+    "kind": "transitive",
     "source": "hosted",
     "dependencies": [
-      "device_info_plus_platform_interface",
-      "ffi",
-      "file",
       "flutter",
-      "flutter_web_plugins",
-      "meta",
-      "win32",
-      "win32_registry"
+      "url_launcher_platform_interface"
     ]
   },
   {
-    "name": "win32_registry",
-    "version": "1.1.1",
+    "name": "url_launcher_ios",
+    "version": "6.1.4",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
-      "ffi",
-      "win32"
+      "flutter",
+      "url_launcher_platform_interface"
     ]
   },
   {
-    "name": "device_info_plus_platform_interface",
-    "version": "7.0.0",
+    "name": "url_launcher_android",
+    "version": "6.0.38",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
       "flutter",
-      "meta",
-      "plugin_platform_interface"
+      "url_launcher_platform_interface"
     ]
   },
   {
@@ -1277,7 +1245,7 @@
   },
   {
     "name": "unifiedpush_android",
-    "version": "2.1.1",
+    "version": "2.1.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1337,7 +1305,7 @@
   },
   {
     "name": "path_provider_windows",
-    "version": "2.1.7",
+    "version": "2.2.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1350,7 +1318,7 @@
   },
   {
     "name": "path_provider_platform_interface",
-    "version": "2.0.6",
+    "version": "2.1.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1386,7 +1354,7 @@
   },
   {
     "name": "path_provider_linux",
-    "version": "2.1.11",
+    "version": "2.2.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1399,18 +1367,17 @@
   },
   {
     "name": "xdg_directories",
-    "version": "1.0.0",
+    "version": "1.0.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
       "meta",
-      "path",
-      "process"
+      "path"
     ]
   },
   {
     "name": "shared_preferences_foundation",
-    "version": "2.3.1",
+    "version": "2.3.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1488,7 +1455,7 @@
   },
   {
     "name": "share_plus",
-    "version": "7.0.2",
+    "version": "7.1.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -1509,7 +1476,7 @@
   },
   {
     "name": "share_plus_platform_interface",
-    "version": "3.2.1",
+    "version": "3.3.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1524,7 +1491,7 @@
   },
   {
     "name": "path_provider",
-    "version": "2.0.15",
+    "version": "2.1.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -1538,7 +1505,7 @@
   },
   {
     "name": "path_provider_foundation",
-    "version": "2.2.3",
+    "version": "2.3.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1548,7 +1515,7 @@
   },
   {
     "name": "path_provider_android",
-    "version": "2.0.27",
+    "version": "2.1.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1726,7 +1693,7 @@
   },
   {
     "name": "permission_handler",
-    "version": "10.4.2",
+    "version": "10.4.3",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -1740,7 +1707,7 @@
   },
   {
     "name": "permission_handler_platform_interface",
-    "version": "3.11.1",
+    "version": "3.11.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1761,7 +1728,7 @@
   },
   {
     "name": "permission_handler_apple",
-    "version": "9.1.3",
+    "version": "9.1.4",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1771,7 +1738,7 @@
   },
   {
     "name": "permission_handler_android",
-    "version": "10.3.0",
+    "version": "10.3.3",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -1792,7 +1759,7 @@
   },
   {
     "name": "package_info_plus",
-    "version": "4.0.2",
+    "version": "4.1.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -1857,7 +1824,7 @@
   },
   {
     "name": "matrix",
-    "version": "0.22.2",
+    "version": "0.22.3",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -2029,44 +1996,6 @@
     ]
   },
   {
-    "name": "just_audio_mpv",
-    "version": "0.1.6",
-    "kind": "direct",
-    "source": "hosted",
-    "dependencies": [
-      "flutter",
-      "just_audio_platform_interface",
-      "mpv_dart"
-    ]
-  },
-  {
-    "name": "mpv_dart",
-    "version": "0.0.1",
-    "kind": "transitive",
-    "source": "hosted",
-    "dependencies": [
-      "eventify",
-      "path"
-    ]
-  },
-  {
-    "name": "eventify",
-    "version": "1.0.1",
-    "kind": "transitive",
-    "source": "hosted",
-    "dependencies": []
-  },
-  {
-    "name": "just_audio_platform_interface",
-    "version": "4.2.1",
-    "kind": "transitive",
-    "source": "hosted",
-    "dependencies": [
-      "flutter",
-      "plugin_platform_interface"
-    ]
-  },
-  {
     "name": "just_audio",
     "version": "0.9.34",
     "kind": "direct",
@@ -2116,8 +2045,18 @@
     ]
   },
   {
+    "name": "just_audio_platform_interface",
+    "version": "4.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "plugin_platform_interface"
+    ]
+  },
+  {
     "name": "image_picker",
-    "version": "1.0.0",
+    "version": "1.0.2",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -2145,7 +2084,7 @@
   },
   {
     "name": "image_picker_platform_interface",
-    "version": "2.8.0",
+    "version": "2.9.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -2192,7 +2131,7 @@
   },
   {
     "name": "file_selector_macos",
-    "version": "0.9.3",
+    "version": "0.9.3+1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -2236,7 +2175,7 @@
   },
   {
     "name": "image_picker_for_web",
-    "version": "2.2.0",
+    "version": "3.0.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -2248,7 +2187,7 @@
   },
   {
     "name": "image_picker_android",
-    "version": "0.8.7+3",
+    "version": "0.8.7+4",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -2279,15 +2218,26 @@
     ]
   },
   {
-    "name": "handy_window",
-    "version": "0.3.1",
+    "name": "go_router",
+    "version": "10.1.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
-      "flutter"
+      "collection",
+      "flutter",
+      "flutter_web_plugins",
+      "logging",
+      "meta"
     ]
   },
   {
+    "name": "logging",
+    "version": "1.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
     "name": "geolocator",
     "version": "7.7.1",
     "kind": "direct",
@@ -2332,7 +2282,7 @@
   },
   {
     "name": "flutter_webrtc",
-    "version": "0.9.37",
+    "version": "0.9.40",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -2345,7 +2295,7 @@
   },
   {
     "name": "dart_webrtc",
-    "version": "1.1.1",
+    "version": "1.1.2",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -2907,7 +2857,7 @@
   },
   {
     "name": "sqflite",
-    "version": "2.2.8+4",
+    "version": "2.3.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -2918,7 +2868,7 @@
   },
   {
     "name": "sqflite_common",
-    "version": "2.4.5+1",
+    "version": "2.5.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -2963,7 +2913,7 @@
   },
   {
     "name": "file_picker",
-    "version": "5.3.2",
+    "version": "5.3.3",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -3072,7 +3022,7 @@
   },
   {
     "name": "connectivity_plus",
-    "version": "4.0.1",
+    "version": "4.0.2",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -3119,7 +3069,7 @@
   },
   {
     "name": "wakelock_plus",
-    "version": "1.1.0",
+    "version": "1.1.1",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -3155,7 +3105,7 @@
   },
   {
     "name": "badges",
-    "version": "2.0.3",
+    "version": "3.1.1",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -3173,7 +3123,7 @@
   },
   {
     "name": "adaptive_dialog",
-    "version": "1.9.0-x-macos-beta.1",
+    "version": "1.9.0",
     "kind": "direct",
     "source": "hosted",
     "dependencies": [
@@ -3188,7 +3138,7 @@
   },
   {
     "name": "macos_ui",
-    "version": "2.0.0-beta.6",
+    "version": "2.0.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
@@ -3198,7 +3148,7 @@
   },
   {
     "name": "macos_window_utils",
-    "version": "1.1.3",
+    "version": "1.2.0",
     "kind": "transitive",
     "source": "hosted",
     "dependencies": [
diff --git a/pkgs/applications/networking/qv2ray/default.nix b/pkgs/applications/networking/qv2ray/default.nix
index bb9bb957f3d..038d904f453 100644
--- a/pkgs/applications/networking/qv2ray/default.nix
+++ b/pkgs/applications/networking/qv2ray/default.nix
@@ -42,7 +42,6 @@ mkDerivation rec {
   };
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DQV2RAY_DISABLE_AUTO_UPDATE=on"
     "-DQV2RAY_USE_V5_CORE=on"
     "-DQV2RAY_TRANSLATION_PATH=${placeholder "out"}/share/qv2ray/lang"
diff --git a/pkgs/applications/radio/soapysdr/default.nix b/pkgs/applications/radio/soapysdr/default.nix
index 7e0c01c2f5f..ee03d67d598 100644
--- a/pkgs/applications/radio/soapysdr/default.nix
+++ b/pkgs/applications/radio/soapysdr/default.nix
@@ -51,9 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     python.pkgs.numpy
   ];
 
-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
-  ] ++ lib.optionals usePython [
+  cmakeFlags = lib.optionals usePython [
     "-DUSE_PYTHON_CONFIG=ON"
   ];
 
diff --git a/pkgs/applications/science/biology/sortmerna/default.nix b/pkgs/applications/science/biology/sortmerna/default.nix
index 6884e1955f7..a529867aaa7 100644
--- a/pkgs/applications/science/biology/sortmerna/default.nix
+++ b/pkgs/applications/science/biology/sortmerna/default.nix
@@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
   buildInputs = [ zlib rocksdb rapidjson ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DPORTABLE=off"
     "-DRAPIDJSON_HOME=${rapidjson}"
     "-DROCKSDB_HOME=${rocksdb}"
diff --git a/pkgs/applications/science/electronics/kicad/base.nix b/pkgs/applications/science/electronics/kicad/base.nix
index fa9b7703703..3403e410cf8 100644
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@@ -104,7 +104,6 @@ stdenv.mkDerivation rec {
     "-DKICAD_BUILD_QA_TESTS=OFF"
   ]
   ++ optionals (debug) [
-    "-DCMAKE_BUILD_TYPE=Debug"
     "-DKICAD_STDLIB_DEBUG=ON"
     "-DKICAD_USE_VALGRIND=ON"
   ]
@@ -115,6 +114,8 @@ stdenv.mkDerivation rec {
     "-DKICAD_SANITIZE_THREADS=ON"
   ];
 
+  cmakeBuildType = if debug then "Debug" else "Release";
+
   nativeBuildInputs = [
     cmake
     doxygen
diff --git a/pkgs/applications/science/electronics/openboardview/default.nix b/pkgs/applications/science/electronics/openboardview/default.nix
index 715a99cf489..a750001d05d 100644
--- a/pkgs/applications/science/electronics/openboardview/default.nix
+++ b/pkgs/applications/science/electronics/openboardview/default.nix
@@ -39,7 +39,6 @@ stdenv.mkDerivation rec {
   '';
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DGLAD_REPRODUCIBLE=On"
   ];
 
diff --git a/pkgs/applications/science/logic/cvc4/default.nix b/pkgs/applications/science/logic/cvc4/default.nix
index e9f04d2044d..1513c747798 100644
--- a/pkgs/applications/science/logic/cvc4/default.nix
+++ b/pkgs/applications/science/logic/cvc4/default.nix
@@ -35,9 +35,8 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     patchShebangs ./src/
   '';
-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Production"
-  ];
+
+  cmakeBuildType = "Production";
 
   meta = with lib; {
     description = "A high-performance theorem prover and SMT solver";
diff --git a/pkgs/applications/science/logic/cvc5/default.nix b/pkgs/applications/science/logic/cvc5/default.nix
index 24bcb16df9d..9a540f5b550 100644
--- a/pkgs/applications/science/logic/cvc5/default.nix
+++ b/pkgs/applications/science/logic/cvc5/default.nix
@@ -21,8 +21,9 @@ stdenv.mkDerivation rec {
     patchShebangs ./src/
   '';
 
+  cmakeBuildType = "Production";
+
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Production"
     "-DBUILD_SHARED_LIBS=1"
     "-DANTLR3_JAR=${antlr3_4}/lib/antlr/antlr-3.4-complete.jar"
   ];
diff --git a/pkgs/applications/science/logic/klee/default.nix b/pkgs/applications/science/logic/klee/default.nix
index 401b2f48a6e..68f68355f81 100644
--- a/pkgs/applications/science/logic/klee/default.nix
+++ b/pkgs/applications/science/logic/klee/default.nix
@@ -72,10 +72,11 @@ in stdenv.mkDerivation rec {
     (lit.override { python = kleePython; })
   ];
 
+  cmakeBuildType = if debug then "Debug" else if !debug && includeDebugInfo then "RelWithDebInfo" else "MinSizeRel";
+
   cmakeFlags = let
     onOff = val: if val then "ON" else "OFF";
   in [
-    "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else if !debug && includeDebugInfo then "RelWithDebInfo" else "MinSizeRel"}"
     "-DKLEE_RUNTIME_BUILD_TYPE=${if debugRuntime then "Debug" else "Release"}"
     "-DLLVMCC=${clang}/bin/clang"
     "-DLLVMCXX=${clang}/bin/clang++"
diff --git a/pkgs/applications/version-management/gh/default.nix b/pkgs/applications/version-management/gh/default.nix
index 1d6fb52db11..981b5838177 100644
--- a/pkgs/applications/version-management/gh/default.nix
+++ b/pkgs/applications/version-management/gh/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.34.0";
+  version = "2.35.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-Bb0vEaMOjgQ5p9r/tfciKo4/MXjUCUIdoDSB/Bido/8=";
+    hash = "sha256-ddVszWyfu9BsP4yvOtVTHhZ51D8j4Vf1pdyahF0gjVk=";
   };
 
   vendorHash = "sha256-iql/CEWwg6t5k8qOFEQotMUUJd4VQ/H4JcuL2Eunqg0=";
diff --git a/pkgs/applications/video/hyperion-ng/default.nix b/pkgs/applications/video/hyperion-ng/default.nix
index a1eb4086e89..43bd337ae50 100644
--- a/pkgs/applications/video/hyperion-ng/default.nix
+++ b/pkgs/applications/video/hyperion-ng/default.nix
@@ -49,7 +49,6 @@ stdenv.mkDerivation rec {
   '' ;
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DENABLE_DEPLOY_DEPENDENCIES=OFF"
     "-DUSE_SYSTEM_FLATBUFFERS_LIBS=ON"
     "-DUSE_SYSTEM_PROTO_LIBS=ON"
diff --git a/pkgs/applications/video/jellyfin-media-player/default.nix b/pkgs/applications/video/jellyfin-media-player/default.nix
index 5c26d20eda9..47afaef81a6 100644
--- a/pkgs/applications/video/jellyfin-media-player/default.nix
+++ b/pkgs/applications/video/jellyfin-media-player/default.nix
@@ -72,7 +72,6 @@ mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DQTROOT=${qtbase}"
     "-GNinja"
   ] ++ lib.optionals (!withDbus) [
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix b/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
index 8f8506aa05e..a94cb71f10e 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-vkcapture";
-  version = "1.4.1";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "nowrep";
     repo = finalAttrs.pname;
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1M/lchsrHG01C18GXfiIcclovdHKHrHMVsPvIJ+oB+M=";
+    hash = "sha256-hFweWZalWMGbGXhM6uxaGoWkr9srqxRChJo5yUBiBXs=";
   };
 
   cmakeFlags = lib.optionals stdenv.isi686 [
diff --git a/pkgs/applications/video/plex-media-player/default.nix b/pkgs/applications/video/plex-media-player/default.nix
index 34b6eb9c286..6a686d9d2c2 100644
--- a/pkgs/applications/video/plex-media-player/default.nix
+++ b/pkgs/applications/video/plex-media-player/default.nix
@@ -34,7 +34,9 @@ in mkDerivation rec {
     ln -s ${webClientTv} build/dependencies/web-client-tv-${webClientTvBuildId}.tar.xz
   '';
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=RelWithDebInfo" "-DQTROOT=${qtbase}" ];
+  cmakeBuildType = "RelWithDebInfo";
+
+  cmakeFlags = [ "-DQTROOT=${qtbase}" ];
 
   # plexmediaplayer currently segfaults under wayland
   qtWrapperArgs = [ "--set" "QT_QPA_PLATFORM" "xcb" ];
diff --git a/pkgs/applications/virtualization/cloud-hypervisor/default.nix b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
index 7e3c6d64546..7a0dc67dba2 100644
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@@ -37,7 +37,8 @@ rustPlatform.buildRustPackage rec {
   cargoTestFlags = [
     "--workspace"
     "--bins" "--lib" # Integration tests require root.
-    "--exclude" "net_util" # Tries to access /dev/net/tun
+    "--exclude" "net_util" # /dev/net/tun
+    "--exclude" "vmm"      # /dev/kvm
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix b/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
index 73db7f0353f..17f53883424 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-k+rG5AZjz47Q6bpVcTK7r4s7Avg3O+1iw+skK+cn0rk=";
   };
 
-  cmakeFlags = lib.optional debug "-DCMAKE_BUILD_TYPE=Debug";
+  cmakeBuildType = if debug then "Debug" else "Release";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/build-support/deterministic-uname/deterministic-uname.sh b/pkgs/build-support/deterministic-uname/deterministic-uname.sh
index 5272bb5b3fe..31772aeee3c 100644
--- a/pkgs/build-support/deterministic-uname/deterministic-uname.sh
+++ b/pkgs/build-support/deterministic-uname/deterministic-uname.sh
@@ -38,6 +38,10 @@ processor=0
 hardware_platform=0
 operating_system=0
 
+# With no OPTION, same as -s.
+if [[ $# -eq 0 ]]; then
+    kernel_name=1
+fi
 
 @getopt@/bin/getopt --test > /dev/null && rc=$? || rc=$?
 if [[ $rc -ne 4 ]]; then
@@ -54,11 +58,6 @@ else
   eval set -- "$PARSED"
 fi
 
-# With no OPTION, same as -s.
-if [[ $# -eq 0 ]]; then
-    kernel_name=1
-fi
-
 # Process each argument, and set the appropriate flag if we recognize it.
 while [[ $# -ge 1 ]]; do
   case "$1" in
@@ -132,44 +131,44 @@ fi
 #  Darwin *nodename* 22.1.0 Darwin Kernel Version 22.1.0: Sun Oct  9 20:14:30 PDT 2022; root:xnu-8792.41.9~2/RELEASE_ARM64_T8103 arm64 arm Darwin
 # NixOS:
 #  Linux *nodename* 6.0.13 #1-NixOS SMP PREEMPT_DYNAMIC Wed Dec 14 10:41:06 UTC 2022 x86_64 GNU/Linux
+output=()
 if [[ "$all" = "1" ]]; then
-    echo -n "$KERNEL_NAME_VAL $NODENAME_VAL $KERNEL_RELEASE_VAL $KERNEL_VERSION_VAL $MACHINE_VAL "
+    output+=("$KERNEL_NAME_VAL" "$NODENAME_VAL" "$KERNEL_RELEASE_VAL" "$KERNEL_VERSION_VAL" "$MACHINE_VAL")
     # in help:  except omit -p and -i if unknown.
-    #echo -n "$PROCESSOR_VAL $HARDWARE_PLATFORM_VAL\n"
-    echo -n "$OPERATING_SYSTEM_VAL"
+    # output+=($PROCESSOR_VAL $HARDWARE_PLATFORM_VAL)
+    output+=("$OPERATING_SYSTEM_VAL")
 fi
 
 if [[ "$kernel_name" = "1" ]]; then
-    echo -n "$KERNEL_NAME_VAL"
+    output+=("$KERNEL_NAME_VAL")
 fi
 
 if [[ "$nodename" = "1" ]]; then
-    echo -n "$NODENAME_VAL"
+    output+=("$NODENAME_VAL")
 fi
 
 if [[ "$kernel_release" = "1" ]]; then
-    echo -n "$KERNEL_RELEASE_VAL"
+    output+=("$KERNEL_RELEASE_VAL")
 fi
 
 if [[ "$kernel_version" = "1" ]]; then
-    echo -n "$KERNEL_VERSION_VAL"
+    output+=("$KERNEL_VERSION_VAL")
 fi
 
 if [[ "$machine" = "1" ]]; then
-    echo -n "$MACHINE_VAL"
+    output+=("$MACHINE_VAL")
 fi
 
 if [[ "$processor" = "1" ]]; then
-    echo -n "$PROCESSOR_VAL"
+    output+=("$PROCESSOR_VAL")
 fi
 
 if [[ "$hardware_platform" = "1" ]]; then
-    echo -n "$HARDWARE_PLATFORM_VAL"
+    output+=("$HARDWARE_PLATFORM_VAL")
 fi
 
 if [[ "$operating_system" = "1" ]]; then
-    echo -n "$OPERATING_SYSTEM_VAL"
+    output+=("$OPERATING_SYSTEM_VAL")
 fi
 
-# for newline.
-echo
+echo "${output[@]}"
diff --git a/pkgs/by-name/ou/outputcheck/package.nix b/pkgs/by-name/ou/outputcheck/package.nix
new file mode 100644
index 00000000000..22b033ea119
--- /dev/null
+++ b/pkgs/by-name/ou/outputcheck/package.nix
@@ -0,0 +1,52 @@
+{ lib
+, python3
+, fetchFromGitHub
+, lit
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "outputcheck";
+  version = "0.4.2";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "stp";
+    repo = "OutputCheck";
+    rev = "eab62a5dd5129f6a4ebfbe4bbe41d35611f7c48d";
+    hash = "sha256-0D5Lljn66jB/EW/ntC2eTuXAt0w0cceeeqf3aKuyeF0=";
+  };
+
+  # - Fix deprecated 'U' mode in python 3.11
+  #   https://github.com/python/cpython/blob/3.11/Doc/library/functions.rst?plain=1#L1386
+  # - Fix expected error and actual parser error mismatch
+  # - Fix version number cannot find error
+  postPatch = ''
+    substituteInPlace OutputCheck/Driver.py \
+      --replace "argparse.FileType('rU')" "argparse.FileType('r')"
+
+    substituteInPlace tests/invalid-regex-syntax.smt2 \
+      --replace "unbalanced parenthesis" "missing ), unterminated subpattern"
+
+    echo ${version} > RELEASE-VERSION
+  '';
+
+  nativeCheckInputs = [ lit ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    lit -v tests/
+
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [ "OutputCheck" ];
+
+  meta = with lib; {
+    description = "A tool for checking tool output inspired by LLVM's FileCheck";
+    homepage = "https://github.com/stp/OutputCheck";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fsagbuya ];
+    mainProgram = "OutputCheck";
+  };
+}
diff --git a/pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix b/pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix
index 6e9db943c91..46d6af5f24c 100644
--- a/pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix
+++ b/pkgs/data/themes/kwin-decorations/sierra-breeze-enhanced/default.nix
@@ -23,7 +23,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_PREFIX=$out"
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DBUILD_TESTING=OFF"
     "-DKDE_INSTALL_USE_QT_SYS_PATHS=ON"
   ];
diff --git a/pkgs/development/compilers/ldc/generic.nix b/pkgs/development/compilers/ldc/generic.nix
index f88f4484cfd..130dcecf120 100644
--- a/pkgs/development/compilers/ldc/generic.nix
+++ b/pkgs/development/compilers/ldc/generic.nix
@@ -68,7 +68,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DD_FLAGS=-d-version=TZDatabaseDir;-d-version=LibcurlPath;-J${pathConfig}"
-    "-DCMAKE_BUILD_TYPE=Release"
   ];
 
   postConfigure = ''
diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index 6f8ef0b5751..c4e6f2827e8 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -204,6 +204,8 @@ in stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -219,7 +221,6 @@ in stdenv.mkDerivation (rec {
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index a5078ef3b76..01e6483ad64 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -212,6 +212,8 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -227,7 +229,6 @@ in stdenv.mkDerivation (rec {
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index 3c724e07bd1..97d8f27672e 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -202,6 +202,8 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -217,7 +219,6 @@ in stdenv.mkDerivation (rec {
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index 827e528581c..2a7c1c1867c 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -164,6 +164,8 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -179,7 +181,6 @@ in stdenv.mkDerivation (rec {
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
index 06b54998352..081c84c04e0 100644
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@@ -162,6 +162,8 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -177,7 +179,6 @@ in stdenv.mkDerivation (rec {
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/compilers/llvm/15/llvm/default.nix b/pkgs/development/compilers/llvm/15/llvm/default.nix
index 7742fc0a186..e6f339ff6d6 100644
--- a/pkgs/development/compilers/llvm/15/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/15/llvm/default.nix
@@ -298,6 +298,8 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -313,7 +315,6 @@ in stdenv.mkDerivation (rec {
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/compilers/llvm/16/llvm/default.nix b/pkgs/development/compilers/llvm/16/llvm/default.nix
index 8e676f5ad46..c70f9d37a56 100644
--- a/pkgs/development/compilers/llvm/16/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/16/llvm/default.nix
@@ -286,6 +286,8 @@ in
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -301,7 +303,6 @@ in
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/compilers/llvm/5/llvm/default.nix b/pkgs/development/compilers/llvm/5/llvm/default.nix
index 219ae190e95..74523490244 100644
--- a/pkgs/development/compilers/llvm/5/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/5/llvm/default.nix
@@ -141,6 +141,8 @@ stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -156,7 +158,6 @@ stdenv.mkDerivation (rec {
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/compilers/llvm/6/llvm/default.nix b/pkgs/development/compilers/llvm/6/llvm/default.nix
index 1c75660c20f..72e43ba8d1f 100644
--- a/pkgs/development/compilers/llvm/6/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/6/llvm/default.nix
@@ -161,6 +161,8 @@ stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -176,7 +178,6 @@ stdenv.mkDerivation (rec {
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/compilers/llvm/7/llvm/default.nix b/pkgs/development/compilers/llvm/7/llvm/default.nix
index 7bfaef7d00b..97ac428a7f5 100644
--- a/pkgs/development/compilers/llvm/7/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/7/llvm/default.nix
@@ -179,6 +179,8 @@ in stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -194,7 +196,6 @@ in stdenv.mkDerivation (rec {
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index f95cefb9add..8a0fea85e26 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -178,6 +178,8 @@ in stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -193,7 +195,6 @@ in stdenv.mkDerivation (rec {
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index b7259ac1915..526030d6b34 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -193,6 +193,8 @@ in stdenv.mkDerivation (rec {
     ln -sv $PWD/lib $out
   '';
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -208,7 +210,6 @@ in stdenv.mkDerivation (rec {
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 634cd782953..66b0a7438ce 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -283,6 +283,8 @@ in stdenv.mkDerivation (rec {
   # E.g. mesa.drivers use the build-id as a cache key (see #93946):
   LDFLAGS = optionalString (enableSharedLibraries && !stdenv.isDarwin) "-Wl,--build-id=sha1";
 
