summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix30
-rw-r--r--nixos/doc/manual/release-notes/rl-2311.section.md7
-rw-r--r--nixos/lib/systemd-network-units.nix6
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/services/audio/slimserver.nix2
-rw-r--r--nixos/modules/services/misc/forgejo.md2
-rw-r--r--nixos/modules/services/misc/forgejo.nix11
-rw-r--r--nixos/modules/services/networking/mullvad-vpn.nix4
-rw-r--r--nixos/modules/services/networking/syncthing.nix4
-rw-r--r--nixos/modules/services/search/kibana.nix213
-rw-r--r--nixos/modules/services/web-apps/code-server.nix259
-rw-r--r--nixos/modules/services/web-apps/jitsi-meet.nix178
-rw-r--r--nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py2
-rw-r--r--nixos/modules/system/boot/networkd.nix38
-rw-r--r--nixos/modules/tasks/filesystems/bcachefs.nix41
-rw-r--r--nixos/modules/virtualisation/google-compute-image.nix5
-rw-r--r--nixos/tests/all-tests.nix2
-rw-r--r--nixos/tests/code-server.nix22
-rw-r--r--nixos/tests/elk.nix14
-rw-r--r--nixos/tests/installer.nix62
-rw-r--r--nixos/tests/slimserver.nix47
-rw-r--r--nixos/tests/systemd-boot.nix29
-rw-r--r--pkgs/applications/audio/ledfx/default.nix4
-rw-r--r--pkgs/applications/audio/squeezelite/default.nix6
-rw-r--r--pkgs/applications/blockchains/erigon/default.nix6
-rw-r--r--pkgs/applications/editors/emacs/make-emacs.nix2
-rw-r--r--pkgs/applications/editors/helix/default.nix11
-rw-r--r--pkgs/applications/editors/standardnotes/src.json10
-rw-r--r--pkgs/applications/editors/texstudio/default.nix3
-rw-r--r--pkgs/applications/editors/vim/plugins/overrides.nix4
-rw-r--r--pkgs/applications/emulators/firebird-emu/default.nix28
-rw-r--r--pkgs/applications/emulators/wine/base.nix11
-rw-r--r--pkgs/applications/emulators/wine/darwin-metal-compat-pre8.18.patch12
-rw-r--r--pkgs/applications/emulators/wine/darwin-metal-compat.patch13
-rw-r--r--pkgs/applications/emulators/wine/sources.nix18
-rw-r--r--pkgs/applications/graphics/gimp/default.nix4
-rw-r--r--pkgs/applications/misc/1password-gui/default.nix10
-rw-r--r--pkgs/applications/misc/1password/default.nix10
-rw-r--r--pkgs/applications/misc/blender/default.nix14
-rw-r--r--pkgs/applications/misc/blender/libdecor.patch34
-rw-r--r--pkgs/applications/misc/keepass-plugins/keepassrpc/default.nix11
-rw-r--r--pkgs/applications/misc/llpp/default.nix22
-rw-r--r--pkgs/applications/misc/ulauncher/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.nix16
-rw-r--r--pkgs/applications/networking/cluster/arkade/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/calico/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/cilium/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/cmctl/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kubernetes/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/default.nix28
-rw-r--r--pkgs/applications/networking/instant-messengers/session-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix8
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/tg_owt.nix8
-rw-r--r--pkgs/applications/networking/mailreaders/afew/default.nix46
-rw-r--r--pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/newsreaders/pan/default.nix4
-rw-r--r--pkgs/applications/networking/onionshare/default.nix4
-rw-r--r--pkgs/applications/office/timeular/default.nix4
-rw-r--r--pkgs/applications/radio/freedv/default.nix6
-rw-r--r--pkgs/applications/science/electronics/picoscope/sources.json78
-rw-r--r--pkgs/applications/science/math/eigenmath/default.nix6
-rw-r--r--pkgs/applications/terminal-emulators/rio/default.nix26
-rw-r--r--pkgs/applications/video/showmethekey/default.nix6
-rw-r--r--pkgs/applications/virtualization/containerd/default.nix4
-rw-r--r--pkgs/applications/virtualization/ecs-agent/default.nix4
-rw-r--r--pkgs/applications/virtualization/nixpacks/default.nix6
-rw-r--r--pkgs/applications/virtualization/singularity/packages.nix6
-rw-r--r--pkgs/applications/window-managers/cagebreak/default.nix8
-rw-r--r--pkgs/applications/window-managers/e16/default.nix4
-rw-r--r--pkgs/applications/window-managers/leftwm/default.nix27
-rw-r--r--pkgs/by-name/de/devdash/package.nix52
-rw-r--r--pkgs/by-name/dx/dxvk_1/package.nix16
-rw-r--r--pkgs/by-name/dx/dxvk_2/package.nix17
-rw-r--r--pkgs/by-name/ek/eksctl/package.nix4
-rw-r--r--pkgs/by-name/fr/free42/package.nix (renamed from pkgs/applications/misc/free42/default.nix)79
-rw-r--r--pkgs/by-name/ho/hof/package.nix40
-rw-r--r--pkgs/by-name/ni/nix-web/package.nix48
-rw-r--r--pkgs/by-name/of/offpunk/package.nix (renamed from pkgs/applications/networking/browsers/offpunk/default.nix)34
-rw-r--r--pkgs/by-name/op/openai-triton-llvm/package.nix127
-rw-r--r--pkgs/by-name/py/pyprland/package.nix4
-rw-r--r--pkgs/by-name/si/signaturepdf/package.nix58
-rw-r--r--pkgs/by-name/sw/sway-audio-idle-inhibit/package.nix39
-rw-r--r--pkgs/by-name/sw/sway-overfocus/package.nix30
-rw-r--r--pkgs/by-name/wo/wordlists/package.nix57
-rw-r--r--pkgs/data/misc/clash-geoip/default.nix4
-rw-r--r--pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix14
-rw-r--r--pkgs/desktops/plasma-5/discover.nix2
-rw-r--r--pkgs/development/compilers/elm/packages/node-composition.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/lldb/default.nix6
-rw-r--r--pkgs/development/interpreters/cel-go/default.nix12
-rw-r--r--pkgs/development/interpreters/cel-go/go-mod-tidy.patch52
-rw-r--r--pkgs/development/interpreters/expr/default.nix6
-rw-r--r--pkgs/development/libraries/ada/xmlada/default.nix4
-rw-r--r--pkgs/development/libraries/duckdb/default.nix4
-rw-r--r--pkgs/development/libraries/imgui/default.nix4
-rw-r--r--pkgs/development/libraries/libepc/default.nix37
-rw-r--r--pkgs/development/libraries/libepc/no-avahi-ui.patch36
-rw-r--r--pkgs/development/libraries/libspatialindex/default.nix1
-rw-r--r--pkgs/development/libraries/libusbsio/default.nix33
-rw-r--r--pkgs/development/libraries/oneDNN/default.nix4
-rw-r--r--pkgs/development/libraries/simdjson/default.nix4
-rw-r--r--pkgs/development/libraries/tracker-miners/default.nix5
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix4
-rw-r--r--pkgs/development/python-modules/appthreat-vulnerability-db/default.nix6
-rw-r--r--pkgs/development/python-modules/bbox/default.nix27
-rw-r--r--pkgs/development/python-modules/brian2/default.nix6
-rw-r--r--pkgs/development/python-modules/brian2/numpy1.24.patch18
-rw-r--r--pkgs/development/python-modules/django-hijack/default.nix10
-rw-r--r--pkgs/development/python-modules/echo/default.nix63
-rw-r--r--pkgs/development/python-modules/fast-histogram/default.nix54
-rw-r--r--pkgs/development/python-modules/glueviz/default.nix87
-rw-r--r--pkgs/development/python-modules/google-cloud-org-policy/default.nix4
-rw-r--r--pkgs/development/python-modules/hcloud/default.nix4
-rw-r--r--pkgs/development/python-modules/lightning-utilities/default.nix4
-rw-r--r--pkgs/development/python-modules/linknlink/default.nix45
-rw-r--r--pkgs/development/python-modules/md-toc/default.nix4
-rw-r--r--pkgs/development/python-modules/meraki/default.nix4
-rw-r--r--pkgs/development/python-modules/mitmproxy-macos/default.nix33
-rw-r--r--pkgs/development/python-modules/mitmproxy-rs/default.nix6
-rw-r--r--pkgs/development/python-modules/mitmproxy/default.nix4
-rw-r--r--pkgs/development/python-modules/mopeka-iot-ble/default.nix16
-rw-r--r--pkgs/development/python-modules/mpl-scatter-density/default.nix67
-rw-r--r--pkgs/development/python-modules/msprime/default.nix11
-rw-r--r--pkgs/development/python-modules/oca-port/default.nix4
-rw-r--r--pkgs/development/python-modules/oslo-log/default.nix4
-rw-r--r--pkgs/development/python-modules/plaid-python/default.nix4
-rw-r--r--pkgs/development/python-modules/plugwise/default.nix4
-rw-r--r--pkgs/development/python-modules/pvextractor/default.nix61
-rw-r--r--pkgs/development/python-modules/pygobject-stubs/default.nix18
-rw-r--r--pkgs/development/python-modules/pyinsteon/default.nix4
-rw-r--r--pkgs/development/python-modules/python-ldap/default.nix32
-rw-r--r--pkgs/development/python-modules/pyudev/default.nix19
-rw-r--r--pkgs/development/python-modules/pyvmomi/default.nix13
-rw-r--r--pkgs/development/python-modules/ring-doorbell/default.nix4
-rw-r--r--pkgs/development/python-modules/siobrultech-protocols/default.nix4
-rw-r--r--pkgs/development/python-modules/stripe/default.nix15
-rw-r--r--pkgs/development/python-modules/succulent/default.nix6
-rw-r--r--pkgs/development/python-modules/syrupy/default.nix4
-rw-r--r--pkgs/development/python-modules/testrail-api/default.nix27
-rw-r--r--pkgs/development/python-modules/torch/default.nix12
-rw-r--r--pkgs/development/python-modules/total-connect-client/default.nix4
-rw-r--r--pkgs/development/python-modules/wakeonlan/default.nix10
-rw-r--r--pkgs/development/python-modules/xlsxwriter/default.nix5
-rw-r--r--pkgs/development/python-modules/xnd/default.nix12
-rw-r--r--pkgs/development/python-modules/ytmusicapi/default.nix4
-rw-r--r--pkgs/development/tools/api-linter/default.nix8
-rw-r--r--pkgs/development/tools/bazelisk/default.nix6
-rw-r--r--pkgs/development/tools/buildah/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/github-runner/default.nix7
-rw-r--r--pkgs/development/tools/continuous-integration/gitlab-runner/default.nix6
-rw-r--r--pkgs/development/tools/darklua/default.nix6
-rw-r--r--pkgs/development/tools/database/sqlcmd/default.nix6
-rw-r--r--pkgs/development/tools/fsautocomplete/default.nix4
-rw-r--r--pkgs/development/tools/fsautocomplete/deps.nix50
-rw-r--r--pkgs/development/tools/kafkactl/default.nix6
-rw-r--r--pkgs/development/tools/kubepug/default.nix14
-rw-r--r--pkgs/development/tools/kubepug/skip-external-network-tests.patch12
-rw-r--r--pkgs/development/tools/misc/kibana/7.x.nix60
-rw-r--r--pkgs/development/tools/misc/kibana/disable-nodejs-version-check-7.patch19
-rw-r--r--pkgs/development/tools/misc/uncrustify/default.nix4
-rw-r--r--pkgs/development/tools/rust/cargo-llvm-cov/default.nix8
-rw-r--r--pkgs/development/tools/rust/cargo-show-asm/default.nix6
-rw-r--r--pkgs/development/tools/rust/cargo-zigbuild/default.nix6
-rw-r--r--pkgs/development/tools/unityhub/default.nix4
-rw-r--r--pkgs/development/web/deno/default.nix9
-rw-r--r--pkgs/development/web/nodejs/v14.nix26
-rw-r--r--pkgs/development/web/nodejs/v16.nix35
-rw-r--r--pkgs/development/web/playwright-test/default.nix2
-rw-r--r--pkgs/games/itch/default.nix19
-rw-r--r--pkgs/misc/cups/drivers/brother/dcp375cw/default.nix97
-rw-r--r--pkgs/misc/cups/drivers/brother/mfc465cncupswrapper/default.nix82
-rw-r--r--pkgs/misc/cups/drivers/brother/mfc465cnlpr/default.nix67
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix1
-rw-r--r--pkgs/os-specific/darwin/sketchybar/default.nix4
-rw-r--r--pkgs/os-specific/darwin/skhd/default.nix2
-rw-r--r--pkgs/os-specific/linux/checksec/0002-don-t-sanatize-the-environment.patch25
-rw-r--r--pkgs/os-specific/linux/checksec/default.nix62
-rw-r--r--pkgs/servers/code-server/build-vscode-nogit.patch20
-rw-r--r--pkgs/servers/code-server/default.nix327
-rw-r--r--pkgs/servers/code-server/playwright.patch10
-rw-r--r--pkgs/servers/code-server/remove-node-download.patch28
-rw-r--r--pkgs/servers/jitsi-excalidraw/default.nix40
-rw-r--r--pkgs/servers/mail/mailpit/default.nix6
-rw-r--r--pkgs/servers/mautrix-whatsapp/default.nix6
-rw-r--r--pkgs/servers/monitoring/uptime-kuma/default.nix6
-rw-r--r--pkgs/servers/mx-puppet-discord/node-composition.nix2
-rw-r--r--pkgs/servers/nextcloud/packages/26.json78
-rw-r--r--pkgs/servers/nextcloud/packages/27.json78
-rw-r--r--pkgs/servers/nextcloud/packages/nextcloud-apps.json2
-rw-r--r--pkgs/servers/slimserver/default.nix112
-rw-r--r--pkgs/servers/sql/dolt/default.nix6
-rw-r--r--pkgs/servers/unifi/default.nix5
-rw-r--r--pkgs/shells/fish/plugins/done.nix10
-rw-r--r--pkgs/shells/fish/plugins/github-copilot-cli-fish.nix4
-rw-r--r--pkgs/shells/zsh/zsh-prezto/default.nix6
-rw-r--r--pkgs/tools/X11/srandrd/default.nix4
-rw-r--r--pkgs/tools/admin/exoscale-cli/default.nix4
-rw-r--r--pkgs/tools/filesystems/bcachefs-tools/default.nix42
-rw-r--r--pkgs/tools/graphics/lsix/default.nix4
-rw-r--r--pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch17
-rw-r--r--pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch26
-rw-r--r--pkgs/tools/graphics/zbar/default.nix6
-rw-r--r--pkgs/tools/misc/entr/default.nix4
-rw-r--r--pkgs/tools/misc/fend/default.nix6
-rw-r--r--pkgs/tools/misc/fzf/default.nix4
-rw-r--r--pkgs/tools/misc/gh-actions-cache/default.nix5
-rw-r--r--pkgs/tools/misc/rlwrap/default.nix2
-rw-r--r--pkgs/tools/misc/vtm/default.nix4
-rw-r--r--pkgs/tools/misc/wasm-tools/default.nix6
-rw-r--r--pkgs/tools/package-management/dpkg/default.nix4
-rw-r--r--pkgs/tools/security/cmospwd/default.nix2
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/ghidra/0001-Use-protobuf-gradle-plugin.patch227
-rw-r--r--pkgs/tools/security/ghidra/build.nix39
-rw-r--r--pkgs/tools/security/gitleaks/default.nix6
-rw-r--r--pkgs/tools/security/metasploit/Gemfile2
-rw-r--r--pkgs/tools/security/metasploit/Gemfile.lock6
-rw-r--r--pkgs/tools/security/metasploit/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/gemset.nix6
-rw-r--r--pkgs/tools/security/nitrokey-app2/default.nix6
-rw-r--r--pkgs/tools/system/automatic-timezoned/default.nix6
-rw-r--r--pkgs/tools/system/nsc/default.nix8
-rw-r--r--pkgs/tools/system/zps/default.nix4
-rw-r--r--pkgs/tools/system/zram-generator/Cargo.lock28
-rw-r--r--pkgs/tools/text/difftastic/default.nix6
-rw-r--r--pkgs/tools/text/invoice2data/default.nix5
-rw-r--r--pkgs/tools/text/vale/default.nix6
-rw-r--r--pkgs/tools/virtualization/govc/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix7
-rw-r--r--pkgs/top-level/all-packages.nix47
-rw-r--r--pkgs/top-level/linux-kernels.nix2
-rw-r--r--pkgs/top-level/perl-packages.nix93
-rw-r--r--pkgs/top-level/python-packages.nix14
233 files changed, 3077 insertions, 2136 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index da13f66838c..21e902171bb 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2477,6 +2477,12 @@
     githubId = 50839;
     name = "Brian Jones";
   };
+  boltzmannrain = {
+    email = "boltzmannrain@gmail.com";
+    github = "boltzmannrain";
+    githubId = 150560585;
+    name = "Dmitry Ivankov";
+  };
   booklearner = {
     name = "booklearner";
     email = "booklearner@proton.me";
@@ -7793,6 +7799,12 @@
     githubId = 4458;
     name = "Ivan Kozik";
   };
+  ivan770 = {
+    email = "ivan@ivan770.me";
+    github = "ivan770";
+    githubId = 14003886;
+    name = "Ivan Leshchenko";
+  };
   ivan-babrou = {
     email = "nixpkgs@ivan.computer";
     name = "Ivan Babrou";
@@ -10968,6 +10980,12 @@
     githubId = 1651325;
     name = "maralorn";
   };
+  marcovergueira = {
+    email = "vergueira.marco@gmail.com";
+    github = "marcovergueira";
+    githubId = 929114;
+    name = "Marco Vergueira";
+  };
   marcus7070 = {
     email = "marcus@geosol.com.au";
     github = "marcus7070";
@@ -14041,6 +14059,12 @@
     githubId = 301903;
     name = "Chip Collier";
   };
+  phrogg = {
+    name = "Phil Roggenbuck";
+    email = "nixpkgs@phrogg.de";
+    github = "phrogg";
+    githubId = 1367949;
+  };
   phryneas = {
     email = "mail@lenzw.de";
     github = "phryneas";
@@ -14810,6 +14834,12 @@
     githubId = 1016742;
     name = "Rafael García";
   };
+  rafaelrc = {
+    email = "contact@rafaelrc.com";
+    name = "Rafael Carvalho";
+    github = "rafaelrc7";
+    githubId = 5376043;
+  };
   ragge = {
     email = "r.dahlen@gmail.com";
     github = "ragnard";
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index e5e4e713ae2..e2853569423 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -30,6 +30,9 @@
 
