summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/CODEOWNERS13
-rw-r--r--.github/labeler.yml5
-rw-r--r--doc/languages-frameworks/javascript.section.md1
-rw-r--r--lib/fileset/README.md15
-rw-r--r--lib/fileset/default.nix133
-rw-r--r--lib/fileset/internal.nix56
-rwxr-xr-xlib/fileset/tests.sh241
-rw-r--r--lib/tests/release.nix2
-rw-r--r--maintainers/maintainer-list.nix32
-rw-r--r--nixos/doc/manual/release-notes/rl-2311.section.md2
-rw-r--r--nixos/modules/services/monitoring/parsedmarc.nix1
-rw-r--r--nixos/modules/services/networking/ntp/chrony.nix39
-rw-r--r--nixos/modules/services/networking/unbound.nix28
-rw-r--r--nixos/modules/services/networking/unifi.nix82
-rw-r--r--nixos/modules/services/search/opensearch.nix19
-rw-r--r--nixos/tests/dnscrypt-wrapper/default.nix144
-rw-r--r--pkgs/applications/audio/galaxy-buds-client/default.nix4
-rw-r--r--pkgs/applications/audio/galaxy-buds-client/deps.nix69
-rw-r--r--pkgs/applications/audio/reaper/default.nix6
-rw-r--r--pkgs/applications/editors/quartus-prime/default.nix3
-rw-r--r--pkgs/applications/editors/tweak/default.nix3
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix434
-rw-r--r--pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix84
-rw-r--r--pkgs/applications/editors/vim/plugins/overrides.nix2
-rw-r--r--pkgs/applications/editors/vim/plugins/patches/coq_nvim/emulate-venv.patch18
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-clap/Cargo.lock276
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-clap/default.nix4
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix4
-rw-r--r--pkgs/applications/graphics/hydrus/default.nix4
-rw-r--r--pkgs/applications/graphics/texturepacker/default.nix49
-rw-r--r--pkgs/applications/misc/cherrytree/default.nix6
-rw-r--r--pkgs/applications/misc/spicetify-cli/default.nix6
-rw-r--r--pkgs/applications/networking/browsers/brave/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kube-router/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/stern/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/talosctl/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/terraform/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/weave-gitops/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/werf/default.nix6
-rw-r--r--pkgs/applications/networking/gmailctl/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix16
-rw-r--r--pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix8
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/seaweedfs/default.nix6
-rw-r--r--pkgs/applications/networking/syncthing/default.nix4
-rw-r--r--pkgs/applications/science/biology/picard-tools/default.nix4
-rw-r--r--pkgs/applications/science/electronics/kicad/addons/default.nix5
-rw-r--r--pkgs/applications/science/electronics/kicad/addons/kikit.nix52
-rw-r--r--pkgs/applications/science/electronics/kicad/base.nix2
-rw-r--r--pkgs/applications/science/electronics/kicad/default.nix53
-rw-r--r--pkgs/applications/science/electronics/kicad/runtime_stock_data_path.patch15
-rw-r--r--pkgs/applications/science/electronics/verilator/default.nix4
-rw-r--r--pkgs/applications/science/logic/eprover/default.nix4
-rw-r--r--pkgs/applications/version-management/git-mit/default.nix6
-rw-r--r--pkgs/applications/version-management/pijul/default.nix6
-rw-r--r--pkgs/applications/version-management/sourcehut/default.nix8
-rw-r--r--pkgs/applications/video/obs-studio/plugins/obs-pipewire-audio-capture.nix4
-rw-r--r--pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix4
-rw-r--r--pkgs/applications/video/ustreamer/default.nix4
-rw-r--r--pkgs/applications/video/webtorrent_desktop/default.nix26
-rw-r--r--pkgs/applications/virtualization/docker/default.nix2
-rw-r--r--pkgs/applications/virtualization/virt-manager/default.nix6
-rw-r--r--pkgs/build-support/build-graalvm-native-image/default.nix7
-rw-r--r--pkgs/build-support/node/build-npm-package/default.nix11
-rw-r--r--pkgs/by-name/as/ast-grep/package.nix6
-rw-r--r--pkgs/by-name/ez/eza/package.nix6
-rw-r--r--pkgs/by-name/fo/fortune-kind/package.nix6
-rw-r--r--pkgs/by-name/ki/kikit/default.nix87
-rw-r--r--pkgs/by-name/ki/kikit/package.nix2
-rw-r--r--pkgs/by-name/ki/kikit/shapely/default.nix71
-rw-r--r--pkgs/by-name/ki/kikit/shapely/library-paths.patch31
-rw-r--r--pkgs/by-name/ki/kikit/solidpython/default.nix66
-rw-r--r--pkgs/by-name/lc/lcab/package.nix32
-rw-r--r--pkgs/by-name/ln/lngen/package.nix23
-rw-r--r--pkgs/by-name/ni/nix-search-cli/package.nix30
-rw-r--r--pkgs/by-name/rq/rqbit/package.nix (renamed from pkgs/applications/networking/p2p/rqbit/default.nix)11
-rw-r--r--pkgs/by-name/rt/rtl-sdr-osmocom/package.nix53
-rw-r--r--pkgs/by-name/se/seclists/package.nix6
-rw-r--r--pkgs/by-name/sy/symbolicator/Cargo.lock178
-rw-r--r--pkgs/by-name/sy/symbolicator/package.nix4
-rw-r--r--pkgs/by-name/tr/trealla/package.nix4
-rw-r--r--pkgs/by-name/xs/xscreensaver/package.nix16
-rw-r--r--pkgs/data/fonts/sil-abyssinica/default.nix4
-rw-r--r--pkgs/data/icons/tau-hydrogen/default.nix4
-rw-r--r--pkgs/development/compilers/elm/default.nix11
-rw-r--r--pkgs/development/compilers/elm/packages/node-packages.json1
-rw-r--r--pkgs/development/compilers/elm/packages/node-packages.nix456
-rw-r--r--pkgs/development/compilers/julia/1.9-bin.nix10
-rw-r--r--pkgs/development/compilers/julia/1.9.nix4
-rw-r--r--pkgs/development/interpreters/babashka/default.nix7
-rw-r--r--pkgs/development/interpreters/ruby/default.nix4
-rw-r--r--pkgs/development/libraries/libcmis/default.nix4
-rw-r--r--pkgs/development/libraries/libdeltachat/Cargo.lock401
-rw-r--r--pkgs/development/libraries/libdeltachat/default.nix4
-rw-r--r--pkgs/development/libraries/libvirt/default.nix10
-rw-r--r--pkgs/development/libraries/omorfi/default.nix11
-rw-r--r--pkgs/development/libraries/sentry-native/default.nix4
-rw-r--r--pkgs/development/libraries/vulkan-utility-libraries/default.nix4
-rw-r--r--pkgs/development/libraries/wxwidgets/wxGTK32.nix4
-rw-r--r--pkgs/development/ocaml-modules/cry/default.nix6
-rw-r--r--pkgs/development/ocaml-modules/ffmpeg/base.nix6
-rw-r--r--pkgs/development/ocaml-modules/ffmpeg/default.nix2
-rw-r--r--pkgs/development/ocaml-modules/ffmpeg/ffmpeg-av.nix2
-rw-r--r--pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avcodec.nix2
-rw-r--r--pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix2
-rw-r--r--pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avfilter.nix2
-rw-r--r--pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avutil.nix2
-rw-r--r--pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swresample.nix2
-rw-r--r--pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swscale.nix2
-rw-r--r--pkgs/development/ocaml-modules/flac/default.nix4
-rw-r--r--pkgs/development/ocaml-modules/metadata/default.nix22
-rw-r--r--pkgs/development/python-modules/accuweather/default.nix4
-rw-r--r--pkgs/development/python-modules/adafruit-platformdetect/default.nix4
-rw-r--r--pkgs/development/python-modules/ailment/default.nix4
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix4
-rw-r--r--pkgs/development/python-modules/aiomisc/default.nix4
-rw-r--r--pkgs/development/python-modules/angr/default.nix4
-rw-r--r--pkgs/development/python-modules/appthreat-vulnerability-db/default.nix4
-rw-r--r--pkgs/development/python-modules/archinfo/default.nix4
-rw-r--r--pkgs/development/python-modules/argcomplete/default.nix9
-rw-r--r--pkgs/development/python-modules/argilla/default.nix4
-rw-r--r--pkgs/development/python-modules/authcaptureproxy/default.nix10
-rw-r--r--pkgs/development/python-modules/bitarray/default.nix4
-rw-r--r--pkgs/development/python-modules/canals/default.nix4
-rw-r--r--pkgs/development/python-modules/claripy/default.nix4
-rw-r--r--pkgs/development/python-modules/cle/default.nix6
-rw-r--r--pkgs/development/python-modules/edalize/default.nix19
-rw-r--r--pkgs/development/python-modules/euclid3/default.nix25
-rw-r--r--pkgs/development/python-modules/griffe/default.nix4
-rw-r--r--pkgs/development/python-modules/gvm-tools/default.nix4
-rw-r--r--pkgs/development/python-modules/jax/default.nix8
-rw-r--r--pkgs/development/python-modules/jaxlib/bin.nix34
-rw-r--r--pkgs/development/python-modules/jaxlib/default.nix19
-rw-r--r--pkgs/development/python-modules/newversion/default.nix24
-rw-r--r--pkgs/development/python-modules/opensearch-py/default.nix52
-rw-r--r--pkgs/development/python-modules/pcbnew-transition/default.nix39
-rw-r--r--pkgs/development/python-modules/pixel-ring/default.nix42
-rw-r--r--pkgs/development/python-modules/psycopg/default.nix8
-rw-r--r--pkgs/development/python-modules/pybars3/default.nix38
-rw-r--r--pkgs/development/python-modules/pymeta3/default.nix29
-rw-r--r--pkgs/development/python-modules/pynvim-pp/default.nix9
-rw-r--r--pkgs/development/python-modules/pyoverkiz/default.nix4
-rw-r--r--pkgs/development/python-modules/python-gvm/default.nix4
-rw-r--r--pkgs/development/python-modules/pyvex/default.nix4
-rw-r--r--pkgs/development/python-modules/std2/default.nix9
-rw-r--r--pkgs/development/python-modules/transformers/default.nix4
-rw-r--r--pkgs/development/python-modules/types-awscrt/default.nix4
-rw-r--r--pkgs/development/python-modules/weconnect-mqtt/default.nix4
-rw-r--r--pkgs/development/python-modules/weconnect/default.nix4
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix4
-rw-r--r--pkgs/development/tools/analysis/checkstyle/default.nix4
-rw-r--r--pkgs/development/tools/analysis/rr/default.nix1
-rw-r--r--pkgs/development/tools/argc/default.nix6
-rw-r--r--pkgs/development/tools/database/litestream/default.nix4
-rw-r--r--pkgs/development/tools/devpod/default.nix4
-rw-r--r--pkgs/development/tools/ginkgo/default.nix6
-rw-r--r--pkgs/development/tools/language-servers/lua-language-server/default.nix6
-rw-r--r--pkgs/development/tools/misc/saleae-logic-2/default.nix4
-rw-r--r--pkgs/development/tools/mold/default.nix4
-rw-r--r--pkgs/development/tools/ocaml/camlidl/default.nix7
-rw-r--r--pkgs/development/tools/open-policy-agent/default.nix9
-rw-r--r--pkgs/development/tools/rust/cargo-codspeed/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-crev/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-mutants/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-nextest/default.nix6
-rw-r--r--pkgs/development/tools/selene/default.nix6
-rw-r--r--pkgs/development/tools/stylua/default.nix6
-rw-r--r--pkgs/games/vassal/default.nix4
-rw-r--r--pkgs/misc/mnemonicode/default.nix18
-rw-r--r--pkgs/os-specific/linux/apfs/default.nix4
-rw-r--r--pkgs/os-specific/linux/mstflint_access/default.nix40
-rw-r--r--pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix17
-rw-r--r--pkgs/os-specific/linux/trinity/default.nix23
-rw-r--r--pkgs/servers/clickhouse/default.nix58
-rw-r--r--pkgs/servers/http/dufs/default.nix6
-rw-r--r--pkgs/servers/jellyseerr/default.nix4
-rw-r--r--pkgs/servers/jellyseerr/package.json98
-rw-r--r--pkgs/servers/jellyseerr/pin.json6
-rwxr-xr-xpkgs/servers/jellyseerr/update.sh4
-rw-r--r--pkgs/servers/mjolnir/default.nix6
-rw-r--r--pkgs/servers/mjolnir/package.json10
-rw-r--r--pkgs/servers/monitoring/telegraf/default.nix6
-rw-r--r--pkgs/servers/nosql/victoriametrics/default.nix4
-rw-r--r--pkgs/servers/search/zincsearch/default.nix6
-rw-r--r--pkgs/servers/sozu/default.nix6
-rw-r--r--pkgs/servers/teleport/12/default.nix8
-rw-r--r--pkgs/servers/teleport/13/Cargo.lock23
-rw-r--r--pkgs/servers/teleport/13/default.nix8
-rw-r--r--pkgs/servers/teleport/14/Cargo.lock49
-rw-r--r--pkgs/servers/teleport/14/default.nix8
-rw-r--r--pkgs/test/cc-wrapper/atomics.cc8
-rw-r--r--pkgs/test/cc-wrapper/default.nix11
-rw-r--r--pkgs/test/default.nix36
-rw-r--r--pkgs/tools/admin/pulumi-bin/data.nix34
-rw-r--r--pkgs/tools/audio/liquidsoap/full.nix93
-rw-r--r--pkgs/tools/filesystems/bcachefs-tools/default.nix13
-rw-r--r--pkgs/tools/misc/esphome/dashboard.nix4
-rw-r--r--pkgs/tools/misc/esphome/default.nix11
-rw-r--r--pkgs/tools/misc/google-cloud-sql-proxy/default.nix6
-rw-r--r--pkgs/tools/misc/moar/default.nix4
-rw-r--r--pkgs/tools/misc/mstflint/default.nix94
-rw-r--r--pkgs/tools/misc/pspg/default.nix4
-rw-r--r--pkgs/tools/misc/qflipper/default.nix4
-rw-r--r--pkgs/tools/misc/ttyplot/default.nix4
-rw-r--r--pkgs/tools/misc/ugs/default.nix4
-rw-r--r--pkgs/tools/misc/yt-dlp/default.nix4
-rw-r--r--pkgs/tools/networking/aria2/default.nix4
-rw-r--r--pkgs/tools/networking/containerlab/default.nix8
-rw-r--r--pkgs/tools/networking/sing-box/default.nix6
-rw-r--r--pkgs/tools/networking/socat/default.nix4
-rw-r--r--pkgs/tools/networking/tgt/default.nix4
-rw-r--r--pkgs/tools/networking/v2ray/default.nix6
-rw-r--r--pkgs/tools/security/sigma-cli/default.nix4
-rw-r--r--pkgs/tools/security/sslscan/default.nix4
-rw-r--r--pkgs/tools/system/bfs/default.nix2
-rw-r--r--pkgs/tools/text/riffdiff/default.nix6
-rw-r--r--pkgs/tools/wayland/hyprland-per-window-layout/default.nix6
-rw-r--r--pkgs/top-level/all-packages.nix74
-rw-r--r--pkgs/top-level/linux-kernels.nix2
-rw-r--r--pkgs/top-level/ocaml-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix10
223 files changed, 3622 insertions, 1552 deletions
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 59348b7b27a..47069c9a794 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -11,9 +11,6 @@
 # This also holds true for GitHub teams. Since almost none of our teams have write
 # permissions, you need to list all members of the team with commit access individually.
 
-# This file
-/.github/CODEOWNERS @edolstra
-
 # GitHub actions
 /.github/workflows @NixOS/Security @Mic92 @zowoq
 /.github/workflows/merge-staging @FRidh
@@ -22,12 +19,12 @@
 /.editorconfig @Mic92 @zowoq
 
 # Libraries
-/lib                        @edolstra @infinisil
+/lib                        @infinisil
 /lib/systems                @alyssais @ericson2314 @amjoseph-nixpkgs
-/lib/generators.nix         @infinisil @edolstra @Profpatsch
-/lib/cli.nix                @infinisil @edolstra @Profpatsch
-/lib/debug.nix              @infinisil @edolstra @Profpatsch
-/lib/asserts.nix            @infinisil @edolstra @Profpatsch
+/lib/generators.nix         @infinisil @Profpatsch
+/lib/cli.nix                @infinisil @Profpatsch
+/lib/debug.nix              @infinisil @Profpatsch
+/lib/asserts.nix            @infinisil @Profpatsch
 /lib/path.*                 @infinisil @fricklerhandwerk
 /lib/fileset                @infinisil
 /doc/functions/fileset.section.md @infinisil
diff --git a/.github/labeler.yml b/.github/labeler.yml
index c05c496cb10..58226031227 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -37,6 +37,11 @@
 "6.topic: fetch":
   - pkgs/build-support/fetch*/**/*
 
+"6.topic: flakes":
+  - '**/flake.nix'
+  - lib/systems/flake-systems.nix
+  - nixos/modules/config/nix-flakes.nix
+
 "6.topic: GNOME":
   - doc/languages-frameworks/gnome.section.md
   - nixos/modules/services/desktops/gnome/**/*
diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 0bb9959a510..152974b465a 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -210,6 +210,7 @@ In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json
 * `npmPruneFlags`: Flags to pass to `npm prune`. Defaults to the value of `npmInstallFlags`.
 * `makeWrapperArgs`: Flags to pass to `makeWrapper`, added to executable calling the generated `.js` with `node` as an interpreter. These scripts are defined in `package.json`.
 * `nodejs`: The `nodejs` package to build against, using the corresponding `npm` shipped with that version of `node`. Defaults to `pkgs.nodejs`.
+* `npmDeps`: The dependencies used to build the npm package. Especially useful to not have to recompute workspace depedencies.
 
 #### prefetch-npm-deps {#javascript-buildNpmPackage-prefetch-npm-deps}
 
diff --git a/lib/fileset/README.md b/lib/fileset/README.md
index 91f892a1be9..14b6877a906 100644
--- a/lib/fileset/README.md
+++ b/lib/fileset/README.md
@@ -238,6 +238,21 @@ Arguments:
   And it would be unclear how the library should behave if the one file wouldn't be added to the store:
   `toSource { root = ./file.nix; fileset = <empty>; }` has no reasonable result because returing an empty store path wouldn't match the file type, and there's no way to have an empty file store path, whatever that would mean.
 
+### `fileFilter` takes a path
+
+The `fileFilter` function takes a path, and not a file set, as its second argument.
+
+- (-) Makes it harder to compose functions, since the file set type, the return value, can't be passed to the function itself like `fileFilter predicate fileset`
+  - (+) It's still possible to use `intersection` to filter on file sets: `intersection fileset (fileFilter predicate ./.)`
+    - (-) This does need an extra `./.` argument that's not obvious
+      - (+) This could always be `/.` or the project directory, `intersection` will make it lazy
+- (+) In the future this will allow `fileFilter` to support a predicate property like `subpath` and/or `components` in a reproducible way.
+  This wouldn't be possible if it took a file set, because file sets don't have a predictable absolute path.
+  - (-) What about the base path?
+    - (+) That can change depending on which files are included, so if it's used for `fileFilter`
+      it would change the `subpath`/`components` value depending on which files are included.
+- (+) If necessary, this restriction can be relaxed later, the opposite wouldn't be possible
+
 ## To update in the future
 
 Here's a list of places in the library that need to be updated in the future:
diff --git a/lib/fileset/default.nix b/lib/fileset/default.nix
index d90c770633d..15af0813eec 100644
--- a/lib/fileset/default.nix
+++ b/lib/fileset/default.nix
@@ -12,14 +12,18 @@ let
     _printFileset
     _intersection
     _difference
+    _mirrorStorePath
+    _fetchGitSubmodulesMinver
     ;
 
   inherit (builtins)
+    isBool
     isList
     isPath
     pathExists
     seq
     typeOf
+    nixVersion
     ;
 
   inherit (lib.lists)
@@ -34,6 +38,7 @@ let
 
   inherit (lib.strings)
     isStringLike
+    versionOlder
     ;
 
   inherit (lib.filesystem)
@@ -47,6 +52,7 @@ let
   inherit (lib.trivial)
     isFunction
     pipe
+    inPureEvalMode
     ;
 
 in {
@@ -366,7 +372,7 @@ in {
           type :: String,
           ...
         } -> Bool)
-        -> FileSet
+        -> Path
         -> FileSet
 
     Example:
@@ -397,14 +403,24 @@ in {
       Other attributes may be added in the future.
     */
     predicate:
-    # The file set to filter based on the predicate function
-    fileset:
+    # The path whose files to filter
+    path:
     if ! isFunction predicate then
       throw ''
         lib.fileset.fileFilter: First argument is of type ${typeOf predicate}, but it should be a function instead.''
+    else if ! isPath path then
+      if path._type or "" == "fileset" then
+        throw ''
+          lib.fileset.fileFilter: Second argument is a file set, but it should be a path instead.
+              If you need to filter files in a file set, use `intersection fileset (fileFilter pred ./.)` instead.''
+      else
+        throw ''
+          lib.fileset.fileFilter: Second argument is of type ${typeOf path}, but it should be a path instead.''
+    else if ! pathExists path then
+      throw ''
+        lib.fileset.fileFilter: Second argument (${toString path}) is a path that does not exist.''
     else
-      _fileFilter predicate
-        (_coerce "lib.fileset.fileFilter: Second argument" fileset);
+      _fileFilter predicate path;
 
   /*
     The file set containing all files that are in both of two given file sets.
@@ -586,4 +602,111 @@ in {
       # We could also return the original fileset argument here,
       # but that would then duplicate work for consumers of the fileset, because then they have to coerce it again
       actualFileset;
+
+  /*
+    Create a file set containing all [Git-tracked files](https://git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository) in a repository.
+
+    This function behaves like [`gitTrackedWith { }`](#function-library-lib.fileset.gitTrackedWith) - using the defaults.
+
+    Type:
+      gitTracked :: Path -> FileSet
+
+    Example:
+      # Include all files tracked by the Git repository in the current directory
+      gitTracked ./.
+
+      # Include only files tracked by the Git repository in the parent directory
+      # that are also in the current directory
+      intersection ./. (gitTracked ../.)
+  */
+  gitTracked =
+    /*
+      The [path](https://nixos.org/manual/nix/stable/language/values#type-path) to the working directory of a local Git repository.
+      This directory must contain a `.git` file or subdirectory.
+    */
+    path:
+    # See the gitTrackedWith implementation for more explanatory comments
+    let
+      fetchResult = builtins.fetchGit path;
+    in
+    if inPureEvalMode then
+      throw "lib.fileset.gitTracked: This function is currently not supported in pure evaluation mode, since it currently relies on `builtins.fetchGit`. See https://github.com/NixOS/nix/issues/9292."
+    else if ! isPath path then
+      throw "lib.fileset.gitTracked: Expected the argument to be a path, but it's a ${typeOf path} instead."
+    else if ! pathExists (path + "/.git") then
+      throw "lib.fileset.gitTracked: Expected the argument (${toString path}) to point to a local working tree of a Git repository, but it's not."
+    else
+      _mirrorStorePath path fetchResult.outPath;
+
+  /*
+    Create a file set containing all [Git-tracked files](https://git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository) in a repository.
+    The first argument allows configuration with an attribute set,
+    while the second argument is the path to the Git working tree.
+    If you don't need the configuration,
+    you can use [`gitTracked`](#function-library-lib.fileset.gitTracked) instead.
+
+    This is equivalent to the result of [`unions`](#function-library-lib.fileset.unions) on all files returned by [`git ls-files`](https://git-scm.com/docs/git-ls-files)
+    (which uses [`--cached`](https://git-scm.com/docs/git-ls-files#Documentation/git-ls-files.txt--c) by default).
+
+    :::{.warning}
+    Currently this function is based on [`builtins.fetchGit`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-fetchGit)
+    As such, this function causes all Git-tracked files to be unnecessarily added to the Nix store,
+    without being re-usable by [`toSource`](#function-library-lib.fileset.toSource).
+
+    This may change in the future.
+    :::
+
+    Type:
+      gitTrackedWith :: { recurseSubmodules :: Bool ? false } -> Path -> FileSet
+
+    Example:
+      # Include all files tracked by the Git repository in the current directory
+      # and any submodules under it
+      gitTracked { recurseSubmodules = true; } ./.
+  */
+  gitTrackedWith =
+    {
+      /*
+        (optional, default: `false`) Whether to recurse into [Git submodules](https://git-scm.com/book/en/v2/Git-Tools-Submodules) to also include their tracked files.
+
+        If `true`, this is equivalent to passing the [--recurse-submodules](https://git-scm.com/docs/git-ls-files#Documentation/git-ls-files.txt---recurse-submodules) flag to `git ls-files`.
+      */
+      recurseSubmodules ? false,
+    }:
+    /*
+      The [path](https://nixos.org/manual/nix/stable/language/values#type-path) to the working directory of a local Git repository.
+      This directory must contain a `.git` file or subdirectory.
+    */
+    path:
+    let
+      # This imports the files unnecessarily, which currently can't be avoided
+      # because `builtins.fetchGit` is the only function exposing which files are tracked by Git.
+      # With the [lazy trees PR](https://github.com/NixOS/nix/pull/6530),
+      # the unnecessarily import could be avoided.
+      # However a simpler alternative still would be [a builtins.gitLsFiles](https://github.com/NixOS/nix/issues/2944).
+      fetchResult = builtins.fetchGit {
+        url = path;
+
+        # This is the only `fetchGit` parameter that makes sense in this context.
+        # We can't just pass `submodules = recurseSubmodules` here because
+        # this would fail for Nix versions that don't support `submodules`.
+        ${if recurseSubmodules then "submodules" else null} = true;
+      };
+    in
+    if inPureEvalMode then
+      throw "lib.fileset.gitTrackedWith: This function is currently not supported in pure evaluation mode, since it currently relies on `builtins.fetchGit`. See https://github.com/NixOS/nix/issues/9292."
+    else if ! isBool recurseSubmodules then
+      throw "lib.fileset.gitTrackedWith: Expected the attribute `recurseSubmodules` of the first argument to be a boolean, but it's a ${typeOf recurseSubmodules} instead."
+    else if recurseSubmodules && versionOlder nixVersion _fetchGitSubmodulesMinver then
+      throw "lib.fileset.gitTrackedWith: Setting the attribute `recurseSubmodules` to `true` is only supported for Nix version ${_fetchGitSubmodulesMinver} and after, but Nix version ${nixVersion} is used."
+    else if ! isPath path then
+      throw "lib.fileset.gitTrackedWith: Expected the second argument to be a path, but it's a ${typeOf path} instead."
+    # We can identify local working directories by checking for .git,
+    # see https://git-scm.com/docs/gitrepository-layout#_description.
+    # Note that `builtins.fetchGit` _does_ work for bare repositories (where there's no `.git`),
+    # even though `git ls-files` wouldn't return any files in that case.
+    else if ! pathExists (path + "/.git") then
+      throw "lib.fileset.gitTrackedWith: Expected the second argument (${toString path}) to point to a local working tree of a Git repository, but it's not."
+    else
+      _mirrorStorePath path fetchResult.outPath;
 }
diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index b245caade1f..0769e654c8f 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -786,9 +786,9 @@ rec {
         _differenceTree (path + "/${name}") lhsValue (rhs.${name} or null)
       ) (_directoryEntries path lhs);
 
-  # Filters all files in a file set based on a predicate
-  # Type: ({ name, type, ... } -> Bool) -> FileSet -> FileSet
-  _fileFilter = predicate: fileset:
+  # Filters all files in a path based on a predicate
+  # Type: ({ name, type, ... } -> Bool) -> Path -> FileSet
+  _fileFilter = predicate: root:
     let
       # Check the predicate for a single file
       # Type: String -> String -> filesetTree
@@ -807,19 +807,45 @@ rec {
 
       # Check the predicate for all files in a directory
       # Type: Path -> filesetTree
-      fromDir = path: tree:
-        mapAttrs (name: subtree:
-          if isAttrs subtree || subtree == "directory" then
-            fromDir (path + "/${name}") subtree
-          else if subtree == null then
-            null
+      fromDir = path:
+        mapAttrs (name: type:
+          if type == "directory" then
+            fromDir (path + "/${name}")
           else
-            fromFile name subtree
-        ) (_directoryEntries path tree);
+            fromFile name type
+        ) (readDir path);
+
+      rootType = pathType root;
     in
-    if fileset._internalIsEmptyWithoutBase then
-      _emptyWithoutBase
+    if rootType == "directory" then
+      _create root (fromDir root)
     else
-      _create fileset._internalBase
-        (fromDir fileset._internalBase fileset._internalTree);
+      # Single files are turned into a directory containing that file or nothing.
+      _create (dirOf root) {
+        ${baseNameOf root} =
+          fromFile (baseNameOf root) rootType;
+      };
+
+  # Support for `builtins.fetchGit` with `submodules = true` was introduced in 2.4
+  # https://github.com/NixOS/nix/commit/55cefd41d63368d4286568e2956afd535cb44018
+  _fetchGitSubmodulesMinver = "2.4";
+
+  # Mirrors the contents of a Nix store path relative to a local path as a file set.
+  # Some notes:
+  # - The store path is read at evaluation time.
+  # - The store path must not include files that don't exist in the respective local path.
+  #
+  # Type: Path -> String -> FileSet
+  _mirrorStorePath = localPath: storePath:
+    let
+      recurse = focusedStorePath:
+        mapAttrs (name: type:
+          if type == "directory" then
+            recurse (focusedStorePath + "/${name}")
+          else
+            type
+        ) (builtins.readDir focusedStorePath);
+    in
+    _create localPath
+      (recurse storePath);
 }
diff --git a/lib/fileset/tests.sh b/lib/fileset/tests.sh
index 5ef155d25a8..3c88ebdd055 100755
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@@ -43,15 +43,29 @@ crudeUnquoteJSON() {
     cut -d \" -f2
 }
 
-prefixExpression='let
-  lib = import <nixpkgs/lib>;
-  internal = import <nixpkgs/lib/fileset/internal.nix> {
-    inherit lib;
-  };
-in
-with lib;
-with internal;
-with lib.fileset;'
+prefixExpression() {
+    echo 'let
+      lib =
+        (import <nixpkgs/lib>)
+    '
+    if [[ "${1:-}" == "--simulate-pure-eval" ]]; then
+        echo '
+        .extend (final: prev: {
+          trivial = prev.trivial // {
+            inPureEvalMode = true;
+          };
+        })'
+    fi
+    echo '
+      ;
+      internal = import <nixpkgs/lib/fileset/internal.nix> {
+        inherit lib;
+      };
+    in
+    with lib;
+    with internal;
+    with lib.fileset;'
+}
 
 # Check that two nix expression successfully evaluate to the same value.
 # The expressions have `lib.fileset` in scope.
@@ -60,7 +74,7 @@ expectEqual() {
     local actualExpr=$1
     local expectedExpr=$2
     if actualResult=$(nix-instantiate --eval --strict --show-trace 2>"$tmp"/actualStderr \
-        --expr "$prefixExpression ($actualExpr)"); then
+        --expr "$(prefixExpression) ($actualExpr)"); then
         actualExitCode=$?
     else
         actualExitCode=$?
@@ -68,7 +82,7 @@ expectEqual() {
     actualStderr=$(< "$tmp"/actualStderr)
 
     if expectedResult=$(nix-instantiate --eval --strict --show-trace 2>"$tmp"/expectedStderr \
-        --expr "$prefixExpression ($expectedExpr)"); then
+        --expr "$(prefixExpression) ($expectedExpr)"); then
         expectedExitCode=$?
     else
         expectedExitCode=$?
@@ -95,8 +109,9 @@ expectEqual() {
 # Usage: expectStorePath NIX
 expectStorePath() {
     local expr=$1
-    if ! result=$(nix-instantiate --eval --strict --json --read-write-mode --show-trace \
-        --expr "$prefixExpression ($expr)"); then
+    if ! result=$(nix-instantiate --eval --strict --json --read-write-mode --show-trace 2>"$tmp"/stderr \
+        --expr "$(prefixExpression) ($expr)"); then
+        cat "$tmp/stderr" >&2
         die "$expr failed to evaluate, but it was expected to succeed"
     fi
     # This is safe because we assume to get back a store path in a string
@@ -108,10 +123,16 @@ expectStorePath() {
 # The expression has `lib.fileset` in scope.
 # Usage: expectFailure NIX REGEX
 expectFailure() {
+    if [[ "$1" == "--simulate-pure-eval" ]]; then
+        maybePure="--simulate-pure-eval"
+        shift
+    else
+        maybePure=""
+    fi
     local expr=$1
     local expectedErrorRegex=$2
     if result=$(nix-instantiate --eval --strict --read-write-mode --show-trace 2>"$tmp/stderr" \
-        --expr "$prefixExpression $expr"); then
+        --expr "$(prefixExpression $maybePure) $expr"); then
         die "$expr evaluated successfully to $result, but it was expected to fail"
     fi
     stderr=$(<"$tmp/stderr")
@@ -128,12 +149,12 @@ expectTrace() {
     local expectedTrace=$2
 
     nix-instantiate --eval --show-trace >/dev/null 2>"$tmp"/stderrTrace \
-        --expr "$prefixExpression trace ($expr)" || true
+        --expr "$(prefixExpression) trace ($expr)" || true
 
     actualTrace=$(sed -n 's/^trace: //p' "$tmp/stderrTrace")
 
     nix-instantiate --eval --show-trace >/dev/null 2>"$tmp"/stderrTraceVal \
-        --expr "$prefixExpression traceVal ($expr)" || true
+        --expr "$(prefixExpression) traceVal ($expr)" || true
 
     actualTraceVal=$(sed -n 's/^trace: //p' "$tmp/stderrTraceVal")
 
@@ -813,14 +834,15 @@ checkFileset 'difference ./. ./b'
 # The first argument needs to be a function
 expectFailure 'fileFilter null (abort "this is not needed")' 'lib.fileset.fileFilter: First argument is of type null, but it should be a function instead.'
 
-# The second argument can be a file set or an existing path
-expectFailure 'fileFilter (file: abort "this is not needed") null' 'lib.fileset.fileFilter: Second argument is of type null, but it should be a file set or a path instead.'
+# The second argument needs to be an existing path
+expectFailure 'fileFilter (file: abort "this is not needed") _emptyWithoutBase' 'lib.fileset.fileFilter: Second argument is a file set, but it should be a path instead.
+\s*If you need to filter files in a file set, use `intersection fileset \(fileFilter pred \./\.\)` instead.'
+expectFailure 'fileFilter (file: abort "this is not needed") null' 'lib.fileset.fileFilter: Second argument is of type null, but it should be a path instead.'
 expectFailure 'fileFilter (file: abort "this is not needed") ./a' 'lib.fileset.fileFilter: Second argument \('"$work"'/a\) is a path that does not exist.'
 
 # The predicate is not called when there's no files
 tree=()
 checkFileset 'fileFilter (file: abort "this is not needed") ./.'
-checkFileset 'fileFilter (file: abort "this is not needed") _emptyWithoutBase'
 
 # The predicate must be able to handle extra attributes
 touch a
@@ -882,14 +904,6 @@ checkFileset 'union ./c/a (fileFilter (file: assert file.name != "a"; true) ./.)
 # but here we need to use ./c
 checkFileset 'union (fileFilter (file: assert file.name != "a"; true) ./.) ./c'
 
-# Also lazy, the filter isn't called on a filtered out path
-tree=(
-    [a]=1
-    [b]=0
-    [c]=0
-)
-checkFileset 'fileFilter (file: assert file.name != "c"; file.name == "a") (difference ./. ./c)'
-
 # Make sure single files are filtered correctly
 tree=(
     [a]=1
@@ -1258,6 +1272,179 @@ expectEqual 'trace (intersection ./a (fromSource (lib.cleanSourceWith {
 }))) null' 'trace ./a/b null'
 rm -rf -- *
 
+## lib.fileset.gitTracked/gitTrackedWith
+
+# The first/second argument has to be a path
+expectFailure 'gitTracked null' 'lib.fileset.gitTracked: Expected the argument to be a path, but it'\''s a null instead.'
+expectFailure 'gitTrackedWith {} null' 'lib.fileset.gitTrackedWith: Expected the second argument to be a path, but it'\''s a null instead.'
+
+# The path has to contain a .git directory
+expectFailure 'gitTracked ./.' 'lib.fileset.gitTracked: Expected the argument \('"$work"'\) to point to a local working tree of a Git repository, but it'\''s not.'
+expectFailure 'gitTrackedWith {} ./.' 'lib.fileset.gitTrackedWith: Expected the second argument \('"$work"'\) to point to a local working tree of a Git repository, but it'\''s not.'
+
+# recurseSubmodules has to be a boolean
+expectFailure 'gitTrackedWith { recurseSubmodules = null; } ./.' 'lib.fileset.gitTrackedWith: Expected the attribute `recurseSubmodules` of the first argument to be a boolean, but it'\''s a null instead.'
+
+# recurseSubmodules = true is not supported on all Nix versions
+if [[ "$(nix-instantiate --eval --expr "$(prefixExpression) (versionAtLeast builtins.nixVersion _fetchGitSubmodulesMinver)")" == true ]]; then
+    fetchGitSupportsSubmodules=1
+else
+    fetchGitSupportsSubmodules=
+    expectFailure 'gitTrackedWith { recurseSubmodules = true; } ./.' 'lib.fileset.gitTrackedWith: Setting the attribute `recurseSubmodules` to `true` is only supported for Nix version 2.4 and after, but Nix version [0-9.]+ is used.'
+fi
+
+# Checks that `gitTrackedWith` contains the same files as `git ls-files`
+# for the current working directory.
+# If --recurse-submodules is passed, the flag is passed through to `git ls-files`
+# and as `recurseSubmodules` to `gitTrackedWith`
+checkGitTrackedWith() {
+    if [[ "${1:-}" == "--recurse-submodules" ]]; then
+        gitLsFlags="--recurse-submodules"
+        gitTrackedArg="{ recurseSubmodules = true; }"
+    else
+        gitLsFlags=""
+        gitTrackedArg="{ }"
+    fi
+
+    # All files listed by `git ls-files`
+    expectedFiles=()
+    while IFS= read -r -d $'\0' file; do
+        # If there are submodules but --recurse-submodules isn't passed,
+        # `git ls-files` lists them as empty directories,
+        # we need to filter that out since we only want to check/count files
+        if [[ -f "$file" ]]; then
+            expectedFiles+=("$file")
+        fi
+    done < <(git ls-files -z $gitLsFlags)
+
+    storePath=$(expectStorePath 'toSource { root = ./.; fileset = gitTrackedWith '"$gitTrackedArg"' ./.; }')
+
+    # Check that each expected file is also in the store path with the same content
+    for expectedFile in "${expectedFiles[@]}"; do
+        if [[ ! -e "$storePath"/"$expectedFile" ]]; then
+            die "Expected file $expectedFile to exist in $storePath, but it doesn't.\nGit status:\n$(git status)\nStore path contents:\n$(find "$storePath")"
+        fi
+        if ! diff "$expectedFile" "$storePath"/"$expectedFile"; then
+            die "Expected file $expectedFile to have the same contents as in $storePath, but it doesn't.\nGit status:\n$(git status)\nStore path contents:\n$(find "$storePath")"
+        fi
+    done
+
+    # This is a cheap way to verify the inverse: That all files in the store path are also expected
+    # We just count the number of files in both and verify they're the same
+    actualFileCount=$(find "$storePath" -type f -printf . | wc -c)
+    if [[ "${#expectedFiles[@]}" != "$actualFileCount" ]]; then
+        die "Expected ${#expectedFiles[@]} files in $storePath, but got $actualFileCount.\nGit status:\n$(git status)\nStore path contents:\n$(find "$storePath")"
+    fi
+}
+
+
+# Runs checkGitTrackedWith with and without --recurse-submodules
+# Allows testing both variants together
+checkGitTracked() {
+    checkGitTrackedWith
+    if [[ -n "$fetchGitSupportsSubmodules" ]]; then
+        checkGitTrackedWith --recurse-submodules
+    fi
+}
+
+createGitRepo() {
+    git init -q "$1"
+    # Only repo-local config
+    git -C "$1" config user.name "Nixpkgs"
+    git -C "$1" config user.email "nixpkgs@nixos.org"
+    # Get at least a HEAD commit, needed for older Nix versions
+    git -C "$1" commit -q --allow-empty -m "Empty commit"
+}
+
+# Check the error message for pure eval mode
+createGitRepo .
+expectFailure --simulate-pure-eval 'toSource { root = ./.; fileset = gitTracked ./.; }' 'lib.fileset.gitTracked: This function is currently not supported in pure evaluation mode, since it currently relies on `builtins.fetchGit`. See https://github.com/NixOS/nix/issues/9292.'
+expectFailure --simulate-pure-eval 'toSource { root = ./.; fileset = gitTrackedWith {} ./.; }' 'lib.fileset.gitTrackedWith: This function is currently not supported in pure evaluation mode, since it currently relies on `builtins.fetchGit`. See https://github.com/NixOS/nix/issues/9292.'
+rm -rf -- *
+
+# Go through all stages of Git files
+# See https://www.git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository
+
+# Empty repository
+createGitRepo .
+checkGitTracked
+
+# Untracked file
+echo a > a
+checkGitTracked
+
+# Staged file
+git add a
+checkGitTracked
+
+# Committed file
+git commit -q -m "Added a"
+checkGitTracked
+
+# Edited file
+echo b > a
+checkGitTracked
+
+# Removed file
+git rm -f -q a
+checkGitTracked
+
+rm -rf -- *
+
+# gitignored file
+createGitRepo .
+echo a > .gitignore
+touch a
+git add -A
+checkGitTracked
+
+# Add it regardless (needs -f)
+git add -f a
+checkGitTracked
+rm -rf -- *
+
+# Directory
+createGitRepo .
+mkdir -p d1/d2/d3
+touch d1/d2/d3/a
+git add d1
+checkGitTracked
+rm -rf -- *
+
+# Submodules
+createGitRepo .
+createGitRepo sub
+
+# Untracked submodule
+git -C sub commit -q --allow-empty -m "Empty commit"
+checkGitTracked
+
+# Tracked submodule
+git submodule add ./sub sub >/dev/null
+checkGitTracked
+
+# Untracked file
+echo a > sub/a
+checkGitTracked
+
+# Staged file
+git -C sub add a
+checkGitTracked
+
+# Committed file
+git -C sub commit -q -m "Add a"
+checkGitTracked
+
+# Changed file
+echo b > sub/b
+checkGitTracked
+
+# Removed file
+git -C sub rm -f -q a
+checkGitTracked
+
+rm -rf -- *
+
 # TODO: Once we have combinators and a property testing library, derive property tests from https://en.wikipedia.org/wiki/Algebra_of_sets
 
 echo >&2 tests ok
diff --git a/lib/tests/release.nix b/lib/tests/release.nix
index c8d6b810122..6e5b0711736 100644
--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@@ -25,11 +25,13 @@ let
       ];
       nativeBuildInputs = [
         nix
+        pkgs.gitMinimal
       ] ++ lib.optional pkgs.stdenv.isLinux pkgs.inotify-tools;
       strictDeps = true;
     } ''
       datadir="${nix}/share"
       export TEST_ROOT=$(pwd)/test-tmp
+      export HOME=$(mktemp -d)
       export NIX_BUILD_HOOK=
       export NIX_CONF_DIR=$TEST_ROOT/etc
       export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 6fde1f61e5f..0c410d2e362 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3079,6 +3079,12 @@
     githubId = 1689801;
     name = "Mikhail Chekan";
   };
+  chen = {
+    email = "i@cuichen.cc";
+    github = "cu1ch3n";
+    githubId = 80438676;
+    name = "Chen Cui";
+  };
   ChengCat = {
     email = "yu@cheng.cat";
     github = "ChengCat";
@@ -8289,6 +8295,15 @@
     githubId = 18501;
     name = "Julien Langlois";
   };
+  jfly = {
+    name = "Jeremy Fleischman";
+    email = "jeremyfleischman@gmail.com";
+    github = "jfly";
+    githubId = 277474;
+    keys = [{
+      fingerprint = "F1F1 3395 8E8E 9CC4 D9FC  9647 1931 9CD8 416A 642B";
+    }];
+  };
   jfrankenau = {
     email = "johannes@frankenau.net";
     github = "jfrankenau";
@@ -11203,6 +11218,12 @@
     githubId = 11810057;
     name = "Matt Snider";
   };
+  matusf = {
+    email = "matus.ferech@gmail.com";
+    github = "matusf";
+    githubId = 18228995;
+    name = "Matúš Ferech";
+  };
   maurer = {
     email = "matthew.r.maurer+nix@gmail.com";
     github = "maurer";
@@ -11714,6 +11735,12 @@
     githubId = 34864484;
     name = "Mikael Fangel";
   };
+  mikecm = {
+    email = "mikecmcleod@gmail.com";
+    github = "MaxwellDupre";
+    githubId = 14096356;
+    name = "Michael McLeod";
+  };
   mikefaille = {
     email = "michael@faille.io";
     github = "mikefaille";
@@ -16513,6 +16540,11 @@
     githubId = 158321;
     name = "Stewart Mackenzie";
   };
+  skovati = {
+    github = "skovati";
+    githubId = 49844593;
+    name = "skovati";
+  };
   skykanin = {
     github = "skykanin";
     githubId = 3789764;
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 93abf760b0d..08fd671e2a7 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -373,6 +373,8 @@
 
 - The `prayer` package as well as `services.prayer` have been removed because it's been unmaintained for several years and the author's website has vanished.
 
+- The `chrony` NixOS module now tracks the Real-Time Clock drift from the System Clock with `rtcfile` and automatically adjusts it with `rtcautotrim` when it exceeds the maximum error specified in `services.chrony.autotrimThreshold` (default 30 seconds). If you enabled `rtcsync` in `extraConfig`, you should remove RTC related options from `extraConfig`. If you do not want chrony configured to keep the RTC in check, you can set `services.chrony.enableRTCTrimming = false;`
+
 ## Other Notable Changes {#sec-release-23.11-notable-changes}
 
 - A new option `system.switch.enable` was added. By default, this is option is
diff --git a/nixos/modules/services/monitoring/parsedmarc.nix b/nixos/modules/services/monitoring/parsedmarc.nix
index 44fc359b6a7..a146e7ab954 100644
--- a/nixos/modules/services/monitoring/parsedmarc.nix
+++ b/nixos/modules/services/monitoring/parsedmarc.nix
@@ -301,6 +301,7 @@ in
               description = lib.mdDoc ''
                 The addresses to send outgoing mail to.
               '';
+              apply = x: if x == [] then null else lib.concatStringsSep "," x;
             };
           };
 
diff --git a/nixos/modules/services/networking/ntp/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix
index afd721e34da..d370e6946d7 100644
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@@ -9,6 +9,7 @@ let
   stateDir = cfg.directory;
   driftFile = "${stateDir}/chrony.drift";
   keyFile = "${stateDir}/chrony.keys";
+  rtcFile = "${stateDir}/chrony.rtc";
 
   configFile = pkgs.writeText "chrony.conf" ''
     ${concatMapStringsSep "\n" (server: "server " + server + " " + cfg.serverOption + optionalString (cfg.enableNTS) " nts") cfg.servers}
@@ -20,8 +21,10 @@ let
 
     driftfile ${driftFile}
     keyfile ${keyFile}
+    ${optionalString (cfg.enableRTCTrimming) "rtcfile ${rtcFile}"}
     ${optionalString (cfg.enableNTS) "ntsdumpdir ${stateDir}"}
 
+    ${optionalString (cfg.enableRTCTrimming) "rtcautotrim ${builtins.toString cfg.autotrimThreshold}"}
     ${optionalString (!config.time.hardwareClockInLocalTime) "rtconutc"}
 
     ${cfg.extraConfig}
@@ -85,6 +88,33 @@ in
         '';
       };
 
+      enableRTCTrimming = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc ''
+          Enable tracking of the RTC offset to the system clock and automatic trimming.
+          See also [](#opt-services.chrony.autotrimThreshold)
+
+          ::: {.note}
+          This is not compatible with the `rtcsync` directive, which naively syncs the RTC time every 11 minutes.
+
+          Tracking the RTC drift will allow more precise timekeeping,
+          especially on intermittently running devices, where the RTC is very relevant.
+          :::
+        '';
+      };
+
+      autotrimThreshold = mkOption {
+        type = types.ints.positive;
+        default = 30;
+        example = 10;
+        description = ''
+          Maximum estimated error threshold for the `rtcautotrim` command.
+          When reached, the RTC will be trimmed.
+          Only used when [](#opt-services.chrony.enableRTCTrimming) is enabled.
+        '';
+      };
+
       enableNTS = mkOption {
         type = types.bool;
         default = false;
@@ -141,7 +171,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    meta.maintainers = with lib.maintainers; [ thoughtpolice ];
+    meta.maintainers = with lib.maintainers; [ thoughtpolice vifino ];
 
     environment.systemPackages = [ chronyPkg ];
 
@@ -156,12 +186,19 @@ in
 
     services.timesyncd.enable = mkForce false;
 
+    # If chrony controls and tracks the RTC, writing it externally causes clock error.
+    systemd.services.save-hwclock = lib.mkIf cfg.enableRTCTrimming {
+      enable = lib.mkForce false;
+    };
+
     systemd.services.systemd-timedated.environment = { SYSTEMD_TIMEDATED_NTP_SERVICES = "chronyd.service"; };
 
     systemd.tmpfiles.rules = [
       "d ${stateDir} 0750 chrony chrony - -"
       "f ${driftFile} 0640 chrony chrony - -"
       "f ${keyFile} 0640 chrony chrony - -"
+    ] ++ lib.optionals cfg.enableRTCTrimming [
+      "f ${rtcFile} 0640 chrony chrony - -"
     ];
 
     systemd.services.chronyd =
diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix
index 0426dbb0c83..b6579af10a7 100644
--- a/nixos/modules/services/networking/unbound.nix
+++ b/nixos/modules/services/networking/unbound.nix
@@ -166,7 +166,7 @@ in {
     services.unbound.settings = {
       server = {
         directory = mkDefault cfg.stateDir;
-        username = cfg.user;
+        username = ''""'';
         chroot = ''""'';
         pidfile = ''""'';
         # when running under systemd there is no need to daemonize
@@ -245,14 +245,13 @@ in {
         NotifyAccess = "main";
         Type = "notify";
 
-        # FIXME: Which of these do we actually need, can we drop the chroot flag?
         AmbientCapabilities = [
           "CAP_NET_BIND_SERVICE"
+          "CAP_NET_RAW" # needed if ip-transparent is set to true
+        ];
+        CapabilityBoundingSet = [
+          "CAP_NET_BIND_SERVICE"
           "CAP_NET_RAW"
-          "CAP_SETGID"
-          "CAP_SETUID"
-          "CAP_SYS_CHROOT"
-          "CAP_SYS_RESOURCE"
         ];
 
         User = cfg.user;
@@ -266,22 +265,19 @@ in {
         ProtectControlGroups = true;
         ProtectKernelModules = true;
         ProtectSystem = "strict";
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectKernelLogs = true;
+        ProtectKernelTunables = true;
         RuntimeDirectory = "unbound";
         ConfigurationDirectory = "unbound";
         StateDirectory = "unbound";
         RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_NETLINK" "AF_UNIX" ];
         RestrictRealtime = true;
         SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "~@clock"
-          "@cpu-emulation"
-          "@debug"
-          "@keyring"
-          "@module"
-          "mount"
-          "@obsolete"
-          "@resources"
-        ];
+        SystemCallFilter = [ "@system-service" ];
         RestrictNamespaces = true;
         LockPersonality = true;
         RestrictSUIDSGID = true;
diff --git a/nixos/modules/services/networking/unifi.nix b/nixos/modules/services/networking/unifi.nix
index 6b683710980..537a4db95ca 100644
--- a/nixos/modules/services/networking/unifi.nix
+++ b/nixos/modules/services/networking/unifi.nix
@@ -1,60 +1,61 @@
 { config, options, lib, pkgs, utils, ... }:
-with lib;
 let
   cfg = config.services.unifi;
   stateDir = "/var/lib/unifi";
-  cmd = ''
-    @${cfg.jrePackage}/bin/java java \
-        ${optionalString (lib.versionAtLeast (lib.getVersion cfg.jrePackage) "16")
-        ("--add-opens java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED "
-        + "--add-opens java.base/sun.security.util=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED "
-        + "--add-opens java.rmi/sun.rmi.transport=ALL-UNNAMED")} \
-        ${optionalString (cfg.initialJavaHeapSize != null) "-Xms${(toString cfg.initialJavaHeapSize)}m"} \
-        ${optionalString (cfg.maximumJavaHeapSize != null) "-Xmx${(toString cfg.maximumJavaHeapSize)}m"} \
-        -jar ${stateDir}/lib/ace.jar
-  '';
+  cmd = lib.escapeShellArgs ([ "@${cfg.jrePackage}/bin/java" "java" ]
+    ++ lib.optionals (lib.versionAtLeast (lib.getVersion cfg.jrePackage) "16") [
+      "--add-opens=java.base/java.lang=ALL-UNNAMED"
+      "--add-opens=java.base/java.time=ALL-UNNAMED"
+      "--add-opens=java.base/sun.security.util=ALL-UNNAMED"
+      "--add-opens=java.base/java.io=ALL-UNNAMED"
+      "--add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED"
+    ]
+    ++ (lib.optional (cfg.initialJavaHeapSize != null) "-Xms${(toString cfg.initialJavaHeapSize)}m")
+    ++ (lib.optional (cfg.maximumJavaHeapSize != null) "-Xmx${(toString cfg.maximumJavaHeapSize)}m")
+    ++ cfg.extraJvmOptions
+    ++ [ "-jar" "${stateDir}/lib/ace.jar" ]);
 in
 {
 
   options = {
 
-    services.unifi.enable = mkOption {
-      type = types.bool;
+    services.unifi.enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = lib.mdDoc ''
         Whether or not to enable the unifi controller service.
       '';
     };
 
-    services.unifi.jrePackage = mkOption {
-      type = types.package;
+    services.unifi.jrePackage = lib.mkOption {
+      type = lib.types.package;
       default = if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.5") then pkgs.jdk17_headless else if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.3") then pkgs.jdk11 else pkgs.jre8;
-      defaultText = literalExpression ''if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.5") then pkgs.jdk17_headless else if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.3" then pkgs.jdk11 else pkgs.jre8'';
+      defaultText = lib.literalExpression ''if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.5") then pkgs.jdk17_headless else if (lib.versionAtLeast (lib.getVersion cfg.unifiPackage) "7.3" then pkgs.jdk11 else pkgs.jre8'';
       description = lib.mdDoc ''
         The JRE package to use. Check the release notes to ensure it is supported.
       '';
     };
 
-    services.unifi.unifiPackage = mkOption {
-      type = types.package;
+    services.unifi.unifiPackage = lib.mkOption {
+      type = lib.types.package;
       default = pkgs.unifi5;
-      defaultText = literalExpression "pkgs.unifi5";
+      defaultText = lib.literalExpression "pkgs.unifi5";
       description = lib.mdDoc ''
         The unifi package to use.
       '';
     };
 
-    services.unifi.mongodbPackage = mkOption {
-      type = types.package;
+    services.unifi.mongodbPackage = lib.mkOption {
+      type = lib.types.package;
       default = pkgs.mongodb-4_4;
-      defaultText = literalExpression "pkgs.mongodb";
+      defaultText = lib.literalExpression "pkgs.mongodb";
       description = lib.mdDoc ''
         The mongodb package to use. Please note: unifi7 officially only supports mongodb up until 3.6 but works with 4.4.
       '';
     };
 
-    services.unifi.openFirewall = mkOption {
-      type = types.bool;
+    services.unifi.openFirewall = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = lib.mdDoc ''
         Whether or not to open the minimum required ports on the firewall.
@@ -65,8 +66,8 @@ in
       '';
     };
 
-    services.unifi.initialJavaHeapSize = mkOption {
-      type = types.nullOr types.int;
+    services.unifi.initialJavaHeapSize = lib.mkOption {
+      type = with lib.types; nullOr int;
       default = null;
       example = 1024;
       description = lib.mdDoc ''
@@ -75,8 +76,8 @@ in
       '';
     };
 
-    services.unifi.maximumJavaHeapSize = mkOption {
-      type = types.nullOr types.int;
+    services.unifi.maximumJavaHeapSize = lib.mkOption {
+      type = with lib.types; nullOr int;
       default = null;
       example = 4096;
       description = lib.mdDoc ''
@@ -85,9 +86,18 @@ in
       '';
     };
 