+  cmakeBuildType = if debugVersion then "Debug" else "Release";
+
   cmakeFlags = with stdenv; let
     # These flags influence llvm-config's BuildVariables.inc in addition to the
     # general build. We need to make sure these are also passed via
@@ -298,7 +300,6 @@ in stdenv.mkDerivation (rec {
       "-DLLVM_LINK_LLVM_DYLIB=ON"
     ];
   in flagsForLlvmConfig ++ [
-    "-DCMAKE_BUILD_TYPE=${if debugVersion then "Debug" else "Release"}"
     "-DLLVM_INSTALL_UTILS=ON"  # Needed by rustc
     "-DLLVM_BUILD_TESTS=${if doCheck then "ON" else "OFF"}"
     "-DLLVM_ENABLE_FFI=ON"
diff --git a/pkgs/development/interpreters/python/hooks/default.nix b/pkgs/development/interpreters/python/hooks/default.nix
index 306c33a91fd..5deb3cf97b8 100644
--- a/pkgs/development/interpreters/python/hooks/default.nix
+++ b/pkgs/development/interpreters/python/hooks/default.nix
@@ -66,7 +66,19 @@ in {
   pypaBuildHook = callPackage ({ makePythonHook, build, wheel }:
     makePythonHook {
       name = "pypa-build-hook.sh";
-      propagatedBuildInputs = [ build wheel ];
+      propagatedBuildInputs = [ wheel ];
+      substitutions = {
+        inherit build;
+      };
+      # A test to ensure that this hook never propagates any of its dependencies
+      #   into the build environment.
+      # This prevents false positive alerts raised by catchConflictsHook.
+      # Such conflicts don't happen within the standard nixpkgs python package
+      #   set, but in downstream projects that build packages depending on other
+      #   versions of this hook's dependencies.
+      passthru.tests = import ./pypa-build-hook-tests.nix {
+        inherit pythonForBuild runCommand;
+      };
     } ./pypa-build-hook.sh) {
       inherit (pythonForBuild.pkgs) build;
     };
diff --git a/pkgs/development/interpreters/python/hooks/pypa-build-hook-test.nix b/pkgs/development/interpreters/python/hooks/pypa-build-hook-test.nix
new file mode 100644
index 00000000000..d909e34241f
--- /dev/null
+++ b/pkgs/development/interpreters/python/hooks/pypa-build-hook-test.nix
@@ -0,0 +1,32 @@
+{ pythonForBuild, runCommand }: {
+  dont-propagate-conflicting-deps = let
+    # customize a package so that its store paths differs
+    mkConflict = pkg: pkg.overrideAttrs { some_modification = true; };
+    # minimal pyproject.toml for the example project
+    pyprojectToml = builtins.toFile "pyproject.toml" ''
+      [project]
+      name = "my-project"
+      version = "1.0.0"
+    '';
+    # the source of the example project
+    projectSource = runCommand "my-project-source" {} ''
+      mkdir -p $out/src
+      cp ${pyprojectToml} $out/pyproject.toml
+      touch $out/src/__init__.py
+    '';
+    in
+    # this build must never triger conflicts
+    pythonForBuild.pkgs.buildPythonPackage {
+      pname = "dont-propagate-conflicting-deps";
+      version = "0.0.0";
+      src = projectSource;
+      format = "pyproject";
+      propagatedBuildInputs = [
+        # At least one dependency of `build` should be included here to
+        # keep the test meaningful
+        (mkConflict pythonForBuild.pkgs.tomli)
+        # setuptools is also needed to build the example project
+        pythonForBuild.pkgs.setuptools
+      ];
+    };
+}
diff --git a/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh b/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
index 5d77613bf56..dd49d935bce 100644
--- a/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/pypa-build-hook.sh
@@ -6,7 +6,7 @@ pypaBuildPhase() {
     runHook preBuild
 
     echo "Creating a wheel..."
-    pyproject-build --no-isolation --outdir dist/ --wheel $pypaBuildFlags
+    @build@/bin/pyproject-build --no-isolation --outdir dist/ --wheel $pypaBuildFlags
     echo "Finished creating a wheel..."
 
     runHook postBuild
diff --git a/pkgs/development/libraries/cracklib/default.nix b/pkgs/development/libraries/cracklib/default.nix
index 484af3337a0..ba5d96a9518 100644
--- a/pkgs/development/libraries/cracklib/default.nix
+++ b/pkgs/development/libraries/cracklib/default.nix
@@ -1,8 +1,8 @@
-let version = "2.9.8"; in
+let version = "2.9.11"; in
 { stdenv, lib, buildPackages, fetchurl, zlib, gettext
 , wordlists ? [ (fetchurl {
   url = "https://github.com/cracklib/cracklib/releases/download/v${version}/cracklib-words-${version}.gz";
-  hash = "sha256-WLOCTIDdO6kIsMytUdbhZx4woj/u1gf7jmORR2i8T4U=";
+  hash = "sha256-popxGjE1c517Z+nzYLM/DU7M+b1/rE0XwNXkVqkcUXo=";
 }) ]
 }:
 
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-H500OF6jqnzXwH+jiNwlgQrqnTwz4mDHE6Olhz1w44Y=";
+    hash = "sha256-yosEmjwtOyIloejRXWE3mOvHSOOVA4jtomlN5Qe6YCA=";
   };
 
   nativeBuildInputs = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) buildPackages.cracklib;
diff --git a/pkgs/development/libraries/ffmpeg/4.nix b/pkgs/development/libraries/ffmpeg/4.nix
index 6bd9a8b8f1a..8dc42dea247 100644
--- a/pkgs/development/libraries/ffmpeg/4.nix
+++ b/pkgs/development/libraries/ffmpeg/4.nix
@@ -7,5 +7,17 @@ import ./generic.nix {
       url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/031f1561cd286596cdb374da32f8aa816ce3b135";
       hash = "sha256-mSnmAkoNikDpxcN+A/hpB7mUbbtcMvm4tG6gZFuroe8=";
     }
+    # The upstream patch isn’t for ffmpeg 4, but it will apply with a few tweaks.
+    # Fixes a crash when built with clang 16 due to UB in ff_seek_frame_binary.
+    {
+      name = "utils-fix_crash_in_ff_seek_frame_binary.patch";
+      url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/ab792634197e364ca1bb194f9abe36836e42f12d";
+      hash = "sha256-UxZ4VneZpw+Q/UwkEUDNdb2nOx1QnMrZ40UagspNTxI=";
+      postFetch = ''
+        substituteInPlace "$out" \
+          --replace libavformat/seek.c libavformat/utils.c \
+          --replace 'const AVInputFormat *const ' 'const AVInputFormat *'
+      '';
+    }
   ];
 }
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 6bde5aa776b..31c93c52fb1 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -80,7 +80,7 @@
 , withSvtav1 ? withHeadlessDeps && !stdenv.isAarch64 # AV1 encoder/decoder (focused on speed and correctness)
 , withTensorflow ? false # Tensorflow dnn backend support
 , withTheora ? withHeadlessDeps # Theora encoder
-, withV4l2 ? withFullDeps && !stdenv.isDarwin # Video 4 Linux support
+, withV4l2 ? withHeadlessDeps && !stdenv.isDarwin # Video 4 Linux support
 , withV4l2M2m ? withV4l2
 , withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD) # Vaapi hardware acceleration
 , withVdpau ? withSmallDeps # Vdpau hardware acceleration
@@ -545,7 +545,10 @@ stdenv.mkDerivation (finalAttrs: {
   in
     "remove-references-to ${lib.concatStringsSep " " (map (o: "-t ${o}") toStrip)} config.h";
 
-  nativeBuildInputs = [ removeReferencesTo addOpenGLRunpath perl pkg-config texinfo yasm ];
+  strictDeps = true;
+
+  nativeBuildInputs = [ removeReferencesTo addOpenGLRunpath perl pkg-config texinfo yasm ]
+  ++ optionals withCudaLLVM [ clang ];
 
   # TODO This was always in buildInputs before, why?
   buildInputs = optionals withFullDeps [ libdc1394 ]
@@ -559,7 +562,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withBzlib [ bzip2 ]
   ++ optionals withCaca [ libcaca ]
   ++ optionals withCelt [ celt ]
-  ++ optionals withCudaLLVM [ clang ]
   ++ optionals withDav1d [ dav1d ]
   ++ optionals withDrm [ libdrm ]
   ++ optionals withFdkAac [ fdk_aac ]
diff --git a/pkgs/development/libraries/flatcc/default.nix b/pkgs/development/libraries/flatcc/default.nix
index a65ad5c6fe3..1f487955b3f 100644
--- a/pkgs/development/libraries/flatcc/default.nix
+++ b/pkgs/development/libraries/flatcc/default.nix
@@ -18,7 +18,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DFLATCC_INSTALL=on"
-    "-DCMAKE_BUILD_TYPE=Release"
   ];
 
   env.NIX_CFLAGS_COMPILE = toString [
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index a527faf5a8b..792f305a83b 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -24,6 +24,7 @@
 , gobject-introspection
 , buildPackages
 , withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, compileSchemas ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , fribidi
 , xorg
 , libepoxy
@@ -110,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
     gtk-doc
     # For xmllint
     libxml2
-  ] ++ lib.optionals (withIntrospection && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+  ] ++ lib.optionals ((withIntrospection || compileSchemas) && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     mesonEmulatorHook
   ] ++ lib.optionals waylandSupport [
     wayland-scanner
@@ -183,6 +184,10 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace meson.build \
       --replace "x11_enabled = false" ""
 
+    # this conditional gates the installation of share/gsettings-schemas/.../glib-2.0/schemas/gschemas.compiled.
+    substituteInPlace meson.build \
+      --replace 'if not meson.is_cross_build()' 'if ${lib.boolToString compileSchemas}'
+
     files=(
       build-aux/meson/post-install.py
       demos/gtk-demo/geninclude.py
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index b7e8c13ccca..0503ac199f9 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, buildPackages
 , substituteAll
 , fetchurl
 , pkg-config
@@ -7,6 +8,7 @@
 , graphene
 , gi-docgen
 , meson
+, mesonEmulatorHook
 , ninja
 , python3
 , makeWrapper
@@ -45,6 +47,7 @@
 , wayland-scanner
 , xineramaSupport ? stdenv.isLinux
 , cupsSupport ? stdenv.isLinux
+, compileSchemas ? stdenv.hostPlatform.emulatorAvailable buildPackages
 , cups
 , AppKit
 , Cocoa
@@ -99,6 +102,8 @@ stdenv.mkDerivation rec {
     sassc
     gi-docgen
     libxml2 # for xmllint
+  ] ++ lib.optionals (compileSchemas && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
   ] ++ lib.optionals waylandSupport [
     wayland-scanner
   ] ++ setupHooks;
@@ -190,6 +195,10 @@ stdenv.mkDerivation rec {
   };
 
   postPatch = ''
+    # this conditional gates the installation of share/gsettings-schemas/.../glib-2.0/schemas/gschemas.compiled.
+    substituteInPlace meson.build \
+      --replace 'if not meson.is_cross_build()' 'if ${lib.boolToString compileSchemas}'
+
     files=(
       build-aux/meson/gen-demo-header.py
       demos/gtk-demo/geninclude.py
diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index 4f3c956a440..f85ec4d96b3 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -29,11 +29,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "imlib2";
-  version = "1.11.1";
+  version = "1.12.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/enlightenment/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-9xK2u53K1G2Lj0rVJhDcu667TMgLX9EvkxJNOjgPpr8=";
+    hash = "sha256-lf9dTMF92fk0wuetFRw2DzCIgKCnhJpspDt8e5pLshY=";
   };
 
   buildInputs = [
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
     homepage = "https://docs.enlightenment.org/api/imlib2/html";
-    changelog = "https://git.enlightenment.org/legacy/imlib2.git/plain/ChangeLog?h=v${version}";
+    changelog = "https://git.enlightenment.org/old/legacy-imlib2/raw/tag/v${finalAttrs.version}/ChangeLog";
     license = licenses.imlib2;
     pkgConfigModules = [ "imlib2" ];
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/libavif/default.nix b/pkgs/development/libraries/libavif/default.nix
index 3042dad31e1..27aaef54643 100644
--- a/pkgs/development/libraries/libavif/default.nix
+++ b/pkgs/development/libraries/libavif/default.nix
@@ -19,13 +19,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libavif";
-  version = "0.11.1";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "AOMediaCodec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-mUi0DU99XV3FzUZ8/9uJZU+W3fc6Bk6+y6Z78IRZ9Qs=";
+    sha256 = "sha256-3zNhKl8REWsRlblXIFD7zn7qvrc/pa4wHZI0oEc3pKE=";
   };
 
   # reco: encode libaom slowest but best, decode dav1d fastest
diff --git a/pkgs/development/libraries/libbsd/darwin-fix-libbsd.sym.patch b/pkgs/development/libraries/libbsd/darwin-fix-libbsd.sym.patch
new file mode 100644
index 00000000000..de40da98162
--- /dev/null
+++ b/pkgs/development/libraries/libbsd/darwin-fix-libbsd.sym.patch
@@ -0,0 +1,15 @@
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 9d22b00..c6848fc 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -198,7 +198,9 @@ libbsd_ctor_a_SOURCES = \
+ # Generate a simple libtool symbol export list to be used as a fallback if
+ # there is no version script support.
+ libbsd.sym: libbsd.map
+-	$(AM_V_GEN) $(SED) -ne 's/^[[:space:]]\{1,\}\([A-Za-z0-9_]\{1,\}\);/\1/p' libbsd.map > $@
++	$(AM_V_GEN) $(SED) -ne 's/^[[:space:]]\{1,\}\([A-Za-z0-9_]\{1,\}\);/\1/p' libbsd.map \
++	  | grep -Ev '(group_from_gid|user_from_uid|nlist|__fdnlist|bsd_getopt)' \
++	  > $@
+ 
+ if NEED_TRANSPARENT_LIBMD
+ TRANSPARENT_LIBMD_DEPENDS = format.ld
diff --git a/pkgs/development/libraries/libbsd/darwin.patch b/pkgs/development/libraries/libbsd/darwin.patch
deleted file mode 100644
index c52c64f35ae..00000000000
--- a/pkgs/development/libraries/libbsd/darwin.patch
+++ /dev/null
@@ -1,309 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index 5b6d22b..98c449b 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -145,7 +145,7 @@ AS_CASE([$host_os],
- AM_CONDITIONAL([OS_WINDOWS], [test "x$is_windows" = "xyes"])
- 
- # Checks for header files.
--AC_CHECK_HEADERS([sys/ndir.h sys/dir.h ndir.h dirent.h pwd.h grp.h])
-+AC_CHECK_HEADERS([sys/ndir.h sys/dir.h ndir.h dirent.h pwd.h grp.h nlist.h])
- 
- # Checks for typedefs, structures, and compiler characteristics.
- AC_C_INLINE
-@@ -245,7 +245,9 @@ AC_LINK_IFELSE(
- 
- AC_CHECK_FUNCS([clearenv dirfd fopencookie __fpurge \
-                 getauxval getentropy getexecname getline \
--                pstat_getproc sysconf])
-+                pstat_getproc sysconf \
-+		strlcpy strlcat strnstr strmode fpurge \
-+		user_from_uid group_from_gid])
- AM_CONDITIONAL([HAVE_GETENTROPY], [test "x$ac_cv_func_getentropy" = "xtrue"])
- 
- AC_SUBST([MD5_LIBS])
-diff --git a/include/bsd/grp.h b/include/bsd/grp.h
-index b2705e5..c9423a2 100644
---- a/include/bsd/grp.h
-+++ b/include/bsd/grp.h
-@@ -44,8 +44,10 @@
- __BEGIN_DECLS
- int
- gid_from_group(const char *, gid_t *);
-+#if !HAVE_GROUP_FROM_GID
- const char *
- group_from_gid(gid_t, int);
-+#endif
- __END_DECLS
- 
- #endif
-diff --git a/include/bsd/pwd.h b/include/bsd/pwd.h
-index 798af4b..6ae5244 100644
---- a/include/bsd/pwd.h
-+++ b/include/bsd/pwd.h
-@@ -44,8 +44,10 @@
- __BEGIN_DECLS
- int
- uid_from_user(const char *, uid_t *);
-+#if !HAVE_USER_FROM_UID
- const char *
- user_from_uid(uid_t, int);
-+#endif
- __END_DECLS
- 
- #endif
-diff --git a/include/bsd/string.h b/include/bsd/string.h
-index f987fee..a1e17ed 100644
---- a/include/bsd/string.h
-+++ b/include/bsd/string.h
-@@ -41,10 +41,21 @@
- #include <sys/types.h>
- 
- __BEGIN_DECLS
-+#if !HAVE_STRLCPY
- size_t strlcpy(char *dst, const char *src, size_t siz);
-+#endif
-+
-+#if !HAVE_STRLCAT
- size_t strlcat(char *dst, const char *src, size_t siz);
-+#endif
-+
-+#if !HAVE_STRNSTR
- char *strnstr(const char *str, const char *find, size_t str_len);
-+#endif
-+
-+#if !HAVE_STRMODE
- void strmode(mode_t mode, char *str);
-+#endif
- 
- #if !defined(__GLIBC__) || \
-     (defined(__GLIBC__) && (!__GLIBC_PREREQ(2, 25) || !defined(_GNU_SOURCE)))
-diff --git a/src/fpurge.c b/src/fpurge.c
-index 350f364..ff7f01e 100644
---- a/src/fpurge.c
-+++ b/src/fpurge.c
-@@ -26,9 +26,10 @@
- 
- #include <errno.h>
- #include <stdio.h>
--#include <stdio_ext.h>
- 
- #ifdef HAVE___FPURGE
-+#include <stdio_ext.h>
-+
- int
- fpurge(FILE *fp)
- {
-@@ -41,6 +42,36 @@ fpurge(FILE *fp)
- 
- 	return 0;
- }
-+/* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin 1.7 */
-+#elif HAVE_FPURGE
-+int
-+fpurge(FILE *fp)
-+{
-+	if (fp == NULL || fileno(fp) < 0) {
-+		errno = EBADF;
-+		return EOF;
-+	}
-+
-+  /* Call the system's fpurge function.  */
-+#undef fpurge
-+#if !HAVE_DECL_FPURGE
-+  extern int fpurge (FILE *);
-+#endif
-+  int result = fpurge (fp);
-+/* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin */
-+#if defined(__sferror) || defined(__DragonFly__)
-+  if (result == 0)
-+    /* Correct the invariants that fpurge broke.
-+       <stdio.h> on BSD systems says:
-+         "The following always hold: if _flags & __SRD, _w is 0."
-+       If this invariant is not fulfilled and the stream is read-write but
-+       currently reading, subsequent putc or fputc calls will write directly
-+       into the buffer, although they shouldn't be allowed to.  */
-+    if ((fp->_flags & __SRD) != 0)
-+      fp->_w = 0;
-+#endif
-+  return result;
-+}
- #else
- #error "Function fpurge() needs to be ported."
- #endif
-diff --git a/src/funopen.c b/src/funopen.c
-index 1e6f43a..3a3af6a 100644
---- a/src/funopen.c
-+++ b/src/funopen.c
-@@ -143,6 +143,7 @@ funopen(const void *cookie,
-  * they will not add the needed support to implement it. Just ignore this
-  * interface there, as it has never been provided anyway.
-  */
-+#elif defined(__MACH__)
- #else
- #error "Function funopen() needs to be ported or disabled."
- #endif
-diff --git a/src/local-link.h b/src/local-link.h
-index 6782d9a..fb76098 100644
---- a/src/local-link.h
-+++ b/src/local-link.h
-@@ -29,6 +29,12 @@
- 
- #include <sys/cdefs.h>
- 
-+#ifdef __MACH__
-+#define libbsd_link_warning(symbol, msg)
-+#define libbsd_symver_default(alias, symbol, version)
-+#define libbsd_symver_variant(alias, symbol, version)
-+#define libbsd_symver_weak(alias, symbol, version)
-+#else
- #define libbsd_link_warning(symbol, msg) \
- 	static const char libbsd_emit_link_warning_##symbol[] \
- 		__attribute__((__used__,__section__(".gnu.warning." #symbol))) = msg
-@@ -68,3 +74,4 @@
- #endif
- 
- #endif
-+#endif
-diff --git a/src/nlist.c b/src/nlist.c
-index 1cb9d18..b476f1e 100644
---- a/src/nlist.c
-+++ b/src/nlist.c
-@@ -41,6 +41,7 @@
- #include <unistd.h>
- #include <nlist.h>
- 
-+#if !HAVE_NLIST_H
- #include "local-elf.h"
- 
- /* Note: This function is used by libkvm0, so we need to export it.
-@@ -277,3 +278,4 @@ nlist(const char *name, struct nlist *list)
- 	(void)close(fd);
- 	return (n);
- }
-+#endif
-diff --git a/src/pwcache.c b/src/pwcache.c
-index d54daa0..74fde9f 100644
---- a/src/pwcache.c
-+++ b/src/pwcache.c
-@@ -191,6 +191,7 @@ grptb_start(void)
- 	return 0;
- }
- 
-+#if !HAVE_USER_FROM_UID
- /*
-  * user_from_uid()
-  *	caches the name (if any) for the uid. If noname clear, we always
-@@ -251,7 +252,9 @@ user_from_uid(uid_t uid, int noname)
- 	}
- 	return ptr->name;
- }
-+#endif
- 
-+#if !HAVE_USER_FROM_UID
- /*
-  * group_from_gid()
-  *	caches the name (if any) for the gid. If noname clear, we always
-@@ -312,6 +315,7 @@ group_from_gid(gid_t gid, int noname)
- 	}
- 	return ptr->name;
- }
-+#endif
- 
- /*
-  * uid_from_user()
-diff --git a/src/readpassphrase.c b/src/readpassphrase.c
-index f9f6195..2bc5fb4 100644
---- a/src/readpassphrase.c
-+++ b/src/readpassphrase.c
-@@ -36,6 +36,14 @@
- #define TCSASOFT 0
- #endif
- 
-+#ifndef _SIGMAX
-+#define	_SIGMAX	64
-+#endif
-+
-+#ifndef _NSIG
-+#define _NSIG (_SIGMAX + 1)
-+#endif
-+
- static volatile sig_atomic_t signo[_NSIG];
- 
- static void handler(int);
-diff --git a/src/setproctitle.c b/src/setproctitle.c
-index d3e1087..0e5f64c 100644
---- a/src/setproctitle.c
-+++ b/src/setproctitle.c
-@@ -33,6 +33,10 @@
- #include <string.h>
- #include "local-link.h"
- 
-+#ifdef __MACH__
-+extern char **environ;
-+#endif
-+
- static struct {
- 	/* Original value. */
- 	const char *arg0;
-@@ -291,7 +295,8 @@ libbsd_symver_default(setproctitle, setproctitle_impl, LIBBSD_0.5);
-  * in 0.5, make the implementation available in the old version as an alias
-  * for code linking against that version, and change the default to use the
-  * new version, so that new code depends on the implemented version. */
--#ifdef HAVE_TYPEOF
-+#ifdef __MACH__
-+#elif defined(HAVE_TYPEOF)
- extern __typeof__(setproctitle_impl)
- setproctitle_stub
- 	__attribute__((__alias__("setproctitle_impl")));
-diff --git a/src/strlcat.c b/src/strlcat.c
-index 14c53a1..5961c17 100644
---- a/src/strlcat.c
-+++ b/src/strlcat.c
-@@ -26,6 +26,7 @@
-  * Returns strlen(src) + MIN(dsize, strlen(initial dst)).
-  * If retval >= dsize, truncation occurred.
-  */
-+#if !HAVE_STRLCAT
- size_t
- strlcat(char *dst, const char *src, size_t dsize)
- {
-@@ -53,3 +54,4 @@ strlcat(char *dst, const char *src, size_t dsize)
- 
- 	return(dlen + (src - osrc));	/* count does not include NUL */
- }
-+#endif
-diff --git a/src/strlcpy.c b/src/strlcpy.c
-index e9a7fe4..5137acb 100644
---- a/src/strlcpy.c
-+++ b/src/strlcpy.c
-@@ -24,6 +24,7 @@
-  * chars will be copied.  Always NUL terminates (unless dsize == 0).
-  * Returns strlen(src); if retval >= dsize, truncation occurred.
-  */
-+#if !HAVE_STRLCPY
- size_t
- strlcpy(char *dst, const char *src, size_t dsize)
- {
-@@ -48,3 +49,4 @@ strlcpy(char *dst, const char *src, size_t dsize)
- 
- 	return(src - osrc - 1);	/* count does not include NUL */
- }
-+#endif
-diff --git a/src/strmode.c b/src/strmode.c
-index e6afde5..da680c9 100644
---- a/src/strmode.c
-+++ b/src/strmode.c
-@@ -32,6 +32,7 @@
- #include <sys/stat.h>
- #include <string.h>
- 
-+#if !HAVE_STRMODE
- void
- strmode(mode_t mode, char *p)
- {
-@@ -141,3 +142,4 @@ strmode(mode_t mode, char *p)
- 	*p++ = ' ';		/* will be a '+' if ACL's implemented */
- 	*p = '\0';
- }
-+#endif
diff --git a/pkgs/development/libraries/libbsd/default.nix b/pkgs/development/libraries/libbsd/default.nix
index 0c8040010e7..5943d697f6f 100644
--- a/pkgs/development/libraries/libbsd/default.nix
+++ b/pkgs/development/libraries/libbsd/default.nix
@@ -1,28 +1,53 @@
 { lib
 , stdenv
-, fetchurl
+, fetchFromGitLab
+, fetchpatch
 , autoreconfHook
 , libmd
 , gitUpdater
 }:
 
-stdenv.mkDerivation rec {
+# Run `./get-version` for the new value when bumping the Git revision.
+let gitVersion = "0.11.7-55-g73b2"; in
+
+stdenv.mkDerivation {
   pname = "libbsd";
-  version = "0.11.7";
+  version = "unstable-2023-04-29";
 
-  src = fetchurl {
-    url = "https://libbsd.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    hash = "sha256-m6oYYFnrvyXAYwjp+ZH9ox9xg8DySTGCbYOqar2KAmE=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "libbsd";
+    repo = "libbsd";
+    rev = "73b25a8f871b3a20f6ff76679358540f95d7dbfd";
+    hash = "sha256-LS28taIMjRCl6xqg75eYOIrTDl8PzSa+OvrdiEOP1+U=";
   };
 
   outputs = [ "out" "dev" "man" ];
 
-  # darwin changes configure.ac which means we need to regenerate
-  # the configure scripts
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
   nativeBuildInputs = [ autoreconfHook ];
   propagatedBuildInputs = [ libmd ];
 
-  patches = [ ./darwin.patch ];
+  patches = [
+    # Fix `{get,set}progname(3bsd)` conditionalization
+    # https://gitlab.freedesktop.org/libbsd/libbsd/-/issues/24
+    (fetchpatch {
+      url = "https://github.com/emilazy/libbsd/commit/0381f8d92873c5a19ced3ff861ee8ffe7825953e.patch";
+      hash = "sha256-+RMg5eHLgC4gyX9zXM0ttNf7rd9E3UzJX/7UVCYGXx4=";
+    })
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Temporary build system hack from upstream maintainer
+    # https://gitlab.freedesktop.org/libbsd/libbsd/-/issues/19#note_2017684
+    ./darwin-fix-libbsd.sym.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace configure.ac \
+      --replace 'm4_esyscmd([./get-version])' '[${gitVersion}]'
+  '';
 
   passthru.updateScript = gitUpdater {
     # No nicer place to find latest release.
@@ -33,7 +58,7 @@ stdenv.mkDerivation rec {
     description = "Common functions found on BSD systems";
     homepage = "https://libbsd.freedesktop.org/";
     license = with licenses; [ beerware bsd2 bsd3 bsdOriginal isc mit ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ matthewbauer ];
   };
 }
diff --git a/pkgs/development/libraries/libhwy/default.nix b/pkgs/development/libraries/libhwy/default.nix
index 4373f747433..b2f32cbe725 100644
--- a/pkgs/development/libraries/libhwy/default.nix
+++ b/pkgs/development/libraries/libhwy/default.nix
@@ -1,23 +1,21 @@
-{ lib, stdenv, cmake, ninja, gtest, fetchFromGitHub, fetchpatch }:
+{ lib
+, stdenv
+, cmake
+, ninja
+, gtest
+, fetchFromGitHub
+}:
 
 stdenv.mkDerivation rec {
   pname = "libhwy";
-  version = "1.0.5";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "highway";
     rev = version;
-    hash = "sha256-Gym2iHq5ws9kuG4HWSQndD8hVugV4USZt6dUFnEkLwY=";
+    hash = "sha256-Z+mAR9nSAbCskUvo6oK79Yd85bu0HtI2aR5THS1EozM=";
   };
-  patches = [
-    # backport for compilation issue on aarch64
-    # https://github.com/google/highway/issues/1613
-    (fetchpatch {
-      url = "https://github.com/google/highway/commit/7ad89efa911cb906ccf3f78fe510db415e921801.diff";
-      hash = "sha256-hTSkeCh2QLMqeIKG/CAqJXaPqD/66Z02gjGXk591f+U=";
-    })
-  ];
 
   nativeBuildInputs = [ cmake ninja ];
 
@@ -53,7 +51,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Performance-portable, length-agnostic SIMD with runtime dispatch";
     homepage = "https://github.com/google/highway";
-    license = licenses.asl20;
+    license = with licenses; [ asl20 bsd3 ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ zhaofengli ];
   };
diff --git a/pkgs/development/libraries/libimagequant/Cargo.lock b/pkgs/development/libraries/libimagequant/Cargo.lock
index d85dfcde626..8823a070b81 100644
--- a/pkgs/development/libraries/libimagequant/Cargo.lock
+++ b/pkgs/development/libraries/libimagequant/Cargo.lock
@@ -21,9 +21,9 @@ dependencies = [
 
 [[package]]
 name = "arrayvec"
-version = "0.7.2"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8da52d66c7071e2e3fa2a1e5c6d088fec47b593032b254f5e980de8ea54454d6"
+checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
 