 [`sudo-rs`]: https://github.com/memorysafety/sudo-rs/
 
+- `linuxPackages_testing_bcachefs` is now soft-deprecated by `linuxPackages_testing`.
+  - Please consider changing your NixOS configuration's `boot.kernelPackages` to `linuxPackages_testing` until a stable kernel with bcachefs support is released.
+
 - All [ROCm](https://rocm.docs.amd.com/en/latest/) packages have been updated to 5.7.0.
   - [ROCm](https://rocm.docs.amd.com/en/latest/) package attribute sets are versioned: `rocmPackages` -> `rocmPackages_5`.
 
@@ -550,6 +553,10 @@ The module update takes care of the new config syntax and the data itself (user
 
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
 
+- Node.js v14, v16 has been removed as they were end of life. Any dependent packages that contributors were not able to reasonably upgrade were dropped after a month of notice to their maintainers, were **removed**.
+  - This includes VSCode Server.
+  - This includes Kibana 7 as the ELK stack is unmaintained in nixpkgs and is marked for slow removal.
+
 - The use of `sourceRoot = "source";`, `sourceRoot = "source/subdir";`, and similar lines in package derivations using the default `unpackPhase` is deprecated as it requires `unpackPhase` to always produce a directory named "source". Use `sourceRoot = src.name`, `sourceRoot = "${src.name}/subdir";`, or `setSourceRoot = "sourceRoot=$(echo */subdir)";` or similar instead.
 
 - The `django` alias in the python package set was upgraded to Django 4.x.
diff --git a/nixos/lib/systemd-network-units.nix b/nixos/lib/systemd-network-units.nix
index 8bda1a8bfdc..1d5f823f367 100644
--- a/nixos/lib/systemd-network-units.nix
+++ b/nixos/lib/systemd-network-units.nix
@@ -23,6 +23,12 @@ in {
     '' + optionalString (def.vlanConfig != { }) ''
       [VLAN]
       ${attrsToSection def.vlanConfig}
+    '' + optionalString (def.ipvlanConfig != { }) ''
+      [IPVLAN]
+      ${attrsToSection def.ipvlanConfig}
+    '' + optionalString (def.ipvtapConfig != { }) ''
+      [IPVTAP]
+      ${attrsToSection def.ipvtapConfig}
     '' + optionalString (def.macvlanConfig != { }) ''
       [MACVLAN]
       ${attrsToSection def.macvlanConfig}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 00da6399295..d02c5b593b3 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1147,7 +1147,6 @@
   ./services/search/elasticsearch-curator.nix
   ./services/search/elasticsearch.nix
   ./services/search/hound.nix
-  ./services/search/kibana.nix
   ./services/search/meilisearch.nix
   ./services/search/opensearch.nix
   ./services/search/qdrant.nix
@@ -1241,7 +1240,6 @@
   ./services/web-apps/changedetection-io.nix
   ./services/web-apps/chatgpt-retrieval-plugin.nix
   ./services/web-apps/cloudlog.nix
-  ./services/web-apps/code-server.nix
   ./services/web-apps/convos.nix
   ./services/web-apps/dex.nix
   ./services/web-apps/discourse.nix
diff --git a/nixos/modules/services/audio/slimserver.nix b/nixos/modules/services/audio/slimserver.nix
index 9fbc68b7136..cdd9d551c50 100644
--- a/nixos/modules/services/audio/slimserver.nix
+++ b/nixos/modules/services/audio/slimserver.nix
@@ -54,7 +54,7 @@ in {
       serviceConfig = {
         User = "slimserver";
         # Issue 40589: Disable broken image/video support (audio still works!)
-        ExecStart = "${cfg.package}/slimserver.pl --logdir ${cfg.dataDir}/logs --prefsdir ${cfg.dataDir}/prefs --cachedir ${cfg.dataDir}/cache --noimage --novideo";
+        ExecStart = "${lib.getExe cfg.package} --logdir ${cfg.dataDir}/logs --prefsdir ${cfg.dataDir}/prefs --cachedir ${cfg.dataDir}/cache --noimage --novideo";
       };
     };
 
diff --git a/nixos/modules/services/misc/forgejo.md b/nixos/modules/services/misc/forgejo.md
index 6a340738208..3df8bc20976 100644
--- a/nixos/modules/services/misc/forgejo.md
+++ b/nixos/modules/services/misc/forgejo.md
@@ -68,7 +68,7 @@ services.forgejo = {
   database.user = "gitea";
 };
 