+    services.unifi.extraJvmOptions = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = [ ];
+      example = lib.literalExpression ''["-Xlog:gc"]'';
+      description = lib.mdDoc ''
+        Set extra options to pass to the JVM.
+      '';
+    };
+
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.users.unifi = {
       isSystemUser = true;
@@ -97,7 +107,7 @@ in
     };
     users.groups.unifi = {};
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       # https://help.ubnt.com/hc/en-us/articles/218506997
       allowedTCPPorts = [
         8080  # Port for UAP to inform controller.
@@ -123,8 +133,8 @@ in
 
       serviceConfig = {
         Type = "simple";
-        ExecStart = "${(removeSuffix "\n" cmd)} start";
-        ExecStop = "${(removeSuffix "\n" cmd)} stop";
+        ExecStart = "${cmd} start";
+        ExecStop = "${cmd} stop";
         Restart = "on-failure";
         TimeoutSec = "5min";
         User = "unifi";
@@ -166,7 +176,7 @@ in
         StateDirectory = "unifi";
         RuntimeDirectory = "unifi";
         LogsDirectory = "unifi";
-        CacheDirectory= "unifi";
+        CacheDirectory = "unifi";
 
         TemporaryFileSystem = [
           # required as we want to create bind mounts below
@@ -176,7 +186,7 @@ in
         # We must create the binary directories as bind mounts instead of symlinks
         # This is because the controller resolves all symlinks to absolute paths
         # to be used as the working directory.
-        BindPaths =  [
+        BindPaths = [
           "/var/log/unifi:${stateDir}/logs"
           "/run/unifi:${stateDir}/run"
           "${cfg.unifiPackage}/dl:${stateDir}/dl"
@@ -194,7 +204,7 @@ in
 
   };
   imports = [
-    (mkRemovedOptionModule [ "services" "unifi" "dataDir" ] "You should move contents of dataDir to /var/lib/unifi/data" )
-    (mkRenamedOptionModule [ "services" "unifi" "openPorts" ] [ "services" "unifi" "openFirewall" ])
+    (lib.mkRemovedOptionModule [ "services" "unifi" "dataDir" ] "You should move contents of dataDir to /var/lib/unifi/data")
+    (lib.mkRenamedOptionModule [ "services" "unifi" "openPorts" ] [ "services" "unifi" "openFirewall" ])
   ];
 }
diff --git a/nixos/modules/services/search/opensearch.nix b/nixos/modules/services/search/opensearch.nix
index 9a50e796313..ae79d5545fd 100644
--- a/nixos/modules/services/search/opensearch.nix
+++ b/nixos/modules/services/search/opensearch.nix
@@ -72,6 +72,18 @@ in
             The port to listen on for transport traffic.
           '';
         };
+
+        options."plugins.security.disabled" = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = lib.mdDoc ''
+            Whether to enable the security plugin,
+            `plugins.security.ssl.transport.keystore_filepath` or
+            `plugins.security.ssl.transport.server.pemcert_filepath` and
+            `plugins.security.ssl.transport.client.pemcert_filepath`
+            must be set for this plugin to be enabled.
+          '';
+        };
       };
 
       default = {};
@@ -186,6 +198,13 @@ in
               shopt -s inherit_errexit
 
               # Install plugins
+
+              # remove plugins directory if it is empty.
+              if [ -z "$(ls -A ${cfg.dataDir}/plugins)" ]; then
+                rm -r "${cfg.dataDir}/plugins"
+              fi
+
+              ln -sfT "${cfg.package}/plugins" "${cfg.dataDir}/plugins"
               ln -sfT ${cfg.package}/lib ${cfg.dataDir}/lib
               ln -sfT ${cfg.package}/modules ${cfg.dataDir}/modules
 
diff --git a/nixos/tests/dnscrypt-wrapper/default.nix b/nixos/tests/dnscrypt-wrapper/default.nix
index 1c05376e097..1a794931dc5 100644
--- a/nixos/tests/dnscrypt-wrapper/default.nix
+++ b/nixos/tests/dnscrypt-wrapper/default.nix
@@ -1,5 +1,15 @@
+
 { lib, pkgs, ... }:
 
+let
+  snakeoil = import ../common/acme/server/snakeoil-certs.nix;
+
+  hosts = lib.mkForce
+   { "fd::a" = [ "server" snakeoil.domain ];
+     "fd::b" = [ "client" ];
+   };
+in
+
 {
   name = "dnscrypt-wrapper";
   meta = with pkgs.lib.maintainers; {
@@ -7,59 +17,122 @@
   };
 
   nodes = {
-    server = { lib, ... }:
-      { services.dnscrypt-wrapper = with builtins;
+    server = {
+      networking.hosts = hosts;
+      networking.interfaces.eth1.ipv6.addresses = lib.singleton
+        { address = "fd::a"; prefixLength = 64; };
+
+        services.dnscrypt-wrapper =
           { enable = true;
-            address = "192.168.1.1";
+            address = "[::]";
+            port = 5353;
             keys.expiration = 5; # days
             keys.checkInterval = 2;  # min
             # The keypair was generated by the command:
             # dnscrypt-wrapper --gen-provider-keypair \
             #  --provider-name=2.dnscrypt-cert.server \
-            #  --ext-address=192.168.1.1:5353
-            providerKey.public = toFile "public.key" (readFile ./public.key);
-            providerKey.secret = toFile "secret.key" (readFile ./secret.key);
+            providerKey.public = "${./public.key}";
+            providerKey.secret = "${./secret.key}";
+          };
+
+        # nameserver
+        services.bind.enable = true;
+        services.bind.zones = lib.singleton
+          { name = ".";
+            master = true;
+            file = pkgs.writeText "root.zone" ''
+              $TTL 3600
+              . IN SOA example.org. admin.example.org. ( 1 3h 1h 1w 1d )
+              . IN NS example.org.
+              example.org. IN AAAA 2001:db8::1
+            '';
+          };
+
+        # webserver
+        services.nginx.enable = true;
+        services.nginx.virtualHosts.${snakeoil.domain} =
+          { onlySSL = true;
+            listenAddresses = [ "localhost" ];
+            sslCertificate = snakeoil.${snakeoil.domain}.cert;
+            sslCertificateKey = snakeoil.${snakeoil.domain}.key;
+            locations."/ip".extraConfig = ''
+              default_type text/plain;
+              return 200 "Ciao $remote_addr!\n";
+            '';
           };
-        services.tinydns.enable = true;
-        services.tinydns.data = ''
-          ..:192.168.1.1:a
-          +it.works:1.2.3.4
-        '';
-        networking.firewall.allowedUDPPorts = [ 5353 ];
-        networking.firewall.allowedTCPPorts = [ 5353 ];
-        networking.interfaces.eth1.ipv4.addresses = lib.mkForce
-          [ { address = "192.168.1.1"; prefixLength = 24; } ];
+
+        # demultiplex HTTP and DNS from port 443
+        services.sslh =
+          { enable = true;
+            method = "ev";
+            settings.transparent = true;
+            settings.listen = lib.mkForce
+              [ { host = "server"; port = "443"; is_udp = false; }
+                { host = "server"; port = "443"; is_udp = true; }
+              ];
+            settings.protocols =
+              [ # Send TLS to webserver (TCP)
+                { name = "tls"; host= "localhost"; port= "443"; }
+                # Send DNSCrypt to dnscrypt-wrapper (TCP or UDP)
+                { name = "anyprot"; host = "localhost"; port = "5353"; }
+                { name = "anyprot"; host = "localhost"; port = "5353"; is_udp = true;}
+              ];
+          };
+
+        networking.firewall.allowedTCPPorts = [ 443 ];
+        networking.firewall.allowedUDPPorts = [ 443 ];
       };
 
-    client = { lib, ... }:
-      { services.dnscrypt-proxy2.enable = true;
-        services.dnscrypt-proxy2.upstreamDefaults = false;
-        services.dnscrypt-proxy2.settings = {
-          server_names = [ "server" ];
-          static.server.stamp = "sdns://AQAAAAAAAAAAEDE5Mi4xNjguMS4xOjUzNTMgFEHYOv0SCKSuqR5CDYa7-58cCBuXO2_5uTSVU9wNQF0WMi5kbnNjcnlwdC1jZXJ0LnNlcnZlcg";
+    client = {
+      networking.hosts = hosts;
+      networking.interfaces.eth1.ipv6.addresses = lib.singleton
+        { address = "fd::b"; prefixLength = 64; };
+
+      services.dnscrypt-proxy2.enable = true;
+      services.dnscrypt-proxy2.upstreamDefaults = false;
+      services.dnscrypt-proxy2.settings =
+        { server_names = [ "server" ];
+          listen_addresses = [ "[::1]:53" ];
+          cache = false;
+          # Computed using https://dnscrypt.info/stamps/
+          static.server.stamp =
+            "sdns://AQAAAAAAAAAADzE5Mi4xNjguMS4yOjQ0MyAUQdg6"
+            +"_RIIpK6pHkINhrv7nxwIG5c7b_m5NJVT3A1AXRYyLmRuc2NyeXB0LWNlcnQuc2VydmVy";
         };
-        networking.nameservers = [ "127.0.0.1" ];
-        networking.interfaces.eth1.ipv4.addresses = lib.mkForce
-          [ { address = "192.168.1.2"; prefixLength = 24; } ];
-      };
+      networking.nameservers = [ "::1" ];
+      security.pki.certificateFiles = [ snakeoil.ca.cert ];
+    };
 
   };
 
   testScript = ''
-    start_all()
-
     with subtest("The server can generate the ephemeral keypair"):
         server.wait_for_unit("dnscrypt-wrapper")
         server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.key")
         server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.crt")
         almost_expiration = server.succeed("date --date '4days 23 hours 56min'").strip()
 
-    with subtest("The client can connect to the server"):
-        server.wait_for_unit("tinydns")
-        client.wait_for_unit("dnscrypt-proxy2")
-        assert "1.2.3.4" in client.wait_until_succeeds(
-            "host it.works"
-        ), "The IP address of 'it.works' does not match 1.2.3.4"
+    with subtest("The DNSCrypt client can connect to the server"):
+        server.wait_for_unit("sslh")
+        client.wait_until_succeeds("journalctl -u dnscrypt-proxy2 --grep '\[server\] OK'")
+
+    with subtest("HTTP client can connect to the server"):
+        server.wait_for_unit("nginx")
+        client.succeed("curl -s --fail https://${snakeoil.domain}/ip | grep -q fd::b")
+
+    with subtest("DNS queries over UDP are working"):
+        server.wait_for_unit("bind")
+        client.wait_for_open_port(53)
+        assert "2001:db8::1" in client.wait_until_succeeds(
+            "host -U example.org"
+        ), "The IP address of 'example.org' does not match 2001:db8::1"
+
+    with subtest("DNS queries over TCP are working"):
+        server.wait_for_unit("bind")
+        client.wait_for_open_port(53)
+        assert "2001:db8::1" in client.wait_until_succeeds(
+            "host -T example.org"
+        ), "The IP address of 'example.org' does not match 2001:db8::1"
 
     with subtest("The server rotates the ephemeral keys"):
         # advance time by a little less than 5 days
@@ -68,7 +141,8 @@
         server.wait_for_file("/var/lib/dnscrypt-wrapper/oldkeys")
 
     with subtest("The client can still connect to the server"):
-        server.wait_for_unit("dnscrypt-wrapper")
-        client.succeed("host it.works")
+        client.systemctl("restart dnscrypt-proxy2")
+        client.wait_until_succeeds("host -T example.org")
+        client.wait_until_succeeds("host -U example.org")
   '';
 }
diff --git a/pkgs/applications/audio/galaxy-buds-client/default.nix b/pkgs/applications/audio/galaxy-buds-client/default.nix
index f3a0ba8c6e9..15125358e46 100644
--- a/pkgs/applications/audio/galaxy-buds-client/default.nix
+++ b/pkgs/applications/audio/galaxy-buds-client/default.nix
@@ -13,13 +13,13 @@
 
 buildDotnetModule rec {
   pname = "galaxy-buds-client";
-  version = "4.5.2";
+  version = "4.5.4";
 
   src = fetchFromGitHub {
     owner = "ThePBone";
     repo = "GalaxyBudsClient";
     rev = version;
-    hash = "sha256-bnJ1xvqos+JP0KF8Z7mX8/8IozcaRCgaRL3cSO3V120=";
+    hash = "sha256-mmhXTtESjc8uNULc9zV2Qy/815BEEL7ybdnjArF2CXY=";
   };
 
   projectFile = [ "GalaxyBudsClient/GalaxyBudsClient.csproj" ];
diff --git a/pkgs/applications/audio/galaxy-buds-client/deps.nix b/pkgs/applications/audio/galaxy-buds-client/deps.nix
index d45dd12b8b2..1e72808d906 100644
--- a/pkgs/applications/audio/galaxy-buds-client/deps.nix
+++ b/pkgs/applications/audio/galaxy-buds-client/deps.nix
@@ -2,33 +2,42 @@
 # Please dont edit it manually, your changes might get overwritten!
 
 { fetchNuGet }: [
-  (fetchNuGet { pname = "Avalonia"; version = "0.10.14"; sha256 = "0nn3xgkf7v47dwpnsxjg0b25ifqa4mbq02ja5rvnlc3q2k6k0fxv"; })
+  (fetchNuGet { pname = "Avalonia"; version = "0.10.18"; sha256 = "01x7fc8rdkzba40piwi1ngsk7f8jawzn5bcq2la96hphsiahaarh"; })
   (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2020091801"; sha256 = "04jm83cz7vkhhr6n2c9hya2k8i2462xbf6np4bidk55as0jdq43a"; })
-  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "0.10.14"; sha256 = "0diw3l2nblapvvhnpl28fcgmqg845rlp8cszcvzhd8g6mcm54r7i"; })
-  (fetchNuGet { pname = "Avalonia.Desktop"; version = "0.10.14"; sha256 = "0r0p1g80pj06d8i7mq0kj00bpnsdlrxkh31r9166c779in34y946"; })
-  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "0.10.14"; sha256 = "133w2s2jrjj8731s7xq06c8b4zwn00lb7cn8c1iypqaa82krvkq2"; })
-  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "0.10.14"; sha256 = "06v18kmq10z5gmdqpnvn3aws2ir14gnnz0gvkbj7f68bfggzcg3s"; })
-  (fetchNuGet { pname = "Avalonia.Markup.Xaml.Loader"; version = "0.10.14"; sha256 = "1qmggiigsn2rkqr0fhrfvyx138dvazihj64r1s4azq014530r0pk"; })
-  (fetchNuGet { pname = "Avalonia.Native"; version = "0.10.14"; sha256 = "1h0h20cq6hds2mljn1457s42n6pcq821l1d6da2ijncmhk6rdwnl"; })
-  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "0.10.14"; sha256 = "1hnski71ynqqlddfnbhall4fx3ndh04774kzykzparm8nd9aqaam"; })
-  (fetchNuGet { pname = "Avalonia.Skia"; version = "0.10.13"; sha256 = "0k5y0w164m03q278m4wr7zzf3vfq9nb0am9vmmprivpn1xwwa7ml"; })
-  (fetchNuGet { pname = "Avalonia.Skia"; version = "0.10.14"; sha256 = "1cvyg94avqdscniszshx5r3vfvx0cnna262sp89ad4bianmd4qkj"; })
-  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "0.10.13"; sha256 = "1msrsxzya1l0grfxk17yizfvy2vg4i7hyw1aw54s8gf7x3gpzn86"; })
-  (fetchNuGet { pname = "Avalonia.Win32"; version = "0.10.14"; sha256 = "1c1jdxsnqrzwrcalrvc7x34x1zxc5qcpfxx4fkqca99ngw4b0blj"; })
-  (fetchNuGet { pname = "Avalonia.X11"; version = "0.10.14"; sha256 = "182nza6rqndxlwi089r06ladfc6j8vsgqzd7xq21s91zbcbcidar"; })
-  (fetchNuGet { pname = "Avalonia.Xaml.Behaviors"; version = "0.10.13"; sha256 = "0cs42z2vz679mdic7fbxzjs53xm2lp37wcnh843nz86qvma5280k"; })
-  (fetchNuGet { pname = "Avalonia.Xaml.Interactions"; version = "0.10.13"; sha256 = "0s5fcsy2hs2wphd5cs4dnk4aw8zs5bbzisg0ba5akqpzwpps8fs1"; })
-  (fetchNuGet { pname = "Avalonia.Xaml.Interactivity"; version = "0.10.13"; sha256 = "19kxbgs0nbiw9zq1f9fsawnw0sl5c880z2dfidnjp99vvfda9rzs"; })
+  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "0.10.18"; sha256 = "1qbb527jvhv2p8dcxi7lhm3lczy96j546gb5w09gh90dmzaq45bw"; })
+  (fetchNuGet { pname = "Avalonia.Desktop"; version = "0.10.18"; sha256 = "0iaby5696km0yl0bs2a8i6a5ypras54mimnmh9wjwarwniqj8yjs"; })
+  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "0.10.18"; sha256 = "1qsrzv1fz73p46p9v60qqds229znfv9hawnams5hxwl46jn2v9cp"; })
+  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "0.10.18"; sha256 = "173apfayxkm3lgj7xk9xzsbxmdhv44svr49ccqnd1dii7y69bgny"; })
+  (fetchNuGet { pname = "Avalonia.Markup.Xaml.Loader"; version = "0.10.18"; sha256 = "0vcbhwckzxgcq9wxim91zk30kzjaydr9szl4rbr3rz85447hj9pi"; })
+  (fetchNuGet { pname = "Avalonia.Native"; version = "0.10.18"; sha256 = "1hvmjs7wfcbycviky79g1p5q3bzs8j31sr53nnqxqy6pnbmg0nxg"; })
+  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "0.10.18"; sha256 = "0phxxz4r1llklvp4svy9qlsms3qw77crai3ww70g03fifmmr9qq2"; })
+  (fetchNuGet { pname = "Avalonia.Skia"; version = "0.10.16"; sha256 = "1rla042nc9mc36qnpipszrf0sffwi5d83cr9dmihpa015bby42pz"; })
+  (fetchNuGet { pname = "Avalonia.Skia"; version = "0.10.18"; sha256 = "1vi83d9q6m2zd7b5snyzjxsj3vdp5bmi5vqhfslzghslpbhj2zwv"; })
+  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "0.10.16"; sha256 = "1gsm421gzzymc6rys4sw4hds33grg2mwpnm5xpbhwfh4bnbfblg8"; })
+  (fetchNuGet { pname = "Avalonia.Win32"; version = "0.10.18"; sha256 = "1rvqydbzdi2n6jw4xx9q8i025w5zsgcli9vmv0vw1d51rd4cnc4k"; })
+  (fetchNuGet { pname = "Avalonia.X11"; version = "0.10.18"; sha256 = "0bzhbnz0dimxbpjxcrphnjn8nk37hqw0b83s2nsha4gzqvpc75b2"; })
+  (fetchNuGet { pname = "Avalonia.Xaml.Behaviors"; version = "0.10.17"; sha256 = "05g761may9xa1n75lmzib5hknjk7k0nz453bmg2d5m0xxqw6yc13"; })
+  (fetchNuGet { pname = "Avalonia.Xaml.Interactions"; version = "0.10.17"; sha256 = "0k0xnbayplndc6xld98jdla8zv769aj5s285cpbdgm2dril0rywj"; })
+  (fetchNuGet { pname = "Avalonia.Xaml.Interactivity"; version = "0.10.17"; sha256 = "0smxxr0b8585x0fq57y3jcaxpl5qyxmkr0c6pd83bsczk8p4rjfy"; })
   (fetchNuGet { pname = "Castle.Core"; version = "4.4.0"; sha256 = "0rpcbmyhckvlvp6vbzpj03c1gqz56ixc6f15vgmxmyf1g40c24pf"; })
   (fetchNuGet { pname = "Config.Net"; version = "4.15.0"; sha256 = "0hsyma0r8hssz2h7bx38rr8ajx28x5ya2h4k665cbd65z3cs1di1"; })
   (fetchNuGet { pname = "Config.Net.Json"; version = "4.15.0"; sha256 = "1q6v4pj76h0hhn26ln4kc8vg75jm8jnlp1ssnrqzwxy88yf82z4h"; })
   (fetchNuGet { pname = "CS-Script.Core"; version = "1.4.2-preview"; sha256 = "0djliiixl3ncc1b29s9knal1ascg359na0pacsm73p98ad1f7pzh"; })
-  (fetchNuGet { pname = "Fizzler"; version = "1.2.0"; sha256 = "1b8kvqli5wql53ab9fwyg78h572z4f286s8rjb9xxmsyav1hsyll"; })
+  (fetchNuGet { pname = "ExCSS"; version = "4.1.4"; sha256 = "1y50xp6rihkydbf5l73mr3qq2rm6rdfjrzdw9h1dw9my230q5lpd"; })
+  (fetchNuGet { pname = "Fizzler"; version = "1.2.1"; sha256 = "1w5jb1d0figbv68dydbnlcsfmqlc3sv9z1zxp7d79dg2dkarc4qm"; })
   (fetchNuGet { pname = "HarfBuzzSharp"; version = "2.8.2-preview.178"; sha256 = "1p5nwzl7jpypsd6df7hgcf47r977anjlyv21wacmalsj6lvdgnvn"; })
+  (fetchNuGet { pname = "HarfBuzzSharp"; version = "2.8.2.1-preview.1"; sha256 = "1g5g7mnfr668hww9r84pfl04x0s44cq5ppykqg406a0lkdb2g8yp"; })
+  (fetchNuGet { pname = "HarfBuzzSharp"; version = "2.8.2.1-preview.108"; sha256 = "0xs4px4fy5b6glc77rqswzpi5ddhxvbar1md6q9wla7hckabnq0z"; })
   (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Linux"; version = "2.8.2-preview.178"; sha256 = "1402ylkxbgcnagcarqlfvg4gppy2pqs3bmin4n5mphva1g7bqb2p"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Linux"; version = "2.8.2.1-preview.108"; sha256 = "16wvgvyra2g1b38rxxgkk85wbz89hspixs54zfcm4racgmj1mrj4"; })
   (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.macOS"; version = "2.8.2-preview.178"; sha256 = "0p8miaclnbfpacc1jaqxwfg0yfx9byagi4j4k91d9621vd19i8b2"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.macOS"; version = "2.8.2.1-preview.1"; sha256 = "0z0fadsicysa77ji4fnjkaaqfpc0d1w7x9qlkq40kb3jg7xhsmyx"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.macOS"; version = "2.8.2.1-preview.108"; sha256 = "16v7lrwwif2f5zfkx08n6y6w3m56mh4hy757biv0w9yffaf200js"; })
   (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.WebAssembly"; version = "2.8.2-preview.178"; sha256 = "1n9jay9sji04xly6n8bzz4591fgy8i65p21a8mv5ip9lsyj1c320"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.WebAssembly"; version = "2.8.2.1-preview.108"; sha256 = "15kqb353snwpavz3jja63mq8xjqsrw1f902scm8wxmsqrm5q6x55"; })
   (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Win32"; version = "2.8.2-preview.178"; sha256 = "1r5syii96wv8q558cvsqw3lr10cdw6677lyiy82p6i3if51v3mr7"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Win32"; version = "2.8.2.1-preview.1"; sha256 = "15671jvv5j98rkv249nn1fchxcd9gq8b37iwjqbmijig3r4ir718"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Win32"; version = "2.8.2.1-preview.108"; sha256 = "0n6ymn9jqms3mk5hg0ar4y9jmh96myl6q0jimn7ahb1a8viq55k1"; })
   (fetchNuGet { pname = "InputSimulatorCore"; version = "1.0.5"; sha256 = "1vfqhqjcrpzahhvv5kyh6pk6j5c06wd0b2831y31fbxpdkxhbs2p"; })
   (fetchNuGet { pname = "JetBrains.Annotations"; version = "10.3.0"; sha256 = "1grdx28ga9fp4hwwpwv354rizm8anfq4lp045q4ss41gvhggr3z8"; })
   (fetchNuGet { pname = "libsodium"; version = "1.0.18"; sha256 = "15qzl5k31yaaapqlijr336lh4lzz1qqxlimgxy8fdyig8jdmgszn"; })
@@ -112,16 +121,21 @@
   (fetchNuGet { pname = "Serilog.Sinks.Debug"; version = "2.0.0"; sha256 = "1i7j870l47gan3gpnnlzkccn5lbm7518cnkp25a3g5gp9l0dbwpw"; })
   (fetchNuGet { pname = "Serilog.Sinks.File"; version = "5.0.0"; sha256 = "097rngmgcrdfy7jy8j7dq3xaq2qky8ijwg0ws6bfv5lx0f3vvb0q"; })
   (fetchNuGet { pname = "Serilog.Sinks.Trace"; version = "3.0.0"; sha256 = "10byjmh2s0c13lmnzfw24qmr11kry9hg9y5fib3556y7759qwbqv"; })
-  (fetchNuGet { pname = "ShimSkiaSharp"; version = "0.5.13"; sha256 = "0gzsiv85g0i8jmjl0nplvljqrgc4y42ds1q0f1x1hdqbnn7vsav2"; })
-  (fetchNuGet { pname = "SkiaSharp"; version = "2.88.0-preview.178"; sha256 = "062g14s6b2bixanpwihj3asm3jwvfw15mhvzqv6901afrlgzx4nk"; })
-  (fetchNuGet { pname = "SkiaSharp.HarfBuzz"; version = "2.88.0-preview.178"; sha256 = "1gwk81iq6zipab3dhpwydrqm2mqz67hpx7asvhna3mx0phrp2zqd"; })
-  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Linux"; version = "2.88.0-preview.178"; sha256 = "07kga1j51l3l302nvf537zg5clf6rflinjy0xd6i06cmhpkf3ksw"; })
-  (fetchNuGet { pname = "SkiaSharp.NativeAssets.macOS"; version = "2.88.0-preview.178"; sha256 = "14p95nxccs6yq4rn2h9zbb60k0232k6349zdpy31jcfr6gc99cgi"; })
-  (fetchNuGet { pname = "SkiaSharp.NativeAssets.WebAssembly"; version = "2.88.0-preview.178"; sha256 = "09jmcg5k1vpsal8jfs90mwv0isf2y5wq3h4hd77rv6vffn5ic4sm"; })
-  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.0-preview.178"; sha256 = "0ficil702lv3fvwpngbqh5l85i05l5jafzyh4jprzshr2qbnd8nl"; })
-  (fetchNuGet { pname = "Svg.Custom"; version = "0.5.13"; sha256 = "1a6rwgwwqg98dhk5hdb38iffa39khcrvfwskl6i5j3xgvgzzq2lx"; })
-  (fetchNuGet { pname = "Svg.Model"; version = "0.5.13"; sha256 = "0rxm79asyx1dji8x7q1z47mzy6zh8qbgw7py6xfkfj89cai6x4p8"; })
-  (fetchNuGet { pname = "Svg.Skia"; version = "0.5.13"; sha256 = "1f00mzx7gzfhy42yldi3jzaivsl3byspak22rji86iq0vczz28zg"; })
+  (fetchNuGet { pname = "ShimSkiaSharp"; version = "0.5.16"; sha256 = "06qf63bx6m18wbhvzfs89m5yl5s08spgg02gr7qy8j36r04k6cc5"; })
+  (fetchNuGet { pname = "SkiaSharp"; version = "2.88.1-preview.1"; sha256 = "1i1px67hcr9kygmbfq4b9nqzlwm7v2gapsp4isg9i19ax5g8dlhm"; })
+  (fetchNuGet { pname = "SkiaSharp"; version = "2.88.1-preview.108"; sha256 = "01sm36hdgmcgkai9m09xn2qfz8v7xhh803n8fng8rlxwnw60rgg6"; })
+  (fetchNuGet { pname = "SkiaSharp.HarfBuzz"; version = "2.88.1-preview.1"; sha256 = "0r14s3zyn3cpic02j80xjh8x6dd8g671f9nfnng5zk1x497qdw3a"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Linux"; version = "2.88.1-preview.1"; sha256 = "1r9qr3civk0ws1z7hg322qyr8yjm10853zfgs03szr2lvdqiy7d1"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Linux"; version = "2.88.1-preview.108"; sha256 = "19jf2jcq2spwbpx3cfdi2a95jf4y8205rh56lmkh8zsxd2k7fjyp"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.macOS"; version = "2.88.1-preview.1"; sha256 = "1w55nrwpl42psn6klia5a9aw2j1n25hpw2fdhchypm9f0v2iz24h"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.macOS"; version = "2.88.1-preview.108"; sha256 = "1vcpqd7slh2b9gsacpd7mk1266r1xfnkm6230k8chl3ng19qlf15"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.WebAssembly"; version = "2.88.1-preview.1"; sha256 = "0mwj2yl4gn40lry03yqkj7sbi1drmm672dv88481sgah4c21lzrq"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.WebAssembly"; version = "2.88.1-preview.108"; sha256 = "0a89gqjw8k97arr0kyd0fm3f46k1qamksbnyns9xdlgydjg557dd"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.1-preview.1"; sha256 = "1k50abd147pif9z9lkckbbk91ga1vv6k4skjz2n7wpll6fn0fvlv"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.1-preview.108"; sha256 = "05g9blprq5msw3wshrgsk19y0fvhjlqiybs1vdyhfmww330jlypn"; })
+  (fetchNuGet { pname = "Svg.Custom"; version = "0.5.16"; sha256 = "0qp0vmknclaahf1aj8y2jl4xbaq30rf4ia55fpawxi25dfxsa4wy"; })
+  (fetchNuGet { pname = "Svg.Model"; version = "0.5.16"; sha256 = "0c2hk7wgvd2lbc96jxnkcwmzbbdnwgnhh4km9ijb5248qkghs1b1"; })
+  (fetchNuGet { pname = "Svg.Skia"; version = "0.5.16"; sha256 = "0ra6svakyg5h6m19ww5yrxl85w8yi3v5vrzqgcnqlvzndk696cyf"; })
   (fetchNuGet { pname = "System.AppContext"; version = "4.3.0"; sha256 = "1649qvy3dar900z3g817h17nl8jp4ka5vcfmsr05kh0fshn7j3ya"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
   (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
@@ -154,6 +168,7 @@
   (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; sha256 = "1w0gmba695rbr80l1k2h4mrwzbzsyfl2z4klmpbsvsg5pm4a56s7"; })
   (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
   (fetchNuGet { pname = "System.Memory"; version = "4.5.3"; sha256 = "0naqahm3wljxb5a911d37mwjqjdxv9l0b49p5dmfyijvni2ppy8a"; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.4"; sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y"; })
   (fetchNuGet { pname = "System.Net.Http"; version = "4.3.0"; sha256 = "1i4gc757xqrzflbk7kc5ksn20kwwfjhw9w7pgdkn19y3cgnl302j"; })
   (fetchNuGet { pname = "System.Net.NameResolution"; version = "4.3.0"; sha256 = "15r75pwc0rm3vvwsn8rvm2krf929mjfwliv0mpicjnii24470rkq"; })
   (fetchNuGet { pname = "System.Net.Primitives"; version = "4.3.0"; sha256 = "0c87k50rmdgmxx7df2khd9qj7q35j9rzdmm2572cc55dygmdk3ii"; })
diff --git a/pkgs/applications/audio/reaper/default.nix b/pkgs/applications/audio/reaper/default.nix
index f62af07c522..b5cf860ad9b 100644
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "7.03";
+  version = "7.05";
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
     hash = {
-      x86_64-linux = "sha256-74fQXN6a3SqNZIc2MkOf2iWwP6oQToklbb3kBuaku6s=";
-      aarch64-linux = "sha256-BF7iN8NdejqwZzHTFdys422p3qoNIm20IpFuaHdUx3U=";
+      x86_64-linux = "sha256-P/PnbJPr4ErDz5ho1/dLERhqkKjdetHzKpCpfVZAYb0=";
+      aarch64-linux = "sha256-PdnBVlHwoEEv2SPq/p5oyiOlduCEqL35gAY+QIJU1Ys=";
     }.${stdenv.hostPlatform.system};
   };
 
diff --git a/pkgs/applications/editors/quartus-prime/default.nix b/pkgs/applications/editors/quartus-prime/default.nix
index d68925e752f..278296f12d4 100644
--- a/pkgs/applications/editors/quartus-prime/default.nix
+++ b/pkgs/applications/editors/quartus-prime/default.nix
@@ -65,8 +65,7 @@ in buildFHSEnv rec {
     progs_to_wrap=(
       "${unwrapped}"/quartus/bin/*
       "${unwrapped}"/quartus/sopc_builder/bin/qsys-{generate,edit,script}
-      # Should we install all executables?
-      "${unwrapped}"/modelsim_ase/bin/{vsim,vlog,vlib,vcom,vdel,vmap}
+      "${unwrapped}"/modelsim_ase/bin/*
       "${unwrapped}"/modelsim_ase/linuxaloem/lmutil
     )
 
diff --git a/pkgs/applications/editors/tweak/default.nix b/pkgs/applications/editors/tweak/default.nix
index 887a9a8e692..f6b241c9d07 100644
--- a/pkgs/applications/editors/tweak/default.nix
+++ b/pkgs/applications/editors/tweak/default.nix
@@ -11,11 +11,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses ];
   preBuild = "substituteInPlace Makefile --replace '$(DESTDIR)/usr/local' $out";
+  makeFlags = [ "CC:=$(CC)" "LINK:=$(CC)" ];
 
   meta = with lib; {
     description = "An efficient hex editor";
     homepage = "http://www.chiark.greenend.org.uk/~sgtatham/tweak";
     license = licenses.mit;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ac3dabe5436..38324c09bb0 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -29,12 +29,12 @@ final: prev:
 
   ChatGPT-nvim = buildVimPlugin {
     pname = "ChatGPT.nvim";
-    version = "2023-10-16";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "jackMort";
       repo = "ChatGPT.nvim";
-      rev = "9f8062c7c40ec082c49f10e20818333a972b8063";
-      sha256 = "0k8y48rrzqf8r1mbyi370grgxa28612qwm67mwsk3zhnm3496060";
+      rev = "b50fdaf7836c18e0de2f1def0c1f39d56ef8bced";
+      sha256 = "1xmnzr1hccgdaadjc8i207bz44272ng5aaaypdacaag2pciapq3s";
     };
     meta.homepage = "https://github.com/jackMort/ChatGPT.nvim/";
   };
@@ -305,12 +305,12 @@ final: prev:
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "2023-11-12";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "a937222abcc2843c13f0a92576a215d391829811";
-      sha256 = "1snvkv6ba4kciz4xq2810ffsg4nnlzjp5vddj9x68q2bvssh8xlc";
+      rev = "357fe900baae09e1a3fcef913e49733d05d1f888";
+      sha256 = "1dk08b9sb825z18zcq3av3wr8c2xk5szakgiis5c25938jw0c1hl";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
   };
@@ -811,12 +811,12 @@ final: prev:
 
   aurora = buildVimPlugin {
     pname = "aurora";
-    version = "2023-11-12";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "aurora";
-      rev = "b085a8952dfa3a0fe245a8aae2799236833001f1";
-      sha256 = "04pz7cn876dqysr8ky5wfffi6zybvzqz7hx59z7fbf59x4jzlpfg";
+      rev = "41ab08a3c56b2543263873e0f1a7d1f3267180fc";
+      sha256 = "1d0d9c89i56qh6rks1sp8fzw6a09jyvqclya70vwxdyayz48mspc";
     };
     meta.homepage = "https://github.com/ray-x/aurora/";
   };
@@ -2287,12 +2287,12 @@ final: prev:
 
   conform-nvim = buildVimPlugin {
     pname = "conform.nvim";
-    version = "2023-11-12";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "conform.nvim";
-      rev = "ca3dfba94600aa62bfc88ae37cbd4f17eaea2553";
-      sha256 = "192r845pyszbl5jwxzs36pvjn4c4si4n0ywnqlia0w03vac4zz8g";
+      rev = "4524a687107c6e598017dc7356b7cd1eb046aa71";
+      sha256 = "02waplka03ghpxhwsgjf0z4iv6dqkcrg2whlha334982q57gml1w";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/conform.nvim/";
@@ -3046,12 +3046,12 @@ final: prev:
 
   dropbar-nvim = buildVimPlugin {
     pname = "dropbar.nvim";
-    version = "2023-11-11";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "Bekaboo";
       repo = "dropbar.nvim";
-      rev = "c41904a3dcc103587b1157da13d565a0a5f9f3a5";
-      sha256 = "0q0b5llz4jmpqlv4yx929wbhsnqjd62ng5kjmiwl3nylz1gndgmk";
+      rev = "c8a209ee319bb93e41e4daebc02eb1614409c350";
+      sha256 = "16kcqjzi68mmfic13jagv2glnlg9jg63n8ywixn60c9h8cd83gk5";
     };
     meta.homepage = "https://github.com/Bekaboo/dropbar.nvim/";
   };
@@ -3131,24 +3131,24 @@ final: prev:
 
   efmls-configs-nvim = buildVimPlugin {
     pname = "efmls-configs-nvim";
-    version = "2023-10-23";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "creativenull";
       repo = "efmls-configs-nvim";
-      rev = "7db13d3f609640e9f12d7d6f1251e6a8f964f579";
-      sha256 = "0ih5c2llvw5sx7qxck12v5blh9kgc7kv643cjkqzhlf9cplpvihp";
+      rev = "9bc2196b24a38ebaa16fab25d63caa38565410f3";
+      sha256 = "0pnmk7zgbqhxcnwby7x3s1ryb0wx53m2i9ifv5lc1yf7ns71kcz9";
     };
     meta.homepage = "https://github.com/creativenull/efmls-configs-nvim/";
   };
 
   elixir-tools-nvim = buildVimPlugin {
     pname = "elixir-tools.nvim";
-    version = "2023-11-10";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "elixir-tools";
       repo = "elixir-tools.nvim";
-      rev = "517ffd8366e4065ba66e0fb0c8e8ce192906db5d";
-      sha256 = "1b38zb5nisyk5msz045vw5ibl35jd31zskj26qm93z8h29b3f0xa";
+      rev = "8f573b0b089567aa9c544b029000c97e715e5f58";
+      sha256 = "0rhnvlji6qvwj8mafgw2jwyx8ixmw4ir73gbywlvhpay3nzal8rb";
     };
     meta.homepage = "https://github.com/elixir-tools/elixir-tools.nvim/";
   };
@@ -3505,12 +3505,12 @@ final: prev:
 
   formatter-nvim = buildVimPlugin {
     pname = "formatter.nvim";
-    version = "2023-09-21";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "mhartington";
       repo = "formatter.nvim";
-      rev = "34dcdfa0c75df667743b2a50dd99c84a557376f0";
-      sha256 = "09dks17yi1cbk4gviv7kw7r04rcn8ridq75slm3vxf3jkid095ns";
+      rev = "91651e6afaf6f73b0ffb8b433c06cd4e06f90403";
+      sha256 = "1dsxlhsfhdd37l8z9pg2f5s0r4rafk6jl92wz1zcbhf6iswa6vy7";
     };
     meta.homepage = "https://github.com/mhartington/formatter.nvim/";
   };
@@ -3637,12 +3637,12 @@ final: prev:
 
   fzf-lua = buildVimPlugin {
     pname = "fzf-lua";
-    version = "2023-11-08";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "ibhagwan";
       repo = "fzf-lua";
-      rev = "e1046726cf0cedf15ae0ff40537a421b79968c3e";
-      sha256 = "0yh5yrlv0a73yjgwb23vl91lb38h121w4zxf9wavrk262qqkm903";
+      rev = "03d8c35bf7b0541a877348cefc486dcd02142ec7";
+      sha256 = "024cf9f73f90qfhcr3iqpcwwbxgm1k6a3hn7nl6ndci7mfbc4xc1";
     };
     meta.homepage = "https://github.com/ibhagwan/fzf-lua/";
   };
@@ -3865,12 +3865,12 @@ final: prev:
 
   go-nvim = buildVimPlugin {
     pname = "go.nvim";
-    version = "2023-11-09";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "ray-x";
       repo = "go.nvim";
-      rev = "38f6402fa5362f2c31a31439294d9e24eda46b13";
-      sha256 = "143wi05bh6fdcfcm7lrx4x2qh4srdw022c107476p3gcasswkihr";
+      rev = "e749ff85ffec5a4ef11cb8252a2030be5726cb6c";
+      sha256 = "0811lkf5cr9qsp4as3lqq04w545ygmxj1sad66gabvk8lcq7indj";
     };
     meta.homepage = "https://github.com/ray-x/go.nvim/";
   };
@@ -4080,12 +4080,12 @@ final: prev:
 
   haskell-tools-nvim = buildNeovimPlugin {
     pname = "haskell-tools.nvim";
-    version = "2023-11-12";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "haskell-tools.nvim";
-      rev = "3076ac21d6ffc6d0100eb5878a1b77c6a53d8871";
-      sha256 = "0fc0npgmv6zxc3v5rzxh9lqa0868pyj4kcsyg8vw9qwl1waz6pa9";
+      rev = "dc778953e98bf2667424d93dad82eefe319e0f7d";
+      sha256 = "18qc0xcdzg914bis9djz1gd7csalqzvlqbv2nd7v02pm0gnw7fbj";
     };
     meta.homepage = "https://github.com/MrcJkb/haskell-tools.nvim/";
   };
@@ -4128,12 +4128,12 @@ final: prev:
 
   headlines-nvim = buildVimPlugin {
     pname = "headlines.nvim";
-    version = "2023-07-27";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "lukas-reineke";
       repo = "headlines.nvim";
-      rev = "74a083a3c32a08be24f7dfcc6f448ecf47857f46";
-      sha256 = "1ak7j159c0lv6pxiq4nld6svzx3465r6f1xwpawwrxlzhi5a14yz";
+      rev = "e3d7bfdf40e41a020d966d35f8b48d75b90367d2";
+      sha256 = "1acxyy5317qf4ry0z32xkk3aasp233nss0nyd8dzfkf631klvzi2";
     };
     meta.homepage = "https://github.com/lukas-reineke/headlines.nvim/";
   };
@@ -4271,12 +4271,12 @@ final: prev:
 
   hover-nvim = buildVimPlugin {
     pname = "hover.nvim";
-    version = "2023-11-10";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "hover.nvim";
-      rev = "bb3dc1a9fa34c3577bca627b848625e94a93efe8";
-      sha256 = "0ikqzwsfapyq84d2lfdz2cjl83ppxdlg32220fgsxjxad1d2qran";
+      rev = "db0acd3a3445b26948e754dbb35a4ede10c31d30";
+      sha256 = "16rph1lwqz4i78qz30l59kwzkndcsfpcc5dzcpw5rzlhq1zqcssy";
     };
     meta.homepage = "https://github.com/lewis6991/hover.nvim/";
   };
@@ -4355,12 +4355,12 @@ final: prev:
 
   image-nvim = buildVimPlugin {
     pname = "image.nvim";
-    version = "2023-11-10";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "3rd";
       repo = "image.nvim";
-      rev = "f458f33e6ba0f3bfee233b90fb9318d42941d972";
-      sha256 = "14kspw9s6wsgh0afyskkyqdbr68l7fiq75r1d22a3ffvc8m5a81w";
+      rev = "4c1c903268b42a5b83caf229ddda7014a6a2e0bd";
+      sha256 = "0q6315nx7dailivvncvg1hiwjk910djcwjm5arqd0nq7099d998p";
     };
     meta.homepage = "https://github.com/3rd/image.nvim/";
   };
@@ -4812,12 +4812,12 @@ final: prev:
 
   lean-nvim = buildVimPlugin {
     pname = "lean.nvim";
-    version = "2023-11-12";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "Julian";
       repo = "lean.nvim";
-      rev = "a4868d184b0cf5114d5b0ee6aa13b1c5c4fb47fa";
-      sha256 = "0q4nhp3bgbxfzg8x9grhpqfdvs7z6z4sxiz9vdm7q1ch9vq2g12q";
+      rev = "2c896afc38b1e1d39118318d581850e2d3ad8e7f";
+      sha256 = "1n9f4hhi55imk53hzzxsypxvsymg3avj9xnsxgr1bl12xyjbm9gk";
     };
     meta.homepage = "https://github.com/Julian/lean.nvim/";
   };
@@ -5196,12 +5196,12 @@ final: prev:
 
   lsp-zero-nvim = buildVimPlugin {
     pname = "lsp-zero.nvim";
-    version = "2023-11-01";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "VonHeikemen";
       repo = "lsp-zero.nvim";
-      rev = "bb874e8d832b66fa734b7b048d52eb9ed736bdcf";
-      sha256 = "0m3k26sn52l34gc39gj913470n35bcw6vbp4wciqdhg8l4slliav";
+      rev = "8a9ee4e11a3e23101d1d1d11aaac3159ad925cc9";
+      sha256 = "0snk9as2m5dz3m0iki4mrs8j5kd3zr0bfpwxi0i70y4hzxaqlwm1";
     };
     meta.homepage = "https://github.com/VonHeikemen/lsp-zero.nvim/";
   };
@@ -5267,12 +5267,12 @@ final: prev:
 
   lspsaga-nvim = buildVimPlugin {
     pname = "lspsaga.nvim";
-    version = "2023-11-12";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "nvimdev";
       repo = "lspsaga.nvim";
-      rev = "283a3fc8e01191095d33c078031c577e8f9427b9";
-      sha256 = "0r70gssbdkplmfacbcafr1d9hh0k61ybpcw65lplx7ya8q62yb0k";
+      rev = "4d85d4ad3ef6ba9ad0fffe478f834c29b5bfa57c";
+      sha256 = "07jpv90i1xrns6hy77pbyilrxh7ad8i1h0x2x0w6mmv395gysxvy";
     };
     meta.homepage = "https://github.com/nvimdev/lspsaga.nvim/";
   };
@@ -5315,12 +5315,12 @@ final: prev:
 
   luasnip = buildVimPlugin {
     pname = "luasnip";
-    version = "2023-11-10";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "l3mon4d3";
       repo = "luasnip";
-      rev = "46c91e814732c1630b8a8b50d04acbf54b8320fa";
-      sha256 = "1bx2sjqr2rvyl2zyc4rymg1sl67gw542vfpl857dx7yhabr9xj4d";
+      rev = "1f4ad8bb72bdeb60975e98652636b991a9b7475d";
+      sha256 = "174pwxjdnb1gxxrnvz6zplr5r2cwjq79si1ns1ymziq4lrxjnni8";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/l3mon4d3/luasnip/";
@@ -5424,12 +5424,12 @@ final: prev:
 
   mason-lspconfig-nvim = buildVimPlugin {
     pname = "mason-lspconfig.nvim";
-    version = "2023-11-09";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "williamboman";
       repo = "mason-lspconfig.nvim";
-      rev = "6eb8cae80f2e4322ec82cd9f8fa423f6d1eb02c3";
-      sha256 = "143yq3hydkp54m2mw04rirqs7zgl7wp09jdlq5q9nb4v7ll7nmgg";
+      rev = "faeb361507aa1ef1b0e5645781e2aa0d36a4aa84";
+      sha256 = "1kq88b7q8kskigpizk432h4r5gf8k87f3zrnxz2pyvrwwg7vpkmp";
     };
     meta.homepage = "https://github.com/williamboman/mason-lspconfig.nvim/";
   };
@@ -5544,12 +5544,12 @@ final: prev:
 
   mini-nvim = buildVimPlugin {
     pname = "mini.nvim";
-    version = "2023-11-11";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "echasnovski";
       repo = "mini.nvim";
-      rev = "f2b89efbbad1943657e43f474fe308fceb63597e";
-      sha256 = "1yyqb3plmzmfpidcij66j3mcg37ysf3bs1s5wyyi7hxqw6hqqhk4";
+      rev = "abd7aa3ec50350ec3c986fcdd7328e3d23948b89";
+      sha256 = "188dqyddsj2rzz212n8kswxqn8mxa0n38j681r912z4yf4vbmjqi";
     };
     meta.homepage = "https://github.com/echasnovski/mini.nvim/";
   };
@@ -5604,12 +5604,12 @@ final: prev:
 
   modicator-nvim = buildVimPlugin {
     pname = "modicator.nvim";
-    version = "2023-11-11";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "mawkler";
       repo = "modicator.nvim";
-      rev = "3918f17ab136a469a81881a194068609f0a878d4";
-      sha256 = "1xkfg8hmglyx8y8b2hlv40n904naiar1abb29r2lvdwri8aksql5";
+      rev = "d22c02c007170ab432ca3e166a1da56297767e87";
+      sha256 = "0pvx8bsl4623mx4fgym993dnws62vfnaz90mrcfp7kska3p1d4p2";
     };
     meta.homepage = "https://github.com/mawkler/modicator.nvim/";
   };
@@ -5628,12 +5628,12 @@ final: prev:
 
   molten-nvim = buildVimPlugin {
     pname = "molten-nvim";
-    version = "2023-11-10";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "benlubas";
       repo = "molten-nvim";
-      rev = "29763c6d49eaa8d0c9c9093a88fb38db34ba4875";
-      sha256 = "1hxr0grv8fcaik3kbcd323jz5zgqc0k353n7lrrs0ka2qicz94k5";
+      rev = "91ec70b710bc8e1de59352b1ecfb4cdb6e786c92";
+      sha256 = "0h3xg8n5asya98lyly8m2zgkkg1llxji3fx6fd4i6yym42c3awv0";
     };
     meta.homepage = "https://github.com/benlubas/molten-nvim/";
   };
@@ -5940,12 +5940,12 @@ final: prev:
 
   neo-tree-nvim = buildVimPlugin {
     pname = "neo-tree.nvim";
-    version = "2023-11-11";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "nvim-neo-tree";
       repo = "neo-tree.nvim";
-      rev = "0f6e7acfd86b052acf78baccba04d5c61dcbbc0d";
-      sha256 = "0glq1ywx1q8sqs3fkq071cqmwa6sn18glx1l0gmyvaxr0q9bijmh";
+      rev = "f86e871584bd3c5a00b4ff8344305889eb52ebff";
+      sha256 = "16v172gmr3clr8mnw1v767ln6qidalp7qv6xsh10ylnkzygz9lin";
     };
     meta.homepage = "https://github.com/nvim-neo-tree/neo-tree.nvim/";
   };
@@ -5988,12 +5988,12 @@ final: prev:
 
   neodev-nvim = buildVimPlugin {
     pname = "neodev.nvim";
-    version = "2023-11-12";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neodev.nvim";
-      rev = "f93a984ee75ba6d532d85419619cc6e91d954ee9";
-      sha256 = "0aisb4kwjys02za4rp2ai9qk64f3rx8xwwz1y20ki9q6729623d5";
+      rev = "b2881eeb395d2b268de5fe9b5e201a8f1816beb8";
+      sha256 = "02wnkbcvcpsz6dy855c1c8l0cz7178qaqddvmmgqfpzi1dfxn4q9";
     };
     meta.homepage = "https://github.com/folke/neodev.nvim/";
   };
@@ -6024,12 +6024,12 @@ final: prev:
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "2023-11-08";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "d3c5687a78cffc25026ff31d2fcbd61a2a3e067f";
-      sha256 = "02yrcxmgx7va1h2nnabazwm7bwzffl5cmm4cbjssdhpsg6ahb2yk";
+      rev = "296570589180d9428539f5ac099d7c8b9f4ad489";
+      sha256 = "10b9jl17kb6lnlhgm7lblf08qh3q8ymhzzv7w1p4hz786hrcgi53";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
   };
@@ -6096,12 +6096,12 @@ final: prev:
 
   neorg = buildVimPlugin {
     pname = "neorg";
-    version = "2023-11-08";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "nvim-neorg";
       repo = "neorg";
-      rev = "55090798a2eed2dd00fc1b2774bc6bf309a3bd0b";
-      sha256 = "1p5372c7n9ihyk8dnkwj4fb1as7q2md5xhqy5j17q7nviskvzq0s";
+      rev = "d5f3ad064918cf19dbbdfa77817d162d4de6a461";
+      sha256 = "1qaghcfmnyv8hcmnbdrz12x6m92lxl9n3mxbf6vqmqi9ivdr63h1";
     };
     meta.homepage = "https://github.com/nvim-neorg/neorg/";
   };
@@ -6168,12 +6168,12 @@ final: prev:
 
   neotest = buildVimPlugin {
     pname = "neotest";
-    version = "2023-11-12";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest";
-      rev = "009328955066ae6c170d24bb0de5f168d8760ff8";
-      sha256 = "1i6lkbq5iadn9as9fy9lw1m1aw3vj00j6hxrrflgpnf3wqkvxb6a";
+      rev = "d424d262d01bccc1e0b038c9a7220a755afd2a1f";
+      sha256 = "1sg8m77hik1gffrqy4038sivhr8yhg536dp6yr5gbnbrjvc35dgm";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest/";
   };
@@ -6216,12 +6216,12 @@ final: prev:
 
   neotest-elixir = buildVimPlugin {
     pname = "neotest-elixir";
-    version = "2023-08-23";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "jfpedroza";
       repo = "neotest-elixir";
-      rev = "7904f8c0fedbe615ee3d75beb810d3e1426b05c6";
-      sha256 = "13lsns5wdkp9ay4a11pp6hvhd8isqd5vzag89alwlazsdnmirmvd";
+      rev = "0e85312566c6ef0aa7456503e4038cc5541e7df4";
+      sha256 = "0jcbmh0w8zvhdkk111cvsb56j67bc2l0vf7dcyswn50p96djq5g0";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/jfpedroza/neotest-elixir/";
@@ -6241,24 +6241,24 @@ final: prev:
 
   neotest-haskell = buildVimPlugin {
     pname = "neotest-haskell";
-    version = "2023-11-12";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "neotest-haskell";
-      rev = "6f4b11212ef7a83889a3b488f562242198ddae4a";
-      sha256 = "00h283dx9k9bdd89379q200h5kg7x02fk7cb6fac6ybnnbvp53pm";
+      rev = "d0d9fa025056d4a8124e7bf34a3b0b7942870c84";
+      sha256 = "1f4w2lyjj19piw0pn9456ilnw4g7086641z73f6msvy6fnxggp6l";
     };
     meta.homepage = "https://github.com/MrcJkb/neotest-haskell/";
   };
 
   neotest-jest = buildVimPlugin {
     pname = "neotest-jest";
-    version = "2023-10-11";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "nvim-neotest";
       repo = "neotest-jest";
-      rev = "65ab61c77aa1c245f16982ffe1a4d31589e18023";
-      sha256 = "168597vm0645c3n6lijw18308kn6lhjp5k9jcnlc0jg640znczsf";
+      rev = "d8b00a91e440474da20a8e9acdb0d72051078b8b";
+      sha256 = "1z400jfjy3nqxn8024kbampnbnawzxacqz7k3mv2l72brgyp62bn";
     };
     meta.homepage = "https://github.com/nvim-neotest/neotest-jest/";
   };
@@ -6325,12 +6325,12 @@ final: prev:
 
   neotest-rust = buildVimPlugin {
     pname = "neotest-rust";
-    version = "2023-10-09";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "rouge8";
       repo = "neotest-rust";
-      rev = "03e036a310379f132d4e39387e9076396132ce3f";
-      sha256 = "1s3816q710qymv62zz6vld178lmfqgfh8wq5s0hcc26rpk8ap85h";
+      rev = "f4e58d5278344440f65c5a5177f16711337e44f7";
+      sha256 = "1ysg0vh7kw1sqpzdhgy13j9aljwk47jh5ss2y3k54j8a1qrx5c3j";
     };
     meta.homepage = "https://github.com/rouge8/neotest-rust/";
   };
@@ -6433,12 +6433,12 @@ final: prev:
 
   nerdtree = buildVimPlugin {
     pname = "nerdtree";
-    version = "2023-10-25";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "preservim";
       repo = "nerdtree";
-      rev = "4c588f182090e01edadeecb127a353cb08d1e39f";
-      sha256 = "1pibwk0vrb10h2r9x2s4ja54ballc548wb6cqdbdpcjfz4z5j14z";
+      rev = "0cb04e9245b000daf32f04aae5f606011a6aa3b5";
+      sha256 = "1rws27wc2l3qahvbfd5b2i1js9kwldxxsfsn0abah96q2m1i3q85";
     };
     meta.homepage = "https://github.com/preservim/nerdtree/";
   };
@@ -6601,12 +6601,12 @@ final: prev:
 
   none-ls-nvim = buildVimPlugin {
     pname = "none-ls.nvim";
-    version = "2023-10-28";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "nvimtools";
       repo = "none-ls.nvim";
-      rev = "b8fd44ee1616e6a9c995ed5f94ad9f1721d303ef";
-      sha256 = "0wa15f4p6ggngc8jkjfi4s5l0g6fm9va49825khnw94my45b5h5g";
+      rev = "e5abf91b410e28e823b26fe9141287fb416d2dee";
+      sha256 = "1bx8aan45sipqpg0yh4idagqhgn085dnnzgb051jzdwd6ja0hisv";
     };
     meta.homepage = "https://github.com/nvimtools/none-ls.nvim/";
   };
@@ -6697,12 +6697,12 @@ final: prev:
 
   nvchad = buildVimPlugin {
     pname = "nvchad";
-    version = "2023-11-08";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "nvchad";
-      rev = "ff99797242f37dbc118baad3d31aa125e08da90f";
-      sha256 = "1dnsrk07q3va0p52xq6qsqh0iqxfgxx45xnw0cxhya732i4jlbdk";
+      rev = "9d37797e6f9856ef25cfa266cff43f764e828827";
+      sha256 = "0a57bswr6w0nmxj1fmvn24w60ibgh1gyqx586qhz1fq5i4jfjva8";
     };
     meta.homepage = "https://github.com/nvchad/nvchad/";
   };
@@ -6961,12 +6961,12 @@ final: prev:
 