 [[package]]
 name = "autocfg"
@@ -33,15 +33,15 @@ checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
 name = "bitflags"
-version = "1.3.2"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
 
 [[package]]
 name = "bytemuck"
-version = "1.13.1"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17febce684fd15d89027105661fec94afb475cb995fbc59d2865198446ba2eea"
+checksum = "374d28ec25809ee0e23827c2ab573d729e293f281dfe393500e7ad618baa61c6"
 
 [[package]]
 name = "c_test"
@@ -53,9 +53,12 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.79"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "cfg-if"
@@ -95,9 +98,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.14"
+version = "0.9.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46bd5f3f85273295a9d14aedfb86f6aadbff6d8f5295c4a9edb08e819dcf5695"
+checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
 dependencies = [
  "autocfg",
  "cfg-if",
@@ -108,33 +111,33 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.15"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c063cd8cc95f5c377ed0d4b49a4b21f632396ff690e8470c29b3359b346984b"
+checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "either"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 
 [[package]]
 name = "fallible_collections"
-version = "0.4.7"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9acf77205554f3cfeca94a4b910e159ad9824e8c2d164de02b3f12495cc1074d"
+checksum = "a88c69768c0a15262df21899142bc6df9b9b823546d4b4b9a7bc2d6c448ec6fd"
 dependencies = [
  "hashbrown",
 ]
 
 [[package]]
 name = "flate2"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b9429470923de8e8cbd4d2dc513535400b4b3fef0319fb5c4e1f520a7bef743"
+checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -151,16 +154,13 @@ dependencies = [
 
 [[package]]
 name = "hermit-abi"
-version = "0.2.6"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
-dependencies = [
- "libc",
-]
+checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
 
 [[package]]
 name = "imagequant"
-version = "4.2.0"
+version = "4.2.1"
 dependencies = [
  "arrayvec",
  "lodepng",
@@ -173,7 +173,7 @@ dependencies = [
 
 [[package]]
 name = "imagequant-sys"
-version = "4.0.1"
+version = "4.0.2"
 dependencies = [
  "bitflags",
  "imagequant",
@@ -182,9 +182,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.142"
+version = "0.2.147"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a987beff54b60ffa6d51982e1aa1146bc42f19bd26be28b0586f252fccf5317"
+checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
 
 [[package]]
 name = "lodepng"
@@ -201,9 +201,9 @@ dependencies = [
 
 [[package]]
 name = "memoffset"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d61c719bcfbcf5d62b3a09efa6088de8c54bc0bfcd3ea7ae39fcc186108b8de1"
+checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
 dependencies = [
  "autocfg",
 ]
@@ -219,9 +219,9 @@ dependencies = [
 
 [[package]]
 name = "num_cpus"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
  "hermit-abi",
  "libc",
@@ -229,9 +229,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.17.1"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "rayon"
@@ -266,9 +266,9 @@ dependencies = [
 
 [[package]]
 name = "scopeguard"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "thread_local"
diff --git a/pkgs/development/libraries/libimagequant/default.nix b/pkgs/development/libraries/libimagequant/default.nix
index 08893611507..9041b373edf 100644
--- a/pkgs/development/libraries/libimagequant/default.nix
+++ b/pkgs/development/libraries/libimagequant/default.nix
@@ -5,13 +5,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "libimagequant";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
     repo = pname;
     rev = version;
-    hash = "sha256-51xTCymZKLuw1Xeje6EyKqHdbmqBV1Fdhx+OsO3bZ6Q=";
+    hash = "sha256-a5TztgNFRV9BVERpHI33ZEYwfOR46F9FzmbquzwGq3k=";
   };
 
   cargoLock = {
diff --git a/pkgs/development/libraries/libksba/default.nix b/pkgs/development/libraries/libksba/default.nix
index d7f5aa24c15..9b1716ecc6d 100644
--- a/pkgs/development/libraries/libksba/default.nix
+++ b/pkgs/development/libraries/libksba/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libksba";
-  version = "1.6.3";
+  version = "1.6.4";
 
   src = fetchurl {
     url = "mirror://gnupg/libksba/libksba-${version}.tar.bz2";
-    hash = "sha256-P3LGjbMJceu/FDZ1J3GUI/Ck1fgQP8n0ocAan6RA3lw=";
+    hash = "sha256-u7Q/AyuRZNhseB/+QiE6g79PL+6RRV7fpGVFIbiwO2s=";
   };
 
   outputs = [ "out" "dev" "info" ];
diff --git a/pkgs/development/libraries/libmd/default.nix b/pkgs/development/libraries/libmd/default.nix
index ad3d8f0cce4..bf156fb1c55 100644
--- a/pkgs/development/libraries/libmd/default.nix
+++ b/pkgs/development/libraries/libmd/default.nix
@@ -1,35 +1,30 @@
 { lib, stdenv, fetchurl, fetchpatch, autoreconfHook }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libmd";
-  version = "1.0.4";
+  version = "1.1.0";
 
   src = fetchurl {
     urls = [
-      "https://archive.hadrons.org/software/libmd/libmd-${version}.tar.xz"
-      "https://libbsd.freedesktop.org/releases/libmd-${version}.tar.xz"
+      "https://archive.hadrons.org/software/libmd/libmd-${finalAttrs.version}.tar.xz"
+      "https://libbsd.freedesktop.org/releases/libmd-${finalAttrs.version}.tar.xz"
     ];
-    sha256 = "sha256-9RySEELjS+3e3tS3VVdlZVnPWx8kSAM7TB7sEcB+Uw8=";
+    sha256 = "sha256-G9aqQidTE68xQcfPLluWTosf1IgCXK8vlx9DsAd2szI=";
   };
 
-  patches = [
-    # Drop aliases for SHA384 functions, because such aliases are not supported on Darwin.
-    (fetchpatch {
-      url = "https://github.com/macports/macports-ports/raw/8332f5dbcaf05a02bc31fbd4ccf735e7d5c9a5b0/devel/libmd/files/patch-symbol-alias.diff";
-      sha256 = "sha256-py5hMpKYKwtBzhWn01lFc2a6+OZN72YCYXyhg1qe6rg=";
-      extraPrefix = "";
-    })
-  ];
+  enableParallelBuilding = true;
+
+  doCheck = true;
 
   nativeBuildInputs = [ autoreconfHook ];
 
   meta = with lib; {
-    homepage = "https://www.hadrons.org/software/${pname}/";
-    changelog = "https://archive.hadrons.org/software/libmd/libmd-${version}.announce";
+    homepage = "https://www.hadrons.org/software/libmd/";
+    changelog = "https://archive.hadrons.org/software/libmd/libmd-${finalAttrs.version}.announce";
     # Git: https://git.hadrons.org/cgit/libmd.git
     description = "Message Digest functions from BSD systems";
     license = with licenses; [ bsd3 bsd2 isc beerware publicDomain ];
     maintainers = with maintainers; [ primeos ];
     platforms = platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/libraries/libmodplug/default.nix b/pkgs/development/libraries/libmodplug/default.nix
index 69c36dc718c..334dfa9d801 100644
--- a/pkgs/development/libraries/libmodplug/default.nix
+++ b/pkgs/development/libraries/libmodplug/default.nix
@@ -9,6 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "1pnri98a603xk47smnxr551svbmgbzcw018mq1k6srbrq6kaaz25";
   };
 
+  # Unfortunately, upstream appears inactive and the patches from the fork don’t apply cleanly.
+  # Modify `src/fastmix.cpp` to remove usage of the register storage class, which is
+  # not allowed in C++17 and is an error in clang 16.
+  prePatch = "substituteInPlace src/fastmix.cpp --replace 'register ' ''";
+
   outputs = [ "out" "dev" ];
 
   preConfigure = ''
diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix
index b757d20b71d..f8ae5b828c2 100644
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/development/libraries/libpng/default.nix
@@ -3,20 +3,20 @@
 assert zlib != null;
 
 let
-  patchVersion = "1.6.39";
+  patchVersion = "1.6.40";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
-    hash = "sha256-SsS26roAzeISxI22XLlCkQc/68oixcef2ocJFQLoDP0=";
+    hash = "sha256-CjykZIKTjY1sciZivtLH7gxlobViRESzztIa2NNW2y8=";
   };
   whenPatched = lib.optionalString apngSupport;
 
 in stdenv.mkDerivation rec {
   pname = "libpng" + whenPatched "-apng";
-  version = "1.6.39";
+  version = "1.6.40";
 
   src = fetchurl {
     url = "mirror://sourceforge/libpng/libpng-${version}.tar.xz";
-    hash = "sha256-H0aWznC07l+F8eFiPcEimyEAKfpLeu5XPfPiunsDaTc=";
+    hash = "sha256-U1tHmyRn/yMaPsbZKlJZBvuO8nl4vk9m2+BdPzoBs6E=";
   };
   postPatch = whenPatched "gunzip < ${patch_src} | patch -Np1";
 
@@ -32,7 +32,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "The official reference implementation for the PNG file format" + whenPatched " with animation patch";
     homepage = "http://www.libpng.org/pub/png/libpng.html";
-    changelog = "https://github.com/glennrp/libpng/blob/v1.6.39/CHANGES";
+    changelog = "https://github.com/glennrp/libpng/blob/v1.6.40/CHANGES";
     license = licenses.libpng2;
     platforms = platforms.all;
     maintainers = with maintainers; [ vcunat ];
diff --git a/pkgs/development/libraries/libwebp/CVE-2023-4863.patch b/pkgs/development/libraries/libwebp/CVE-2023-4863.patch
deleted file mode 100644
index c01b8a48667..00000000000
--- a/pkgs/development/libraries/libwebp/CVE-2023-4863.patch
+++ /dev/null
@@ -1,361 +0,0 @@
-From 4de93ac70c3292fc944e4587101a52a29f8b0c9c Mon Sep 17 00:00:00 2001
-From: Vincent Rabaud <vrabaud@google.com>
-Date: Thu, 7 Sep 2023 21:16:03 +0200
-Subject: [PATCH] Fix OOB write in BuildHuffmanTable.
-
-First, BuildHuffmanTable is called to check if the data is valid.
-If it is and the table is not big enough, more memory is allocated.
-
-This will make sure that valid (but unoptimized because of unbalanced
-codes) streams are still decodable.
-
-Bug: chromium:1479274
-Change-Id: I31c36dbf3aa78d35ecf38706b50464fd3d375741
-(cherry picked from commit 902bc9190331343b2017211debcec8d2ab87e17a)
----
- src/dec/vp8l_dec.c        | 46 ++++++++++---------
- src/dec/vp8li_dec.h       |  2 +-
- src/utils/huffman_utils.c | 97 +++++++++++++++++++++++++++++++--------
- src/utils/huffman_utils.h | 27 +++++++++--
- 4 files changed, 129 insertions(+), 43 deletions(-)
-
-diff --git a/src/dec/vp8l_dec.c b/src/dec/vp8l_dec.c
-index c0ea0181..7995313f 100644
---- a/src/dec/vp8l_dec.c
-+++ b/src/dec/vp8l_dec.c
-@@ -253,11 +253,11 @@ static int ReadHuffmanCodeLengths(
-   int symbol;
-   int max_symbol;
-   int prev_code_len = DEFAULT_CODE_LENGTH;
--  HuffmanCode table[1 << LENGTHS_TABLE_BITS];
-+  HuffmanTables tables;
- 
--  if (!VP8LBuildHuffmanTable(table, LENGTHS_TABLE_BITS,
--                             code_length_code_lengths,
--                             NUM_CODE_LENGTH_CODES)) {
-+  if (!VP8LHuffmanTablesAllocate(1 << LENGTHS_TABLE_BITS, &tables) ||
-+      !VP8LBuildHuffmanTable(&tables, LENGTHS_TABLE_BITS,
-+                             code_length_code_lengths, NUM_CODE_LENGTH_CODES)) {
-     goto End;
-   }
- 
-@@ -277,7 +277,7 @@ static int ReadHuffmanCodeLengths(
-     int code_len;
-     if (max_symbol-- == 0) break;
-     VP8LFillBitWindow(br);
--    p = &table[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK];
-+    p = &tables.curr_segment->start[VP8LPrefetchBits(br) & LENGTHS_TABLE_MASK];
-     VP8LSetBitPos(br, br->bit_pos_ + p->bits);
-     code_len = p->value;
-     if (code_len < kCodeLengthLiterals) {
-@@ -300,6 +300,7 @@ static int ReadHuffmanCodeLengths(
-   ok = 1;
- 
-  End:
-+  VP8LHuffmanTablesDeallocate(&tables);
-   if (!ok) dec->status_ = VP8_STATUS_BITSTREAM_ERROR;
-   return ok;
- }
-@@ -307,7 +308,8 @@ static int ReadHuffmanCodeLengths(
- // 'code_lengths' is pre-allocated temporary buffer, used for creating Huffman
- // tree.
- static int ReadHuffmanCode(int alphabet_size, VP8LDecoder* const dec,
--                           int* const code_lengths, HuffmanCode* const table) {
-+                           int* const code_lengths,
-+                           HuffmanTables* const table) {
-   int ok = 0;
-   int size = 0;
-   VP8LBitReader* const br = &dec->br_;
-@@ -362,8 +364,7 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
-   VP8LMetadata* const hdr = &dec->hdr_;
-   uint32_t* huffman_image = NULL;
-   HTreeGroup* htree_groups = NULL;
--  HuffmanCode* huffman_tables = NULL;
--  HuffmanCode* huffman_table = NULL;
-+  HuffmanTables* huffman_tables = &hdr->huffman_tables_;
-   int num_htree_groups = 1;
-   int num_htree_groups_max = 1;
-   int max_alphabet_size = 0;
-@@ -372,6 +373,10 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
-   int* mapping = NULL;
-   int ok = 0;
- 
-+  // Check the table has been 0 initialized (through InitMetadata).
-+  assert(huffman_tables->root.start == NULL);
-+  assert(huffman_tables->curr_segment == NULL);
-+
-   if (allow_recursion && VP8LReadBits(br, 1)) {
-     // use meta Huffman codes.
-     const int huffman_precision = VP8LReadBits(br, 3) + 2;
-@@ -434,16 +439,15 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
- 
-   code_lengths = (int*)WebPSafeCalloc((uint64_t)max_alphabet_size,
-                                       sizeof(*code_lengths));
--  huffman_tables = (HuffmanCode*)WebPSafeMalloc(num_htree_groups * table_size,
--                                                sizeof(*huffman_tables));
-   htree_groups = VP8LHtreeGroupsNew(num_htree_groups);
- 
--  if (htree_groups == NULL || code_lengths == NULL || huffman_tables == NULL) {
-+  if (htree_groups == NULL || code_lengths == NULL ||
-+      !VP8LHuffmanTablesAllocate(num_htree_groups * table_size,
-+                                 huffman_tables)) {
-     dec->status_ = VP8_STATUS_OUT_OF_MEMORY;
-     goto Error;
-   }
- 
--  huffman_table = huffman_tables;
-   for (i = 0; i < num_htree_groups_max; ++i) {
-     // If the index "i" is unused in the Huffman image, just make sure the
-     // coefficients are valid but do not store them.
-@@ -468,19 +472,20 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
-       int max_bits = 0;
-       for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; ++j) {
-         int alphabet_size = kAlphabetSize[j];
--        htrees[j] = huffman_table;
-         if (j == 0 && color_cache_bits > 0) {
-           alphabet_size += (1 << color_cache_bits);
-         }
--        size = ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_table);
-+        size =
-+            ReadHuffmanCode(alphabet_size, dec, code_lengths, huffman_tables);
-+        htrees[j] = huffman_tables->curr_segment->curr_table;
-         if (size == 0) {
-           goto Error;
-         }
-         if (is_trivial_literal && kLiteralMap[j] == 1) {
--          is_trivial_literal = (huffman_table->bits == 0);
-+          is_trivial_literal = (htrees[j]->bits == 0);
-         }
--        total_size += huffman_table->bits;
--        huffman_table += size;
-+        total_size += htrees[j]->bits;
-+        huffman_tables->curr_segment->curr_table += size;
-         if (j <= ALPHA) {
-           int local_max_bits = code_lengths[0];
-           int k;
-@@ -515,14 +520,13 @@ static int ReadHuffmanCodes(VP8LDecoder* const dec, int xsize, int ysize,
-   hdr->huffman_image_ = huffman_image;
-   hdr->num_htree_groups_ = num_htree_groups;
-   hdr->htree_groups_ = htree_groups;
--  hdr->huffman_tables_ = huffman_tables;
- 
-  Error:
-   WebPSafeFree(code_lengths);
-   WebPSafeFree(mapping);
-   if (!ok) {
-     WebPSafeFree(huffman_image);
--    WebPSafeFree(huffman_tables);
-+    VP8LHuffmanTablesDeallocate(huffman_tables);
-     VP8LHtreeGroupsFree(htree_groups);
-   }
-   return ok;
-@@ -1358,7 +1362,7 @@ static void ClearMetadata(VP8LMetadata* const hdr) {
-   assert(hdr != NULL);
- 
-   WebPSafeFree(hdr->huffman_image_);
--  WebPSafeFree(hdr->huffman_tables_);
-+  VP8LHuffmanTablesDeallocate(&hdr->huffman_tables_);
-   VP8LHtreeGroupsFree(hdr->htree_groups_);
-   VP8LColorCacheClear(&hdr->color_cache_);
-   VP8LColorCacheClear(&hdr->saved_color_cache_);
-@@ -1673,7 +1677,7 @@ int VP8LDecodeImage(VP8LDecoder* const dec) {
- 
-   if (dec == NULL) return 0;
- 
--  assert(dec->hdr_.huffman_tables_ != NULL);
-+  assert(dec->hdr_.huffman_tables_.root.start != NULL);
-   assert(dec->hdr_.htree_groups_ != NULL);
-   assert(dec->hdr_.num_htree_groups_ > 0);
- 
-diff --git a/src/dec/vp8li_dec.h b/src/dec/vp8li_dec.h
-index 72b2e861..32540a4b 100644
---- a/src/dec/vp8li_dec.h
-+++ b/src/dec/vp8li_dec.h
-@@ -51,7 +51,7 @@ typedef struct {
-   uint32_t*       huffman_image_;
-   int             num_htree_groups_;
-   HTreeGroup*     htree_groups_;
--  HuffmanCode*    huffman_tables_;
-+  HuffmanTables   huffman_tables_;
- } VP8LMetadata;
- 
- typedef struct VP8LDecoder VP8LDecoder;
-diff --git a/src/utils/huffman_utils.c b/src/utils/huffman_utils.c
-index 90c2fbf7..cf73abd4 100644
---- a/src/utils/huffman_utils.c
-+++ b/src/utils/huffman_utils.c
-@@ -177,21 +177,24 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
-       if (num_open < 0) {
-         return 0;
-       }
--      if (root_table == NULL) continue;
-       for (; count[len] > 0; --count[len]) {
-         HuffmanCode code;
-         if ((key & mask) != low) {
--          table += table_size;
-+          if (root_table != NULL) table += table_size;
-           table_bits = NextTableBitSize(count, len, root_bits);
-           table_size = 1 << table_bits;
-           total_size += table_size;
-           low = key & mask;
--          root_table[low].bits = (uint8_t)(table_bits + root_bits);
--          root_table[low].value = (uint16_t)((table - root_table) - low);
-+          if (root_table != NULL) {
-+            root_table[low].bits = (uint8_t)(table_bits + root_bits);
-+            root_table[low].value = (uint16_t)((table - root_table) - low);
-+          }
-+        }
-+        if (root_table != NULL) {
-+          code.bits = (uint8_t)(len - root_bits);
-+          code.value = (uint16_t)sorted[symbol++];
-+          ReplicateValue(&table[key >> root_bits], step, table_size, code);
-         }
--        code.bits = (uint8_t)(len - root_bits);
--        code.value = (uint16_t)sorted[symbol++];
--        ReplicateValue(&table[key >> root_bits], step, table_size, code);
-         key = GetNextKey(key, len);
-       }
-     }
-@@ -211,25 +214,83 @@ static int BuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
-   ((1 << MAX_CACHE_BITS) + NUM_LITERAL_CODES + NUM_LENGTH_CODES)
- // Cut-off value for switching between heap and stack allocation.
- #define SORTED_SIZE_CUTOFF 512
--int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
-+int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits,
-                           const int code_lengths[], int code_lengths_size) {
--  int total_size;
-+  const int total_size =
-+      BuildHuffmanTable(NULL, root_bits, code_lengths, code_lengths_size, NULL);
-   assert(code_lengths_size <= MAX_CODE_LENGTHS_SIZE);
--  if (root_table == NULL) {
--    total_size = BuildHuffmanTable(NULL, root_bits,
--                                   code_lengths, code_lengths_size, NULL);
--  } else if (code_lengths_size <= SORTED_SIZE_CUTOFF) {
-+  if (total_size == 0 || root_table == NULL) return total_size;
-+
-+  if (root_table->curr_segment->curr_table + total_size >=
-+      root_table->curr_segment->start + root_table->curr_segment->size) {
-+    // If 'root_table' does not have enough memory, allocate a new segment.
-+    // The available part of root_table->curr_segment is left unused because we
-+    // need a contiguous buffer.
-+    const int segment_size = root_table->curr_segment->size;
-+    struct HuffmanTablesSegment* next =
-+        (HuffmanTablesSegment*)WebPSafeMalloc(1, sizeof(*next));
-+    if (next == NULL) return 0;
-+    // Fill the new segment.
-+    // We need at least 'total_size' but if that value is small, it is better to
-+    // allocate a big chunk to prevent more allocations later. 'segment_size' is
-+    // therefore chosen (any other arbitrary value could be chosen).
-+    next->size = total_size > segment_size ? total_size : segment_size;
-+    next->start =
-+        (HuffmanCode*)WebPSafeMalloc(next->size, sizeof(*next->start));
-+    if (next->start == NULL) {
-+      WebPSafeFree(next);
-+      return 0;
-+    }
-+    next->curr_table = next->start;
-+    next->next = NULL;
-+    // Point to the new segment.
-+    root_table->curr_segment->next = next;
-+    root_table->curr_segment = next;
-+  }
-+  if (code_lengths_size <= SORTED_SIZE_CUTOFF) {
-     // use local stack-allocated array.
-     uint16_t sorted[SORTED_SIZE_CUTOFF];
--    total_size = BuildHuffmanTable(root_table, root_bits,
--                                   code_lengths, code_lengths_size, sorted);
--  } else {   // rare case. Use heap allocation.
-+    BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits,
-+                      code_lengths, code_lengths_size, sorted);
-+  } else {  // rare case. Use heap allocation.
-     uint16_t* const sorted =
-         (uint16_t*)WebPSafeMalloc(code_lengths_size, sizeof(*sorted));
-     if (sorted == NULL) return 0;
--    total_size = BuildHuffmanTable(root_table, root_bits,
--                                   code_lengths, code_lengths_size, sorted);
-+    BuildHuffmanTable(root_table->curr_segment->curr_table, root_bits,
-+                      code_lengths, code_lengths_size, sorted);
-     WebPSafeFree(sorted);
-   }
-   return total_size;
- }
-+
-+int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables) {
-+  // Have 'segment' point to the first segment for now, 'root'.
-+  HuffmanTablesSegment* const root = &huffman_tables->root;
-+  huffman_tables->curr_segment = root;
-+  // Allocate root.
-+  root->start = (HuffmanCode*)WebPSafeMalloc(size, sizeof(*root->start));
-+  if (root->start == NULL) return 0;
-+  root->curr_table = root->start;
-+  root->next = NULL;
-+  root->size = size;
-+  return 1;
-+}
-+
-+void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables) {
-+  HuffmanTablesSegment *current, *next;
-+  if (huffman_tables == NULL) return;
-+  // Free the root node.
-+  current = &huffman_tables->root;
-+  next = current->next;
-+  WebPSafeFree(current->start);
-+  current->start = NULL;
-+  current->next = NULL;
-+  current = next;
-+  // Free the following nodes.
-+  while (current != NULL) {
-+    next = current->next;
-+    WebPSafeFree(current->start);
-+    WebPSafeFree(current);
-+    current = next;
-+  }
-+}
-diff --git a/src/utils/huffman_utils.h b/src/utils/huffman_utils.h
-index 13b7ad1a..98415c53 100644
---- a/src/utils/huffman_utils.h
-+++ b/src/utils/huffman_utils.h
-@@ -43,6 +43,29 @@ typedef struct {
-                     // or non-literal symbol otherwise
- } HuffmanCode32;
- 
-+// Contiguous memory segment of HuffmanCodes.
-+typedef struct HuffmanTablesSegment {
-+  HuffmanCode* start;
-+  // Pointer to where we are writing into the segment. Starts at 'start' and
-+  // cannot go beyond 'start' + 'size'.
-+  HuffmanCode* curr_table;
-+  // Pointer to the next segment in the chain.
-+  struct HuffmanTablesSegment* next;
-+  int size;
-+} HuffmanTablesSegment;
-+
-+// Chained memory segments of HuffmanCodes.
-+typedef struct HuffmanTables {
-+  HuffmanTablesSegment root;
-+  // Currently processed segment. At first, this is 'root'.
-+  HuffmanTablesSegment* curr_segment;
-+} HuffmanTables;
-+
-+// Allocates a HuffmanTables with 'size' contiguous HuffmanCodes. Returns 0 on
-+// memory allocation error, 1 otherwise.
-+int VP8LHuffmanTablesAllocate(int size, HuffmanTables* huffman_tables);
-+void VP8LHuffmanTablesDeallocate(HuffmanTables* const huffman_tables);
-+
- #define HUFFMAN_PACKED_BITS 6
- #define HUFFMAN_PACKED_TABLE_SIZE (1u << HUFFMAN_PACKED_BITS)
- 
-@@ -78,9 +101,7 @@ void VP8LHtreeGroupsFree(HTreeGroup* const htree_groups);
- // the huffman table.
- // Returns built table size or 0 in case of error (invalid tree or
- // memory error).
--// If root_table is NULL, it returns 0 if a lookup cannot be built, something
--// > 0 otherwise (but not the table size).
--int VP8LBuildHuffmanTable(HuffmanCode* const root_table, int root_bits,
-+int VP8LBuildHuffmanTable(HuffmanTables* const root_table, int root_bits,
-                           const int code_lengths[], int code_lengths_size);
- 
- #ifdef __cplusplus
--- 
-2.41.0
-
diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix
index 287c0b6b18b..2605dabf125 100644
--- a/pkgs/development/libraries/libwebp/default.nix
+++ b/pkgs/development/libraries/libwebp/default.nix
@@ -27,23 +27,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libwebp";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner  = "webmproject";
     repo   = pname;
     rev    = "v${version}";
-    hash   = "sha256-Q94avvKjPdwdGt5ADo30cf2V4T7MCTubDHJxTtbG4xQ=";
+    hash   = "sha256-UYO2Fmm8nzQR8VBC26wEwWd3qZTD+6MHKcmKBoNcpEE=";
   };
 
-  patches = [
-    # Commit 902bc919 from upstream, mangled slightly to apply onto 1.3.1.
-    # There is currently (2023-09-12) no confirmation that this is the fix for
-    # CVE-2023-4863, but it is linked to the right crbug, and matches the
-    # description of that (critical sev, exploited in the wild) CVE.
-    ./CVE-2023-4863.patch
-  ];
-
   configureFlags = [
     (lib.enableFeature threadingSupport "threading")
     (lib.enableFeature openglSupport "gl")
diff --git a/pkgs/development/libraries/libyang/default.nix b/pkgs/development/libraries/libyang/default.nix
index 9102286746b..88fdfcca03c 100644
--- a/pkgs/development/libraries/libyang/default.nix
+++ b/pkgs/development/libraries/libyang/default.nix
@@ -36,7 +36,6 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-DCMAKE_INSTALL_LIBDIR=lib"
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
-    "-DCMAKE_BUILD_TYPE:String=Release"
   ];
 
   passthru.updateScript = gitUpdater {
diff --git a/pkgs/development/libraries/mesa-glu/default.nix b/pkgs/development/libraries/mesa-glu/default.nix
index b583eb93153..dac12db94b6 100644
--- a/pkgs/development/libraries/mesa-glu/default.nix
+++ b/pkgs/development/libraries/mesa-glu/default.nix
@@ -1,19 +1,22 @@
-{ lib, stdenv, fetchurl, pkg-config, libGL, ApplicationServices
+{ lib, stdenv, fetchurl
+, meson, ninja
+, pkg-config, libGL, ApplicationServices
 , testers
+, gitUpdater
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glu";
-  version = "9.0.2";
+  version = "9.0.3";
 
   src = let
     inherit (finalAttrs) pname version;
   in fetchurl {
     url = "https://mesa.freedesktop.org/archive/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bnKA/1hcah2d/N8vykiSUWNLM3e/wzwp5AAkZqONAtQ=";
+    hash = "sha256-vUP+EvN0sRkusV/iDkX/RWubwmq1fw7ukZ+Wyg+KMw8=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ meson ninja pkg-config ];
   propagatedBuildInputs = [ libGL ]
     ++ lib.optional stdenv.isDarwin ApplicationServices;
 