-users.users,gitea = {
+users.users.gitea = {
   home = "/var/lib/gitea";
   useDefaultShell = true;
   group = "gitea";
diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix
index 15966adfe38..454febda589 100644
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@@ -436,17 +436,6 @@ in
       ];
     };
 
-    # Work around 'pq: permission denied for schema public' with postgres v15, until a
-    # solution for `services.postgresql.ensureUsers` is found.
-    # See https://github.com/NixOS/nixpkgs/issues/216989
-    systemd.services.postgresql.postStart = lib.mkIf (
-      usePostgresql
-      && cfg.database.createDatabase
-      && lib.strings.versionAtLeast config.services.postgresql.package.version "15.0"
-    ) (lib.mkAfter ''
-      $PSQL -tAc 'ALTER DATABASE "${cfg.database.name}" OWNER TO "${cfg.database.user}";'
-    '');
-
     services.mysql = optionalAttrs (useMysql && cfg.database.createDatabase) {
       enable = mkDefault true;
       package = mkDefault pkgs.mariadb;
diff --git a/nixos/modules/services/networking/mullvad-vpn.nix b/nixos/modules/services/networking/mullvad-vpn.nix
index 99ffbf56ccb..8c7d5237971 100644
--- a/nixos/modules/services/networking/mullvad-vpn.nix
+++ b/nixos/modules/services/networking/mullvad-vpn.nix
@@ -65,7 +65,9 @@ with lib;
         pkgs.iproute2
         # Needed for ping
         "/run/wrappers"
-      ];
+        # See https://github.com/NixOS/nixpkgs/issues/262681
+      ] ++ (lib.optional config.networking.resolvconf.enable
+        config.networking.resolvconf.package);
       startLimitBurst = 5;
       startLimitIntervalSec = 20;
       serviceConfig = {
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index bdcdaf056d0..6d9af6141f1 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -666,7 +666,9 @@ in {
             ${cfg.package}/bin/syncthing \
               -no-browser \
               -gui-address=${if isUnixGui then "unix://" else ""}${cfg.guiAddress} \
-              -home=${cfg.configDir} ${escapeShellArgs cfg.extraFlags}
+              -config=${cfg.configDir} \
+              -data=${cfg.dataDir} \
+              ${escapeShellArgs cfg.extraFlags}
           '';
           MemoryDenyWriteExecute = true;
           NoNewPrivileges = true;
diff --git a/nixos/modules/services/search/kibana.nix b/nixos/modules/services/search/kibana.nix
deleted file mode 100644
index a5e132d5c38..00000000000
--- a/nixos/modules/services/search/kibana.nix
+++ /dev/null
@@ -1,213 +0,0 @@
-{ config, lib, options, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.kibana;
-  opt = options.services.kibana;
-
-  ge7 = builtins.compareVersions cfg.package.version "7" >= 0;
-  lt6_6 = builtins.compareVersions cfg.package.version "6.6" < 0;
-
-  cfgFile = pkgs.writeText "kibana.json" (builtins.toJSON (
-    (filterAttrsRecursive (n: v: v != null && v != []) ({
-      server.host = cfg.listenAddress;
-      server.port = cfg.port;
-      server.ssl.certificate = cfg.cert;
-      server.ssl.key = cfg.key;
-
-      kibana.index = cfg.index;
-      kibana.defaultAppId = cfg.defaultAppId;
-
-      elasticsearch.url = cfg.elasticsearch.url;
-      elasticsearch.hosts = cfg.elasticsearch.hosts;
-      elasticsearch.username = cfg.elasticsearch.username;
-      elasticsearch.password = cfg.elasticsearch.password;
-
-      elasticsearch.ssl.certificate = cfg.elasticsearch.cert;
-      elasticsearch.ssl.key = cfg.elasticsearch.key;
-      elasticsearch.ssl.certificateAuthorities = cfg.elasticsearch.certificateAuthorities;
-    } // cfg.extraConf)
-  )));
-
-in {
-  options.services.kibana = {
-    enable = mkEnableOption (lib.mdDoc "kibana service");
-
-    listenAddress = mkOption {
-      description = lib.mdDoc "Kibana listening host";
-      default = "127.0.0.1";
-      type = types.str;
-    };
-
-    port = mkOption {
-      description = lib.mdDoc "Kibana listening port";
-      default = 5601;
-      type = types.port;
-    };
-
-    cert = mkOption {
-      description = lib.mdDoc "Kibana ssl certificate.";
-      default = null;
-      type = types.nullOr types.path;
-    };
-
-    key = mkOption {
-      description = lib.mdDoc "Kibana ssl key.";
-      default = null;
-      type = types.nullOr types.path;
-    };
-
-    index = mkOption {
-      description = lib.mdDoc "Elasticsearch index to use for saving kibana config.";
-      default = ".kibana";
-      type = types.str;
-    };
-
-    defaultAppId = mkOption {
-      description = lib.mdDoc "Elasticsearch default application id.";
-      default = "discover";
-      type = types.str;
-    };
-
-    elasticsearch = {
-      url = mkOption {
-        description = lib.mdDoc ''
-          Elasticsearch url.
-
-          Defaults to `"http://localhost:9200"`.
-
-          Don't set this when using Kibana >= 7.0.0 because it will result in a
-          configuration error. Use {option}`services.kibana.elasticsearch.hosts`
-          instead.
-        '';
-        default = null;
-        type = types.nullOr types.str;
-      };
-
-      hosts = mkOption {
-        description = lib.mdDoc ''
-          The URLs of the Elasticsearch instances to use for all your queries.
-          All nodes listed here must be on the same cluster.
-
-          Defaults to `[ "http://localhost:9200" ]`.
-
-          This option is only valid when using kibana >= 6.6.
-        '';
-        default = null;
-        type = types.nullOr (types.listOf types.str);
-      };
-
-      username = mkOption {
-        description = lib.mdDoc "Username for elasticsearch basic auth.";
-        default = null;
-        type = types.nullOr types.str;
-      };
-
-      password = mkOption {
-        description = lib.mdDoc "Password for elasticsearch basic auth.";
-        default = null;
-        type = types.nullOr types.str;
-      };
-
-      ca = mkOption {
-        description = lib.mdDoc ''
-          CA file to auth against elasticsearch.
-
-          It's recommended to use the {option}`certificateAuthorities` option
-          when using kibana-5.4 or newer.
-        '';
-        default = null;
-        type = types.nullOr types.path;
-      };
-
-      certificateAuthorities = mkOption {
-        description = lib.mdDoc ''
-          CA files to auth against elasticsearch.
-
-          Please use the {option}`ca` option when using kibana \< 5.4
-          because those old versions don't support setting multiple CA's.
-
-          This defaults to the singleton list [ca] when the {option}`ca` option is defined.
-        '';
-        default = lib.optional (cfg.elasticsearch.ca != null) ca;
-        defaultText = literalExpression ''
-          lib.optional (config.${opt.elasticsearch.ca} != null) ca
-        '';
-        type = types.listOf types.path;
-      };
-
-      cert = mkOption {
-        description = lib.mdDoc "Certificate file to auth against elasticsearch.";
-        default = null;
-        type = types.nullOr types.path;
-      };
-
-      key = mkOption {
-        description = lib.mdDoc "Key file to auth against elasticsearch.";
-        default = null;
-        type = types.nullOr types.path;
-      };
-    };
-
-    package = mkOption {
-      description = lib.mdDoc "Kibana package to use";
-      default = pkgs.kibana;
-      defaultText = literalExpression "pkgs.kibana";
-      type = types.package;
-    };
-
-    dataDir = mkOption {
-      description = lib.mdDoc "Kibana data directory";
-      default = "/var/lib/kibana";
-      type = types.path;
-    };
-
-    extraConf = mkOption {
-      description = lib.mdDoc "Kibana extra configuration";
-      default = {};
-      type = types.attrs;
-    };
-  };
-
-  config = mkIf (cfg.enable) {
-    assertions = [
-      {
-        assertion = ge7 -> cfg.elasticsearch.url == null;
-        message =
-          "The option services.kibana.elasticsearch.url has been removed when using kibana >= 7.0.0. " +
-          "Please use option services.kibana.elasticsearch.hosts instead.";
-      }
-      {
-        assertion = lt6_6 -> cfg.elasticsearch.hosts == null;
-        message =
-          "The option services.kibana.elasticsearch.hosts is only valid for kibana >= 6.6.";
-      }
-    ];
-    systemd.services.kibana = {
-      description = "Kibana Service";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" "elasticsearch.service" ];
-      environment = { BABEL_CACHE_PATH = "${cfg.dataDir}/.babelcache.json"; };
-      serviceConfig = {
-        ExecStart =
-          "${cfg.package}/bin/kibana" +
-          " --config ${cfgFile}" +
-          " --path.data ${cfg.dataDir}";
-        User = "kibana";
-        WorkingDirectory = cfg.dataDir;
-      };
-    };
-
-    environment.systemPackages = [ cfg.package ];
-
-    users.users.kibana = {
-      isSystemUser = true;
-      description = "Kibana service user";
-      home = cfg.dataDir;
-      createHome = true;
-      group = "kibana";
-    };
-    users.groups.kibana = {};
-  };
-}
diff --git a/nixos/modules/services/web-apps/code-server.nix b/nixos/modules/services/web-apps/code-server.nix
deleted file mode 100644
index 11601f6c304..00000000000
--- a/nixos/modules/services/web-apps/code-server.nix
+++ /dev/null
@@ -1,259 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.services.code-server;
-  defaultUser = "code-server";
-  defaultGroup = defaultUser;
-in {
-  options = {
-    services.code-server = {
-      enable = lib.mkEnableOption (lib.mdDoc "code-server");
-
-      package = lib.mkPackageOptionMD pkgs "code-server" {
-        example = ''
-          pkgs.vscode-with-extensions.override {
-            vscode = pkgs.code-server;
-            vscodeExtensions = with pkgs.vscode-extensions; [
-              bbenoist.nix
-              dracula-theme.theme-dracula
-            ];
-          }
-        '';
-      };
-
-      extraPackages = lib.mkOption {
-        default = [ ];
-        description = lib.mdDoc ''
-          Additional packages to add to the code-server {env}`PATH`.
-        '';
-        example = lib.literalExpression "[ pkgs.go ]";
-        type = lib.types.listOf lib.types.package;
-      };
-
-      extraEnvironment = lib.mkOption {
-        type = lib.types.attrsOf lib.types.str;
-        description = lib.mdDoc ''
-          Additional environment variables to pass to code-server.
-        '';
-        default = { };
-        example = { PKG_CONFIG_PATH = "/run/current-system/sw/lib/pkgconfig"; };
-      };
-
-      extraArguments = lib.mkOption {
-        default = [ ];
-        description = lib.mdDoc ''
-          Additional arguments to pass to code-server.
-        '';
-        example = lib.literalExpression ''[ "--log=info" ]'';
-        type = lib.types.listOf lib.types.str;
-      };
-
-      host = lib.mkOption {
-        default = "localhost";
-        description = lib.mdDoc ''
-          The host name or IP address the server should listen to.
-        '';
-        type = lib.types.str;
-      };
-
-      port = lib.mkOption {
-        default = 4444;
-        description = lib.mdDoc ''
-          The port the server should listen to.
-        '';
-        type = lib.types.port;
-      };
-
-      auth = lib.mkOption {
-        default = "password";
-        description = lib.mdDoc ''
-          The type of authentication to use.
-        '';
-        type = lib.types.enum [ "none" "password" ];
-      };
-
-      hashedPassword = lib.mkOption {
-        default = "";
-        description = lib.mdDoc ''
-          Create the password with: `echo -n 'thisismypassword' | npx argon2-cli -e`.
-        '';
-        type = lib.types.str;
-      };
-
-      user = lib.mkOption {
-        default = defaultUser;
-        example = "yourUser";
-        description = lib.mdDoc ''
-          The user to run code-server as.
-          By default, a user named `${defaultUser}` will be created.
-        '';
-        type = lib.types.str;
-      };
-
-      group = lib.mkOption {
-        default = defaultGroup;
-        example = "yourGroup";
-        description = lib.mdDoc ''
-          The group to run code-server under.
-          By default, a group named `${defaultGroup}` will be created.
-        '';
-        type = lib.types.str;
-      };
-
-      extraGroups = lib.mkOption {
-        default = [ ];
-        description = lib.mdDoc ''
-          An array of additional groups for the `${defaultUser}` user.
-        '';
-        example = [ "docker" ];
-        type = lib.types.listOf lib.types.str;
-      };
-
-      socket = lib.mkOption {
-        default = null;
-        example = "/run/code-server/socket";
-        description = lib.mdDoc ''
-          Path to a socket (bind-addr will be ignored).
-        '';
-        type = lib.types.nullOr lib.types.str;
-      };
-
-      socketMode = lib.mkOption {
-        default = null;
-        description = lib.mdDoc ''
-           File mode of the socket.
-        '';
-        type = lib.types.nullOr lib.types.str;
-      };
-
-      userDataDir = lib.mkOption {
-        default = null;
-        description = lib.mdDoc ''
-          Path to the user data directory.
-        '';
-        type = lib.types.nullOr lib.types.str;
-      };
-
-      extensionsDir = lib.mkOption {
-        default = null;
-        description = lib.mdDoc ''
-          Path to the extensions directory.
-        '';
-        type = lib.types.nullOr lib.types.str;
-      };
-
-      proxyDomain = lib.mkOption {
-        default = null;
-        example = "code-server.lan";
-        description = lib.mdDoc ''
-          Domain used for proxying ports.
-        '';
-        type = lib.types.nullOr lib.types.str;
-      };
-
-      disableTelemetry = lib.mkOption {
-        default = false;
-        example = true;
-        description = lib.mdDoc ''
-          Disable telemetry.
-        '';
-        type = lib.types.bool;
-      };
-
-      disableUpdateCheck = lib.mkOption {
-        default = false;
-        example = true;
-        description = lib.mdDoc ''
-          Disable update check.
-          Without this flag, code-server checks every 6 hours against the latest github release and
-          then notifies you once every week that a new release is available.
-        '';
-        type = lib.types.bool;
-      };
-
-      disableFileDownloads = lib.mkOption {
-        default = false;
-        example = true;
-        description = lib.mdDoc ''
-          Disable file downloads from Code.
-        '';
-        type = lib.types.bool;
-      };
-
-      disableWorkspaceTrust = lib.mkOption {
-        default = false;
-        example = true;
-        description = lib.mdDoc ''
-          Disable Workspace Trust feature.
-        '';
-        type = lib.types.bool;
-      };
-
-      disableGettingStartedOverride = lib.mkOption {
-        default = false;
-        example = true;
-        description = lib.mdDoc ''
-          Disable the coder/coder override in the Help: Getting Started page.
-        '';
-        type = lib.types.bool;
-      };
-
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.code-server = {
-      description = "Code server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network-online.target" ];
-      path = cfg.extraPackages;
-      environment = {
-        HASHED_PASSWORD = cfg.hashedPassword;
-      } // cfg.extraEnvironment;
-      serviceConfig = {
-        ExecStart = ''
-          ${lib.getExe cfg.package} \
-            --auth=${cfg.auth} \
-            --bind-addr=${cfg.host}:${toString cfg.port} \
-          '' + lib.optionalString (cfg.socket != null) ''
-            --socket=${cfg.socket} \
-          '' + lib.optionalString (cfg.userDataDir != null) ''
-            --user-data-dir=${cfg.userDataDir} \
-          '' + lib.optionalString (cfg.extensionsDir != null) ''
-            --extensions-dir=${cfg.extensionsDir} \
-          '' + lib.optionalString (cfg.disableTelemetry == true) ''
-            --disable-telemetry \
-          '' + lib.optionalString (cfg.disableUpdateCheck == true) ''
-            --disable-update-check \
-          '' + lib.optionalString (cfg.disableFileDownloads == true) ''
-            --disable-file-downloads \
-          '' + lib.optionalString (cfg.disableWorkspaceTrust == true) ''
-            --disable-workspace-trust \
-          '' + lib.optionalString (cfg.disableGettingStartedOverride == true) ''
-            --disable-getting-started-override \
-          '' + lib.escapeShellArgs cfg.extraArguments;
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-        RuntimeDirectory = cfg.user;
-        User = cfg.user;
-        Group = cfg.group;
-        Restart = "on-failure";
-      };
-    };
-
-    users.users."${cfg.user}" = lib.mkMerge [
-      (lib.mkIf (cfg.user == defaultUser) {
-        isNormalUser = true;
-        description = "code-server user";
-        inherit (cfg) group;
-      })
-      {
-        packages = cfg.extraPackages;
-        inherit (cfg) extraGroups;
-      }
-    ];
-
-    users.groups."${defaultGroup}" = lib.mkIf (cfg.group == defaultGroup) { };
-  };
-
-  meta.maintainers = [ lib.maintainers.stackshadow ];
-}
diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix
index 21416be3587..c0f9d785eea 100644
--- a/nixos/modules/services/web-apps/jitsi-meet.nix
+++ b/nixos/modules/services/web-apps/jitsi-meet.nix
@@ -169,6 +169,15 @@ in
         off if you want to configure it manually.
       '';
     };
+
+    excalidraw.enable = mkEnableOption (lib.mdDoc "Excalidraw collaboration backend for Jitsi");
+    excalidraw.port = mkOption {
+      type = types.port;
+      default = 3002;
+      description = lib.mdDoc ''The port which the Excalidraw backend for Jitsi should listen to.'';
+    };
+
+    secureDomain.enable = mkEnableOption (lib.mdDoc "Authenticated room creation");
   };
 