   nvim-dap-python = buildVimPlugin {
     pname = "nvim-dap-python";
-    version = "2023-05-23";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-dap-python";
-      rev = "37b4cba02e337a95cb62ad1609b3d1dccb2e5d42";
-      sha256 = "186advam53j32xgiwg05wbgq3ab8zzkq3lnam6gad9101qp4wgf1";
+      rev = "e0be843877e7ae756ef1ee7a441ca0b9e1677da9";
+      sha256 = "0xib2xayrnf96r07rd7xdahpza41155npkdjxmr48h52gjj15nbl";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-dap-python/";
   };
@@ -7176,24 +7176,24 @@ final: prev:
 
   nvim-lilypond-suite = buildVimPlugin {
     pname = "nvim-lilypond-suite";
-    version = "2023-11-09";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "martineausimon";
       repo = "nvim-lilypond-suite";
-      rev = "002fa927c9567ba70ab69225fd49f1e70c1290f8";
-      sha256 = "1358imc5s0h0z4lyh2zyyiahcy5dl0jlkpc6iscfij6irlqv4jzr";
+      rev = "b1db01865791b324918a7835984c0f96112df37c";
+      sha256 = "1smxkw2pkmcbhypmcmssbnq0cpi2jsq7ihsm9nzp7mpvxz21gd34";
     };
     meta.homepage = "https://github.com/martineausimon/nvim-lilypond-suite/";
   };
 
   nvim-lint = buildVimPlugin {
     pname = "nvim-lint";
-    version = "2023-11-10";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "mfussenegger";
       repo = "nvim-lint";
-      rev = "775ae0e5a451dd6c5d15de7a828ea72d2c54e8cf";
-      sha256 = "1ldbq4qfajysfrplawba8jv6v6lcvnvfz18pas198npn2gp9kgna";
+      rev = "4f2d968a827d86bb40b7b1fad28c11f7b764fef3";
+      sha256 = "0i60lyzhhnpzxi7k5dy4xacsg8mmc7ac8f8xwlbv32h8jqrblsab";
     };
     meta.homepage = "https://github.com/mfussenegger/nvim-lint/";
   };
@@ -7224,12 +7224,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPlugin {
     pname = "nvim-lspconfig";
-    version = "2023-11-12";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "90a28fd7637b66e055af62387ecee06f7cbd3173";
-      sha256 = "0vzvbw8fh2j1l1sjkk5dfj5l5yghp5fk9pparvar1cyadpa6mcsh";
+      rev = "d5d7412ff267b92a11a94e6559d5507c43670a52";
+      sha256 = "1jqpsj2in41fv148zdvddpcwjzmll5kchzx9mnbas685xmzc4h0k";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -7284,12 +7284,12 @@ final: prev:
 
   nvim-metals = buildVimPlugin {
     pname = "nvim-metals";
-    version = "2023-10-25";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "scalameta";
       repo = "nvim-metals";
-      rev = "6692a6512a53b494984eac247ced40e8165dc2ca";
-      sha256 = "0060s3w35r03h7g3dykx1dj31ns9dsmnlxm2rz100y7mvbxi7qcc";
+      rev = "96d0c8ded6c2b9e66340c1e00d5a62acec112711";
+      sha256 = "1ml08is8vn49d7bbzlhfdxfa6q8c9hjnfxrsaxqbgkhgnw7nakq5";
     };
     meta.homepage = "https://github.com/scalameta/nvim-metals/";
   };
@@ -7452,12 +7452,12 @@ final: prev:
 
   nvim-scrollview = buildVimPlugin {
     pname = "nvim-scrollview";
-    version = "2023-11-12";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "dstein64";
       repo = "nvim-scrollview";
-      rev = "c9b5422a845bff25ddeb8057b42afbf0f7b25e32";
-      sha256 = "08x62lpjir0zhmscln14id0lz59wqmvdixacz7z9ghi00r7lrwxf";
+      rev = "642068c7d6d98e019a3e1db7c7b4876373347730";
+      sha256 = "1zi3kvyxb3zyni5dj9kmi296r303bskpcdmsi3a4r9a3pryl4lhr";
     };
     meta.homepage = "https://github.com/dstein64/nvim-scrollview/";
   };
@@ -7476,12 +7476,12 @@ final: prev:
 
   nvim-snippy = buildVimPlugin {
     pname = "nvim-snippy";
-    version = "2023-11-11";
+    version = "2023-11-12";
     src = fetchFromGitHub {
       owner = "dcampos";
       repo = "nvim-snippy";
-      rev = "9192f310afe34ab925d61add187a5ff278879333";
-      sha256 = "1wcw0xjh44ik1j9gaalrwl86d7mp4v5hcdas3qy3bg8w8aqvgwaw";
+      rev = "7c8f18e90cad4f56c4e22a49101668735639f286";
+      sha256 = "1mfjnzfg4z5hzribzadlmgjjihh5dx55swjrjljmgsbj7jn4nqws";
     };
     meta.homepage = "https://github.com/dcampos/nvim-snippy/";
   };
@@ -7500,12 +7500,12 @@ final: prev:
 
   nvim-spectre = buildVimPlugin {
     pname = "nvim-spectre";
-    version = "2023-11-12";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "nvim-pack";
       repo = "nvim-spectre";
-      rev = "07201e6bd3b43a193d891cec844dfd1f23e775d1";
-      sha256 = "0rpp9ddyq7yd462mlf99khrpway04vi892538ss8zqmz2lazchrn";
+      rev = "a18a58015b46f02b4fe537ebfffd82e46110ff24";
+      sha256 = "0ry2scnw8hzd3snjhbp71zc6mnna2bwn6icr3frsgdj1p5rfissn";
     };
     meta.homepage = "https://github.com/nvim-pack/nvim-spectre/";
   };
@@ -7524,12 +7524,12 @@ final: prev:
 
   nvim-surround = buildVimPlugin {
     pname = "nvim-surround";
-    version = "2023-11-11";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "kylechui";
       repo = "nvim-surround";
-      rev = "cfa2da7f469f1e759f2a961bc25fa4ccfe1795c2";
-      sha256 = "0r1nm8l736vvrxhqnszk65siphkn59473y88qahxzhfj4b98qgd3";
+      rev = "0855a89e00a5822c3a482a82e5223fcf2e9ede13";
+      sha256 = "09riinjjh96nrs357ay886j8gs6cgkhj3zwngm44pf8p04w2w81n";
     };
     meta.homepage = "https://github.com/kylechui/nvim-surround/";
   };
@@ -7576,20 +7576,20 @@ final: prev:
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-tree.lua";
-      rev = "874ae6e9445a5eb5ba430e5fd10212450a261ad7";
-      sha256 = "0dn56zpbjxggcsbm7z6f1b4kcwsspj09ynzjkl8bq0l45qf3v50i";
+      rev = "80cfeadf179d5cba76f0f502c71dbcff1b515cd8";
+      sha256 = "0fmmfhzl8igk3kpk34cs0wvw4lyhjvc83cdk225gs06awqr24i3m";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-tree.lua/";
   };
 
   nvim-treesitter = buildVimPlugin {
     pname = "nvim-treesitter";
-    version = "2023-11-11";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "075a64addc33390028ea124a1046a43497f05cd1";
-      sha256 = "1rkwc97h9pnxrzqq1bp72cr6182rvh0bi3c9dfq91q51g70a651h";
+      rev = "8b9f99660294dcd11d42572c84ee33a1e284f70d";
+      sha256 = "09mkkkirp922018dvci32p9mfsa2fqkv9b6nd1srwicxydx1wzp7";
     };
     meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
   };
@@ -7715,12 +7715,12 @@ final: prev:
 
   nvim-ufo = buildVimPlugin {
     pname = "nvim-ufo";
-    version = "2023-11-12";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "kevinhwang91";
       repo = "nvim-ufo";
-      rev = "068053c5921b04d4ecb5fafc2e71b4f04cc35e80";
-      sha256 = "08kgrmcxv3rcf8lmvh4fif5njicvsirgsb8v48zhcg1ppn36c412";
+      rev = "a6132d058f23d15686f07b8e1ca252e060a0e0ce";
+      sha256 = "0ijlsw9x3g2h48wvcagp1h4pvyjrrlc1cn0jni5pqs6fqjlcbypk";
     };
     meta.homepage = "https://github.com/kevinhwang91/nvim-ufo/";
   };
@@ -7739,12 +7739,12 @@ final: prev:
 
   nvim-web-devicons = buildVimPlugin {
     pname = "nvim-web-devicons";
-    version = "2023-11-11";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "nvim-tree";
       repo = "nvim-web-devicons";
-      rev = "3fafeea5f339223e888fd15eb4032260849cb038";
-      sha256 = "14vwqj74icbh1zk23k833jfprh4bdb7yq850c4rn7cs6bl06nwrp";
+      rev = "11eb26fc166742db8d1e8a6f5a7de9df37b09aae";
+      sha256 = "0xshsc1wxgsvdb09klsddz0ipf43vimsya4rc4zi22xxjgj40dyh";
     };
     meta.homepage = "https://github.com/nvim-tree/nvim-web-devicons/";
   };
@@ -7847,24 +7847,24 @@ final: prev:
 
   octo-nvim = buildVimPlugin {
     pname = "octo.nvim";
-    version = "2023-11-09";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "pwntester";
       repo = "octo.nvim";
-      rev = "154721cebecde111242377901760b6d175e49d84";
-      sha256 = "06503m702f9ff59vpqz7al7my90k9rca1ll7mvwzdfrsfllkpggf";
+      rev = "5d6bed660ff18878a9096b3acef9c444b85021ac";
+      sha256 = "1y1d1fa5m5wch2daskshmwm934qgbaca9s1340y36bhysbdd7ifj";
     };
     meta.homepage = "https://github.com/pwntester/octo.nvim/";
   };
 
   oil-nvim = buildVimPlugin {
     pname = "oil.nvim";
-    version = "2023-11-10";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "stevearc";
       repo = "oil.nvim";
-      rev = "3727410e4875ad8ba339c585859a9391d643b9ed";
-      sha256 = "0h9d24y213bwr0nh3kalmfvsjiqkj3jjq9c81x3vkdy6g12kfdxm";
+      rev = "af04969c437e0c46a2b3c86d7892458e878ecc40";
+      sha256 = "17mi1hs3jmmrxqxhykqf0xj91ssxzzzig7gmdlyak6pgwln2ziyr";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/stevearc/oil.nvim/";
@@ -7924,8 +7924,8 @@ final: prev:
     src = fetchFromGitHub {
       owner = "olimorris";
       repo = "onedarkpro.nvim";
-      rev = "f3a7349156453500f1c053a1f8034a3975b1d793";
-      sha256 = "0xr665dmv8h87c681f114d3vmb9rh0g7map5m70gixdnd60v009p";
+      rev = "89888840309a813ef6911e0150a0c6aa66c2ab5c";
+      sha256 = "0648dilrk31yn2c8s581c62j9jk30cnxf6h4f2pcddygs308pqn8";
     };
     meta.homepage = "https://github.com/olimorris/onedarkpro.nvim/";
   };
@@ -8511,11 +8511,11 @@ final: prev:
 
   rainbow-delimiters-nvim = buildVimPlugin {
     pname = "rainbow-delimiters.nvim";
-    version = "2023-11-11";
+    version = "2023-11-15";
     src = fetchgit {
       url = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
-      rev = "a5e8fb4960f905a52031b28113cf43088cfeae22";
-      sha256 = "0d3yfy7a7jc0g4y3x6fff2skbkhp3hjjk0p4q2a66s6rm626pg6z";
+      rev = "ffb31befabb165812360ba70072e04c2101317d7";
+      sha256 = "1a4gwggn131zyiigv7zvpbriqs2f2z7kslds9xpc6rgskd873kkd";
     };
     meta.homepage = "https://gitlab.com/HiPhish/rainbow-delimiters.nvim";
   };
@@ -8762,12 +8762,12 @@ final: prev:
 
   rustaceanvim = buildNeovimPlugin {
     pname = "rustaceanvim";
-    version = "2023-11-12";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "mrcjkb";
       repo = "rustaceanvim";
-      rev = "36cbeceb6602ce97f04d5526fd238957b77dd263";
-      sha256 = "108zzz088ll08h55ij0bb81ak53cyxbzfigkfvj31c8v2i3j9jr9";
+      rev = "3f0217642bbcb4179772c2bfd124fb808371be2e";
+      sha256 = "0lqvggbrfmf96cz6q2jjdic67m9j7ap65va7j0z4jm2rfndany70";
     };
     meta.homepage = "https://github.com/mrcjkb/rustaceanvim/";
   };
@@ -8930,12 +8930,12 @@ final: prev:
 
   sg-nvim = buildVimPlugin {
     pname = "sg.nvim";
-    version = "2023-10-18";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "sourcegraph";
       repo = "sg.nvim";
-      rev = "6c592e9e78e68cd2bf4385da1b2a633219a22aab";
-      sha256 = "1a32yhdq9pbl9xz9brgn54171b059yrsp635r6crzp380nfpw1hf";
+      rev = "41378567217097a3d78b624c9f11d29436381e99";
+      sha256 = "0dwh7zb8l83d8l63ps6qc5am7r95bnyavz5r8qpxnzgzdic2r5nv";
     };
     meta.homepage = "https://github.com/sourcegraph/sg.nvim/";
   };
@@ -9051,12 +9051,12 @@ final: prev:
 
   snap = buildVimPlugin {
     pname = "snap";
-    version = "2023-11-12";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "camspiers";
       repo = "snap";
-      rev = "8a2c15665fab760ecfd854329d2170a6ab40aa83";
-      sha256 = "0b9zd8v8l2d89wsc8qfgk51pqs8wrfr6fj9vcdq2v7f648ly19lw";
+      rev = "e00e423a5cc4637fdcea79435086736f6ae85182";
+      sha256 = "06hviy2f6jawhdcjfhd5hkkjwsj0bnaz5cvmf76chccqr24851cw";
     };
     meta.homepage = "https://github.com/camspiers/snap/";
   };
@@ -9219,12 +9219,12 @@ final: prev:
 
   splitjoin-vim = buildVimPlugin {
     pname = "splitjoin.vim";
-    version = "2023-11-05";
+    version = "2023-11-12";
     src = fetchFromGitHub {
       owner = "AndrewRadev";
       repo = "splitjoin.vim";
-      rev = "89e6e2ed2e3d8fc55479ad642d260a95bb731d1a";
-      sha256 = "1499ajkpq7vbapwn4s96wcmc5mnxrlidb7p34nhns41cn8kfss3n";
+      rev = "8b00772a03c416d23954baeff8a32154bb626293";
+      sha256 = "0anb7bh08n4aj6x04v3ys35sl6b4f1lc7026b3pc3i6yjivnq9k8";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/AndrewRadev/splitjoin.vim/";
@@ -9244,12 +9244,12 @@ final: prev:
 
   srcery-vim = buildVimPlugin {
     pname = "srcery-vim";
-    version = "2023-09-25";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "srcery-colors";
       repo = "srcery-vim";
-      rev = "8ea4c4f5caf61ac4ab887fc53eabc916985db881";
-      sha256 = "0z6i35gcf4qcy9cgsrg2bg2alh0sk6zxqvid8lgkmds4qgrvhxp3";
+      rev = "ffe6b8e975bb2f218cbeb3e785d2f12d9f88b37d";
+      sha256 = "0nwk81y9j5ljjm3k19kf1zmscdxiis4mwan026wv7cqp7f9qhxlr";
     };
     meta.homepage = "https://github.com/srcery-colors/srcery-vim/";
   };
@@ -9715,12 +9715,12 @@ final: prev:
 
   telescope-file-browser-nvim = buildVimPlugin {
     pname = "telescope-file-browser.nvim";
-    version = "2023-11-05";
+    version = "2023-11-12";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope-file-browser.nvim";
-      rev = "3044ff9e38d1ed8d7818d72d9f951ed9d1b0563d";
-      sha256 = "0p1k1cfapbws0snf43idcrh326z2zcz3l05m3jv8dg9j7mmaps4w";
+      rev = "da2a20ccaf39ce04b92178711a2db175ec0a87d5";
+      sha256 = "1k7sp1xcrr2wlkjrs7aqsnxjf7sp9ra36bpl1rn1dfmjyd949n6r";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope-file-browser.nvim/";
   };
@@ -9812,12 +9812,12 @@ final: prev:
 
   telescope-manix = buildNeovimPlugin {
     pname = "telescope-manix";
-    version = "2023-10-29";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "MrcJkb";
       repo = "telescope-manix";
-      rev = "30f95237af9a9bbbd386742ec40e489bf09f8ead";
-      sha256 = "1svw724jlhchsl191bmgr50zbjl9vghkaxk3j8g0nzvrn9677b22";
+      rev = "d946dba3dbf71005434aeae5a4aa5589b09649bc";
+      sha256 = "1sha737v9ixzf2d336ykvh5kszb5bi2vb4i5ms4ffayf10lhk30g";
     };
     meta.homepage = "https://github.com/MrcJkb/telescope-manix/";
   };
@@ -9896,12 +9896,12 @@ final: prev:
 
   telescope-undo-nvim = buildVimPlugin {
     pname = "telescope-undo.nvim";
-    version = "2023-11-10";
+    version = "2023-11-12";
     src = fetchFromGitHub {
       owner = "debugloop";
       repo = "telescope-undo.nvim";
-      rev = "a3dcb6e32a3a59a5570a7cda33171eeef9753345";
-      sha256 = "1vx3zfb2mc56ggk1j2kh9xzpnid963wvg2ibhq1c7vzf0d3wigc0";
+      rev = "13c33c173e53f14df7eec5155c52a3d2ab022d8d";
+      sha256 = "0bc3c447491pbp6l20gn4kwd9n7wm4ayac0imsvswpmnvlrh0ibn";
     };
     meta.homepage = "https://github.com/debugloop/telescope-undo.nvim/";
   };
@@ -9957,12 +9957,12 @@ final: prev:
 
   telescope-nvim = buildNeovimPlugin {
     pname = "telescope.nvim";
-    version = "2023-11-06";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "nvim-telescope";
       repo = "telescope.nvim";
-      rev = "20bf20500c95208c3ac0ef07245065bf94dcab15";
-      sha256 = "096vv98xxdqy96ipz6lbricfr74bkc3r58x1si1816lnm0j896r5";
+      rev = "721cdcae134eb5c564cb6c9df6c317c3854528ad";
+      sha256 = "12kizqyhknpp4931n2fkbdxhb04afpcnxyw6s4z7mf1vsfjz39w2";
     };
     meta.homepage = "https://github.com/nvim-telescope/telescope.nvim/";
   };
@@ -10065,12 +10065,12 @@ final: prev:
 
   text-case-nvim = buildVimPlugin {
     pname = "text-case.nvim";
-    version = "2023-11-12";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "johmsalas";
       repo = "text-case.nvim";
-      rev = "51e043c27478823d3d914ccf8e373b189a084836";
-      sha256 = "1fggk1k1wfgrcapv2z8s7j9k1nkxc1g33c87pjld7dsm6477fvms";
+      rev = "acd6178ffcf728c82036c7064630ff40f4c9ae82";
+      sha256 = "03r9znnrgvc374k71wzjyr69ifpmbgpwx9n8xmrv3f0w6kmfa1y1";
     };
     meta.homepage = "https://github.com/johmsalas/text-case.nvim/";
   };
@@ -10246,12 +10246,12 @@ final: prev:
 
   treesj = buildVimPlugin {
     pname = "treesj";
-    version = "2023-11-08";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "Wansmer";
       repo = "treesj";
-      rev = "7b6e1ce4bfd679071a16ed212be6b3b1e0840dd4";
-      sha256 = "02n5231gq3097a2ldgl5mflm0182mfcxc7wv801fd6gj3d021ls7";
+      rev = "1d6e89f4790aa04eaae38fa9460a3ee191961c96";
+      sha256 = "1f7zrzv0f2di1vkavgyqa80mx686rii0gsygl8rs3qrr9bc17zd5";
     };
     meta.homepage = "https://github.com/Wansmer/treesj/";
   };
@@ -10426,12 +10426,12 @@ final: prev:
 
   unison = buildVimPlugin {
     pname = "unison";
-    version = "2023-11-10";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "unisonweb";
       repo = "unison";
-      rev = "790da1ea008bac817ec80eb941286120e3e59b74";
-      sha256 = "0q084havhpxkws9ppw4hiv1sjq53w3q1sdfh492rkcrsrpppvgyv";
+      rev = "68d6f93d3bdd3663aee6ec7e16fee4eedc6df26b";
+      sha256 = "1kb2dnd5jcwig3yjajjwznmb47llrl5y5jmd33nkdrrmvckb6l0z";
     };
     meta.homepage = "https://github.com/unisonweb/unison/";
   };
@@ -11686,12 +11686,12 @@ final: prev:
 
   vim-dirvish = buildVimPlugin {
     pname = "vim-dirvish";
-    version = "2023-06-18";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "justinmk";
       repo = "vim-dirvish";
-      rev = "bbf53b30ca1e718625b9b84b1d32379e470ddad7";
-      sha256 = "1pg1w587lkj0vx1qcf7916928jm72c5j0jjj9804bdxdwixygyza";
+      rev = "babbf69f7bb5274f0461e04a59d3e059bee27314";
+      sha256 = "1j38m972z5qca8rl5i0w8rhvv1r2ipqvajh07b006dn8smaz33zs";
     };
     meta.homepage = "https://github.com/justinmk/vim-dirvish/";
   };
@@ -12070,12 +12070,12 @@ final: prev:
 
   vim-floaterm = buildVimPlugin {
     pname = "vim-floaterm";
-    version = "2023-10-05";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "voldikss";
       repo = "vim-floaterm";
-      rev = "6e81602e9d7ff7dc1c96c66fedc38fca1262d57c";
-      sha256 = "1354apq2hcizp96p5y3ig2v8i0aq358qyifi8m3qzx6sh5ql0vgp";
+      rev = "b1d93789faf8bfe1f3e17eec03b8312c2939fcf2";
+      sha256 = "11rykxacg9qlwyf0j4p6w8qqjr5yi1inmghyb4mvd5d0zp61p5w0";
     };
     meta.homepage = "https://github.com/voldikss/vim-floaterm/";
   };
@@ -12876,12 +12876,12 @@ final: prev:
 
   vim-just = buildVimPlugin {
     pname = "vim-just";
-    version = "2023-11-08";
+    version = "2023-11-14";
     src = fetchFromGitHub {
       owner = "NoahTheDuke";
       repo = "vim-just";
-      rev = "743cbe28d8e6acd82eb7db6bac11c50661ec16a9";
-      sha256 = "16vdabnq8rxkbi5bccr0fjxjhm0n7d3r1sdx1459s4b5h6his9bw";
+      rev = "8fa4691bc3b593b6deaf885a3af80aafb12f338b";
+      sha256 = "0gic7vfd3jbz5pwn0cchhx4xs05vil590mc90kfkvf97ksr94965";
     };
     meta.homepage = "https://github.com/NoahTheDuke/vim-just/";
   };
@@ -13128,12 +13128,12 @@ final: prev:
 
   vim-lsp-settings = buildVimPlugin {
     pname = "vim-lsp-settings";
-    version = "2023-09-17";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "mattn";
       repo = "vim-lsp-settings";
-      rev = "7613a3f702ae7ff2794b659a9769494203f5cb67";
-      sha256 = "0fa56dn9jmqz0hwd2jjc9g4j0rqyw5d5v64vzs8lq6r52fvzcm6j";
+      rev = "3d99f09affd1ea6b9289949d5b282c43fe21eab8";
+      sha256 = "08983vwgcaz2ydl4pf5nlzjli7aa88bmdp3m56519ihfhj2s1s22";
     };
     meta.homepage = "https://github.com/mattn/vim-lsp-settings/";
   };
@@ -13357,12 +13357,12 @@ final: prev:
 
   vim-monokai-tasty = buildVimPlugin {
     pname = "vim-monokai-tasty";
-    version = "2023-11-07";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "patstockwell";
       repo = "vim-monokai-tasty";
-      rev = "dae763bc4665516f354c20d84e53355a810682a2";
-      sha256 = "1yddbd9wazxh95wrkw5lnb8fmlk3q4zj051f4qjn13rbj4j0ch6l";
+      rev = "247324e0170e19de0018e7c8e437f83b6f0ef6fc";
+      sha256 = "0l3rlah48969kkz2r6xl9r8plg7n4an1pk5cy92ly94x6yw5awkm";
     };
     meta.homepage = "https://github.com/patstockwell/vim-monokai-tasty/";
   };
@@ -13657,12 +13657,12 @@ final: prev:
 
   vim-orgmode = buildVimPlugin {
     pname = "vim-orgmode";
-    version = "2022-12-09";
+    version = "2023-11-12";
     src = fetchFromGitHub {
       owner = "jceb";
       repo = "vim-orgmode";
-      rev = "b27feaba9a316e8307cfd7a56797b378fb52df83";
-      sha256 = "0b2y49ylbrp1i5r5abznziv1n43d063mib07v4ila0873k7fzir6";
+      rev = "83982349e45e6d27d186ad82050f86c3233a16f0";
+      sha256 = "1gw9x3lf379kpscb47vg14cmfspcj04kif6q38xvd5szkw8mq50f";
     };
     meta.homepage = "https://github.com/jceb/vim-orgmode/";
   };
@@ -14293,12 +14293,12 @@ final: prev:
 
   vim-scriptease = buildVimPlugin {
     pname = "vim-scriptease";
-    version = "2022-05-30";
+    version = "2023-11-13";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-scriptease";
-      rev = "18511d389675d773994215ddb572ccdc2b72f52b";
-      sha256 = "1mzs4x6y68akysbibprfif1dksaafhcyhddkcyh3da6by6sp5l0l";
+      rev = "cdb5981d47ac98221a408ae2e7cae66524d9e872";
+      sha256 = "1f5y96lkbj8zfm6lc3izynb4dz914vli2yqpn1gw9y3llj43n5bn";
     };
     meta.homepage = "https://github.com/tpope/vim-scriptease/";
   };
@@ -14822,12 +14822,12 @@ final: prev:
 
   vim-test = buildVimPlugin {
     pname = "vim-test";
-    version = "2023-10-28";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "vim-test";
       repo = "vim-test";
-      rev = "5880b17c3baf31a22077538dad5d88c658874303";
-      sha256 = "1j42sdr24z7hg3n5g1paa3a5gc4sfdyp0rl43qqa2kvnghpzk93z";
+      rev = "6d054a713d601291c01c42197796644cf00ca9f2";
+      sha256 = "0lf82ka9x1fkgczqxkbvlqygp6glcn1baq8ix0y60jn3kqccpm4s";
     };
     meta.homepage = "https://github.com/vim-test/vim-test/";
   };
@@ -15567,12 +15567,12 @@ final: prev:
 
   vimtex = buildVimPlugin {
     pname = "vimtex";
-    version = "2023-11-04";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "7d1dbd0eebe041fbda4d1132622bf051b1546497";
-      sha256 = "130v7kqf14r46ndn199lc74fm4dxiky3c14kilx4adnifac7qywb";
+      rev = "a630f0f75d9468d10c9125f2f1b0049e479c2f54";
+      sha256 = "0f1p93jmhfp6fvl29v58rgwcvqa5lh1ks44w7gp6yh2w0i78s200";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -16024,12 +16024,12 @@ final: prev:
 
   catppuccin-nvim = buildVimPlugin {
     pname = "catppuccin-nvim";
-    version = "2023-11-12";
+    version = "2023-11-15";
     src = fetchFromGitHub {
       owner = "catppuccin";
       repo = "nvim";
-      rev = "9f3c13bbcf16fcaec3a429c03743a13e5923f3e3";
-      sha256 = "06m4mz3s53n5rw62jdrz66ygfqx02r0m7ixb14cl327hy1dfnsgc";
+      rev = "cc717acba29259d578548973c41448b092453c52";
+      sha256 = "1jbyvd5w06hppwpvjm2sd01qz3phw7ds5n7w220x8r2vslpmm25l";
     };
     meta.homepage = "https://github.com/catppuccin/nvim/";
   };
diff --git a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
index 4f00a46348c..e0c0f05bf30 100644
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -292,12 +292,12 @@
   };
   cpp = buildGrammar {
     language = "cpp";
-    version = "0.0.0+rev=a90f170";
+    version = "0.0.0+rev=d153fe1";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-cpp";
-      rev = "a90f170f92d5d70e7c2d4183c146e61ba5f3a457";
-      hash = "sha256-e9Mz84lssaPR80hlogyjXx+jA8gD8YVp4T06qC6gRVI=";
+      rev = "d153fe1c3385ee0521730ff4e0be9358e903b322";
+      hash = "sha256-zxAz82XpTtKondA84L1sO3VByo8vLI4j154pWbxlV74=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-cpp";
   };
@@ -714,12 +714,12 @@
   };
   gleam = buildGrammar {
     language = "gleam";
-    version = "0.0.0+rev=3f93ccc";
+    version = "0.0.0+rev=b2afa4f";
     src = fetchFromGitHub {
       owner = "gleam-lang";
       repo = "tree-sitter-gleam";
-      rev = "3f93cccaf278cc4c9cf9a373ea2f6389174d634c";
-      hash = "sha256-TjyAaxEtGVjnBdcw1uyeQhotNhZlQKvN1SgbZwKvm3M=";
+      rev = "b2afa4fd6bb41a7bf912b034c653c90af7ae5122";
+      hash = "sha256-Z1wutK2NyI5EMwTezeZp/g8JFD0p7kqBGCuh9Amyjgo=";
     };
     meta.homepage = "https://github.com/gleam-lang/tree-sitter-gleam";
   };
@@ -901,12 +901,12 @@
   };
   hcl = buildGrammar {
     language = "hcl";
-    version = "0.0.0+rev=b553906";
+    version = "0.0.0+rev=fdf6463";
     src = fetchFromGitHub {
       owner = "MichaHoffmann";
       repo = "tree-sitter-hcl";
-      rev = "b5539065432c08e4118eb3ee7c94902fdda85708";
-      hash = "sha256-okLwoDGgK6aM5+8oelfRnuKqIimTs8Hc0N8Ikrm2eY0=";
+      rev = "fdf6463216f1a45d83ba911cdb9f57445a8d3b51";
+      hash = "sha256-UEjC3PeTQCvbtfk4a0EaLh+DXraUQIaSUGU6vszYP3E=";
     };
     meta.homepage = "https://github.com/MichaHoffmann/tree-sitter-hcl";
   };
@@ -934,12 +934,12 @@
   };
   hlsl = buildGrammar {
     language = "hlsl";
-    version = "0.0.0+rev=f2902bd";
+    version = "0.0.0+rev=ac65c93";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-hlsl";
-      rev = "f2902bd614e3916bdf65e1bc9ad45ebd08417bba";
-      hash = "sha256-tuie4Yzauejf+5Par2qnWfaQgOLhROL2le1+UTq5cSY=";
+      rev = "ac65c934b3214e96e0f854be009a3bd51549bd14";
+      hash = "sha256-rTBal4RBOFBKfb9cydvWH+JtCCMOlnnGMPb2X7LXRjE=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
   };
@@ -1011,12 +1011,12 @@
   };
   ini = buildGrammar {
     language = "ini";
-    version = "0.0.0+rev=7f11a02";
+    version = "0.0.0+rev=bcb84a2";
     src = fetchFromGitHub {
       owner = "justinmk";
       repo = "tree-sitter-ini";
-      rev = "7f11a02fb8891482068e0fe419965d7bade81a68";
-      hash = "sha256-IIpKzpA4q1jpYVZ75VZaxWHaqNt8TA427eMOui2s71M=";
+      rev = "bcb84a2d4bcd6f55b911c42deade75c8f90cb0c5";
+      hash = "sha256-dYPeVTNWO4apY5dsjsKViavU7YtLeGTp6BzEemXhsEU=";
     };
     meta.homepage = "https://github.com/justinmk/tree-sitter-ini";
   };
@@ -1220,12 +1220,12 @@
   };
   leo = buildGrammar {
     language = "leo";
-    version = "0.0.0+rev=91d7aa6";
+    version = "0.0.0+rev=23a9534";
     src = fetchFromGitHub {
       owner = "r001";
       repo = "tree-sitter-leo";
-      rev = "91d7aa606f524cf4f5df7f4aacb45b4056fac704";
-      hash = "sha256-8nea6Qg0eT5ciif+tzD13TcFqP9/uJVxgVSW93OdiVY=";
+      rev = "23a9534d09d523d0dcee7dbf89e7c819e6835f6f";
+      hash = "sha256-21Vqvc3HjmKi1FRKyswMcf8rPjkyAbjTayDYMsTUsBg=";
     };
     meta.homepage = "https://github.com/r001/tree-sitter-leo";
   };
@@ -1319,24 +1319,24 @@
   };
   markdown = buildGrammar {
     language = "markdown";
-    version = "0.0.0+rev=7ce4c69";
+    version = "0.0.0+rev=f9820b2";
     src = fetchFromGitHub {
       owner = "MDeiml";
       repo = "tree-sitter-markdown";
-      rev = "7ce4c69fe92d1c10225e3d1b3676c87dd9427b45";
-      hash = "sha256-UxpTkiRChAwNJBVS9y/lydI8R035EuRy3t39Y1mscq0=";
+      rev = "f9820b2db958228f9be339b67d2de874d065866e";
+      hash = "sha256-0T0P018Zb4tfU2D4PLhiW8tunOInlRtrHajPOVqOpwc=";
     };
     location = "tree-sitter-markdown";
     meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
   };
   markdown_inline = buildGrammar {
     language = "markdown_inline";
-    version = "0.0.0+rev=7ce4c69";
+    version = "0.0.0+rev=f9820b2";
     src = fetchFromGitHub {
       owner = "MDeiml";
       repo = "tree-sitter-markdown";
-      rev = "7ce4c69fe92d1c10225e3d1b3676c87dd9427b45";
-      hash = "sha256-UxpTkiRChAwNJBVS9y/lydI8R035EuRy3t39Y1mscq0=";
+      rev = "f9820b2db958228f9be339b67d2de874d065866e";
+      hash = "sha256-0T0P018Zb4tfU2D4PLhiW8tunOInlRtrHajPOVqOpwc=";
     };
     location = "tree-sitter-markdown-inline";
     meta.homepage = "https://github.com/MDeiml/tree-sitter-markdown";
@@ -1498,12 +1498,12 @@
   };
   objdump = buildGrammar {
     language = "objdump";
-    version = "0.0.0+rev=64e4741";
+    version = "0.0.0+rev=28d3b2e";
     src = fetchFromGitHub {
       owner = "ColinKennedy";
       repo = "tree-sitter-objdump";
-      rev = "64e4741d58345c36ded639f5a3bcd7811be7f8f8";
-      hash = "sha256-v5skJKQ/c0YeGVj3Vs+SNnFqTkp0mblZU4DyJ9hg7s4=";
+      rev = "28d3b2e25a0b1881d1b47ed1924ca276c7003d45";
+      hash = "sha256-OPqIhgItghXplQ78Vlwd0G6KtDWTVkaG17RPqx1b5JY=";
     };
     meta.homepage = "https://github.com/ColinKennedy/tree-sitter-objdump";
   };
@@ -1766,12 +1766,12 @@
   };
   purescript = buildGrammar {
     language = "purescript";
-    version = "0.0.0+rev=5ef5592";
+    version = "0.0.0+rev=f89bd14";
     src = fetchFromGitHub {
       owner = "postsolar";
       repo = "tree-sitter-purescript";
-      rev = "5ef5592674ea42de75fc2792972e4ea0b6e3da6c";
-      hash = "sha256-V9cuENH/tpXt9mfZqJ2v4dxJvbwEHU8Ri+UxQafWemY=";
+      rev = "f89bd149e44624342bf49f76245d3284f2beed9a";
+      hash = "sha256-c4Zux+6kg9b9/0t9LOtfSdMMQbp1xwiQH8dz4BBB/pY=";
     };
     meta.homepage = "https://github.com/postsolar/tree-sitter-purescript";
   };
@@ -2121,12 +2121,12 @@
   };
   sql = buildGrammar {
     language = "sql";
-    version = "0.0.0+rev=5f928f4";
+    version = "0.0.0+rev=9fe5aea";
     src = fetchFromGitHub {
       owner = "derekstride";
       repo = "tree-sitter-sql";
-      rev = "5f928f404d2aa024abce8657778fc10c03f1511f";
-      hash = "sha256-7W6vuaZjDZgoaxJexPPBjJZlutlTT+hTFL1dq9k2NSo=";
+      rev = "9fe5aeaa8d58d00cc31c20a3ae923ae695ce2ce7";
+      hash = "sha256-HnSZGrxrHlARPhgTJRO6P0FcmjOdB3c5eMpH9+5ZaX8=";
     };
     meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
   };
@@ -2277,12 +2277,12 @@
   };
   terraform = buildGrammar {
     language = "terraform";
-    version = "0.0.0+rev=b553906";
+    version = "0.0.0+rev=fdf6463";
     src = fetchFromGitHub {
       owner = "MichaHoffmann";
       repo = "tree-sitter-hcl";
-      rev = "b5539065432c08e4118eb3ee7c94902fdda85708";
-      hash = "sha256-okLwoDGgK6aM5+8oelfRnuKqIimTs8Hc0N8Ikrm2eY0=";
+      rev = "fdf6463216f1a45d83ba911cdb9f57445a8d3b51";
+      hash = "sha256-UEjC3PeTQCvbtfk4a0EaLh+DXraUQIaSUGU6vszYP3E=";
     };
     location = "dialects/terraform";
     meta.homepage = "https://github.com/MichaHoffmann/tree-sitter-hcl";
@@ -2322,12 +2322,12 @@
   };
   tlaplus = buildGrammar {
     language = "tlaplus";
-    version = "0.0.0+rev=204e858";
+    version = "0.0.0+rev=d99cb5c";
     src = fetchFromGitHub {
       owner = "tlaplus-community";
       repo = "tree-sitter-tlaplus";
-      rev = "204e858899f7dd5713dea7b0148d6aa477d4a18f";
-      hash = "sha256-AzCXFr6YAmbmEiBEN6MI+MeBDoEDrJB2vcZl/OEUqmg=";
+      rev = "d99cb5c77bb0e733176d607a0875ac30e17e1e72";
+      hash = "sha256-ShZlFHokmy3hhfTeh+/anz7a2bGDwWAdWIdi3X/lchQ=";
     };
     meta.homepage = "https://github.com/tlaplus-community/tree-sitter-tlaplus";
   };
@@ -2580,12 +2580,12 @@
   };
   wing = buildGrammar {
     language = "wing";
-    version = "0.0.0+rev=238200d";
+    version = "0.0.0+rev=eacf704";
     src = fetchFromGitHub {
       owner = "winglang";
       repo = "wing";
-      rev = "238200d172538d5ff1228a929ea543465acfc410";
-      hash = "sha256-a/8lbO8/+XhD3i6hjAxCA1rpovlkVHnDxz8xkc3bPoY=";
+      rev = "eacf704338661b981fcf4fdb5ee44d898f038144";
+      hash = "sha256-JwA49Up2G2/jobjqniQeJ1Rfko3PFfgINRvi/QswlCk=";
     };
     location = "libs/tree-sitter-wing";
     generate = true;
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 5e6f03ec8ce..ea1e3f8da7b 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -999,7 +999,7 @@ self: super: {
         pname = "sg-nvim-rust";
         inherit (old) version src;
 
-        cargoHash = "sha256-Rqs9INcc53SYGXHRyeTbLkGGU035i2i6n6A4ekFKve0=";
+        cargoHash = "sha256-ITrjY15Haz8hEztWym4q8YW2h0R8/kOYPaIYJu87sN4=";
 
         nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/editors/vim/plugins/patches/coq_nvim/emulate-venv.patch b/pkgs/applications/editors/vim/plugins/patches/coq_nvim/emulate-venv.patch
index da0222fbbe4..e0980a3ccb0 100644
--- a/pkgs/applications/editors/vim/plugins/patches/coq_nvim/emulate-venv.patch
+++ b/pkgs/applications/editors/vim/plugins/patches/coq_nvim/emulate-venv.patch
@@ -1,15 +1,15 @@
 diff --git a/coq/__main__.py b/coq/__main__.py
-index 5a6c6fd2..e0d9eec8 100644
+index dd40afc1..36bcca21 100644
 --- a/coq/__main__.py
 +++ b/coq/__main__.py
 @@ -78,7 +78,7 @@ _EXEC_PATH = Path(executable)
  _EXEC_PATH = _EXEC_PATH.parent.resolve(strict=True) / _EXEC_PATH.name
  _REQ = REQUIREMENTS.read_text()
-
+ 
 -_IN_VENV = _RT_PY == _EXEC_PATH
 +_IN_VENV = True
-
-
+ 
+ 
  if command == "deps":
 @@ -152,7 +152,7 @@ elif command == "run":
      try:
@@ -21,15 +21,15 @@ index 5a6c6fd2..e0d9eec8 100644
          else:
              import pynvim_pp
 diff --git a/coq/consts.py b/coq/consts.py
-index 5a027fe9..a3e0c5a4 100644
+index 804e92ab..5c090a93 100644
 --- a/coq/consts.py
 +++ b/coq/consts.py
-@@ -9,7 +9,7 @@ TOP_LEVEL = Path(__file__).resolve(strict=True).parent.parent
+@@ -10,7 +10,7 @@ TOP_LEVEL = Path(__file__).resolve(strict=True).parent.parent
  REQUIREMENTS = TOP_LEVEL / "requirements.txt"
-
-
+ 
+ 
 -VARS = TOP_LEVEL / ".vars"
 +VARS = Path.home() / ".cache/coq_nvim/vars"
-
+ 
  RT_DIR = VARS / "runtime"
  RT_PY = RT_DIR / "Scripts" / "python.exe" if IS_WIN else RT_DIR / "bin" / "python3"
diff --git a/pkgs/applications/editors/vim/plugins/vim-clap/Cargo.lock b/pkgs/applications/editors/vim/plugins/vim-clap/Cargo.lock
index 92518ad77c5..4db45ddc849 100644
--- a/pkgs/applications/editors/vim/plugins/vim-clap/Cargo.lock
+++ b/pkgs/applications/editors/vim/plugins/vim-clap/Cargo.lock
@@ -150,6 +150,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "604178f6c5c21f02dc555784810edfb88d34ac2c73b2eae109655649ee73ce3d"
 
 [[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "bitflags"
 version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -201,6 +210,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"
 
 [[package]]
+name = "camino"
+version = "1.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c59e92b5a388f549b863a7bea62612c09f24c8393560709a54558a9abdfb3b9c"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "cargo-lock"
 version = "9.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -213,6 +231,29 @@ dependencies = [
 ]
 
 [[package]]
+name = "cargo-platform"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cfa25e60aea747ec7e1124f238816749faa93759c6ff5b31f1ccdda137f4479"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cargo_metadata"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb9ac64500cc83ce4b9f8dafa78186aa008c8dea77a09b94cd307fd0cd5022a8"
+dependencies = [
+ "camino",
+ "cargo-platform",
+ "semver",
+ "serde",
+ "serde_json",
+ "thiserror",
+]
+
+[[package]]
 name = "cc"
 version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -361,6 +402,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
 
 [[package]]
+name = "colorsys"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54261aba646433cb567ec89844be4c4825ca92a4f8afba52fc4dd88436e31bbd"
+
+[[package]]
 name = "combine"
 version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -399,6 +446,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
 
 [[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
 name = "crossbeam-channel"
 version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -442,6 +498,41 @@ dependencies = [
 ]
 
 [[package]]
+name = "darling"
+version = "0.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0209d94da627ab5605dcccf08bb18afa5009cfbef48d8a8b7d7bdbc79be25c5e"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "177e3443818124b357d8e76f53be906d60937f0d3a90773a664fa63fa253e621"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "836a9bbc7ad63342d6d6e7b815ccab164bc77a2d95d84bc3117a8c0d5c98e2d5"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
 name = "deranged"
 version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -572,6 +663,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "flate2"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
 name = "fnv"
 version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -810,6 +911,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
 
 [[package]]
+name = "highlighter"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "colorsys",
+ "once_cell",
+ "rgb2ansi256",
+ "serde",
+ "syntect",
+ "tracing",
+ "utils",
+]
+
+[[package]]
 name = "home"
 version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -923,6 +1038,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
 name = "idna"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1096,6 +1217,37 @@ dependencies = [
 ]
 
 [[package]]
+name = "line-wrap"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f30344350a2a51da54c1d53be93fade8a237e545dbcc4bdbe635413f2117cab9"
+dependencies = [
+ "safemem",
+]
+
+[[package]]
+name = "linked-hash-map"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
+
+[[package]]
+name = "linter"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "cargo_metadata",
+ "once_cell",
+ "parking_lot",
+ "paths",
+ "regex",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
 name = "linux-raw-sys"
 version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1128,7 +1280,7 @@ dependencies = [
 
 [[package]]
 name = "maple"
-version = "0.1.46"
+version = "0.1.47"
 dependencies = [
  "built",
  "chrono",
@@ -1156,9 +1308,12 @@ dependencies = [
  "futures",
  "grep-matcher",
  "grep-searcher",
+ "highlighter",
  "icon",
  "ignore",
  "itertools",
+ "linter",
+ "maple_derive",
  "matcher",
  "once_cell",
  "parking_lot",
@@ -1181,6 +1336,18 @@ dependencies = [
 ]
 
 [[package]]
+name = "maple_derive"
+version = "0.1.0"
+dependencies = [
+ "darling",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "types",
+]
+
+[[package]]
 name = "matcher"
 version = "0.1.0"
 dependencies = [
@@ -1195,9 +1362,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"
 
 [[package]]
 name = "memmap2"
@@ -1309,6 +1476,28 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
+name = "onig"
+version = "6.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c4b31c8722ad9171c6d77d3557db078cab2bd50afcc9d09c8b315c59df8ca4f"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+ "once_cell",
+ "onig_sys",
+]
+
+[[package]]
+name = "onig_sys"
+version = "69.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b829e3d7e9cc74c7e315ee8edb185bf4190da5acde74afd7fc59c35b1f086e7"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
+[[package]]
 name = "overload"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1385,6 +1574,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
 
 [[package]]
+name = "plist"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdc0001cfea3db57a2e24bc0d818e9e20e554b5f97fabb9bc231dc240269ae06"
+dependencies = [
+ "base64 0.21.2",
+ "indexmap 1.9.3",
+ "line-wrap",
+ "quick-xml",
+ "serde",
+ "time 0.3.27",
+]
+
+[[package]]
 name = "printer"
 version = "0.1.0"
 dependencies = [
@@ -1407,6 +1610,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "quick-xml"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81b9228215d82c7b61490fec1de287136b5de6f5700f6e58ea9ad61a7964ca51"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
 name = "quote"
 version = "1.0.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1474,25 +1686,25 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.9.3"
+version = "1.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81bc1d4caf89fac26a70747fe603c130093b53c773888797a6329091246d651a"
+checksum = "697061221ea1b4a94a624f67d0ae2bfe4e22b8a17b6a192afb11046542cc8c47"
 dependencies = [
  "aho-corasick 1.0.4",
  "memchr",
  "regex-automata",
- "regex-syntax 0.7.4",
+ "regex-syntax 0.7.5",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.3.6"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed1ceff11a1dddaee50c9dc8e4938bd106e9d89ae372f192311e7da498e3b69"
+checksum = "c2f401f4955220693b56f8ec66ee9c78abffd8d1c4f23dc41a23839eb88f0795"
 dependencies = [
  "aho-corasick 1.0.4",
  "memchr",
- "regex-syntax 0.7.4",
+ "regex-syntax 0.7.5",
 ]
 
 [[package]]
@@ -1503,9 +1715,9 @@ checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5ea92a5b6195c6ef2a0295ea818b312502c6fc94dde986c5553242e18fd4ce2"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
 
 [[package]]
 name = "reqwest"
@@ -1547,6 +1759,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "rgb2ansi256"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebca96b1c05912d531790498048bab5b7b97a756a7bb9df71fa4ef7ef9814e1"
+
+[[package]]
 name = "ring"
 version = "0.16.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1628,6 +1846,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
 
 [[package]]
+name = "safemem"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef703b7cb59335eae2eb93ceb664c0eb7ea6bf567079d843e09420219668e072"
+
+[[package]]
 name = "same-file"
 version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1805,6 +2029,27 @@ dependencies = [
 ]
 
 [[package]]
+name = "syntect"
+version = "5.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e02b4b303bf8d08bfeb0445cba5068a3d306b6baece1d5582171a9bf49188f91"
+dependencies = [
+ "bincode",
+ "bitflags 1.3.2",
+ "flate2",
+ "fnv",
+ "once_cell",
+ "onig",
+ "plist",
+ "regex-syntax 0.7.5",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "walkdir",
+ "yaml-rust",
+]
+
+[[package]]
 name = "thiserror"
 version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2486,3 +2731,12 @@ dependencies = [
  "cfg-if",
  "windows-sys 0.48.0",
 ]
+
+[[package]]
+name = "yaml-rust"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
+dependencies = [
+ "linked-hash-map",
+]
diff --git a/pkgs/applications/editors/vim/plugins/vim-clap/default.nix b/pkgs/applications/editors/vim/plugins/vim-clap/default.nix
index e5ff07f4d8d..5e4466af796 100644
--- a/pkgs/applications/editors/vim/plugins/vim-clap/default.nix
+++ b/pkgs/applications/editors/vim/plugins/vim-clap/default.nix
@@ -11,13 +11,13 @@
 }:
 
 let
-  version = "0.46";
+  version = "0.47";
 
   src = fetchFromGitHub {
     owner = "liuchengxu";
     repo = "vim-clap";
     rev = "v${version}";
-    hash = "sha256-KWBuoZ2GxjwIu7L1PPq/7u3iuYFp5QrlsleL2RQTdUE=";
+    hash = "sha256-CYv5AZsGvN2dtN7t58b50a8PH7804Lnm4d4wAX6Mm5Q=";
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index ace04b88372..365b26642b3 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -343,8 +343,8 @@ let
         mktplcRef = {
           name = "vscode-neovim";
           publisher = "asvetliakov";
-          version = "0.8.2";
-          sha256 = "0kw9asv91s37ql61blbb8pr7wb6c2ba1klchal53chp6ib55v5kn";
+          version = "1.0.1";
+          sha256 = "1yf065syb5hskds47glnv18nk0fg7d84w1j72hg1pqb082gn1sdv";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/asvetliakov.vscode-neovim/changelog";
diff --git a/pkgs/applications/graphics/hydrus/default.nix b/pkgs/applications/graphics/hydrus/default.nix
index 91f38633e6d..0f96680bb07 100644
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "549";
+  version = "551";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-y3WFQhPE8H0198Xu3Dn9YAqaX8YvFJcdt90tebTg7qw=";
+    hash = "sha256-P/U44ndfucbRnwGLdSnnA0VE4K40zPz3wtNpQj8rh5Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/texturepacker/default.nix b/pkgs/applications/graphics/texturepacker/default.nix
new file mode 100644
index 00000000000..14769c02af0
--- /dev/null
+++ b/pkgs/applications/graphics/texturepacker/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, fetchurl
+, dpkg
+, autoPatchelfHook
+, wrapQtAppsHook
+, qtbase
+, qtdeclarative
+, qtsvg
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "texturepacker";
+  version = "7.1.0";
+
+  src = fetchurl {
+    url = "https://www.codeandweb.com/download/texturepacker/${finalAttrs.version}/TexturePacker-${finalAttrs.version}.deb";
+    hash = "sha256-9HbmdMPTp6qZCEU/lIZv4HbjKUlEtPVval+y0tiYObc=";
+  };
+
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qtbase
+    qtdeclarative
+    qtsvg
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin $out/lib
+    cp usr/lib/texturepacker/{libGrantlee_Templates.so.5,libHQX.so.1.0.0,libPVRTexLib.so} $out/lib
+    cp usr/lib/texturepacker/TexturePacker $out/bin
+    cp -r usr/share $out
+  '';
+
+  meta = {
+    changelog = "https://www.codeandweb.com/texturepacker/download";
+    description = "Sprite sheet creator and game graphics optimizer";
+    homepage = "https://www.codeandweb.com/texturepacker";
+    license = lib.licenses.unfree;
+    mainProgram = "TexturePacker";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/applications/misc/cherrytree/default.nix b/pkgs/applications/misc/cherrytree/default.nix
index 04c30deef77..33e83410004 100644
--- a/pkgs/applications/misc/cherrytree/default.nix
+++ b/pkgs/applications/misc/cherrytree/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cherrytree";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "giuspen";
     repo = "cherrytree";
-    rev = version;
-    hash = "sha256-A/4OcsAOECgQnENj2l9BX713KHG+zk5cJE+yyHXw1TM=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ZGw6gESKaio89mt3VPm/uqHwlUQ0/8vIydv/WsOYQ20=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/spicetify-cli/default.nix b/pkgs/applications/misc/spicetify-cli/default.nix
index 9c6c8f93f3f..b9ac311bcea 100644
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.27.0";
+  version = "2.27.1";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "spicetify-cli";
     rev = "v${version}";
-    hash = "sha256-5WIITzm9yZWB847WHL+okwpULdwHegtZfvsVrAzwTO0=";
+    hash = "sha256-Z+paJAuzUnCdCSx2UHg1HV14vDo3jWsyUrcbEnvqTm0=";
   };
 
-  vendorHash = "sha256-VktAO3yKCdm5yz/RRLeLv6zzyGrwuHC/i8WdJtqZoYc=";
+  vendorHash = "sha256-H2kSTsYiD9HResHes+7YxUyNcjtM0SLpDPUC0Y518VM=";
 
   ldflags = [
     "-s -w"
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 17492b5a1c7..d51f3816ef7 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -92,11 +92,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.59.124";
+  version = "1.60.118";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-uY9i0TxTsSvOfMA98amxwWpQh1nsRVEgxeSZ2sv8NEU=";
+    sha256 = "sha256-Lo9F7z8gJJRId7LBfVTj18C65swDr8C7Mt1gNmXoSoY=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/cluster/kube-router/default.nix b/pkgs/applications/networking/cluster/kube-router/default.nix
index 2dd52220cb7..2701db12e61 100644
--- a/pkgs/applications/networking/cluster/kube-router/default.nix
+++ b/pkgs/applications/networking/cluster/kube-router/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kube-router";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "cloudnativelabs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7laXw0tC25zPTeLJlB/rX6WVcRFCd6DCB+3EUPnE4cM=";
+    hash = "sha256-Iwo+I1EfclkF4FL8QM3xGkIFxakmelI+hSUepLwfFSw=";
   };
 
-  vendorHash = "sha256-qJA6gnb+VIkJD24iq6yyn8r4zYY19ZywcyalwfaTtbo=";
+  vendorHash = "sha256-VjPesQ27GcwnFQrNI+VYzJ4/aahcjASbfMi//Zs/KLM=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/applications/networking/cluster/stern/default.nix b/pkgs/applications/networking/cluster/stern/default.nix
index b144df23bd2..02ceac61989 100644
--- a/pkgs/applications/networking/cluster/stern/default.nix
+++ b/pkgs/applications/networking/cluster/stern/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "stern";
-  version = "1.26.0";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "stern";
     repo = "stern";
     rev = "v${version}";
-    sha256 = "sha256-86XoYzw1bnIWwGiFgRl9RcZSYrF4byYKnDlJ4QSqXV0=";
+    sha256 = "sha256-W8jGUs63R6QpwuTgzK5yVLhKGXypvKOyCWHT2xdb6eM=";
   };
 
   vendorHash = "sha256-LLVd9WB8ixH78CHYe0sS4sCDCD+6SQ7PxWr2MHiAOxI=";
diff --git a/pkgs/applications/networking/cluster/talosctl/default.nix b/pkgs/applications/networking/cluster/talosctl/default.nix
index 73984e86360..f0414dba54d 100644
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     rev = "v${version}";
-    hash = "sha256-l0cR5BDUREBOOac/b87re5lzq3maz8Tg3msalXV6zAs=";
+    hash = "sha256-15sNXiJ/s3MlrXFXPxA7mQ+/36HRSZF6XKos6XEHi1Y=";
   };
 
-  vendorHash = "sha256-/l0crKz1Pks2yiQ+t/rY2ZxB+jYCymSfoILtHYtQ7K8=";
+  vendorHash = "sha256-fGl16Wsb1tW9+wZBg5yY73t7n+EJ1dVx5IlzY2B8PJA=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index b89cc624bd4..6769c46868d 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -46,6 +46,8 @@ let
           name = "source-${rev}";
           inherit owner repo rev hash;
         };
+        # nixpkgs-update: no auto update
+        # easier to update all providers together
 
         meta = {
           inherit homepage;
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index ed252614490..70f547fb022 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -167,9 +167,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.6.3";
-    hash = "sha256-2ai0WAknz4rt33BuBoqnTCsfPNHmet9+PdgYeeJKQkQ=";
-    vendorHash = "sha256-ZtaXUX0PgL1nwXgohcfCyj/fLPAodx8amHEsQnlOQrc=";
+    version = "1.6.4";
+    hash = "sha256-kA0H+JxyMV6RKRr20enTOzfwj2Lk2IP4vivfHv02+w8=";
+    vendorHash = "sha256-cxnvEwtZLXYZzCITJgYk8hDRndLLC8YTD+RvgcNska0=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;
diff --git a/pkgs/applications/networking/cluster/weave-gitops/default.nix b/pkgs/applications/networking/cluster/weave-gitops/default.nix
index a268f262ead..336d840eb58 100644
--- a/pkgs/applications/networking/cluster/weave-gitops/default.nix
+++ b/pkgs/applications/networking/cluster/weave-gitops/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "weave-gitops";
-  version = "0.34.0";
+  version = "0.35.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-W7Q5rsmNEDUGofQumbs9HaByQEb7sj4tOT7ZpIe98E4=";
+    sha256 = "sha256-H/l/b6yPoNZeBG1TPc9PCBpZg4ETnF9FmYnbRmKl8c8=";
   };
 
   ldflags = [ "-s" "-w" "-X github.com/weaveworks/weave-gitops/cmd/gitops/version.Version=${version}" ];
 