@@ -21,7 +24,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  passthru = {
+    tests = {
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    };
+    updateScript = gitUpdater {
+      # No nicer place to find latest release.
+      url = "https://gitlab.freedesktop.org/mesa/glu";
+    rev-prefix = "glu-";
+    };
+  };
 
   meta = {
     description = "OpenGL utility library";
diff --git a/pkgs/development/libraries/muparserx/default.nix b/pkgs/development/libraries/muparserx/default.nix
index 2b3d2853d13..8a7d2c8f364 100644
--- a/pkgs/development/libraries/muparserx/default.nix
+++ b/pkgs/development/libraries/muparserx/default.nix
@@ -16,10 +16,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
-  ];
-
   doCheck = true;
   checkPhase = ''
     echo "***Muparserx self-test***"
diff --git a/pkgs/development/libraries/onnxruntime/default.nix b/pkgs/development/libraries/onnxruntime/default.nix
index 1b955b57de4..4a9ee61f561 100644
--- a/pkgs/development/libraries/onnxruntime/default.nix
+++ b/pkgs/development/libraries/onnxruntime/default.nix
@@ -133,7 +133,6 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DABSL_ENABLE_INSTALL=ON"
-    "-DCMAKE_BUILD_TYPE=RELEASE"
     "-DFETCHCONTENT_FULLY_DISCONNECTED=ON"
     "-DFETCHCONTENT_QUIET=OFF"
     "-DFETCHCONTENT_SOURCE_DIR_ABSEIL_CPP=${abseil-cpp.src}"
diff --git a/pkgs/development/libraries/phonon/backends/gstreamer.nix b/pkgs/development/libraries/phonon/backends/gstreamer.nix
index fc0afbe2184..a94234aec41 100644
--- a/pkgs/development/libraries/phonon/backends/gstreamer.nix
+++ b/pkgs/development/libraries/phonon/backends/gstreamer.nix
@@ -58,9 +58,7 @@ stdenv.mkDerivation rec {
     qttools
   ];
 
-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else "Release"}"
-  ];
+  cmakeBuildType = if debug then "Debug" else "Release";
 
   meta = with lib; {
     homepage = "https://phonon.kde.org/";
diff --git a/pkgs/development/libraries/phonon/backends/vlc.nix b/pkgs/development/libraries/phonon/backends/vlc.nix
index 42923d4f026..a50a07dde1a 100644
--- a/pkgs/development/libraries/phonon/backends/vlc.nix
+++ b/pkgs/development/libraries/phonon/backends/vlc.nix
@@ -28,9 +28,7 @@ stdenv.mkDerivation rec {
 
   dontWrapQtApps = true;
 
-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else "Release"}"
-  ];
+  cmakeBuildType = if debug then "Debug" else "Release";
 
   meta = with lib; {
     homepage = "https://community.kde.org/Phonon";
diff --git a/pkgs/development/libraries/phonon/default.nix b/pkgs/development/libraries/phonon/default.nix
index 59d9e19556a..dc95b4ed826 100644
--- a/pkgs/development/libraries/phonon/default.nix
+++ b/pkgs/development/libraries/phonon/default.nix
@@ -52,9 +52,7 @@ stdenv.mkDerivation rec {
 
   env.NIX_CFLAGS_COMPILE = "-fPIC";
 
-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else "Release"}"
-  ];
+  cmakeBuildType = if debug then "Debug" else "Release";
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index fdc514c286b..1e66d1573fc 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -23,6 +23,7 @@
 , vulkan-headers
 , vulkan-loader
 , webrtc-audio-processing
+, webrtc-audio-processing_1
 , ncurses
 , readline # meson can't find <7 as those versions don't have a .pc file
 , lilv
@@ -42,10 +43,11 @@
 , bluez
 , sbc
 , libfreeaptx
-, ldacbt
 , liblc3
 , fdk_aac
 , libopus
+, ldacbtSupport ? bluezSupport && lib.meta.availableOn stdenv.hostPlatform ldacbt
+, ldacbt
 , nativeHspSupport ? true
 , nativeHfpSupport ? true
 , nativeModemManagerSupport ? true
@@ -70,12 +72,15 @@
 , ffado
 }:
 
+# Bluetooth codec only makes sense if general bluetooth enabled
+assert ldacbtSupport -> bluezSupport;
+
 let
   mesonEnableFeature = b: if b then "enabled" else "disabled";
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "0.3.79";
+    version = "0.3.80";
 
     outputs = [
       "out"
@@ -93,7 +98,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-pqs991pMqz3IQE+NUk0VNzZS4ExwfoZqBQDWBSGdWcs=";
+      sha256 = "sha256-6Ka83Bqd/nsfp8rv0GTBerpGP226MeZvC5u/j62FzP0=";
     };
 
     patches = [
@@ -111,6 +116,12 @@ let
       ./0090-pipewire-config-template-paths.patch
       # Place SPA data files in lib output to avoid dependency cycles
       ./0095-spa-data-dir.patch
+
+      # backport fix for building with webrtc-audio-processing 0.3 on platforms where we don't have 1.x
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/1f1c308c9766312e684f0b53fc2d1422c7414d31.patch";
+        hash = "sha256-ECM7/84G99yzXsg5A2DkFnXFGJSV9lz3vD0IRSzR8vU=";
+      })
     ];
 
     strictDeps = true;
@@ -138,13 +149,14 @@ let
       udev
       vulkan-headers
       vulkan-loader
-      webrtc-audio-processing
       tinycompress
     ] ++ (if enableSystemd then [ systemd ] else [ eudev ])
+    ++ (if lib.meta.availableOn stdenv.hostPlatform webrtc-audio-processing_1 then [ webrtc-audio-processing_1 ] else [ webrtc-audio-processing ])
     ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
     ++ lib.optionals libcameraSupport [ libcamera libdrm ]
     ++ lib.optional ffmpegSupport ffmpeg
-    ++ lib.optionals bluezSupport [ bluez libfreeaptx ldacbt liblc3 sbc fdk_aac libopus ]
+    ++ lib.optionals bluezSupport [ bluez libfreeaptx liblc3 sbc fdk_aac libopus ]
+    ++ lib.optional ldacbtSupport ldacbt
     ++ lib.optional nativeModemManagerSupport modemmanager
     ++ lib.optional pulseTunnelSupport libpulseaudio
     ++ lib.optional zeroconfSupport avahi
@@ -184,6 +196,7 @@ let
       # source code is not easily obtainable
       "-Dbluez5-codec-lc3plus=disabled"
       "-Dbluez5-codec-lc3=${mesonEnableFeature bluezSupport}"
+      "-Dbluez5-codec-ldac=${mesonEnableFeature ldacbtSupport}"
       "-Dsysconfdir=/etc"
       "-Dpipewire_confdata_dir=${placeholder "lib"}/share/pipewire"
       "-Draop=${mesonEnableFeature raopSupport}"
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index a00b6bb07a5..b6de5b02c09 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -39,7 +39,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "polkit";
-  version = "122";
+  version = "123";
 
   outputs = [ "bin" "dev" "out" ]; # small man pages in $bin
 
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     owner = "polkit";
     repo = "polkit";
     rev = version;
-    sha256 = "fLY8i8h4McAnwVt8dLOqbyHM7v3SkbWqATz69NkUudU=";
+    hash = "sha256-/kjWkh6w2FYgtYWzw3g3GlWJKKpkJ3cqwfE0iDqJctw=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/protobuf/3.24.nix b/pkgs/development/libraries/protobuf/3.24.nix
index 2deb155444e..60ad747194d 100644
--- a/pkgs/development/libraries/protobuf/3.24.nix
+++ b/pkgs/development/libraries/protobuf/3.24.nix
@@ -1,6 +1,6 @@
 { callPackage, ... } @ args:
 
 callPackage ./generic-v3-cmake.nix ({
-  version = "3.24.2";
-  sha256 = "sha256-yVLszyVtsz1CCzeOkioL4O3mWTFKKVBUyOhwDbC5UqE=";
+  version = "3.24.3";
+  sha256 = "sha256-wXGQW/o674DeLXX2IlyZskl5OrBcSRptOMoJqLQGm94=";
 } // args)
diff --git a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
index 384d2d0decb..5b5ab87bfcd 100644
--- a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
+++ b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
@@ -13,53 +13,45 @@
 , version
 , sha256
 
-# downstream dependencies
+  # downstream dependencies
 , python3
+, grpc
 
 , ...
 }:
 
-let
-  self = stdenv.mkDerivation {
-    pname = "protobuf";
-    inherit version;
+stdenv.mkDerivation (finalAttrs: {
+  pname = "protobuf";
+  inherit version;
 
-    src = fetchFromGitHub {
-      owner = "protocolbuffers";
-      repo = "protobuf";
-      rev = "v${version}";
-      inherit sha256;
-    };
-
-    # re-create submodule logic
-    postPatch = ''
-      rm -rf gmock
-      cp -r ${gtest.src}/googlemock third_party/gmock
-      cp -r ${gtest.src}/googletest third_party/
-      chmod -R a+w third_party/
+  src = fetchFromGitHub {
+    owner = "protocolbuffers";
+    repo = "protobuf";
+    rev = "v${version}";
+    inherit sha256;
+  };
 
-      ln -s ../googletest third_party/gmock/gtest
-      ln -s ../gmock third_party/googletest/googlemock
-      ln -s $(pwd)/third_party/googletest third_party/googletest/googletest
-    '' + lib.optionalString stdenv.isDarwin ''
-      substituteInPlace src/google/protobuf/testing/googletest.cc \
-        --replace 'tmpnam(b)' '"'$TMPDIR'/foo"'
-    '';
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace src/google/protobuf/testing/googletest.cc \
+      --replace 'tmpnam(b)' '"'$TMPDIR'/foo"'
+  '';
 
-    patches = lib.optionals (lib.versionOlder version "3.22") [
-      # fix protobuf-targets.cmake installation paths, and allow for CMAKE_INSTALL_LIBDIR to be absolute
-      # https://github.com/protocolbuffers/protobuf/pull/10090
-      (fetchpatch {
-        url = "https://github.com/protocolbuffers/protobuf/commit/a7324f88e92bc16b57f3683403b6c993bf68070b.patch";
-        sha256 = "sha256-SmwaUjOjjZulg/wgNmR/F5b8rhYA2wkKAjHIOxjcQdQ=";
-      })
-    ] ++ lib.optionals stdenv.hostPlatform.isStatic [
-      ./static-executables-have-no-rpath.patch
-    ];
+  patches = lib.optionals (lib.versionOlder version "3.22") [
+    # fix protobuf-targets.cmake installation paths, and allow for CMAKE_INSTALL_LIBDIR to be absolute
+    # https://github.com/protocolbuffers/protobuf/pull/10090
+    (fetchpatch {
+      url = "https://github.com/protocolbuffers/protobuf/commit/a7324f88e92bc16b57f3683403b6c993bf68070b.patch";
+      sha256 = "sha256-SmwaUjOjjZulg/wgNmR/F5b8rhYA2wkKAjHIOxjcQdQ=";
+    })
+  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
+    ./static-executables-have-no-rpath.patch
+  ];
 
-    nativeBuildInputs = let
+  nativeBuildInputs =
+    let
       protobufVersion = "${lib.versions.major version}_${lib.versions.minor version}";
-    in [
+    in
+    [
       cmake
     ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       # protoc of the same version must be available for build. For non-cross builds, it's able to
@@ -67,52 +59,54 @@ let
       buildPackages."protobuf${protobufVersion}"
     ];
 
-    buildInputs = [
-      zlib
-    ];
+  buildInputs = [
+    gtest
+    zlib
+  ];
 
-    propagatedBuildInputs = [
-      abseil-cpp
-    ];
+  propagatedBuildInputs = [
+    abseil-cpp
+  ];
 
-    cmakeDir = if lib.versionOlder version "3.22" then "../cmake" else null;
-    cmakeFlags = [
-      "-Dprotobuf_ABSL_PROVIDER=package"
-    ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
-      "-Dprotobuf_BUILD_SHARED_LIBS=ON"
-    ]
-    # Tests fail to build on 32-bit platforms; fixed in 3.22
-    # https://github.com/protocolbuffers/protobuf/issues/10418
-    ++ lib.optional
-      (stdenv.targetPlatform.is32bit && lib.versionOlder version "3.22")
-      "-Dprotobuf_BUILD_TESTS=OFF";
+  strictDeps = true;
 
-    # unfortunately the shared libraries have yet to been patched by nix, thus tests will fail
-    doCheck = false;
+  cmakeDir = if lib.versionOlder version "3.22" then "../cmake" else null;
+  cmakeFlags = [
+    "-Dprotobuf_USE_EXTERNAL_GTEST=ON"
+    "-Dprotobuf_ABSL_PROVIDER=package"
+  ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
+    "-Dprotobuf_BUILD_SHARED_LIBS=ON"
+  ]
+  # Tests fail to build on 32-bit platforms; fixed in 3.22
+  # https://github.com/protocolbuffers/protobuf/issues/10418
+  ++ lib.optionals (stdenv.targetPlatform.is32bit && lib.versionOlder version "3.22") [
+    "-Dprotobuf_BUILD_TESTS=OFF"
+  ];
 
-    passthru = {
-      tests = {
-        pythonProtobuf = python3.pkgs.protobuf.override(_: {
-          protobuf = self;
-        });
-      };
+  doCheck = true;
 
-      inherit abseil-cpp;
+  passthru = {
+    tests = {
+      pythonProtobuf = python3.pkgs.protobuf.override (_: {
+        protobuf = finalAttrs.finalPackage;
+      });
+      inherit grpc;
     };
 
-    meta = {
-      description = "Google's data interchange format";
-      longDescription = ''
-        Protocol Buffers are a way of encoding structured data in an efficient
-        yet extensible format. Google uses Protocol Buffers for almost all of
-        its internal RPC protocols and file formats.
-      '';
-      license = lib.licenses.bsd3;
-      platforms = lib.platforms.unix;
-      homepage = "https://developers.google.com/protocol-buffers/";
-      maintainers = with lib.maintainers; [ jonringer ];
-      mainProgram = "protoc";
-    };
+    inherit abseil-cpp;
+  };
+
+  meta = {
+    description = "Google's data interchange format";
+    longDescription = ''
+      Protocol Buffers are a way of encoding structured data in an efficient
+      yet extensible format. Google uses Protocol Buffers for almost all of
+      its internal RPC protocols and file formats.
+    '';
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    homepage = "https://protobuf.dev/";
+    maintainers = with lib.maintainers; [ jonringer ];
+    mainProgram = "protoc";
   };
-in
-  self
+})
diff --git a/pkgs/development/libraries/qpdf/default.nix b/pkgs/development/libraries/qpdf/default.nix
index 838657f48bb..d80309f2b16 100644
--- a/pkgs/development/libraries/qpdf/default.nix
+++ b/pkgs/development/libraries/qpdf/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qpdf";
-  version = "11.5.0";
+  version = "11.6.1";
 
   src = fetchFromGitHub {
     owner = "qpdf";
     repo = "qpdf";
     rev = "v${version}";
-    hash = "sha256-lojvsCgBsT7wVRLWfkeOduEYUG7ztI/uryM0WueWiL0=";
+    hash = "sha256-QXRzvSMi6gKISJo44KIjTYENNqxh1yDhUUhEZa8uz6Q=";
   };
 
   nativeBuildInputs = [ cmake perl ];
diff --git a/pkgs/development/libraries/qt-5/modules/qtwayland.nix b/pkgs/development/libraries/qt-5/modules/qtwayland.nix
index edb15b0b48b..0faabf3752a 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwayland.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwayland.nix
@@ -1,10 +1,10 @@
-{ qtModule, qtbase, qtquickcontrols, wayland, pkg-config }:
+{ qtModule, qtbase, qtquickcontrols, wayland, wayland-scanner, pkg-config }:
 
 qtModule {
   pname = "qtwayland";
   qtInputs = [ qtbase qtquickcontrols ];
   buildInputs = [ wayland ];
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config wayland-scanner ];
   outputs = [ "out" "dev" "bin" ];
   patches = [
     # NixOS-specific, ensure that app_id is correctly determined for
diff --git a/pkgs/development/libraries/re2/default.nix b/pkgs/development/libraries/re2/default.nix
index adaef49976a..c5f74854f77 100644
--- a/pkgs/development/libraries/re2/default.nix
+++ b/pkgs/development/libraries/re2/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re2";
-  version = "2023-08-01";
+  version = "2023-09-01";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "re2";
     rev = version;
-    hash = "sha256-RexwqNR/Izf2Rzu1cvMw+le6C4EmL4CeWCOc+vXUBZQ=";
+    hash = "sha256-dCEkwjIs8ITVUZ4N0+qeGoShGNqKkdvJ88teyGKN6pg=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/reproc/default.nix b/pkgs/development/libraries/reproc/default.nix
index 2083a6a7af4..680455d4cb5 100644
--- a/pkgs/development/libraries/reproc/default.nix
+++ b/pkgs/development/libraries/reproc/default.nix
@@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DCMAKE_INSTALL_LIBDIR=lib"
     "-DBUILD_SHARED_LIBS=ON"
     "-DREPROC++=ON"
diff --git a/pkgs/development/libraries/rnnoise-plugin/default.nix b/pkgs/development/libraries/rnnoise-plugin/default.nix
index d5f5268ac8e..39a8f1a4b6a 100644
--- a/pkgs/development/libraries/rnnoise-plugin/default.nix
+++ b/pkgs/development/libraries/rnnoise-plugin/default.nix
@@ -49,8 +49,6 @@ stdenv.mkDerivation rec {
       simd
     ];
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
-
   meta = with lib; {
     description = "A real-time noise suppression plugin for voice based on Xiph's RNNoise";
     homepage = "https://github.com/werman/noise-suppression-for-voice";
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index 678aac37e89..c1483f90c43 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "s2n-tls";
-  version = "1.3.48";
+  version = "1.3.50";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7C1syZAhMv0N+AuE/SuXqhatKhlzDOix4ZDxLRyuWOs=";
+    sha256 = "sha256-B+znuvQ7TTl2u4rw64ylPywfpr066Yf8Wg0qrdByGRE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/sentry-native/default.nix b/pkgs/development/libraries/sentry-native/default.nix
index 9f6ac99c6f0..09989fb7bdd 100644
--- a/pkgs/development/libraries/sentry-native/default.nix
+++ b/pkgs/development/libraries/sentry-native/default.nix
@@ -28,8 +28,9 @@ stdenv.mkDerivation rec {
     breakpad
   ];
 
+  cmakeBuildType = "RelWithDebInfo";
+
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
     "-DSENTRY_BREAKPAD_SYSTEM=On"
   ];
 
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index cc26df385a5..f51ce3a5000 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -7,6 +7,8 @@
 , interactive ? false
 # TODO: can be removed since 3.36 since it is the default now.
 , enableDeserialize ? false
+
+, gitUpdater
 }:
 
 let
@@ -15,13 +17,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.42.0";
+  version = "3.43.1";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2023/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    hash = "sha256-erz9FhxuJ0LKXGwIldH4U8lA8gMwSgtJ2k4eyl0IjKY=";
+    hash = "sha256-ORFslOdmMPItVM2Cw86jCFZfFxX3FtGyUn8cnJabpNk=";
   };
 
   outputs = [ "bin" "dev" "out" ];
@@ -87,9 +89,18 @@ stdenv.mkDerivation rec {
 
   doCheck = false; # fails to link against tcl
 
-  passthru.tests = {
-    inherit (python3Packages) sqlalchemy;
-    inherit sqldiff sqlite-analyzer tracker;
+  passthru = {
+    tests = {
+      inherit (python3Packages) sqlalchemy;
+      inherit sqldiff sqlite-analyzer tracker;
+    };
+
+    updateScript = gitUpdater {
+      # No nicer place to look for patest version.
+      url = "https://github.com/sqlite/sqlite.git";
+      # Expect tags like "version-3.43.0".
+      rev-prefix = "version-";
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index c30ce8d45d9..31207ad9edf 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -4,12 +4,12 @@ let
   archiveVersion = import ./archive-version.nix lib;
   mkTool = { pname, makeTarget, description, homepage, mainProgram }: stdenv.mkDerivation rec {
     inherit pname;
-    version = "3.42.0";
+    version = "3.43.1";
 
     # nixpkgs-update: no auto update
     src = assert version == sqlite.version; fetchurl {
       url = "https://sqlite.org/2023/sqlite-src-${archiveVersion version}.zip";
-      hash = "sha256-OMpWoxe+N/sAvZK8KA2bkgm9QAiyl9SDxB7B9geb+20=";
+      hash = "sha256-IunC70n+b4otvJPE09zgnG1qT1Y95SsKgXGtSajHKRc=";
     };
 
     nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/taglib/default.nix b/pkgs/development/libraries/taglib/default.nix
index 0fb207e4e0f..6eaab962341 100644
--- a/pkgs/development/libraries/taglib/default.nix
+++ b/pkgs/development/libraries/taglib/default.nix
@@ -7,20 +7,26 @@
 
 stdenv.mkDerivation rec {
   pname = "taglib";
-  version = "1.13";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "taglib";
     repo = "taglib";
     rev = "v${version}";
-    sha256 = "sha256-DRALRH+/7c2lBvCpLp8hop3Xxsf76F1q8L7F9qehqQA=";
+    hash = "sha256-QX0EpHGT36UsgIfRf5iALnwxe0jjLpZvCTbk8vSMFF4=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [ zlib ];
 
-  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+    # Workaround unconditional ${prefix} until upstream is fixed:
+    #   https://github.com/taglib/taglib/issues/1098
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+  ];
 
   meta = with lib; {
     homepage = "https://taglib.org/";
diff --git a/pkgs/development/libraries/unixODBC/default.nix b/pkgs/development/libraries/unixODBC/default.nix
index 90398e5aef2..8587ad6d2c3 100644
--- a/pkgs/development/libraries/unixODBC/default.nix
+++ b/pkgs/development/libraries/unixODBC/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "unixODBC";
-  version = "2.3.11";
+  version = "2.3.12";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.unixodbc.org/pub/unixODBC/${pname}-${version}.tar.gz"
       "https://www.unixodbc.org/${pname}-${version}.tar.gz"
     ];
-    sha256 = "sha256-2eVcjnEYNH48ZshzOIVtrRUWtJD7fHVsFWKiwmfHO1w=";
+    sha256 = "sha256-8hBQFEXOIb9ge6Ue+MEl4Q4i3/3/7Dd2RkYt9fAZFew=";
   };
 
   configureFlags = [ "--disable-gui" "--sysconfdir=/etc" ];
diff --git a/pkgs/development/libraries/webrtc-audio-processing/default.nix b/pkgs/development/libraries/webrtc-audio-processing/default.nix
index f78d8b35e2a..2c1e15bfbef 100644
--- a/pkgs/development/libraries/webrtc-audio-processing/default.nix
+++ b/pkgs/development/libraries/webrtc-audio-processing/default.nix
@@ -1,45 +1,41 @@
-{ lib, stdenv, fetchurl
+{ lib, stdenv, fetchFromGitLab
 , darwin
 , abseil-cpp
 , meson
 , ninja
+, pkg-config
 }:
 
 stdenv.mkDerivation rec {
   pname = "webrtc-audio-processing";
-  version = "1.0";
+  version = "1.3";
 
-  src = fetchurl {
-    url = "https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/archive/v${version}/webrtc-audio-processing-v${version}.tar.gz";
-    sha256 = "sha256-dqRy1OfOG9TX2cgCD8cowU44zVanns/nPYZrilPfuiU=";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "pulseaudio";
+    repo = "webrtc-audio-processing";
+    rev = "v${version}";
+    hash = "sha256-8CDt4kMt2Owzyv22dqWIcFuHeg4Y3FxB405cLw3FZ+g=";
   };
 
   nativeBuildInputs = [
     meson
     ninja
+    pkg-config
   ];
 
-  buildInputs = [
+  propagatedBuildInputs = [
     abseil-cpp
-  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ ApplicationServices ]);
+  ];
 
-  patchPhase = ''
-    # this is just incorrect upstream
-    # see https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/issues/4
-    substituteInPlace meson.build \
-      --replace "absl_flags_registry" "absl_flags_reflection"
-    '' + lib.optionalString stdenv.hostPlatform.isMusl ''
-    substituteInPlace webrtc/base/checks.cc --replace 'defined(__UCLIBC__)' 1
-  '';
+  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ ApplicationServices ]);
 
   meta = with lib; {
     homepage = "https://www.freedesktop.org/software/pulseaudio/webrtc-audio-processing";
     description = "A more Linux packaging friendly copy of the AudioProcessing module from the WebRTC project";
     license = licenses.bsd3;
     # https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/blob/master/webrtc/rtc_base/system/arch.h
-    platforms = intersectLists platforms.unix (platforms.aarch64 ++ platforms.mips ++ platforms.riscv ++ platforms.x86);
-    # attempts to inline 256bit AVX instructions on x86
-    # https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/issues/5
-    broken = stdenv.isx86_32;
+    # x86-32 disabled due to https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/issues/5
+    platforms = intersectLists platforms.unix (platforms.aarch64 ++ platforms.mips ++ platforms.riscv ++ platforms.x86_64);
   };
 }
diff --git a/pkgs/development/ocaml-modules/batteries/default.nix b/pkgs/development/ocaml-modules/batteries/default.nix
index 38a28eafae8..16d9e7c50fb 100644
--- a/pkgs/development/ocaml-modules/batteries/default.nix
+++ b/pkgs/development/ocaml-modules/batteries/default.nix
@@ -1,34 +1,25 @@
-{ stdenv, lib, fetchFromGitHub, ocaml, findlib, ocamlbuild, qtest, qcheck, num, camlp-streams
-, doCheck ? lib.versionAtLeast ocaml.version "4.08" && !stdenv.isAarch64
+{ stdenv, lib, fetchFromGitHub, buildDunePackage, ocaml, qtest, qcheck, num, camlp-streams
+, doCheck ? lib.versionAtLeast ocaml.version "4.08"
 }:
 
-if lib.versionOlder ocaml.version "4.02"
-then throw "batteries is not available for OCaml ${ocaml.version}"
-else
-
-stdenv.mkDerivation rec {
-  pname = "ocaml${ocaml.version}-batteries";
-  version = "3.6.0";
+buildDunePackage rec {
+  pname = "batteries";
+  version = "3.7.1";
 
   src = fetchFromGitHub {
     owner = "ocaml-batteries-team";
     repo = "batteries-included";
     rev = "v${version}";
-    hash = "sha256-D/0h0/70V8jmzHIUR6i2sT2Jz9/+tfR2dQgp4Bxtimc=";
+    hash = "sha256-0ZCaJA9xowO9QxCWcyJ1zhqG7+GNkMYJt62+VPOFj4Y=";
   };
 
-  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
   nativeCheckInputs = [ qtest ];
   checkInputs = [ qcheck ];
   propagatedBuildInputs = [ camlp-streams num ];
 
-  strictDeps = true;
-
   inherit doCheck;
   checkTarget = "test";
 