   config = mkIf cfg.enable {
@@ -192,41 +201,118 @@ in
           roomLocking = false;
           roomDefaultPublicJids = true;
           extraConfig = ''
+            restrict_room_creation = true
+            storage = "memory"
+            admins = { "focus@auth.${cfg.hostName}" }
+          '';
+        }
+        {
+          domain = "breakout.${cfg.hostName}";
+          name = "Jitsi Meet Breakout MUC";
+          roomLocking = false;
+          roomDefaultPublicJids = true;
+          extraConfig = ''
+            restrict_room_creation = true
             storage = "memory"
+            admins = { "focus@auth.${cfg.hostName}" }
           '';
         }
         {
-          domain = "internal.${cfg.hostName}";
+          domain = "internal.auth.${cfg.hostName}";
           name = "Jitsi Meet Videobridge MUC";
+          roomLocking = false;
+          roomDefaultPublicJids = true;
           extraConfig = ''
             storage = "memory"
             admins = { "focus@auth.${cfg.hostName}", "jvb@auth.${cfg.hostName}" }
           '';
           #-- muc_room_cache_size = 1000
         }
+        {
+          domain = "lobby.${cfg.hostName}";
+          name = "Jitsi Meet Lobby MUC";
+          roomLocking = false;
+          roomDefaultPublicJids = true;
+          extraConfig = ''
+            restrict_room_creation = true
+            storage = "memory"
+          '';
+        }
+      ];
+      extraModules = [
+        "pubsub"
+        "smacks"
+        "speakerstats"
+        "external_services"
+        "conference_duration"
+        "end_conference"
+        "muc_lobby_rooms"
+        "muc_breakout_rooms"
+        "av_moderation"
+        "muc_hide_all"
+        "muc_meeting_id"
+        "muc_domain_mapper"
+        "muc_rate_limit"
+        "limits_exception"
+        "persistent_lobby"
+        "room_metadata"
       ];
-      extraModules = [ "pubsub" "smacks" ];
       extraPluginPaths = [ "${pkgs.jitsi-meet-prosody}/share/prosody-plugins" ];
-      extraConfig = lib.mkMerge [ (mkAfter ''
-        Component "focus.${cfg.hostName}" "client_proxy"
-          target_address = "focus@auth.${cfg.hostName}"
+      extraConfig = lib.mkMerge [
+        (mkAfter ''
+          Component "focus.${cfg.hostName}" "client_proxy"
+            target_address = "focus@auth.${cfg.hostName}"
+
+          Component "speakerstats.${cfg.hostName}" "speakerstats_component"
+            muc_component = "conference.${cfg.hostName}"
+
+          Component "conferenceduration.${cfg.hostName}" "conference_duration_component"
+            muc_component = "conference.${cfg.hostName}"
+
+          Component "endconference.${cfg.hostName}" "end_conference"
+            muc_component = "conference.${cfg.hostName}"
+
+          Component "avmoderation.${cfg.hostName}" "av_moderation_component"
+            muc_component = "conference.${cfg.hostName}"
+
+          Component "metadata.${cfg.hostName}" "room_metadata_component"
+            muc_component = "conference.${cfg.hostName}"
+            breakout_rooms_component = "breakout.${cfg.hostName}"
         '')
         (mkBefore ''
+          muc_mapper_domain_base = "${cfg.hostName}"
+
           cross_domain_websocket = true;
           consider_websocket_secure = true;
+
+          unlimited_jids = {
+            "focus@auth.${cfg.hostName}",
+            "jvb@auth.${cfg.hostName}"
+          }
         '')
       ];
       virtualHosts.${cfg.hostName} = {
         enabled = true;
         domain = cfg.hostName;
         extraConfig = ''
-          authentication = "anonymous"
+          authentication = ${if cfg.secureDomain.enable then "\"internal_hashed\"" else "\"jitsi-anonymous\""}
           c2s_require_encryption = false
           admins = { "focus@auth.${cfg.hostName}" }
           smacks_max_unacked_stanzas = 5
           smacks_hibernation_time = 60
           smacks_max_hibernated_sessions = 1
           smacks_max_old_sessions = 1
+
+          av_moderation_component = "avmoderation.${cfg.hostName}"
+          speakerstats_component = "speakerstats.${cfg.hostName}"
+          conference_duration_component = "conferenceduration.${cfg.hostName}"
+          end_conference_component = "endconference.${cfg.hostName}"
+
+          c2s_require_encryption = false
+          lobby_muc = "lobby.${cfg.hostName}"
+          breakout_rooms_muc = "breakout.${cfg.hostName}"
+          room_metadata_component = "metadata.${cfg.hostName}"
+          main_muc = "conference.${cfg.hostName}"
         '';
         ssl = {
           cert = "/var/lib/jitsi-meet/jitsi-meet.crt";
@@ -237,7 +323,7 @@ in
         enabled = true;
         domain = "auth.${cfg.hostName}";
         extraConfig = ''
-          authentication = "internal_plain"
+          authentication = "internal_hashed"
         '';
         ssl = {
           cert = "/var/lib/jitsi-meet/jitsi-meet.crt";
@@ -252,6 +338,14 @@ in
           c2s_require_encryption = false
         '';
       };
+      virtualHosts."guest.${cfg.hostName}" = {
+        enabled = true;
+        domain = "guest.${cfg.hostName}";
+        extraConfig = ''
+          authentication = "anonymous"
+          c2s_require_encryption = false
+        '';
+      };
     };
     systemd.services.prosody = mkIf cfg.prosody.enable {
       preStart = let
@@ -270,7 +364,7 @@ in
       reloadIfChanged = true;
     };
 