-  vendorHash = "sha256-+UxrhtwYP+ctn+y7IxKKLO5RVoiUSl4ky0xprXr98Jc=";
+  vendorHash = "sha256-le34zvlgquxOv0xdOPfpf7/ZuoPd9MEfp8Gshigvtas=";
 
   subPackages = [ "cmd/gitops" ];
 
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index 0d58e54bcb4..9895729c29e 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.267";
+  version = "1.2.269";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    hash = "sha256-OlTlyo/JbmXyoMBSDnKHvjGN6NMRrk0kQT63R34gtOs=";
+    hash = "sha256-LUHENANM+3wGftTVXaQsGykKayzEAIQ3TQ5qM77TJVA=";
   };
 
-  vendorHash = "sha256-0bxM0Y4K6wxg6Ka1A9MusptiSMshTUWJItXoVDpo7lI=";
+  vendorHash = "sha256-20bPsBRya7Gg7p/hSSnnYLoSHf/fRwk1UrA/KlMT3Jk=";
 
   proxyVendor = true;
 
diff --git a/pkgs/applications/networking/gmailctl/default.nix b/pkgs/applications/networking/gmailctl/default.nix
index be8173da16d..b10dac2262a 100644
--- a/pkgs/applications/networking/gmailctl/default.nix
+++ b/pkgs/applications/networking/gmailctl/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gmailctl";
-  version = "0.10.6";
+  version = "0.10.7";
 
   src = fetchFromGitHub {
     owner = "mbrt";
     repo = "gmailctl";
     rev = "v${version}";
-    sha256 = "sha256-OpRkBHNWRrBhh6nGrV7dZT01xsSlbANCk+g7b8SidG0=";
+    hash = "sha256-OpRkBHNWRrBhh6nGrV7dZT01xsSlbANCk+g7b8SidG0=";
   };
 
   vendorHash = "sha256-+r0WHrKARcxW1hUY1HwAXk0X6ZQrbgBj9+GjIJV5DS0=";
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
index deff202d2e6..fea9da80d19 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@@ -15,6 +15,8 @@
 , sqlcipher
 , stdenv
 , CoreServices
+, testers
+, deltachat-desktop
 }:
 
 let
@@ -33,16 +35,16 @@ let
 in
 buildNpmPackage rec {
   pname = "deltachat-desktop";
-  version = "unstable-2023-11-03";
+  version = "1.41.1";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
-    rev = "40152e9543eb773fc27e7a4f96ef1eecebe9310e";
-    hash = "sha256-9GPXFUCu9GKa/bJgO8CIPMLccI6WAJ6PhfoyJ6s/DHE=";
+    rev = "v${version}";
+    hash = "sha256-ITcBIm47OiGy/i6jnG6r1OoStjRPystOts6ViLioLNY=";
   };
 
-  npmDepsHash = "sha256-g3nkgqZNoq+xuwXbXLHEMVpHH6Sq3792xhITCx7WvOc=";
+  npmDepsHash = "sha256-+t6m2kDUOh6kIkbZgol/CQciDTxUZSkTr1amPywrMb4=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -116,6 +118,12 @@ buildNpmPackage rec {
     ];
   });
 
+  passthru.tests = {
+    version = testers.testVersion {
+      package = deltachat-desktop;
+    };
+  };
+
   meta = with lib; {
     description = "Email-based instant messaging for Desktop";
     homepage = "https://github.com/deltachat/deltachat-desktop";
diff --git a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
index d3c6a33d248..63d8b250b96 100644
--- a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
@@ -4,11 +4,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "rocketchat-desktop";
-  version = "3.9.9";
+  version = "3.9.10";
 
   src = fetchurl {
     url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat-${version}-linux-amd64.deb";
-    hash = "sha256-50mVmE+q2VYJXIv2iD6ppS83We0aJRT9vje+zpJcdq0=";
+    hash = "sha256-VLHkFiIwfjCHr08wTsD8rMWSvHEswZCKl2XJr61cQYE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
index 2ff8a8d81a8..a30f5be4ce9 100644
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -19,18 +19,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "teams-for-linux";
-  version = "1.3.18";
+  version = "1.3.19";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-evOwjHUmeGw8AUpXSig8zVW2cpJbWkNTH/RUuNipFsQ=";
+    hash = "sha256-+n26VTNRymPdzMbSz8AZsQ73xOHizOFAstw6toKfZQM=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-tMC8/qHYli7+OTdxVWRDEyCNzrkYA+zKlHJXlTsl+W0=";
+    hash = "sha256-SxUdTzk8WngkKwT05U8HJsK8+8ezcJWdiT/ettxpeEE=";
   };
 
   nativeBuildInputs = [ yarn fixup_yarn_lock nodejs copyDesktopItems makeWrapper ];
@@ -102,7 +102,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Unofficial Microsoft Teams client for Linux";
     homepage = "https://github.com/IsmaelMartinez/teams-for-linux";
     license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ muscaln lilyinstarlight qjoly ];
+    maintainers = with lib.maintainers; [ muscaln lilyinstarlight qjoly chvp ];
     platforms = lib.platforms.unix;
     broken = stdenv.isDarwin;
   };
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
index c6191e8b477..e0d3a4171ca 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@@ -103,14 +103,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "4.11.6";
+  version = "4.11.8";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-GV5jaC1chm4cq097/aP18Z4QemTO4tt8SBrdxCQYaS8=";
+    hash = "sha256-VuMcqbGo1t1J7I8kXdqsw/01Mth9YKEbiy8aNtM3azw=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/seaweedfs/default.nix b/pkgs/applications/networking/seaweedfs/default.nix
index fe06e6a09a4..dd94e7bd88d 100644
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "seaweedfs";
-  version = "3.58";
+  version = "3.59";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
     repo = "seaweedfs";
     rev = version;
-    hash = "sha256-4USDCss2KYjyuwH55ZqMwBWsf7iDcjN7qxTSXvKDkus=";
+    hash = "sha256-askngehfEBJzJG0MVBA4WCRUPDELWlwJWcRPH6gTvzw=";
   };
 
-  vendorHash = "sha256-cbc6xKAneBCWpc4kUQUtgV5rrsggCGvVkt9tkypeCiE=";
+  vendorHash = "sha256-o+moq4arkQLQZcsW4Tahpv1MpGRHwMv+IL5E03W0U5c=";
 
   subPackages = [ "weed" ];
 
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 042f623366d..35c6620c34c 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -13,13 +13,13 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.26.0";
+      version = "1.26.1";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         rev = "v${version}";
-        hash = "sha256-JsjZzOYBQ5DD7BsBq/lO2AZvC3Rx4mGr5cUJEU6ufNc=";
+        hash = "sha256-R7JTHlNP1guKRfiDjPVi1lnvfUAXuPDNDAMTGmbj3Hc=";
       };
 
       vendorHash = "sha256-XYXIj+7xe33hCYM6Z9tqGSgr/P0LVlaPNf3T0PrxU7I=";
diff --git a/pkgs/applications/science/biology/picard-tools/default.nix b/pkgs/applications/science/biology/picard-tools/default.nix
index e0555055c1a..880ea77e9d2 100644
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "picard-tools";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "sha256-6nnKYnml6BjLb6aKNHbd55nH6gP/5Somo8poxx7yhVk=";
+    sha256 = "sha256-FcefUf0KwAEEn53XubrB2991ncsCMKicf20fJG6LurQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/science/electronics/kicad/addons/default.nix b/pkgs/applications/science/electronics/kicad/addons/default.nix
new file mode 100644
index 00000000000..5170e7efce3
--- /dev/null
+++ b/pkgs/applications/science/electronics/kicad/addons/default.nix
@@ -0,0 +1,5 @@
+{ kicad }:
+{
+  kikit = kicad.callPackage ./kikit.nix { addonName = "kikit"; };
+  kikit-library = kicad.callPackage ./kikit.nix { addonName = "kikit-library"; };
+}
diff --git a/pkgs/applications/science/electronics/kicad/addons/kikit.nix b/pkgs/applications/science/electronics/kicad/addons/kikit.nix
new file mode 100644
index 00000000000..6e5fc5ad967
--- /dev/null
+++ b/pkgs/applications/science/electronics/kicad/addons/kikit.nix
@@ -0,0 +1,52 @@
+# For building the multiple addons that are in the kikit repo.
+{ stdenv
+, bc
+, kikit
+, zip
+, python3
+, addonName
+, addonPath
+}:
+let
+  # This python is only used when building the package, it's not the python
+  # environment that will ultimately run the code packaged here. The python env defined
+  # in KiCad will import the python code packaged here when KiCad starts up.
+  python = python3.withPackages (ps: with ps; [ click ]);
+  kikit-module = python3.pkgs.toPythonModule (kikit.override { inherit python3; });
+
+  # The following different addons can be built from the same source.
+  targetSpecs = {
+    "kikit" = {
+      makeTarget = "pcm-kikit";
+      resultZip = "pcm-kikit.zip";
+      description = "KiCad plugin and a CLI tool to automate several tasks in a standard KiCad workflow";
+    };
+    "kikit-library" = {
+      makeTarget = "pcm-lib";
+      resultZip = "pcm-kikit-lib.zip";
+      description = "KiKit uses these symbols and footprints to annotate your boards (e.g., to place a tab in a panel).";
+    };
+  };
+  targetSpec = targetSpecs.${addonName};
+in
+stdenv.mkDerivation {
+  name = "kicadaddon-${addonName}";
+  inherit (kikit-module) src version;
+
+  nativeBuildInputs = [ python bc zip ];
+  propagatedBuildInputs = [ kikit-module ];
+
+  buildPhase = ''
+    patchShebangs scripts/setJson.py
+    make ${targetSpec.makeTarget}
+  '';
+
+  installPhase = ''
+    mkdir $out
+    mv build/${targetSpec.resultZip} $out/${addonPath}
+  '';
+
+  meta = kikit-module.meta // {
+    description = targetSpec.description;
+  };
+}
diff --git a/pkgs/applications/science/electronics/kicad/base.nix b/pkgs/applications/science/electronics/kicad/base.nix
index 3403e410cf8..a2e5bbe72a5 100644
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@@ -69,6 +69,8 @@ stdenv.mkDerivation rec {
   patches = [
     # upstream issue 12941 (attempted to upstream, but appreciably unacceptable)
     ./writable.patch
+    # https://gitlab.com/kicad/code/kicad/-/issues/15687
+    ./runtime_stock_data_path.patch
   ];
 
   # tagged releases don't have "unknown"
diff --git a/pkgs/applications/science/electronics/kicad/default.nix b/pkgs/applications/science/electronics/kicad/default.nix
index a49c813036d..c6c66839e4b 100644
--- a/pkgs/applications/science/electronics/kicad/default.nix
+++ b/pkgs/applications/science/electronics/kicad/default.nix
@@ -1,4 +1,6 @@
 { lib, stdenv
+, runCommand
+, newScope
 , fetchFromGitLab
 , gnome
 , dconf
@@ -11,6 +13,8 @@
 , callPackages
 , librsvg
 , cups
+, unzip
+, jq
 
 , pname ? "kicad"
 , stable ? true
@@ -18,6 +22,7 @@
 , libngspice
 , withScripting ? true
 , python3
+, addons ? [ ]
 , debug ? false
 , sanitizeAddress ? false
 , sanitizeThreads ? false
@@ -27,6 +32,14 @@
 , symlinkJoin
 }:
 
+# `addons`: https://dev-docs.kicad.org/en/addons/
+#
+# ```nix
+# kicad = pkgs.kicad.override {
+#   addons = with pkgs.kicadAddons; [ kikit kikit-library ];
+# };
+# ```
+
 # The `srcs` parameter can be used to override the kicad source code
 # and all libraries, which are otherwise inaccessible
 # to overlays since most of the kicad build expression has been
@@ -106,6 +119,32 @@ let
   wxGTK = wxGTK32;
   python = python3;
   wxPython = python.pkgs.wxPython_4_2;
+  addonPath = "addon.zip";
+  addonsDrvs = map (pkg: pkg.override { inherit addonPath python3; }) addons;
+
+  addonsJoined =
+    runCommand "addonsJoined"
+      {
+        inherit addonsDrvs;
+        nativeBuildInputs = [ unzip jq ];
+      } ''
+      mkdir $out
+
+      for pkg in $addonsDrvs; do
+        unzip $pkg/addon.zip -d unpacked
+
+        folder_name=$(jq .identifier unpacked/metadata.json --raw-output | tr . _)
+        for d in unpacked/*; do
+          if [ -d "$d" ]; then
+            dest=$out/share/kicad/scripting/$(basename $d)/$folder_name
+            mkdir -p $(dirname $dest)
+
+            mv $d $dest
+          fi
+        done
+        rm -r unpacked
+      done
+    '';
 
   inherit (lib) concatStringsSep flatten optionalString optionals;
 in
@@ -113,6 +152,7 @@ stdenv.mkDerivation rec {
 
   # Common libraries, referenced during runtime, via the wrapper.
   passthru.libraries = callPackages ./libraries.nix { inherit libSrc; };
+  passthru.callPackage = newScope { inherit addonPath python3; };
   base = callPackage ./base.nix {
     inherit stable baseName;
     inherit kicadSrc kicadVersion;
@@ -131,7 +171,7 @@ stdenv.mkDerivation rec {
   dontFixup = true;
 
   pythonPath = optionals (withScripting)
-    [ wxPython python.pkgs.six python.pkgs.requests ];
+    [ wxPython python.pkgs.six python.pkgs.requests ] ++ addonsDrvs;
 
   nativeBuildInputs = [ makeWrapper ]
     ++ optionals (withScripting)
@@ -164,6 +204,17 @@ stdenv.mkDerivation rec {
     "--set-default KICAD7_SYMBOL_DIR ${symbols}/share/kicad/symbols"
     "--set-default KICAD7_TEMPLATE_DIR ${template_dir}"
   ]
+  ++ optionals (addons != [ ]) (
+    let stockDataPath = symlinkJoin {
+      name = "kicad_stock_data_path";
+      paths = [
+        "${base}/share/kicad"
+        "${addonsJoined}/share/kicad"
+      ];
+    };
+    in
+    [ "--set-default NIX_KICAD7_STOCK_DATA_PATH ${stockDataPath}" ]
+  )
   ++ optionals (with3d)
   [
     "--set-default KICAD7_3DMODEL_DIR ${packages3d}/share/kicad/3dmodels"
diff --git a/pkgs/applications/science/electronics/kicad/runtime_stock_data_path.patch b/pkgs/applications/science/electronics/kicad/runtime_stock_data_path.patch
new file mode 100644
index 00000000000..16f7e493c62
--- /dev/null
+++ b/pkgs/applications/science/electronics/kicad/runtime_stock_data_path.patch
@@ -0,0 +1,15 @@
+diff --git a/common/paths.cpp b/common/paths.cpp
+index a74cdd9..790cc58 100644
+--- a/common/paths.cpp
++++ b/common/paths.cpp
+@@ -151,6 +151,10 @@ wxString PATHS::GetStockDataPath( bool aRespectRunFromBuildDir )
+ {
+     wxString path;
+
++    if( wxGetEnv( wxT( "NIX_KICAD7_STOCK_DATA_PATH" ), &path ) ) {
++        return path;
++    }
++
+     if( aRespectRunFromBuildDir && wxGetEnv( wxT( "KICAD_RUN_FROM_BUILD_DIR" ), nullptr ) )
+     {
+         // Allow debugging from build dir by placing relevant files/folders in the build root
diff --git a/pkgs/applications/science/electronics/verilator/default.nix b/pkgs/applications/science/electronics/verilator/default.nix
index 86d6716eaeb..0c2adf0907e 100644
--- a/pkgs/applications/science/electronics/verilator/default.nix
+++ b/pkgs/applications/science/electronics/verilator/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "verilator";
-  version = "5.016";
+  version = "5.018";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-MVQbAZXSIdzX7+yKbSrFLLd0j6dfLSXpES3uu6bcPt8=";
+    hash = "sha256-f06UzNw2MQ5me03EPrVFhkwxKum/GLDzQbDNTBsJMJs=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/science/logic/eprover/default.nix b/pkgs/applications/science/logic/eprover/default.nix
index 400d636346c..a79b74740e6 100644
--- a/pkgs/applications/science/logic/eprover/default.nix
+++ b/pkgs/applications/science/logic/eprover/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "eprover";
-  version = "2.6";
+  version = "3.0";
 
   src = fetchurl {
     url = "https://wwwlehre.dhbw-stuttgart.de/~sschulz/WORK/E_DOWNLOAD/V_${version}/E.tgz";
-    sha256 = "sha256-qh896qIpFR5g1gdWAwGkbNJLBqUQCeCpuoYHHkDXPt0=";
+    sha256 = "sha256-RJ2uc/GIWU/fDJijSzYS8GdL7zUkeExOLWXtTbi8ZLk=";
   };
 
   buildInputs = [ which ];
diff --git a/pkgs/applications/version-management/git-mit/default.nix b/pkgs/applications/version-management/git-mit/default.nix
index 0f630f049ba..36cda3dfc72 100644
--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "5.12.171";
+  version = "5.12.174";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-K2d12isOOPs8ba77VhQSXRHSYLZZIkZJlM9d3/G4nOo=";
+    hash = "sha256-juCiPulDVDDg9+DXUf9Gp/1lMoQ0NKLUTrzOqlv+32w=";
   };
 
-  cargoHash = "sha256-m5b57dJ6IRJ10eJRF5lj2+WiNswHxj08LgXz7KJiTaw=";
+  cargoHash = "sha256-Wtw7GBPUci4fbplQDtz1Yxrf+7+3ABIe7GPN/gUER6I=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/version-management/pijul/default.nix b/pkgs/applications/version-management/pijul/default.nix
index 1ea92e333d5..63f7bf7fbbe 100644
--- a/pkgs/applications/version-management/pijul/default.nix
+++ b/pkgs/applications/version-management/pijul/default.nix
@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pijul";
-  version = "1.0.0-beta.6";
+  version = "1.0.0-beta.7";
 
   src = fetchCrate {
     inherit version pname;
-    hash = "sha256-1cIb4QsDYlOCGrQrLgEwIjjHZ3WwD2o0o0bF+OOqEtI=";
+    hash = "sha256-BXDz9po8i937/xYoIW4S/FddtcWxSmtRUWYIphgh060=";
   };
 
-  cargoHash = "sha256-mRi0NUETTdYE/oM+Jo7gW/zNby8dPAKl6XhzP0Qzsf0=";
+  cargoHash = "sha256-+KF1G4bDfcjHHzZR93lIR8muO6s3j5jDobr3A7Arr+Q=";
 
   doCheck = false;
   nativeBuildInputs = [ installShellFiles pkg-config ];
diff --git a/pkgs/applications/version-management/sourcehut/default.nix b/pkgs/applications/version-management/sourcehut/default.nix
index 37840f486dc..8682057b783 100644
--- a/pkgs/applications/version-management/sourcehut/default.nix
+++ b/pkgs/applications/version-management/sourcehut/default.nix
@@ -1,4 +1,6 @@
-{ python3
+{ lib
+, stdenv
+, python3
 , callPackage
 , recurseIntoAttrs
 , nixosTests
@@ -35,7 +37,9 @@ let
           hash = "sha256-aRO4JH2KKS74MVFipRkx4rQM6RaB8bbxj2lwRSAMSjA=";
         };
         nativeCheckInputs = with super; [ pytestCheckHook mock ];
-        disabledTestPaths = [];
+        disabledTestPaths = []
+          # Disable incompatible tests on Darwin.
+          ++ lib.optionals stdenv.isDarwin [ "test/aaa_profiling" ];
       });
 
       flask-sqlalchemy = super.flask-sqlalchemy.overridePythonAttrs (oldAttrs: rec {
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-pipewire-audio-capture.nix b/pkgs/applications/video/obs-studio/plugins/obs-pipewire-audio-capture.nix
index ec9885fc7e7..622ba7d66e2 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-pipewire-audio-capture.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-pipewire-audio-capture.nix
@@ -32,10 +32,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = " Audio device and application capture for OBS Studio using PipeWire ";
+    description = "Audio device and application capture for OBS Studio using PipeWire";
     homepage = "https://github.com/dimtpap/obs-pipewire-audio-capture";
     maintainers = with maintainers; [ Elinvention ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = [ "x86_64-linux" "i686-linux" ];
   };
 }
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix b/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix
index 48ee9ee6394..9b7ec4090dd 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vaapi/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-vaapi";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "fzwoch";
     repo = pname;
     rev = version;
-    hash = "sha256-AbSI6HBdOEI54bUVqqF+b4LcCyzW30XlS9SXX2ajkas=";
+    hash = "sha256-PpGNLIOz+fCpcP/nvjcJ+1fkduxjcbZjb7yx8TUO25s=";
   };
 
   nativeBuildInputs = [ pkg-config meson ninja ];
diff --git a/pkgs/applications/video/ustreamer/default.nix b/pkgs/applications/video/ustreamer/default.nix
index 777a1ce0c7f..04c1296b0e3 100644
--- a/pkgs/applications/video/ustreamer/default.nix
+++ b/pkgs/applications/video/ustreamer/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ustreamer";
-  version = "5.42";
+  version = "5.45";
 
   src = fetchFromGitHub {
     owner = "pikvm";
     repo = "ustreamer";
     rev = "v${version}";
-    hash = "sha256-V4ScXzZwh3fWCWmeGeb1hce+INYBmf3wtemwNch5FjY=";
+    hash = "sha256-2WJXOv15oZRk2doecd+xOURygbX4oGyeMAJiiuiRBi4=";
   };
 
   buildInputs = [ libbsd libevent libjpeg ];
diff --git a/pkgs/applications/video/webtorrent_desktop/default.nix b/pkgs/applications/video/webtorrent_desktop/default.nix
index f5b90bb2c88..925fa38a199 100644
--- a/pkgs/applications/video/webtorrent_desktop/default.nix
+++ b/pkgs/applications/video/webtorrent_desktop/default.nix
@@ -1,15 +1,27 @@
-{ lib, stdenv, electron_22, buildNpmPackage, fetchFromGitHub }:
+{ lib, stdenv, electron, buildNpmPackage, fetchFromGitHub, fetchpatch }:
 
 buildNpmPackage {
   pname = "webtorrent-desktop";
-  version = "0.25-pre";
+  version = "0.25-pre-1eb612";
   src = fetchFromGitHub {
     owner = "webtorrent";
     repo = "webtorrent-desktop";
-    rev = "fce078defefd575cb35a5c79d3d9f96affc8a08f";
-    sha256 = "sha256-gXFiG36qqR0QHTqhaxgQKDO0UCHkJLnVwUTQB/Nct/c=";
+    rev = "1eb61201d6360698a2cc4ea72bf0fa7ee78b457c";
+    sha256 = "sha256-DBEFOamncyidMXypvKNnUmDIPUq1LzYjDgox7fa4+Gg=";
   };
-  npmDepsHash = "sha256-pEuvstrZ9oMdJ/iU6XwEQ1BYOyQp/ce6sYBTrMCjGMc=";
+  patches = [
+    # electron 27 fix
+    (fetchpatch {
+      url = "https://github.com/webtorrent/webtorrent-desktop/pull/2388.patch";
+      hash = "sha256-gam5oAZtsaiCNFwecA5ff0nhraySLx3SOHlb/js+cPM=";
+    })
+    # startup fix
+    (fetchpatch {
+      url = "https://github.com/webtorrent/webtorrent-desktop/pull/2389.patch";
+      hash = "sha256-hBJGLNNjcGRhYOFlLm/RL0po+70tEeJtR6Y/CfacPAI=";
+    })
+  ];
+  npmDepsHash = "sha256-tqhp3jDb1xtyV/n9kJtzkiznLQfqeYWeZiTnTVV0ibE=";
   makeCacheWritable = true;
   npmRebuildFlags = [ "--ignore-scripts" ];
   installPhase = ''
@@ -31,7 +43,7 @@ buildNpmPackage {
     cat > $out/bin/WebTorrent <<EOF
     #! ${stdenv.shell}
     set -eu
-    exec ${electron_22}/bin/electron --no-sandbox $out/lib/webtorrent-desktop "\$@"
+    exec ${electron}/bin/electron --no-sandbox $out/lib/webtorrent-desktop "\$@"
     EOF
     chmod +x $out/bin/WebTorrent
     cp -r static/linux/share/icons $out/share/
@@ -44,7 +56,7 @@ buildNpmPackage {
     description = "Streaming torrent app for Mac, Windows, and Linux";
     homepage = "https://webtorrent.io/desktop";
     license = licenses.mit;
-    maintainers = [ maintainers.flokli maintainers.bendlas ];
+    maintainers = [ maintainers.bendlas ];
   };
 
 }
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index e9873961641..a8c7d77da67 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -179,7 +179,7 @@ rec {
       makeWrapper pkg-config go-md2man go libtool installShellFiles
     ];
 
-    buildInputs = plugins ++ lib.optionals (lib.versionAtLeast version "23") [
+    buildInputs = plugins ++ lib.optionals (lib.versionAtLeast version "23" && stdenv.isLinux) [
       glibc
       glibc.static
     ];
diff --git a/pkgs/applications/virtualization/virt-manager/default.nix b/pkgs/applications/virtualization/virt-manager/default.nix
index 4e4d7e7d0a9..b3225633289 100644
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub, python3, intltool, file, wrapGAppsHook, gtk-vnc
 , vte, avahi, dconf, gobject-introspection, libvirt-glib, system-libvirt
-, gsettings-desktop-schemas, libosinfo, gnome, gtksourceview4, docutils, cpio
+, gsettings-desktop-schemas, gst_all_1, libosinfo, gnome, gtksourceview4, docutils, cpio
 , e2fsprogs, findutils, gzip, cdrtools, xorriso, fetchpatch
 , desktopToDarwinBundle, stdenv
 , spiceSupport ? true, spice-gtk ? null
@@ -21,10 +21,12 @@ python3.pkgs.buildPythonApplication rec {
     intltool file
     gobject-introspection # for setup hook populating GI_TYPELIB_PATH
     docutils
+    wrapGAppsHook
   ] ++ lib.optional stdenv.isDarwin desktopToDarwinBundle;
 
   buildInputs = [
-    wrapGAppsHook
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
     libvirt-glib vte dconf gtk-vnc gnome.adwaita-icon-theme avahi
     gsettings-desktop-schemas libosinfo gtksourceview4
   ] ++ lib.optional spiceSupport spice-gtk;
diff --git a/pkgs/build-support/build-graalvm-native-image/default.nix b/pkgs/build-support/build-graalvm-native-image/default.nix
index e25a7140508..6a5e82427f7 100644
--- a/pkgs/build-support/build-graalvm-native-image/default.nix
+++ b/pkgs/build-support/build-graalvm-native-image/default.nix
@@ -3,7 +3,6 @@
 , glibcLocales
   # The GraalVM derivation to use
 , graalvmDrv
-, name ? "${args.pname}-${args.version}"
 , executable ? args.pname
   # JAR used as input for GraalVM derivation, defaults to src
 , jar ? args.src
@@ -15,13 +14,13 @@
     "-H:Name=${executable}"
     "-march=compatibility"
     "--verbose"
+    "-J-Dsun.stdout.encoding=UTF-8"
+    "-J-Dsun.stderr.encoding=UTF-8"
   ]
   # Extra arguments to be passed to the native-image
 , extraNativeImageBuildArgs ? [ ]
   # XMX size of GraalVM during build
 , graalvmXmx ? "-J-Xmx6g"
-  # Locale to be used by GraalVM compiler
-, LC_ALL ? "en_US.UTF-8"
 , meta ? { }
 , ...
 } @ args:
@@ -41,7 +40,7 @@ let
   ];
 in
 stdenv.mkDerivation ({
-  inherit dontUnpack LC_ALL jar;
+  inherit dontUnpack jar;
 
   nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [ graalvmDrv glibcLocales ];
 
diff --git a/pkgs/build-support/node/build-npm-package/default.nix b/pkgs/build-support/node/build-npm-package/default.nix
index 9babc7ae628..2aefab8ac7a 100644
--- a/pkgs/build-support/node/build-npm-package/default.nix
+++ b/pkgs/build-support/node/build-npm-package/default.nix
@@ -35,16 +35,15 @@
   # Value for npm `--workspace` flag and directory in which the files to be installed are found.
 , npmWorkspace ? null
 , nodejs ? topLevelArgs.nodejs
+, npmDeps ?  fetchNpmDeps {
+  inherit forceGitDeps src srcs sourceRoot prePatch patches postPatch;
+  name = "${name}-npm-deps";
+  hash = npmDepsHash;
+}
 , ...
 } @ args:
 
 let
-  npmDeps = fetchNpmDeps {
-    inherit forceGitDeps src srcs sourceRoot prePatch patches postPatch;
-    name = "${name}-npm-deps";
-    hash = npmDepsHash;
-  };
-
   # .override {} negates splicing, so we need to use buildPackages explicitly
   npmHooks = buildPackages.npmHooks.override {
     inherit nodejs;
diff --git a/pkgs/by-name/as/ast-grep/package.nix b/pkgs/by-name/as/ast-grep/package.nix
index 68e9ebd5f4d..b1979b00b08 100644
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ast-grep";
-  version = "0.12.5";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     rev = version;
-    hash = "sha256-oFe3AbMpBVBAm/W4IowXAKcEN7CDrrAXhx4dzMXppUM=";
+    hash = "sha256-Wee+npgL0+7pv9ph3S93fIXr8z/FWp/TBthJhVSx3zI=";
   };
 
-  cargoHash = "sha256-f4tcJqT3l9G6FimBb0D4PATgQYUkSG5uIQ9BbsbgC/U=";
+  cargoHash = "sha256-OFNqBkPAKaSqDQUWisupj6FlDbm3kw0xq5nbvj04H5U=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index e2e5443991d..96098d190bb 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.15.3";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-V0PuiF8N5ubNO4/EmGFx6qL0k1ziTVVKe+0rpMTMVlg=";
+    hash = "sha256-q72IIKUWZBroDcxMEa1ppTPda9lg/KtEpCNOqlg9ZhU=";
   };
 
-  cargoHash = "sha256-kO4WxTDVmLlQpYuFbohih+4Hct2AmnO802Veuw2Wj2g=";
+  cargoHash = "sha256-UBayjaQX+bRkciookfQYUrCCewMXlIL3Z1I2ZJIbX6o=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/fo/fortune-kind/package.nix b/pkgs/by-name/fo/fortune-kind/package.nix
index 536710faee5..1378e40f52d 100644
--- a/pkgs/by-name/fo/fortune-kind/package.nix
+++ b/pkgs/by-name/fo/fortune-kind/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fortune-kind";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "cafkafk";
     repo = "fortune-kind";
     rev = "v${version}";
-    hash = "sha256-8xXRIp6fNYo0Eylzz+i+YccEJZjqiT0TxguZheIblns=";
+    hash = "sha256-93BEy9FX3bZTYNewotBv1ejmMSnSdu9XnC4TgIvcYG0=";
   };
 
-  cargoHash = "sha256-v1LmZRuknWFAwwuw4U7Y7jnhBi8UkglY0sege9nSKes=";
+  cargoHash = "sha256-xm6BOYnxUoCRuMAAFyWRcKEcqrs5FmnOgIO/Gj1bCoI=";
 
   nativeBuildInputs = [ makeBinaryWrapper installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
diff --git a/pkgs/by-name/ki/kikit/default.nix b/pkgs/by-name/ki/kikit/default.nix
new file mode 100644
index 00000000000..45209545aa3
--- /dev/null
+++ b/pkgs/by-name/ki/kikit/default.nix
@@ -0,0 +1,87 @@
+{ bc
+, zip
+, lib
+, fetchFromGitHub
+, bats
+, buildPythonApplication
+, pythonOlder
+, callPackage
+, kicad
+, numpy
+, click
+, markdown2
+, pytestCheckHook
+, commentjson
+, wxPython_4_2
+, pcbnew-transition
+, pybars3
+, versioneer
+}:
+let
+  solidpython = callPackage ./solidpython { };
+
+  # https://github.com/yaqwsx/KiKit/issues/574
+  # copy-pasted from nixpkgs#8d8e62e74f511160a599471549a98bc9e4f4818d
+  shapely = callPackage ./shapely { };
+in
+buildPythonApplication rec {
+  pname = "kikit";
+  version = "1.3.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "yaqwsx";
+    repo = "KiKit";
+    rev = "v${version}";
+    hash = "sha256-kDTPk/R3eZtm4DjoUV4tSQzjGQ9k8MKQedX4oUXYzeo=";
+  };
+
+  propagatedBuildInputs = [
+    kicad
+    numpy
+    click
+    markdown2
+    commentjson
+    # https://github.com/yaqwsx/KiKit/issues/575
+    wxPython_4_2
+    pcbnew-transition
+    pybars3
+    shapely
+    # https://github.com/yaqwsx/KiKit/issues/576
+    solidpython
+  ];
+
+  nativeBuildInputs = [
+    versioneer
+    bc
+    zip
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    bats
+  ];
+
+  pythonImportsCheck = [
+    "kikit"
+  ];
+
+  preCheck = ''
+    export PATH=$PATH:$out/bin
+
+    make test-system
+
+    # pytest needs to run in a subdir. See https://github.com/yaqwsx/KiKit/blob/v1.3.0/Makefile#L43
+    cd test/units
+  '';
+
+  meta = with lib; {
+    description = "Automation for KiCAD boards";
+    homepage = "https://github.com/yaqwsx/KiKit/";
+    changelog = "https://github.com/yaqwsx/KiKit/releases/tag/v${version}";
+    maintainers = with maintainers; [ jfly matusf ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/by-name/ki/kikit/package.nix b/pkgs/by-name/ki/kikit/package.nix
new file mode 100644
index 00000000000..5f1daa8aa5c
--- /dev/null
+++ b/pkgs/by-name/ki/kikit/package.nix
@@ -0,0 +1,2 @@
+{ python3 }:
+(python3.pkgs.callPackage ./default.nix { })
diff --git a/pkgs/by-name/ki/kikit/shapely/default.nix b/pkgs/by-name/ki/kikit/shapely/default.nix
new file mode 100644
index 00000000000..7f136a1338a
--- /dev/null
+++ b/pkgs/by-name/ki/kikit/shapely/default.nix
@@ -0,0 +1,71 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, substituteAll
+, pythonOlder
+, geos
+, pytestCheckHook
+, cython
+, numpy
+}:
+
+buildPythonPackage rec {
+  pname = "Shapely";
+  version = "1.8.4";
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-oZXlHKr6IYKR8suqP+9p/TNTyT7EtlsqRyLEz0DDGYw=";
+  };
+
+  nativeBuildInputs = [
+    geos # for geos-config
+    cython
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  # Environment variable used in shapely/_buildcfg.py
+  GEOS_LIBRARY_PATH = "${geos}/lib/libgeos_c${stdenv.hostPlatform.extensions.sharedLibrary}";
+
+  patches = [
+    # Patch to search form GOES .so/.dylib files in a Nix-aware way
+    (substituteAll {
+      src = ./library-paths.patch;
+      libgeos_c = GEOS_LIBRARY_PATH;
+      libc = lib.optionalString (!stdenv.isDarwin) "${stdenv.cc.libc}/lib/libc${stdenv.hostPlatform.extensions.sharedLibrary}.6";
+    })
+  ];
+
+  preCheck = ''
+    rm -r shapely # prevent import of local shapely
+  '';
+
+  disabledTests = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+    # FIXME(lf-): these logging tests are broken, which is definitely our
+    # fault. I've tried figuring out the cause and failed.
+    #
+    # It is apparently some sandbox or no-sandbox related thing on macOS only
+    # though.
+    "test_error_handler_exception"
+    "test_error_handler"
+    "test_info_handler"
+  ];
+
+  pythonImportsCheck = [ "shapely" ];
+
+  meta = with lib; {
+    description = "Geometric objects, predicates, and operations";
+    homepage = "https://pypi.python.org/pypi/Shapely/";
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ knedlsepp ];
+  };
+}
diff --git a/pkgs/by-name/ki/kikit/shapely/library-paths.patch b/pkgs/by-name/ki/kikit/shapely/library-paths.patch
new file mode 100644
index 00000000000..12f93e757f9
--- /dev/null
+++ b/pkgs/by-name/ki/kikit/shapely/library-paths.patch
@@ -0,0 +1,31 @@
+diff --git a/shapely/geos.py b/shapely/geos.py
+index 88c5f53..1ccd6e4 100644
+--- a/shapely/geos.py
++++ b/shapely/geos.py
+@@ -96,6 +96,7 @@ if sys.platform.startswith('linux'):
+         alt_paths = [
+             'libgeos_c.so.1',
+             'libgeos_c.so',
++            '@libgeos_c@',
+         ]
+         _lgeos = load_dll('geos_c', fallbacks=alt_paths)
+
+@@ -160,6 +161,7 @@ elif sys.platform == 'darwin':
+             "/usr/local/lib/libgeos_c.dylib",
+             # homebrew Apple Silicon
+             "/opt/homebrew/lib/libgeos_c.dylib",
++            "@libgeos_c@",
+         ]
+         _lgeos = load_dll('geos_c', fallbacks=alt_paths)
+
+diff --git a/tests/test_dlls.py b/tests/test_dlls.py
+index c71da8e..c36262c 100644
+--- a/tests/test_dlls.py
++++ b/tests/test_dlls.py
+@@ -18,4 +18,5 @@ class LoadingTestCase(unittest.TestCase):
+             '/opt/homebrew/lib/libgeos_c.dylib',  # homebrew (macOS)
+             os.path.join(sys.prefix, "lib", "libgeos_c.so"), # anaconda (Linux)
+             'libgeos_c.so.1',
+-            'libgeos_c.so'])
++            'libgeos_c.so',
++            '@libgeos_c@'])
diff --git a/pkgs/by-name/ki/kikit/solidpython/default.nix b/pkgs/by-name/ki/kikit/solidpython/default.nix
new file mode 100644
index 00000000000..c03637907a3
--- /dev/null
+++ b/pkgs/by-name/ki/kikit/solidpython/default.nix
@@ -0,0 +1,66 @@
+# SolidPython is an unmaintained library with old dependencies.
+{ buildPythonPackage
+, callPackage
+, fetchFromGitHub
+, fetchFromGitLab
+, fetchpatch
+, lib
+, pythonRelaxDepsHook
+
+, poetry-core
+, prettytable
+, pypng
+, ply
+, setuptools
+, euclid3
+}:
+buildPythonPackage rec {
+  pname = "solidpython";
+  version = "1.1.3";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "SolidCode";
+    repo = "SolidPython";
+    rev = "d962740d600c5dfd69458c4559fc416b9beab575";
+    hash = "sha256-3fJta2a5c8hV9FPwKn5pj01aBtsCGSRCz3vvxR/5n0Q=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = [
+    ply
+    setuptools
+    euclid3
+
+    prettytable
+  ];
+
+  pythonRelaxDeps = [
+    # SolidPython has PrettyTable pinned to a hyper-specific version due to
+    # some ancient bug with Poetry. They aren't interested in unpinning because
+    # SolidPython v1 seems to be deprecated in favor of v2:
+    # https://github.com/SolidCode/SolidPython/issues/207
+    "PrettyTable"
+  ];
+
+  pythonRemoveDeps = [
+    # The pypng dependency is only used in an example script.
+    "pypng"
+  ];
+
+  pythonImportsCheck = [
+    "solid"
+  ];
+
+  meta = with lib; {
+    description = "Python interface to the OpenSCAD declarative geometry language";
+    homepage = "https://github.com/SolidCode/SolidPython";
+    changelog = "https://github.com/SolidCode/SolidPython/releases/tag/v${version}";
+    maintainers = with maintainers; [ jfly ];
+    license = licenses.lgpl21Plus;
+  };
+}
diff --git a/pkgs/by-name/lc/lcab/package.nix b/pkgs/by-name/lc/lcab/package.nix
new file mode 100644
index 00000000000..54f6159ab15
--- /dev/null
+++ b/pkgs/by-name/lc/lcab/package.nix
@@ -0,0 +1,32 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lcab";
+  version = "1.0b12";
+
+  src = fetchurl {
+    # Original site is no longer available
+    url = "http://deb.debian.org/debian/pool/main/l/lcab/lcab_${finalAttrs.version}.orig.tar.gz";
+    hash = "sha256-Bl8sF5O2XyhHHA9xt88SCnBk8o0cRLB8q/SewOl/H8g=";
+  };
+
+  patches = [
+    # Fix version number
+    (fetchurl {
+      url = "https://salsa.debian.org/debian/lcab/-/raw/f72d6db6504123bd124b1a4be21ead8cc1535c9e/debian/patches/20-version.patch";
+      hash = "sha256-Yb6E8nQVdicmjcGnxR7HHdsd7D+ThXk02UHiaB+PLvE=";
+    })
+  ];
+
+  meta = with lib; {
+    description = "Create cabinet (.cab) archives";
+    homepage = "http://ohnopub.net/~ohnobinki/lcab";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ emilytrau ];
+    platforms = platforms.unix;
+    mainProgram = "lcab";
+  };
+})
diff --git a/pkgs/by-name/ln/lngen/package.nix b/pkgs/by-name/ln/lngen/package.nix
new file mode 100644
index 00000000000..1b06a5b1966
--- /dev/null
+++ b/pkgs/by-name/ln/lngen/package.nix
@@ -0,0 +1,23 @@
+{ lib
+, haskellPackages
+, fetchFromGitHub
+}:
+
+haskellPackages.mkDerivation {
+  pname = "lngen";
+  version = "unstable-2023-10-17";
+  src = fetchFromGitHub {
+    owner = "plclub";
+    repo = "lngen";
+    rev = "c7645001404e0e2fec2c56f128e30079b5b3fac6";
+    hash = "sha256-2vUYHtl9yAadwdTtsjTI0klP+nRSYGXVpaSwD9EBTTI=";
+  };
+  isLibrary = true;
+  isExecutable = true;
+  libraryHaskellDepends = with haskellPackages; [ base syb parsec containers mtl ];
+  executableHaskellDepends = with haskellPackages; [ base ];
+  homepage = "https://github.com/plclub/lngen";
+  description = "Tool for generating Locally Nameless definitions and proofs in Coq, working together with Ott";
+  maintainers = with lib.maintainers; [ chen ];
+  license = lib.licenses.mit;
+}
diff --git a/pkgs/by-name/ni/nix-search-cli/package.nix b/pkgs/by-name/ni/nix-search-cli/package.nix
new file mode 100644
index 00000000000..56bde6ac04c
--- /dev/null
+++ b/pkgs/by-name/ni/nix-search-cli/package.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, unstableGitUpdater
+}:
+
+buildGoModule {
+  pname = "nix-search-cli";
+  version = "unstable-2023-09-12";
+
+  src = fetchFromGitHub {
+    owner = "peterldowns";
+    repo = "nix-search-cli";
+    rev = "f3f1c53c72dadac06472a7112aeb486ab5dda695";
+    hash = "sha256-YM1Lf7py79rU8aJE0PfQaMr5JWx5J1covUf1aCjRkc8=";
+  };
+
+  vendorHash = "sha256-JDOu7YdX9ztMZt0EFAMz++gD7n+Mn1VOe5g6XwrgS5M=";
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "CLI for searching packages on search.nixos.org";
+    homepage = "https://github.com/peterldowns/nix-search-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ donovanglover ];
+    platforms = platforms.all;
+    mainProgram = "nix-search";
+  };
+}
diff --git a/pkgs/applications/networking/p2p/rqbit/default.nix b/pkgs/by-name/rq/rqbit/package.nix
index a60b3e9ddf7..0505cbb1b69 100644
--- a/pkgs/applications/networking/p2p/rqbit/default.nix
+++ b/pkgs/by-name/rq/rqbit/package.nix
@@ -1,22 +1,22 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, pkg-config, openssl, Security }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, pkg-config, openssl, darwin }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rqbit";
-  version = "2.2.1";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "ikatson";
     repo = "rqbit";
     rev = "v${version}";
-    hash = "sha256-7n+T+y60RjmZC7bE96Ljg0xVg4bSzV/LFgezTld4zfI=";
+    hash = "sha256-9yYHxlvRlO8iJ3SPi0+4lEgBgAaqaDffKChqAe4OsYU=";
   };
 
-  cargoHash = "sha256-hcuZ4hqGJT/O7vFefKPGZlkqhdsAl5LGAcSRQAEopnM=";
+  cargoHash = "sha256-dUQiW6J3Wycp5D3mAwGwruU6CkQ534OyP1GdsY7jzEw=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
   buildInputs = lib.optionals stdenv.isLinux [ openssl ]
-    ++ lib.optionals stdenv.isDarwin [ Security ];
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];
 
   doCheck = false;
 
@@ -25,5 +25,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/ikatson/rqbit";
     license = licenses.asl20;
     maintainers = with maintainers; [ marsam ];
+    mainProgram = "rqbit";
   };
 }
diff --git a/pkgs/by-name/rt/rtl-sdr-osmocom/package.nix b/pkgs/by-name/rt/rtl-sdr-osmocom/package.nix
new file mode 100644
index 00000000000..9f88ebd503a
--- /dev/null
+++ b/pkgs/by-name/rt/rtl-sdr-osmocom/package.nix
@@ -0,0 +1,53 @@
+{ lib
+, stdenv
+, fetchFromGitea
+, cmake
+, pkg-config
+, libusb1
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rtl-sdr-osmocom";
+  version = "2.0.1";
+
+  src = fetchFromGitea {
+    domain = "gitea.osmocom.org";
+    owner = "sdr";
+    repo = "rtl-sdr";
+    rev = "v${version}";
+    hash = "sha256-+RYSCn+wAkb9e7NRI5kLY8a6OXtJu7QcSUht1R6wDX0=";
+  };
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace '/etc/udev/rules.d' "$out/etc/udev/rules.d" \
+      --replace "VERSION_INFO_PATCH_VERSION git" "VERSION_INFO_PATCH_VERSION ${lib.versions.patch version}"
+
+    substituteInPlace rtl-sdr.rules \
+      --replace 'MODE:="0666"' 'ENV{ID_SOFTWARE_RADIO}="1", MODE="0660", GROUP="plugdev"'
+  '';
+
+  nativeBuildInputs = [ pkg-config cmake ];
+
+  propagatedBuildInputs = [ libusb1 ];
+
+  cmakeFlags = lib.optionals stdenv.isLinux [
+    "-DINSTALL_UDEV_RULES=ON"
+    "-DWITH_RPC=ON"
+  ];
+
+  meta = with lib; {
+    description = "Software to turn the RTL2832U into a SDR receiver";
+    longDescription = ''
+    This packages the rtl-sdr library by the Osmocom project. This is the upstream codebase of the unsuffixed "rtl-sdr" package, which is a downstream fork. A list of differences can be found here:
+    https://github.com/librtlsdr/librtlsdr/blob/master/README_improvements.md
+
+    The Osmocom upstream has a regular release schedule, so this package will likely support newer SDR dongles. It should be compatible with most software that currently depends on the "rtl-sdr" nixpkg, but comptabiliy should be manually confirmed.
+    '';
+    homepage = "https://gitea.osmocom.org/sdr/rtl-sdr";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ skovati ];
+    platforms = platforms.unix;
+    mainProgram = "rtl_sdr";
+  };
+}
diff --git a/pkgs/by-name/se/seclists/package.nix b/pkgs/by-name/se/seclists/package.nix
index d01328a1841..f452eb313f5 100644
--- a/pkgs/by-name/se/seclists/package.nix
+++ b/pkgs/by-name/se/seclists/package.nix
@@ -5,13 +5,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "seclists";
-  version = "2023.2";
+  version = "2023.3";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "SecLists";
-    rev = "2023.2";
-    hash = "sha256-yVxb5GaQDuCsyjIV+oZzNUEFoq6gMPeaIeQviwGdAgY=";
+    rev = "2023.3";
+    hash = "sha256-mJgCzp8iKzSWf4Tud5xDpnuY4aNJmnEo/hTcuGTaOWM=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/sy/symbolicator/Cargo.lock b/pkgs/by-name/sy/symbolicator/Cargo.lock
index 1752195bb12..29b24ea9cc7 100644
--- a/pkgs/by-name/sy/symbolicator/Cargo.lock
+++ b/pkgs/by-name/sy/symbolicator/Cargo.lock
@@ -222,7 +222,7 @@ dependencies = [
  "hex",
  "http",
  "hyper",
- "ring",
+ "ring 0.16.20",
  "time",
  "tokio",
  "tower",
@@ -287,9 +287,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-s3"
-version = "0.31.2"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c681fef332c3462634cd97fced8d1ac3cfdf790829bd7bfb4006cfba76712053"
+checksum = "73018483d9cb78e1a0d4dcbc94327b01d532e7cb28f26c5bceff97f8f0e4c6eb"
 dependencies = [
  "aws-credential-types",
  "aws-http",
@@ -675,12 +675,6 @@ dependencies = [
 
 [[package]]
 name = "base64"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
-
-[[package]]
-name = "base64"
 version = "0.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ba43ea6f343b788c8764558649e08df62f86c6ef251fdaeb1ffd010a9ae50a2"
@@ -810,9 +804,9 @@ checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
 
 [[package]]
 name = "bytecount"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad152d03a2c813c80bb94fedbf3a3f02b28f793e39e7c214c8a0bcc196343de7"
+checksum = "d1a12477b7237a01c11a80a51278165f9ba0edd28fa6db00a65ab230320dc58c"
 
 [[package]]
 name = "byteorder"
@@ -1054,9 +1048,9 @@ dependencies = [
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.9"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
+checksum = "3fbc60abd742b35f2492f808e1abbb83d45f72db402e14c55057edc9c7b1e9e4"
 dependencies = [
  "libc",
 ]
@@ -1567,11 +1561,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d3b20d3058763d26d88e6e7a49998841e5296735b00dbfb064ff7cb142933dd"
 dependencies = [
  "async-trait",
- "base64 0.21.4",
+ "base64",
  "dirs-next",
  "hyper",
  "hyper-rustls",
- "ring",
+ "ring 0.16.20",
  "rustls",
  "rustls-pemfile",
  "serde",
@@ -1660,9 +1654,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.14.1"
+version = "0.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dfda62a12f55daeae5015f81b0baea145391cb4520f86c248fc615d72640d12"
+checksum = "f93e7192158dbcda357bdec5fb5788eebf8bbac027f3f33e719d29135ae84156"
 
 [[package]]
 name = "heck"
@@ -1784,7 +1778,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2 0.4.9",
+ "socket2 0.4.10",
  "tokio",
  "tower-service",
  "tracing",
@@ -1822,16 +1816,16 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.57"
+version = "0.1.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fad5b825842d2b38bd206f3e81d6957625fd7f0a361e345c30e01a0ae2dd613"
+checksum = "8326b86b6cff230b97d0d312a6c40a60726df3332e721f72a1b035f451663b20"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
  "iana-time-zone-haiku",
  "js-sys",
  "wasm-bindgen",
- "windows",
+ "windows-core",
 ]
 
 [[package]]
@@ -1893,7 +1887,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8adf3ddd720272c6ea8bf59463c04e0f93d0bbf7c5439b691bca2987e0270897"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.1",
+ "hashbrown 0.14.2",
 ]
 
 [[package]]
@@ -1936,7 +1930,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
 dependencies = [
- "socket2 0.5.4",
+ "socket2 0.5.5",
  "widestring",
  "windows-sys 0.48.0",
  "winreg",
@@ -1944,9 +1938,9 @@ dependencies = [
 
 [[package]]
 name = "ipnet"
-version = "2.8.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28b29a3cd74f0f4598934efe3aeba42bae0eb4680554128851ebbecb02af14e6"
+checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
 [[package]]
 name = "ipnetwork"
@@ -2057,13 +2051,13 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "8.3.0"
+version = "9.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6971da4d9c3aa03c3d8f3ff0f4155b534aad021292003895a469716b2a230378"
+checksum = "155c4d7e39ad04c172c5e3a99c434ea3b4a7ba7960b38ecd562b270b097cce09"
 dependencies = [
- "base64 0.21.4",
+ "base64",
  "pem",
- "ring",
+ "ring 0.17.5",
  "serde",
  "serde_json",
  "simple_asn1",
@@ -2190,9 +2184,9 @@ checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"
 
 [[package]]
 name = "lock_api"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -2707,7 +2701,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
 dependencies = [
  "lock_api",
- "parking_lot_core 0.9.8",
+ "parking_lot_core 0.9.9",
 ]
 
 [[package]]
@@ -2726,13 +2720,13 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.3.5",
+ "redox_syscall 0.4.1",
  "smallvec",
  "windows-targets 0.48.5",
 ]
@@ -2770,11 +2764,12 @@ checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
 
 [[package]]
 name = "pem"
-version = "1.1.1"
+version = "3.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8835c273a76a90455d7344889b0964598e3316e2a79ede8e36f16bdcf2228b8"
+checksum = "3163d2912b7c3b52d651a055f2c7eec9ba5cd22d26ef75b8dd3a59980b185923"
 dependencies = [
- "base64 0.13.1",
+ "base64",
+ "serde",
 ]
 
 [[package]]
@@ -2955,7 +2950,7 @@ dependencies = [
 
 [[package]]
 name = "process-event"
-version = "23.10.1"
+version = "23.11.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -3114,6 +3109,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "redox_syscall"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
 name = "redox_users"
 version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3174,7 +3178,7 @@ version = "0.11.18"
 source = "git+https://github.com/getsentry/reqwest?branch=restricted-connector#04ea4c720aca814c3f1de500b3e6fe3b0feeae4c"
 dependencies = [
  "async-compression",
- "base64 0.21.4",
+ "base64",
  "bytes",
  "encoding_rs",
  "futures-core",
@@ -3229,12 +3233,26 @@ dependencies = [
  "libc",
  "once_cell",
  "spin 0.5.2",
- "untrusted",
+ "untrusted 0.7.1",
  "web-sys",
  "winapi",
 ]
 
 [[package]]
+name = "ring"
+version = "0.17.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb0205304757e5d899b9c2e448b867ffd03ae7f988002e47cd24954391394d0b"
+dependencies = [
+ "cc",
+ "getrandom",
+ "libc",
+ "spin 0.9.8",
+ "untrusted 0.9.0",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
 name = "rustc-demangle"
 version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3266,9 +3284,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.19"
+version = "0.38.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "745ecfa778e66b2b63c88a61cb36e0eea109e803b0b86bf9879fbc77c70e86ed"
+checksum = "67ce50cb2e16c2903e30d1cbccfd8387a74b9d4c938b6a4c5ec6cc7556f7a8a0"
 dependencies = [
  "bitflags 2.4.1",
  "errno",
@@ -3284,7 +3302,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cd8d6c9f025a446bc4d18ad9632e69aec8f287aa84499ee335599fabd20c3fd8"
 dependencies = [
  "log",
- "ring",
+ "ring 0.16.20",
  "rustls-webpki",
  "sct",
 ]
@@ -3307,7 +3325,7 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d3987094b1d07b653b7dfdc3f70ce9a1da9c51ac18c1b06b662e4f9a0e9f4b2"
 dependencies = [
- "base64 0.21.4",
+ "base64",
 ]
 
 [[package]]
@@ -3316,8 +3334,8 @@ version = "0.101.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c7d5dece342910d9ba34d259310cae3e0154b873b35408b787b59bce53d34fe"
 dependencies = [
- "ring",
- "untrusted",
+ "ring 0.16.20",
+ "untrusted 0.7.1",
 ]
 
 [[package]]
@@ -3388,8 +3406,8 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
 dependencies = [
- "ring",
- "untrusted",
+ "ring 0.16.20",
+ "untrusted 0.7.1",
 ]
 
 [[package]]
@@ -3795,9 +3813,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64a4a911eed85daf18834cfaa86a79b7d266ff93ff5ba14005426219480ed662"
+checksum = "9f7916fc008ca5542385b89a3d3ce689953c143e9304a9bf8beec1de48994c0d"
 dependencies = [
  "libc",
  "winapi",
@@ -3805,9 +3823,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.5.4"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4031e820eb552adee9295814c0ced9e5cf38ddf1e8b7d566d6de8e2538ea989e"
+checksum = "7b5fac59a5cb5dd637972e5fca70daf0523c9067fcdc4842f053dae04a18f8e9"
 dependencies = [
  "libc",
  "windows-sys 0.48.0",
@@ -4200,7 +4218,7 @@ dependencies = [
 