-  createFindlibDestdir = true;
-
   meta = {
     homepage = "https://ocaml-batteries-team.github.io/batteries-included/hdoc2/";
     description = "OCaml Batteries Included";
@@ -38,7 +29,6 @@ stdenv.mkDerivation rec {
       language.
     '';
     license = lib.licenses.lgpl21Plus;
-    inherit (ocaml.meta) platforms;
     maintainers = [
       lib.maintainers.maggesi
     ];
diff --git a/pkgs/development/ocaml-modules/telegraml/default.nix b/pkgs/development/ocaml-modules/telegraml/default.nix
index 1aca2da2974..d58e6adfe2e 100644
--- a/pkgs/development/ocaml-modules/telegraml/default.nix
+++ b/pkgs/development/ocaml-modules/telegraml/default.nix
@@ -10,7 +10,6 @@
 buildDunePackage rec {
   pname = "telegraml";
   version = "unstable-2021-06-17";
-  duneVersion = "3";
 
   src = fetchFromGitHub {
     owner = "nv-vn";
@@ -19,6 +18,10 @@ buildDunePackage rec {
     sha256 = "sha256-2bMHARatwl8Zl/fWppvwbH6Ut+igJVKzwyQb8Q4gem4=";
   };
 
+  postPatch = ''
+    substituteInPlace src/dune --replace batteries batteries.unthreaded
+  '';
+
   propagatedBuildInputs = [
     batteries
     cohttp-lwt-unix
diff --git a/pkgs/development/python-modules/bootstrap/build/default.nix b/pkgs/development/python-modules/bootstrap/build/default.nix
index 639d2e3292c..f4e49bd6560 100644
--- a/pkgs/development/python-modules/bootstrap/build/default.nix
+++ b/pkgs/development/python-modules/bootstrap/build/default.nix
@@ -7,12 +7,15 @@
 , packaging
 , pyproject-hooks
 , tomli
+, makeWrapper
 }:
 let
   buildBootstrapPythonModule = basePackage: attrs: stdenv.mkDerivation ({
     pname = "${python.libPrefix}-bootstrap-${basePackage.pname}";
     inherit (basePackage) version src meta;
 
+    nativeBuildInputs = [ makeWrapper ];
+
     buildPhase = ''
       runHook preBuild
 
@@ -38,12 +41,30 @@ let
   bootstrap-pyproject-hooks = buildBootstrapPythonModule pyproject-hooks {};
 
   bootstrap-tomli = buildBootstrapPythonModule tomli {};
+
+  sitePkgs = python.sitePackages;
 in
 buildBootstrapPythonModule build {
-  propagatedBuildInputs = [
-    bootstrap-packaging
-    bootstrap-pyproject-hooks
-  ] ++ lib.optionals (python.pythonOlder "3.11") [
-    bootstrap-tomli
-  ];
+  # like the installPhase above, but wrapping the pyproject-build command
+  #   to set up PYTHONPATH with the correct dependencies.
+  # This allows using `pyproject-build` without propagating its dependencies
+  #   into the build environment, which is necessary to prevent
+  #   pythonCatchConflicts from raising false positive alerts.
+  # This would happen whenever the package to build has a dependency on
+  #   another version of a package that is also a dependency of pyproject-build.
+  installPhase = ''
+    runHook preInstall
+
+    PYTHONPATH="${installer}/${python.sitePackages}" \
+      ${python.interpreter} -m installer \
+        --destdir "$out" --prefix "" dist/*.whl
+
+    wrapProgram $out/bin/pyproject-build \
+      --prefix PYTHONPATH : "$out/${sitePkgs}" \
+      --prefix PYTHONPATH : "${bootstrap-pyproject-hooks}/${sitePkgs}" \
+      --prefix PYTHONPATH : "${bootstrap-packaging}/${sitePkgs}" \
+      --prefix PYTHONPATH : "${bootstrap-tomli}/${sitePkgs}"
+
+    runHook postInstall
+  '';
 }
diff --git a/pkgs/development/python-modules/django-ninja/default.nix b/pkgs/development/python-modules/django-ninja/default.nix
new file mode 100644
index 00000000000..620960797ea
--- /dev/null
+++ b/pkgs/development/python-modules/django-ninja/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, django
+, fetchFromGitHub
+, flit-core
+, psycopg2
+, pydantic
+, pytest-asyncio
+, pytest-django
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "django-ninja";
+  version = "0.22.2";
+  format = "pyproject";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "vitalik";
+    repo = "django-ninja";
+    rev = "v${version}";
+    hash = "sha256-oeisurp9seSn3X/5jFF9DMm9nU6uDYIU1b6/J3o2be0=";
+  };
+
+  propagatedBuildInputs = [ django pydantic ];
+
+  nativeBuildInputs = [ flit-core ];
+
+  nativeCheckInputs = [
+    psycopg2
+    pytest-asyncio
+    pytest-django
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    changelog = "https://github.com/vitalik/django-ninja/releases/tag/v${version}";
+    description = "Web framework for building APIs with Django and Python type hints";
+    homepage = "https://django-ninja.rest-framework.com/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ elohmeier ];
+  };
+}
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index c3df9cf4aef..d694ff7fb03 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "4.2.4";
+  version = "4.2.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fkIl7AZeDzVMz3NJoi0gneCcwcB0gyvp64TFHBeZxDI=";
+    hash = "sha256-XlwclUj/t3lrSopHgumi5aPfNhUln8G/0+vHO2RhRsE=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/easyocr/default.nix b/pkgs/development/python-modules/easyocr/default.nix
index 3d260f1f652..ff7f7650fce 100644
--- a/pkgs/development/python-modules/easyocr/default.nix
+++ b/pkgs/development/python-modules/easyocr/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "easyocr";
-  version = "1.7.0";
+  version = "1.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "JaidedAI";
     repo = "EasyOCR";
     rev = "refs/tags/v${version}";
-    hash = "sha256-01Exz55eTIO/xzdq/dzV+ELkU75hpxe/EbjIqLBA8h0=";
+    hash = "sha256-EiiJ2LJ3uYIvgPd2y25MraV5kTa47JalDR7SLbkM9UI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/geopandas/default.nix b/pkgs/development/python-modules/geopandas/default.nix
index 809a9ff1072..e176a614e8d 100644
--- a/pkgs/development/python-modules/geopandas/default.nix
+++ b/pkgs/development/python-modules/geopandas/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   version = "0.14.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "geopandas";
diff --git a/pkgs/development/python-modules/gudhi/default.nix b/pkgs/development/python-modules/gudhi/default.nix
index 6fbba605da9..1e0932e6286 100644
--- a/pkgs/development/python-modules/gudhi/default.nix
+++ b/pkgs/development/python-modules/gudhi/default.nix
@@ -38,7 +38,6 @@ buildPythonPackage rec {
   nativeCheckInputs = [ pytest ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DWITH_GUDHI_PYTHON=ON"
     "-DPython_ADDITIONAL_VERSIONS=3"
   ];
diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index b22d82d7f22..0ad58dc0358 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -27,7 +27,7 @@ let
 in
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.4.14";
+  version = "0.4.16";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -37,13 +37,17 @@ buildPythonPackage rec {
     repo = pname;
     # google/jax contains tags for jax and jaxlib. Only use jax tags!
     rev = "refs/tags/${pname}-v${version}";
-    hash = "sha256-0KnILQkahSiA1uuyT+kgy1XaCcZ3cpx1q114e2pecvg=";
+    hash = "sha256-q+8CXGxK8JX0bUMK4KJB3qV/EaLHg68D1B5UrtRz0Eg=";
   };
 
   nativeBuildInputs = [
     setuptools
   ];
 
+  # The version is automatically set to ".dev" if this variable is not set.
+  # https://github.com/google/jax/commit/e01f2617b85c5bdffc5ffb60b3d8d8ca9519a1f3
+  JAX_RELEASE = "1";
+
   # jaxlib is _not_ included in propagatedBuildInputs because there are
   # different versions of jaxlib depending on the desired target hardware. The
   # JAX project ships separate wheels for CPU, GPU, and TPU.
diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix
index c0773878c1d..b9e8fac5930 100644
--- a/pkgs/development/python-modules/jaxlib/bin.nix
+++ b/pkgs/development/python-modules/jaxlib/bin.nix
@@ -39,7 +39,7 @@ in
 assert cudaSupport -> lib.versionAtLeast cudatoolkit.version "11.1" && lib.versionAtLeast cudnn.version "8.2" && stdenv.isLinux;
 
 let
-  version = "0.4.14";
+  version = "0.4.16";
 
   inherit (python) pythonVersion;
 
@@ -60,15 +60,15 @@ let
     {
       "x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
-        hash = "sha256-nyylSZfqHeftlvVgJZFCN1ldjluZVJIYu4ZSsVxvXf8=";
+        hash = "sha256-4XyaDnKEMhAbfPEvN3RCDEjXTWbOL6tWrTlyYeiboVs=";
       };
       "aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
-        hash = "sha256-La3wYbGCjWTl7krBD6BaBRqyBD8R530Lckbz0AWv0FM=";
+        hash = "sha256-IG2pCui/Yj+LDMbQwBVlu7yl2llqnaxMzz/MtBvBr6U=";
       };
       "x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
-        hash = "sha256-hDg5+qisgtgOrdvbjxsUgI73cW6Aah8NLjhPe4kMAsM=";
+        hash = "sha256-x5DqsmHqEb7Dl7dnxT5N0l30GKt5OPZpq3HGX9MFKmo=";
       };
     };
 
@@ -78,7 +78,7 @@ let
   # https://github.com/google/jax/issues/12879 as to why this specific URL is the correct index.
   gpuSrc = fetchurl {
     url = "https://storage.googleapis.com/jax-releases/cuda11/jaxlib-${version}+cuda11.cudnn86-cp310-cp310-manylinux2014_x86_64.whl";
-    hash = "sha256-CcQ5kjp4XfUX4/RwFY3T5G3kVKAeyoCTXu1Lo4O16Qo=";
+    hash = "sha256-eLOprP2kv6roodwRKZXVZFQCD1wC26TSTEDJBjMu/Uo=";
   };
 
 in
diff --git a/pkgs/development/python-modules/jaxlib/default.nix b/pkgs/development/python-modules/jaxlib/default.nix
index 7a9e49a6a29..6fb960f684c 100644
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@@ -54,7 +54,7 @@ let
   inherit (cudaPackages) backendStdenv cudatoolkit cudaFlags cudnn nccl;
 
   pname = "jaxlib";
-  version = "0.4.14";
+  version = "0.4.16";
 
   meta = with lib; {
     description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
@@ -151,7 +151,7 @@ let
       repo = "jax";
       # google/jax contains tags for jax and jaxlib. Only use jaxlib tags!
       rev = "refs/tags/${pname}-v${version}";
-      hash = "sha256-0KnILQkahSiA1uuyT+kgy1XaCcZ3cpx1q114e2pecvg=";
+      hash = "sha256-q+8CXGxK8JX0bUMK4KJB3qV/EaLHg68D1B5UrtRz0Eg=";
     };
 
     nativeBuildInputs = [
@@ -203,6 +203,10 @@ let
     GCC_HOST_COMPILER_PREFIX = lib.optionalString cudaSupport "${cudatoolkit_cc_joined}/bin";
     GCC_HOST_COMPILER_PATH = lib.optionalString cudaSupport "${cudatoolkit_cc_joined}/bin/gcc";
 
+    # The version is automatically set to ".dev" if this variable is not set.
+    # https://github.com/google/jax/commit/e01f2617b85c5bdffc5ffb60b3d8d8ca9519a1f3
+    JAXLIB_RELEASE = "1";
+
     preConfigure = ''
       # dummy ldconfig
       mkdir dummy-ldconfig
@@ -260,10 +264,10 @@ let
       ];
 
       sha256 = (if cudaSupport then {
-        x86_64-linux = "sha256-L+d4umcN8eZQJS7NtbyMhFbbGUVd0a73GOYbZx3bW9Q=";
+        x86_64-linux = "sha256-6HkrEWAPjGPj4zRxahl0FLiV7WZO/6zsdCX8STfV5EE=";
       } else {
-        x86_64-linux = "sha256-V1giQbu70RYjbNsqudibiCgvtFNRIJ8XG75QtIzjM4g=";
-        aarch64-linux = "sha256-DRU4aT7kQffhsOllgHtSlIsYOeLF4Sy5o5RR1CaTle0=";
+        x86_64-linux = "sha256-MDnuJwJ/xKnC72Qub0ETYj5uQB2r8/AgGm10oqmzzcc=";
+        aarch64-linux = "sha256-aVUm612VNEsjZLDrtiOPTqSk1t+AhmOx+pOG3bZdOAw=";
       }).${stdenv.system} or (throw "jaxlib: unsupported system: ${stdenv.system}");
     };
 
diff --git a/pkgs/development/python-modules/jq/default.nix b/pkgs/development/python-modules/jq/default.nix
index 335b6e92781..d7dc37b0685 100644
--- a/pkgs/development/python-modules/jq/default.nix
+++ b/pkgs/development/python-modules/jq/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , cython
 , fetchFromGitHub
+, fetchpatch
 , jq
 , pytestCheckHook
 , pythonOlder
@@ -9,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "jq";
-  version = "1.4.1";
+  version = "1.5.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,12 +19,17 @@ buildPythonPackage rec {
     owner = "mwilliamson";
     repo = "jq.py";
     rev = "refs/tags/${version}";
-    hash = "sha256-prH3yUFh3swXGsxnoax09aYAXaiu8o2M21ZbOp9HDJY=";
+    hash = "sha256-mITk5y2AdUc9kZ/WrsnHxS1GRRmO4FDbPRgTtV2gIXI=";
   };
 
   patches = [
     # Removes vendoring
     ./jq-py-setup.patch
+    (fetchpatch {
+      url = "https://github.com/mwilliamson/jq.py/commit/805705dde4beb9db9a1743663d415198fb02eb1a.patch";
+      includes = [ "tests/*" ];
+      hash = "sha256-AgdpwmtOTeJ4nSbM6IknKaIVqqtWkpxTTtblXjlbWeA=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index 0528aeaec52..90fafe527bd 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -119,6 +119,9 @@ buildPythonPackage rec {
     "mypyc/test/test_commandline.py"
     # fails to find hatchling
     "mypy/test/testpep561.py"
+  ] ++ lib.optionals stdenv.hostPlatform.isi686 [
+    # https://github.com/python/mypy/issues/15221
+    "mypyc/test/test_run.py"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/ossfs/default.nix b/pkgs/development/python-modules/ossfs/default.nix
index 2989176dd2c..9b30afeb492 100644
--- a/pkgs/development/python-modules/ossfs/default.nix
+++ b/pkgs/development/python-modules/ossfs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "ossfs";
-  version = "2023.5.0";
+  version = "2023.8.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "fsspec";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-h9h5h2eJO1wzOR7oC2usrEx0ADSoKDu74YczAmZL9NU=";
+    hash = "sha256-v6QZgv1QwBrQpCwP/1z6704UNvQyoCrpQGkhTmncbjQ=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/pytube/default.nix b/pkgs/development/python-modules/pytube/default.nix
index a684e5ca6a3..2c8f714e500 100644
--- a/pkgs/development/python-modules/pytube/default.nix
+++ b/pkgs/development/python-modules/pytube/default.nix
@@ -7,9 +7,9 @@
 
 buildPythonPackage rec {
   pname = "pytube";
-  version = "12.1.2";
+  version = "15.0.0";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   format = "setuptools";
 
@@ -17,13 +17,17 @@ buildPythonPackage rec {
     owner = "pytube";
     repo = "pytube";
     rev = "v${version}";
-    hash = "sha256-Y4mriCwFvwAZ3e8kHKo9/S2vReb4q+b8KTHxtQo8SEw=";
+    hash = "sha256-Nvs/YlOjk/P5nd1kpUnCM2n6yiEaqZP830UQI0Ug1rk=";
   };
 
   nativeCheckInputs = [
     pytestCheckHook
   ];
 
+  disabledTests = [
+    "test_streaming"
+  ];
+
   disabledTestPaths = [
     "tests/test_extract.py"
     "tests/test_query.py"
diff --git a/pkgs/development/python-modules/qdrant-client/default.nix b/pkgs/development/python-modules/qdrant-client/default.nix
index 643a67d898e..b1d46d5fcb9 100644
--- a/pkgs/development/python-modules/qdrant-client/default.nix
+++ b/pkgs/development/python-modules/qdrant-client/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "qdrant-client";
-  version = "1.5.0";
+  version = "1.5.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "qdrant";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-k+ggx4QyVduqtV4WwHELyQDAHdaGE0bizpG1ie6x7FM=";
+    hash = "sha256-9aZBUrGCNRQjYRF1QmIwVqeT5Tdgv7CCkyOUsbZbmVM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index e58a165f5cc..7312e53ed41 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -14,7 +14,7 @@
 , pythran
 , wheel
 , nose
-, pytest
+, pytestCheckHook
 , pytest-xdist
 , numpy
 , pybind11
@@ -107,7 +107,22 @@ in buildPythonPackage {
 
   __darwinAllowLocalNetworking = true;
 
-  nativeCheckInputs = [ nose pytest pytest-xdist ];
+  nativeCheckInputs = [
+    nose
+    pytestCheckHook
+    pytest-xdist
+  ];
+
+  # The following tests are broken on aarch64-darwin with newer compilers and library versions.
+  # See https://github.com/scipy/scipy/issues/18308
+  disabledTests = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+    "test_a_b_neg_int_after_euler_hypergeometric_transformation"
+    "test_dst4_definition_ortho"
+    "test_load_mat4_le"
+    "hyp2f1_test_case47"
+    "hyp2f1_test_case3"
+    "test_uint64_max"
+  ];
 
   doCheck = !(stdenv.isx86_64 && stdenv.isDarwin);
 
@@ -145,9 +160,38 @@ in buildPythonPackage {
 
   checkPhase = ''
     runHook preCheck
+
+    # Adapted from pytestCheckHook because scipy uses a custom check phase.
+    # It needs to pass `$args` as a Python list to `scipy.test` rather than as
+    # arguments to pytest on the command-line.
+    args=""
+    if [ -n "$disabledTests" ]; then
+      disabledTestsString=$(_pytestComputeDisabledTestsString "''${disabledTests[@]}")
+      args+="'-k','$disabledTestsString'"
+    fi
+
+    if [ -n "''${disabledTestPaths-}" ]; then
+        eval "disabledTestPaths=($disabledTestPaths)"
+    fi
+
+    for path in ''${disabledTestPaths[@]}; do
+      if [ ! -e "$path" ]; then
+        echo "Disabled tests path \"$path\" does not exist. Aborting"
+        exit 1
+      fi
+      args+="''${args:+,}'--ignore=\"$path\"'"
+    done
+    args+="''${args:+,}$(printf \'%s\', "''${pytestFlagsArray[@]}")"
+    args=''${args%,}
+
     pushd "$out"
     export OMP_NUM_THREADS=$(( $NIX_BUILD_CORES / 4 ))
-    ${python.interpreter} -c "import scipy, sys; sys.exit(scipy.test('fast', verbose=10, parallel=$NIX_BUILD_CORES) != True)"
+    ${python.interpreter} -c "import scipy, sys; sys.exit(scipy.test(
+        'fast',
+        verbose=10,
+        extra_argv=[$args],
+        parallel=$NIX_BUILD_CORES
+    ) != True)"
     popd
     runHook postCheck
   '';
diff --git a/pkgs/development/python-modules/skorch/default.nix b/pkgs/development/python-modules/skorch/default.nix
index 2f8b842d9a9..13757f13e1a 100644
--- a/pkgs/development/python-modules/skorch/default.nix
+++ b/pkgs/development/python-modules/skorch/default.nix
@@ -2,28 +2,46 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, pytestCheckHook
-, flaky
+, pythonOlder
 , numpy
-, pandas
-, torch
 , scikit-learn
 , scipy
 , tabulate
+, torch
 , tqdm
+, flaky
+, pandas
+, pytestCheckHook
+, safetensors
+, pythonAtLeast
 }:
 
 buildPythonPackage rec {
   pname = "skorch";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/d0s0N40W18uGfVbD9VEbhbWfduoo+TBqDjmTkjMUxs=";
+    hash = "sha256-39XVBlCmbg162z9uL84GZrU+v+M8waXbGdVV72ZYf84=";
   };
 
-  propagatedBuildInputs = [ numpy torch scikit-learn scipy tabulate tqdm ];
-  nativeCheckInputs = [ flaky pandas pytestCheckHook ];
+  disabled = pythonOlder "3.8";
+
+  propagatedBuildInputs = [
+    numpy
+    scikit-learn
+    scipy
+    tabulate
+    torch
+    tqdm
+  ];
+
+  nativeCheckInputs = [
+    flaky
+    pandas
+    pytestCheckHook
+    safetensors
+  ];
 
   # patch out pytest-cov dep/invocation
   postPatch = ''
@@ -41,6 +59,10 @@ buildPythonPackage rec {
   ] ++ lib.optionals stdenv.isDarwin [
     # there is a problem with the compiler selection
     "test_fit_and_predict_with_compile"
+  ] ++ lib.optionals (pythonAtLeast "3.11") [
+    # Python 3.11+ not yet supported for torch.compile
+    # https://github.com/pytorch/pytorch/blob/v2.0.1/torch/_dynamo/eval_frame.py#L376-L377
+    "test_fit_and_predict_with_compile"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/svg2tikz/default.nix b/pkgs/development/python-modules/svg2tikz/default.nix
index 18ca0bd263e..b6623d3b800 100644
--- a/pkgs/development/python-modules/svg2tikz/default.nix
+++ b/pkgs/development/python-modules/svg2tikz/default.nix
@@ -10,9 +10,9 @@
 
 buildPythonPackage rec {
   pname = "svg2tikz";
-  version = "1.2.0";
+  version = "2.1.0";
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.7";
 
   format = "pyproject";
 
@@ -20,14 +20,9 @@ buildPythonPackage rec {
     owner = "xyz2tex";
     repo = "svg2tikz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-oFcKRcXef1Uz0qFi6Gga/D4u8zW0RjXAnHDlhRr33Ts=";
+    hash = "sha256-v8+0h90uJlkI5eJcwCG55nxPz8n2aJXwP8Ocp48cl9M=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "+dairiki.1" ""
-  '';
-
   nativeBuildInputs = [
     poetry-core
   ];
@@ -44,7 +39,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "svg2tikz" ];
 
   meta = with lib; {
-    changelog = "https://github.com/xyz2tex/svg2tikz/blob/${src.rev}/README.md#changes-bug-fixes-and-known-problems-from-the-original";
+    changelog = "https://github.com/xyz2tex/svg2tikz/blob/${src.rev}/CHANGELOG.md";
     homepage = "https://github.com/xyz2tex/svg2tikz";
     description = "Set of tools for converting SVG graphics to TikZ/PGF code";
     license = licenses.gpl2Plus;
diff --git a/pkgs/development/python-modules/systemd/default.nix b/pkgs/development/python-modules/systemd/default.nix
index ed8eb472dc5..da81905fca3 100644
--- a/pkgs/development/python-modules/systemd/default.nix
+++ b/pkgs/development/python-modules/systemd/default.nix
@@ -36,7 +36,9 @@ buildPythonPackage rec {
     export NIX_REDIRECTS=/etc/machine-id=$(realpath machine-id) \
     LD_PRELOAD=${libredirect}/lib/libredirect.so
 
-    pytest $out/${python.sitePackages}/systemd
+    # Those tests assume /etc/machine-id to be available
+    # But our redirection technique does not work apparently
+    pytest $out/${python.sitePackages}/systemd -k 'not test_get_machine and not test_get_machine_app_specific and not test_reader_this_machine'
   '';
 
   pythonImportsCheck = [
@@ -51,6 +53,6 @@ buildPythonPackage rec {
     homepage = "https://www.freedesktop.org/software/systemd/python-systemd/";
     changelog = "https://github.com/systemd/python-systemd/blob/v${version}/NEWS";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ raitobezarius ];
   };
 }
diff --git a/pkgs/development/tools/analysis/actionlint/default.nix b/pkgs/development/tools/analysis/actionlint/default.nix
index 2516c0c59c9..b953aea0bb2 100644
--- a/pkgs/development/tools/analysis/actionlint/default.nix
+++ b/pkgs/development/tools/analysis/actionlint/default.nix
@@ -10,7 +10,7 @@
 
 buildGoModule rec {
   pname = "actionlint";
-  version = "1.6.25";
+  version = "1.6.26";
 
   subPackages = [ "cmd/actionlint" ];
 
@@ -18,10 +18,10 @@ buildGoModule rec {
     owner = "rhysd";
     repo = "actionlint";
     rev = "v${version}";
-    hash = "sha256-MbMisADJg0c0idAZ3Ru1WJMzbYoyac71CIeQd3Xjsy0=";
+    hash = "sha256-BCja8twbPwYI41JuQs2LHMCXlTbY5FAjHhZvn5mIlkg=";
   };
 
-  vendorHash = "sha256-YkLZYL+VgO2QfkjVG3baPCn+CExRnsnxtdmL3GGNGlI=";
+  vendorHash = "sha256-sBwI2L9tNg8Q/vIhhp0eIxetklytvJj+O1mWjrHkH24=";
 
   nativeBuildInputs = [ makeWrapper ronn installShellFiles ];
 
diff --git a/pkgs/development/tools/argc/default.nix b/pkgs/development/tools/argc/default.nix
index 84d9332ade1..6c6f54b4c75 100644
--- a/pkgs/development/tools/argc/default.nix
+++ b/pkgs/development/tools/argc/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "argc";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "sigoden";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-BM9MXokVXA5EJwr8F7Wg5LTE1xhmj9ttVXOMNJx0RRw=";
+    hash = "sha256-DmBSHiil9TdPog1Tnz2UjwbgLwwJwdYg9qAykolriQs=";
   };
 
-  cargoHash = "sha256-SScCPBERXScYJ9LlPcbIhwCikRum0F1tU3gZYaQRFTo=";
+  cargoHash = "sha256-JyiBEawBTm8t9oKFH5OCKabWasuiRoBe0rSeyHKuXGU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/biome/default.nix b/pkgs/development/tools/biome/default.nix
index b067a25119b..d92dee556c6 100644
--- a/pkgs/development/tools/biome/default.nix
+++ b/pkgs/development/tools/biome/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "biome";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "cli/v${version}";
-    hash = "sha256-/rIPIZX3w28xTn+UyAsB+lgfF0LDmxM92EofcPSCD+4=";
+    hash = "sha256-WiyORFXS1kpOaMCbnPdr5ewa6D4ozFTIRSArVlA2FvY=";
   };
 
-  cargoHash = "sha256-5mX4RDACImjiU+nSuN9SzyibIMcUWYCAJfikX2gWIfg=";
+  cargoHash = "sha256-s2CVEGYRzJgsg4soETStpaJ7GDNdJCBJ+Qbn88sFlDQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/code-maat/default.nix b/pkgs/development/tools/code-maat/default.nix
index c65b8844935..4d7be6c4b06 100644
--- a/pkgs/development/tools/code-maat/default.nix
+++ b/pkgs/development/tools/code-maat/default.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "code-maat";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchurl {
     url = "https://github.com/adamtornhill/code-maat/releases/download/v${finalAttrs.version}/code-maat-${finalAttrs.version}-standalone.jar";
-    hash = "sha256-cAaGX9BX27Z2GN583YmhagWsBIygVc0ZDkzbspM9OJw=";
+    hash = "sha256-QoeuIDSQGERFD3aVR7xEl6DaGm0cf6b63IWHBeZ0O18=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/tools/jq/default.nix b/pkgs/development/tools/jq/default.nix
index 3c6d85e8ddc..4a57c0f5a0c 100644
--- a/pkgs/development/tools/jq/default.nix
+++ b/pkgs/development/tools/jq/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, removeReferencesTo
 , autoreconfHook
 , bison
 , onigurumaSupport ? true
@@ -9,18 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "jq";
-  version = "1.6";
+  version = "1.7";
 
   # Note: do not use fetchpatch or fetchFromGitHub to keep this package available in __bootPackages
   src = fetchurl {
-    url = "https://github.com/stedolan/jq/releases/download/jq-${version}/jq-${version}.tar.gz";
-    sha256 = "sha256-XejI4pqqP7nMa0e7JymfJxNU67clFOOsytx9OLW7qnI=";
+    url = "https://github.com/jqlang/jq/releases/download/jq-${version}/jq-${version}.tar.gz";
+    hash = "sha256-QCoNaXXZRub05ITRqEMgQUoP+Ots9J0sEdFE1NNE22I=";
   };
 