-    users.groups.jitsi-meet = {};
+    users.groups.jitsi-meet = { };
     systemd.tmpfiles.rules = [
       "d '/var/lib/jitsi-meet' 0750 root jitsi-meet - -"
     ];
@@ -317,6 +411,20 @@ in
       '';
     };
 
+    systemd.services.jitsi-excalidraw = mkIf cfg.excalidraw.enable {
+      description = "Excalidraw collaboration backend for Jitsi";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment.PORT = toString cfg.excalidraw.port;
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pkgs.jitsi-excalidraw}/bin/jitsi-excalidraw-backend";
+        Restart = "on-failure";
+        Group = "jitsi-meet";
+      };
+    };
+
     services.nginx = mkIf cfg.nginx.enable {
       enable = mkDefault true;
       virtualHosts.${cfg.hostName} = {
@@ -345,12 +453,23 @@ in
         locations."=/external_api.js" = mkDefault {
           alias = "${pkgs.jitsi-meet}/libs/external_api.min.js";
         };
+        locations."=/_api/room-info" = {
+          proxyPass = "http://localhost:5280/room-info";
+          extraConfig = ''
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header Host $host;
+          '';
+        };
         locations."=/config.js" = mkDefault {
           alias = overrideJs "${pkgs.jitsi-meet}/config.js" "config" (recursiveUpdate defaultCfg cfg.config) cfg.extraConfig;
         };
         locations."=/interface_config.js" = mkDefault {
           alias = overrideJs "${pkgs.jitsi-meet}/interface_config.js" "interfaceConfig" cfg.interfaceConfig "";
         };
+        locations."/socket.io/" = mkIf cfg.excalidraw.enable {
+          proxyPass = "http://127.0.0.1:${toString cfg.excalidraw.port}";
+          proxyWebsockets = true;
+        };
       };
     };
 
@@ -359,7 +478,7 @@ in
       virtualHosts.${cfg.hostName} = {
         extraConfig =
         let
-          templatedJitsiMeet = pkgs.runCommand "templated-jitsi-meet" {} ''
+          templatedJitsiMeet = pkgs.runCommand "templated-jitsi-meet" { } ''
             cp -R ${pkgs.jitsi-meet}/* .
             for file in *.html **/*.html ; do
               ${pkgs.sd}/bin/sd '<!--#include virtual="(.*)" -->' '{{ include "$1" }}' $file
@@ -390,13 +509,24 @@ in
       };
     };
 
+    services.jitsi-meet.config = recursiveUpdate
+      (mkIf cfg.excalidraw.enable {
+        whiteboard = {
+          enabled = true;
+          collabServerBaseUrl = "https://${cfg.hostName}";
+        };
+      })
+      (mkIf cfg.secureDomain.enable {
+        hosts.anonymousdomain = "guest.${cfg.hostName}";
+      });
+
     services.jitsi-videobridge = mkIf cfg.videobridge.enable {
       enable = true;
       xmppConfigs."localhost" = {
         userName = "jvb";
         domain = "auth.${cfg.hostName}";
         passwordFile = "/var/lib/jitsi-meet/videobridge-secret";
-        mucJids = "jvbbrewery@internal.${cfg.hostName}";
+        mucJids = "jvbbrewery@internal.auth.${cfg.hostName}";
         disableCertificateVerification = true;
       };
     };
@@ -409,17 +539,27 @@ in
       userName = "focus";
       userPasswordFile = "/var/lib/jitsi-meet/jicofo-user-secret";
       componentPasswordFile = "/var/lib/jitsi-meet/jicofo-component-secret";
-      bridgeMuc = "jvbbrewery@internal.${cfg.hostName}";
+      bridgeMuc = "jvbbrewery@internal.auth.${cfg.hostName}";
       config = mkMerge [{
         jicofo.xmpp.service.disable-certificate-verification = true;
         jicofo.xmpp.client.disable-certificate-verification = true;
-      #} (lib.mkIf cfg.jibri.enable {
-       } (lib.mkIf (config.services.jibri.enable || cfg.jibri.enable) {
-         jicofo.jibri = {
-           brewery-jid = "JibriBrewery@internal.${cfg.hostName}";
-           pending-timeout = "90";
-         };
-      })];
+      }
+        (lib.mkIf (config.services.jibri.enable || cfg.jibri.enable) {
+          jicofo.jibri = {
+            brewery-jid = "JibriBrewery@internal.auth.${cfg.hostName}";
+            pending-timeout = "90";
+          };
+        })
+        (lib.mkIf cfg.secureDomain.enable {
+          jicofo = {
+            authentication = {
+              enabled = "true";
+              type = "XMPP";
+              login-url = cfg.hostName;
+            };
+            xmpp.client.client-proxy = "focus.${cfg.hostName}";
+          };
+        })];
     };
 
     services.jibri = mkIf cfg.jibri.enable {
@@ -430,7 +570,7 @@ in
         xmppDomain = cfg.hostName;
 
         control.muc = {
-          domain = "internal.${cfg.hostName}";
+          domain = "internal.auth.${cfg.hostName}";
           roomName = "JibriBrewery";
           nickname = "jibri";
         };
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index 7d06e0131d9..e2e7ffe59dc 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -277,7 +277,7 @@ def install_bootloader(args: argparse.Namespace) -> None:
 
         if installed_version < available_version:
             print("updating systemd-boot from %s to %s" % (installed_version, available_version))
-            subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@", "update"])
+            subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@"] + bootctl_flags + ["update"])
 
     os.makedirs("@efiSysMountPoint@/efi/nixos", exist_ok=True)
     os.makedirs("@efiSysMountPoint@/loader/entries", exist_ok=True)
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index b7ced5b0d34..33261021480 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -122,6 +122,16 @@ let
         (assertValueOneOf "PacketInfo" boolValues)
         (assertValueOneOf "VNetHeader" boolValues)
       ];
+
+      # See https://www.freedesktop.org/software/systemd/man/latest/systemd.netdev.html#%5BIPVTAP%5D%20Section%20Options
+      ipVlanVtapChecks = [
+        (assertOnlyFields [
+          "Mode"
+          "Flags"
+        ])
+        (assertValueOneOf "Mode" ["L2" "L3" "L3S" ])
+        (assertValueOneOf "Flags" ["private" "vepa" "bridge" ])
+      ];
     in {
 
       sectionNetdev = checkUnitConfig "Netdev" [
@@ -146,6 +156,7 @@ let
           "ip6gretap"
           "ipip"
           "ipvlan"
+          "ipvtap"
           "macvlan"
           "macvtap"
           "sit"
@@ -191,6 +202,10 @@ let
         (assertValueOneOf "ReorderHeader" boolValues)
       ];
 
+      sectionIPVLAN = checkUnitConfig "IPVLAN" ipVlanVtapChecks;
+
+      sectionIPVTAP = checkUnitConfig "IPVTAP" ipVlanVtapChecks;
+
       sectionMACVLAN = checkUnitConfig "MACVLAN" [
         (assertOnlyFields [
           "Mode"
@@ -615,6 +630,7 @@ let
           "VRF"
           "VLAN"
           "IPVLAN"
+          "IPVTAP"
           "MACVLAN"
           "MACVTAP"
           "VXLAN"
@@ -1277,6 +1293,7 @@ let
           "FirewallMark"
           "Wash"
           "SplitGSO"
+          "AckFilter"
         ])
         (assertValueOneOf "AutoRateIngress" boolValues)
         (assertInt "OverheadBytes")
@@ -1309,6 +1326,7 @@ let
         (assertRange "FirewallMark" 1 4294967295)
         (assertValueOneOf "Wash" boolValues)
         (assertValueOneOf "SplitGSO" boolValues)
+        (assertValueOneOf "AckFilter" (boolValues ++ ["aggressive"]))
       ];
 
       sectionControlledDelay = checkUnitConfig "ControlledDelay" [
@@ -1623,6 +1641,26 @@ let
       '';
     };
 
+    ipvlanConfig = mkOption {
+      default = {};
+      example = { Mode = "L2"; Flags = "private"; };
+      type = types.addCheck (types.attrsOf unitOption) check.netdev.sectionIPVLAN;
+      description = lib.mdDoc ''
+        Each attribute in this set specifies an option in the `[IPVLAN]` section of the unit.
+        See {manpage}`systemd.netdev(5)` for details.
+      '';
+    };
+
+    ipvtapConfig = mkOption {
+      default = {};
+      example = { Mode = "L3"; Flags = "vepa"; };
+      type = types.addCheck (types.attrsOf unitOption) check.netdev.sectionIPVTAP;
+      description = lib.mdDoc ''
+        Each attribute in this set specifies an option in the `[IPVTAP]` section of the unit.
+        See {manpage}`systemd.netdev(5)` for details.
+      '';
+    };
+
     macvlanConfig = mkOption {
       default = {};
       example = { Mode = "private"; };
diff --git a/nixos/modules/tasks/filesystems/bcachefs.nix b/nixos/modules/tasks/filesystems/bcachefs.nix
index af7ba7aa6a0..d144ce62dc2 100644
--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@@ -1,10 +1,8 @@
 { config, lib, pkgs, utils, ... }:
 