 [[package]]
 name = "symbolicator"
-version = "23.10.1"
+version = "23.11.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -4238,7 +4256,7 @@ dependencies = [
 
 [[package]]
 name = "symbolicator-crash"
-version = "23.10.1"
+version = "23.11.0"
 dependencies = [
  "bindgen",
  "cmake",
@@ -4246,7 +4264,7 @@ dependencies = [
 
 [[package]]
 name = "symbolicator-js"
-version = "23.10.1"
+version = "23.11.0"
 dependencies = [
  "data-url",
  "futures",
@@ -4272,7 +4290,7 @@ dependencies = [
 
 [[package]]
 name = "symbolicator-native"
-version = "23.10.1"
+version = "23.11.0"
 dependencies = [
  "anyhow",
  "apple-crash-report-parser",
@@ -4303,7 +4321,7 @@ dependencies = [
 
 [[package]]
 name = "symbolicator-service"
-version = "23.10.1"
+version = "23.11.0"
 dependencies = [
  "anyhow",
  "aws-config",
@@ -4347,7 +4365,7 @@ dependencies = [
 
 [[package]]
 name = "symbolicator-sources"
-version = "23.10.1"
+version = "23.11.0"
 dependencies = [
  "anyhow",
  "aws-types",
@@ -4362,7 +4380,7 @@ dependencies = [
 
 [[package]]
 name = "symbolicator-stress"
-version = "23.10.1"
+version = "23.11.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -4384,7 +4402,7 @@ dependencies = [
 
 [[package]]
 name = "symbolicator-test"
-version = "23.10.1"
+version = "23.11.0"
 dependencies = [
  "axum",
  "humantime",
@@ -4402,7 +4420,7 @@ dependencies = [
 
 [[package]]
 name = "symbolicli"
-version = "23.10.1"
+version = "23.11.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -4427,7 +4445,7 @@ dependencies = [
 
 [[package]]
 name = "symsorter"
-version = "23.10.1"
+version = "23.11.0"
 dependencies = [
  "anyhow",
  "chrono",
@@ -4525,18 +4543,18 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.49"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1177e8c6d7ede7afde3585fd2513e611227efd6481bd78d2e82ba1ce16557ed4"
+checksum = "f9a7210f5c9a7156bb50aa36aed4c95afb51df0df00713949448cf9e97d382d2"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.49"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10712f02019e9288794769fba95cd6847df9874d49d871d062172f9dd41bc4cc"
+checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4611,7 +4629,7 @@ dependencies = [
  "mio 0.8.8",
  "num_cpus",
  "pin-project-lite",
- "socket2 0.5.4",
+ "socket2 0.5.5",
  "tokio-macros",
  "windows-sys 0.48.0",
 ]
@@ -4773,9 +4791,9 @@ checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
 
 [[package]]
 name = "tracing"
-version = "0.1.39"
+version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee2ef2af84856a50c1d430afce2fdded0a4ec7eda868db86409b4543df0797f9"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
  "log",
  "pin-project-lite",
@@ -5006,12 +5024,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
 
 [[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
 name = "ureq"
 version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f5ccd538d4a604753ebc2f17cd9946e89b77bf87f6a8e2309667c6f2e87855e3"
 dependencies = [
- "base64 0.21.4",
+ "base64",
  "log",
  "native-tls",
  "once_cell",
@@ -5044,9 +5068,9 @@ checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
 name = "uuid"
-version = "1.4.1"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79daa5ed5740825c40b389c5e50312b9c86df53fccd33f281df655642b43869d"
+checksum = "88ad59a7560b41a70d191093a945f0b87bc1deeda46fb237479708a1d6b6cdfc"
 dependencies = [
  "getrandom",
  "serde",
@@ -5169,7 +5193,7 @@ checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
 
 [[package]]
 name = "wasm-split"
-version = "23.10.1"
+version = "23.11.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -5297,10 +5321,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
-name = "windows"
-version = "0.48.0"
+name = "windows-core"
+version = "0.51.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e686886bc078bc1b0b600cac0147aadb815089b6e4da64016cbd754b6342700f"
+checksum = "f1f8cf84f35d2db49a46868f947758c7a1138116f7fac3bc844f43ade1292e64"
 dependencies = [
  "windows-targets 0.48.5",
 ]
diff --git a/pkgs/by-name/sy/symbolicator/package.nix b/pkgs/by-name/sy/symbolicator/package.nix
index c744f572a59..9a11cb5e5ab 100644
--- a/pkgs/by-name/sy/symbolicator/package.nix
+++ b/pkgs/by-name/sy/symbolicator/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "symbolicator";
-  version = "23.10.1";
+  version = "23.11.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "symbolicator";
     rev = version;
-    hash = "sha256-G8ElLH6u07uJR2Jz05rM59tnVADaDQ768lK477NuWuM=";
+    hash = "sha256-eXMMk12ZxRs5k3DaRhGADwLbE62L8e4N3R5Rw8kZMKI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/tr/trealla/package.nix b/pkgs/by-name/tr/trealla/package.nix
index 6aee9c1598b..c8fc25f2069 100644
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@@ -17,13 +17,13 @@
 assert lib.elem lineEditingLibrary [ "isocline" "readline" ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "2.29.36";
+  version = "2.30.7";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tQp2DOBW71Wm1aQqspW9tuH8aM8ir+ilZiENdElB/+0=";
+    hash = "sha256-W0hcIeWbgORWBYuNbVJRA8NNnuBEG8HMLeVBxXtd2VQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/xs/xscreensaver/package.nix b/pkgs/by-name/xs/xscreensaver/package.nix
index 1ec3b6905a6..2f4af30ff30 100644
--- a/pkgs/by-name/xs/xscreensaver/package.nix
+++ b/pkgs/by-name/xs/xscreensaver/package.nix
@@ -24,19 +24,21 @@
 , perlPackages
 , pkg-config
 , systemd
-, forceInstallAllHacks ? false
+, forceInstallAllHacks ? true
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xscreensaver";
-  version = "6.06";
+  version = "6.08";
 
   src = fetchurl {
     url = "https://www.jwz.org/xscreensaver/xscreensaver-${finalAttrs.version}.tar.gz";
-    hash = "sha256-9TT6uFqDbeW4vo6R/CG4DKfWpO2ThuviB9S+ek50mac=";
+    hash = "sha256-XPUrpSXO7PlLLyvWNIXr3zGOEvzA8q2tfUwQbYVedqM=";
   };
 
+  outputs = [ "out" "man" ];
+
   nativeBuildInputs = [
     intltool
     makeWrapper
@@ -65,7 +67,13 @@ stdenv.mkDerivation (finalAttrs: {
     perlPackages.MozillaCA
     perlPackages.perl
   ]
-  ++ lib.optional withSystemd systemd;
+  ++ lib.optionals withSystemd [ systemd ];
+
+  postPatch = ''
+    pushd hacks
+    patchShebangs check-configs.pl munge-ad.pl xml2man.pl
+    popd
+  '';
 
   preConfigure = ''
     # Fix installation paths for GTK resources.
diff --git a/pkgs/data/fonts/sil-abyssinica/default.nix b/pkgs/data/fonts/sil-abyssinica/default.nix
index f01c50b4260..d0571fae0bf 100644
--- a/pkgs/data/fonts/sil-abyssinica/default.nix
+++ b/pkgs/data/fonts/sil-abyssinica/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sil-abyssinica";
-  version = "2.200";
+  version = "2.201";
 
   src = fetchzip {
     url = "https://software.sil.org/downloads/r/abyssinica/AbyssinicaSIL-${version}.zip";
-    hash = "sha256-IdWMZHm9VoLVDO0//ISujxlXUxe0O6+aEcdP63YRmPg=";
+    hash = "sha256-DJWp3T9uBLnztSq9r5YCSWaBjIK/0Aljg1IiU0FLrdE=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/icons/tau-hydrogen/default.nix b/pkgs/data/icons/tau-hydrogen/default.nix
index bff4bb703a4..17a6d31b8a5 100644
--- a/pkgs/data/icons/tau-hydrogen/default.nix
+++ b/pkgs/data/icons/tau-hydrogen/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tau-hydrogen";
-  version = "1.0.13";
+  version = "1.0.14";
 
   src = fetchFromGitHub {
     owner = "tau-OS";
     repo = "tau-hydrogen";
     rev = finalAttrs.version;
-    hash = "sha256-rfgSNytPCVCkAJ9N3kRw9mfcXr+JEqy1jyyDgXqxtsM=";
+    hash = "sha256-8awcowBm0hwoYYm/wtKeqCWRhgXh2rI3UvAlL1tbj6c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/elm/default.nix b/pkgs/development/compilers/elm/default.nix
index b72d418a97d..9ae727f9376 100644
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@@ -274,6 +274,17 @@ in lib.makeScope pkgs.newScope (self: with self; {
         }
       );
 
+      elm-land = nodePkgs."elm-land".overrideAttrs (
+        old: {
+          meta = with lib; nodePkgs."elm-land".meta // {
+            description = "A production-ready framework for building Elm applications.";
+            homepage = "https://elm.land/";
+            license = licenses.bsd3;
+            maintainers = [ maintainers.zupo ];
+          };
+        }
+      );
+
       lamdera = callPackage ./packages/lamdera.nix {};
 
       elm-doc-preview = nodePkgs."elm-doc-preview".overrideAttrs (old: {
diff --git a/pkgs/development/compilers/elm/packages/node-packages.json b/pkgs/development/compilers/elm/packages/node-packages.json
index 30b2662ba49..8112b01bc9e 100644
--- a/pkgs/development/compilers/elm/packages/node-packages.json
+++ b/pkgs/development/compilers/elm/packages/node-packages.json
@@ -3,6 +3,7 @@
   "elm-coverage",
   "elm-doc-preview",
   "@elm-tooling/elm-language-server",
+  "elm-land",
   "elm-live",
   "elm-spa",
   "elm-test",
diff --git a/pkgs/development/compilers/elm/packages/node-packages.nix b/pkgs/development/compilers/elm/packages/node-packages.nix
index 5bf0474e66f..bfc0fcdf7bd 100644
--- a/pkgs/development/compilers/elm/packages/node-packages.nix
+++ b/pkgs/development/compilers/elm/packages/node-packages.nix
@@ -4,13 +4,13 @@
 
 let
   sources = {
-    "@adobe/css-tools-4.2.0" = {
+    "@adobe/css-tools-4.3.1" = {
       name = "_at_adobe_slash_css-tools";
       packageName = "@adobe/css-tools";
-      version = "4.2.0";
+      version = "4.3.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.2.0.tgz";
-        sha512 = "E09FiIft46CmH5Qnjb0wsW54/YQd69LsxeKUOWawmws1XWvyFGURnAChH0mlr7YPFR1ofwvUQfcL0J3lMxXqPA==";
+        url = "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.3.1.tgz";
+        sha512 = "/62yikz7NLScCGAAST5SHdnjaDJQBDq0M2muyRTpf2VQhw6StBg2ALiu73zSJQ4fMVLA+0uBhBHAle7Wg+2kSg==";
       };
     };
     "@babel/cli-7.12.10" = {
@@ -1399,6 +1399,69 @@ let
         sha512 = "GaHYm+c0O9MjZRu0ongGBRbinu8gVAMd2UZjji6jVmqKtZluZnptXGWhz1E8j8D2HJ3f/yMxKAUC0b+57wncIw==";
       };
     };
+    "@lydell/elm-0.19.1-14" = {
+      name = "_at_lydell_slash_elm";
+      packageName = "@lydell/elm";
+      version = "0.19.1-14";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm/-/elm-0.19.1-14.tgz";
+        sha512 = "otpGlYiNRvL7F9k6MJOTcuyIgHr+XWy/1NtHpGUgQi8lHrnuyCjwKFPPiimKpr3bcZTwpD4nebHuYR0bmPIKuA==";
+      };
+    };
+    "@lydell/elm_darwin_arm64-0.19.1-3" = {
+      name = "_at_lydell_slash_elm_darwin_arm64";
+      packageName = "@lydell/elm_darwin_arm64";
+      version = "0.19.1-3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm_darwin_arm64/-/elm_darwin_arm64-0.19.1-3.tgz";
+        sha512 = "RuKTz5ck+RBx4urj1EL/r0xWZZqBMPEXzNBQTEBCAMWLSi4Ck3TVz5pkhBaK+cRZXI+cCgytm/1bIttbp2fFIg==";
+      };
+    };
+    "@lydell/elm_darwin_x64-0.19.1-2" = {
+      name = "_at_lydell_slash_elm_darwin_x64";
+      packageName = "@lydell/elm_darwin_x64";
+      version = "0.19.1-2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm_darwin_x64/-/elm_darwin_x64-0.19.1-2.tgz";
+        sha512 = "MXfQwxdQfmuQ22iDCFlcXu5YTA0w6/ASzbxmWc+8DkgUkHTynjViGBVkQljAbYe4ZWgrYGWinZQQyhVnp/5oZw==";
+      };
+    };
+    "@lydell/elm_linux_arm-0.19.1-0" = {
+      name = "_at_lydell_slash_elm_linux_arm";
+      packageName = "@lydell/elm_linux_arm";
+      version = "0.19.1-0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm_linux_arm/-/elm_linux_arm-0.19.1-0.tgz";
+        sha512 = "crKrLzuT6jn4OOS7PWKZGYFw6vHwPu3iNP7lg8rFkOog/HxlkRwX4S695aILBG8SGTLhEdfP9tg28SQ7vR4Lpg==";
+      };
+    };
+    "@lydell/elm_linux_arm64-0.19.1-4" = {
+      name = "_at_lydell_slash_elm_linux_arm64";
+      packageName = "@lydell/elm_linux_arm64";
+      version = "0.19.1-4";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm_linux_arm64/-/elm_linux_arm64-0.19.1-4.tgz";
+        sha512 = "JuUkkVBtJjUajtTriQFFANHDmwA14NhqNqgIcq5LCJ6vUQv5/LVd6NUOkl/Rdq7Ju/VN/XwBD1/vm7MGIMOTqA==";
+      };
+    };
+    "@lydell/elm_linux_x64-0.19.1-1" = {
+      name = "_at_lydell_slash_elm_linux_x64";
+      packageName = "@lydell/elm_linux_x64";
+      version = "0.19.1-1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm_linux_x64/-/elm_linux_x64-0.19.1-1.tgz";
+        sha512 = "1Y8UAb+GfUqlSjUTX9CaaZhJqvhVcfNbYC0N9AEutlXf1CzFMvF4VsDeZdxzhNI4allPRWBD1IqtdlLhBTFacA==";
+      };
+    };
+    "@lydell/elm_win32_x64-0.19.1-1" = {
+      name = "_at_lydell_slash_elm_win32_x64";
+      packageName = "@lydell/elm_win32_x64";
+      version = "0.19.1-1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/@lydell/elm_win32_x64/-/elm_win32_x64-0.19.1-1.tgz";
+        sha512 = "3LMiJ+uUxDFLNnCd6HBmvVWSjSWjs/Z9dMXZWCMOcw3vrW9iOkRrsNGNxohRXun2YRd8wXOX8/DwVn8i2SJ3KA==";
+      };
+    };
     "@mrmlnc/readdir-enhanced-2.2.1" = {
       name = "_at_mrmlnc_slash_readdir-enhanced";
       packageName = "@mrmlnc/readdir-enhanced";
@@ -1642,13 +1705,13 @@ let
         sha512 = "U5icWpv7YnZYGsN4/cmh3WD2onMY0aJIiTE6+51TwJCttdHvtCYmkBNOobHlXwrJRL0nkH9jH4kD+1FAdMN4Tg==";
       };
     };
-    "@types/node-20.8.9" = {
+    "@types/node-20.8.10" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "20.8.9";
+      version = "20.8.10";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-20.8.9.tgz";
-        sha512 = "UzykFsT3FhHb1h7yD4CA4YhBHq545JC0YnEz41xkipN88eKQtL6rSgocL5tbAP6Ola9Izm/Aw4Ora8He4x0BHg==";
+        url = "https://registry.npmjs.org/@types/node/-/node-20.8.10.tgz";
+        sha512 = "TlgT8JntpcbmKUFzjhsyhGfP2fsiz1Mv56im6enJ905xG1DAYesxJaeSbGqQmAw8OWPdhyJGhGSQGKRNJ45u9w==";
       };
     };
     "@types/node-8.10.66" = {
@@ -1957,13 +2020,13 @@ let
         sha512 = "XtGIhXwF8YM8bJhGxG5kXgjkEuNGLTkoYqVE+KMR+aspr4KGYmKYg7yUe3KghyQ9yheNwLnjmzh/7+gfDBmHCQ==";
       };
     };
-    "acorn-8.11.0" = {
+    "acorn-8.11.2" = {
       name = "acorn";
       packageName = "acorn";
-      version = "8.11.0";
+      version = "8.11.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/acorn/-/acorn-8.11.0.tgz";
-        sha512 = "hNiSyky+cuYVALBrsjB7f9gMN9P4u09JyAiMNMLaVfsmkDJuH84M1T/0pfDX/OJfGWcobd2A7ecXYzygn8wibA==";
+        url = "https://registry.npmjs.org/acorn/-/acorn-8.11.2.tgz";
+        sha512 = "nc0Axzp/0FILLEVsm4fNwLCwMttvhEI263QtVPQcbpfZZ3ts0hLsZGOpE6czNlid7CJ9MlyH8reXkpsf3YUY4w==";
       };
     };
     "address-1.0.3" = {
@@ -3190,13 +3253,13 @@ let
         sha512 = "bsTwuIg/BZZK/vreVTYYbSWoe2F+71P7K5QGEX+pT250DZbfU1MQ5prOKpPR+LL6uWKK3KMwMCAS74QB3Um1uw==";
       };
     };
-    "caniuse-lite-1.0.30001554" = {
+    "caniuse-lite-1.0.30001561" = {
       name = "caniuse-lite";
       packageName = "caniuse-lite";
-      version = "1.0.30001554";
+      version = "1.0.30001561";
       src = fetchurl {
-        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001554.tgz";
-        sha512 = "A2E3U//MBwbJVzebddm1YfNp7Nud5Ip+IPn4BozBmn4KqVX7AvluoIDFWjsv5OkGnKUXQVmMSoMKLa3ScCblcQ==";
+        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001561.tgz";
+        sha512 = "NTt0DNoKe958Q0BE0j0c1V9jbUzhBxHIEJy7asmGrpE0yG63KTV7PLHPnK2E1O9RsQrQ081I3NLuXGS6zht3cw==";
       };
     };
     "case-sensitive-paths-webpack-plugin-2.3.0" = {
@@ -3946,13 +4009,13 @@ let
         sha512 = "Kb2wC0fvsWfQrgk8HU5lW6U/Lcs8+9aaYcy4ZFc6DDlo4nZ7n70dEgE5rtR0oG6ufKDUnrwfWL1mXR5ljDatrQ==";
       };
     };
-    "core-js-compat-3.33.1" = {
+    "core-js-compat-3.33.2" = {
       name = "core-js-compat";
       packageName = "core-js-compat";
-      version = "3.33.1";
+      version = "3.33.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.33.1.tgz";
-        sha512 = "6pYKNOgD/j/bkC5xS5IIg6bncid3rfrI42oBH1SQJbsmYPKF7rhzcFzYCcxYMmNQQ0rCEB8WqpW7QHndOggaeQ==";
+        url = "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.33.2.tgz";
+        sha512 = "axfo+wxFVxnqf8RvxTzoAlzW4gRoacrHeoFlc9n0x50+7BEyZL/Rt3hicaED1/CEd7I6tPCPVUYcJwCMO5XUYw==";
       };
     };
     "core-util-is-1.0.2" = {
@@ -4810,13 +4873,13 @@ let
         sha512 = "WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==";
       };
     };
-    "electron-to-chromium-1.4.567" = {
+    "electron-to-chromium-1.4.576" = {
       name = "electron-to-chromium";
       packageName = "electron-to-chromium";
-      version = "1.4.567";
+      version = "1.4.576";
       src = fetchurl {
-        url = "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.567.tgz";
-        sha512 = "8KR114CAYQ4/r5EIEsOmOMqQ9j0MRbJZR3aXD/KFA8RuKzyoUB4XrUCg+l8RUGqTVQgKNIgTpjaG8YHRPAbX2w==";
+        url = "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.576.tgz";
+        sha512 = "yXsZyXJfAqzWk1WKryr0Wl0MN2D47xodPvEEwlVePBnhU5E7raevLQR+E6b9JAD3GfL/7MbAL9ZtWQQPcLx7wA==";
       };
     };
     "elliptic-6.5.4" = {
@@ -7204,15 +7267,6 @@ let
         sha512 = "opmNIX7uFnS96NtPmhWQgQx6/NYFgsUXYMllcfzwWKUMwfo8kku1TvE6hkNcH+Q1ts5cMVrsY7j0bxXQDciu9Q==";
       };
     };
-    "is-accessor-descriptor-0.1.6" = {
-      name = "is-accessor-descriptor";
-      packageName = "is-accessor-descriptor";
-      version = "0.1.6";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-0.1.6.tgz";
-        sha512 = "e1BM1qnDbMRG3ll2U9dSK0UMHuWOs3pY3AtcFsmvwPtKL3MML/Q86i+GilLfvqEs4GW+ExB91tQ3Ig9noDIZ+A==";
-      };
-    };
     "is-accessor-descriptor-1.0.1" = {
       name = "is-accessor-descriptor";
       packageName = "is-accessor-descriptor";
@@ -7330,15 +7384,6 @@ let
         sha512 = "hHrIjvZsftOsvKSn2TRYl63zvxsgE0K+0mYMoH6gD4omR5IWB2KynivBQczo3+wF1cCkjzvptnI9Q0sPU66ilw==";
       };
     };
-    "is-data-descriptor-0.1.4" = {
-      name = "is-data-descriptor";
-      packageName = "is-data-descriptor";
-      version = "0.1.4";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-0.1.4.tgz";
-        sha512 = "+w9D5ulSoBNlmw9OHn3U2v51SyoCd0he+bB3xMl62oijhrspxowjU+AIcDY0N3iEJbUEkB15IlMASQsxYigvXg==";
-      };
-    };
     "is-data-descriptor-1.0.1" = {
       name = "is-data-descriptor";
       packageName = "is-data-descriptor";
@@ -7357,22 +7402,22 @@ let
         sha512 = "9YQaSxsAiSwcvS33MBk3wTCVnWK+HhF8VZR2jRxehM16QcVOdHqPn4VPHmRK4lSr38n9JriurInLcP90xsYNfQ==";
       };
     };
-    "is-descriptor-0.1.6" = {
+    "is-descriptor-0.1.7" = {
       name = "is-descriptor";
       packageName = "is-descriptor";
-      version = "0.1.6";
+      version = "0.1.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/is-descriptor/-/is-descriptor-0.1.6.tgz";
-        sha512 = "avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==";
+        url = "https://registry.npmjs.org/is-descriptor/-/is-descriptor-0.1.7.tgz";
+        sha512 = "C3grZTvObeN1xud4cRWl366OMXZTj0+HGyk4hvfpx4ZHt1Pb60ANSXqCK7pdOTeUQpRzECBSTphqvD7U+l22Eg==";
       };
     };
-    "is-descriptor-1.0.2" = {
+    "is-descriptor-1.0.3" = {
       name = "is-descriptor";
       packageName = "is-descriptor";
-      version = "1.0.2";
+      version = "1.0.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz";
-        sha512 = "2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==";
+        url = "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.3.tgz";
+        sha512 = "JCNNGbwWZEVaSPtS45mdtrneRWJFp07LLmykxeFV5F6oBvNF8vHSfJuJgoT472pSfk+Mf8VnlrspaFBHWM8JAw==";
       };
     };
     "is-directory-0.3.1" = {
@@ -8122,15 +8167,6 @@ let
         sha512 = "24XsCxmEbRwEDbz/qz3stgin8TTzZ1ESR56OMCN0ujYg+vRutNSiOj9bHH9u85DKgXguraugV5sFuvbD4FW/hw==";
       };
     };
-    "kind-of-5.1.0" = {
-      name = "kind-of";
-      packageName = "kind-of";
-      version = "5.1.0";
-      src = fetchurl {
-        url = "https://registry.npmjs.org/kind-of/-/kind-of-5.1.0.tgz";
-        sha512 = "NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==";
-      };
-    };
     "kind-of-6.0.3" = {
       name = "kind-of";
       packageName = "kind-of";
@@ -10957,13 +10993,13 @@ let
         sha512 = "jmYNElW7yvO7TV33CjSmvSiE2yco3bV2czu/OzDKdMNVZQWfxCblURLhf+47syQRBntjfLdd/H0egrzIG+oaFQ==";
       };
     };
-    "punycode-2.3.0" = {
+    "punycode-2.3.1" = {
       name = "punycode";
       packageName = "punycode";
-      version = "2.3.0";
+      version = "2.3.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/punycode/-/punycode-2.3.0.tgz";
-        sha512 = "rRV+zQD8tVFys26lAGR9WUuS4iUAngJScM+ZRSKtvl5tKeZ2t5bvdNFdNHBW9FWR4guGHlgmsZ1G7BSm2wTbuA==";
+        url = "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz";
+        sha512 = "vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==";
       };
     };
     "q-1.5.1" = {
@@ -12928,13 +12964,13 @@ let
         sha512 = "7GlLk9JwlElY4Y6a/rmbH2MhVlTyVmiJd1PfTCqFaIBEGMYNsrO/v3SeGTdhBThLg4Z+NbOk/qFMwCa+J+3p/g==";
       };
     };
-    "stylus-0.60.0" = {
+    "stylus-0.61.0" = {
       name = "stylus";
       packageName = "stylus";
-      version = "0.60.0";
+      version = "0.61.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/stylus/-/stylus-0.60.0.tgz";
-        sha512 = "j2pBgEwzCu05yCuY4cmyp0FtPQQFBBAGB7TY7QaNl7eztiHwkxzwvIp5vjZJND/a1JNOka+ZW9ewVPFZpI3pcA==";
+        url = "https://registry.npmjs.org/stylus/-/stylus-0.61.0.tgz";
+        sha512 = "oaV9T4sRBiQfChXE0av9SrLD+ovEdQiWzPJ5kwIeYvMhjUDJnZtdubAG6lSSbaR4sCnoT6sw411IOl5Akcht4Q==";
       };
     };
     "sudo-prompt-8.2.5" = {
@@ -13108,13 +13144,22 @@ let
         sha512 = "4GnLC0x667eJG0ewJTa6z/yXrbLGv80D9Ru6HIpCQmO+Q4PfEtBFi0ObSckqwL6VyQv/7ENJieXHo2ANmdQwgw==";
       };
     };
-    "terser-5.22.0" = {
+    "terser-5.15.1" = {
       name = "terser";
       packageName = "terser";
-      version = "5.22.0";
+      version = "5.15.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/terser/-/terser-5.22.0.tgz";
-        sha512 = "hHZVLgRA2z4NWcN6aS5rQDc+7Dcy58HOf2zbYwmFcQ+ua3h6eEFf5lIDKTzbWwlazPyOZsFQO8V80/IjVNExEw==";
+        url = "https://registry.npmjs.org/terser/-/terser-5.15.1.tgz";
+        sha512 = "K1faMUvpm/FBxjBXud0LWVAGxmvoPbZbfTCYbSgaaYQaIXI3/TdI7a7ZGA73Zrou6Q8Zmz3oeUTsp/dj+ag2Xw==";
+      };
+    };
+    "terser-5.24.0" = {
+      name = "terser";
+      packageName = "terser";
+      version = "5.24.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/terser/-/terser-5.24.0.tgz";
+        sha512 = "ZpGR4Hy3+wBEzVEnHvstMvqpD/nABNelQn/z2r0fjVWGQsN3bpOLzQlqDxmb4CDZnXq5lpjnQ+mHQLAOpfM5iw==";
       };
     };
     "terser-5.3.8" = {
@@ -13549,6 +13594,15 @@ let
         sha512 = "zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==";
       };
     };
+    "typescript-4.9.3" = {
+      name = "typescript";
+      packageName = "typescript";
+      version = "4.9.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/typescript/-/typescript-4.9.3.tgz";
+        sha512 = "CIfGzTelbKNEnLpLdGFgdyKhG23CKdKgQPOBc+OUNrkJ2vr+KSzsSV5kq5iWhEQbok+quxgGzrAtGWCyU7tHnA==";
+      };
+    };
     "typescript-4.9.5" = {
       name = "typescript";
       packageName = "typescript";
@@ -13720,13 +13774,13 @@ let
         sha512 = "rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==";
       };
     };
-    "universalify-2.0.0" = {
+    "universalify-2.0.1" = {
       name = "universalify";
       packageName = "universalify";
-      version = "2.0.0";
+      version = "2.0.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/universalify/-/universalify-2.0.0.tgz";
-        sha512 = "hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ==";
+        url = "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz";
+        sha512 = "gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==";
       };
     };
     "unpipe-1.0.0" = {
@@ -13990,6 +14044,15 @@ let
         sha512 = "ZZKSmDAEFOijERBLkmYfJ+vmk3w+7hOLYDNkRCuRuMJGEmqYNCNLyBBFwWKVMhfwaEF3WOd0Zlw86U/WC/+nYw==";
       };
     };
+    "vite-4.3.9" = {
+      name = "vite";
+      packageName = "vite";
+      version = "4.3.9";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/vite/-/vite-4.3.9.tgz";
+        sha512 = "qsTNZjO9NoJNW7KnOrgYwczm0WctJ8m/yqYAMAK9Lxt4SoySUfS5S8ia9K7JHpa3KEeMfyF8LoJ3c5NeBJy6pg==";
+      };
+    };
     "vite-4.5.0" = {
       name = "vite";
       packageName = "vite";
@@ -14880,7 +14943,7 @@ in
       sources."process-nextick-args-1.0.7"
       sources."proxy-addr-2.0.7"
       sources."psl-1.9.0"
-      sources."punycode-2.3.0"
+      sources."punycode-2.3.1"
       sources."qs-6.7.0"
       sources."range-parser-1.2.1"
       sources."raw-body-2.4.0"
@@ -15118,7 +15181,7 @@ in
       sources."picomatch-2.3.1"
       sources."pseudomap-1.0.2"
       sources."psl-1.9.0"
-      sources."punycode-2.3.0"
+      sources."punycode-2.3.1"
       sources."qs-6.5.3"
       sources."readdirp-3.1.3"
       sources."request-2.88.2"
@@ -15471,6 +15534,148 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  elm-land = nodeEnv.buildNodePackage {
+    name = "elm-land";
+    packageName = "elm-land";
+    version = "0.19.4";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/elm-land/-/elm-land-0.19.4.tgz";
+      sha512 = "ruspCQ7s+ZOSILEJ8psXuQMb4ASGfgXCqmMjiLIyV7oX42nSpQGYADTXwiAwo+E7ESev1TWspn/DkAxsuDo6Qg==";
+    };
+    dependencies = [
+      sources."@adobe/css-tools-4.3.1"
+      sources."@esbuild/android-arm-0.17.19"
+      sources."@esbuild/android-arm64-0.17.19"
+      sources."@esbuild/android-x64-0.17.19"
+      sources."@esbuild/darwin-arm64-0.17.19"
+      sources."@esbuild/darwin-x64-0.17.19"
+      sources."@esbuild/freebsd-arm64-0.17.19"
+      sources."@esbuild/freebsd-x64-0.17.19"
+      sources."@esbuild/linux-arm-0.17.19"
+      sources."@esbuild/linux-arm64-0.17.19"
+      sources."@esbuild/linux-ia32-0.17.19"
+      sources."@esbuild/linux-loong64-0.17.19"
+      sources."@esbuild/linux-mips64el-0.17.19"
+      sources."@esbuild/linux-ppc64-0.17.19"
+      sources."@esbuild/linux-riscv64-0.17.19"
+      sources."@esbuild/linux-s390x-0.17.19"
+      sources."@esbuild/linux-x64-0.17.19"
+      sources."@esbuild/netbsd-x64-0.17.19"
+      sources."@esbuild/openbsd-x64-0.17.19"
+      sources."@esbuild/sunos-x64-0.17.19"
+      sources."@esbuild/win32-arm64-0.17.19"
+      sources."@esbuild/win32-ia32-0.17.19"
+      sources."@esbuild/win32-x64-0.17.19"
+      sources."@jridgewell/gen-mapping-0.3.3"
+      sources."@jridgewell/resolve-uri-3.1.1"
+      sources."@jridgewell/set-array-1.1.2"
+      sources."@jridgewell/source-map-0.3.5"
+      sources."@jridgewell/sourcemap-codec-1.4.15"
+      sources."@jridgewell/trace-mapping-0.3.20"
+      sources."@lydell/elm-0.19.1-14"
+      sources."@lydell/elm_darwin_arm64-0.19.1-3"
+      sources."@lydell/elm_darwin_x64-0.19.1-2"
+      sources."@lydell/elm_linux_arm-0.19.1-0"
+      sources."@lydell/elm_linux_arm64-0.19.1-4"
+      sources."@lydell/elm_linux_x64-0.19.1-1"
+      sources."@lydell/elm_win32_x64-0.19.1-1"
+      sources."@types/node-20.8.10"
+      sources."acorn-8.11.2"
+      sources."anymatch-3.1.3"
+      sources."balanced-match-1.0.2"
+      sources."binary-extensions-2.2.0"
+      sources."brace-expansion-1.1.11"
+      sources."braces-3.0.2"
+      sources."buffer-from-1.1.2"
+      sources."chokidar-3.5.3"
+      sources."commander-2.20.3"
+      sources."concat-map-0.0.1"
+      sources."copy-anything-2.0.6"
+      sources."cross-spawn-6.0.5"
+      sources."debug-3.2.7"
+      sources."errno-0.1.8"
+      sources."esbuild-0.17.19"
+      sources."fill-range-7.0.1"
+      sources."find-elm-dependencies-2.0.4"
+      sources."firstline-1.3.1"
+      sources."fs.realpath-1.0.0"
+      sources."fsevents-2.3.3"
+      sources."glob-7.2.3"
+      sources."glob-parent-5.1.2"
+      sources."graceful-fs-4.2.11"
+      sources."iconv-lite-0.6.3"
+      sources."image-size-0.5.5"
+      sources."immutable-4.3.4"
+      sources."inflight-1.0.6"
+      sources."inherits-2.0.4"
+      sources."is-binary-path-2.1.0"
+      sources."is-extglob-2.1.1"
+      sources."is-glob-4.0.3"
+      sources."is-number-7.0.0"
+      sources."is-what-3.14.1"
+      sources."isexe-2.0.0"
+      sources."less-4.2.0"
+      sources."lodash-4.17.21"
+      sources."make-dir-2.1.0"
+      sources."mime-1.6.0"
+      sources."minimatch-3.1.2"
+      sources."minimist-1.2.8"
+      sources."mkdirp-0.5.6"
+      sources."ms-2.1.3"
+      sources."nanoid-3.3.6"
+      sources."needle-3.2.0"
+      sources."nice-try-1.0.5"
+      sources."node-elm-compiler-5.0.6"
+      sources."normalize-path-3.0.0"
+      sources."once-1.4.0"
+      sources."parse-node-version-1.0.1"
+      sources."path-is-absolute-1.0.1"
+      sources."path-key-2.0.1"
+      sources."picocolors-1.0.0"
+      sources."picomatch-2.3.1"
+      sources."pify-4.0.1"
+      sources."postcss-8.4.31"
+      sources."prr-1.0.1"
+      sources."readdirp-3.6.0"
+      sources."rimraf-2.6.3"
+      sources."rollup-3.29.4"
+      sources."safer-buffer-2.1.2"
+      sources."sass-1.69.5"
+      sources."sax-1.3.0"
+      sources."semver-5.7.2"
+      sources."shebang-command-1.2.0"
+      sources."shebang-regex-1.0.0"
+      sources."source-map-0.6.1"
+      sources."source-map-js-1.0.2"
+      sources."source-map-support-0.5.21"
+      (sources."stylus-0.61.0" // {
+        dependencies = [
+          sources."debug-4.3.4"
+          sources."ms-2.1.2"
+          sources."source-map-0.7.4"
+        ];
+      })
+      sources."sugarss-4.0.1"
+      sources."temp-0.9.4"
+      sources."terser-5.15.1"
+      sources."to-regex-range-5.0.1"
+      sources."tslib-2.6.2"
+      sources."typescript-4.9.3"
+      sources."undici-types-5.26.5"
+      sources."vite-4.3.9"
+      sources."which-1.3.1"
+      sources."wrappy-1.0.2"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "Reliable web apps for everyone";
+      homepage = "https://elm.land";
+      license = "ISC";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   elm-live = nodeEnv.buildNodePackage {
     name = "elm-live";
     packageName = "elm-live";
@@ -15756,7 +15961,7 @@ in
       sources."@types/cacheable-request-6.0.3"
       sources."@types/http-cache-semantics-4.0.3"
       sources."@types/keyv-3.1.4"
-      sources."@types/node-20.8.9"
+      sources."@types/node-20.8.10"
       sources."@types/responselike-1.0.2"
       sources."cacheable-lookup-2.0.1"
       sources."cacheable-request-7.0.4"
@@ -15920,7 +16125,7 @@ in
       (sources."fs-extra-11.1.1" // {
         dependencies = [
           sources."jsonfile-6.1.0"
-          sources."universalify-2.0.0"
+          sources."universalify-2.0.1"
         ];
       })
       sources."fs-minipass-1.2.7"
@@ -15984,7 +16189,7 @@ in
       sources."performance-now-2.1.0"
       sources."picomatch-2.3.1"
       sources."psl-1.9.0"
-      sources."punycode-2.3.0"
+      sources."punycode-2.3.1"
       sources."qs-6.5.3"
       sources."readdirp-3.1.3"
       sources."request-2.88.2"
@@ -16264,7 +16469,7 @@ in
       sources."@types/http-proxy-1.17.13"
       sources."@types/json-schema-7.0.14"
       sources."@types/minimatch-5.1.2"
-      sources."@types/node-20.8.9"
+      sources."@types/node-20.8.10"
       sources."@types/parse-json-4.0.1"
       sources."@types/q-1.5.7"
       sources."@types/source-list-map-0.1.4"
@@ -16435,7 +16640,7 @@ in
       sources."camel-case-4.1.2"
       sources."camelcase-5.3.1"
       sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001554"
+      sources."caniuse-lite-1.0.30001561"
       sources."case-sensitive-paths-webpack-plugin-2.3.0"
       sources."caseless-0.12.0"
       (sources."chalk-2.4.2" // {
@@ -16455,18 +16660,7 @@ in
       (sources."class-utils-0.3.6" // {
         dependencies = [
           sources."define-property-0.2.5"
-          (sources."is-accessor-descriptor-0.1.6" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          (sources."is-data-descriptor-0.1.4" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          sources."is-descriptor-0.1.6"
-          sources."kind-of-5.1.0"
+          sources."is-descriptor-0.1.7"
         ];
       })
       (sources."clean-css-4.2.4" // {
@@ -16534,7 +16728,7 @@ in
         ];
       })
       sources."core-js-2.6.12"
-      sources."core-js-compat-3.33.1"
+      sources."core-js-compat-3.33.2"
       sources."core-util-is-1.0.3"
       sources."cosmiconfig-5.2.1"
       (sources."create-ecdh-4.0.4" // {
@@ -16659,7 +16853,7 @@ in
       sources."duplexify-3.7.1"
       sources."ecc-jsbn-0.1.2"
       sources."ee-first-1.1.1"
-      sources."electron-to-chromium-1.4.567"
+      sources."electron-to-chromium-1.4.576"
       (sources."elliptic-6.5.4" // {
         dependencies = [
           sources."bn.js-4.12.0"
@@ -16732,18 +16926,7 @@ in
           sources."debug-2.6.9"
           sources."define-property-0.2.5"
           sources."extend-shallow-2.0.1"
-          (sources."is-accessor-descriptor-0.1.6" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          (sources."is-data-descriptor-0.1.4" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          sources."is-descriptor-0.1.6"
-          sources."kind-of-5.1.0"
+          sources."is-descriptor-0.1.7"
           sources."ms-2.0.0"
         ];
       })
@@ -16987,7 +17170,7 @@ in
       sources."is-core-module-2.13.1"
       sources."is-data-descriptor-1.0.1"
       sources."is-date-object-1.0.5"
-      sources."is-descriptor-1.0.2"
+      sources."is-descriptor-1.0.3"
       sources."is-directory-0.3.1"
       sources."is-extendable-0.1.1"
       sources."is-extglob-2.1.1"
@@ -17144,13 +17327,7 @@ in
       (sources."object-copy-0.1.0" // {
         dependencies = [
           sources."define-property-0.2.5"
-          sources."is-accessor-descriptor-0.1.6"
-          sources."is-data-descriptor-0.1.4"
-          (sources."is-descriptor-0.1.6" // {
-            dependencies = [
-              sources."kind-of-5.1.0"
-            ];
-          })
+          sources."is-descriptor-0.1.7"
           sources."kind-of-3.2.2"
         ];
       })
@@ -17520,7 +17697,7 @@ in
           sources."pump-2.0.1"
         ];
       })
-      sources."punycode-2.3.0"
+      sources."punycode-2.3.1"
       sources."q-1.5.1"
       sources."qs-6.5.3"
       sources."query-string-4.3.4"
@@ -17696,18 +17873,7 @@ in
           sources."debug-2.6.9"
           sources."define-property-0.2.5"
           sources."extend-shallow-2.0.1"
-          (sources."is-accessor-descriptor-0.1.6" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          (sources."is-data-descriptor-0.1.4" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          sources."is-descriptor-0.1.6"
-          sources."kind-of-5.1.0"
+          sources."is-descriptor-0.1.7"
           sources."ms-2.0.0"
         ];
       })
@@ -17764,18 +17930,7 @@ in
       (sources."static-extend-0.1.2" // {
         dependencies = [
           sources."define-property-0.2.5"
-          (sources."is-accessor-descriptor-0.1.6" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          (sources."is-data-descriptor-0.1.4" // {
-            dependencies = [
-              sources."kind-of-3.2.2"
-            ];
-          })
-          sources."is-descriptor-0.1.6"
-          sources."kind-of-5.1.0"
+          sources."is-descriptor-0.1.7"
         ];
       })
       sources."statuses-2.0.1"
@@ -18231,7 +18386,7 @@ in
       sha512 = "EFwDCYHm3rwCiwXwfSUKeDDcIYrQ61deChDk7ruXPN4y0PkIINIKbljLu3uOnKSYhzc5CGSc7avwiAlkxXnJsA==";
     };
     dependencies = [
-      sources."@adobe/css-tools-4.2.0"
+      sources."@adobe/css-tools-4.3.1"
       sources."@esbuild/android-arm-0.17.19"
       sources."@esbuild/android-arm64-0.17.19"
       sources."@esbuild/android-x64-0.17.19"
@@ -18284,7 +18439,7 @@ in
       sources."@types/rimraf-2.0.5"
       sources."@types/tmp-0.0.33"
       sources."accepts-1.3.8"
-      sources."acorn-8.11.0"
+      sources."acorn-8.11.2"
       (sources."agent-base-6.0.2" // {
         dependencies = [
           sources."debug-4.3.4"
@@ -18593,7 +18748,7 @@ in
       sources."proxy-addr-2.0.7"
       sources."prr-1.0.1"
       sources."pump-3.0.0"
-      sources."punycode-2.3.0"
+      sources."punycode-2.3.1"
       sources."qs-6.11.0"
       sources."queue-microtask-1.2.3"
       sources."range-parser-1.2.1"
@@ -18671,11 +18826,10 @@ in
       sources."strip-ansi-cjs-6.0.1"
       sources."strip-bom-string-1.0.0"
       sources."strip-json-comments-2.0.1"
-      (sources."stylus-0.60.0" // {
+      (sources."stylus-0.61.0" // {
         dependencies = [
           sources."debug-4.3.4"
           sources."ms-2.1.2"
-          sources."sax-1.2.4"
           sources."source-map-0.7.4"
         ];
       })
@@ -18692,7 +18846,7 @@ in
           sources."mkdirp-1.0.4"
         ];
       })
-      (sources."terser-5.22.0" // {
+      (sources."terser-5.24.0" // {
         dependencies = [
           sources."commander-2.20.3"
         ];
@@ -18707,7 +18861,7 @@ in
       sources."undici-types-5.26.5"
       sources."unique-filename-3.0.0"
       sources."unique-slug-4.0.0"
-      sources."universalify-2.0.0"
+      sources."universalify-2.0.1"
       sources."unpipe-1.0.0"
       sources."url-parse-lax-3.0.0"
       sources."utf-8-validate-5.0.10"
@@ -18737,7 +18891,7 @@ in
           sources."@esbuild/win32-arm64-0.18.20"
           sources."@esbuild/win32-ia32-0.18.20"
           sources."@esbuild/win32-x64-0.18.20"
-          sources."@types/node-20.8.9"
+          sources."@types/node-20.8.10"
           sources."esbuild-0.18.20"
         ];
       })
@@ -18789,7 +18943,7 @@ in
       sources."@types/cacheable-request-6.0.3"
       sources."@types/http-cache-semantics-4.0.3"
       sources."@types/keyv-3.1.4"
-      sources."@types/node-20.8.9"
+      sources."@types/node-20.8.10"
       sources."@types/responselike-1.0.2"
       sources."ansi-escapes-4.3.2"
       sources."ansi-regex-6.0.1"
@@ -18938,7 +19092,7 @@ in
       sources."to-regex-range-5.0.1"
       sources."type-fest-0.21.3"
       sources."undici-types-5.26.5"
-      sources."universalify-2.0.0"
+      sources."universalify-2.0.1"
       sources."util-deprecate-1.0.2"
       sources."wcwidth-1.0.1"
       sources."which-2.0.2"
diff --git a/pkgs/development/compilers/julia/1.9-bin.nix b/pkgs/development/compilers/julia/1.9-bin.nix
index 85c0d7043ef..04e768d0bff 100644
--- a/pkgs/development/compilers/julia/1.9-bin.nix
+++ b/pkgs/development/compilers/julia/1.9-bin.nix
@@ -24,24 +24,24 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "julia-bin";
-  version = "1.9.3";
+  version = "1.9.4";
 
   src = {
     x86_64-linux = fetchurl {
       url = "https://julialang-s3.julialang.org/bin/linux/x64/${lib.versions.majorMinor version}/julia-${version}-linux-x86_64.tar.gz";
-      sha256 = "d76670cc9ba3e0fd4c1545dd3d00269c0694976a1176312795ebce1692d323d1";
+      sha256 = "07d20c4c2518833e2265ca0acee15b355463361aa4efdab858dad826cf94325c";
     };
     aarch64-linux = fetchurl {
       url = "https://julialang-s3.julialang.org/bin/linux/aarch64/${lib.versions.majorMinor version}/julia-${version}-linux-aarch64.tar.gz";
-      sha256 = "55437879f6b98470d96c4048b922501b643dfffb8865abeb90c7333a83df7524";
+      sha256 = "541d0c5a9378f8d2fc384bb8595fc6ffe20d61054629a6e314fb2f8dfe2f2ade";
     };
     x86_64-darwin = fetchurl {
       url = "https://julialang-s3.julialang.org/bin/mac/x64/${lib.versions.majorMinor version}/julia-${version}-mac64.tar.gz";
-      sha256 = "6eea87748424488226090d1e7d553e72ab106a873d63c732fc710a3d080abb97";
+      sha256 = "67eec264f6afc9e9bf72c0f62c84d91c2ebdfaed6a0aa11606e3c983d278b441";
     };
     aarch64-darwin = fetchurl {
       url = "https://julialang-s3.julialang.org/bin/mac/aarch64/${lib.versions.majorMinor version}/julia-${version}-macaarch64.tar.gz";
-      sha256 = "f518e38d7bd5b37766fb051916bd295993aa4b52a47018f4c98b5fde721ced87";
+      sha256 = "67542975e86102eec95bc4bb7c30c5d8c7ea9f9a0b388f0e10f546945363b01a";
     };
   }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
diff --git a/pkgs/development/compilers/julia/1.9.nix b/pkgs/development/compilers/julia/1.9.nix
index 002cca08aac..715414e7dab 100644
--- a/pkgs/development/compilers/julia/1.9.nix
+++ b/pkgs/development/compilers/julia/1.9.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "julia";
-  version = "1.9.3";
+  version = "1.9.4";
 
   src = fetchurl {
     url = "https://github.com/JuliaLang/julia/releases/download/v${version}/julia-${version}-full.tar.gz";
-    hash = "sha256-j8DJ3FRDoo01m9ed2jlA+pS6K3lmuJhlvrINqBEjwxY=";
+    hash = "sha256-YYQ7lkf9BtOymU8yd6ZN4ctaWlKX2TC4yOO8DpN0ACQ=";
   };
 
   patches = [
diff --git a/pkgs/development/interpreters/babashka/default.nix b/pkgs/development/interpreters/babashka/default.nix
index 4c4cfd67dcd..7f8281dd1de 100644
--- a/pkgs/development/interpreters/babashka/default.nix
+++ b/pkgs/development/interpreters/babashka/default.nix
@@ -33,9 +33,10 @@ let
     doInstallCheck = true;
 
     installCheckPhase = ''
-      $out/bin/bb --version | grep '${version}'
-      $out/bin/bb '(+ 1 2)' | grep '3'
-      $out/bin/bb '(vec (dedupe *input*))' <<< '[1 1 1 1 2]' | grep '[1 2]'
+      $out/bin/bb --version | fgrep '${version}'
+      $out/bin/bb '(+ 1 2)' | fgrep '3'
+      $out/bin/bb '(vec (dedupe *input*))' <<< '[1 1 1 1 2]' | fgrep '[1 2]'
+      $out/bin/bb '(prn "bépo àê")' | fgrep 'bépo àê'
     '';
 
     # As of v1.2.174, this will remove references to ${graalvmDrv}/conf/chronology,
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index d650a03331e..903a101aa49 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -351,8 +351,8 @@ in {
   };
 
   ruby_3_3 = generic {
-    version = rubyVersion "3" "3" "0" "preview2";
-    sha256 = "sha256-MM6LD+EbN7WsCI9aV2V0S5NerEW7ianjgXMVMxRPWZE=";
+    version = rubyVersion "3" "3" "0" "preview3";
+    sha256 = "sha256-CWkUG+kuZ+DtuEqPs1SsyY8BvXjmAqI6DxNgRcgvSAk=";
     cargoSha256 = "sha256-GeelTMRFIyvz1QS2L+Q3KAnyQy7jc0ejhx3TdEFVEbk=";
   };
 
diff --git a/pkgs/development/libraries/libcmis/default.nix b/pkgs/development/libraries/libcmis/default.nix
index 142e329fd09..52da3719991 100644
--- a/pkgs/development/libraries/libcmis/default.nix
+++ b/pkgs/development/libraries/libcmis/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcmis";
-  version = "0.6.0";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "tdf";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-E2A4uJUayqMMxVifzeAeYKLL+FiV2vShNNdXe5ZLXZ4=";
+    sha256 = "sha256-HXiyQKjOlQXWABY10XrOiYxPqfpmUJC3a6xD98LIHDw=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config docbook2x ];
diff --git a/pkgs/development/libraries/libdeltachat/Cargo.lock b/pkgs/development/libraries/libdeltachat/Cargo.lock
index 80f4eb3346f..26a8f666646 100644
--- a/pkgs/development/libraries/libdeltachat/Cargo.lock
+++ b/pkgs/development/libraries/libdeltachat/Cargo.lock
@@ -198,12 +198,12 @@ dependencies = [
 
 [[package]]
 name = "async-channel"
-version = "2.0.0"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "336d835910fab747186c56586562cb46f42809c2843ef3a84f47509009522838"
+checksum = "d37875bd9915b7d67c2f117ea2c30a0989874d0b2cb694fe25403c85763c0c9e"
 dependencies = [
  "concurrent-queue",
- "event-listener 3.0.0",
+ "event-listener 3.0.1",
  "event-listener-strategy",
  "futures-core",
  "pin-project-lite",
@@ -224,11 +224,11 @@ dependencies = [
 
 [[package]]
 name = "async-imap"
-version = "0.9.2"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "936c1b580be4373b48c9c687e0c79285441664398354df28d0860087cac0c069"
+checksum = "2e542b1682eba6b85a721daef0c58e79319ffd0c678565c07ac57c8071c548b5"
 dependencies = [
- "async-channel 1.9.0",
+ "async-channel 2.1.0",
  "base64 0.21.5",
  "bytes",
  "chrono",
@@ -290,7 +290,7 @@ checksum = "a66537f1bb974b254c98ed142ff995236e81b9d0fe4db0575f46612cb15eb0f9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -512,9 +512,9 @@ dependencies = [
 
 [[package]]
 name = "brotli-decompressor"
-version = "2.5.0"
+version = "2.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da74e2b81409b1b743f8f0c62cc6254afefb8b8e50bbfe3735550f7aeefa3448"
+checksum = "4e2e4afe60d7dd600fdd3de8d0f08c2b7ec039712e3b6137ff98b7004e82de4f"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -522,9 +522,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c79ad7fb2dd38f3dabd76b09c6a5a20c038fc0213ef1e9afd30eb777f120f019"
+checksum = "542f33a8835a0884b006a0c3df3dadd99c0c3f296ed26c2fdc8028e01ad6230c"
 dependencies = [
  "memchr",
  "serde",
@@ -707,18 +707,18 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.4.7"
+version = "4.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac495e00dcec98c83465d5ad66c5c4fabd652fd6686e7c6269b117e729a6f17b"
+checksum = "2275f18819641850fa26c89acc84d465c1bf91ce57bc2748b28c420473352f64"
 dependencies = [
  "clap_builder",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.4.7"
+version = "4.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c77ed9a32a62e6ca27175d00d29d05ca32e396ea1eb5fb01d8256b669cec7663"
+checksum = "07cdf1b148b25c1e1f7a42225e30a0d99a615cd4637eae7365548dd4529b95bc"
 dependencies = [
  "anstyle",
  "clap_lex",
@@ -824,9 +824,9 @@ checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.10"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fbc60abd742b35f2492f808e1abbb83d45f72db402e14c55057edc9c7b1e9e4"
+checksum = "ce420fe07aecd3e67c5f910618fe65e94158f6dcc0adf44e00d69ce2bdfe0fd0"
 dependencies = [
  "libc",
 ]
@@ -983,13 +983,13 @@ dependencies = [
 
 [[package]]
 name = "curve25519-dalek-derive"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fdaf97f4804dcebfa5862639bc9ce4121e82140bec2a987ac5140294865b5b"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -1087,11 +1087,11 @@ dependencies = [
 
 [[package]]
 name = "deltachat"
-version = "1.128.0"
+version = "1.131.1"
 dependencies = [
  "ansi_term",
  "anyhow",
- "async-channel 2.0.0",
+ "async-channel 2.1.0",
  "async-imap",
  "async-native-tls",
  "async-smtp",
@@ -1165,10 +1165,10 @@ dependencies = [
 
 [[package]]
 name = "deltachat-jsonrpc"
-version = "1.128.0"
+version = "1.131.1"
 dependencies = [
  "anyhow",
- "async-channel 2.0.0",
+ "async-channel 2.1.0",
  "axum",
  "base64 0.21.5",
  "deltachat",
@@ -1189,7 +1189,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-repl"
-version = "1.128.0"
+version = "1.131.1"
 dependencies = [
  "ansi_term",
  "anyhow",
@@ -1204,7 +1204,7 @@ dependencies = [
 
 [[package]]
 name = "deltachat-rpc-server"
-version = "1.128.0"
+version = "1.131.1"
 dependencies = [
  "anyhow",
  "deltachat",
@@ -1224,12 +1224,12 @@ name = "deltachat_derive"
 version = "2.0.0"
 dependencies = [
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "deltachat_ffi"
-version = "1.128.0"
+version = "1.131.1"
 dependencies = [
  "anyhow",
  "deltachat",
@@ -1433,7 +1433,7 @@ checksum = "487585f4d0c6655fe74905e2504d8ad6908e4db67f744eb140876906c2f3175d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -1461,9 +1461,9 @@ dependencies = [
 
 [[package]]
 name = "dyn-clone"
-version = "1.0.14"
+version = "1.0.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d2f3407d9a573d666de4b5bdf10569d73ca9478087346697dcbae6244bfbcd"
+checksum = "545b22097d44f8a9581187cdf93de7a71e4722bf51200cfaba810865b49a495d"
 
 [[package]]
 name = "ecdsa"
@@ -1613,6 +1613,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "embedded-io"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"
+
+[[package]]
 name = "encoded-words"
 version = "0.2.0"
 source = "git+https://github.com/async-email/encoded-words?branch=master#d55366b36f96e383f39c432aedce42ee8b43f796"
@@ -1720,7 +1726,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -1733,14 +1739,14 @@ dependencies = [
  "num-traits",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "env_logger"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85cdab6a89accf66733ad5a1693a4dcced6aeff64602b634530dd73c1f3ee9f0"
+checksum = "95b3f3e67048839cb0d0781f445682a35113da7121f7c949db0e2be96a4fbece"
 dependencies = [
  "humantime",
  "is-terminal",
@@ -1757,9 +1763,9 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.5"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3e13f66a2f95e32a39eaa81f6b95d42878ca0e1db0c7543723dfe12557e860"
+checksum = "7c18ee0ed65a5f1f81cac6b1d213b69c35fa47d4252ad41f1486dbd8226fe36e"
 dependencies = [
  "libc",
  "windows-sys",
@@ -1792,9 +1798,9 @@ checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
 