-  patches = [
-    ./fix-tests-when-building-without-regex-supports.patch
-  ];
-
   outputs = [ "bin" "doc" "man" "dev" "lib" "out" ];
 
   # Upstream script that writes the version that's eventually compiled
@@ -39,7 +36,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = lib.optionals onigurumaSupport [ oniguruma ];
-  nativeBuildInputs = [ autoreconfHook bison ];
+  nativeBuildInputs = [ removeReferencesTo autoreconfHook bison ];
 
   # Darwin requires _REENTRANT be defined to use functions like `lgamma_r`.
   # Otherwise, configure will detect that they’re in libm, but the build will fail
@@ -59,6 +56,12 @@ stdenv.mkDerivation rec {
   # jq is linked to libjq:
   ++ lib.optional (!stdenv.isDarwin) "LDFLAGS=-Wl,-rpath,\\\${libdir}";
 
+  # Break the dependency cycle: $dev refers to $bin via propagated-build-outputs, and
+  # $bin refers to $dev because of https://github.com/jqlang/jq/commit/583e4a27188a2db097dd043dd203b9c106bba100
+  postFixup = ''
+    remove-references-to -t "$dev" "$bin/bin/jq"
+  '';
+
   doInstallCheck = true;
   installCheckTarget = "check";
 
@@ -71,11 +74,11 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A lightweight and flexible command-line JSON processor";
-    homepage = "https://stedolan.github.io/jq/";
+    homepage = "https://jqlang.github.io/jq/";
     license = licenses.mit;
-    maintainers = with maintainers; [ raskin globin artturin ];
+    maintainers = with maintainers; [ raskin artturin ncfavier ];
     platforms = platforms.unix;
-    downloadPage = "https://stedolan.github.io/jq/download/";
+    downloadPage = "https://jqlang.github.io/jq/download/";
     mainProgram = "jq";
   };
 }
diff --git a/pkgs/development/tools/jq/fix-tests-when-building-without-regex-supports.patch b/pkgs/development/tools/jq/fix-tests-when-building-without-regex-supports.patch
deleted file mode 100644
index ac7614ed80b..00000000000
--- a/pkgs/development/tools/jq/fix-tests-when-building-without-regex-supports.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From f6a69a6e52b68a92b816a28eb20719a3d0cb51ae Mon Sep 17 00:00:00 2001
-From: Dmitry Bogatov <git#v1@kaction.cc>
-Date: Sat, 27 Mar 2021 00:00:00 +0000
-Subject: [PATCH] Disable some tests when building without regex support
-
----
- Makefile.am  | 5 ++++-
- configure.ac | 1 +
- 2 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index f5c1db594..f3f44bb9e 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -130,7 +130,10 @@ endif
- 
- ### Tests (make check)
- 
--TESTS = tests/optionaltest tests/mantest tests/jqtest tests/onigtest tests/shtest tests/utf8test tests/base64test
-+TESTS = tests/optionaltest tests/jqtest tests/shtest tests/utf8test tests/base64test
-+if WITH_ONIGURUMA
-+TESTS += tests/mantest tests/onigtest
-+endif
- TESTS_ENVIRONMENT = NO_VALGRIND=$(NO_VALGRIND)
- 
- # This is a magic make variable that causes it to treat tests/man.test as a
-diff --git a/configure.ac b/configure.ac
-index 0441d4a2c..987d94e0a 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -278,6 +278,7 @@ AC_SUBST(onig_CFLAGS)
- AC_SUBST(onig_LDFLAGS)
- 
- AM_CONDITIONAL([BUILD_ONIGURUMA], [test "x$build_oniguruma" = xyes])
-+AM_CONDITIONAL([WITH_ONIGURUMA], [test "x$with_oniguruma" = xyes])
- AC_SUBST([BUNDLER], ["$bundle_cmd"])
- 
- AC_CONFIG_MACRO_DIR([config/m4])
diff --git a/pkgs/development/tools/misc/autoconf-archive/default.nix b/pkgs/development/tools/misc/autoconf-archive/default.nix
index 9b5ca5de570..3fbfabcee26 100644
--- a/pkgs/development/tools/misc/autoconf-archive/default.nix
+++ b/pkgs/development/tools/misc/autoconf-archive/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "autoconf-archive";
-  version = "2022.09.03";
+  version = "2023.02.20";
 
   src = fetchurl {
     url = "mirror://gnu/autoconf-archive/autoconf-archive-${version}.tar.xz";
-    sha256 = "sha256-4HRU8A2MrnkHvtQtB0d5iSeAmUdoTZTDcgek1joy9CM=";
+    hash = "sha256-cdQEhHmuKPH1eUYZw9ct+cAd9JscYo74X943WW3DGjM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/tools/misc/gperf/3.0.x.nix b/pkgs/development/tools/misc/gperf/3.0.x.nix
index f83b245417e..8a2fdf6ec4b 100644
--- a/pkgs/development/tools/misc/gperf/3.0.x.nix
+++ b/pkgs/development/tools/misc/gperf/3.0.x.nix
@@ -10,7 +10,18 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook ];
-  patches = [ ./gperf-ar-fix.patch ];
+  patches = [
+    ./gperf-ar-fix.patch
+    # Clang 16 defaults to C++17, which does not allow `register` as a storage class specifier.
+    ./gperf-c++17-register-fix.patch
+  ];
+
+  # Replace the conditional inclusion of `string.h` on VMS with unconditional inclusion on all
+  # platforms. Otherwise, clang 16 fails to build gperf due to use of undeclared library functions.
+  postPatch = ''
+    sed '/#ifdef VMS/{N;N;N;N;N;s/.*/#include <string.h>/}' -i lib/getopt.c
+  '';
+
   meta = {
     description = "Perfect hash function generator";
 
diff --git a/pkgs/development/tools/rust/cargo-shuttle/Cargo.lock b/pkgs/development/tools/rust/cargo-shuttle/Cargo.lock
index 3521b27b18f..24af540157c 100644
--- a/pkgs/development/tools/rust/cargo-shuttle/Cargo.lock
+++ b/pkgs/development/tools/rust/cargo-shuttle/Cargo.lock
@@ -1141,7 +1141,7 @@ dependencies = [
 
 [[package]]
 name = "cargo-shuttle"
-version = "0.25.1"
+version = "0.26.0"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -5352,7 +5352,7 @@ dependencies = [
 
 [[package]]
 name = "shuttle-admin"
-version = "0.25.0"
+version = "0.26.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -5369,7 +5369,7 @@ dependencies = [
 
 [[package]]
 name = "shuttle-auth"
-version = "0.25.0"
+version = "0.26.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5398,7 +5398,7 @@ dependencies = [
 
 [[package]]
 name = "shuttle-codegen"
-version = "0.25.0"
+version = "0.26.0"
 dependencies = [
  "pretty_assertions",
  "proc-macro-error",
@@ -5415,7 +5415,7 @@ dependencies = [
 
 [[package]]
 name = "shuttle-common"
-version = "0.25.0"
+version = "0.26.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5438,7 +5438,6 @@ dependencies = [
  "opentelemetry-otlp",
  "pin-project",
  "proptest",
- "prost-types",
  "rand",
  "reqwest",
  "ring",
@@ -5464,20 +5463,23 @@ dependencies = [
 
 [[package]]
 name = "shuttle-common-tests"
-version = "0.25.0"
+version = "0.26.0"
 dependencies = [
  "cargo-shuttle",
  "hyper",
  "portpicker",
  "reqwest",
  "shuttle-common",
+ "shuttle-proto",
  "tokio",
+ "tokio-stream",
+ "tonic",
  "tower",
 ]
 
 [[package]]
 name = "shuttle-deployer"
-version = "0.25.0"
+version = "0.26.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5500,11 +5502,13 @@ dependencies = [
  "opentelemetry-http",
  "pipe",
  "portpicker",
+ "prost-types",
  "rand",
  "rmp-serde",
  "serde",
  "serde_json",
  "shuttle-common",
+ "shuttle-common-tests",
  "shuttle-proto",
  "shuttle-service",
  "sqlx",
@@ -5513,6 +5517,7 @@ dependencies = [
  "tempfile",
  "thiserror",
  "tokio",
+ "tokio-stream",
  "toml 0.5.11",
  "tonic",
  "tower",
@@ -5528,7 +5533,7 @@ dependencies = [
 
 [[package]]
 name = "shuttle-gateway"
-version = "0.25.0"
+version = "0.26.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5585,8 +5590,34 @@ dependencies = [
 ]
 
 [[package]]
+name = "shuttle-logger"
+version = "0.26.0"
+dependencies = [
+ "async-trait",
+ "chrono",
+ "clap",
+ "ctor",
+ "once_cell",
+ "portpicker",
+ "pretty_assertions",
+ "prost-types",
+ "serde_json",
+ "shuttle-common",
+ "shuttle-common-tests",
+ "shuttle-proto",
+ "sqlx",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tonic",
+ "tracing",
+ "tracing-subscriber",
+ "uuid",
+]
+
+[[package]]
 name = "shuttle-proto"
-version = "0.25.0"
+version = "0.26.0"
 dependencies = [
  "anyhow",
  "chrono",
@@ -5604,7 +5635,7 @@ dependencies = [
 
 [[package]]
 name = "shuttle-provisioner"
-version = "0.25.0"
+version = "0.26.0"
 dependencies = [
  "aws-config",
  "aws-sdk-rds",
@@ -5630,7 +5661,7 @@ dependencies = [
 
 [[package]]
 name = "shuttle-resource-recorder"
-version = "0.25.0"
+version = "0.26.0"
 dependencies = [
  "async-trait",
  "chrono",
@@ -5654,12 +5685,13 @@ dependencies = [
 
 [[package]]
 name = "shuttle-runtime"
-version = "0.25.0"
+version = "0.26.0"
 dependencies = [
  "anyhow",
  "async-trait",
  "cap-std",
  "chrono",
+ "colored",
  "crossbeam-channel",
  "futures",
  "hyper",
@@ -5678,8 +5710,8 @@ dependencies = [
  "tokio-stream",
  "tonic",
  "tower",
- "tracing",
  "tracing-subscriber",
+ "uuid",
  "wasi-common",
  "wasmtime",
  "wasmtime-wasi",
@@ -5687,7 +5719,7 @@ dependencies = [
 
 [[package]]
 name = "shuttle-service"
-version = "0.25.0"
+version = "0.26.0"
 dependencies = [
  "anyhow",
  "async-trait",
diff --git a/pkgs/development/tools/rust/cargo-shuttle/default.nix b/pkgs/development/tools/rust/cargo-shuttle/default.nix
index 5e3f2cca245..db18ac85ab6 100644
--- a/pkgs/development/tools/rust/cargo-shuttle/default.nix
+++ b/pkgs/development/tools/rust/cargo-shuttle/default.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-shuttle";
-  version = "0.25.1";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "shuttle-hq";
     repo = "shuttle";
     rev = "v${version}";
-    hash = "sha256-UB9S3Ougd7t+D3oAYE9i6AUY76bNKrr605W6GWh1vb0=";
+    hash = "sha256-O6erIv+6DbxioB4F1Mfaj51zSswQErcUuFdA+A7DQRA=";
   };
 
   cargoLock = {
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index 8780b8892fa..4b66ecfa467 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-uaDTL6dfH+zqjMbLtgLaZRe91mDuyKA0afw+3LFF+1U=";
+    hash = "sha256-hxtT5cL1PTXkTXGB0nVPhMI8Vlqrk4q2MHW0KGosFwc=";
   };
 
-  cargoHash = "sha256-DF8O3YrHr0tBStnmnUUUF4QaZcoXYCCweZoEig4etQA=";
+  cargoHash = "sha256-IZWh/Bp9TdB+flc1PXVkwrIdOr83TFk6X6O5M0FVaO4=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security libiconv ];
 
diff --git a/pkgs/development/tools/sd-local/default.nix b/pkgs/development/tools/sd-local/default.nix
index da696c5d714..bc89ce9c525 100644
--- a/pkgs/development/tools/sd-local/default.nix
+++ b/pkgs/development/tools/sd-local/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "sd-local";
-  version = "1.0.48";
+  version = "1.0.49";
 
   src = fetchFromGitHub {
     owner = "screwdriver-cd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cjPqVdHJt1/kxFCdjOKQIvq1V3KppHPeWozrawxdJek=";
+    sha256 = "sha256-cyu2J7clIyM6j9ELO2Xk/9agQHtvPtr9yHM/gRTzzG0=";
   };
 
   vendorHash = "sha256-uHu8jPPQCJAhXE+Lzw5/9wyw7sL5REQJsPsYII+Nusc=";
diff --git a/pkgs/development/tools/wasmedge/default.nix b/pkgs/development/tools/wasmedge/default.nix
index 741a610c890..6ebbe75a15b 100644
--- a/pkgs/development/tools/wasmedge/default.nix
+++ b/pkgs/development/tools/wasmedge/default.nix
@@ -41,7 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DWASMEDGE_BUILD_TESTS=OFF" # Tests are downloaded using git
   ] ++ lib.optionals stdenv.isDarwin [
     "-DWASMEDGE_FORCE_DISABLE_LTO=ON"
diff --git a/pkgs/games/dwarf-fortress/update.sh b/pkgs/games/dwarf-fortress/update.sh
index 0ef9a40c7a5..5b99dff8aa7 100755
--- a/pkgs/games/dwarf-fortress/update.sh
+++ b/pkgs/games/dwarf-fortress/update.sh
@@ -38,5 +38,5 @@ done | jq --slurp --raw-input \
 
 # Append $tmp1 to game.json. There should be a better way to handle
 # this but all other attempts failed for me.
-jq -M --argfile a "$tmp1" '. + $a' < "$(dirname "$0")/game.json" > "$tmp2"
+jq -M --slurpfile a "$tmp1" '. + $a[]' < "$(dirname "$0")/game.json" > "$tmp2"
 cat "$tmp2" > "$(dirname "$0")/game.json"
diff --git a/pkgs/games/etlegacy/default.nix b/pkgs/games/etlegacy/default.nix
index ee5d31874c6..befbbc5ed29 100644
--- a/pkgs/games/etlegacy/default.nix
+++ b/pkgs/games/etlegacy/default.nix
@@ -100,7 +100,6 @@ stdenv.mkDerivation {
   '';
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DCROSS_COMPILE32=0"
     "-DBUILD_SERVER=1"
     "-DBUILD_CLIENT=1"
diff --git a/pkgs/games/lzwolf/default.nix b/pkgs/games/lzwolf/default.nix
index 7598022f31b..37bcc7fc8e0 100644
--- a/pkgs/games/lzwolf/default.nix
+++ b/pkgs/games/lzwolf/default.nix
@@ -38,7 +38,6 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DGPL=ON"
   ];
 
diff --git a/pkgs/games/nanosaur/default.nix b/pkgs/games/nanosaur/default.nix
index 5460d3d87e0..4ec59b726ee 100644
--- a/pkgs/games/nanosaur/default.nix
+++ b/pkgs/games/nanosaur/default.nix
@@ -20,8 +20,6 @@ stdenv.mkDerivation rec {
     SDL2
   ];
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
-
   installPhase = ''
     runHook preInstall
     mkdir -p "$out/bin"
diff --git a/pkgs/games/nanosaur2/default.nix b/pkgs/games/nanosaur2/default.nix
index 423d40e71c6..7ab77623e65 100644
--- a/pkgs/games/nanosaur2/default.nix
+++ b/pkgs/games/nanosaur2/default.nix
@@ -20,8 +20,6 @@ stdenv.mkDerivation rec {
     SDL2
   ];
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
-
   installPhase = ''
     runHook preInstall
     mkdir -p "$out/bin"
diff --git a/pkgs/games/openmw/tes3mp.nix b/pkgs/games/openmw/tes3mp.nix
index f236bc8cd5e..8b6c96c5286 100644
--- a/pkgs/games/openmw/tes3mp.nix
+++ b/pkgs/games/openmw/tes3mp.nix
@@ -26,7 +26,6 @@ let
     };
 
     cmakeFlags = [
-      "-DCMAKE_BUILD_TYPE=Release"
       "-DCRABNET_ENABLE_DLL=OFF"
     ];
 
diff --git a/pkgs/games/otto-matic/default.nix b/pkgs/games/otto-matic/default.nix
index 800b97b2b86..c56db251a1b 100644
--- a/pkgs/games/otto-matic/default.nix
+++ b/pkgs/games/otto-matic/default.nix
@@ -21,8 +21,6 @@ stdenv.mkDerivation rec {
     SDL2
   ];
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/games/prismlauncher/default.nix b/pkgs/games/prismlauncher/default.nix
index 63c6901326e..9f260aaba9d 100644
--- a/pkgs/games/prismlauncher/default.nix
+++ b/pkgs/games/prismlauncher/default.nix
@@ -98,6 +98,7 @@ rec {
   dontWrapQtApps = true;
 
   meta = with lib; {
+    mainProgram = "prismlauncher";
     homepage = "https://prismlauncher.org/";
     description = "A free, open source launcher for Minecraft";
     longDescription = ''
diff --git a/pkgs/games/prismlauncher/wrapper.nix b/pkgs/games/prismlauncher/wrapper.nix
index 89b0b08c229..c95a5c00bcf 100644
--- a/pkgs/games/prismlauncher/wrapper.nix
+++ b/pkgs/games/prismlauncher/wrapper.nix
@@ -17,10 +17,12 @@
 , flite
 , mesa-demos
 , udev
+, libusb1
 
 , msaClientID ? null
 , gamemodeSupport ? stdenv.isLinux
 , textToSpeechSupport ? stdenv.isLinux
+, controllerSupport ? stdenv.isLinux
 , jdks ? [ jdk17 jdk8 ]
 , additionalLibs ? [ ]
 , additionalPrograms ? [ ]
@@ -71,6 +73,7 @@ symlinkJoin {
       ]
       ++ lib.optional gamemodeSupport gamemode.lib
       ++ lib.optional textToSpeechSupport flite
+      ++ lib.optional controllerSupport libusb1
       ++ additionalLibs;
 
       runtimePrograms = [
diff --git a/pkgs/misc/drivers/epsonscan2/default.nix b/pkgs/misc/drivers/epsonscan2/default.nix
index 325cbbd8707..69c4c03b95e 100644
--- a/pkgs/misc/drivers/epsonscan2/default.nix
+++ b/pkgs/misc/drivers/epsonscan2/default.nix
@@ -97,7 +97,6 @@ stdenv.mkDerivation {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     # The non-free (Debian) packages uses this directory structure so do the same when compiling
     # from source so we can easily merge them.
     "-DCMAKE_INSTALL_LIBDIR=lib/${system}-gnu"
diff --git a/pkgs/misc/dumb/default.nix b/pkgs/misc/dumb/default.nix
index 2a554d99b28..f80dea534a6 100644
--- a/pkgs/misc/dumb/default.nix
+++ b/pkgs/misc/dumb/default.nix
@@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
   };
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE='Release'"
     "-DBUILD_EXAMPLES='OFF'"
   ];
 
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 230f73ef416..c85a75d1f17 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -3,18 +3,20 @@
 , autoreconfHook
 , pkg-config
 , dbus
+, fetchpatch
+, sysctl
 }:
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.57";
+  version = "0.58";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-9d9WMCByQ1TKWpzWe5msts1LG+BKKqwCgaMBbD74/+4=";
+    hash = "sha256-CwUwwvyT541aIvypVMqRhHkVJLna121Cme+v7c0FLWo=";
   };
 
   nativeBuildInputs = [
@@ -24,8 +26,18 @@ stdenv.mkDerivation rec {
 
   nativeCheckInputs = [
     dbus
+    # required as the sysctl test works on some machines
+    sysctl
   ];
 
+  patches = [
+    # /proc/sys/net/core/somaxconn doesn't always exist in the nix build environment
+    (fetchpatch {
+      name = "skip-sysctl-test-if-sysfs-not-available.patch";
+      url = "https://patchwork.kernel.org/project/ell/patch/526DA75D-01AB-4D85-BF5C-5F25E5C39480@kloenk.dev/raw/";
+      hash = "sha256-YYGYWQ67cbMLt6RnqZmHt+tpvVIDKPbSCqPIouk6alU=";
+    })
+  ];
   enableParallelBuilding = true;
 
   # tests sporadically fail on musl
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 6c7afffd9ce..a64a0574d8f 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.373";
+  version = "0.374";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-KXZodSvY4Szt/gp0iRkx+ngziCaUYvkjnkvjwPj3OwI=";
+    hash = "sha256-RvjYd8iD6JkGhh6TDy/Qo+UzLxbhPvIJvhl/Rw14lbk=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index 792fef69cbd..1b983bb90e1 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -12,12 +12,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "2.7";
+  version = "2.8";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "sha256-UsyJYQB6YzwcL6H1nyCW8ZTpBzacZMAp39mCfsZqwHY=";
+    sha256 = "sha256-i+2R8smgLXooApj0Z5e03FybhYgw1X/kIsJkrDzW8y4=";
   };
 
   outputs = [ "out" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index b1c0d3ba50d..ff40e585b1d 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -111,12 +111,12 @@ let
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "6.4"; in
+  linuxHeaders = let version = "6.5"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
-        hash = "sha256-j6BYjwws7KRMrHeg45ukjJ8AprncaXYcAqXT76yNp/M=";
+        hash = "sha256-eldLvCCALqdrUsp/rwcmf3IEXoYbGJFcUnKpjCer+IQ=";
       };
       patches = [
          ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 659fc1a65c1..594b303a25a 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -52,22 +52,22 @@
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.52-hardened1.patch",
-            "sha256": "1xp8m9d927g3nb8l6pc4xzm0yspxxa0kpiv6hi1x0cal5a1bwnb3",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.52-hardened1/linux-hardened-6.1.52-hardened1.patch"
+            "name": "linux-hardened-6.1.53-hardened1.patch",
+            "sha256": "1v8k4rb3f24cpzvng7nyxllypmi8dc4cv0yj2jfvr64pxr7vzlkw",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.53-hardened1/linux-hardened-6.1.53-hardened1.patch"
         },
-        "sha256": "0lis73mxnl7hxz8lyja6sfgmbym944l3k1h7dab6b4mw1nckfxsn",
-        "version": "6.1.52"
+        "sha256": "0zpdg3fcc12iyjhfs5w7cw75700z4i8m9jcg38mlzlhh92hf0msz",
+        "version": "6.1.53"
     },
     "6.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.4.15-hardened1.patch",
-            "sha256": "1r6c1yzr0cmfhqv0qirj9nbc2hgmmh43mwal1gmyhk5qisq7h1rf",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.15-hardened1/linux-hardened-6.4.15-hardened1.patch"
+            "name": "linux-hardened-6.4.16-hardened1.patch",
+            "sha256": "10lydnnhhq9ynng1gfaqh1mncsb0dmr27zzcbygs1xigy2bl70n9",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.16-hardened1/linux-hardened-6.4.16-hardened1.patch"
         },
-        "sha256": "1phlx375ln5pslw5vjqm029cdv6pzf4ang10xlrf90x5sb4fgy93",
-        "version": "6.4.15"
+        "sha256": "0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln",
+        "version": "6.4.16"
     },
     "6.5": {
         "patch": {
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index f340b5d9f5d..213bf7e670f 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.194";
+  version = "5.10.195";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "15fr7krhpmqz0xqjg78m2xvfllbni3xh8xyhxh9ni31ppd3mw394";
+    sha256 = "0n4vg2i9sq89wnz85arlyvwysh9s83cgzs5bk2wh98bivi5fwfs1";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index e189e720108..d86b0cf0ce6 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.131";
+  version = "5.15.132";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0sacnbw48lblnqaj56nybh588sq4k84gwf0r5zinzyrryj8k6z4r";
+    sha256 = "1b0qjsaqjw2rk86shmmrj2aasblkn27acjmc761vnjg7sv2baxs1";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index a9de8074de4..df99c986851 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.53";
+  version = "6.1.54";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0zpdg3fcc12iyjhfs5w7cw75700z4i8m9jcg38mlzlhh92hf0msz";
+    sha256 = "09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.5.nix b/pkgs/os-specific/linux/kernel/linux-6.5.nix
index 614a07b66a2..28557090de6 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.5.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.5.3";
+  version = "6.5.4";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    hash = "sha256-TKwT97F72Nz5AyrWj5Ejq1MT1pjJ9ZQWBDFlFQdj608=";
+    sha256 = "0s8nzd8yaq06bq8byk7aakbk95gh0rhlif26h1biw94v48anrxxx";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 6a0f7c2325e..ef020b7eb56 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19397";
-    sha256 = "130q08my839kwbi1v8lqwvs6w8s6328ki7s243as4yz4kfrlymr3";
+    rev = "19408";
+    sha256 = "1bfpzdfd7k859ids5d5ixzn36c7f62gh2lw6gv4szwakw032gh9i";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index cfb84c25f27..d599c3bda31 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.46-rt13"; # updated by ./update-rt.sh
+  version = "6.1.46-rt14"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -25,7 +25,7 @@ in buildLinux (args // {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "00pj02mvamxvlkwrca1j3baaa18rg6dra7al1xsvgw3ypckwyafz";
+      sha256 = "0mrpsy175iz0b51hwgqbj15w83lm3m57il3gqwb489gln7mpzy17";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index f0e2c281aa5..746f9b17a69 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -1,9 +1,9 @@
 { lib, stdenv, fetchFromGitHub
-, runtimeShell, nixosTests, fetchpatch
+, runtimeShell, nixosTests
 , autoreconfHook, bison, flex
 , docbook_xml_dtd_45, docbook_xsl
-, itstool , libxml2, libxslt
-, libxcrypt
+, itstool, libbsd, libxml2, libxslt
+, libxcrypt, pkg-config
 , glibcCross ? null
 , pam ? null
 , withTcb ? lib.meta.availableOn stdenv.hostPlatform tcb, tcb
@@ -17,13 +17,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "shadow";
-  version = "4.13";
+  version = "4.14.0";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
     repo = pname;
     rev = version;
-    sha256 = "sha256-L54DhdBYthfB9436t/XWXiqKhW7rfd0GLS7pYGB32rA=";
+    hash = "sha256-zopJevCv7ot8RLp/rSQGKO05eF4FjkLaOEMo9aq9Afo=";
   };
 
   outputs = [ "out" "su" "dev" "man" ];
@@ -34,9 +34,10 @@ stdenv.mkDerivation rec {
     autoreconfHook bison flex
     docbook_xml_dtd_45 docbook_xsl
     itstool libxml2 libxslt
+    pkg-config
   ];
 
-  buildInputs = [ libxcrypt ]
+  buildInputs = [ libbsd libxcrypt ]
     ++ lib.optional (pam != null && stdenv.isLinux) pam
     ++ lib.optional withTcb tcb;
 
@@ -46,11 +47,6 @@ stdenv.mkDerivation rec {
     ./respect-xml-catalog-files-var.patch
     ./runtime-shell.patch
     ./fix-install-with-tcb.patch
-    # Fix HAVE_SHADOWGRP configure check
-    (fetchpatch {
-      url = "https://github.com/shadow-maint/shadow/commit/a281f241b592aec636d1b93a99e764499d68c7ef.patch";
-      sha256 = "sha256-GJWg/8ggTnrbIgjI+HYa26DdVbjTHTk/IHhy7GU9G5w=";
-    })
   ];
 
   # The nix daemon often forbids even creating set[ug]id files.
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index a5cb7ba6bf7..104a9dad959 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -13,7 +13,7 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index 3dbba1f850..40d367d1c8 100644
+index c0defc31de..8f80235731 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
 @@ -20,10 +20,6 @@ SUBSYSTEM=="block", TAG+="systemd"
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index 138823ec68f..dda8524c498 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -1,21 +1,23 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Fri, 12 Apr 2013 13:16:57 +0200
+From: Raito Bezarius <masterancpp@gmail.com>
+Date: Mon, 19 Jun 2023 02:11:35 +0200
 Subject: [PATCH] Don't try to unmount /nix or /nix/store
 
 They'll still be remounted read-only.
 
 https://github.com/NixOS/nixos/issues/126
+
+Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
 ---
  src/shared/fstab-util.c | 2 ++
- src/shutdown/umount.c   | 2 ++
- 2 files changed, 4 insertions(+)
+ src/shutdown/umount.c   | 6 ++++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index 164e71a150..68e0766594 100644
+index 4ffec25c75..b99031c54e 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
-@@ -41,6 +41,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
+@@ -43,6 +43,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
          /* Don't bother with the OS data itself */
          if (PATH_IN_SET(mount,
                          "/",
@@ -25,15 +27,19 @@ index 164e71a150..68e0766594 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 61bd9d2601..a6243da417 100644
+index 1586c2e214..fcae95f824 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
-@@ -531,6 +531,8 @@ static int delete_md(MountPoint *m) {
- 
+@@ -170,8 +170,10 @@ int mount_points_list_get(const char *mountinfo, MountPoint **head) {
  static bool nonunmountable_path(const char *path) {
-         return path_equal(path, "/")
+         assert(path);
+ 
+-        return PATH_IN_SET(path, "/", "/usr") ||
+-                path_startswith(path, "/run/initramfs");
++        return PATH_IN_SET(path, "/", "/usr")
 +                || path_equal(path, "/nix")
 +                || path_equal(path, "/nix/store")
- #if ! HAVE_SPLIT_USR
-                 || path_equal(path, "/usr")
- #endif
++                || path_startswith(path, "/run/initramfs");
+ }
+ 
+ static void log_umount_blockers(const char *mnt) {
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 08499a22834..2d86d1e6957 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 3dabe12672..e5aa4feb1e 100644
+index e170958fc5..898a674631 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5638,6 +5638,7 @@ static int run(int argc, char *argv[]) {
+@@ -5648,6 +5648,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,7 +21,7 @@ index 3dabe12672..e5aa4feb1e 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -5652,6 +5653,7 @@ static int run(int argc, char *argv[]) {
+@@ -5662,6 +5663,7 @@ static int run(int argc, char *argv[]) {
                                                      "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
                                  goto finish;
                          }
diff --git a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
index b4a0da30c8f..c905a4d812a 100644
--- a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
@@ -1,6 +1,6 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Fri, 19 Dec 2014 14:46:17 +0100
+From: Raito Bezarius <masterancpp@gmail.com>
+Date: Mon, 19 Jun 2023 02:13:42 +0200
 Subject: [PATCH] Add some NixOS-specific unit directories
 
 Look in `/nix/var/nix/profiles/default/lib/systemd/{system,user}` for
@@ -8,13 +8,15 @@ units provided by packages installed into the default profile via
 `nix-env -iA nixos.$package`.
 