-with lib;
-
 let
 
-  bootFs = filterAttrs (n: fs: (fs.fsType == "bcachefs") && (utils.fsNeededForBoot fs)) config.fileSystems;
+  bootFs = lib.filterAttrs (n: fs: (fs.fsType == "bcachefs") && (utils.fsNeededForBoot fs)) config.fileSystems;
 
   commonFunctions = ''
     prompt() {
@@ -56,7 +54,7 @@ let
   # remove this adaptation when bcachefs implements mounting by filesystem uuid
   # also, implement automatic waiting for the constituent devices when that happens
   # bcachefs does not support mounting devices with colons in the path, ergo we don't (see #49671)
-  firstDevice = fs: head (splitString ":" fs.device);
+  firstDevice = fs: lib.head (lib.splitString ":" fs.device);
 
   openCommand = name: fs: ''
     tryUnlock ${name} ${firstDevice fs}
@@ -90,22 +88,45 @@ let
     };
   };
 
+  assertions = [
+    {
+      assertion = let
+        kernel = config.boot.kernelPackages.kernel;
+      in (
+        kernel.kernelAtLeast "6.7" || (
+          lib.elem (kernel.structuredExtraConfig.BCACHEFS_FS or null) [
+            lib.kernel.module
+            lib.kernel.yes
+            lib.kernel.option.yes
+          ]
+        )
+      );
+
+      message = "Linux 6.7-rc1 at minimum or a custom linux kernel with bcachefs support is required";
+    }
+  ];
 in
 
 {
-  config = mkIf (elem "bcachefs" config.boot.supportedFilesystems) (mkMerge [
+  config = lib.mkIf (lib.elem "bcachefs" config.boot.supportedFilesystems) (lib.mkMerge [
     {
+      inherit assertions;
       # needed for systemd-remount-fs
       system.fsPackages = [ pkgs.bcachefs-tools ];
 
-      # use kernel package with bcachefs support until it's in mainline
-      # TODO replace with requireKernelConfig
-      boot.kernelPackages = pkgs.linuxPackages_testing_bcachefs;
+      # FIXME: Replace this with `linuxPackages_testing` after NixOS 23.11 is released
+      # FIXME: Replace this with `linuxPackages_latest` when 6.7 is released, remove this line when the LTS version is at least 6.7
+      boot.kernelPackages = lib.mkDefault (
+        # FIXME: Remove warning after NixOS 23.11 is released
+        lib.warn "Please upgrade to Linux 6.7-rc1 or later: 'linuxPackages_testing_bcachefs' is deprecated. Use 'boot.kernelPackages = pkgs.linuxPackages_testing;' to silence this warning"
+        pkgs.linuxPackages_testing_bcachefs
+      );
 
       systemd.services = lib.mapAttrs' (mkUnits "") (lib.filterAttrs (n: fs: (fs.fsType == "bcachefs") && (!utils.fsNeededForBoot fs)) config.fileSystems);
     }
 
-    (mkIf ((elem "bcachefs" config.boot.initrd.supportedFilesystems) || (bootFs != {})) {
+    (lib.mkIf ((lib.elem "bcachefs" config.boot.initrd.supportedFilesystems) || (bootFs != {})) {
+      inherit assertions;
       # chacha20 and poly1305 are required only for decryption attempts
       boot.initrd.availableKernelModules = [ "bcachefs" "sha256" "chacha20" "poly1305" ];
       boot.initrd.systemd.extraBin = {
@@ -121,7 +142,7 @@ in
         $out/bin/bcachefs version
       '';
 
-      boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable) (commonFunctions + concatStrings (mapAttrsToList openCommand bootFs));
+      boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable) (commonFunctions + lib.concatStrings (lib.mapAttrsToList openCommand bootFs));
 
       boot.initrd.systemd.services = lib.mapAttrs' (mkUnits "/sysroot") bootFs;
     })
diff --git a/nixos/modules/virtualisation/google-compute-image.nix b/nixos/modules/virtualisation/google-compute-image.nix
index dcdd1b59eef..e4a18fd81d7 100644
--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@@ -56,6 +56,11 @@ in
       efiInstallAsRemovable = true;
     };
 
+    fileSystems."/boot" = mkIf cfg.efi {
+      device = "/dev/disk/by-label/ESP";
+      fsType = "vfat";
+    };
+
     system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
       name = "google-compute-image";
       postVM = ''
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 6c127efa4ce..325e99c9774 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -192,7 +192,6 @@ in {
   cntr = handleTestOn ["aarch64-linux" "x86_64-linux"] ./cntr.nix {};
   cockpit = handleTest ./cockpit.nix {};
   cockroachdb = handleTestOn ["x86_64-linux"] ./cockroachdb.nix {};
-  code-server = handleTest ./code-server.nix {};
   coder = handleTest ./coder.nix {};
   collectd = handleTest ./collectd.nix {};
   connman = handleTest ./connman.nix {};
@@ -750,6 +749,7 @@ in {
   signal-desktop = handleTest ./signal-desktop.nix {};
   simple = handleTest ./simple.nix {};
   sing-box = handleTest ./sing-box.nix {};
+  slimserver = handleTest ./slimserver.nix {};
   slurm = handleTest ./slurm.nix {};
   smokeping = handleTest ./smokeping.nix {};
   snapcast = handleTest ./snapcast.nix {};
diff --git a/nixos/tests/code-server.nix b/nixos/tests/code-server.nix
deleted file mode 100644
index 7d523dfc617..00000000000
--- a/nixos/tests/code-server.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-import ./make-test-python.nix ({pkgs, lib, ...}:
-{
-  name = "code-server";
-
-  nodes = {
-    machine = {pkgs, ...}: {
-      services.code-server = {
-        enable = true;
-        auth = "none";
-      };
-    };
-  };
-
-  testScript = ''
-    start_all()
-    machine.wait_for_unit("code-server.service")
-    machine.wait_for_open_port(4444)
-    machine.succeed("curl -k --fail http://localhost:4444", timeout=10)
-  '';
-
-  meta.maintainers = [ lib.maintainers.drupol ];
-})
diff --git a/nixos/tests/elk.nix b/nixos/tests/elk.nix
index 0122bc44036..900ea632010 100644
--- a/nixos/tests/elk.nix
+++ b/nixos/tests/elk.nix
@@ -119,11 +119,6 @@ let
                 package = elk.elasticsearch;
               };
 
-              kibana = {
-                enable = true;
-                package = elk.kibana;
-              };
-
               elasticsearch-curator = {
                 enable = true;
                 actionYAML = ''
@@ -217,13 +212,6 @@ let
           one.wait_until_succeeds("cat /tmp/logstash.out | grep flowers")
           one.wait_until_succeeds("cat /tmp/logstash.out | grep -v dragons")
 
-      with subtest("Kibana is healthy"):
-          one.wait_for_unit("kibana.service")
-          one.wait_until_succeeds(
-              "curl --silent --show-error --fail-with-body 'http://localhost:5601/api/status'"
-              + " | jq -es 'if . == [] then null else .[] | .status.overall.state == \"green\" end'"
-          )
-
       with subtest("Metricbeat is running"):
           one.wait_for_unit("metricbeat.service")
 
@@ -274,7 +262,6 @@ in {
   #   name = "elk-7";
   #   elasticsearch = pkgs.elasticsearch7-oss;
   #   logstash      = pkgs.logstash7-oss;
-  #   kibana        = pkgs.kibana7-oss;
   #   filebeat      = pkgs.filebeat7;
   #   metricbeat    = pkgs.metricbeat7;
   # };
@@ -282,7 +269,6 @@ in {
     ELK-7 = mkElkTest "elk-7" {
       elasticsearch = pkgs.elasticsearch7;
       logstash      = pkgs.logstash7;
-      kibana        = pkgs.kibana7;
       filebeat      = pkgs.filebeat7;
       metricbeat    = pkgs.metricbeat7;
     };
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 1baa4396424..e9ec2874985 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -991,6 +991,68 @@ in {
     '';
   };
 
+  bcachefsLinuxTesting = makeInstallerTest "bcachefs-linux-testing" {
+    extraInstallerConfig = {
+      imports = [ no-zfs-module ];
+
+      boot = {
+        supportedFilesystems = [ "bcachefs" ];
+        kernelPackages = pkgs.linuxPackages_testing;
+      };
+    };
+
+    extraConfig = ''
+      boot.kernelPackages = pkgs.linuxPackages_testing;
+    '';
+
+    createPartitions = ''
+      machine.succeed(
+        "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+        + " mkpart primary ext2 1M 100MB"          # /boot
+        + " mkpart primary linux-swap 100M 1024M"  # swap
+        + " mkpart primary 1024M -1s",             # /
+        "udevadm settle",
+        "mkswap /dev/vda2 -L swap",
+        "swapon -L swap",
+        "mkfs.bcachefs -L root /dev/vda3",
+        "mount -t bcachefs /dev/vda3 /mnt",
+        "mkfs.ext3 -L boot /dev/vda1",
+        "mkdir -p /mnt/boot",
+        "mount /dev/vda1 /mnt/boot",
+      )
+    '';
+  };
+
+  bcachefsUpgradeToLinuxTesting = makeInstallerTest "bcachefs-upgrade-to-linux-testing" {
+    extraInstallerConfig = {
+      imports = [ no-zfs-module ];
+      boot.supportedFilesystems = [ "bcachefs" ];
+      # We don't have network access in the VM, we need this for `nixos-install`
+      system.extraDependencies = [ pkgs.linux_testing ];
+    };
+
+    extraConfig = ''
+      boot.kernelPackages = pkgs.linuxPackages_testing;
+    '';
+
+    createPartitions = ''
+      machine.succeed(
+        "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
+        + " mkpart primary ext2 1M 100MB"          # /boot
+        + " mkpart primary linux-swap 100M 1024M"  # swap
+        + " mkpart primary 1024M -1s",             # /
+        "udevadm settle",
+        "mkswap /dev/vda2 -L swap",
+        "swapon -L swap",
+        "mkfs.bcachefs -L root /dev/vda3",
+        "mount -t bcachefs /dev/vda3 /mnt",
+        "mkfs.ext3 -L boot /dev/vda1",
+        "mkdir -p /mnt/boot",
+        "mount /dev/vda1 /mnt/boot",
+      )
+    '';
+  };
+
   # Test using labels to identify volumes in grub
   simpleLabels = makeInstallerTest "simpleLabels" {
     createPartitions = ''
diff --git a/nixos/tests/slimserver.nix b/nixos/tests/slimserver.nix
new file mode 100644
index 00000000000..c3f7b6fde4d
--- /dev/null
+++ b/nixos/tests/slimserver.nix
@@ -0,0 +1,47 @@
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "slimserver";
+  meta.maintainers = with pkgs.lib.maintainers; [ adamcstephens ];
+
+  nodes.machine = { ... }: {
+    services.slimserver.enable = true;
+    services.squeezelite = {
+      enable = true;
+      extraArguments = "-s 127.0.0.1 -d slimproto=info";
+    };
+    sound.enable = true;
+    boot.initrd.kernelModules = ["snd-dummy"];
+  };
+
+  testScript =
+    ''
+      import json
+      rpc_get_player = {
+          "id": 1,
+          "method": "slim.request",
+          "params":[0,["player", "id", "0", "?"]]
+      }
+
+      with subtest("slimserver is started"):
+          machine.wait_for_unit("slimserver.service")
+          # give slimserver a moment to report errors
+          machine.sleep(2)
+
+      with subtest('slimserver module errors are not reported'):
+          machine.fail("journalctl -u slimserver.service | grep 'throw_exception'")
+          machine.fail("journalctl -u slimserver.service | grep 'not installed'")
+          machine.fail("journalctl -u slimserver.service | grep 'not found'")
+          machine.fail("journalctl -u slimserver.service | grep 'The following CPAN modules were found but cannot work with Logitech Media Server'")
+          machine.fail("journalctl -u slimserver.service | grep 'please use the buildme.sh'")
+
+      with subtest('slimserver is ready'):
+          machine.wait_for_open_port(9000)
+          machine.wait_until_succeeds("journalctl -u slimserver.service | grep 'Completed dbOptimize Scan'")
+
+      with subtest("squeezelite player successfully connects to slimserver"):
+          machine.wait_for_unit("squeezelite.service")
+          machine.wait_until_succeeds("journalctl -u squeezelite.service | grep 'slimproto:937 connected'")
+          player_mac = machine.wait_until_succeeds("journalctl -eu squeezelite.service | grep 'sendHELO:148 mac:'").strip().split(" ")[-1]
+          player_id = machine.succeed(f"curl http://localhost:9000/jsonrpc.js -g -X POST -d '{json.dumps(rpc_get_player)}'")
+          assert player_mac == json.loads(player_id)["result"]["_id"], "squeezelite player not found"
+    '';
+})
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index a592504addc..256a18532b0 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -252,6 +252,35 @@ in
     '';
   };
 