 [[package]]
 name = "event-listener"
-version = "3.0.0"
+version = "3.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29e56284f00d94c1bc7fd3c77027b4623c88c1f53d8d2394c6199f2921dea325"
+checksum = "01cec0252c2afff729ee6f00e903d479fba81784c8e2bd77447673471fdfaea1"
 dependencies = [
  "concurrent-queue",
  "parking",
@@ -1807,15 +1813,15 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d96b852f1345da36d551b9473fa1e2b1eb5c5195585c6c018118bc92a8d91160"
 dependencies = [
- "event-listener 3.0.0",
+ "event-listener 3.0.1",
  "pin-project-lite",
 ]
 
 [[package]]
 name = "fallible-iterator"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4443176a9f2c162692bd3d352d745ef9413eec5782a80d8fd6f8a1ac692a07f7"
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
 
 [[package]]
 name = "fallible-streaming-iterator"
@@ -1864,9 +1870,9 @@ dependencies = [
 
 [[package]]
 name = "fdeflate"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d329bdeac514ee06249dabc27877490f17f5d371ec693360768b838e19f3ae10"
+checksum = "64d6dafc854908ff5da46ff3f8f473c6984119a2876a383a860246dd7841a868"
 dependencies = [
  "simd-adler32",
 ]
@@ -1893,9 +1899,9 @@ dependencies = [
 
 [[package]]
 name = "fiat-crypto"
-version = "0.2.1"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0870c84016d4b481be5c9f323c24f65e31e901ae618f0e80f4308fb00de1d2d"
+checksum = "f69037fe1b785e84986b4f2cbcf647381876a00671d25ceef715d7812dd7e1dd"
 
 [[package]]
 name = "filetime"
@@ -1968,9 +1974,9 @@ version = "1.0.0"
 
 [[package]]
 name = "futures"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23342abe12aba583913b2e62f22225ff9c950774065e4bfb61a19cd9770fec40"
+checksum = "da0290714b38af9b4a7b094b8a37086d1b4e61f2df9122c3cad2577669145335"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1983,9 +1989,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2"
+checksum = "ff4dd66668b557604244583e3e1e1eada8c5c2e96a6d0d6653ede395b78bbacb"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -1993,15 +1999,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bca583b7e26f571124fe5b7561d49cb2868d79116cfa0eefce955557c6fee8c"
+checksum = "eb1d22c66e66d9d72e1758f0bd7d4fd0bee04cad842ee34587d68c07e45d088c"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccecee823288125bd88b4d7f565c9e58e41858e47ab72e8ea2d64e93624386e0"
+checksum = "0f4fb8693db0cf099eadcca0efe2a5a22e4550f98ed16aba6c48700da29597bc"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -2010,15 +2016,15 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fff74096e71ed47f8e023204cfd0aa1289cd54ae5430a9523be060cdb849964"
+checksum = "8bf34a163b5c4c52d0478a4d757da8fb65cabef42ba90515efee0f6f9fa45aaa"
 
 [[package]]
 name = "futures-lite"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c1155db57329dca6d018b61e76b1488ce9a2e5e44028cac420a5898f4fcef63"
+checksum = "d3831c2651acb5177cbd83943f3d9c8912c5ad03c76afcc0e9511ba568ec5ebb"
 dependencies = [
  "fastrand",
  "futures-core",
@@ -2026,37 +2032,36 @@ dependencies = [
  "memchr",
  "parking",
  "pin-project-lite",
- "waker-fn",
 ]
 
 [[package]]
 name = "futures-macro"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72"
+checksum = "53b153fd91e4b0147f4aced87be237c98248656bb01050b96bf3ee89220a8ddb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f43be4fe21a13b9781a69afa4985b0f6ee0e1afab2c6f454a8cf30e2b2237b6e"
+checksum = "e36d3378ee38c2a36ad710c5d30c2911d752cb941c00c72dbabfb786a7970817"
 
 [[package]]
 name = "futures-task"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76d3d132be6c0e6aa1534069c705a74a5997a356c0dc2f86a47765e5617c5b65"
+checksum = "efd193069b0ddadc69c46389b740bbccdd97203899b48d09c5f7969591d6bae2"
 
 [[package]]
 name = "futures-util"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b01e40b772d54cf6c6d721c1d1abd0647a0106a12ecaa1c186273392a69533"
+checksum = "a19526d624e703a3179b3d322efec918b6246ea0fa51d41124525f00f1cc8104"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -2094,9 +2099,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.10"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -2296,9 +2301,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "0.2.9"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd6effc99afb63425aff9b05836f029929e345a6148a14b7ecd5ab67af944482"
+checksum = "f95b9abcae896730d42b78e09c155ed4ddf82c07b4de772c64aee5b2d8b7c150"
 dependencies = [
  "bytes",
  "fnv",
@@ -2330,9 +2335,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "human-panic"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b82da652938b83f94cfdaaf9ae7aaadb8430d84b0dfda226998416318727eac2"
+checksum = "7a79a67745be0cb8dd2771f03b24c2f25df98d5471fe7a595d668cfa2e6f843d"
 dependencies = [
  "backtrace",
  "os_info",
@@ -2460,9 +2465,9 @@ dependencies = [
 
 [[package]]
 name = "imap-proto"
-version = "0.16.2"
+version = "0.16.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f73b1b63179418b20aa81002d616c5f21b4ba257da9bca6989ea64dc573933e0"
+checksum = "305c25c6e69416059e3396c4a062b84dc7b0a782cd4c84d82bab268eb0421ec7"
 dependencies = [
  "nom",
 ]
@@ -2479,9 +2484,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.0.2"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8adf3ddd720272c6ea8bf59463c04e0f93d0bbf7c5439b691bca2987e0270897"
+checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
 dependencies = [
  "equivalent",
  "hashbrown 0.14.2",
@@ -2591,9 +2596,9 @@ checksum = "bc0000e42512c92e31c2252315bda326620a4e034105e900c98ec492fa077b3e"
 
 [[package]]
 name = "js-sys"
-version = "0.3.64"
+version = "0.3.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
+checksum = "54c0c35952f67de54bb584e9fd912b3023117cbafc0a77d8f3dee1fb5f572fe8"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -2651,9 +2656,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.149"
+version = "0.2.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
+checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
 
 [[package]]
 name = "libm"
@@ -2662,10 +2667,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
 
 [[package]]
+name = "libredox"
+version = "0.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85c833ca1e66078851dba29046874e38f08b2c883700aa29a03ddd3b23814ee8"
+dependencies = [
+ "bitflags 2.4.1",
+ "libc",
+ "redox_syscall 0.4.1",
+]
+
+[[package]]
 name = "libsqlite3-sys"
-version = "0.26.0"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "afc22eff61b133b115c6e8c74e818c628d6d5e7a502afea6f64dee076dd94326"
+checksum = "cf4e226dcd58b4be396f7bd3c20da8fdee2911400705297ba7d2d7cc2c30f716"
 dependencies = [
  "cc",
  "openssl-sys",
@@ -2681,9 +2697,9 @@ checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"
+checksum = "969488b55f8ac402214f3f5fd243ebb7206cf82de60d3172994707a4bcc2b829"
 
 [[package]]
 name = "lock_api"
@@ -2818,7 +2834,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a51313c5820b0b02bd422f4b44776fbf47961755c74ce64afc73bfad10226c3"
 dependencies = [
- "getrandom 0.2.10",
+ "getrandom 0.2.11",
 ]
 
 [[package]]
@@ -2974,7 +2990,7 @@ checksum = "cfb77679af88f8b125209d354a202862602672222e7f2313fdd6dc349bad4712"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -3067,9 +3083,9 @@ checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
 
 [[package]]
 name = "openssl"
-version = "0.10.57"
+version = "0.10.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bac25ee399abb46215765b1cb35bc0212377e58a061560d8b29b024fd0430e7c"
+checksum = "7a257ad03cd8fb16ad4172fedf8094451e1af1c4b70097636ef2eac9a5f0cc33"
 dependencies = [
  "bitflags 2.4.1",
  "cfg-if",
@@ -3088,7 +3104,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -3108,9 +3124,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.93"
+version = "0.9.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db4d56a4c0478783083cfafcc42493dd4a981d41669da64b4572a2a089b51b1d"
+checksum = "40a4130519a360279579c2053038317e40eff64d13fd3f004f9e1b72b8a6aaf9"
 dependencies = [
  "cc",
  "libc",
@@ -3206,13 +3222,13 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.3.5",
+ "redox_syscall 0.4.1",
  "smallvec",
  "windows-targets",
 ]
@@ -3296,7 +3312,7 @@ dependencies = [
  "p384 0.13.0",
  "rand 0.8.5",
  "ripemd",
- "rsa 0.9.2",
+ "rsa 0.9.3",
  "sha1",
  "sha2 0.10.8",
  "sha3",
@@ -3325,7 +3341,7 @@ checksum = "4359fd9c9171ec6e8c62926d6faaf553a8dc3f64e1507e76da7911b4f6a04405"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -3391,9 +3407,9 @@ checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
 
 [[package]]
 name = "platforms"
-version = "3.1.2"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4503fa043bf02cee09a9582e9554b4c6403b2ef55e4612e96561d294419429f8"
+checksum = "14e6ab3f592e6fb464fc9712d8d6e6912de6473954635fd76a589d832cffcbb0"
 
 [[package]]
 name = "plotters"
@@ -3444,12 +3460,13 @@ checksum = "3bccab0e7fd7cc19f820a1c8c91720af652d0c88dc9664dd72aef2614f04af3b"
 
 [[package]]
 name = "postcard"
-version = "1.0.6"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9ee729232311d3cd113749948b689627618133b1c5012b77342c1950b25eaeb"
+checksum = "a55c51ee6c0db07e68448e336cf8ea4131a620edefebf9893e759b2d793420f8"
 dependencies = [
  "cobs",
  "const_format",
+ "embedded-io",
  "postcard-derive",
  "serde",
 ]
@@ -3499,9 +3516,9 @@ dependencies = [
 
 [[package]]
 name = "primeorder"
-version = "0.13.2"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c2fcef82c0ec6eefcc179b978446c399b3cdf73c392c35604e399eee6df1ee3"
+checksum = "c7dbe9ed3b56368bd99483eb32fe9c17fdd3730aebadc906918ce78d54c7eeb4"
 dependencies = [
  "elliptic-curve 0.13.6",
 ]
@@ -3541,9 +3558,9 @@ dependencies = [
 
 [[package]]
 name = "proptest"
-version = "1.3.1"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c003ac8c77cb07bb74f5f198bce836a689bcd5a42574612bf14d17bfd08c20e"
+checksum = "31b476131c3c86cb68032fdc5cb6d5a1045e3e42d96b69fa599fd77701e1f5bf"
 dependencies = [
  "bitflags 2.4.1",
  "lazy_static",
@@ -3551,7 +3568,7 @@ dependencies = [
  "rand 0.8.5",
  "rand_chacha 0.3.1",
  "rand_xorshift",
- "regex-syntax 0.7.5",
+ "regex-syntax 0.8.2",
  "unarray",
 ]
 
@@ -3614,9 +3631,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.10.5"
+version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c78e758510582acc40acb90458401172d41f1016f8c9dde89e49677afb7eec1"
+checksum = "141bf7dfde2fbc246bfd3fe12f2455aa24b0fbd9af535d8c86c7bd1381ff2b1a"
 dependencies = [
  "bytes",
  "rand 0.8.5",
@@ -3727,7 +3744,7 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.10",
+ "getrandom 0.2.11",
 ]
 
 [[package]]
@@ -3786,30 +3803,30 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.2.16"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
 dependencies = [
  "bitflags 1.3.2",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.3.5"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
  "bitflags 1.3.2",
 ]
 
 [[package]]
 name = "redox_users"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
+checksum = "a18479200779601e498ada4e8c1e1f50e3ee19deb0259c25825a98b5603b2cb4"
 dependencies = [
- "getrandom 0.2.10",
- "redox_syscall 0.2.16",
+ "getrandom 0.2.11",
+ "libredox",
  "thiserror",
 ]
 
@@ -3853,12 +3870,6 @@ checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
-
-[[package]]
-name = "regex-syntax"
 version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
@@ -3954,7 +3965,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fb0205304757e5d899b9c2e448b867ffd03ae7f988002e47cd24954391394d0b"
 dependencies = [
  "cc",
- "getrandom 0.2.10",
+ "getrandom 0.2.11",
  "libc",
  "spin 0.9.8",
  "untrusted 0.9.0",
@@ -3993,16 +4004,14 @@ dependencies = [
 
 [[package]]
 name = "rsa"
-version = "0.9.2"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ab43bb47d23c1a631b4b680199a45255dce26fa9ab2fa902581f624ff13e6a8"
+checksum = "86ef35bf3e7fe15a53c4ab08a998e42271eab13eb0db224126bc7bc4c4bad96d"
 dependencies = [
- "byteorder",
  "const-oid",
  "digest 0.10.7",
  "num-bigint-dig",
  "num-integer",
- "num-iter",
  "num-traits",
  "pkcs1 0.7.5",
  "pkcs8 0.10.2",
@@ -4015,9 +4024,9 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.29.0"
+version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "549b9d036d571d42e6e85d1c1425e2ac83491075078ca9a15be021c56b1641f2"
+checksum = "a78046161564f5e7cd9008aff3b2990b3850dc8e0349119b98e8f251e099f24d"
 dependencies = [
  "bitflags 2.4.1",
  "fallible-iterator",
@@ -4065,9 +4074,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.20"
+version = "0.38.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67ce50cb2e16c2903e30d1cbccfd8387a74b9d4c938b6a4c5ec6cc7556f7a8a0"
+checksum = "2b426b0506e5d50a7d8dafcf2e81471400deb602392c7dd110815afb4eaf02a3"
 dependencies = [
  "bitflags 2.4.1",
  "errno",
@@ -4101,9 +4110,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pemfile"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d3987094b1d07b653b7dfdc3f70ce9a1da9c51ac18c1b06b662e4f9a0e9f4b2"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
 dependencies = [
  "base64 0.21.5",
 ]
@@ -4189,9 +4198,9 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "0.8.15"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f7b0ce13155372a76ee2e1c5ffba1fe61ede73fbea5630d61eee6fac4929c0c"
+checksum = "45a28f4c49489add4ce10783f7911893516f15afe45d015608d41faca6bc4d29"
 dependencies = [
  "dyn-clone",
  "schemars_derive",
@@ -4201,9 +4210,9 @@ dependencies = [
 
 [[package]]
 name = "schemars_derive"
-version = "0.8.15"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e85e2a16b12bdb763244c69ab79363d71db2b4b918a2def53f80b02e0574b13c"
+checksum = "c767fd6fa65d9ccf9cf026122c1b555f2ef9a4f0cea69da4d7dbc3e258d30967"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4280,9 +4289,9 @@ dependencies = [
 
 [[package]]
 name = "self_cell"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c309e515543e67811222dbc9e3dd7e1056279b782e1dacffe4242b718734fb6"
+checksum = "e388332cd64eb80cd595a00941baf513caffae8dce9cfd0467fc9c66397dade6"
 
 [[package]]
 name = "semver"
@@ -4295,9 +4304,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.190"
+version = "1.0.192"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91d3c334ca1ee894a2c6f6ad698fe8c435b76d504b13d436f0685d648d6d96f7"
+checksum = "bca2a08484b285dcb282d0f67b26cadc0df8b19f8c12502c13d966bf9482f001"
 dependencies = [
  "serde_derive",
 ]
@@ -4322,13 +4331,13 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.190"
+version = "1.0.192"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67c5609f394e5c2bd7fc51efda478004ea80ef42fee983d5c67a65e34f32c0e3"
+checksum = "d6c7207fbec9faa48073f3e3074cbe553af6ea512d7c21ba46e434e70ea9fbc1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -4344,9 +4353,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.107"
+version = "1.0.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
+checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
 dependencies = [
  "itoa",
  "ryu",
@@ -4495,9 +4504,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.11.1"
+version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
+checksum = "4dccd0940a2dcdf68d092b8cbab7dc0ad8fa938bf95787e1b916b0e3d0e8e970"
 
 [[package]]
 name = "smawk"
@@ -4629,7 +4638,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -4651,9 +4660,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.38"
+version = "2.0.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
+checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4721,13 +4730,13 @@ checksum = "094c9f64d6de9a8506b1e49b63a29333b37ed9e821ee04be694d431b3264c3c5"
 
 [[package]]
 name = "tempfile"
-version = "3.8.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
+checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
 dependencies = [
  "cfg-if",
  "fastrand",
- "redox_syscall 0.3.5",
+ "redox_syscall 0.4.1",
  "rustix",
  "windows-sys",
 ]
@@ -4783,7 +4792,7 @@ checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -4863,9 +4872,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.33.0"
+version = "1.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f38200e3ef7995e5ef13baec2f432a6da0aa9ac495b2c0e8f3b7eec2c92d653"
+checksum = "d0c014766411e834f7af5b8f4cf46257aab4036ca95e9d2c144a10f59ad6f5b9"
 dependencies = [
  "backtrace",
  "bytes",
@@ -4892,13 +4901,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.1.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
+checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -4980,9 +4989,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.7.8"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd79e69d3b627db300ff956027cc6c3798cef26d22526befdfcd12feeb6d2257"
+checksum = "a1a195ec8c9da26928f773888e0742ca3ca1040c6cd859c919c9f59c1954ab35"
 dependencies = [
  "serde",
  "serde_spanned",
@@ -5001,11 +5010,11 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.19.15"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
+checksum = "d34d383cd00a163b4a5b85053df514d45bc330f6de7737edfe0a93311d1eaa03"
 dependencies = [
- "indexmap 2.0.2",
+ "indexmap 2.1.0",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -5060,7 +5069,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -5268,7 +5277,7 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "88ad59a7560b41a70d191093a945f0b87bc1deeda46fb237479708a1d6b6cdfc"
 dependencies = [
- "getrandom 0.2.10",
+ "getrandom 0.2.11",
  "serde",
 ]
 
@@ -5291,12 +5300,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
 [[package]]
-name = "waker-fn"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c4517f54858c779bbcbf228f4fca63d121bf85fbecb2dc578cdf4a39395690"
-
-[[package]]
 name = "walkdir"
 version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5335,9 +5338,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
+checksum = "7daec296f25a1bae309c0cd5c29c4b260e510e6d813c286b19eaadf409d40fce"
 dependencies = [
  "cfg-if",
  "wasm-bindgen-macro",
@@ -5345,24 +5348,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
+checksum = "e397f4664c0e4e428e8313a469aaa58310d302159845980fd23b0f22a847f217"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.37"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c02dbc21516f9f1f04f187958890d7e6026df8d16540b7ad9492bc34a67cea03"
+checksum = "9afec9963e3d0994cac82455b2b3502b81a7f40f9a0d32181f7528d9f4b43e02"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -5372,9 +5375,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
+checksum = "5961017b3b08ad5f3fe39f1e79877f8ee7c23c5e5fd5eb80de95abc41f1f16b2"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -5382,28 +5385,28 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
+checksum = "c5353b8dab669f5e10f5bd76df26a9360c748f054f862ff5f3f8aae0c7fb3907"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.87"
+version = "0.2.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
+checksum = "0d046c5d029ba91a1ed14da14dca44b68bf2f124cfbaf741c54151fdb3e0750b"
 
 [[package]]
 name = "web-sys"
-version = "0.3.64"
+version = "0.3.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b85cbef8c220a6abc02aefd892dfc0fc23afb1c6a426316ec33253a3877249b"
+checksum = "5db499c5f66323272151db0e666cd34f78617522fb0c1604d31a27c50c206a85"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -5582,9 +5585,9 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "winnow"
-version = "0.5.17"
+version = "0.5.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3b801d0e0a6726477cc207f60162da452f3a95adb368399bef20a946e06f65c"
+checksum = "829846f3e3db426d4cee4510841b71a8e58aa2a76b1132579487ae430ccd9c7b"
 dependencies = [
  "memchr",
 ]
@@ -5691,22 +5694,22 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.7.15"
+version = "0.7.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81ba595b9f2772fbee2312de30eeb80ec773b4cb2f1e8098db024afadda6c06f"
+checksum = "8cd369a67c0edfef15010f980c3cbe45d7f651deac2cd67ce097cd801de16557"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.7.15"
+version = "0.7.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "772666c41fb6dceaf520b564b962d738a8e1a83b41bd48945f50837aed78bb1d"
+checksum = "c2f140bda219a26ccc0cdb03dba58af72590c53b22642577d88a927bc5c87d6b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
 
 [[package]]
@@ -5726,5 +5729,5 @@ checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn 2.0.39",
 ]
diff --git a/pkgs/development/libraries/libdeltachat/default.nix b/pkgs/development/libraries/libdeltachat/default.nix
index 092a235d9fd..d62e8bf245c 100644
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@@ -30,13 +30,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "1.128.0";
+  version = "1.131.1";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-core-rust";
     rev = "v${version}";
-    hash = "sha256-kujPkKKobn4/J0rCdZfnlNZzGM0SUVtOWOhyDawYiqw=";
+    hash = "sha256-JXSZrlekvPVGKR+ritxk3Eru2DhtUN9UBtqUZ7G9/gg=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index c36e3116dad..4c3740e4ba7 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -155,16 +155,12 @@ stdenv.mkDerivation rec {
       src/storage/storage_backend_disk.c \
       src/storage/storage_util.c
   '' + lib.optionalString isDarwin ''
-    sed -i '/qemucapabilitiestest/d' tests/meson.build
-    sed -i '/vircryptotest/d' tests/meson.build
-    sed -i '/domaincapstest/d' tests/meson.build
+    # Darwin doesn’t support -fsemantic-interposition, but the problem doesn’t seem to affect Mach-O.
+    # See https://gitlab.com/libvirt/libvirt/-/merge_requests/235
+    sed -i "s/not supported_cc_flags.contains('-fsemantic-interposition')/false/" meson.build
     sed -i '/qemufirmwaretest/d' tests/meson.build
     sed -i '/qemuvhostusertest/d' tests/meson.build
     sed -i '/qemuxml2xmltest/d' tests/meson.build
-  '' + lib.optionalString (isDarwin && isx86_64) ''
-    sed -i '/qemucaps2xmltest/d' tests/meson.build
-    sed -i '/qemuhotplugtest/d' tests/meson.build
-    sed -i '/virnetdaemontest/d' tests/meson.build
   '';
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/omorfi/default.nix b/pkgs/development/libraries/omorfi/default.nix
index d6d0f1741d1..6002ea46467 100644
--- a/pkgs/development/libraries/omorfi/default.nix
+++ b/pkgs/development/libraries/omorfi/default.nix
@@ -3,6 +3,7 @@
 , autoreconfHook
 , cg3
 , fetchFromGitHub
+, fetchpatch
 , hfst
 , hfst-ospell
 , icu
@@ -24,6 +25,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-UoqdwNWCNOPX6u1YBlnXUcB/fmcvcy/HXbYciVrMBOY=";
   };
 
+  patches = [
+    # allow building with python311.
+    # patch is incorporated upstream and should be removed on the next update
+    (fetchpatch {
+      name = "python311.patch";
+      url = "https://github.com/flammie/omorfi/commit/9736452ae6624060dbea0876a722c3731e776357.patch";
+      hash = "sha256-Q4fi5HMmO0fq8YI833vgv2EYp//9Um/xFoRk28WrUMk=";
+    })
+  ];
+
   # Fix for omorfi-hyphenate.sh file not found error
   postInstall = ''
     ln -s $out/share/omorfi/{omorfi.hyphenate-rules.hfst,omorfi.hyphenate.hfst}
diff --git a/pkgs/development/libraries/sentry-native/default.nix b/pkgs/development/libraries/sentry-native/default.nix
index e8c090e392b..95ba1dc68e5 100644
--- a/pkgs/development/libraries/sentry-native/default.nix
+++ b/pkgs/development/libraries/sentry-native/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sentry-native";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-native";
     rev = version;
-    hash = "sha256-mi9mEyb25fb3W6X07TX36fW6T2SOPOkDvpIXQn5sg8Q=";
+    hash = "sha256-pEFfs8xjc+6r+60aJF4Sjjy/oSU/+ADWgOBpS3t9rWI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/vulkan-utility-libraries/default.nix b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
index f82fad83627..c79f599f5c6 100644
--- a/pkgs/development/libraries/vulkan-utility-libraries/default.nix
+++ b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.3.269";
+  version = "1.3.270";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7BN+U97dqpSyCYhHuFTPqokRnABH7Gt91njZPxItpzg=";
+    hash = "sha256-P1v5UEAooTDGA10K4uck8lhcrbW2ccl44gWIGVnZ6uo=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/libraries/wxwidgets/wxGTK32.nix b/pkgs/development/libraries/wxwidgets/wxGTK32.nix
index 280602eee59..91a0b00670c 100644
--- a/pkgs/development/libraries/wxwidgets/wxGTK32.nix
+++ b/pkgs/development/libraries/wxwidgets/wxGTK32.nix
@@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wxwidgets";
-  version = "3.2.3";
+  version = "3.2.4";
 
   src = fetchFromGitHub {
     owner = "wxWidgets";
     repo = "wxWidgets";
     rev = "v${version}";
-    hash = "sha256-tuLNNhQA9HGax1aueZHQ+eB2dyIQnKjlmarp7e6Jplc=";
+    hash = "sha256-YkV150sDsfBEHvHne0GF6i8Y5881NrByPkLtPAmb24E=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/ocaml-modules/cry/default.nix b/pkgs/development/ocaml-modules/cry/default.nix
index 60ecb885d80..8e475a7987c 100644
--- a/pkgs/development/ocaml-modules/cry/default.nix
+++ b/pkgs/development/ocaml-modules/cry/default.nix
@@ -2,19 +2,21 @@
 
 buildDunePackage rec {
   pname = "cry";
-  version = "0.6.7";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "savonet";
     repo = "ocaml-cry";
     rev = "v${version}";
-    sha256 = "sha256-1Omp3LBKGTPVwEBd530H0Djn3xiEjOHLqso6S8yIJSQ=";
+    sha256 = "sha256-wn9hLqbydzFTdYsJ1e76dmDLtwcZ7CGjbzFe5o9veYQ=";
   };
 
   postPatch = ''
     substituteInPlace src/dune --replace bytes ""
   '';
 
+  minimalOCamlVersion = "4.12";
+
   meta = with lib; {
     homepage = "https://github.com/savonet/ocaml-cry";
     description = "OCaml client for the various icecast & shoutcast source protocols";
diff --git a/pkgs/development/ocaml-modules/ffmpeg/base.nix b/pkgs/development/ocaml-modules/ffmpeg/base.nix
index 59405349130..e8bb6128db6 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/base.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/base.nix
@@ -1,15 +1,13 @@
 { lib, fetchFromGitHub }:
 
 rec {
-  version = "1.1.7";
-
-  duneVersion = "3";
+  version = "1.1.8";
 
   src = fetchFromGitHub {
     owner = "savonet";
     repo = "ocaml-ffmpeg";
     rev = "v${version}";
-    sha256 = "sha256-0QDy0ZUAtojYIuNliiDV2uywBnWxtKUhZ/LPqkfSOZ4=";
+    sha256 = "sha256-XqZATaxpW0lEdrRTXVTc0laQAx437+eoa/zOzZV1kHk=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/ocaml-modules/ffmpeg/default.nix b/pkgs/development/ocaml-modules/ffmpeg/default.nix
index f3364cb548a..10e837dcd62 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/default.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/default.nix
@@ -14,7 +14,7 @@ buildDunePackage {
 
   minimalOCamlVersion = "4.08";
 
-  inherit (ffmpeg-base) version src duneVersion;
+  inherit (ffmpeg-base) version src;
 
   propagatedBuildInputs = [
     ffmpeg-avutil
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-av.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-av.nix
index 73b8ed0f6ae..b902f72bc1e 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-av.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-av.nix
@@ -11,7 +11,7 @@ buildDunePackage {
 
   minimalOCamlVersion = "4.08";
 
-  inherit (ffmpeg-base) version src duneVersion;
+  inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dune-configurator ] ++ lib.optionals stdenv.isDarwin [ AudioToolbox VideoToolbox ];
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avcodec.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avcodec.nix
index 1ff5a89ee30..bce592a8a2c 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avcodec.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avcodec.nix
@@ -11,7 +11,7 @@ buildDunePackage {
 
   minimalOCamlVersion = "4.08";
 
-  inherit (ffmpeg-base) version src duneVersion;
+  inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dune-configurator ]
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix
index b2537bd25be..3d27ab80315 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix
@@ -17,7 +17,7 @@ buildDunePackage {
 
   minimalOCamlVersion = "4.08";
 
-  inherit (ffmpeg-base) version src duneVersion;
+  inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dune-configurator ]
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avfilter.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avfilter.nix
index 32342860d13..524bc600093 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avfilter.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avfilter.nix
@@ -13,7 +13,7 @@ buildDunePackage {
 
   minimalOCamlVersion = "4.08";
 
-  inherit (ffmpeg-base) version src duneVersion;
+  inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dune-configurator ]
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avutil.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avutil.nix
index a271b984d14..6cd71ebd58e 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avutil.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avutil.nix
@@ -9,7 +9,7 @@ buildDunePackage {
 
   minimalOCamlVersion = "4.08";
 
-  inherit (ffmpeg-base) version src duneVersion;
+  inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dune-configurator ] ++ lib.optionals stdenv.isDarwin [ AudioToolbox VideoToolbox ];
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swresample.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swresample.nix
index fb6fbda58d2..a6012a44171 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swresample.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swresample.nix
@@ -10,7 +10,7 @@ buildDunePackage {
 
   minimalOCamlVersion = "4.08";
 
-  inherit (ffmpeg-base) version src duneVersion;
+  inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dune-configurator ] ++ lib.optionals stdenv.isDarwin [ VideoToolbox ];
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swscale.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swscale.nix
index a085795831b..773b10ee168 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swscale.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swscale.nix
@@ -10,7 +10,7 @@ buildDunePackage {
 
   minimalOCamlVersion = "4.08";
 
-  inherit (ffmpeg-base) version src duneVersion;
+  inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dune-configurator ] ++ lib.optionals stdenv.isDarwin [ VideoToolbox ];
diff --git a/pkgs/development/ocaml-modules/flac/default.nix b/pkgs/development/ocaml-modules/flac/default.nix
index d79416b7053..c30236e0e2c 100644
--- a/pkgs/development/ocaml-modules/flac/default.nix
+++ b/pkgs/development/ocaml-modules/flac/default.nix
@@ -2,13 +2,13 @@
 
 buildDunePackage rec {
   pname = "flac";
-  version = "0.3.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "savonet";
     repo = "ocaml-flac";
     rev = "v${version}";
-    sha256 = "sha256-oMmxZtphEX/OPfyTumjkWQJidAjSRqriygaTjVJTCG0=";
+    sha256 = "sha256-HRRQd//e6Eh2HuyO+U00ILu5FoBT9jf/nRJzDOie70A=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/ocaml-modules/metadata/default.nix b/pkgs/development/ocaml-modules/metadata/default.nix
new file mode 100644
index 00000000000..789825175e4
--- /dev/null
+++ b/pkgs/development/ocaml-modules/metadata/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildDunePackage, fetchFromGitHub, dune-configurator, pkg-config, ogg, flac }:
+
+buildDunePackage rec {
+  pname = "metadata";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "savonet";
+    repo = "ocaml-metadata";
+    rev = "v${version}";
+    sha256 = "sha256-sSekkyJ8D6mCCmxIyd+pBk/khaehA3BcpUQl2Gln+Ic=";
+  };
+
+  minimalOCamlVersion = "4.14";
+
+  meta = with lib; {
+    homepage = "https://github.com/savonet/ocaml-metadata";
+    description = "Library to read metadata from files in various formats. ";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}
diff --git a/pkgs/development/python-modules/accuweather/default.nix b/pkgs/development/python-modules/accuweather/default.nix
index 7e83d5a6b9a..8aa2719385a 100644
--- a/pkgs/development/python-modules/accuweather/default.nix
+++ b/pkgs/development/python-modules/accuweather/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "accuweather";
-  version = "2.0.0";
+  version = "2.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "bieniu";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-elpVclH/sVQHEp3kTiwbDproJcB85F7m5sEjXwSEtNk=";
+    hash = "sha256-7uCR/xUARUakODeLVdI13D9ZksvN9c63o3Q0MlJp8cs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index e7ed02bbe04..97966e6bb33 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.53.0";
+  version = "3.54.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Adafruit-PlatformDetect";
     inherit version;
-    hash = "sha256-P6oR9Aszj2yj2w+2hAjCMDwngJ+uuUNLpgZooYImzyk=";
+    hash = "sha256-P+f7eBqD0/KIEry/807dQQCvtokB2cYu4i0H6CTYIWg=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index e433aa42599..d669fa98384 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.76";
+  version = "9.2.77";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-RIYGWPvQ2n+NgZHw2pGEvgWAtbpb/rdyb6/K4JClRxM=";
+    hash = "sha256-Bff44LSWdoXrijTAjnlsaN5iqDbHjfmYqe0FR4dmZxU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 9af84e2ff91..d1dc513c0b0 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "18.4.0";
+  version = "18.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-jSPoVMtGRtqpDFagjvLTxps5plcN92Mp9vjtQlmqyGg=";
+    hash = "sha256-o1Yv4/wSM2k+L2/JP3teUj129QlyLjoShCRWJ3lIN98=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aiomisc/default.nix b/pkgs/development/python-modules/aiomisc/default.nix
index 77016c323d9..671cce69c6f 100644
--- a/pkgs/development/python-modules/aiomisc/default.nix
+++ b/pkgs/development/python-modules/aiomisc/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "aiomisc";
-  version = "17.3.23";
+  version = "17.3.25";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-9Df/eGMnXFdv3RUh4LmlPm7STlUcVBw4flfH+bZ6q9Q=";
+    hash = "sha256-EPEfBK/1nbwcajqyv5lFX+02WMvbyFnij2w5J91+UK8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index e3d0f027114..1c26f847f62 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.76";
+  version = "9.2.77";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "angr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-B3oYh0okbIeEvBjBHvY29QTqPyR2TTzLmz6fMsIRcs0=";
+    hash = "sha256-EslJnwgZUUN+EtyjGi/7a4Upr2/vbfNXpkc7I+/ZrU8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index 8b72b5e8e99..af7635184a0 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "5.5.1";
+  version = "5.5.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "AppThreat";
     repo = "vulnerability-db";
     rev = "refs/tags/v${version}";
-    hash = "sha256-URDVNuUrxWoQjeNRPrSJz8aiEozn5BzRTvhqc4bihA0=";
+    hash = "sha256-ioFTayuPkxXIaaKKVHBLyU47jID6dGWCX1G9kVkD5Yo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 2e5ebe9e8e0..c8383ecc9af 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.76";
+  version = "9.2.77";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-g1qlcaSByXhF+6ffxwbV/0tXFdmLySH3TcDuok4y6xw=";
+    hash = "sha256-uTkPDhk4Ugyb9HV/0PMwWpuNajpzfTn1dg7gsQnc/zg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/argcomplete/default.nix b/pkgs/development/python-modules/argcomplete/default.nix
index 5eec27d6782..765a7848ac5 100644
--- a/pkgs/development/python-modules/argcomplete/default.nix
+++ b/pkgs/development/python-modules/argcomplete/default.nix
@@ -8,8 +8,8 @@
 
 buildPythonPackage rec {
   pname = "argcomplete";
-  version = "3.1.2";
-  format = "pyproject";
+  version = "3.1.6";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "kislyuk";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-vKXHmCcZZTjVBwQZWtyRjJT4tTuIiK5Qos9yJT/mpag=";
+    hash = "sha256-Akwa6dsf8w/Sw0ydUrqKEP5+dzHYX4hS8vcl7Gw4ePc=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -35,9 +35,10 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/kislyuk/argcomplete/blob/v${version}/Changes.rst";
     description = "Bash tab completion for argparse";
+    downloadPage = "https://github.com/kislyuk/argcomplete";
     homepage = "https://kislyuk.github.io/argcomplete/";
-    changelog = "https://github.com/kislyuk/argcomplete/blob/v${version}/Changes.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ womfoo ];
   };
diff --git a/pkgs/development/python-modules/argilla/default.nix b/pkgs/development/python-modules/argilla/default.nix
index 6f6ba426687..26a527eb4f8 100644
--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@@ -65,7 +65,7 @@
 }:
 let
   pname = "argilla";
-  version = "1.18.0";
+  version = "1.19.0";
   optional-dependencies = {
     server = [
       fastapi
@@ -126,7 +126,7 @@ buildPythonPackage {
     owner = "argilla-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-2VWzmNMdd4WXSBrMSmclpjSZ9jDKNG7GbndUh8zLmgQ=";
+    hash = "sha256-Idl5Tm1XWgBLVgHPbXiyt9MW4J5wZdPb2J7iIDBnorg=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/authcaptureproxy/default.nix b/pkgs/development/python-modules/authcaptureproxy/default.nix
index a73403518b4..e18375c1f5d 100644
--- a/pkgs/development/python-modules/authcaptureproxy/default.nix
+++ b/pkgs/development/python-modules/authcaptureproxy/default.nix
@@ -44,6 +44,16 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # test fails with frequency 1/200
+    # https://github.com/alandtse/auth_capture_proxy/issues/25
+    "test_return_timer_countdown_refresh_html"
+  ];
+
+  pythonImportsCheck = [
+    "authcaptureproxy"
+  ];
+
   meta = with lib; {
     changelog = "https://github.com/alandtse/auth_capture_proxy/releases/tag/v${version}";
     description = "A proxy to capture authentication information from a webpage";
diff --git a/pkgs/development/python-modules/bitarray/default.nix b/pkgs/development/python-modules/bitarray/default.nix
index 55f709c0e3d..e69b31b118f 100644
--- a/pkgs/development/python-modules/bitarray/default.nix
+++ b/pkgs/development/python-modules/bitarray/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "bitarray";
-  version = "2.8.2";
+  version = "2.8.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+QsvRLWyM2TV+63iw0ZS4Vsfz+gTxG+CjgCPaKcJFg8=";
+    hash = "sha256-4VWHsr3xjTLrO6JfX1pRvt0NwGsxEqTFPated1O8ZYg=";
   };
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/canals/default.nix b/pkgs/development/python-modules/canals/default.nix
index 2b3af3e5702..f06975bbfc1 100644
--- a/pkgs/development/python-modules/canals/default.nix
+++ b/pkgs/development/python-modules/canals/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "canals";
-  version = "0.9.0";
+  version = "0.10.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "deepset-ai";
     repo = "canals";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5pRrpi1qxkFgGqcw7Nfc5rnOTra27H31DLKCglkPf6s=";
+    hash = "sha256-zTC9zaY2WQ4Sx/1YeEaw23UH0hoP/ktMwzH8x/rER00=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index c185d1148bd..52a3bf6482d 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.76";
+  version = "9.2.77";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "claripy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-BwhM5J+20ZvP0d+9TAqy0AgRuPU6XoLKgM88WJdf3Qg=";
+    hash = "sha256-YLa70xxLDyOOKQg/PzFO90JzS5SyvgcJ2+Nltz0q6T8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index efc5c616819..6b56defb4cb 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,14 +16,14 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.76";
+  version = "9.2.77";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
     owner = "angr";
     repo = "binaries";
     rev = "refs/tags/v${version}";
-    hash = "sha256-01Y4UKTkaO6bYtVTvv4KFzkEdj4qKiWKaC80/iKa/Eg=";
+    hash = "sha256-YPxdKwR+pq0S1B9GltE8r3bFWDPpCU8OQ05w+kp4lAs=";
   };
 
 in
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "cle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uMT9LvDkXl3SueR80pgGJRkWbymDRmGEn8HV93K/VNc=";
+    hash = "sha256-tdfV+DoDcRO+8TjiBc0u1huA+etF4MY5uYj670lqudY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/edalize/default.nix b/pkgs/development/python-modules/edalize/default.nix
index 9455cdc1b81..0005a4cb2e6 100644
--- a/pkgs/development/python-modules/edalize/default.nix
+++ b/pkgs/development/python-modules/edalize/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "edalize";
-  version = "0.5.0";
+  version = "0.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "olofk";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-jsrJr/iuezh9/KL0PykWB1XKev4Wr5QeDh0ZWNMZSp8=";
+    hash = "sha256-foq1CwIe86d+s7PlhLlGpnJCwrpOyr+uf5/RMLASSJU=";
   };
 
   postPatch = ''
@@ -52,6 +52,21 @@ buildPythonPackage rec {
     "edalize"
   ];
 
+  disabledTests = [
+    # disable failures related to pandas 2.1.0 apply(...,errors="ignore")
+    # behavior change. upstream pins pandas to 2.0.3 as of 2023-10-10
+    # https://github.com/olofk/edalize/commit/2a3db6658752f97c61048664b478ebfe65a909f8
+    "test_picorv32_artix7_summary"
+    "test_picorv32_artix7_resources"
+    "test_picorv32_artix7_timing"
+    "test_picorv32_kusp_summary"
+    "test_picorv32_kusp_resources"
+    "test_picorv32_kusp_timing"
+    "test_linux_on_litex_vexriscv_arty_a7_summary"
+    "test_linux_on_litex_vexriscv_arty_a7_resources"
+    "test_linux_on_litex_vexriscv_arty_a7_timing"
+  ];
+
   disabledTestPaths = [
     "tests/test_questa_formal.py"
     "tests/test_slang.py"
diff --git a/pkgs/development/python-modules/euclid3/default.nix b/pkgs/development/python-modules/euclid3/default.nix
new file mode 100644
index 00000000000..3d723eca565
--- /dev/null
+++ b/pkgs/development/python-modules/euclid3/default.nix
@@ -0,0 +1,25 @@
+{ buildPythonPackage
+, lib
+, fetchPypi
+}:
+buildPythonPackage rec {
+  pname = "euclid3";
+  version = "0.01";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-JbgnpXrb/Zo/qGJeQ6vD6Qf2HeYiND5+U4SC75tG/Qs=";
+  };
+
+  pythonImportsCheck = [
+    "euclid3"
+  ];
+
+  meta = with lib; {
+    description = "2D and 3D vector, matrix, quaternion and geometry module.";
+    homepage = "http://code.google.com/p/pyeuclid/";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ jfly matusf ];
+  };
+}
diff --git a/pkgs/development/python-modules/griffe/default.nix b/pkgs/development/python-modules/griffe/default.nix
index 314a2249cdb..63d985326ef 100644
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "griffe";
-  version = "0.36.9";
+  version = "0.38.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "mkdocstrings";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-5j6boIy2LnB3Y0ZzheTdflON8KaQkeQS5vkaPIsETGk=";
+    hash = "sha256-GhohFO5tHb9ByISPUf4U2MrDATE4WjuekcC9QZaP2Ls=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/gvm-tools/default.nix b/pkgs/development/python-modules/gvm-tools/default.nix
index 47096022d1f..7cb78248c17 100644
--- a/pkgs/development/python-modules/gvm-tools/default.nix
+++ b/pkgs/development/python-modules/gvm-tools/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "gvm-tools";
-  version = "23.10.0";
+  version = "23.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+D9gl2Q1NybL8Na9qDZpDZOBStzJcfE6IUKFwjzr1J0=";
+    hash = "sha256-ZwImkTYYSscmGJYCpMWmZjToi41XjT4Znpo8j66BKIs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index d9293e07348..203aa49db8f 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -27,7 +27,7 @@ let
 in
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.4.19";
+  version = "0.4.20";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -37,7 +37,7 @@ buildPythonPackage rec {
     repo = "jax";
     # google/jax contains tags for jax and jaxlib. Only use jax tags!
     rev = "refs/tags/${pname}-v${version}";
-    hash = "sha256-l5uLPqhg/hqtO9oJSaioow5cH/0jKHDVziGezkfnVcc=";
+    hash = "sha256-WLYXUtchOaA6SGnKuVhN9CmV06xMCLQTEuEtL13ttZU=";
   };
 
   nativeBuildInputs = [
@@ -108,6 +108,10 @@ buildPythonPackage rec {
     "test_device_put"
     "test_make_array_from_callback"
     "test_make_array_from_single_device_arrays"
+
+    # Fails on some hardware due to some numerical error
+    # See https://github.com/google/jax/issues/18535
+    "testQdwhWithOnRankDeficientInput5"
   ];
 
   disabledTestPaths = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix
index ba3a6adffb7..4030bd5e404 100644
--- a/pkgs/development/python-modules/jaxlib/bin.nix
+++ b/pkgs/development/python-modules/jaxlib/bin.nix
@@ -39,7 +39,7 @@ in
 assert cudaSupport -> lib.versionAtLeast cudatoolkit.version "11.1" && lib.versionAtLeast cudnn.version "8.2" && stdenv.isLinux;
 
 let
-  version = "0.4.19";
+  version = "0.4.20";
 
   inherit (python) pythonVersion;
 
@@ -60,65 +60,65 @@ let
       "3.9-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp39";
-        hash = "sha256-8bTrWutuK0qVnbkcwMfgBf414YdaLc3GK5IsCm/JNPE=";
+        hash = "sha256-eIE+rz5x5BEkO85zncIWE8p/wDPxV8bnVJdHiknS998=";
       };
       "3.9-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp39";
-        hash = "sha256-Tmv2iOqlNbZqw/rYjef6GmM0N18EA5JTt6T3lQe+4Rs=";
+        hash = "sha256-dxInv8/aQiHsN7DpScuZao2ZyHDjF0AaTqUDA0qqg/M=";
       };
       "3.9-x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
         dist = "cp39";
-        hash = "sha256-mDT1INLqPdCkxtMMFR0qHLOIZdWEy8Iuzw1/vOoECsA=";
+        hash = "sha256-wva6LkSokEHN+WQLCancVC7YBIxfImPsQpB1LzFcyqM=";
       };
 
       "3.10-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp310";
-        hash = "sha256-ksnY+CPEstact5lKjbSg+ZSPJtSt0Y0NFWEFufBCByk=";
+        hash = "sha256-Yo2TYnkIelyy4vb5+nC/yY8SjV34i/jJvCe/VRQppmo=";
       };
       "3.10-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp310";
-        hash = "sha256-O7dHvdKLKfNELGfF4TKy7N5EX6Ca7Zu8OtLXWvFykR8=";
+        hash = "sha256-ufA/ACE4s4R/Fiq5SN7T44SVEN1Z5OfkJ/98lKxRFmo=";
       };
       "3.10-x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
         dist = "cp310";
-        hash = "sha256-gqKMUZSXrt8sQtTAoQbzAfCzO8gM9Y1/tZpuJVWyN0Y=";
+        hash = "sha256-hBSrYQyOGMn0BexRWQKYnJdEYYlzHUWuWGHmjVT10TE=";
       };
 
       "3.11-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp311";
-        hash = "sha256-m+NDzwXMNboNjDl2nLY+vqAoN2dQJZVWb1UQDpqqDPw=";
+        hash = "sha256-5N0nghTBrsa7d8kt8hZC2ghqlxCNC7U8ApD0PG7DHn8=";
       };
       "3.11-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp311";
-        hash = "sha256-zCOAjaWWCQT9Jnm1jjc1Rh5gemqy7ACtTKLM0MqSJzM=";
+        hash = "sha256-j13Br64cKe0hFh/cMBbOMuTXqauAvSKE+KzEmN7U6RA=";
       };
       "3.11-x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
         dist = "cp311";
-        hash = "sha256-gOLIxkk+2hew2GqWu1WgMVEx1YEutx7Zod7QbwsuUVQ=";
+        hash = "sha256-nTnyawU4Ngq9VTE6oDuEfR6iJPRy+E/VLt98cU6eW4M=";
       };
 
       "3.12-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp312";
-        hash = "sha256-BZTmkgNuV4nWtfbY4t/19aP43szZQEdgpFXh5qwGRXk=";
+        hash = "sha256-qPMoa7cso7DRBWuCJQoiOEzLPL3m76MPZZMYmZUj400=";
       };
       "3.12-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp312";
-        hash = "sha256-aAMTrLXU9EYwPv+kdeyI88/D7b4NANB39Fn8vuXUqFA=";
+        hash = "sha256-VqTC5egDHaDIvwVa3sAc9Sdtd0CwEFcXjDU/i54h844=";
       };
       "3.12-x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
         dist = "cp312";
-        hash = "sha256-KHzlIfa9KtYcHX+i/F/SKaYTpD4/XjHVu5j3BdRTUmc=";
+        hash = "sha256-1F98Je2rMJJKrksI/EVAsX9n+dOpmDehUeAaMq/BY7o=";
       };
     };
 
@@ -128,19 +128,19 @@ let
   gpuSrcs = {
     "3.9" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp39-cp39-manylinux2014_x86_64.whl";
-      hash = "sha256-WB5Vbr/XeYKXCP/3DIXF20jR6/1xE3huX1h5ow8ETl0=";
+      hash = "sha256-VM2HuyMnG+hzrsTQEB5KJpqpBXyyp+eV1LVxmY1ZCGU=";
     };
     "3.10" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp310-cp310-manylinux2014_x86_64.whl";
-      hash = "sha256-zfN0n31+5GohwBkeQrqHus4qOyhM/GEdqG6KUupCZ4o=";
+      hash = "sha256-TLq3z3T2fjTcO3ESahboKG33mrOpjtj9C92f4d4nJKo=";
     };
     "3.11" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp311-cp311-manylinux2014_x86_64.whl";
-      hash = "sha256-Q8ZtF2GCrG30GFbCeCZTWPmW2TBybeXzh2u+NRiYpx4=";
+      hash = "sha256-CUXwyJq0HOo2j3Sw+NguBCnFkDuJpc3wfZUc90yyhOY=";
     };
     "3.12" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp312-cp312-manylinux2014_x86_64.whl";
-      hash = "sha256-lphkSDOJ9SwbO0hp/xC1bYn5fWgth9A9Iwsc9zV0buI=";
+      hash = "sha256-bAR8FLtiqufU+rL2a1q9c61CjH1eXxGTNGnDUkHlDBA=";
     };
   };
 
diff --git a/pkgs/development/python-modules/jaxlib/default.nix b/pkgs/development/python-modules/jaxlib/default.nix
index f1cda9c58ea..ae479120ed1 100644
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@@ -54,7 +54,7 @@ let
   inherit (cudaPackages) backendStdenv cudatoolkit cudaFlags cudnn nccl;
 
   pname = "jaxlib";
-  version = "0.4.19";
+  version = "0.4.20";
 
   meta = with lib; {
     description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
@@ -95,7 +95,6 @@ let
     "absl_py"
     "astor_archive"
     "astunparse_archive"
-    "boringssl"
     # Not packaged in nixpkgs
     # "com_github_googleapis_googleapis"
     # "com_github_googlecloudplatform_google_cloud_cpp"
@@ -151,7 +150,7 @@ let
       repo = "jax";
       # google/jax contains tags for jax and jaxlib. Only use jaxlib tags!
       rev = "refs/tags/${pname}-v${version}";
-      hash = "sha256-l5uLPqhg/hqtO9oJSaioow5cH/0jKHDVziGezkfnVcc=";
+      hash = "sha256-WLYXUtchOaA6SGnKuVhN9CmV06xMCLQTEuEtL13ttZU=";
     };
 
     nativeBuildInputs = [
@@ -264,10 +263,10 @@ let
       ];
 
       sha256 = (if cudaSupport then {
-        x86_64-linux = "sha256-Hw4uFvltH7nlNN3qAEcQ+IR2FAOjRkvwyWA3rCPi7Vo=";
+        x86_64-linux = "sha256-QczClHxHElLZCqIZlHc3z3DXJ7rZQJaMs2XIb+lxarI=";
       } else {
-        x86_64-linux = "sha256-LEugnFwTV3EyeTZWgMvXzHbgeDPdmuT3daXCXJRMYVY=";
-        aarch64-linux = "sha256-59rv/3RjD8pnveBDZ33xZoNQxLmnhMocsKMgVfYoO70=";
+        x86_64-linux = "sha256-mqiJe4u0NYh1PKCbQfbo0U2e9/kYiBqj98d+BPHFSxQ=";
+        aarch64-linux = "sha256-EuLqamVBJ+qoVMCFIYUT846AghltZolfLGdtO9UeXSM=";
       }).${stdenv.system} or (throw "jaxlib: unsupported system: ${stdenv.system}");
     };
 
@@ -293,13 +292,7 @@ let
           --replace "/usr/bin/install_name_tool" "${cctools}/bin/install_name_tool"
         substituteInPlace ../output/external/rules_cc/cc/private/toolchain/unix_cc_configure.bzl \
           --replace "/usr/bin/libtool" "${cctools}/bin/libtool"
-      '' + (if stdenv.cc.isGNU then ''
-        sed -i 's@-lprotobuf@-l:libprotobuf.a@' ../output/external/xla/third_party/systemlibs/protobuf.BUILD
-        sed -i 's@-lprotoc@-l:libprotoc.a@' ../output/external/xla/third_party/systemlibs/protobuf.BUILD
-      '' else if stdenv.cc.isClang then ''
-        sed -i 's@-lprotobuf@${pkgs.protobuf}/lib/libprotobuf.a@' ../output/external/xla/third_party/systemlibs/protobuf.BUILD
-        sed -i 's@-lprotoc@${pkgs.protobuf}/lib/libprotoc.a@' ../output/external/xla/third_party/systemlibs/protobuf.BUILD
-      '' else throw "Unsupported stdenv.cc: ${stdenv.cc}");
+      '';
     };
 
     inherit meta;
diff --git a/pkgs/development/python-modules/newversion/default.nix b/pkgs/development/python-modules/newversion/default.nix
index e3283a4eb9e..76975016366 100644
--- a/pkgs/development/python-modules/newversion/default.nix
+++ b/pkgs/development/python-modules/newversion/default.nix
@@ -1,45 +1,32 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , packaging
 , poetry-core
 , pytestCheckHook
 , pythonOlder
-, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "newversion";
-  version = "1.8.2";
+  version = "2.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "vemel";
-    repo = pname;
-    rev = version;
-    hash = "sha256-27HWMzSzyAbiOW7OUhlupRWIVJG6DrpXObXmxlCsmxU=";
+    repo = "newversion";
+    rev = "refs/tags/${version}";
+    hash = "sha256-v9hfk2/hBkWtOobQdaYXNOZTTcEqnMV6JYqtjjoidOs=";
   };
 
-  patches = [
-    # https://github.com/vemel/newversion/pull/9
-    (fetchpatch {
-      name = "remove-setuptools-dependency.patch";
-      url = "https://github.com/vemel/newversion/commit/b50562671029dd6834bc7a8ad0dd3f9e0fbdfc1d.patch";
-      hash = "sha256-6dXVQ9Hk0/EfSwPbW19ZV8MAFcSx+ZRO5G94kbh23GM=";
-    })
-  ];
-
   nativeBuildInputs = [
     poetry-core
   ];
 
   propagatedBuildInputs = [
     packaging
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
   ];
 
   nativeCheckInputs = [
@@ -53,6 +40,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "PEP 440 version manager";
     homepage = "https://github.com/vemel/newversion";
+    changelog = "https://github.com/vemel/newversion/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/opensearch-py/default.nix b/pkgs/development/python-modules/opensearch-py/default.nix
index ce61a587cd6..3f2c965cbbc 100644
--- a/pkgs/development/python-modules/opensearch-py/default.nix
+++ b/pkgs/development/python-modules/opensearch-py/default.nix
@@ -1,53 +1,81 @@
-{ aiohttp
-, botocore
+{ lib
 , buildPythonPackage
-, certifi
 , fetchFromGitHub
-, lib
+
+# build-system
+, setuptools
+
+# dependencies
+, certifi
+, python-dateutil
+, requests
+, six
+, urllib3
+
+# optional-dependencies
+, aiohttp
+
+# tests
+, botocore
 , mock
 , pytest-asyncio
+, pytest-mock
 , pytestCheckHook
 , pyyaml
-, requests
-, urllib3
+, pytz
 }:
 
 buildPythonPackage rec {
   pname = "opensearch-py";
-  version = "2.3.2";
-  format = "setuptools";
+  version = "2.4.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "opensearch-project";
     repo = "opensearch-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MkrYCi/iz1OqqrwCZknfcZSEyZNPj+CZFiMycJQk+aQ=";
+    hash = "sha256-nfKUJjB3yAUGiCSLK3xXHQmtDenVZpLjgICR2hMv1aA=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
-    botocore
     certifi
+    python-dateutil
     requests
+    six
     urllib3
   ];
 
+  passthru.optional-dependencies.async = [
+    aiohttp
+  ];
+
   nativeCheckInputs = [
+    botocore
     mock
     pytest-asyncio
+    pytest-mock
     pytestCheckHook
     pyyaml
+    pytz
   ] ++ passthru.optional-dependencies.async;
 
   disabledTestPaths = [
     # require network
     "test_opensearchpy/test_async/test_connection.py"
     "test_opensearchpy/test_async/test_server"
-    "test_opensearchpy/test_connection.py"
     "test_opensearchpy/test_server"
     "test_opensearchpy/test_server_secured"
   ];
 