 Also, remove /usr and /lib as these don't exist on NixOS.
+
+Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
 ---
  src/basic/path-lookup.c | 17 ++---------------
  src/core/systemd.pc.in  |  8 ++++----
  2 files changed, 6 insertions(+), 19 deletions(-)
 
 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index c99e9d8786..b9f85d1f8c 100644
+index 7d158a8295..f9bd62b631 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
 @@ -92,11 +92,7 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
@@ -62,35 +64,37 @@ index c99e9d8786..b9f85d1f8c 100644
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -808,7 +799,6 @@ char **generator_binary_paths(LookupScope scope) {
-                 case LOOKUP_SCOPE_SYSTEM:
+@@ -808,7 +799,6 @@ char **generator_binary_paths(RuntimeScope scope) {
+                 case RUNTIME_SCOPE_SYSTEM:
                          add = strv_new("/run/systemd/system-generators",
                                         "/etc/systemd/system-generators",
 -                                       "/usr/local/lib/systemd/system-generators",
                                         SYSTEM_GENERATOR_DIR);
                          break;
  
-@@ -816,7 +806,6 @@ char **generator_binary_paths(LookupScope scope) {
-                 case LOOKUP_SCOPE_USER:
+@@ -816,7 +806,6 @@ char **generator_binary_paths(RuntimeScope scope) {
+                 case RUNTIME_SCOPE_USER:
                          add = strv_new("/run/systemd/user-generators",
                                         "/etc/systemd/user-generators",
 -                                       "/usr/local/lib/systemd/user-generators",
                                         USER_GENERATOR_DIR);
                          break;
  
-@@ -855,12 +844,10 @@ char **env_generator_binary_paths(bool is_system) {
-                 if (is_system)
+@@ -855,14 +844,12 @@ char **env_generator_binary_paths(RuntimeScope runtime_scope) {
+                 case RUNTIME_SCOPE_SYSTEM:
                          add = strv_new("/run/systemd/system-environment-generators",
                                          "/etc/systemd/system-environment-generators",
 -                                        "/usr/local/lib/systemd/system-environment-generators",
                                          SYSTEM_ENV_GENERATOR_DIR);
-                 else
+                         break;
+ 
+                 case RUNTIME_SCOPE_USER:
                          add = strv_new("/run/systemd/user-environment-generators",
                                         "/etc/systemd/user-environment-generators",
 -                                       "/usr/local/lib/systemd/user-environment-generators",
                                         USER_ENV_GENERATOR_DIR);
+                         break;
  
-                 if (!add)
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
 index 693433b34b..5932a21b5b 100644
 --- a/src/core/systemd.pc.in
diff --git a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
index e9f73d7c772..0a80d5ac4e8 100644
--- a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 4bc8a06bd2..342892490e 100644
+index 22ec6e79b1..771e8e7f16 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1486,7 +1486,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1559,7 +1559,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
index 2c4c3f6564e..abc6c24dbf5 100644
--- a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -11,10 +11,10 @@ Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index 36ab0148b9..7d458d196d 100644
+index 9ef45f8e75..99b1ec2e36 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -1028,6 +1028,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+@@ -1053,6 +1053,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
          if (r < 0)
                  return r;
  
@@ -24,7 +24,7 @@ index 36ab0148b9..7d458d196d 100644
          name = empty_to_null(name);
  
          context_read_etc_hostname(c);
-@@ -1091,6 +1094,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+@@ -1116,6 +1119,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
          if (r < 0)
                  return r;
  
@@ -35,10 +35,10 @@ index 36ab0148b9..7d458d196d 100644
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 841e5e3e91..a21e34430b 100644
+index f544a73580..ce00c262cc 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
-@@ -264,6 +264,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
+@@ -229,6 +229,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
  
          use_localegen = locale_gen_check_available();
  
@@ -48,7 +48,7 @@ index 841e5e3e91..a21e34430b 100644
          /* If single locale without variable name is provided, then we assume it is LANG=. */
          if (strv_length(l) == 1 && !strchr(l[0], '=')) {
                  if (!locale_is_valid(l[0]))
-@@ -382,6 +385,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
+@@ -347,6 +350,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
          if (r < 0)
                  return bus_log_parse_error(r);
  
@@ -57,8 +57,8 @@ index 841e5e3e91..a21e34430b 100644
 +
          vc_context_empty_to_null(&in);
  
-         FOREACH_STRING(name, in.keymap ?: in.toggle, in.keymap ? in.toggle : NULL) {
-@@ -607,6 +613,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
+         r = vc_context_verify_and_warn(&in, LOG_ERR, error);
+@@ -465,6 +471,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
          if (r < 0)
                  return bus_log_parse_error(r);
  
@@ -67,9 +67,9 @@ index 841e5e3e91..a21e34430b 100644
 +
          x11_context_empty_to_null(&in);
  
-         if (!x11_context_is_safe(&in))
+         r = x11_context_verify_and_warn(&in, LOG_ERR, error);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index ad483301ef..31ed86955b 100644
+index ad1d492d6b..331af34505 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
 @@ -665,6 +665,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
diff --git a/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 300906be04d..3150d97be2e 100644
--- a/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -35,10 +35,10 @@ index e486474c44..5f373d0723 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 0bea149324..4b16115d43 100644
+index 1db630003a..31744c3e68 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1283,7 +1283,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1350,7 +1350,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,16 +47,16 @@ index 0bea149324..4b16115d43 100644
          if (!f)
                  return -errno;
  
-@@ -1322,7 +1322,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
-         _cleanup_strv_free_ char **zones = NULL;
-         int r;
+@@ -1391,7 +1391,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+ 
+         assert(ret);
  
 -        f = fopen("/usr/share/zoneinfo/tzdata.zi", "re");
 +        f = fopen("/etc/zoneinfo/tzdata.zi", "re");
          if (!f)
                  return -errno;
  
-@@ -1434,7 +1434,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1503,7 +1503,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 0bea149324..4b16115d43 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1492,7 +1492,7 @@ int get_timezone(char **ret) {
+@@ -1563,7 +1563,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* returns EINVAL if not a symlink */
  
@@ -75,23 +75,23 @@ index 0bea149324..4b16115d43 100644
                  return -EINVAL;
  
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index 9e79f84691..1a1c75718c 100644
+index 1956ab3b13..9ef356f8af 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -512,7 +512,7 @@ static int process_timezone(void) {
+@@ -630,7 +630,7 @@ static int process_timezone(int rfd) {
          if (isempty(arg_timezone))
                  return 0;
  
 -        e = strjoina("../usr/share/zoneinfo/", arg_timezone);
 +        e = strjoina("zoneinfo/", arg_timezone);
  
-         (void) mkdir_parents(etc_localtime, 0755);
-         r = symlink_atomic(e, etc_localtime);
+         r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
+         if (r < 0)
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index e5aa4feb1e..a7a8fae860 100644
+index 898a674631..c41a416e04 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1918,8 +1918,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1924,8 +1924,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -103,7 +103,7 @@ index e5aa4feb1e..a7a8fae860 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 31ed86955b..8db8d8c288 100644
+index 331af34505..722c4b5b4f 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
 @@ -282,7 +282,7 @@ static int context_read_data(Context *c) {
diff --git a/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
index fac9916cf3b..c0f6afd7fc7 100644
--- a/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -10,7 +10,7 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index fb83881cc7..c47a33134a 100644
+index d8db9d9d22..4601bb5431 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
 @@ -297,7 +297,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
diff --git a/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
index eec57111b91..b8f97308acf 100644
--- a/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ b/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] build: don't create statedir and don't touch prefixdir
  1 file changed, 3 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index b1f5477836..1a39484855 100644
+index 395eca1943..082cd748bb 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -4278,9 +4278,6 @@ install_data('LICENSE.GPL2',
+@@ -4707,9 +4707,6 @@ install_data('LICENSE.GPL2',
  install_subdir('LICENSES',
                 install_dir : docdir)
  
diff --git a/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
index 6e07928d5fb..fa201126ae2 100644
--- a/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
@@ -12,10 +12,10 @@ files that I might have missed.
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/constants.h b/src/basic/constants.h
-index 5d68cc6332..33c06c1f65 100644
+index 3f96786da9..6e8fb40c08 100644
 --- a/src/basic/constants.h
 +++ b/src/basic/constants.h
-@@ -73,13 +73,15 @@
+@@ -74,13 +74,15 @@
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
          "/usr/lib/" n "\0"                      \
diff --git a/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index 9d0565a6e76..fde1e2b276c 100644
--- a/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -10,10 +10,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index 5dee1b3a92..c08cf80548 100644
+index 8395bb429d..14fbc85bb4 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
-@@ -339,6 +339,7 @@ static void init_watchdog(void) {
+@@ -334,6 +334,7 @@ static void init_watchdog(void) {
  int main(int argc, char *argv[]) {
          static const char* const dirs[] = {
                  SYSTEM_SHUTDOWN_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index 5fa3fb14f1f..d91150cfc49 100644
--- a/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -9,10 +9,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 288fa4ae84..07deb19d7c 100644
+index de1f6c7ec1..d0cdebd80a 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -186,6 +186,7 @@ static int execute(
+@@ -224,6 +224,7 @@ static int execute(
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index b3d1db340ef..13dec1070ff 100644
--- a/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -10,10 +10,10 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 56f01f41d8..f9b8627388 100644
+index 97175bee11..3839704901 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
-@@ -24,11 +24,11 @@
+@@ -25,11 +25,11 @@
  #  define PATH_SBIN_BIN_NULSTR(x) PATH_NORMAL_SBIN_BIN_NULSTR(x)
  #endif
  
diff --git a/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
index 0f67abe795c..d6640c87454 100644
--- a/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 342892490e..1117251fe0 100644
+index 771e8e7f16..acf3ead8d7 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -3771,9 +3771,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3899,9 +3899,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
@@ -35,5 +35,5 @@ index 342892490e..1117251fe0 100644
                  return -ENOMEM;
 +#endif
  
-         r = strv_env_assign(&nl, "SYSTEMD_SCOPE", MANAGER_IS_SYSTEM(m) ? "system" : "user");
+         r = strv_env_assign(&nl, "SYSTEMD_SCOPE", runtime_scope_to_string(m->runtime_scope));
          if (r < 0)
diff --git a/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch b/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
index f509eb39ece..73b237a2960 100644
--- a/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
+++ b/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
@@ -17,10 +17,10 @@ See also: https://github.com/systemd/systemd/issues/24191
  1 file changed, 4 deletions(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 1117251fe0..bf5600a6cf 100644
+index acf3ead8d7..bdbab16829 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4617,10 +4617,6 @@ char* manager_taint_string(const Manager *m) {
+@@ -4754,10 +4754,6 @@ char* manager_taint_string(const Manager *m) {
          if (m->taint_usr)
                  stage[n++] = "split-usr";
  
diff --git a/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
index 8d6eab5ed84..6de01a0ae80 100644
--- a/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
+++ b/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
@@ -27,10 +27,10 @@ filename_is_valid with path_is_valid.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index 4345b95106..424a334df1 100644
+index ae8a8bc073..c284b244f8 100644
 --- a/src/shared/tpm2-util.c
 +++ b/src/shared/tpm2-util.c
-@@ -176,7 +176,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
+@@ -582,7 +582,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
                  fn = strjoina("libtss2-tcti-", driver, ".so.0");
  
                  /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
diff --git a/pkgs/os-specific/linux/systemd/0019-bootctl-also-print-efi-files-not-owned-by-systemd-in.patch b/pkgs/os-specific/linux/systemd/0019-bootctl-also-print-efi-files-not-owned-by-systemd-in.patch
deleted file mode 100644
index 84fc6528b98..00000000000
--- a/pkgs/os-specific/linux/systemd/0019-bootctl-also-print-efi-files-not-owned-by-systemd-in.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From bc0f378a1149b59e88e9345e579d62fec7f50cdf Mon Sep 17 00:00:00 2001
-From: Arian van Putten <arian.vanputten@gmail.com>
-Date: Wed, 31 May 2023 13:27:13 +0200
-Subject: [PATCH] bootctl: also print efi files not owned by systemd in status
-
-We should not skip over unknown entries in EFI/BOOT/ but
-also print them out in status so people are aware that they are there.
-
-(cherry picked from commit a680d4fb87bad829989949e5ea4fc6db90453456)
----
- src/boot/bootctl-status.c | 11 +++++------
- 1 file changed, 5 insertions(+), 6 deletions(-)
-
-diff --git a/src/boot/bootctl-status.c b/src/boot/bootctl-status.c
-index 2e2bf1f7e1..f1ac4a9c8a 100644
---- a/src/boot/bootctl-status.c
-+++ b/src/boot/bootctl-status.c
-@@ -225,9 +225,8 @@ static int enumerate_binaries(
-                         return log_error_errno(errno, "Failed to open file '%s' for reading: %m", filename);
- 
-                 r = get_file_version(fd, &v);
--                if (r == -ESRCH) /* Not the file we are looking for. */
--                        continue;
--                if (r < 0)
-+
-+                if (r < 0 && r != -ESRCH)
-                         return r;
- 
-                 if (*previous) { /* Let's output the previous entry now, since now we know that there will be
-@@ -242,10 +241,10 @@ static int enumerate_binaries(
-                 /* Do not output this entry immediately, but store what should be printed in a state
-                  * variable, because we only will know the tree glyph to print (branch or final edge) once we
-                  * read one more entry */
--                if (r > 0)
--                        r = asprintf(previous, "/%s/%s (%s%s%s)", path, de->d_name, ansi_highlight(), v, ansi_normal());
--                else
-+                if (r == -ESRCH) /* No systemd-owned file but still interesting to print */
-                         r = asprintf(previous, "/%s/%s", path, de->d_name);
-+                else /* if (r >= 0) */
-+                        r = asprintf(previous, "/%s/%s (%s%s%s)", path, de->d_name, ansi_highlight(), v, ansi_normal());
-                 if (r < 0)
-                         return log_oom();
- 
--- 
-2.39.2 (Apple Git-143)
-
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 338f0c7463c..a938a98f241 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -55,7 +55,6 @@
 , e2fsprogs
 , elfutils
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
-, gnu-efi
 , iptables
 , withSelinux ? false
 , libselinux
@@ -89,9 +88,11 @@
 , withAnalyze ? true
 , withApparmor ? true
 , withAudit ? true
+, withBootloader ? true # compiles systemd-boot, assumes EFI is available.
 , withCompression ? true  # adds bzip2, lz4, xz and zstd
 , withCoredump ? true
 , withCryptsetup ? true
+, withRepart ? true
 , withDocumentation ? true
 , withEfi ? stdenv.hostPlatform.isEfi
 , withFido2 ? true
@@ -116,6 +117,7 @@
 , withNss ? !stdenv.hostPlatform.isMusl
 , withOomd ? true
 , withPam ? true
+, withPasswordQuality ? false
 , withPCRE2 ? true
 , withPolkit ? true
 , withPortabled ? !stdenv.hostPlatform.isMusl
@@ -123,6 +125,7 @@
 , withResolved ? true
 , withShellCompletions ? true
 , withSysusers ? false # conflicts with the NixOS user management
+, withSysupdate ? true
 , withTimedated ? true
 , withTimesyncd ? true
 , withTpm2Tss ? true
@@ -146,17 +149,21 @@ assert withCoredump -> withCompression;
 assert withHomed -> withCryptsetup;
 assert withHomed -> withPam;
 assert withUkify -> withEfi;
+assert withRepart -> withCryptsetup;
+assert withBootloader -> withEfi;
+# passwdqc is not packaged in nixpkgs yet, if you want to fix this, please submit a PR.
+assert !withPasswordQuality;
 
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "253.6";
+  version = "254.3";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
-  releaseTimestamp = "1676488940";
+  releaseTimestamp = "1690536449";
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
@@ -167,7 +174,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-LZs6QuBe23W643bTuz+MD2pzHiapsBJBHoFXi/QjzG4=";
+    hash = "sha256-ObnsAiKwhwEb4ti611eS/wGpg3Sss/pUy/gANPAbXbs=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
@@ -194,7 +201,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./0016-inherit-systemd-environment-when-calling-generators.patch
     ./0017-core-don-t-taint-on-unmerged-usr.patch
     ./0018-tpm2_context_init-fix-driver-name-checking.patch
-    ./0019-bootctl-also-print-efi-files-not-owned-by-systemd-in.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
@@ -229,26 +235,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     substituteInPlace src/basic/path-util.h --replace "@defaultPathNormal@" "${placeholder "out"}/bin/"
-    substituteInPlace src/boot/efi/meson.build \
-      --replace \
-      "run_command(cc.cmd_array(), '-print-prog-name=objcopy', check: true).stdout().strip()" \
-      "'${stdenv.cc.bintools.targetPrefix}objcopy'"
   '' + lib.optionalString withLibBPF ''
     substituteInPlace meson.build \
       --replace "find_program('clang'" "find_program('${stdenv.cc.targetPrefix}clang'"
-    # BPF does not work with stack protector
-    substituteInPlace src/core/bpf/meson.build \
-      --replace "clang_flags = [" "clang_flags = [ '-fno-stack-protector',"
   '' + lib.optionalString withUkify ''
     substituteInPlace src/ukify/ukify.py \
       --replace \
       "'readelf'" \
       "'${targetPackages.stdenv.cc.bintools.targetPrefix}readelf'"
-    # The objcopy dependency is removed in v254
-    substituteInPlace src/ukify/ukify.py \
-      --replace \
-      "'objcopy'" \
-      "'${targetPackages.stdenv.cc.bintools.targetPrefix}objcopy'"
   '' + (
     let
       # The following patches references to dynamic libraries to ensure that
@@ -325,6 +319,9 @@ stdenv.mkDerivation (finalAttrs: {
 
           # Support for PKCS#11 in systemd-cryptsetup, systemd-cryptenroll and systemd-homed
           { name = "libp11-kit.so.0"; pkg = opt (withHomed || withCryptsetup) p11-kit; }
+
+          # Password quality support
+          { name = "libpasswdqc.so.1"; pkg = opt withPasswordQuality null; }
         ];
 
       patchDlOpen = dl:
@@ -395,7 +392,7 @@ stdenv.mkDerivation (finalAttrs: {
       docbook_xml_dtd_42
       docbook_xml_dtd_45
       bash
-      (buildPackages.python3Packages.python.withPackages (ps: with ps; [ lxml jinja2 ]))
+      (buildPackages.python3Packages.python.withPackages (ps: with ps; [ lxml jinja2 ] ++ lib.optional withEfi ps.pyelftools))
     ]
     ++ lib.optionals withLibBPF [
       bpftools
@@ -422,7 +419,6 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals withCompression [ bzip2 lz4 xz zstd ]
     ++ lib.optional withCoredump elfutils
     ++ lib.optional withCryptsetup (lib.getDev cryptsetup.dev)
-    ++ lib.optional withEfi gnu-efi
     ++ lib.optional withKexectools kexec-tools
     ++ lib.optional withKmod kmod
     ++ lib.optional withLibidn2 libidn2
@@ -498,6 +494,8 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dlibidn2=${lib.boolToString withLibidn2}"
     "-Dfirstboot=${lib.boolToString withFirstboot}"
     "-Dsysusers=${lib.boolToString withSysusers}"
+    "-Drepart=${lib.boolToString withRepart}"
+    "-Dsysupdate=${lib.boolToString withSysupdate}"
     "-Dquotacheck=false"
     "-Dldconfig=false"
     "-Dsmack=true"
@@ -537,12 +535,9 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dman=true"
 
     "-Defi=${lib.boolToString withEfi}"
-    "-Dgnu-efi=${lib.boolToString withEfi}"
+    "-Dbootloader=${lib.boolToString withBootloader}"
 
     "-Dukify=${lib.boolToString withUkify}"
-  ] ++ lib.optionals withEfi [
-    "-Defi-libdir=${toString gnu-efi}/lib"
-    "-Defi-includedir=${toString gnu-efi}/include/efi"
   ] ++ lib.optionals (withShellCompletions == false) [
     "-Dbashcompletiondir=no"
     "-Dzshcompletiondir=no"
@@ -586,6 +581,7 @@ stdenv.mkDerivation (finalAttrs: {
           where = [
             "man/systemd-analyze.xml"
             "man/systemd.service.xml"
+            "man/systemd-run.xml"
             "src/analyze/test-verify.c"
             "src/test/test-env-file.c"
             "src/test/test-fileio.c"
@@ -595,7 +591,7 @@ stdenv.mkDerivation (finalAttrs: {
         {
           search = "/bin/cat";
           replacement = "${coreutils}/bin/cat";
-          where = [ "test/create-busybox-container" "test/test-execute/exec-noexecpaths-simple.service" "src/journal/cat.c" ];
+          where = [ "test/test-execute/exec-noexecpaths-simple.service" "src/journal/cat.c" ];
         }
         {
           search = "/usr/lib/systemd/systemd-fsck";
diff --git a/pkgs/servers/bloat/default.nix b/pkgs/servers/bloat/default.nix
index bbafb591824..8db0a2ed962 100644
--- a/pkgs/servers/bloat/default.nix
+++ b/pkgs/servers/bloat/default.nix
@@ -6,15 +6,15 @@
 
 buildGoModule {
   pname = "bloat";
-  version = "unstable-2022-12-17";
+  version = "unstable-2023-09-18";
 
   src = fetchgit {
     url = "git://git.freesoftwareextremist.com/bloat";
-    rev = "5147897c6c8ba3428ea6998f77241182ee8caa24";
-    sha256 = "sha256-/sSRzAAWO/KtXOD3lQsqaXc+lOuN7MJqbfASueLYBQk=";
+    rev = "e50f12b6158ffae6b0b59f2902798ae86d263b5d";
+    hash = "sha256-vejk2f/FC0gS8t16u37pVgp2qzaGRXfcEYzqyP+QbGY=";
   };
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   postInstall = ''
     mkdir -p $out/share/bloat
diff --git a/pkgs/servers/domoticz/default.nix b/pkgs/servers/domoticz/default.nix
index 869971d8fb8..6e50b475443 100644
--- a/pkgs/servers/domoticz/default.nix
+++ b/pkgs/servers/domoticz/default.nix
@@ -51,7 +51,6 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DUSE_BUILTIN_MQTT=false"
     "-DUSE_BUILTIN_LUA=false"
     "-DUSE_BUILTIN_SQLITE=false"
diff --git a/pkgs/servers/nosql/arangodb/default.nix b/pkgs/servers/nosql/arangodb/default.nix
index 74d832803b1..36c978e364f 100644
--- a/pkgs/servers/nosql/arangodb/default.nix
+++ b/pkgs/servers/nosql/arangodb/default.nix
@@ -62,10 +62,11 @@ gcc10Stdenv.mkDerivation rec {
     patchShebangs utils
   '';
 
+  cmakeBuildType = "RelWithDebInfo";
+
   cmakeFlags = [
     "-DUSE_MAINTAINER_MODE=OFF"
     "-DUSE_GOOGLE_TESTS=OFF"
-    "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
 
     # avoid reading /proc/cpuinfo for feature detection
     "-DTARGET_ARCHITECTURE=${targetArch}"
diff --git a/pkgs/servers/pocketbase/default.nix b/pkgs/servers/pocketbase/default.nix
index 58ee4cab598..197035bc568 100644
--- a/pkgs/servers/pocketbase/default.nix
+++ b/pkgs/servers/pocketbase/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.18.3";
+  version = "0.18.6";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-UwxE36y99vW/45Lnkm5qaevEToxIVs73YUJVDtr8ziA=";
+    hash = "sha256-QfipP/nq/vE0TnK/JGLIbO282bFSrnIgGzkfU6N+euY=";
   };
 
-  vendorHash = "sha256-vb0957zO27OgrSTUiAt+vuo9NKM5ftz8mbFf613l0eM=";
+  vendorHash = "sha256-pDLj0Az7aQow1Q+7ANxv5kZQrqBby6gzkfAoV87/k9E=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/servers/tarantool/default.nix b/pkgs/servers/tarantool/default.nix
index bdb36a7f10a..80b2e96d2d6 100644
--- a/pkgs/servers/tarantool/default.nix
+++ b/pkgs/servers/tarantool/default.nix
@@ -38,8 +38,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  cmakeBuildType = "RelWithDebInfo";
+
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
     "-DENABLE_DIST=ON"
     "-DTARANTOOL_VERSION=${version}.builtByNix" # expects the commit hash as well
   ];
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 6b126390c9f..3beb54b908e 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -68,6 +68,12 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
+    # At least on Linux bash memory allocator has pathological performance
+    # in scenarios involving use of larger memory:
+    #   https://lists.gnu.org/archive/html/bug-bash/2023-08/msg00052.html
+    # Various distributions default to system allocator. Let's nixpkgs
+    # do the same.
+    "--without-bash-malloc"
     (if interactive then "--with-installed-readline" else "--disable-readline")
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "bash_cv_job_control_missing=nomissing"
@@ -81,7 +87,6 @@ stdenv.mkDerivation rec {
     "bash_cv_dev_fd=standard"
     "bash_cv_termcap_lib=libncurses"
   ] ++ lib.optionals (stdenv.hostPlatform.libc == "musl") [
-    "--without-bash-malloc"
     "--disable-nls"
   ];
 
diff --git a/pkgs/tools/X11/inputplug/default.nix b/pkgs/tools/X11/inputplug/default.nix
index 031b73994b6..e6bf334cf4c 100644
--- a/pkgs/tools/X11/inputplug/default.nix
+++ b/pkgs/tools/X11/inputplug/default.nix
@@ -4,6 +4,7 @@
 , libbsd
 , pkg-config
 , rustPlatform
+, stdenv
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,6 +30,9 @@ rustPlatform.buildRustPackage rec {
     description = "Monitor XInput events and run arbitrary scripts on hierarchy change events";
     homepage = "https://github.com/andrewshadura/inputplug";
     license = licenses.mit;
+    platforms = platforms.unix;
+    # `daemon(3)` is deprecated on macOS and `pidfile-rs` needs updating
+    broken = stdenv.isDarwin;
     maintainers = with maintainers; [ jecaro ];
   };
 }
diff --git a/pkgs/tools/X11/xdg-utils/default.nix b/pkgs/tools/X11/xdg-utils/default.nix
index 35557ce447f..ed8b1363d5f 100644
--- a/pkgs/tools/X11/xdg-utils/default.nix
+++ b/pkgs/tools/X11/xdg-utils/default.nix
@@ -2,6 +2,7 @@
 , file, libxslt, docbook_xml_dtd_412, docbook_xsl, xmlto
 , w3m, gnugrep, gnused, coreutils, xset, perlPackages
 , mimiSupport ? false, gawk
+, bash
 , glib
 , withXdgOpenUsePortalPatch ? true }:
 