+  garbage-collect-entry = makeTest {
+    name = "systemd-boot-switch-test";
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
+
+    nodes = {
+      inherit common;
+      machine = { pkgs, nodes, ... }: {
+        imports = [ common ];
+
+        # These are configs for different nodes, but we'll use them here in `machine`
+        system.extraDependencies = [
+          nodes.common.system.build.toplevel
+        ];
+      };
+    };
+
+    testScript = { nodes, ... }:
+      let
+        baseSystem = nodes.common.system.build.toplevel;
+      in
+      ''
+        machine.succeed("nix-env -p /nix/var/nix/profiles/system --set ${baseSystem}")
+        machine.succeed("nix-env -p /nix/var/nix/profiles/system --delete-generations 1")
+        machine.succeed("${baseSystem}/bin/switch-to-configuration boot")
+        machine.fail("test -e /boot/loader/entries/nixos-generation-1.conf")
+        machine.succeed("test -e /boot/loader/entries/nixos-generation-2.conf")
+      '';
+  };
+
   # Some UEFI firmwares fail on large reads. Now that systemd-boot loads initrd
   # itself, systems with such firmware won't boot without this fix
   uefiLargeFileWorkaround = makeTest {
diff --git a/pkgs/applications/audio/ledfx/default.nix b/pkgs/applications/audio/ledfx/default.nix
index 004823ee52d..d0cafaaf7f0 100644
--- a/pkgs/applications/audio/ledfx/default.nix
+++ b/pkgs/applications/audio/ledfx/default.nix
@@ -5,12 +5,12 @@
 
 python3.pkgs.buildPythonPackage rec {
   pname = "ledfx";
-  version = "2.0.69";
+  version = "2.0.78";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gkO6XYiPMkU/zRLvc0yd3jJXVcAgAkR1W1ELTSN461o=";
+    hash = "sha256-IalfA/nfQrnE90ycOnPEZ4A/L8rwi08ECNA/8YxeAgQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/audio/squeezelite/default.nix b/pkgs/applications/audio/squeezelite/default.nix
index da126de3fc4..0f3b8be11c0 100644
--- a/pkgs/applications/audio/squeezelite/default.nix
+++ b/pkgs/applications/audio/squeezelite/default.nix
@@ -22,6 +22,7 @@
 , openssl
 , portaudioSupport ? stdenv.isDarwin
 , portaudio
+, slimserver
 , AudioToolbox
 , AudioUnit
 , Carbon
@@ -95,7 +96,10 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
-  passthru.updateScript = ./update.sh;
+  passthru = {
+    inherit (slimserver) tests;
+    updateScript = ./update.sh;
+  };
 
   meta = with lib; {
     description = "Lightweight headless squeezebox client emulator";
diff --git a/pkgs/applications/blockchains/erigon/default.nix b/pkgs/applications/blockchains/erigon/default.nix
index 86c0d53fcf8..d73a916b0de 100644
--- a/pkgs/applications/blockchains/erigon/default.nix
+++ b/pkgs/applications/blockchains/erigon/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "erigon";
-  version = "2.53.1";
+  version = "2.54.0";
 in
 buildGoModule {
   inherit pname version;
@@ -11,11 +11,11 @@ buildGoModule {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Gsrt/+6fhpwg3DzPtXPj9T9VPaMIaRcYBdWuFOotsbA=";
+    hash = "sha256-1kgbIg/3SvVT83UfwAYUixs1RQk4PP1quiOcI1mzbZ0=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-zsLPqcLCZSnhlFWvNXZJwlfS+NsaTS07TmWd+x4ZPXA=";
+  vendorHash = "sha256-Gr9mrME8/ZDxp2ORKessNhfguklDf+jC4RSpzLOSBhQ=";
   proxyVendor = true;
 
   # Build errors in mdbx when format hardening is enabled:
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index c5cc91c1268..789420fdfc6 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -90,6 +90,7 @@
 , withXinput2 ? withX && lib.versionAtLeast version "29"
 , withXwidgets ? !stdenv.isDarwin && !noGui && (withGTK3 || withPgtk)
 , withSmallJaDic ? false
+, withCompressInstall ? true
 
 # Options
 , siteStart ? ./site-start.el
@@ -339,6 +340,7 @@ mkDerivation (finalAttrs: {
   ++ lib.optional withXinput2 "--with-xinput2"
   ++ lib.optional withXwidgets "--with-xwidgets"
   ++ lib.optional withSmallJaDic "--with-small-ja-dic"
+  ++ lib.optional (!withCompressInstall) "--without-compress-install"
   ;
 
   env = lib.optionalAttrs withNativeCompilation {
diff --git a/pkgs/applications/editors/helix/default.nix b/pkgs/applications/editors/helix/default.nix
index 7d3b964fb15..323218f9437 100644
--- a/pkgs/applications/editors/helix/default.nix
+++ b/pkgs/applications/editors/helix/default.nix
@@ -12,6 +12,17 @@ rustPlatform.buildRustPackage rec {
     stripRoot = false;
   };
 
+  patches = [
+    # Fixes implicit int error in rescript grammar when building with clang 16.
+    # https://github.com/nkrkv/tree-sitter-rescript/pull/227.
+    (fetchpatch {
+      url = "https://github.com/nkrkv/tree-sitter-rescript/commit/ea93cbf7d9c52f925ed296b4714737e8088f3a19.patch";
+      hash = "sha256-gpGPiy+yEs+dMJEnE5O3WC7iSB/6PLJYBYRcdTx//+o=";
+      extraPrefix = "runtime/grammars/sources/rescript/";
+      stripLen = 1;
+    })
+  ];
+
   cargoHash = "sha256-B8RO6BADDbPchowSfNVgviGvVgH23iF42DdhEBKBQzs=";
 
   nativeBuildInputs = [ git installShellFiles makeWrapper ];
diff --git a/pkgs/applications/editors/standardnotes/src.json b/pkgs/applications/editors/standardnotes/src.json
index 16598d02485..62e1ae0d952 100644
--- a/pkgs/applications/editors/standardnotes/src.json
+++ b/pkgs/applications/editors/standardnotes/src.json
@@ -1,13 +1,13 @@
 {
-  "version": "3.178.4",
+  "version": "3.181.23",
   "deb": {
     "x86_64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.178.4/standard-notes-3.178.4-linux-amd64.deb",
-      "hash": "sha512-6er/a9PqhKU4aagAxsbVdoXbRBNUr3Fa8BPWfuQ74Q4ai+iYlPjd4q50cTJQ4wJ5ucGyopgBEJq4/xYNunw6Ig=="
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.181.23/standard-notes-3.181.23-linux-amd64.deb",
+      "hash": "sha512-zWjST3guI0qifvZIwSLJ0nIpU12Mu3+m25Xdoqv0BQC7tscChEdCGUAJRUKHEf0b8l4uvp8qBGHiBOfbrIi//w=="
     },
     "aarch64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.178.4/standard-notes-3.178.4-linux-arm64.deb",
-      "hash": "sha512-lvvXCK3XOIH9HS1EU5eVBo4W8VoE4iM1Ve1XkZ/CysYBYLaXojXyybeN5Iw1Rmuk3trq/7RebjkNx/rxhsU0LQ=="
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.181.23/standard-notes-3.181.23-linux-arm64.deb",
+      "hash": "sha512-7R5Ym44mrVgUiqdt6NL8F9uUUOroQRxwn30xKThyIQm2HGRUJivRfOws98El9zV8bKG1khk4DZaMiLQSMjrtaQ=="
     }
   }
 }
diff --git a/pkgs/applications/editors/texstudio/default.nix b/pkgs/applications/editors/texstudio/default.nix
index ef0f15734a2..1f66a581dbe 100644
--- a/pkgs/applications/editors/texstudio/default.nix
+++ b/pkgs/applications/editors/texstudio/default.nix
@@ -1,4 +1,5 @@
 { stdenv, lib, fetchFromGitHub, cmake, qtbase, qttools, qtsvg, qt5compat, quazip
+, qtwayland
 , hunspell
 , wrapQtAppsHook, poppler, zlib, pkg-config }:
 
@@ -27,6 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
     qttools
     quazip
     zlib
+  ] ++ lib.optionals stdenv.isLinux [
+    qtwayland
   ];
 
   postInstall = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index ea1e3f8da7b..a27f8650f42 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -847,6 +847,10 @@ self: super: {
     dependencies = with self; [ plenary-nvim ];
   };
 