-  passthru.optional-dependencies.async = [ aiohttp ];
+  disabledTests = [
+    # finds our ca-bundle, but expects something else (/path/to/clientcert/dir or None)
+    "test_ca_certs_ssl_cert_dir"
+    "test_no_ca_certs"
+  ];
 
   meta = {
     description = "Python low-level client for OpenSearch";
diff --git a/pkgs/development/python-modules/pcbnew-transition/default.nix b/pkgs/development/python-modules/pcbnew-transition/default.nix
new file mode 100644
index 00000000000..2ac478308cd
--- /dev/null
+++ b/pkgs/development/python-modules/pcbnew-transition/default.nix
@@ -0,0 +1,39 @@
+{ pythonOlder
+, buildPythonPackage
+, fetchPypi
+, lib
+, kicad
+, versioneer
+}:
+buildPythonPackage rec {
+  pname = "pcbnewTransition";
+  version = "0.3.4";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-3CJUG1kd63Lg0r9HpJRIvttHS5s2EuZRoxeXrqsJ/kQ=";
+  };
+
+  propagatedBuildInputs = [
+    kicad
+  ];
+
+  nativeBuildInputs = [
+    versioneer
+  ];
+
+  pythonImportsCheck = [
+    "pcbnewTransition"
+  ];
+
+  meta = with lib; {
+    description = "Library that allows you to support both, KiCad 5, 6 and 7 in your plugins";
+    homepage = "https://github.com/yaqwsx/pcbnewTransition";
+    changelog = "https://github.com/yaqwsx/pcbnewTransition/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jfly matusf ];
+  };
+}
diff --git a/pkgs/development/python-modules/pixel-ring/default.nix b/pkgs/development/python-modules/pixel-ring/default.nix
new file mode 100644
index 00000000000..c88715270bd
--- /dev/null
+++ b/pkgs/development/python-modules/pixel-ring/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, wheel
+, pyusb
+, spidev
+}:
+
+buildPythonPackage rec {
+  pname = "pixel-ring";
+  version = "0.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "respeaker";
+    repo = "pixel_ring";
+    rev = version;
+    hash = "sha256-J9kScjD6Xon0YWGxFU881bIbjmDpY7cnWzJ8G0SOKaw=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    pyusb
+    spidev
+  ];
+
+  dontUsePythonImportsCheck = true; # requires SPI access
+
+  doCheck = false; # no tests
+
+  meta = with lib; {
+    description = "RGB LED library for ReSpeaker 4 Mic Array, ReSpeaker V2 & ReSpeaker USB 6+1 Mic Array";
+    homepage = "https://github.com/respeaker/pixel_ring/tree/master";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
diff --git a/pkgs/development/python-modules/psycopg/default.nix b/pkgs/development/python-modules/psycopg/default.nix
index 65156543e87..24063596918 100644
--- a/pkgs/development/python-modules/psycopg/default.nix
+++ b/pkgs/development/python-modules/psycopg/default.nix
@@ -50,6 +50,14 @@ let
       libpq = "${postgresql.lib}/lib/libpq${stdenv.hostPlatform.extensions.sharedLibrary}";
       libc = "${stdenv.cc.libc}/lib/libc.so.6";
     })
+
+    # https://github.com/psycopg/psycopg/pull/669
+    # mark some tests as timing remove on next version update
+    (fetchpatch {
+      name = "mark_tests_as_timing.patch";
+      url = "https://github.com/psycopg/psycopg/commit/00a3c640dd836328ba15931b400b012171f648c2.patch";
+      hash = "sha256-DoVZv1yy9gHOKl0AdVLir+C+UztJZVjboLhS5af2944=";
+    })
   ];
 
   baseMeta = {
diff --git a/pkgs/development/python-modules/pybars3/default.nix b/pkgs/development/python-modules/pybars3/default.nix
new file mode 100644
index 00000000000..ad7294fd635
--- /dev/null
+++ b/pkgs/development/python-modules/pybars3/default.nix
@@ -0,0 +1,38 @@
+{ python3
+, fetchPypi
+, lib
+, pymeta3
+, buildPythonPackage
+}:
+buildPythonPackage rec {
+  pname = "pybars3";
+  version = "0.9.7";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-ashH6QXlO5xbk2rxEskQR14nv3Z/efRSjBb5rx7A4lI=";
+  };
+
+  propagatedBuildInputs = [
+    pymeta3
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    ${python3.interpreter} tests.py
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [
+    "pybars"
+  ];
+
+  meta = with lib; {
+    description = "Handlebars.js template support for Python 3 and 2";
+    homepage = "https://github.com/wbond/pybars3";
+    changelog = "https://github.com/wbond/pybars3/releases/tag/${version}";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ jfly matusf ];
+  };
+}
diff --git a/pkgs/development/python-modules/pymeta3/default.nix b/pkgs/development/python-modules/pymeta3/default.nix
new file mode 100644
index 00000000000..f0350c4153b
--- /dev/null
+++ b/pkgs/development/python-modules/pymeta3/default.nix
@@ -0,0 +1,29 @@
+{ buildPythonPackage
+, fetchPypi
+, lib
+}:
+buildPythonPackage rec {
+  pname = "pymeta3";
+  version = "0.5.1";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "PyMeta3";
+    hash = "sha256-GL2jJtmpu/WHv8DuC8loZJZNeLBnKIvPVdTZhoHQW8s=";
+  };
+
+  doCheck = false; # Tests do not support Python3
+
+  pythonImportsCheck = [
+    "pymeta"
+  ];
+
+  meta = with lib; {
+    description = "Pattern-matching language based on OMeta for Python 3 and 2";
+    homepage = "https://github.com/wbond/pymeta3";
+    changelog = "https://github.com/wbond/pymeta3/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jfly matusf ];
+  };
+}
diff --git a/pkgs/development/python-modules/pynvim-pp/default.nix b/pkgs/development/python-modules/pynvim-pp/default.nix
index af2dbc27d63..0f69b51e65d 100644
--- a/pkgs/development/python-modules/pynvim-pp/default.nix
+++ b/pkgs/development/python-modules/pynvim-pp/default.nix
@@ -7,15 +7,14 @@
 
 buildPythonPackage {
   pname = "pynvim-pp";
-  version = "unstable-2023-07-09";
-
-  format = "pyproject";
+  version = "unstable-2023-08-03";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ms-jpq";
     repo = "pynvim_pp";
-    rev = "93aa25bf3ee039c4eb85f402d6adf6977033013b";
-    hash = "sha256-gZvIiFpP+eMLD8/xodY7ywWxhWXtethXviVRedW/bgo=";
+    rev = "40d0f6053ddbba61f53505eebb0290cfb661661b";
+    hash = "sha256-4jeYE9HL+PQZuJq5nyf9CgL4UrRWm3ifLL/vfygLOwc=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyoverkiz/default.nix b/pkgs/development/python-modules/pyoverkiz/default.nix
index 29c131a12f9..31d8adb3b62 100644
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyoverkiz";
-  version = "1.13.1";
+  version = "1.13.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-55oqrVjvbdwNn5S3YQVU3saWtFHhoUCcyW9VzXs87YM=";
+    hash = "sha256-WGFRZhnlTDC9uv9N4sKznIdgjBwpnuT9Gsa8hdlnPAE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-gvm/default.nix b/pkgs/development/python-modules/python-gvm/default.nix
index fe81dda8939..98cc6109ae7 100644
--- a/pkgs/development/python-modules/python-gvm/default.nix
+++ b/pkgs/development/python-modules/python-gvm/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "python-gvm";
-  version = "23.10.1";
+  version = "23.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-OG45mKYqWrgyDyTlWPz95VXQDKAx4QeU1ZZGmHhbviI=";
+    hash = "sha256-7HneedqHbNB9ZYFUCCQ/puLtA1QlIkTKqji0py9hwBE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index c2af4be8df8..59f1c4233ab 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.76";
+  version = "9.2.77";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JlwqxKJaJ3sk2mROUOaF0N5d4V7LM43VqEXnuSO45BY=";
+    hash = "sha256-kVMhzdTYwra8G/4gg1G853vUr7YHxxt/zXus/SXMkXc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/std2/default.nix b/pkgs/development/python-modules/std2/default.nix
index 2b51f9caaec..8e117b10e77 100644
--- a/pkgs/development/python-modules/std2/default.nix
+++ b/pkgs/development/python-modules/std2/default.nix
@@ -6,15 +6,14 @@
 
 buildPythonPackage {
   pname = "std2";
-  version = "unstable-2023-07-09";
-
-  format = "pyproject";
+  version = "unstable-2023-10-07";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ms-jpq";
     repo = "std2";
-    rev = "2d5594b40585ecae60ce5175bee68cc8b3085ee6";
-    hash = "sha256-phGIWow7PGOtS1Pre1Gz0Xg6izGp6BiUTmze5jI/BwY=";
+    rev = "6332e559ee51c3a7c956804afdd7e1cc6ad47965";
+    hash = "sha256-huN7P/Ws6anrFXDG7L5xxMenS25BHquV9cMi1s7WFJ4=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index aca851a22f8..efee6e3d1fa 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -51,7 +51,7 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.35.1";
+  version = "4.35.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -60,7 +60,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "transformers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ayHx3U/Jpo8K189M6qjRvRbFa9QEpx2uqG85hB8zC/Y=";
+    hash = "sha256-h1RMSEcuali05AWeTm1wyZQJz6XrHamCF1eHrSnFnfM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-awscrt/default.nix b/pkgs/development/python-modules/types-awscrt/default.nix
index 41e92d025d3..3c406d07451 100644
--- a/pkgs/development/python-modules/types-awscrt/default.nix
+++ b/pkgs/development/python-modules/types-awscrt/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "types-awscrt";
-  version = "0.19.10";
+  version = "0.19.12";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "types_awscrt";
     inherit version;
-    hash = "sha256-YowjnLt7eCBzBfklBOEEDRClp/ToA3KLi+xuftUoti4=";
+    hash = "sha256-KbJBIVxl622kZPEeIyiTEEky/DxKShyJGSFYv2YEveY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/weconnect-mqtt/default.nix b/pkgs/development/python-modules/weconnect-mqtt/default.nix
index c99e89944c4..3f85f806489 100644
--- a/pkgs/development/python-modules/weconnect-mqtt/default.nix
+++ b/pkgs/development/python-modules/weconnect-mqtt/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "weconnect-mqtt";
-  version = "0.48.2";
+  version = "0.48.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tillsteinbach";
     repo = "WeConnect-mqtt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8JJBWF53VOmTD/uetCURFaTkfSTax/YeafKsZtA1xAA=";
+    hash = "sha256-Pja9BP0gbWXTgOokEngNS364tJp1oWJYNKcTxyYJHGw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/weconnect/default.nix b/pkgs/development/python-modules/weconnect/default.nix
index e3bb7c34b5b..e9f4877110e 100644
--- a/pkgs/development/python-modules/weconnect/default.nix
+++ b/pkgs/development/python-modules/weconnect/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "weconnect";
-  version = "0.59.4";
+  version = "0.59.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "tillsteinbach";
     repo = "WeConnect-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Z9tiK6oDyyMcXhgUUxSDL9URYDp6Uz8rFPART3qxd+s=";
+    hash = "sha256-ujIA98QD8ds2/iLLeJqn88nY9tZuuOSnOwGvRznA8PQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index b7e93cb6454..cf7eb3fd612 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.0.36";
+  version = "3.0.37";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-MrzCqR1+IJAv81fbuaNygGejRF4EzIZWPutL5qLluhU=";
+    hash = "sha256-cRc5mBMTh5HCqq5hKfvJmYROs74ZiWjX17cgQv7ub+I=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/analysis/checkstyle/default.nix b/pkgs/development/tools/analysis/checkstyle/default.nix
index d6c6740e2a2..96bd017e777 100644
--- a/pkgs/development/tools/analysis/checkstyle/default.nix
+++ b/pkgs/development/tools/analysis/checkstyle/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenvNoCC, fetchurl, makeBinaryWrapper, jre }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "10.12.4";
+  version = "10.12.5";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-ecWTB/4Lc7zgkQI6nN5VvKfRizeMEdyGUyL0fxiAHhk=";
+    sha256 = "sha256-DAUPngTL9c2MePG5ISLul+iRvnwqChg04fo63aKAee0=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/development/tools/analysis/rr/default.nix b/pkgs/development/tools/analysis/rr/default.nix
index d5bcd116dc2..412b62593d2 100644
--- a/pkgs/development/tools/analysis/rr/default.nix
+++ b/pkgs/development/tools/analysis/rr/default.nix
@@ -36,7 +36,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config which makeWrapper ];
   buildInputs = [
     libpfm zlib python3Packages.python python3Packages.pexpect procps gdb capnproto
-    libpfm zlib python3Packages.python python3Packages.pexpect procps capnproto
   ];
   cmakeFlags = [
     "-Ddisable32bit=ON"
diff --git a/pkgs/development/tools/argc/default.nix b/pkgs/development/tools/argc/default.nix
index 9aff7365d76..b36331e8126 100644
--- a/pkgs/development/tools/argc/default.nix
+++ b/pkgs/development/tools/argc/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "argc";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "sigoden";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-BpTborNURfLdw4eyPbGMyNOSvtePB+lcCrCKTl0LoGQ=";
+    hash = "sha256-bF+NTiPrqWD1B/v44+XuxXotOPhUBCYyg6h+T/ydmGM=";
   };
 
-  cargoHash = "sha256-1FdimBQZ4SvAnrYzNnyulUT8b8bTnJfnWRNosfQqSco=";
+  cargoHash = "sha256-T6NfjlHQhHwfcAnmr8R2WWXVKgMZZXFq6IvlvWOVACg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/database/litestream/default.nix b/pkgs/development/tools/database/litestream/default.nix
index 83b1fb0c9f7..27b37eff489 100644
--- a/pkgs/development/tools/database/litestream/default.nix
+++ b/pkgs/development/tools/database/litestream/default.nix
@@ -4,13 +4,13 @@
 }:
 buildGoModule rec {
   pname = "litestream";
-  version = "0.3.12";
+  version = "0.3.13";
 
   src = fetchFromGitHub {
     owner = "benbjohnson";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uao8I3b38JZWpO5iM+qvV4CDxWg1ueYm7BoaW/+FOkA=";
+    sha256 = "sha256-p858gK+ICKDQ+/LUiBaxF/kfrZzQAXnYMZDFU8kNCJ4=";
   };
 
   ldflags = [
diff --git a/pkgs/development/tools/devpod/default.nix b/pkgs/development/tools/devpod/default.nix
index b7e24e34ac3..6ddb483e03c 100644
--- a/pkgs/development/tools/devpod/default.nix
+++ b/pkgs/development/tools/devpod/default.nix
@@ -23,13 +23,13 @@
 
 let
   pname = "devpod";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "loft-sh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8ED74Cqq2fw+TpkJyipxlBpKq60ScZinlPj0hEX13/0=";
+    sha256 = "sha256-e9sa9LniG5fj3S+x9T91v6ILPI0CD2y3QnZxXcKy6Ik=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/tools/ginkgo/default.nix b/pkgs/development/tools/ginkgo/default.nix
index daf27a1d2af..73f0bc8093a 100644
--- a/pkgs/development/tools/ginkgo/default.nix
+++ b/pkgs/development/tools/ginkgo/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "ginkgo";
-  version = "2.13.0";
+  version = "2.13.1";
 
   src = fetchFromGitHub {
     owner = "onsi";
     repo = "ginkgo";
     rev = "v${version}";
-    sha256 = "sha256-N+O8qjSOBv7UVcFZ4BOUFoj+qfN0d2rBHO7d8FBtayY=";
+    sha256 = "sha256-r2tAYH8E1j/gC+IRwcOv0Frcgd2RKEZjVzmuzOOhR7A=";
   };
-  vendorHash = "sha256-wUpWvq6iiS9HkCi4ztXLNs1nCgAomyUo8YaFcElnfeI=";
+  vendorHash = "sha256-5dEKb+KnUZTxSSoaOH1GpqMmYdLcXKMs2nq0SvR2pUs=";
 
   # integration tests expect more file changes
   # types tests are missing CodeLocation
diff --git a/pkgs/development/tools/language-servers/lua-language-server/default.nix b/pkgs/development/tools/language-servers/lua-language-server/default.nix
index faf66298106..c6eec2aff59 100644
--- a/pkgs/development/tools/language-servers/lua-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/lua-language-server/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lua-language-server";
-  version = "3.7.0";
+  version = "3.7.3";
 
   src = fetchFromGitHub {
     owner = "luals";
     repo = "lua-language-server";
     rev = version;
-    sha256 = "sha256-kUtiMNwJJN7ZAktSC7tZriAcTDFhvcfSwBE6KFzceMg=";
+    hash = "sha256-iAxRGG7/zaUbJ/PWgmjxGS0UTq9/OXc8RWzlpUTUftc=";
     fetchSubmodules = true;
   };
 
@@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/luals/lua-language-server";
     changelog = "https://github.com/LuaLS/lua-language-server/blob/${version}/changelog.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ figsoda sei40kr ];
+    maintainers = with maintainers; [ figsoda gepbird sei40kr ];
     mainProgram = "lua-language-server";
     platforms = platforms.linux ++ platforms.darwin;
   };
diff --git a/pkgs/development/tools/misc/saleae-logic-2/default.nix b/pkgs/development/tools/misc/saleae-logic-2/default.nix
index bd12125d83b..c15e7f6451b 100644
--- a/pkgs/development/tools/misc/saleae-logic-2/default.nix
+++ b/pkgs/development/tools/misc/saleae-logic-2/default.nix
@@ -1,10 +1,10 @@
 { lib, fetchurl, makeDesktopItem, appimageTools }:
 let
   name = "saleae-logic-2";
-  version = "2.4.9";
+  version = "2.4.12";
   src = fetchurl {
     url = "https://downloads.saleae.com/logic2/Logic-${version}-linux-x64.AppImage";
-    hash = "sha256-zM5XztFv+A7cNMqNPGAO5i0B45w6AMyRL4OR+tG03JY=";
+    hash = "sha256-QqGtozLZtrS5UgnLmsKWxqbcTykLhlossVxuN4WNYzo=";
   };
   desktopItem = makeDesktopItem {
     inherit name;
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index 4f483fd5f3b..d8edce696a7 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mold";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = "mold";
     rev = "v${version}";
-    hash = "sha256-eX76LRzhAk2n96eMtvbnm4Id99jRCDo3gMlrr5hI3Nw=";
+    hash = "sha256-YXFfjJp4dSxzEyAtrEi/ONQZKD7QAU/MZ62l4QCcbwE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/ocaml/camlidl/default.nix b/pkgs/development/tools/ocaml/camlidl/default.nix
index a97ce8499b2..22104d3d4dc 100644
--- a/pkgs/development/tools/ocaml/camlidl/default.nix
+++ b/pkgs/development/tools/ocaml/camlidl/default.nix
@@ -5,13 +5,13 @@ lib.throwIfNot (lib.versionAtLeast ocaml.version "4.03")
 
 stdenv.mkDerivation rec {
   pname = "ocaml${ocaml.version}-camlidl";
-  version = "1.11";
+  version = "1.12";
 
   src = fetchFromGitHub {
     owner = "xavierleroy";
     repo = "camlidl";
-    rev = "camlidl111";
-    sha256 = "sha256-8m0zem/6nvpEJtjJNP/+vafeVLlMvNQGdl8lyf/OeBg=";
+    rev = "camlidl112";
+    hash = "sha256-ONPQMDFaU2OzFa5jgMVKx+ZRKk8ZgBZyk42vDvbM7E0=";
   };
 
   nativeBuildInputs = [ ocaml ];
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
     substituteInPlace config/Makefile --replace BINDIR=/usr/local/bin BINDIR=$out
     substituteInPlace config/Makefile --replace 'OCAMLLIB=$(shell $(OCAMLC) -where)' OCAMLLIB=$out/lib/ocaml/${ocaml.version}/site-lib/camlidl
     substituteInPlace config/Makefile --replace CPP=cpp CPP=${stdenv.cc}/bin/cpp
+    substituteInPlace lib/Makefile --replace '$(OCAMLLIB)/Makefile.config' "${ocaml}/lib/ocaml/Makefile.config"
     mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/camlidl/caml
     mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/camlidl/stublibs
   '';
diff --git a/pkgs/development/tools/open-policy-agent/default.nix b/pkgs/development/tools/open-policy-agent/default.nix
index 7b7da31ad1d..aa8b4ae20f7 100644
--- a/pkgs/development/tools/open-policy-agent/default.nix
+++ b/pkgs/development/tools/open-policy-agent/default.nix
@@ -11,14 +11,15 @@ assert enableWasmEval && stdenv.isDarwin -> builtins.throw "building with wasm o
 
 buildGoModule rec {
   pname = "open-policy-agent";
-  version = "0.55.0";
+  version = "0.58.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa";
     rev = "v${version}";
-    hash = "sha256-piQ8Cig2zG6UhzVbiDCTruAXNis8P5HUja4xiiol9jA=";
+    hash = "sha256-zDTL/kP0ldPiZhLqLQmpIoDaq979KNDVJyXp93sPZAk=";
   };
+
   vendorHash = null;
 
   nativeBuildInputs = [ installShellFiles ];
@@ -34,6 +35,10 @@ buildGoModule rec {
         + "`opa build` does not need this feature.")
       "opa_wasm");
 
+  checkFlags = lib.optionals (!enableWasmEval) [
+    "-skip=TestRegoTargetWasmAndTargetPluginDisablesIndexingTopdownStages"
+  ];
+
   preCheck = ''
     # Feed in all but the e2e tests for testing
     # This is because subPackages above limits what is built to just what we
diff --git a/pkgs/development/tools/rust/cargo-codspeed/default.nix b/pkgs/development/tools/rust/cargo-codspeed/default.nix
index 5805d605835..3086d11d69d 100644
--- a/pkgs/development/tools/rust/cargo-codspeed/default.nix
+++ b/pkgs/development/tools/rust/cargo-codspeed/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-codspeed";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "CodSpeedHQ";
     repo = "codspeed-rust";
     rev = "v${version}";
-    hash = "sha256-QEqWSCqX00aMF9kM6xyClJjMiEGmscEWZu0W/MmSj2M=";
+    hash = "sha256-TjK84A/hoG5TyXbXgr4SPolUBT9tMqz/Mn9pMK6BQE4=";
   };
 
-  cargoHash = "sha256-kZjQFoP5aZyVt0EcMtUUXc1wUZQxUwONMzzN6iLUAbM=";
+  cargoHash = "sha256-Nfd8YBh+5HlLbxKajptJEH3NFbtBH2V6668c3DHc13g=";
 
   nativeBuildInputs = [
     curl
diff --git a/pkgs/development/tools/rust/cargo-crev/default.nix b/pkgs/development/tools/rust/cargo-crev/default.nix
index cbfa86c69ef..30a2fd44eab 100644
--- a/pkgs/development/tools/rust/cargo-crev/default.nix
+++ b/pkgs/development/tools/rust/cargo-crev/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-crev";
-  version = "0.25.3";
+  version = "0.25.4";
 
   src = fetchFromGitHub {
     owner = "crev-dev";
     repo = "cargo-crev";
     rev = "v${version}";
-    sha256 = "sha256-tyNbBG2okxoLmu8mwoeR3Ud0nIpqkwVmFHT0Gi1Pibs=";
+    sha256 = "sha256-cXGZhTLIxR9VHrQT+unbl69AviiQ6FCOJTdOP/4fRYI=";
   };
 
-  cargoHash = "sha256-sKQw4Bak3JY07TYKkThKTFhh3H5GB2lDcfcGE4cRHDY=";
+  cargoHash = "sha256-H/5OZCnshGOUKVaBTbFAiMpYdsNC/96gV+rOgiuwDYc=";
 
   preCheck = ''
     export HOME=$(mktemp -d)
diff --git a/pkgs/development/tools/rust/cargo-mutants/default.nix b/pkgs/development/tools/rust/cargo-mutants/default.nix
index fefa6bb21fb..ca70c3ecae1 100644
--- a/pkgs/development/tools/rust/cargo-mutants/default.nix
+++ b/pkgs/development/tools/rust/cargo-mutants/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-mutants";
-  version = "23.10.0";
+  version = "23.11.0";
 
   src = fetchFromGitHub {
     owner = "sourcefrog";
     repo = "cargo-mutants";
     rev = "v${version}";
-    hash = "sha256-AJcteYaEm1pJ2tn1mydZAhrhqoMtEVJUrfGY/Vt71Ks=";
+    hash = "sha256-DYHEisVf+Qxiac/ZbPXrGRsFM6UUi584mY5mgzN7ZJE=";
   };
 
-  cargoHash = "sha256-0NLP8KtzeX3jjWjSXBKku4c1LzKmoJce1RPUB+aO804=";
+  cargoHash = "sha256-bJc33o+vm8oMrTkD/mg/xe7b9xQX/6JSDZlYgWeSa68=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/pkgs/development/tools/rust/cargo-nextest/default.nix b/pkgs/development/tools/rust/cargo-nextest/default.nix
index f911f5ee587..92e382071df 100644
--- a/pkgs/development/tools/rust/cargo-nextest/default.nix
+++ b/pkgs/development/tools/rust/cargo-nextest/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.61";
+  version = "0.9.62";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    hash = "sha256-kVADlW5XqKAuQ2n0lmEin67CXGkhTVWgJaPMKpvS5Gs=";
+    hash = "sha256-GxDURkXmZvxaX9RLq/hlqtX1woWm2JKtv5x5goCY4ZU=";
   };
 
-  cargoHash = "sha256-IU2oW00VzEV8p3BpqIJZwXvdcaeweAF9nGHwtX+98vY=";
+  cargoHash = "sha256-zQB8sPeKT43qC5JjrHa7E41NyDyiQ3PGvBqgszs+tBI=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/pkgs/development/tools/selene/default.nix b/pkgs/development/tools/selene/default.nix
index 87c4a0f3ee7..dbaeb264b35 100644
--- a/pkgs/development/tools/selene/default.nix
+++ b/pkgs/development/tools/selene/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "selene";
-  version = "0.25.0";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     owner = "kampfkarren";
     repo = pname;
     rev = version;
-    sha256 = "sha256-aKU+1eoLm/h5Rj/vAZOyAnyl5/TpStL5g8PPdYCJ8o0=";
+    sha256 = "sha256-0imHwZNyhJXFai1J5tHqnQ6Ta10nETQ5TILGH0bHc8Y=";
   };
 
-  cargoSha256 = "sha256-y2BoV59oJPMBf9rUgMhHu87teurwPSNowRbuPfXubGA=";
+  cargoHash = "sha256-Lm3agCnxDxcj7op17uiokK8Y790oMxwHJStvP/9DsI0=";
 
   nativeBuildInputs = lib.optionals robloxSupport [
     pkg-config
diff --git a/pkgs/development/tools/stylua/default.nix b/pkgs/development/tools/stylua/default.nix
index d361773b4d9..23fac8ddac7 100644
--- a/pkgs/development/tools/stylua/default.nix
+++ b/pkgs/development/tools/stylua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stylua";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "johnnymorganz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Lfd6jULV64vP5GQtOQ/wqyu4zZNpU83HSVGXQ8AtnvQ=";
+    sha256 = "sha256-Bw9+BUvZC4sRLFyU5K6FHsWVZ3PTlMAonRmTSwV5AwU=";
   };
 
-  cargoSha256 = "sha256-rojb15M58TnGZfptTMVCC6XaI9RBlpVL7s/Mb18CaSM=";
+  cargoSha256 = "sha256-bainEM4eRMNyecSBi5k1ifjDULWdXed6GP6i10IVA+w=";
 
   # remove cargo config so it can find the linker on aarch64-unknown-linux-gnu
   postPatch = ''
diff --git a/pkgs/games/vassal/default.nix b/pkgs/games/vassal/default.nix
index 0d0ebded723..4ac45503f22 100644
--- a/pkgs/games/vassal/default.nix
+++ b/pkgs/games/vassal/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "VASSAL";
-  version = "3.7.4";
+  version = "3.7.5";
 
   src = fetchzip {
     url = "https://github.com/vassalengine/vassal/releases/download/${version}/${pname}-${version}-linux.tar.bz2";
-    sha256 = "sha256-G9h5U5jlLOFCAKXdwzK+J8er3pUL4AUq5FLcvbUN93A=";
+    sha256 = "sha256-6TXpUsQBzhZ02SCbCqZW2LZfQ370Ma57bsblmpgZmoc=";
   };
 
   buildInputs = [
diff --git a/pkgs/misc/mnemonicode/default.nix b/pkgs/misc/mnemonicode/default.nix
index 4ecacaf418a..1cd78fdce09 100644
--- a/pkgs/misc/mnemonicode/default.nix
+++ b/pkgs/misc/mnemonicode/default.nix
@@ -1,20 +1,21 @@
 { stdenv, lib, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mnemonicode";
-  version = "2015-11-30";
+  version = "1.0.0";
   src = fetchFromGitHub {
     owner = "singpolyma";
     repo = "mnemonicode";
-    rev = "1687fabdf48acf68d4186f219bc20bffe02e8ee0";
-    sha256 = "0kp1jhhqfwfiqg9kx0mbyr4qh4yc4zg4szqk5fbf809nx2pvprm5";
+    rev = finalAttrs.version;
+    hash = "sha256-bGipPvLj6ig+lMLsl/Yve8PmuA93ETvhNKoMPh0JMBM=";
   };
   installPhase = ''
     mkdir -p $out/bin
-    cp mnencode $out/bin
-    cp mndecode $out/bin
+    mv mnencode $out/bin
+    mv mndecode $out/bin
   '';
   meta = with lib; {
+    homepage = "https://github.com/singpolyma/mnemonicode";
     description = ''
       Routines which implement a method for encoding binary data into a sequence
       of words which can be spoken over the phone, for example, and converted
@@ -22,6 +23,7 @@ stdenv.mkDerivation {
     '';
     license = licenses.mit;
     platforms = platforms.all;
-    maintainers = [ ];
+    maintainers = with maintainers; [ kirillrdy ];
+    mainProgram = "mnencode";
   };
-}
+})
diff --git a/pkgs/os-specific/linux/apfs/default.nix b/pkgs/os-specific/linux/apfs/default.nix
index dc46c790c3a..98487799aa8 100644
--- a/pkgs/os-specific/linux/apfs/default.nix
+++ b/pkgs/os-specific/linux/apfs/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  tag = "0.3.4";
+  tag = "0.3.5";
 in
 stdenv.mkDerivation {
   pname = "apfs";
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
     owner = "linux-apfs";
     repo = "linux-apfs-rw";
     rev = "v${tag}";
-    hash = "sha256-EeVOrZtmKi5VfPerW9IntjRvdU3AbFPHG+pyAI4ciGk=";
+    hash = "sha256-rKz9a4Z+tx63rhknQIl/zu/WIMjxxM0+NGyaxnzxLk4=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/mstflint_access/default.nix b/pkgs/os-specific/linux/mstflint_access/default.nix
new file mode 100644
index 00000000000..6e29e27ccbf
--- /dev/null
+++ b/pkgs/os-specific/linux/mstflint_access/default.nix
@@ -0,0 +1,40 @@
+{ lib, stdenv, fetchurl, kernel, kmod, mstflint }:
+
+stdenv.mkDerivation rec {
+  pname = "mstflint_access";
+  inherit (mstflint) version;
+
+  src = fetchurl {
+    url = "https://github.com/Mellanox/mstflint/releases/download/v${version}/kernel-mstflint-${version}.tar.gz";
+    hash = "sha256-rfZts0m8x6clVazpbAa2xK+dYgRU9Us5rbcWa0uHJ1M=";
+  };
+
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "KVER=${kernel.modDirVersion}"
+    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  enableParallelBuilding = true;
+
+  preConfigure = lib.optionals (lib.versionAtLeast kernel.version "6.4") ''
+    sed -i "s/class_create(THIS_MODULE, dev->name)/class_create(dev->name)/g" mst_main.c
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D ${pname}.ko $out/lib/modules/${kernel.modDirVersion}/extra/${pname}.ko
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A kernel module for Nvidia NIC firmware update";
+    homepage = "https://github.com/Mellanox/mstflint";
+    license = [ licenses.gpl2Only ];
+    maintainers = with maintainers; [ thillux ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
index ecfd6a87e6b..a4fc11c8647 100644
--- a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, kernel, bc, fetchpatch }:
+{ lib, stdenv, fetchFromGitHub, kernel, bc }:
 
 stdenv.mkDerivation {
   pname = "rtl8188eus-aircrack";
-  version = "${kernel.version}-unstable-2022-03-19";
+  version = "${kernel.version}-unstable-2023-09-21";
 
   src = fetchFromGitHub {
     owner = "aircrack-ng";
     repo = "rtl8188eus";
-    rev = "0958f294f90b49d6bad4972b14f90676e5d858d3";
-    sha256 = "sha256-dkCcwvOLxqU1IZ/OXTp67akjWgsaH1Cq4N8d9slMRI8=";
+    rev = "3fae7237ba121f1169e9a2ea55040dc123697d3b";
+    sha256 = "sha256-ILSMEt9nMdg1ZbFeatWm8Yxf6a/E7Vm7KtKhN933KTc=";
   };
 
   prePatch = ''
@@ -18,13 +18,6 @@ stdenv.mkDerivation {
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/aircrack-ng/rtl8188eus/commit/daa3a2e12290050be3af956915939a55aed50d5f.patch";
-      hash = "sha256-VsvaAhO74LzqUxbmdDT9qwVl6Y9lXfGfrHHK3SbnOVA=";
-    })
-  ];
-
   hardeningDisable = [ "pic" ];
 
   enableParallelBuilding = true;
@@ -40,6 +33,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/aircrack-ng/rtl8188eus";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ fortuneteller2k ];
-    broken = (lib.versionAtLeast kernel.version "5.17") || ((lib.versions.majorMinor kernel.version) == "5.4" && kernel.isHardened);
+    broken = (lib.versionAtLeast kernel.version "6.6") || ((lib.versions.majorMinor kernel.version) == "5.4" && kernel.isHardened);
   };
 }
diff --git a/pkgs/os-specific/linux/trinity/default.nix b/pkgs/os-specific/linux/trinity/default.nix
index 09a2d8bf638..e0ab2b2802f 100644
--- a/pkgs/os-specific/linux/trinity/default.nix
+++ b/pkgs/os-specific/linux/trinity/default.nix
@@ -1,25 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch }:
+{ lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "trinity";
-  version = "1.9";
+  version = "1.9-unstable-2023-07-10";
 
   src = fetchFromGitHub {
     owner = "kernelslacker";
     repo = "trinity";
-    rev = "v${version}";
-    sha256 = "0z1a7x727xacam74jccd223k303sllgwpq30lnq9b6xxy8b659bv";
+    rev = "e71872454d26baf37ae1d12e9b04a73d64179555";
+    hash = "sha256-Zy+4L1CuB2Ul5iF+AokDkAW1wheDzoCTNkvRZFGRNps=";
   };
 
-  patches = [
-    # Pull upstream fix for -fno-common toolchains
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://github.com/kernelslacker/trinity/commit/e53e25cc8dd5bdb5f7d9b4247de9e9921eec81d8.patch";
-      sha256 = "0dbhyc98x11cmac6rj692zymnfqfqcbawlrkg1lhgfagzjxxwshg";
-    })
-  ];
-
   postPatch = ''
     patchShebangs configure
     patchShebangs scripts
@@ -27,12 +18,12 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  makeFlags = [ "DESTDIR=$(out)" ];
+  installFlags = [ "DESTDIR=$(out)" ];
 
   meta = with lib; {
     description = "A Linux System call fuzz tester";
-    homepage = "https://codemonkey.org.uk/projects/trinity/";
-    license = licenses.gpl2;
+    homepage = "https://github.com/kernelslacker/trinity";
+    license = licenses.gpl2Only;
     maintainers = [ maintainers.dezgeg ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/servers/clickhouse/default.nix b/pkgs/servers/clickhouse/default.nix
index 959b16ceac4..19a0b5e9234 100644
--- a/pkgs/servers/clickhouse/default.nix
+++ b/pkgs/servers/clickhouse/default.nix
@@ -6,12 +6,12 @@
 , ninja
 , python3
 , perl
+, nasm
 , yasm
 , nixosTests
 , darwin
 , findutils
 
-# currently for BLAKE3 hash function
 , rustSupport ? true
 
 , corrosion
@@ -24,19 +24,19 @@ let
   inherit (llvmPackages) stdenv;
   mkDerivation = (
     if stdenv.isDarwin
-    then darwin.apple_sdk_11_0.llvmPackages_15.stdenv
+    then darwin.apple_sdk_11_0.llvmPackages_16.stdenv
     else llvmPackages.stdenv).mkDerivation;
 in mkDerivation rec {
   pname = "clickhouse";
-  version = "23.3.13.6";
+  version = "23.10.3.5";
 
   src = fetchFromGitHub rec {
     owner = "ClickHouse";
     repo = "ClickHouse";
-    rev = "v${version}-lts";
+    rev = "v${version}-stable";
     fetchSubmodules = true;
     name = "clickhouse-${rev}.tar.gz";
-    hash = "sha256-ryUjXN8UNGmkZTkqNHotB4C2E1MHZhx2teqXrlp5ySQ=";
+    hash = "sha256-H3nIhBydLBxSesGrvqmwHmBoQGCGQlWgVVUudKLLkIY=";
     postFetch = ''
       # delete files that make the source too big
       rm -rf $out/contrib/llvm-project/llvm/test
@@ -67,7 +67,9 @@ in mkDerivation rec {
     ninja
     python3
     perl
+    llvmPackages.lld
   ] ++ lib.optionals stdenv.isx86_64 [
+    nasm
     yasm
   ] ++ lib.optionals stdenv.isDarwin [
     llvmPackages.bintools
@@ -92,17 +94,11 @@ in mkDerivation rec {
     preBuild = "cd generator";
     hash = "sha256-dhUgpwSjE9NZ2mCkhGiydI51LIOClA5wwk1O3mnnbM8=";
   } else null;
-  blake3Deps = if rustSupport then rustPlatform.fetchCargoTarball {
+  rustDeps = if rustSupport then rustPlatform.fetchCargoTarball {
     inherit src;
-    name = "blake3-deps";
-    preBuild = "cd rust/BLAKE3";
-    hash = "sha256-lDMmmsyjEbTfI5NgTgT4+8QQrcUE/oUWfFgj1i19W0Q=";
-  } else null;
-  skimDeps = if rustSupport then rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "skim-deps";
-    preBuild = "cd rust/skim";
-    hash = "sha256-gEWB+U8QrM0yYyMXpwocszJZgOemdTlbSzKNkS0NbPk=";
+    name = "rust-deps";
+    preBuild = "cd rust";
+    hash = "sha256-fWDAGm19b7uZv8aBdBoieY5c6POd8IxFXbGdtONpZbw=";
   } else null;
 
   dontCargoSetupPostUnpack = true;
@@ -117,14 +113,12 @@ in mkDerivation rec {
     corrosionDepsCopy="$cargoDepsCopy"
     popd
 
-    pushd rust/BLAKE3
-    cargoDeps="$blake3Deps" cargoSetupPostUnpackHook
-    blake3DepsCopy="$cargoDepsCopy"
-    popd
-
-    pushd rust/skim
-    cargoDeps="$skimDeps" cargoSetupPostUnpackHook
-    skimDepsCopy="$cargoDepsCopy"
+    pushd rust
+    cargoDeps="$rustDeps" cargoSetupPostUnpackHook
+    rustDepsCopy="$cargoDepsCopy"
+    cat .cargo/config >> .cargo/config.toml.in
+    cat .cargo/config >> skim/.cargo/config.toml.in
+    rm .cargo/config
     popd
 
     popd
@@ -152,15 +146,15 @@ in mkDerivation rec {
     cargoDepsCopy="$corrosionDepsCopy" cargoSetupPostPatchHook
     popd
 
-    pushd rust/BLAKE3
-    cargoDepsCopy="$blake3DepsCopy" cargoSetupPostPatchHook
-    popd
-
-    pushd rust/skim
-    cargoDepsCopy="$skimDepsCopy" cargoSetupPostPatchHook
+    pushd rust
+    cargoDepsCopy="$rustDepsCopy" cargoSetupPostPatchHook
     popd
 
     cargoSetupPostPatchHook() { true; }
+  '' + lib.optionalString stdenv.isDarwin ''
+    # Make sure Darwin invokes lld.ld64 not lld.
+    substituteInPlace cmake/tools.cmake \
+      --replace '--ld-path=''${LLD_PATH}' '-fuse-ld=lld'
   '';
 
   cmakeFlags = [
@@ -169,6 +163,12 @@ in mkDerivation rec {
     "-DENABLE_EMBEDDED_COMPILER=ON"
   ];
 
+  env = lib.optionalAttrs stdenv.isDarwin {
+    # Silence ``-Wimplicit-const-int-float-conversion` error in MemoryTracker.cpp and
+    # ``-Wno-unneeded-internal-declaration` TreeOptimizer.cpp.
+    NIX_CFLAGS_COMPILE = "-Wno-implicit-const-int-float-conversion -Wno-unneeded-internal-declaration";
+  };
+
   # https://github.com/ClickHouse/ClickHouse/issues/49988
   hardeningDisable = [ "fortify" ];
 
diff --git a/pkgs/servers/http/dufs/default.nix b/pkgs/servers/http/dufs/default.nix
index 89058fd2171..8713ee35399 100644
--- a/pkgs/servers/http/dufs/default.nix
+++ b/pkgs/servers/http/dufs/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dufs";
-  version = "0.36.0";
+  version = "0.37.1";
 
   src = fetchFromGitHub {
     owner = "sigoden";
     repo = "dufs";
     rev = "v${version}";
-    hash = "sha256-WZ+tyrx4ayFyPmDJq6dGaTRiR6bSQq5k5iOfb+ETe/I=";
+    hash = "sha256-Q5t3FUT/ukGME+ZJXpLWnii2XCPrBVDAlbjW8FrpOZs=";
   };
 
-  cargoHash = "sha256-HZiWmqIh21b12DP+hnx1pWBWgSa5j71kp6GCRKGMHv0=";
+  cargoHash = "sha256-6ybYfeufHr3ulTbKe27CDS5m1mCluPwS/5GYemYXat8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/servers/jellyseerr/default.nix b/pkgs/servers/jellyseerr/default.nix
index 3f35cdebabe..7c361f580d8 100644
--- a/pkgs/servers/jellyseerr/default.nix
+++ b/pkgs/servers/jellyseerr/default.nix
@@ -1,14 +1,10 @@
 { lib
-, stdenv
 , fetchFromGitHub
 , makeWrapper
 , mkYarnPackage
 , nodejs
-, sqlite
 , fetchYarnDeps
 , python3
-, pkg-config
-, glib
 }:
 
 let
diff --git a/pkgs/servers/jellyseerr/package.json b/pkgs/servers/jellyseerr/package.json
index dd5fb6cf187..6892a3bd808 100644
--- a/pkgs/servers/jellyseerr/package.json
+++ b/pkgs/servers/jellyseerr/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jellyseerr",
-  "version": "1.4.1",
+  "version": "1.7.0",
   "private": true,
   "scripts": {
     "dev": "nodemon -e ts --watch server --watch overseerr-api.yml -e .json,.ts,.yml -x ts-node -r tsconfig-paths/register --files --project server/tsconfig.json server/index.ts",
@@ -8,6 +8,7 @@
     "build:next": "next build",
     "build": "yarn build:next && yarn build:server",
     "lint": "eslint \"./server/**/*.{ts,tsx}\" \"./src/**/*.{ts,tsx}\" --cache",
+    "lintfix": "eslint \"./server/**/*.{ts,tsx}\" \"./src/**/*.{ts,tsx}\" --fix",
     "start": "NODE_ENV=production node dist/index.js",
     "i18n:extract": "extract-messages -l=en -o src/i18n/locale -d en --flat true --overwriteDefault true \"./src/**/!(*.test).{ts,tsx}\"",
     "migration:generate": "ts-node -r tsconfig-paths/register --project server/tsconfig.json ./node_modules/typeorm/cli.js migration:generate -d server/datasource.ts",
@@ -29,17 +30,17 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@formatjs/intl-displaynames": "6.2.3",
-    "@formatjs/intl-locale": "3.0.11",
-    "@formatjs/intl-pluralrules": "5.1.8",
+    "@formatjs/intl-displaynames": "6.2.6",
+    "@formatjs/intl-locale": "3.1.1",
+    "@formatjs/intl-pluralrules": "5.1.10",
     "@formatjs/intl-utils": "3.8.4",
-    "@headlessui/react": "1.7.7",
-    "@heroicons/react": "2.0.13",
+    "@headlessui/react": "1.7.12",
+    "@heroicons/react": "2.0.16",
     "@supercharge/request-ip": "1.2.0",
     "@svgr/webpack": "6.5.1",
-    "@tanem/react-nprogress": "5.0.22",
-    "ace-builds": "1.14.0",
-    "axios": "1.2.2",
+    "@tanem/react-nprogress": "5.0.30",
+    "ace-builds": "1.15.2",
+    "axios": "1.3.4",
     "axios-rate-limit": "1.3.0",
     "bcrypt": "5.1.0",
     "bowser": "2.11.0",
@@ -47,7 +48,7 @@
     "cookie-parser": "1.4.6",
     "copy-to-clipboard": "3.3.3",
     "country-flag-icons": "1.5.5",
-    "cronstrue": "2.21.0",
+    "cronstrue": "2.23.0",
     "csurf": "1.11.0",
     "date-fns": "2.29.3",
     "dayjs": "1.11.7",
@@ -64,23 +65,22 @@
     "next": "12.3.4",
     "node-cache": "5.1.2",
     "node-gyp": "9.3.1",
-    "node-schedule": "2.1.0",
-    "nodemailer": "6.8.0",
-    "openpgp": "5.5.0",
+    "node-schedule": "2.1.1",
+    "nodemailer": "6.9.1",
+    "openpgp": "5.7.0",
     "plex-api": "5.3.2",
     "pug": "3.0.2",
-    "pulltorefreshjs": "0.1.22",
     "react": "18.2.0",
     "react-ace": "10.1.0",
     "react-animate-height": "2.1.2",
-    "react-aria": "3.22.0",
+    "react-aria": "3.23.0",
     "react-dom": "18.2.0",
-    "react-intersection-observer": "9.4.1",
-    "react-intl": "6.2.5",
-    "react-markdown": "8.0.4",
+    "react-intersection-observer": "9.4.3",
+    "react-intl": "6.2.10",
+    "react-markdown": "8.0.5",
     "react-popper-tooltip": "4.4.2",
     "react-select": "5.7.0",
-    "react-spring": "9.6.1",
+    "react-spring": "9.7.1",
     "react-tailwindcss-datepicker-sct": "1.3.4",
     "react-toast-notifications": "2.5.1",
     "react-truncate-markup": "5.1.2",
@@ -89,42 +89,41 @@
     "secure-random-password": "0.2.3",
     "semver": "7.3.8",
     "sqlite3": "5.1.4",
-    "swagger-ui-express": "4.6.0",
-    "swr": "2.0.0",
-    "typeorm": "0.3.11",
+    "swagger-ui-express": "4.6.2",
+    "swr": "2.0.4",
+    "typeorm": "0.3.12",
     "web-push": "3.5.0",
     "winston": "3.8.2",
     "winston-daily-rotate-file": "4.7.1",
     "xml2js": "0.4.23",
     "yamljs": "0.3.0",
     "yup": "0.32.11",
-    "zod": "3.20.2"
+    "zod": "3.20.6"
   },
   "devDependencies": {
-    "@babel/cli": "7.20.7",
-    "@commitlint/cli": "17.4.0",
-    "@commitlint/config-conventional": "17.4.0",
+    "@babel/cli": "7.21.0",
+    "@commitlint/cli": "17.4.4",
+    "@commitlint/config-conventional": "17.4.4",
     "@semantic-release/changelog": "6.0.2",
     "@semantic-release/commit-analyzer": "9.0.2",
     "@semantic-release/exec": "6.0.3",
     "@semantic-release/git": "10.0.1",
     "@tailwindcss/aspect-ratio": "0.4.2",
     "@tailwindcss/forms": "0.5.3",
-    "@tailwindcss/typography": "0.5.8",
+    "@tailwindcss/typography": "0.5.9",
     "@types/bcrypt": "5.0.0",
     "@types/cookie-parser": "1.4.3",
     "@types/country-flag-icons": "1.2.0",
     "@types/csurf": "1.11.2",
     "@types/email-templates": "8.0.4",
-    "@types/express": "4.17.15",
-    "@types/express-session": "1.17.5",
+    "@types/express": "4.17.17",
+    "@types/express-session": "1.17.6",
     "@types/lodash": "4.14.191",
     "@types/node": "17.0.36",
     "@types/node-schedule": "2.1.0",
     "@types/nodemailer": "6.4.7",
-    "@types/pulltorefreshjs": "0.1.5",
-    "@types/react": "18.0.26",
-    "@types/react-dom": "18.0.10",
+    "@types/react": "18.0.28",
+    "@types/react-dom": "18.0.11",
     "@types/react-transition-group": "4.4.5",
     "@types/secure-random-password": "0.2.1",
     "@types/semver": "7.3.13",
@@ -133,45 +132,46 @@
     "@types/xml2js": "0.4.11",
     "@types/yamljs": "0.2.31",
     "@types/yup": "0.29.14",
-    "@typescript-eslint/eslint-plugin": "5.48.0",
-    "@typescript-eslint/parser": "5.48.0",
+    "@typescript-eslint/eslint-plugin": "5.54.0",
+    "@typescript-eslint/parser": "5.54.0",
     "autoprefixer": "10.4.13",
     "babel-plugin-react-intl": "8.2.25",
     "babel-plugin-react-intl-auto": "3.3.0",
-    "commitizen": "4.2.6",
+    "commitizen": "4.3.0",
     "copyfiles": "2.4.1",
     "cy-mobile-commands": "0.3.0",
-    "cypress": "12.3.0",
+    "cypress": "12.7.0",
     "cz-conventional-changelog": "3.3.0",
-    "eslint": "8.31.0",
+    "eslint": "8.35.0",
     "eslint-config-next": "12.3.4",
     "eslint-config-prettier": "8.6.0",
-    "eslint-plugin-formatjs": "4.3.9",
-    "eslint-plugin-jsx-a11y": "6.6.1",
+    "eslint-plugin-formatjs": "4.9.0",
+    "eslint-plugin-jsx-a11y": "6.7.1",
     "eslint-plugin-no-relative-import-paths": "1.5.2",
     "eslint-plugin-prettier": "4.2.1",
-    "eslint-plugin-react": "7.31.11",
+    "eslint-plugin-react": "7.32.2",
     "eslint-plugin-react-hooks": "4.6.0",
     "extract-react-intl-messages": "4.1.1",
     "husky": "8.0.3",
-    "lint-staged": "13.1.0",
+    "lint-staged": "13.1.2",
     "nodemon": "2.0.20",
-    "postcss": "8.4.20",
-    "prettier": "2.8.1",
-    "prettier-plugin-organize-imports": "3.2.1",
-    "prettier-plugin-tailwindcss": "0.2.1",
+    "postcss": "8.4.21",
+    "prettier": "2.8.4",
+    "prettier-plugin-organize-imports": "3.2.2",
+    "prettier-plugin-tailwindcss": "0.2.3",
     "semantic-release": "19.0.5",
     "semantic-release-docker-buildx": "1.0.1",
-    "tailwindcss": "3.2.4",
+    "tailwindcss": "3.2.7",
     "ts-node": "10.9.1",
     "tsc-alias": "1.8.2",
     "tsconfig-paths": "4.1.2",
-    "typescript": "4.9.4"
+    "typescript": "4.9.5"
   },
   "resolutions": {
     "sqlite3/node-gyp": "8.4.1",
-    "@types/react": "18.0.26",
-    "@types/react-dom": "18.0.10"
+    "@types/react": "18.0.28",
+    "@types/react-dom": "18.0.11",
+    "@types/express-session": "1.17.6"
   },
   "config": {
     "commitizen": {
diff --git a/pkgs/servers/jellyseerr/pin.json b/pkgs/servers/jellyseerr/pin.json
index 0c658a506c4..7905d006ee8 100644
--- a/pkgs/servers/jellyseerr/pin.json
+++ b/pkgs/servers/jellyseerr/pin.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.4.1",
-  "srcHash": "sha256-LDqlQfy1bm2xMNn1oulImfanQmJX57P48VaZn0Jxwpk=",
-  "yarnSha256": "162aip7r5vcpfj1sn42qwwdlwnaii32bd2k0gp9py1z0zmw0lwlf"
+  "version": "1.7.0",
+  "srcHash": "sha256-9ILP2HH7p8ELwrQOBnqPbvHdUnNrqEkA4OmxOuhNbEc=",
+  "yarnSha256": "1ygb8pmwra570wmdkn7mxv9j90cgjh063b9cl0wl9hsmg687sk9h"
 }
diff --git a/pkgs/servers/jellyseerr/update.sh b/pkgs/servers/jellyseerr/update.sh
index ec1dd0879ed..719fc622a6e 100755
--- a/pkgs/servers/jellyseerr/update.sh
+++ b/pkgs/servers/jellyseerr/update.sh
@@ -19,7 +19,7 @@ if [ -z "$tag" ]; then
 fi
 
 src="https://raw.githubusercontent.com/Fallenbagel/jellyseerr/$tag"
-src_hash=$(nix-prefetch-github Fallenbagel jellyseerr --rev ${tag} | jq -r .hash)
+src_hash=$(nix-prefetch-github Fallenbagel jellyseerr --rev ${tag} | jq -r .sha256)
 
 tmpdir=$(mktemp -d)
 trap 'rm -rf "$tmpdir"' EXIT
@@ -33,7 +33,7 @@ curl -O "$src/package.json"
 cat > pin.json << EOF
 {
   "version": "$(echo $tag | grep -P '(\d|\.)+' -o)",
-  "srcHash": "$src_hash",
+  "srcHash": "sha256-$src_hash",
   "yarnSha256": "$yarn_sha256"
 }
 EOF
diff --git a/pkgs/servers/mjolnir/default.nix b/pkgs/servers/mjolnir/default.nix
index 5a62a8a154b..562a6c83ae3 100644
--- a/pkgs/servers/mjolnir/default.nix
+++ b/pkgs/servers/mjolnir/default.nix
@@ -10,20 +10,20 @@
 
 mkYarnPackage rec {
   pname = "mjolnir";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "mjolnir";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/vnojWLpu/fktqPUhAdL1QTESxDwFrBVYAkyF79Fj9w=";
+    hash = "sha256-xejFKz2MmdjMFU0X0SdI+qXTBRAwIvkcfZPQqXB9LV0=";
   };
 
   packageJSON = ./package.json;
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
-    hash = "sha256-B4s0CYr5Ihoh4gkckwZ3z0Nb4LMET48WvRXuhk3fpQM=";
+    hash = "sha256-RpvdyxJj92k4wFjBBmWCnEpFVOXVWlHEm0SmEBUlnTM=";
   };
 
   packageResolutions = {
diff --git a/pkgs/servers/mjolnir/package.json b/pkgs/servers/mjolnir/package.json
index f7ed5aba81e..4b24df82803 100644
--- a/pkgs/servers/mjolnir/package.json
+++ b/pkgs/servers/mjolnir/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mjolnir",
-  "version": "1.6.3",
+  "version": "1.6.5",
   "description": "A moderation tool for Matrix",
   "main": "lib/index.js",
   "repository": "git@github.com:matrix-org/mjolnir.git",
@@ -30,7 +30,7 @@
     "@types/jsdom": "^16.2.11",
     "@types/mocha": "^9.0.0",
     "@types/nedb": "^1.8.12",
-    "@types/node": "^16.7.10",
+    "@types/node": "^18.0.0",
     "@types/pg": "^8.6.5",
     "@types/request": "^2.48.8",
     "@types/shell-quote": "1.7.1",
@@ -55,15 +55,15 @@
     "humanize-duration-ts": "^2.1.1",
     "js-yaml": "^4.1.0",
     "jsdom": "^16.6.0",
-    "matrix-appservice-bridge": "8.0.0",
+    "matrix-appservice-bridge": "8.1.2",
     "parse-duration": "^1.0.2",
     "pg": "^8.8.0",
     "prom-client": "^14.1.0",
     "shell-quote": "^1.7.3",
     "ulidx": "^0.3.0",
-    "yaml": "^2.1.1"
+    "yaml": "^2.2.2"
   },
   "engines": {
-    "node": ">=16.0.0"
+    "node": ">=18.0.0"
   }
 }
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 7888f426cb3..8dcee384d6d 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.28.4";
+  version = "1.28.5";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -16,10 +16,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-Z6BhMLpuK7j8yo3XGlu6DaTv6e+VMa9fft/KtWNprpc=";
+    hash = "sha256-dmePzJ10VgzN6CxFAz7QloIsPULuTZH+Pjkd/kIQUmU=";
   };
 