@@ -48,6 +49,9 @@ stdenv.mkDerivation rec {
   # just needed when built from git
   nativeBuildInputs = [ libxslt docbook_xml_dtd_412 docbook_xsl xmlto w3m ];
 
+  # explicitly provide a runtime shell so patchShebangs is consistent across build platforms
+  buildInputs = [ bash ];
+
   postInstall = lib.optionalString mimiSupport ''
     cp ${mimisrc}/xdg-open $out/bin/xdg-open
   '' + ''
@@ -83,6 +87,5 @@ stdenv.mkDerivation rec {
     license = if mimiSupport then licenses.gpl2 else licenses.free;
     maintainers = [ maintainers.eelco ];
     platforms = platforms.all;
-    broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
   };
 }
diff --git a/pkgs/tools/admin/eksctl/default.nix b/pkgs/tools/admin/eksctl/default.nix
index bf50e678a45..cb66e6d9fd5 100644
--- a/pkgs/tools/admin/eksctl/default.nix
+++ b/pkgs/tools/admin/eksctl/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.156.0";
+  version = "0.157.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-E50MtMrZy2lnMjoYV4MJF+0YGLmGEioOF74rldXdOPU=";
+    hash = "sha256-OTWCTpxVBTJHaVmnuiGQEmRezDLLUnJKKKWYo+J5fLk=";
   };
 
-  vendorHash = "sha256-maMORSR6ZAasUxAy4kXvua4C+/dWdZbDde2VIKSV8w4=";
+  vendorHash = "sha256-gOQ//+DJXn+5Ip0Ii1j08LD+op5WgHaPg/Wqz8Nwt1w=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index 96a37cfa47f..3d5474a0984 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2023.06.25";
+  version = "2023.09.13";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    hash = "sha256-Fn10QcwqKPerMh3OMJTMUQZ6nUMgBysXmxCbEOXSG0k=";
+    hash = "sha256-rpGINfLuWHu6QA/30aI9B8Hmpfx1o6vstiQn+t0blxA=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/compression/brotli/default.nix b/pkgs/tools/compression/brotli/default.nix
index 3d15cbd395c..263478e4ba3 100644
--- a/pkgs/tools/compression/brotli/default.nix
+++ b/pkgs/tools/compression/brotli/default.nix
@@ -1,8 +1,8 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, cmake
 , fetchpatch
+, cmake
 , staticOnly ? stdenv.hostPlatform.isStatic
 , testers
 }:
@@ -11,23 +11,27 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brotli";
-  version = "1.0.9";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "brotli";
     rev = "v${finalAttrs.version}";
-    sha256 = "z6Dhrabav1MDQ4rAcXaDv0aN+qOoh9cvoXZqEWBB13c=";
+    hash = "sha256-MvceRcle2dSkkucC2PlsCizsIf8iv95d8Xjqew266wc=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  patches = [
+    # revert runpath change, breaks curl on darwin:
+    #   https://github.com/NixOS/nixpkgs/pull/254532#issuecomment-1722337476
+    (fetchpatch {
+      name = "revert-runpath.patch";
+      url = "https://github.com/google/brotli/commit/f842c1bcf9264431cd3b15429a72b7dafbe80509.patch";
+      hash = "sha256-W3LY3EjoHP74YsKOOcYQrzo+f0HbooOvEbnOibtN6TM=";
+      revert = true;
+    })
+  ];
 
-  patches = lib.optional staticOnly (fetchpatch {
-    # context from https://github.com/google/brotli/pull/655
-    # updated patch from https://github.com/google/brotli/pull/655
-    url = "https://github.com/google/brotli/commit/47a554804ceabb899ae924aaee54df806053d0d1.patch";
-    sha256 = "sOeXNVsCaBSD9i82GRUDrkyreGeQ7qaJWjjy/uLL0/0=";
-  });
+  nativeBuildInputs = [ cmake ];
 
   cmakeFlags = lib.optional staticOnly "-DBUILD_SHARED_LIBS=OFF";
 
@@ -37,17 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   checkTarget = "test";
 
-  # This breaks on Darwin because our cmake hook tries to make a build folder
-  # and the wonderful bazel BUILD file is already there (yay case-insensitivity?)
-  prePatch = ''
-    rm BUILD
-
-    # Upstream fixed this reference to runtime-path after the release
-    # and with this references g++ complains about invalid option -R
-    sed -i 's/ -R''${libdir}//' scripts/libbrotli*.pc.in
-    cat scripts/libbrotli*.pc.in
-  '';
-
   # Don't bother with "man" output for now,
   # it currently only makes the manpages hard to use.
   postInstall = ''
diff --git a/pkgs/tools/graphics/astc-encoder/default.nix b/pkgs/tools/graphics/astc-encoder/default.nix
index 5e63038e67d..4403ab255dd 100644
--- a/pkgs/tools/graphics/astc-encoder/default.nix
+++ b/pkgs/tools/graphics/astc-encoder/default.nix
@@ -40,8 +40,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  cmakeBuildType = "RelWithDebInfo";
+
   cmakeFlags = isaFlags ++ [
-    "-DCMAKE_BUILD_TYPE=RelWithDebInfo"
     "-DASTCENC_UNIVERSAL_BUILD=OFF"
   ];
 
diff --git a/pkgs/tools/misc/aspcud/default.nix b/pkgs/tools/misc/aspcud/default.nix
index e3f75693803..cd290d5e085 100644
--- a/pkgs/tools/misc/aspcud/default.nix
+++ b/pkgs/tools/misc/aspcud/default.nix
@@ -27,7 +27,6 @@ stdenv.mkDerivation rec {
   buildInputs = [ boost clingo re2c ];
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DASPCUD_GRINGO_PATH=${clingo}/bin/gringo"
     "-DASPCUD_CLASP_PATH=${clingo}/bin/clasp"
   ];
diff --git a/pkgs/tools/misc/calamares/default.nix b/pkgs/tools/misc/calamares/default.nix
index 00a06b857b0..a82d62aed0d 100644
--- a/pkgs/tools/misc/calamares/default.nix
+++ b/pkgs/tools/misc/calamares/default.nix
@@ -51,7 +51,6 @@ mkDerivation rec {
     "-DPYTHON_LIBRARY=${python}/lib/lib${python.libPrefix}.so"
     "-DPYTHON_INCLUDE_DIR=${python}/include/${python.libPrefix}"
     "-DCMAKE_VERBOSE_MAKEFILE=True"
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DWITH_PYTHONQT:BOOL=ON"
   ];
 
diff --git a/pkgs/tools/misc/clipboard-jh/default.nix b/pkgs/tools/misc/clipboard-jh/default.nix
index 9cebe31dd7b..fe4f18eea8d 100644
--- a/pkgs/tools/misc/clipboard-jh/default.nix
+++ b/pkgs/tools/misc/clipboard-jh/default.nix
@@ -42,8 +42,9 @@ stdenv.mkDerivation rec {
     darwin.apple_sdk.frameworks.AppKit
   ];
 
+  cmakeBuildType = "MinSizeRel";
+
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE='MinSizeRel'"
     "-Wno-dev"
     "-DINSTALL_PREFIX=${placeholder "out"}"
   ];
diff --git a/pkgs/tools/misc/trdl-client/default.nix b/pkgs/tools/misc/trdl-client/default.nix
index 3748f1755d1..e0d92c140ce 100644
--- a/pkgs/tools/misc/trdl-client/default.nix
+++ b/pkgs/tools/misc/trdl-client/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "trdl-client";
-  version = "0.6.5";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "trdl";
     rev = "v${version}";
-    hash = "sha256-jJwRIfxmjlhfS/0+IN2IdQPlO9FkTb64PWUiLwkarfM=";
+    hash = "sha256-umeoiEq+Cp/cKpiNxCnMDghubm3LPFPJA18ChuYmIVo=";
   };
 
   sourceRoot = "${src.name}/client";
diff --git a/pkgs/tools/networking/bandwhich/Cargo.lock b/pkgs/tools/networking/bandwhich/Cargo.lock
index b9dd1fea7c4..5d28b7691ca 100644
--- a/pkgs/tools/networking/bandwhich/Cargo.lock
+++ b/pkgs/tools/networking/bandwhich/Cargo.lock
@@ -30,9 +30,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.0.5"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c378d78423fdad8089616f827526ee33c19f2fddbd5de1629152c9593ba4783"
+checksum = "0f2135563fb5c609d2b2b87c1e8ce7bc41b0b45430fa9661f457981503dd5bf0"
 dependencies = [
  "memchr",
 ]
@@ -68,9 +68,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15c4c2c83f81532e5845a733998b6971faca23490340a418e9b72a3ec9de12ea"
+checksum = "b84bf0a05bbb2a83e5eb6fa36bb6e87baa08193c35ff52bbf6b38d8af2890e46"
 
 [[package]]
 name = "anstyle-parse"
@@ -117,7 +117,7 @@ checksum = "bc00ceb34980c03614e35a3a4e218276a0a824e911d07651cd0d858a51e8c0f0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.37",
 ]
 
 [[package]]
@@ -143,13 +143,13 @@ dependencies = [
 
 [[package]]
 name = "bandwhich"
-version = "0.20.0"
+version = "0.21.0"
 dependencies = [
  "anyhow",
  "async-trait",
  "chrono",
  "clap",
- "crossterm 0.27.0",
+ "crossterm",
  "http_req",
  "insta",
  "ipnetwork",
@@ -199,9 +199,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.13.0"
+version = "3.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3e2c3daef883ecc1b5d58c15adae93470a91d425f3532ba1695849656af3fc1"
+checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
 
 [[package]]
 name = "byteorder"
@@ -260,9 +260,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.30"
+version = "0.4.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "defd4e7873dbddba6c7c91e199c7fcb946abc4a6a4ac3195400bcfb01b5de877"
+checksum = "7f2c685bad3eb3d45a01354cedb7d5faa66194d1d58ba6e267a8de788f79db38"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -284,9 +284,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.4.2"
+version = "4.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a13b88d2c62ff462f88e4a121f17a82c1af05693a2f192b5c38d14de73c19f6"
+checksum = "b1d7b8d5ec32af0fadc644bf1fd509a688c2103b185644bb1e29d164e0703136"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -294,9 +294,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.4.2"
+version = "4.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bb9faaa7c2ef94b2743a21f5a29e6f0010dff4caa69ac8e9d6cf8b6fa74da08"
+checksum = "5179bb514e4d7c2051749d8fcefa2ed6d06a9f4e6d69faf3805f5d80b8cf8d56"
 dependencies = [
  "anstream",
  "anstyle",
@@ -313,7 +313,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.37",
 ]
 
 [[package]]
@@ -425,22 +425,6 @@ dependencies = [
 
 [[package]]
 name = "crossterm"
-version = "0.26.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a84cda67535339806297f1b331d6dd6320470d2a0fe65381e79ee9e156dd3d13"
-dependencies = [
- "bitflags 1.3.2",
- "crossterm_winapi",
- "libc",
- "mio",
- "parking_lot",
- "signal-hook",
- "signal-hook-mio",
- "winapi",
-]
-
-[[package]]
-name = "crossterm"
 version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f476fe445d41c9e991fd07515a6f463074b782242ccf4a5b7b1d1012e70824df"
@@ -529,7 +513,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.37",
 ]
 
 [[package]]
@@ -706,9 +690,9 @@ dependencies = [
 
 [[package]]
 name = "http_req"
-version = "0.9.2"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f680177f2ebe4aabd573d07b322d15a5e0fbc97cd739fd627b08043c89041f8"
+checksum = "42ce34c74ec562d68f2c23a532c62c1332ff1d1b6147fd118bd1938e090137d0"
 dependencies = [
  "native-tls",
  "unicase",
@@ -749,9 +733,9 @@ dependencies = [
 
 [[package]]
 name = "indoc"
-version = "2.0.3"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c785eefb63ebd0e33416dfcb8d6da0bf27ce752843a45632a67bf10d4d4b5c4"
+checksum = "1e186cfbae8084e513daff4240b4797e342f988cecda4fb6c939150f96315fd8"
 
 [[package]]
 name = "inout"
@@ -814,6 +798,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "itertools"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
+dependencies = [
+ "either",
+]
+
+[[package]]
 name = "jobserver"
 version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -839,9 +832,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.147"
+version = "0.2.148"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+checksum = "9cdc71e17332e86d2e1d38c1f99edcb6288ee11b815fb1a4b049eaa2114d369b"
 
 [[package]]
 name = "linked-hash-map"
@@ -1043,7 +1036,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.37",
 ]
 
 [[package]]
@@ -1196,7 +1189,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.32",
+ "syn 2.0.37",
 ]
 
 [[package]]
@@ -1250,9 +1243,9 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.66"
+version = "1.0.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
+checksum = "3d433d9f1a3e8c1263d9456598b16fec66f4acc9a74dacffd35c7bb09b3a1328"
 dependencies = [
  "unicode-ident",
 ]
@@ -1319,15 +1312,17 @@ dependencies = [
 
 [[package]]
 name = "ratatui"
-version = "0.22.0"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8285baa38bdc9f879d92c0e37cb562ef38aa3aeefca22b3200186bc39242d3d5"
+checksum = "2e2e4cd95294a85c3b4446e63ef054eea43e0205b1fd60120c16b74ff7ff96ad"
 dependencies = [
  "bitflags 2.4.0",
  "cassowary",
- "crossterm 0.26.1",
+ "crossterm",
  "indoc",
+ "itertools",
  "paste",
+ "strum",
  "unicode-segmentation",
  "unicode-width",
 ]
@@ -1436,6 +1431,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "rustversion"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
+
+[[package]]
 name = "schannel"
 version = "0.1.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1490,7 +1491,7 @@ checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.37",
 ]
 
 [[package]]
@@ -1568,9 +1569,9 @@ checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
 
 [[package]]
 name = "socket2"
-version = "0.5.3"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2538b18701741680e0322a2302176d3253a35388e2e62f172f64f4f16605f877"
+checksum = "4031e820eb552adee9295814c0ced9e5cf38ddf1e8b7d566d6de8e2538ea989e"
 dependencies = [
  "libc",
  "windows-sys 0.48.0",
@@ -1583,6 +1584,28 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
 [[package]]
+name = "strum"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290d54ea6f91c969195bdbcd7442c8c2a2ba87da8bf60a7ee86a235d4bc1e125"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8d03b598d3d0fff69bf533ee3ef19b8eeb342729596df84bcc7e1f96ec4059"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn 2.0.37",
+]
+
+[[package]]
 name = "subtle"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1601,9 +1624,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.32"
+version = "2.0.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "239814284fd6f1a4ffe4ca893952cdd93c224b6a1571c9a9eadd670295c0c9e2"
+checksum = "7303ef2c05cd654186cb250d29049a24840ca25d2747c25c0381c8d9e2f582e8"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1655,7 +1678,7 @@ checksum = "49922ecae66cc8a249b77e68d1d0623c1b2c514f0060c27cdc68bd62a1219d35"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.37",
 ]
 
 [[package]]
@@ -1726,7 +1749,7 @@ checksum = "5f4f31f56159e98206da9efd823404b79b6ef3143b4a7ab76e67b1751b25a4ab"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.37",
 ]
 
 [[package]]
@@ -1786,9 +1809,9 @@ dependencies = [
 
 [[package]]
 name = "typenum"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
 name = "unicase"
@@ -1807,9 +1830,9 @@ checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.11"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "301abaae475aa91687eb82514b328ab47a211a533026cb25fc3e519b86adfc3c"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
 [[package]]
 name = "unicode-normalization"
@@ -1888,7 +1911,7 @@ dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.37",
  "wasm-bindgen-shared",
 ]
 
@@ -1910,7 +1933,7 @@ checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.32",
+ "syn 2.0.37",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
diff --git a/pkgs/tools/networking/bandwhich/default.nix b/pkgs/tools/networking/bandwhich/default.nix
index 5e0b0e242cd..78b8f7ddf1b 100644
--- a/pkgs/tools/networking/bandwhich/default.nix
+++ b/pkgs/tools/networking/bandwhich/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bandwhich";
-  version = "unstable-2023-09-11";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "imsnif";
     repo = pname;
-    rev = "eba356220cc06254b96cd3241bc80ab7a0ab017b";
-    hash = "sha256-qrVGUbVbURXSKJy28mhpwVkzSGgct8PPOnwb0FdVWtE=";
+    rev = "v${version}";
+    hash = "sha256-FquV+V5BTIX0HB6lLqPMUTvnPn7Y8/jhl93qvrSkYLY=";
   };
 
   cargoLock = {
@@ -18,6 +18,11 @@ rustPlatform.buildRustPackage rec {
     };
   };
 
+  checkFlags = [
+    # failing in upstream CI
+    "--skip=tests::cases::ui::layout_under_50_width_under_50_height"
+  ];
+
   buildInputs = lib.optional stdenv.isDarwin Security;
 
   # 10 passed; 47 failed https://hydra.nixos.org/build/148943783/nixlog/1
diff --git a/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch b/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
index 2c732621d92..2d97338a1fe 100644
--- a/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
+++ b/pkgs/tools/networking/curl/7.79.1-darwin-no-systemconfiguration.patch
@@ -27,13 +27,13 @@ autoconf in the bootstrap loop just to regenerate a patched configure.ac.
  
  curl_includes_winsock2="\
 diff --git a/lib/curl_setup.h b/lib/curl_setup.h
-index 727d123e5..f78d8be4a 100644
+index b43714da7..7674778b7 100644
 --- a/lib/curl_setup.h
 +++ b/lib/curl_setup.h
-@@ -250,19 +250,6 @@
-
+@@ -250,20 +250,6 @@
+ 
  #include <curl/system.h>
-
+ 
 -/*
 - * Use getaddrinfo to resolve the IPv4 address literal. If the current network
 - * interface doesn't support IPv4, but supports IPv6, NAT64, and DNS64,
@@ -42,8 +42,9 @@ index 727d123e5..f78d8be4a 100644
 -#if defined(__APPLE__) && !defined(USE_ARES)
 -#include <TargetConditionals.h>
 -#define USE_RESOLVE_ON_IPS 1
--#  if !defined(TARGET_OS_OSX) || TARGET_OS_OSX
--#    define CURL_OSX_CALL_COPYPROXIES 1
+-#  if TARGET_OS_MAC && !(defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE) && \
+-     defined(ENABLE_IPV6)
+-#    define CURL_MACOS_CALL_COPYPROXIES 1
 -#  endif
 -#endif
 -
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index c15325a49e4..aced6d6653a 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -47,14 +47,14 @@ assert !((lib.count (x: x) [ gnutlsSupport opensslSupport wolfsslSupport rustlsS
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.2.1";
+  version = "8.3.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.xz"
-      "https://github.com/curl/curl/releases/download/curl-${finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
+      "https://github.com/curl/curl/releases/download/curl-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-3TIva9CiDmzr39OI9p6Yw9GDvteSz0cTyKfvSYy6SJQ=";
+    hash = "sha256-N21id2fWxPBRBattSXsNmrpxEXcN2dmVIlR4IJw36mM=";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/ebpf-verifier/default.nix b/pkgs/tools/networking/ebpf-verifier/default.nix
index 972c72c4e57..8605db55bba 100644
--- a/pkgs/tools/networking/ebpf-verifier/default.nix
+++ b/pkgs/tools/networking/ebpf-verifier/default.nix
@@ -39,8 +39,6 @@ stdenv.mkDerivation {
     yaml-cpp
   ];
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/tools/security/sirikali/default.nix b/pkgs/tools/security/sirikali/default.nix
index a3e67a2b76a..6ae689d95fd 100644
--- a/pkgs/tools/security/sirikali/default.nix
+++ b/pkgs/tools/security/sirikali/default.nix
@@ -71,7 +71,6 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=RELEASE"
     "-DINTERNAL_LXQT_WALLET=false"
     "-DNOKDESUPPORT=${if withKWallet then "false" else "true"}"
     "-DNOSECRETSUPPORT=${if withLibsecret then "false" else "true"}"
diff --git a/pkgs/tools/system/nvtop/default.nix b/pkgs/tools/system/nvtop/default.nix
index 1ab520cefac..e47291207f0 100644
--- a/pkgs/tools/system/nvtop/default.nix
+++ b/pkgs/tools/system/nvtop/default.nix
@@ -38,7 +38,6 @@ stdenv.mkDerivation rec {
   };
 
   cmakeFlags = with lib; [
-    "-DCMAKE_BUILD_TYPE=Release"
     "-DBUILD_TESTING=ON"
     "-DUSE_LIBUDEV_OVER_LIBSYSTEMD=ON"
   ] ++ optional nvidia "-DNVML_INCLUDE_DIRS=${cudatoolkit}/include"
diff --git a/pkgs/tools/system/systeroid/default.nix b/pkgs/tools/system/systeroid/default.nix
index 8220b36b43f..dca6ee3f468 100644
--- a/pkgs/tools/system/systeroid/default.nix
+++ b/pkgs/tools/system/systeroid/default.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "systeroid";
-  version = "0.4.3";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZviZ8zjUtVv7PRH9xuiGi8OtAHX1oo6JmKHLCyk4Vog=";
+    sha256 = "sha256-FnUXf2Ia/XIu9ESs71p0UrXC7y7n7SYpfU0+Es7KYqM=";
   };
 
   postPatch = ''
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
       --replace '"/usr/share/doc/kernel-doc-*/Documentation/*",' '"${linux-doc}/share/doc/linux-doc/*",'
   '';
 
-  cargoHash = "sha256-xpE7cP8nISMuIqSO6o6VREsVXQ+K5PU+XUEVvl3k51s=";
+  cargoHash = "sha256-TTxvkRRVPCycEtAmm5BIOVc9bUmdqQBPSORBxHzm9ms=";
 
   buildInputs = [
     xorg.libxcb
diff --git a/pkgs/tools/system/which/default.nix b/pkgs/tools/system/which/default.nix
index aecf68e8c7f..82316541f4c 100644
--- a/pkgs/tools/system/which/default.nix
+++ b/pkgs/tools/system/which/default.nix
@@ -12,6 +12,13 @@ stdenv.mkDerivation rec {
   strictDeps = true;
   enableParallelBuilding = true;
 
+  env.NIX_CFLAGS_COMPILE = toString (
+    # Enable 64-bit file API. Otherwise `which` fails to find tools
+    # on filesystems with 64-bit inodes (like `btrfs`) when running
+    # binaries from 32-bit systems (like `i686-linux`).
+    lib.optional stdenv.hostPlatform.is32bit "-D_FILE_OFFSET_BITS=64"
+  );
+
   meta = with lib; {
     homepage = "https://www.gnu.org/software/which/";
     description = "Shows the full path of (shell) commands";
diff --git a/pkgs/tools/text/ruplacer/default.nix b/pkgs/tools/text/ruplacer/default.nix
index f85b3d62758..b44165d6ea8 100644
--- a/pkgs/tools/text/ruplacer/default.nix
+++ b/pkgs/tools/text/ruplacer/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruplacer";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "TankerHQ";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-7qVjJLw90SUtXkfp40u/X84trnJzgCV6mp7b/yNmcPk=";
+    sha256 = "sha256-xuq+Scy5MyyGvI51Vs26pk9+NnlghzGEJDHYC3kSXNw=";
   };
 
-  cargoSha256 = "sha256-AV6wxD2KZN53rlJofsDISL6p2dfgw+5F+GiP5u9/2/w=";
+  cargoHash = "sha256-Kevwpkvgq40LhWxhW9ra2Nd1zEiAF372DM1sY9hnQb0=";
 
   buildInputs = (lib.optional stdenv.isDarwin Security);
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8114377a37c..4b48d080bf8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25766,12 +25766,7 @@ with pkgs;
 
   wfa2-lib = callPackage ../development/libraries/wfa2-lib { };
 
-  webrtc-audio-processing_1 = callPackage ../development/libraries/webrtc-audio-processing {
-    stdenv = gcc10StdenvCompat;
-    abseil-cpp = abseil-cpp.override {
-      cxxStandard = "14";
-    };
-  };
+  webrtc-audio-processing_1 = callPackage ../development/libraries/webrtc-audio-processing { };
   webrtc-audio-processing_0_3 = callPackage ../development/libraries/webrtc-audio-processing/0.3.nix { };
   # bump when majoring of packages have updated
   webrtc-audio-processing = webrtc-audio-processing_0_3;
@@ -28986,6 +28981,7 @@ with pkgs;
     withCompression = false;
     withCoredump = false;
     withCryptsetup = false;
+    withRepart = false;
     withDocumentation = false;
     withEfi = false;
     withFido2 = false;
@@ -29008,11 +29004,13 @@ with pkgs;
     withRemote = false;
     withResolved = false;
     withShellCompletions = false;
+    withSysupdate = false;
     withTimedated = false;
     withTimesyncd = false;
     withTpm2Tss = false;
     withUserDb = false;
     withUkify = false;
+    withBootloader = false;
   };
   systemdStage1 = systemdMinimal.override {
     pname = "systemd-stage-1";
@@ -29021,6 +29019,7 @@ with pkgs;
     withFido2 = true;
     withKmod = true;
     withTpm2Tss = true;
+    withRepart = true;
   };
   systemdStage1Network = systemdStage1.override {
     pname = "systemd-stage-1-network";
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index f960bf8bd59..5a0f48cf191 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -9189,19 +9189,15 @@ with self; {
     };
   };
 
-  FileBaseDir = buildPerlModule {
-    version = "0.08";
+  FileBaseDir = buildPerlPackage {
+    version = "0.09";
     pname = "File-BaseDir";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/K/KI/KIMRYAN/File-BaseDir-0.08.tar.gz";
-      hash = "sha256-wGX80+LyKudpk3vMlxuR+AKU1QCfrBQL+6g799NTBeM=";
+      url = "mirror://cpan/authors/id/P/PL/PLICEASE/File-BaseDir-0.09.tar.gz";
+      hash = "sha256-bab3KBVirI8R7xo69q7bUcQRgrYPHxIs7QB579kpZ9k=";
     };
-    configurePhase = ''
-      runHook preConfigure
-      perl Build.PL PREFIX="$out" prefix="$out"
-    '';
     propagatedBuildInputs = [ IPCSystemSimple ];
-    buildInputs = [ FileWhich ];
+    nativeCheckInputs = [ FileWhich ];
     meta = {
       description = "Use the Freedesktop.org base directory specification";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
@@ -24142,12 +24138,11 @@ with self; {
 
   TestFile = buildPerlPackage {
     pname = "Test-File";
-    version = "1.443";
+    version = "1.993";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/B/BD/BDFOY/Test-File-1.443.tar.gz";
-      hash = "sha256-YbSmq49hfIx7WXUWTPYZRo3DBLa6quo1J4KShvpYvNU=";
+      url = "mirror://cpan/authors/id/B/BD/BDFOY/Test-File-1.993.tar.gz";
+      hash = "sha256-7y/+Gq7HtC2HStQR7GR1R7m5vC9fuT5J4zmUiEVq/Ho=";
     };
-    buildInputs = [ Testutf8 ];
     meta = {
       description = "Test file attributes";
       homepage = "https://github.com/briandfoy/test-file";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 52f58a04875..fc07cf6a8f1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2966,6 +2966,8 @@ self: super: with self; {
 
   django-mysql = callPackage ../development/python-modules/django-mysql { };
 
+  django-ninja = callPackage ../development/python-modules/django-ninja { };
+
   django-nose = callPackage ../development/python-modules/django-nose { };
 
   django-oauth-toolkit = callPackage ../development/python-modules/django-oauth-toolkit { };