-  vendorHash = "sha256-ebfch59JXJYxXcoIPc8XdkRugsjZ1pKCgvUXODSWTrw=";
+  vendorHash = "sha256-3buC6N/tHTf6FMEXU3+XlJVGntLe86Hx3eNpn7w0yMs=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/nosql/victoriametrics/default.nix b/pkgs/servers/nosql/victoriametrics/default.nix
index 95435b4ea77..25517c0b437 100644
--- a/pkgs/servers/nosql/victoriametrics/default.nix
+++ b/pkgs/servers/nosql/victoriametrics/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "VictoriaMetrics";
-  version = "1.93.5";
+  version = "1.93.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-AC3tQAgGHKl86MakfSWnFMX1Lr5r7RwZfomXtp5/oBs=";
+    hash = "sha256-MGIFM7PhKTeu7hnE9M2fj4EsJQv5AIDhFbypEJjYNwc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/servers/search/zincsearch/default.nix b/pkgs/servers/search/zincsearch/default.nix
index b9316756b19..a5b17b9825b 100644
--- a/pkgs/servers/search/zincsearch/default.nix
+++ b/pkgs/servers/search/zincsearch/default.nix
@@ -5,12 +5,12 @@
 }:
 
 let
-  version = "0.4.7";
+  version = "0.4.9";
   src = fetchFromGitHub {
     owner = "zinclabs";
     repo = "zincsearch";
     rev = "v${version}";
-    hash = "sha256-6ZwEH9Xm+iIZ0SDa8qb82lIN3KU6DMe2wt0q9doKgkE=";
+    hash = "sha256-NIrLhbtpk1mFbWRFPxkH1r4mBiwT488MYBjRgIV7igE=";
   };
 
   webui = buildNpmPackage {
@@ -40,7 +40,7 @@ buildGoModule rec {
     cp -r ${webui}/share/zinc-ui web/dist
   '';
 
-  vendorHash = "sha256-/uZh50ImKWW7vYMfRqTbTAMUoRTZ9jXMbc3K16wYJkE=";
+  vendorHash = "sha256-kP7QlES7VpZrOS4TGOFB9qciXGBEUVqzVLhz+2KiK98=";
   subPackages = [ "cmd/zincsearch" ];
 
   ldflags = [
diff --git a/pkgs/servers/sozu/default.nix b/pkgs/servers/sozu/default.nix
index d7ff34951c8..63f94093a84 100644
--- a/pkgs/servers/sozu/default.nix
+++ b/pkgs/servers/sozu/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sozu";
-  version = "0.15.13";
+  version = "0.15.15";
 
   src = fetchFromGitHub {
     owner = "sozu-proxy";
     repo = pname;
     rev = version;
-    hash = "sha256-egxeKwIgjpzF19ZunK9o2F/pjHWP8wva4KhGreXvR1w=";
+    hash = "sha256-zxGP2SWrq8beb+mJpgB39T7B1HpE76YP6se01vMewuw=";
   };
 
-  cargoHash = "sha256-q61HLKsF6h9/JPmggXHrCHXiFLYnWHtKayC/O0BAtA8=";
+  cargoHash = "sha256-KqCDOWCMRYpBMsESTdhMEgTu6qAxcg4RHe252JBggqs=";
 
   nativeBuildInputs = [ protobuf ];
 
diff --git a/pkgs/servers/teleport/12/default.nix b/pkgs/servers/teleport/12/default.nix
index ee166f5d472..6fcba5773f3 100644
--- a/pkgs/servers/teleport/12/default.nix
+++ b/pkgs/servers/teleport/12/default.nix
@@ -1,9 +1,9 @@
 { callPackage, ... }@args:
 callPackage ../generic.nix ({
-  version = "12.4.22";
-  hash = "sha256-UEiS+GiderYTU34GHsQr4G8XrasV5ewmPcdrec4v5B4=";
-  vendorHash = "sha256-etutgK/5u+e86kx7ha3x+di9np7Tcr7hpGUMKZxJNT4=";
-  yarnHash = "sha256-MBTElkMH5rb33l+AYWH+zguSLQf+ntXpOkHZpjLAx/Q=";
+  version = "12.4.23";
+  hash = "sha256-kCHRBa9rdwfcb98XG/08ZaJmI1NhEiSCoXuH8/3xJlk=";
+  vendorHash = "sha256-yOvQQHjtDSLqQZcw2OIOy6CDqwYSgMpL2Rxlk2u//OE=";
+  yarnHash = "sha256-beHCg9qUSisYMJ/9eeqWmbc9+V9YGgXBheZSFpbqoPY=";
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
diff --git a/pkgs/servers/teleport/13/Cargo.lock b/pkgs/servers/teleport/13/Cargo.lock
index d22467c3e7d..e0b56c33db8 100644
--- a/pkgs/servers/teleport/13/Cargo.lock
+++ b/pkgs/servers/teleport/13/Cargo.lock
@@ -451,17 +451,6 @@ dependencies = [
 
 [[package]]
 name = "errno"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f639046355ee4f37944e44f60642c6f3a7efa3cf6b78c78a0d989a8ce6c396a1"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "errno"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "50d6a0976c999d473fe89ad888d5a284e55366d9dc9038b1ba2aa15128c4afa0"
@@ -713,7 +702,7 @@ checksum = "28dfb6c8100ccc63462345b67d1bbc3679177c75ee4bf59bf29c8b1d110b8189"
 dependencies = [
  "hermit-abi 0.2.6",
  "io-lifetimes",
- "rustix 0.36.5",
+ "rustix 0.36.16",
  "windows-sys 0.42.0",
 ]
 
@@ -1363,16 +1352,16 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.36.5"
+version = "0.36.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3807b5d10909833d3e9acd1eb5fb988f79376ff10fce42937de71a449c4c588"
+checksum = "6da3636faa25820d8648e0e31c5d519bbb01f72fdf57131f0f5f7da5fed36eab"
 dependencies = [
  "bitflags 1.3.2",
- "errno 0.2.8",
+ "errno",
  "io-lifetimes",
  "libc",
  "linux-raw-sys 0.1.4",
- "windows-sys 0.42.0",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
@@ -1382,7 +1371,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c348b5dc624ecee40108aa2922fed8bad89d7fcc2b9f8cb18f632898ac4a37f9"
 dependencies = [
  "bitflags 1.3.2",
- "errno 0.3.0",
+ "errno",
  "io-lifetimes",
  "libc",
  "linux-raw-sys 0.3.0",
diff --git a/pkgs/servers/teleport/13/default.nix b/pkgs/servers/teleport/13/default.nix
index 65cbed70d9c..65a4cf64064 100644
--- a/pkgs/servers/teleport/13/default.nix
+++ b/pkgs/servers/teleport/13/default.nix
@@ -1,9 +1,9 @@
 { callPackage, ... }@args:
 callPackage ../generic.nix ({
-  version = "13.4.3";
-  hash = "sha256-x8G94jKycK3nYwqDA5RPc63GHIk9y4pHfSwSBqGBINk=";
-  vendorHash = "sha256-Pb3eO9zqLgTD7otM7yGRWicQjvpIXg7xKV8Oc4yh8PA=";
-  yarnHash = "sha256-GnoiLqzqGV0UZm5zePCDBUUX63NTIIo1dcxtiWQDPqc=";
+  version = "13.4.5";
+  hash = "sha256-uZolRnESFP65Xgvr29laEok2kBbm7G2qY9j8yKRrUdo=";
+  vendorHash = "sha256-Bkr6R9P2YTqvTEQkHvVdsRmWp6pv3Qg0WaQ+pERclWc=";
+  yarnHash = "sha256-60k4LRHpX4rYXZZ0CC44PqzL3PDu8PadV0kwXatnByI=";
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
diff --git a/pkgs/servers/teleport/14/Cargo.lock b/pkgs/servers/teleport/14/Cargo.lock
index c9b50a388b0..fc4c503d454 100644
--- a/pkgs/servers/teleport/14/Cargo.lock
+++ b/pkgs/servers/teleport/14/Cargo.lock
@@ -451,17 +451,6 @@ dependencies = [
 
 [[package]]
 name = "errno"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f639046355ee4f37944e44f60642c6f3a7efa3cf6b78c78a0d989a8ce6c396a1"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "winapi",
-]
-
-[[package]]
-name = "errno"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
@@ -708,7 +697,7 @@ checksum = "28dfb6c8100ccc63462345b67d1bbc3679177c75ee4bf59bf29c8b1d110b8189"
 dependencies = [
  "hermit-abi 0.2.6",
  "io-lifetimes",
- "rustix 0.36.5",
+ "rustix 0.36.16",
  "windows-sys 0.42.0",
 ]
 
@@ -1356,16 +1345,16 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.36.5"
+version = "0.36.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3807b5d10909833d3e9acd1eb5fb988f79376ff10fce42937de71a449c4c588"
+checksum = "6da3636faa25820d8648e0e31c5d519bbb01f72fdf57131f0f5f7da5fed36eab"
 dependencies = [
  "bitflags 1.3.2",
- "errno 0.2.8",
+ "errno",
  "io-lifetimes",
  "libc",
  "linux-raw-sys 0.1.4",
- "windows-sys 0.42.0",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
@@ -1375,7 +1364,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0a962918ea88d644592894bc6dc55acc6c0956488adcebbfb6e273506b7fd6e5"
 dependencies = [
  "bitflags 2.4.0",
- "errno 0.3.1",
+ "errno",
  "libc",
  "linux-raw-sys 0.4.3",
  "windows-sys 0.48.0",
@@ -1845,11 +1834,35 @@ dependencies = [
 
 [[package]]
 name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.48.0",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
 ]
 
 [[package]]
diff --git a/pkgs/servers/teleport/14/default.nix b/pkgs/servers/teleport/14/default.nix
index 71036da070e..d62c4549329 100644
--- a/pkgs/servers/teleport/14/default.nix
+++ b/pkgs/servers/teleport/14/default.nix
@@ -1,9 +1,9 @@
 { callPackage, ... }@args:
 callPackage ../generic.nix ({
-  version = "14.0.3";
-  hash = "sha256-X+vekYmuTE7n22SH/z2GWO3wnBsIef1GEjR7WOJpjc8=";
-  vendorHash = "sha256-+R6f2HrlN/RLec83YutccDFJW6gq6HXbxoJVtxMgdp8=";
-  yarnHash = "sha256-udM4DNaTGiMkqfkllJjmT+Nk6PNbGUzT34ixQOhmScw=";
+  version = "14.1.1";
+  hash = "sha256-xdJBl5imHuo1IP0ja33eaaE4i/sSP3kg/wQwehC1Hao=";
+  vendorHash = "sha256-+kCns/xHUfUOW2xBk6CaPZYWe/vcEguz2/4lqaJEbFc=";
+  yarnHash = "sha256-fWBMeat1bSIEMSADn8oDVfQtnUBojjy5ZCdVhw8PGMs=";
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
diff --git a/pkgs/test/cc-wrapper/atomics.cc b/pkgs/test/cc-wrapper/atomics.cc
new file mode 100644
index 00000000000..23601ae92f0
--- /dev/null
+++ b/pkgs/test/cc-wrapper/atomics.cc
@@ -0,0 +1,8 @@
+#include <atomic>
+#include <cstdint>
+
+int main()
+{
+  std::atomic_int x = {0};
+  return !std::atomic_is_lock_free(&x);
+}
diff --git a/pkgs/test/cc-wrapper/default.nix b/pkgs/test/cc-wrapper/default.nix
index 74009c97980..a0088751d4a 100644
--- a/pkgs/test/cc-wrapper/default.nix
+++ b/pkgs/test/cc-wrapper/default.nix
@@ -9,7 +9,8 @@ let
   );
   staticLibc = lib.optionalString (stdenv.hostPlatform.libc == "glibc") "-L ${glibc.static}/lib";
   emulator = stdenv.hostPlatform.emulator buildPackages;
-  libcxxStdenvSuffix = lib.optionalString (stdenv.cc.libcxx != null) "-libcxx";
+  isCxx = stdenv.cc.libcxx != null;
+  libcxxStdenvSuffix = lib.optionalString isCxx "-libcxx";
 in stdenv.mkDerivation {
   pname = "cc-wrapper-test-${stdenv.cc.cc.pname}${libcxxStdenvSuffix}";
   version = stdenv.cc.version;
@@ -37,6 +38,14 @@ in stdenv.mkDerivation {
     $CXX -o include-cxxabi ${./include-cxxabi.cc}
     ${emulator} ./include-cxxabi
 
+    # cxx doesn't have libatomic.so
+    ${lib.optionalString (!isCxx) ''
+      # https://github.com/NixOS/nixpkgs/issues/91285
+      echo "checking whether libatomic.so can be linked... " >&2
+      $CXX -shared -o atomics.so ${./atomics.cc} -latomic ${lib.optionalString (stdenv.cc.isClang && lib.versionOlder stdenv.cc.version "6.0.0" ) "-std=c++17"}
+      $READELF -d ./atomics.so | grep libatomic.so && echo "ok" >&2 || echo "failed" >&2
+    ''}
+
     ${lib.optionalString (stdenv.isDarwin && stdenv.cc.isClang) ''
       echo "checking whether compiler can build with CoreFoundation.framework... " >&2
       mkdir -p foo/lib
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 06c275edc70..d8c5f3208bc 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -39,41 +39,43 @@ with pkgs;
       name = "cc-wrapper-supported";
       builtGCC =
         let
-          names = lib.pipe (attrNames gccTests) ([
-            (filter (n: lib.meta.availableOn stdenv.hostPlatform pkgs.${n}.cc))
+          inherit (lib) filterAttrs;
+          sets = lib.pipe gccTests ([
+            (filterAttrs (_: v: lib.meta.availableOn stdenv.hostPlatform v.stdenv.cc))
             # Broken
-            (filter (n: n != "gcc49Stdenv"))
-            (filter (n: n != "gccMultiStdenv"))
+            (filterAttrs (n: _: n != "gcc49Stdenv"))
+            (filterAttrs (n: _: n != "gccMultiStdenv"))
           ] ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
             # fails with things like
             # ld: warning: ld: warning: object file (trunctfsf2_s.o) was built for newer macOS version (11.0) than being linked (10.5)
             # ld: warning: ld: warning: could not create compact unwind for ___fixunstfdi: register 20 saved somewhere other than in frame
-            (filter (n: n != "gcc11Stdenv"))
+            (filterAttrs (n: _: n != "gcc11Stdenv"))
           ]);
         in
-        toJSON (lib.genAttrs names (name: { name = pkgs.${name};  }));
+        toJSON sets;
 
       builtLLVM =
         let
-          names = lib.pipe (attrNames llvmTests) ([
-            (filter (n: lib.meta.availableOn stdenv.hostPlatform pkgs.${n}.stdenv.cc))
-            (filter (n: lib.meta.availableOn stdenv.hostPlatform pkgs.${n}.libcxxStdenv.cc))
+          inherit (lib) filterAttrs;
+          sets = lib.pipe llvmTests ([
+            (filterAttrs (_: v: lib.meta.availableOn stdenv.hostPlatform v.clang.stdenv.cc))
+            (filterAttrs (_: v: lib.meta.availableOn stdenv.hostPlatform v.libcxx.stdenv.cc))
 
             # libcxxStdenv broken
             # fix in https://github.com/NixOS/nixpkgs/pull/216273
           ] ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
             # libcxx does not build for some reason on aarch64-linux
-            (filter (n: n != "llvmPackages_7"))
+            (filterAttrs (n: _: n != "llvmPackages_7"))
           ] ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
-            (filter (n: n != "llvmPackages_5"))
-            (filter (n: n != "llvmPackages_6"))
-            (filter (n: n != "llvmPackages_7"))
-            (filter (n: n != "llvmPackages_8"))
-            (filter (n: n != "llvmPackages_9"))
-            (filter (n: n != "llvmPackages_10"))
+            (filterAttrs (n: _: n != "llvmPackages_5"))
+            (filterAttrs (n: _: n != "llvmPackages_6"))
+            (filterAttrs (n: _: n != "llvmPackages_7"))
+            (filterAttrs (n: _: n != "llvmPackages_8"))
+            (filterAttrs (n: _: n != "llvmPackages_9"))
+            (filterAttrs (n: _: n != "llvmPackages_10"))
           ]);
         in
-        toJSON (lib.genAttrs names (name: { stdenv = pkgs.${name}.stdenv; libcxx = pkgs.${name}.libcxxStdenv;  }));
+        toJSON sets;
         buildCommand = ''
           touch $out
         '';
diff --git a/pkgs/tools/admin/pulumi-bin/data.nix b/pkgs/tools/admin/pulumi-bin/data.nix
index 3050cbbaac7..299d77ff8ac 100644
--- a/pkgs/tools/admin/pulumi-bin/data.nix
+++ b/pkgs/tools/admin/pulumi-bin/data.nix
@@ -1,12 +1,12 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.93.0";
+  version = "3.94.0";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.93.0-linux-x64.tar.gz";
-        sha256 = "1s081ak1m55jckgrrcnj918smlx79sywqgqfbvf50hkcrk5pwdsj";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.94.0-linux-x64.tar.gz";
+        sha256 = "1yn97xxqwgrcd5psrrimcz1gjv34s7mri40nwb2mgmqj7xs4hyi3";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.7.2-linux-amd64.tar.gz";
@@ -61,8 +61,8 @@
         sha256 = "1r1sfxngwkf89lni0l8zalh2vz5a7m9ap4p15cs4bc98zmkin762";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.4.4-linux-amd64.tar.gz";
-        sha256 = "01zckkhkji8579r6b18mc6h36ap5qm8pa5kjf3mzgy1j1v1mhlww";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.4.5-linux-amd64.tar.gz";
+        sha256 = "1m44dwr8q8w60s5clm4n1hini1bm5bqc7p7h1gvbh5zg1482hn5q";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-linux-amd64.tar.gz";
@@ -163,8 +163,8 @@
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.93.0-darwin-x64.tar.gz";
-        sha256 = "0gxch1ml2sv66wbzfycsg02f6cagwrv0kl2b437xnn8g86mxi2di";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.94.0-darwin-x64.tar.gz";
+        sha256 = "0v854xz9imq9kxslvyx3km20jzcia8m6wkq6ga1gxlsrbx3ajgrn";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.7.2-darwin-amd64.tar.gz";
@@ -219,8 +219,8 @@
         sha256 = "0iymy2rjyxya49w7awrjns4pnj4m2m66iqf59f1a6ww4i5qmx5f1";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.4.4-darwin-amd64.tar.gz";
-        sha256 = "10w91x51by096blmvgdyci1xan9xw7yh9ky7ajpz3mmr3y3npqn8";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.4.5-darwin-amd64.tar.gz";
+        sha256 = "0g8rcdbfbpmsw3wqx9jy5kz6pcmr9im2njisi3rlkkyfazm7fmqd";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-darwin-amd64.tar.gz";
@@ -321,8 +321,8 @@
     ];
     aarch64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.93.0-linux-arm64.tar.gz";
-        sha256 = "0xmsn6qyrmiqpgpffr1c0ykpw06ca8lcv4hgsvv12jxzqrasdv6a";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.94.0-linux-arm64.tar.gz";
+        sha256 = "075pyjjinc77283cqd81745sdjxlcrdn02nx17jis28w4gp7y88n";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.7.2-linux-arm64.tar.gz";
@@ -377,8 +377,8 @@
         sha256 = "11q7cnncwdmjp8klk74wrnm6674ap5lrdjfq7413ps8rbdjpyvhl";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.4.4-linux-arm64.tar.gz";
-        sha256 = "0rl4ckrna59qgyhzmrzzlhl08c13979gjfx0pbhk6m6ahcm6whyc";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.4.5-linux-arm64.tar.gz";
+        sha256 = "1dxam51n9r2nmkw29fdwl5b0664ll2a1qczva0fgh1wpdslisp8s";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-linux-arm64.tar.gz";
@@ -479,8 +479,8 @@
     ];
     aarch64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.93.0-darwin-arm64.tar.gz";
-        sha256 = "0q59khgglzk0dkz1p81nmj0v7gsgkdfv2109sk3lb7ms5myknkd6";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.94.0-darwin-arm64.tar.gz";
+        sha256 = "05yyw5pjbmzgqimcd72xidwzqsvvkj7ayafwy701smmxdpck31b0";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.7.2-darwin-arm64.tar.gz";
@@ -535,8 +535,8 @@
         sha256 = "1glpfbinny7cm7bk3q5y7g7lyrzmhdlsfjyiaxqwpkwx2960p5iv";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.4.4-darwin-arm64.tar.gz";
-        sha256 = "0xh2r364xkfxq4dlxskxm449d2iqrc2105y72km6w6wrmdvazpn7";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.4.5-darwin-arm64.tar.gz";
+        sha256 = "0kcivc4bs720s7cdjphjcy1sss7pfsands37c8gikhiq0cnl39mb";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-darwin-arm64.tar.gz";
diff --git a/pkgs/tools/audio/liquidsoap/full.nix b/pkgs/tools/audio/liquidsoap/full.nix
index 5e196a5b557..22925dce99f 100644
--- a/pkgs/tools/audio/liquidsoap/full.nix
+++ b/pkgs/tools/audio/liquidsoap/full.nix
@@ -1,35 +1,68 @@
-{ lib, stdenv, makeWrapper, fetchurl, which, pkg-config
+{ lib, stdenv, makeWrapper, fetchFromGitHub, which, pkg-config
 , libjpeg
 , ocamlPackages
-, awscli2, curl, ffmpeg, youtube-dl
-, runtimePackages ? [ awscli2 curl ffmpeg youtube-dl ]
+, awscli2, bubblewrap, curl, ffmpeg, yt-dlp
+, runtimePackages ? [ awscli2 bubblewrap curl ffmpeg yt-dlp ]
 }:
 
 let
   pname = "liquidsoap";
-  version = "2.1.4";
+  version = "2.2.2";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
-  src = fetchurl {
-    url = "https://github.com/savonet/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-GQuG7f9U+/HqPcuj6hnBoH5mWEhxSwWgBnkCuLqHTAc=";
+  src = fetchFromGitHub {
+    owner = "savonet";
+    repo = "liquidsoap";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-t7rkWHSAd3DaTCXaGfL9NcIQYT+f4Od9D6huuZlwhWk=";
   };
 
-  postFixup = ''
+  postPatch = ''
+    substituteInPlace src/lang/dune \
+      --replace "(run git rev-parse --short HEAD)" "(run echo -n nixpkgs)"
+  '';
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    dune build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    dune install --prefix "$out"
+
+    runHook postInstall
+  '';
+
+  fixupPhase = ''
+    runHook preFixup
+
     wrapProgram $out/bin/liquidsoap \
       --set LIQ_LADSPA_PATH /run/current-system/sw/lib/ladspa \
       --prefix PATH : ${lib.makeBinPath runtimePackages}
-  '';
 
+    runHook postFixup
+  '';
 
   strictDeps = true;
 
-  nativeBuildInputs =
-    [ makeWrapper pkg-config which
-      ocamlPackages.ocaml ocamlPackages.findlib ocamlPackages.menhir
-    ];
+  nativeBuildInputs = [
+    makeWrapper
+    pkg-config
+    which
+    ocamlPackages.ocaml
+    ocamlPackages.dune_3
+    ocamlPackages.findlib
+    ocamlPackages.menhir
+  ];
 
   buildInputs = [
     libjpeg
@@ -38,29 +71,36 @@ stdenv.mkDerivation {
     ocamlPackages.dtools
     ocamlPackages.duppy
     ocamlPackages.mm
-    ocamlPackages.ocaml_pcre
-    ocamlPackages.menhir ocamlPackages.menhirLib
-    (ocamlPackages.camomile.override { version = "1.0.2"; })
     ocamlPackages.ocurl
+    ocamlPackages.cry
+    ocamlPackages.camomile
     ocamlPackages.uri
-    ocamlPackages.sedlex
+    ocamlPackages.fileutils
+    ocamlPackages.menhir # liquidsoap-lang
+    ocamlPackages.menhirLib
+    ocamlPackages.metadata
+    ocamlPackages.dune-build-info
+    ocamlPackages.re
+    ocamlPackages.sedlex # liquidsoap-lang
+    ocamlPackages.ppx_string
 
     # Recommended dependencies
     ocamlPackages.ffmpeg
 
     # Optional dependencies
-    ocamlPackages.camlimages
-    ocamlPackages.gd4o
     ocamlPackages.alsa
     ocamlPackages.ao
     ocamlPackages.bjack
-    ocamlPackages.cry
+    ocamlPackages.camlimages
     ocamlPackages.dssi
     ocamlPackages.faad
     ocamlPackages.fdkaac
     ocamlPackages.flac
     ocamlPackages.frei0r
+    ocamlPackages.gd4o
+    ocamlPackages.graphics
     ocamlPackages.gstreamer
+    ocamlPackages.imagelib
     ocamlPackages.inotify
     ocamlPackages.ladspa
     ocamlPackages.lame
@@ -72,25 +112,22 @@ stdenv.mkDerivation {
     ocamlPackages.ogg
     ocamlPackages.opus
     ocamlPackages.portaudio
+    ocamlPackages.posix-time2
     ocamlPackages.pulseaudio
-    ocamlPackages.shine
     ocamlPackages.samplerate
+    ocamlPackages.shine
     ocamlPackages.soundtouch
     ocamlPackages.speex
     ocamlPackages.srt
     ocamlPackages.ssl
     ocamlPackages.taglib
     ocamlPackages.theora
-    ocamlPackages.vorbis
-    ocamlPackages.xmlplaylist
-    ocamlPackages.posix-time2
     ocamlPackages.tsdl
     ocamlPackages.tsdl-image
     ocamlPackages.tsdl-ttf
-
-    # Undocumented dependencies
-    ocamlPackages.graphics
-    ocamlPackages.cohttp-lwt-unix
+    ocamlPackages.vorbis
+    ocamlPackages.xmlplaylist
+    ocamlPackages.yaml
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/filesystems/bcachefs-tools/default.nix b/pkgs/tools/filesystems/bcachefs-tools/default.nix
index 81152d144aa..7df877f102f 100644
--- a/pkgs/tools/filesystems/bcachefs-tools/default.nix
+++ b/pkgs/tools/filesystems/bcachefs-tools/default.nix
@@ -23,16 +23,17 @@
 , fuseSupport ? false
 }:
 let
-  rev = "cfa816bf3f823a3bedfedd8e214ea929c5c755fe";
-in stdenv.mkDerivation {
+  version = "1.3.1";
+in
+stdenv.mkDerivation {
   pname = "bcachefs-tools";
-  version = "unstable-2023-06-28";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
-    inherit rev;
-    hash = "sha256-XgXUwyZV5N8buYTuiu1Y1ZU3uHXjZ/OZ1kbZ9d6Rt5I=";
+    rev = "v${version}";
+    hash = "sha256-4TmH6YOW6ktISVA6RLo7JRl8/SnRzGMrdbyCr+mDkqY=";
   };
 
   # errors on fsck_err function. Maybe miss-detection?
@@ -75,7 +76,7 @@ in stdenv.mkDerivation {
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
-    "VERSION=${lib.strings.substring 0 7 rev}"
+    "VERSION=${version}"
     "INITRAMFS_DIR=${placeholder "out"}/etc/initramfs-tools"
   ];
 
diff --git a/pkgs/tools/misc/esphome/dashboard.nix b/pkgs/tools/misc/esphome/dashboard.nix
index ceb416c6529..f5bd9910569 100644
--- a/pkgs/tools/misc/esphome/dashboard.nix
+++ b/pkgs/tools/misc/esphome/dashboard.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "esphome-dashboard";
-  version = "20230904.0";
+  version = "20231107.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-b+NlWekNXbGvhLQlQqFtSSsO99J+ldS6NddlK3lykeA=";
+    hash = "sha256-84iM987nxNidMObnbY3lt78xRbN9USNtqQzfOzkd17k=";
   };
 
   # no tests
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index 8413dde7696..33d26ad06e0 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -1,6 +1,6 @@
 { lib
 , callPackage
-, python3
+, python3Packages
 , fetchFromGitHub
 , platformio
 , esptool_3
@@ -8,7 +8,7 @@
 }:
 
 let
-  python = python3.override {
+  python = python3Packages.python.override {
     packageOverrides = self: super: {
       esphome-dashboard = self.callPackage ./dashboard.nix {};
     };
@@ -16,14 +16,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2023.10.6";
+  version = "2023.11.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-GqZSQVQnxLj0JrUrCMB5+RmxcJRU6ErIDGP8WaMolXk=";
+    hash = "sha256-965gjYQmdsx4G4HJdBYx8u1jvAk48fLRP8QXDv1eQLM=";
   };
 
   postPatch = ''
@@ -45,6 +45,7 @@ python.pkgs.buildPythonApplication rec {
   # - validate_pillow_installed
   propagatedBuildInputs = with python.pkgs; [
     aioesphomeapi
+    argcomplete
     click
     colorama
     cryptography
@@ -72,7 +73,7 @@ python.pkgs.buildPythonApplication rec {
     "--set ESPHOME_USE_SUBPROCESS ''"
   ];
 
-  nativeCheckInputs = with python.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     hypothesis
     mock
     pytest-asyncio
diff --git a/pkgs/tools/misc/google-cloud-sql-proxy/default.nix b/pkgs/tools/misc/google-cloud-sql-proxy/default.nix
index a253d1da6c3..de5f49aca25 100644
--- a/pkgs/tools/misc/google-cloud-sql-proxy/default.nix
+++ b/pkgs/tools/misc/google-cloud-sql-proxy/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "google-cloud-sql-proxy";
-  version = "2.7.1";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "cloud-sql-proxy";
     rev = "v${version}";
-    hash = "sha256-8UoAN5z84gGV869AgOWGrC92NdEnkw5b6QME4QKQ/mM=";
+    hash = "sha256-mfPh9cdsn9Jq9a1gkF5f/24inxuwcITrp7KfSfp0pMQ=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-S2bt015AD25K6yrVGK3qv8Gq2fVifVV0AVBSt/8V9So=";
+  vendorHash = "sha256-GfvEurTX5r2ZIOwaDJA4ncd8SNMusoqXuhcMGYvaVwQ=";
 
   preCheck = ''
     buildFlagsArray+="-short"
diff --git a/pkgs/tools/misc/moar/default.nix b/pkgs/tools/misc/moar/default.nix
index d838181a9c7..6bcbd8a9ac4 100644
--- a/pkgs/tools/misc/moar/default.nix
+++ b/pkgs/tools/misc/moar/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "moar";
-  version = "1.18.3";
+  version = "1.18.4";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Wj7zKszVtaTwcIoTtjHasShEnSDoiZ53Gnz38Ci31Hs=";
+    hash = "sha256-zF+Hnsmw5TJCYYoItrwcnyh3NSmKrV9JoTPwTMVyw7Y=";
   };
 
   vendorHash = "sha256-x6BeU6JDayCOi8T8+NvXZe59QmTaO9RAYwSiFlDPL/c=";
diff --git a/pkgs/tools/misc/mstflint/default.nix b/pkgs/tools/misc/mstflint/default.nix
index 51fd22b0c35..619858cbe35 100644
--- a/pkgs/tools/misc/mstflint/default.nix
+++ b/pkgs/tools/misc/mstflint/default.nix
@@ -1,26 +1,109 @@
 { lib
 , stdenv
 , fetchurl
-, libibmad
+, rdma-core
 , openssl
 , zlib
+, xz
+, expat
+, boost
+, curl
+, pkg-config
+, libxml2
+, pciutils
+, busybox
+, python3
+, automake
+, autoconf
+, libtool
+, git
+# use this to shrink the package's footprint if necessary (e.g. for hardened appliances)
+, onlyFirmwareUpdater ? false
+# contains binary-only libraries
+, enableDPA ? true
 }:
 
 stdenv.mkDerivation rec {
   pname = "mstflint";
-  version = "4.17.0-1";
+  version = "4.26.0-1";
 
   src = fetchurl {
     url = "https://github.com/Mellanox/mstflint/releases/download/v${version}/mstflint-${version}.tar.gz";
-    sha256 = "030vpiv44sxmjf0dng91ziq1cggwj33yp0l4xc6cdhnrv2prjs7y";
+    hash = "sha256-P8XACcz6d8UTOhFFeTijfFOthBqnUghGlDj9K145sZ8=";
   };
 
+  nativeBuildInputs = [
+    autoconf
+    automake
+    libtool
+    pkg-config
+    libxml2
+    git
+  ];
+
   buildInputs = [
-    libibmad
-    openssl
+    rdma-core
     zlib
+    libxml2
+    openssl
+  ] ++ lib.optionals (!onlyFirmwareUpdater) [
+    boost
+    curl
+    expat
+    xz
+    python3
+  ];
+
+  preConfigure = ''
+    export CPPFLAGS="-I$(pwd)/tools_layouts -isystem ${libxml2.dev}/include/libxml2"
+    export INSTALL_BASEDIR=$out
+    ./autogen.sh
+  '';
+
+  # Cannot use wrapProgram since the python script's logic depends on the
+  # filename and will get messed up if the executable is named ".xyz-wrapped".
+  # That is why the python executable and runtime dependencies are injected
+  # this way.
+  #
+  # Remove host_cpu replacement again (see https://github.com/Mellanox/mstflint/pull/865),
+  # needs to hit master or a release. master_devel may be rebased.
+  #
+  # Remove patch for regex check, after https://github.com/Mellanox/mstflint/pull/871
+  # got merged.
+  prePatch = [
+  ''
+    patchShebangs eval_git_sha.sh
+    substituteInPlace configure.ac \
+        --replace "build_cpu" "host_cpu"
+    substituteInPlace common/compatibility.h \
+        --replace "#define ROOT_PATH \"/\"" "#define ROOT_PATH \"$out/\""
+    substituteInPlace configure.ac \
+        --replace 'Whether to use GNU C regex])' 'Whether to use GNU C regex])],[AC_MSG_RESULT([yes])'
+  ''
+  (lib.optionals (!onlyFirmwareUpdater) ''
+    substituteInPlace common/python_wrapper.sh \
+      --replace \
+      'exec $PYTHON_EXEC $SCRIPT_PATH "$@"' \
+      'export PATH=$PATH:${lib.makeBinPath [ (placeholder "out") pciutils busybox]}; exec ${python3}/bin/python3 $SCRIPT_PATH "$@"'
+  '')
   ];
 
+  configureFlags = [
+    "--enable-xml2"
+    "--datarootdir=${placeholder "out"}/share"
+  ] ++ lib.optionals (!onlyFirmwareUpdater) [
+    "--enable-adb-generic-tools"
+    "--enable-cs"
+    "--enable-dc"
+    "--enable-fw-mgr"
+    "--enable-inband"
+    "--enable-rdmem"
+  ] ++ lib.optionals enableDPA [
+    "--enable-dpa"
+  ];
+
+  enableParallelBuilding = true;
+
   hardeningDisable = [ "format" ];
 
   dontDisableStatic = true;  # the build fails without this. should probably be reported upstream
@@ -29,6 +112,7 @@ stdenv.mkDerivation rec {
     description = "Open source version of Mellanox Firmware Tools (MFT)";
     homepage = "https://github.com/Mellanox/mstflint";
     license = with licenses; [ gpl2 bsd2 ];
+    maintainers = with maintainers; [ thillux ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/pspg/default.nix b/pkgs/tools/misc/pspg/default.nix
index f14339e007f..e0da056c48c 100644
--- a/pkgs/tools/misc/pspg/default.nix
+++ b/pkgs/tools/misc/pspg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pspg";
-  version = "5.8.0";
+  version = "5.8.1";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = pname;
     rev = version;
-    sha256 = "sha256-VkWGVKLN8arc6BOivmjSk8MtMbp2WYqZE9lM8oTQe+U=";
+    sha256 = "sha256-nsGBBGw66LCwOuNdBjlz6u9RT+BX6iZmZeDY9yJoc+c=";
   };
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
diff --git a/pkgs/tools/misc/qflipper/default.nix b/pkgs/tools/misc/qflipper/default.nix
index 86043f7b0ba..5c139d017c8 100644
--- a/pkgs/tools/misc/qflipper/default.nix
+++ b/pkgs/tools/misc/qflipper/default.nix
@@ -24,8 +24,8 @@
 }:
 let
   pname = "qFlipper";
-  version = "1.3.2";
-  sha256 = "sha256-n/vvLR4p7ZmQC+FuYOvarmgydfYwxRBRktzs7CfiNQg=";
+  version = "1.3.3";
+  sha256 = "sha256-/Xzy+OA0Nl/UlSkOOZW2YsOHdJvS/7X3Z3ITkPByAOc=";
   timestamp = "99999999999";
   commit = "nix-${version}";
 
diff --git a/pkgs/tools/misc/ttyplot/default.nix b/pkgs/tools/misc/ttyplot/default.nix
index a136031dfc1..3778048143b 100644
--- a/pkgs/tools/misc/ttyplot/default.nix
+++ b/pkgs/tools/misc/ttyplot/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ttyplot";
-  version = "1.5";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "tenox7";
     repo = "ttyplot";
     rev = version;
-    sha256 = "sha256-COnqzWqah1J/q64XrOBhMOsrafAs/BptqNvrjHJ9edQ=";
+    sha256 = "sha256-lZLjTmSKxGJhUMELcIPjycpuRR3m9oz/Vh1/FEUzMOQ=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/misc/ugs/default.nix b/pkgs/tools/misc/ugs/default.nix
index c40fbc7a01b..aae9daddae9 100644
--- a/pkgs/tools/misc/ugs/default.nix
+++ b/pkgs/tools/misc/ugs/default.nix
@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ugs";
-  version = "2.0.21";
+  version = "2.1.0";
 
   src = fetchzip {
     url = "https://github.com/winder/Universal-G-Code-Sender/releases/download/v${version}/UniversalGcodeSender.zip";
-    hash = "sha256-KZh15M1dRV7oN5Qrg8q+PV3ZHCdNHF2wOUnGq+VLGYI=";
+    hash = "sha256-BH4oka2Ht4fGMD6/xy/MLBXNkJRggs4VQVG0UqmYQoI=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/misc/yt-dlp/default.nix b/pkgs/tools/misc/yt-dlp/default.nix
index 9218e24230f..c9c1caff801 100644
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@@ -22,11 +22,11 @@ buildPythonPackage rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2023.11.14";
+  version = "2023.11.16";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-s8JTU7oQaSLYcKWlnk1qLrhXg+vRfinsQ1vD4XZN6L4=";
+    hash = "sha256-8Mza8S4IsVkCYBpGccerEpBtexHeOudfplBoEcJOxdo=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/networking/aria2/default.nix b/pkgs/tools/networking/aria2/default.nix
index 6c972bb2397..29426eef06e 100644
--- a/pkgs/tools/networking/aria2/default.nix
+++ b/pkgs/tools/networking/aria2/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aria2";
-  version = "1.36.0";
+  version = "1.37.0";
 
   src = fetchFromGitHub {
     owner = "aria2";
     repo = "aria2";
     rev = "release-${version}";
-    sha256 = "sha256-ErjFfSJDIgZq0qy0Zn5uZ9bZS2AtJq4FuBVuUuQgPTI=";
+    sha256 = "sha256-xbiNSg/Z+CA0x0DQfMNsWdA+TATyX6dCeW2Nf3L3Kfs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/networking/containerlab/default.nix b/pkgs/tools/networking/containerlab/default.nix
index 0a8b02af7cf..856a21cb967 100644
--- a/pkgs/tools/networking/containerlab/default.nix
+++ b/pkgs/tools/networking/containerlab/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "containerlab";
-  version = "0.46.2";
+  version = "0.48.1";
 
   src = fetchFromGitHub {
     owner = "srl-labs";
     repo = "containerlab";
     rev = "v${version}";
-    hash = "sha256-TzHTiAcN57FDdKBkZq5YwFwjP3s6OmN3431XGoMgnwI=";
+    hash = "sha256-k166J9algbbwGMG65Sr0sshwhLwo5M7JDtGnG4AKZJM=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
-  vendorHash = "sha256-3ALEwpFDnbSoTm3bxHZmRGkw1DeQ4Ikl6PpTosa1S6E=";
+  vendorHash = "sha256-w5lwZTSG6OI85P/swjK3NtovMqfgttr9DC+CPSKlpKQ=";
 
   ldflags = [
     "-s"
@@ -41,6 +41,6 @@ buildGoModule rec {
     changelog = "https://github.com/srl-labs/containerlab/releases/tag/${src.rev}";
     license = licenses.bsd3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ janik ];
+    maintainers = with maintainers; [ aaronjheng ];
   };
 }
diff --git a/pkgs/tools/networking/sing-box/default.nix b/pkgs/tools/networking/sing-box/default.nix
index 600ad2b13f8..0d75f874a19 100644
--- a/pkgs/tools/networking/sing-box/default.nix
+++ b/pkgs/tools/networking/sing-box/default.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "sing-box";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-BYmEtdGaNfZ4QJMF1a+W1LjURh7HpFK1rS64CR46z1M=";
+    hash = "sha256-djbRt4VdrZ2a0yLbNaFNhKIN0AwuCCJATIcwFhnw5aM=";
   };
 
-  vendorHash = "sha256-aCYnr9Y6rxmTjY6Q/8IjYSmAVep/0ipitjjeArIhtPI=";
+  vendorHash = "sha256-qoW9+t427k5Ea9BhAdWIh+utD7EnIU1OLKJfsmYlEt8=";
 
   tags = [
     "with_quic"
diff --git a/pkgs/tools/networking/socat/default.nix b/pkgs/tools/networking/socat/default.nix
index c34aa7ab4c2..3fcbbf969e6 100644
--- a/pkgs/tools/networking/socat/default.nix
+++ b/pkgs/tools/networking/socat/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "socat";
-  version = "1.7.4.4";
+  version = "1.8.0.0";
 
   src = fetchurl {
     url = "http://www.dest-unreach.org/socat/download/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-+9Qr0vDlSjr20BvfFThThKuC28Dk8aXhU7PgvhtjgKw=";
+    hash = "sha256-4d5oPdIu4OOmxrv/Jpq+GKsMnX62UCBPElFVuQBfrKc=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index 4030e3d14ec..cdde4191577 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tgt";
-  version = "1.0.88";
+  version = "1.0.89";
 
   src = fetchFromGitHub {
     owner = "fujita";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tLc+viPufR6P5texDs9lU8wsOTzrjSK0Qz/r4/L8M5k=";
+    sha256 = "sha256-sgflHkG4FncQ31+BwcZsp7LRgqeqANCIKGysxUk8aEs=";
   };
 
   nativeBuildInputs = [ libxslt docbook_xsl makeWrapper ];
diff --git a/pkgs/tools/networking/v2ray/default.nix b/pkgs/tools/networking/v2ray/default.nix
index 34f1fd48335..cbaeead5a4b 100644
--- a/pkgs/tools/networking/v2ray/default.nix
+++ b/pkgs/tools/networking/v2ray/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "v2ray-core";
-  version = "5.8.0";
+  version = "5.11.0";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "v2ray-core";
     rev = "v${version}";
-    hash = "sha256-fMAPlPn53GkYKpraRS58XTF//IMZtzssaQpBkirEWfw=";
+    hash = "sha256-wiAK3dzZ9TGYkt7MmBkYTD+Mi5BEid8sziDM1nI3Z80=";
   };
 
   # `nix-update` doesn't support `vendorHash` yet.
   # https://github.com/Mic92/nix-update/pull/95
-  vendorHash = "sha256-un3faML5u9kmlsJw/hitoRcGYtVukF+V/dJMFyGhr8Q=";
+  vendorHash = "sha256-pC3KXx1KBvQx6eZZG1czaGjCOd0xAB42B5HmKn7p52c=";
 
   ldflags = [ "-s" "-w" "-buildid=" ];
 
diff --git a/pkgs/tools/security/sigma-cli/default.nix b/pkgs/tools/security/sigma-cli/default.nix
index d381be73e0f..30954f4c171 100644
--- a/pkgs/tools/security/sigma-cli/default.nix
+++ b/pkgs/tools/security/sigma-cli/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sigma-cli";
-  version = "0.7.9";
+  version = "0.7.10";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
     repo = "sigma-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CWoVVvhprqBW4bmcAHtgJbbOPxGbBsikNu6bwyDdIcc=";
+    hash = "sha256-Sy9adkmR7Vu7kI75XG0PXihFogPaNwzHH2U5uSz9mZA=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/security/sslscan/default.nix b/pkgs/tools/security/sslscan/default.nix
index 55207b1231f..6f5999978a1 100644
--- a/pkgs/tools/security/sslscan/default.nix
+++ b/pkgs/tools/security/sslscan/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sslscan";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "rbsec";
     repo = "sslscan";
     rev = "refs/tags/${version}";
-    hash = "sha256-AsOuNJ5adI7/8A6siK4MzLtpBstsU7JxX1d6WWVJHAY=";
+    hash = "sha256-6teCWzv9DXhGSBjyIurRW3ymSTwMUlbJGjuXmsqpkUc=";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/system/bfs/default.nix b/pkgs/tools/system/bfs/default.nix
index 757e6bcd9dd..17f6af921c7 100644
--- a/pkgs/tools/system/bfs/default.nix
+++ b/pkgs/tools/system/bfs/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   # Disable LTO on darwin. See https://github.com/NixOS/nixpkgs/issues/19098
   preConfigure = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace Makefile --replace "-flto" ""
+    substituteInPlace GNUMakefile --replace "-flto=auto" ""
   '';
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/tools/text/riffdiff/default.nix b/pkgs/tools/text/riffdiff/default.nix
index cd5e2caa8f0..8b71eeec481 100644
--- a/pkgs/tools/text/riffdiff/default.nix
+++ b/pkgs/tools/text/riffdiff/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "riffdiff";
-  version = "2.27.0";
+  version = "2.27.1";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "riff";
     rev = version;
-    hash = "sha256-yrIZsCxoFV9LFh96asYxpAYv1KvrLq+RlqL8gZXaeak=";
+    hash = "sha256-cW43nt8Go4VjEwXpCieGYIXwG1XMexslgriMsZ0BB1g=";
   };
 
-  cargoHash = "sha256-tO49qAEW15q76hLcHOtniwLqGy29MZ/dabyZHYAsiME=";
+  cargoHash = "sha256-phTo0XvCiTnBFF5r5myvwmiWnpcYLnkaMLcaXw4oL/Y=";
 
   meta = with lib; {
     description = "A diff filter highlighting which line parts have changed";
diff --git a/pkgs/tools/wayland/hyprland-per-window-layout/default.nix b/pkgs/tools/wayland/hyprland-per-window-layout/default.nix
index 32dcddea6fc..f6412a3ca74 100644
--- a/pkgs/tools/wayland/hyprland-per-window-layout/default.nix
+++ b/pkgs/tools/wayland/hyprland-per-window-layout/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprland-per-window-layout";
-  version = "2.3";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "coffebar";
     repo = pname;
     rev = version;
-    hash = "sha256-eqhGX9rjvOHh6RuWj5dqWPKlFdTnZpAcDUuJbT3Z/E8=";
+    hash = "sha256-zH0N7m8cvc47MM7+DAIgg/S6onpIwoB9CfcAmRqhtGA=";
   };
 
-  cargoHash = "sha256-AUkBTHShtY3ZJ8pxCuW9baVuxb2QxzXxJQMgbuVTlPY=";
+  cargoHash = "sha256-rYTptEB+2Adlb1y7oXO+noqNylwiHBAb49ufZdPL9Qc=";
 
   meta = with lib; {
     description = "Per window keyboard layout (language) for Hyprland wayland compositor";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b70f26cdbe2..ed3b9a8c0e1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2527,7 +2527,9 @@ with pkgs;
 
   lab = callPackage ../applications/version-management/lab { };
 
-  labctl = callPackage ../tools/networking/labctl { };
+  labctl = callPackage ../tools/networking/labctl {
+    buildGoModule = buildGo120Module;
+  };
 
   lefthook = callPackage ../applications/version-management/lefthook { };
 
@@ -9882,7 +9884,9 @@ with pkgs;
 
   kdiff3 = libsForQt5.callPackage ../tools/text/kdiff3 { };
 
-  kube-router = callPackage ../applications/networking/cluster/kube-router { };
+  kube-router = callPackage ../applications/networking/cluster/kube-router {
+    buildGoModule = buildGo120Module;
+  };
 
   kubepug = callPackage ../development/tools/kubepug { };
 
@@ -11570,7 +11574,9 @@ with pkgs;
 
   onlykey = callPackage ../tools/security/onlykey { node_webkit = nwjs; };
 
-  ooniprobe-cli = callPackage ../tools/networking/ooniprobe-cli { };
+  ooniprobe-cli = callPackage ../tools/networking/ooniprobe-cli {
+    buildGoModule = buildGo120Module;
+  };
 
   openapi-generator-cli = callPackage ../tools/networking/openapi-generator-cli { jre = pkgs.jre_headless; };
   openapi-generator-cli-unstable = callPackage ../tools/networking/openapi-generator-cli/unstable.nix { jre = pkgs.jre_headless; };
@@ -15263,7 +15269,9 @@ with pkgs;
 
   zip = callPackage ../tools/archivers/zip { };
 
-  zincsearch = callPackage ../servers/search/zincsearch { };
+  zincsearch = callPackage ../servers/search/zincsearch {
+    buildGoModule = buildGo120Module;
+  };
 
   zkfuse = callPackage ../tools/filesystems/zkfuse { };
 
@@ -26251,7 +26259,7 @@ with pkgs;
   clamsmtp = callPackage ../servers/mail/clamsmtp { };
 
   clickhouse = callPackage ../servers/clickhouse {
-    llvmPackages = llvmPackages_15;
+    llvmPackages = llvmPackages_16;
   };
 
   clickhouse-cli = with python3Packages; toPythonApplication clickhouse-cli;
@@ -30468,6 +30476,16 @@ with pkgs;
 
   audacity = callPackage ../applications/audio/audacity {
     inherit (darwin.apple_sdk.frameworks) AppKit CoreAudioKit;
+    wxGTK32 = wxGTK32.overrideAttrs {
+      patches = [
+       (fetchpatch { # required to run audacity 3.3.3 on wxGTK 3.2.4, see PR #266945
+         url = "https://github.com/wxWidgets/wxWidgets/commit/425d9455e8307c1267a79d47d77e3dafeb4d86de.patch";
+         excludes = [ "docs/changes.txt" ];
+         revert = true;
+         hash = "sha256-6LOYLDLtVCHxNdHAWv3zhlCsljIpi//RJb9XVLGD5hM=";
+       })
+     ];
+    };
   };
 
   audio-recorder = callPackage ../applications/audio/audio-recorder { };
@@ -31404,7 +31422,9 @@ with pkgs;
 
   gigalixir = callPackage ../tools/misc/gigalixir { };
 
-  go-libp2p-daemon = callPackage ../servers/go-libp2p-daemon { };
+  go-libp2p-daemon = callPackage ../servers/go-libp2p-daemon {
+    buildGoModule = buildGo120Module;
+  };
 
   go-motion = callPackage ../development/tools/go-motion { };
 
@@ -33554,7 +33574,9 @@ with pkgs;
 
   markscribe = callPackage ../tools/text/markscribe { };
 
-  magnetico = callPackage ../applications/networking/p2p/magnetico { };
+  magnetico = callPackage ../applications/networking/p2p/magnetico {
+    buildGoModule = buildGo120Module;
+  };
 
   mastodon-bot = nodePackages.mastodon-bot;
 
@@ -34193,10 +34215,6 @@ with pkgs;
   roxctl = callPackage ../applications/networking/cluster/roxctl {
   };
 
-  rqbit = callPackage ../applications/networking/p2p/rqbit {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   rssguard = libsForQt5.callPackage ../applications/networking/feedreaders/rssguard { };
 
   scudcloud = callPackage ../applications/networking/instant-messengers/scudcloud { };
@@ -35748,6 +35766,8 @@ with pkgs;
 
   texture-synthesis = callPackage ../tools/graphics/texture-synthesis { };
 
+  texturepacker = qt6.callPackage ../applications/graphics/texturepacker { };
+
   tty-solitaire = callPackage ../applications/misc/tty-solitaire { };
 
   termtosvg = callPackage ../tools/misc/termtosvg { };
@@ -36424,7 +36444,9 @@ with pkgs;
 
   webssh = with python3Packages; toPythonApplication webssh;
 
-  webtorrent_desktop = callPackage ../applications/video/webtorrent_desktop { };
+  webtorrent_desktop = callPackage ../applications/video/webtorrent_desktop {
+    electron = electron_27;
+  };
 
   wrapWeechat = callPackage ../applications/networking/irc/weechat/wrapper.nix { };
 
@@ -37040,7 +37062,9 @@ with pkgs;
 
   dcrctl = callPackage ../applications/blockchains/dcrctl { };
   dcrd = callPackage ../applications/blockchains/dcrd { };
-  dcrwallet = callPackage ../applications/blockchains/dcrwallet { };
+  dcrwallet = callPackage ../applications/blockchains/dcrwallet {
+    buildGoModule = buildGo120Module;
+  };
 
   dogecoin  = libsForQt5.callPackage ../applications/blockchains/dogecoin {
     withGui = true;
@@ -37380,13 +37404,31 @@ with pkgs;
   rbdoom-3-bfg = callPackage ../games/doom-ports/rbdoom-3-bfg { };
 
   slade = callPackage ../games/doom-ports/slade {
-    wxGTK = wxGTK32.override {
+    wxGTK = (wxGTK32.overrideAttrs {
+      patches = [
+       (fetchpatch { # required to run slade 3.2.4 on wxGTK 3.2.4, see PR #266945
+         url = "https://github.com/wxWidgets/wxWidgets/commit/425d9455e8307c1267a79d47d77e3dafeb4d86de.patch";
+         excludes = [ "docs/changes.txt" ];
+         revert = true;
+         hash = "sha256-6LOYLDLtVCHxNdHAWv3zhlCsljIpi//RJb9XVLGD5hM=";
+       })
+     ];
+    }).override {
       withWebKit = true;
     };
   };
 
   sladeUnstable = callPackage ../games/doom-ports/slade/git.nix {
-    wxGTK = wxGTK32.override {
+    wxGTK = (wxGTK32.overrideAttrs {
+      patches = [
+       (fetchpatch { # required to run sladeUnstable unstable-2023-09-30 on wxGTK 3.2.4, see PR #266945
+         url = "https://github.com/wxWidgets/wxWidgets/commit/425d9455e8307c1267a79d47d77e3dafeb4d86de.patch";
+         excludes = [ "docs/changes.txt" ];
+         revert = true;
+         hash = "sha256-6LOYLDLtVCHxNdHAWv3zhlCsljIpi//RJb9XVLGD5hM=";
+       })
+     ];
+    }).override {
       withWebKit = true;
     };
   };
@@ -39754,6 +39796,8 @@ with pkgs;
     with3d = false;
   };
 
+  kicadAddons = recurseIntoAttrs (callPackage ../applications/science/electronics/kicad/addons {});
+
   librepcb = libsForQt5.callPackage ../applications/science/electronics/librepcb { };
 
   ngspice = libngspice.override {
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index a997b12325e..e0afcc773f0 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -387,6 +387,8 @@ in {
 
     lttng-modules = callPackage ../os-specific/linux/lttng-modules { };
 
+    mstflint_access = callPackage ../os-specific/linux/mstflint_access { };
+
     broadcom_sta = callPackage ../os-specific/linux/broadcom-sta { };
 
     tbs = callPackage ../os-specific/linux/tbs { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 635a8d71c2e..54e0d011e74 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1046,6 +1046,8 @@ let
 
     merlin-lib = callPackage ../development/tools/ocaml/merlin/lib.nix { };
 
+    metadata = callPackage ../development/ocaml-modules/metadata { };
+
     metrics = callPackage ../development/ocaml-modules/metrics { };
 
     metrics-influx = callPackage ../development/ocaml-modules/metrics/influx.nix { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 922e5a1b792..957f84a120b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3657,6 +3657,8 @@ self: super: with self; {
 
   et-xmlfile = callPackage ../development/python-modules/et-xmlfile { };
 
+  euclid3 = callPackage ../development/python-modules/euclid3 { };
+
   eufylife-ble-client = callPackage ../development/python-modules/eufylife-ble-client { };
 
   evaluate = callPackage ../development/python-modules/evaluate { };
@@ -8843,6 +8845,8 @@ self: super: with self; {
     inherit (pkgs) libpcap; # Avoid confusion with python package of the same name
   };
 
+  pcbnew-transition = callPackage ../development/python-modules/pcbnew-transition { };
+
   pcodedmp = callPackage ../development/python-modules/pcodedmp { };
 
   pcpp = callPackage ../development/python-modules/pcpp { };
@@ -9009,6 +9013,10 @@ self: super: with self; {
 
   psrpcore = callPackage ../development/python-modules/psrpcore { };
 
+  pybars3 = callPackage ../development/python-modules/pybars3 { };
+
+  pymeta3 = callPackage ../development/python-modules/pymeta3 { };
+
   pypemicro = callPackage ../development/python-modules/pypemicro { };
 
   pyprecice = callPackage ../development/python-modules/pyprecice { };
@@ -9112,6 +9120,8 @@ self: super: with self; {
 
   pixelmatch = callPackage ../development/python-modules/pixelmatch { };
 
+  pixel-ring = callPackage ../development/python-modules/pixel-ring { };
+
   pjsua2 = (toPythonModule (pkgs.pjsip.override {
     pythonSupport = true;
     python3 = self.python;