+  neotest = super.neorg.overrideAttrs {
+    dependencies = with self; [ plenary-nvim ];
+  };
+
   neo-tree-nvim = super.neo-tree-nvim.overrideAttrs {
     dependencies = with self; [ plenary-nvim nui-nvim ];
   };
diff --git a/pkgs/applications/emulators/firebird-emu/default.nix b/pkgs/applications/emulators/firebird-emu/default.nix
index d117a93fba4..9fd99014616 100644
--- a/pkgs/applications/emulators/firebird-emu/default.nix
+++ b/pkgs/applications/emulators/firebird-emu/default.nix
@@ -1,6 +1,13 @@
-{ mkDerivation, lib, fetchFromGitHub, qmake, qtbase, qtdeclarative }:
-
-mkDerivation rec {
+{ stdenv
+, lib
+, fetchFromGitHub
+, qmake
+, qtbase
+, qtdeclarative
+, qtquickcontrols
+, wrapQtAppsHook
+}:
+stdenv.mkDerivation rec {
   pname = "firebird-emu";
   version = "1.6";
 
@@ -12,16 +19,23 @@ mkDerivation rec {
     hash = "sha256-ZptjlnOiF+hKuKYvBFJL95H5YQuR99d4biOco/MVEmE=";
   };
 
-  nativeBuildInputs = [ qmake ];
+  # work around https://github.com/NixOS/nixpkgs/issues/19098
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && stdenv.isDarwin) "-fno-lto";
+
+  nativeBuildInputs = [ wrapQtAppsHook qmake ];
+
+  buildInputs = [ qtbase qtdeclarative qtquickcontrols ];
 
-  buildInputs = [ qtbase qtdeclarative ];
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir $out/Applications
+    mv $out/bin/${pname}.app $out/Applications/
+  '';
 
   meta = {
     homepage = "https://github.com/nspire-emus/firebird";
     description = "Third-party multi-platform emulator of the ARM-based TI-Nspire™ calculators";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ pneumaticat ];
-    # Only tested on Linux, but likely possible to build on, e.g. macOS
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/applications/emulators/wine/base.nix b/pkgs/applications/emulators/wine/base.nix
index 2e84a8f2091..68814ca5ba5 100644
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -37,8 +37,11 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
     # The Wine preloader must _not_ be linked to any system libraries, but `NIX_LDFLAGS` will link
     # to libintl, libiconv, and CoreFoundation no matter what. Delete the one that was built and
     # rebuild it with empty NIX_LDFLAGS.
-    rm loader/wine64-preloader
-    make loader/wine64-preloader NIX_LDFLAGS="" NIX_LDFLAGS_${stdenv.cc.suffixSalt}=""
+    for preloader in wine-preloader wine64-preloader; do
+      rm loader/$preloader &> /dev/null \
+      && ( echo "Relinking loader/$preloader"; make loader/$preloader NIX_LDFLAGS="" NIX_LDFLAGS_${stdenv.cc.suffixSalt}="" ) \
+      || echo "loader/$preloader not built, skipping relink."
+    done
   '';
 }) // rec {
   inherit version src;
@@ -109,7 +112,8 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
       # uses property syntax in one place. The first patch is necessary only with older
       # versions of Wine. The second is needed on all versions of Wine.
       (lib.optional (lib.versionOlder version "8.12") ./darwin-metal-compat-pre8.12.patch)
-      ./darwin-metal-compat.patch
+      (lib.optional (lib.versionOlder version "8.18") ./darwin-metal-compat-pre8.18.patch)
+      (lib.optional (lib.versionAtLeast version "8.18") ./darwin-metal-compat.patch)
       # Wine requires `qos.h`, which is not included by default on the 10.12 SDK in nixpkgs.
       ./darwin-qos.patch
     ]
@@ -203,6 +207,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
       fromSource
       binaryNativeCode  # mono, gecko
     ];
+    broken = stdenv.isDarwin && !supportFlags.mingwSupport;
     description = if supportFlags.waylandSupport then "An Open Source implementation of the Windows API on top of OpenGL and Unix (with experimental Wayland support)" else "An Open Source implementation of the Windows API on top of X, OpenGL, and Unix";
     platforms = if supportFlags.waylandSupport then (lib.remove "x86_64-darwin" prevPlatforms) else prevPlatforms;
     maintainers = with lib.maintainers; [ avnik raskin bendlas jmc-figueira reckenrode ];
diff --git a/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.18.patch b/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.18.patch
new file mode 100644
index 00000000000..181b2a0d1a4
--- /dev/null
+++ b/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.18.patch
@@ -0,0 +1,12 @@
+diff --git a/dlls/winemac.drv/cocoa_display.m b/dlls/winemac.drv/cocoa_display.m
+--- a/dlls/winemac.drv/cocoa_display.m
++++ b/dlls/winemac.drv/cocoa_display.m
+@@ -354,7 +354,7 @@ static int macdrv_get_gpu_info_from_display_id_using_metal(struct macdrv_gpu* gp
+ 
+     device = [CGDirectDisplayCopyCurrentMetalDevice(display_id) autorelease];
+     if (device && [device respondsToSelector:@selector(registryID)])
+-        ret = macdrv_get_gpu_info_from_registry_id(gpu, device.registryID);
++        ret = macdrv_get_gpu_info_from_registry_id(gpu, [device registryID]);
+ 
+ done:
+     [pool release];
diff --git a/pkgs/applications/emulators/wine/darwin-metal-compat.patch b/pkgs/applications/emulators/wine/darwin-metal-compat.patch
index 181b2a0d1a4..8176be8ef38 100644
--- a/pkgs/applications/emulators/wine/darwin-metal-compat.patch
+++ b/pkgs/applications/emulators/wine/darwin-metal-compat.patch
@@ -1,12 +1,13 @@
 diff --git a/dlls/winemac.drv/cocoa_display.m b/dlls/winemac.drv/cocoa_display.m
+index fbbe16efcbf..2db375ff3d5 100644
 --- a/dlls/winemac.drv/cocoa_display.m
 +++ b/dlls/winemac.drv/cocoa_display.m
-@@ -354,7 +354,7 @@ static int macdrv_get_gpu_info_from_display_id_using_metal(struct macdrv_gpu* gp
+@@ -387,7 +387,7 @@ static int macdrv_get_gpu_info_from_display_id_using_metal(struct macdrv_gpu* gp
  
      device = [CGDirectDisplayCopyCurrentMetalDevice(display_id) autorelease];
      if (device && [device respondsToSelector:@selector(registryID)])
--        ret = macdrv_get_gpu_info_from_registry_id(gpu, device.registryID);
-+        ret = macdrv_get_gpu_info_from_registry_id(gpu, [device registryID]);
- 
- done:
-     [pool release];
+-        return macdrv_get_gpu_info_from_registry_id(gpu, device.registryID);
++        return macdrv_get_gpu_info_from_registry_id(gpu, [device registryID]);
+     else
+         return -1;
+ }
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 813d032bf96..1bd1d6a8214 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -69,9 +69,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "8.17";
+    version = "8.20";
     url = "https://dl.winehq.org/wine/source/8.x/wine-${version}.tar.xz";
-    hash = "sha256-8BeFvTFix05l3rE6oK3XEeN8SERUcZvt0OjCsaNGm34=";
+    hash = "sha256-SNa3a9ZDBaICBX+8GdkiwfSWJfbRqYJZJ8ChhXJzmYI=";
     inherit (stable) patches;
 
     ## see http://wiki.winehq.org/Gecko
@@ -88,9 +88,9 @@ in rec {
 
     ## see http://wiki.winehq.org/Mono
     mono = fetchurl rec {
-      version = "8.0.0";
+      version = "8.1.0";
       url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      hash = "sha256-dbP0XcodyJhX/p6TLaeHEPZMxtSe8asMcjoXcIW0cRs=";
+      hash = "sha256-DtPsUzrvebLzEhVZMc97EIAAmsDFtMK8/rZ4rJSOCBA=";
     };
 
     updateScript = writeShellScript "update-wine-unstable" ''
@@ -116,8 +116,8 @@ in rec {
 
   staging = fetchFromGitHub rec {
     # https://github.com/wine-staging/wine-staging/releases
-    version = "8.17.1";
-    hash = "sha256-h36NDFYsI0y8TG41IH10IdF4QEuBkBewQ3knZ9iwDpg=";
+    version = "8.20";
+    hash = "sha256-CiWTXjUR1+GY+MO7djHfVUH71zSo3lpH9IaqS5zCeJ8=";
     owner = "wine-staging";
     repo = "wine-staging";
     rev = "v${version}";
@@ -127,12 +127,12 @@ in rec {
 
   wayland = fetchFromGitLab {
     # https://gitlab.collabora.com/alf/wine/-/tree/wayland
-    version = "8.0";
-    hash = "sha256-whRnm21UyKZ4AQufNmctzivISVobnCeidmpYz65vlyk=";
+    version = "8.2";
+    hash = "sha256-Eb2SFBIeQQ3cVZkUQcwNT5mcYe0ShFxBdMc3BlqkwTo=";
     domain = "gitlab.collabora.com";
     owner = "alf";
     repo = "wine";
-    rev = "2f80bd757739f2dd8da41abceae6b87d2c568152";
+    rev = "b2547ddf9e08cafce98cf7734d5c4ec926ef3536";
 
     inherit (unstable) gecko32 gecko64;
 
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index 5e1fbe37587..f3587cf2ea5 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -56,13 +56,13 @@ let
   python = python2.withPackages (pp: [ pp.pygtk ]);
 in stdenv.mkDerivation (finalAttrs: {
   pname = "gimp";
-  version = "2.10.34";
+  version = "2.10.36";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.bz2";
-    sha256 = "hABGQtNRs5ikKTzX/TWSBEqUTwW7UoUO5gaPJHxleqM=";
+    sha256 = "sha256-PTvDxppL2zrqm6LVOF7ZjqA5U/OFeq/R1pdgEe1827I=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index 5d5c981526d..2a46cfd5003 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -9,25 +9,25 @@
 let
 
   pname = "1password";
-  version = if channel == "stable" then "8.10.18" else "8.10.20-1.BETA";
+  version = if channel == "stable" then "8.10.20" else "8.10.20-1.BETA";
 
   sources = {
     stable = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        hash = "sha256-3oK8Jzz4+TY4IW8oAenzHo7KQeP58iZ+on5PNliBn7I=";
+        hash = "sha256-KOKqI64uI454ryLy/zdD0jxgY3GekBFoh028ftt1Twg=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        hash = "sha256-OsmgHPlAt9K7ytXMM8BANGcKcD3U1OLd2MLfOS4lc6Q=";
+        hash = "sha256-8MDJFG5d81Alxs1hqLw7DP+Pte+haGKfiZ/erGvks5A=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        hash = "sha256-wozym2QOLLUf4F+MwdIZfwN+VHkNewB+ZJZEkVNnb/c=";
+        hash = "sha256-T+f19Q/pzsC6lh8OF/w/pzRLBfAdlk1gwQz8funkx8Q=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        hash = "sha256-v1FZIsvFyIx81BORgDtZBP9jTRY6/0p537trOGf8mcM=";
+        hash = "sha256-kmal5wfqCKAlg7c+xVHM39qrucr+Kaxr4pNBYwKfs5g=";
       };
     };
     beta = {
diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
index 89ff023f86f..9030421dbee 100644
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@@ -12,12 +12,12 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.22.0";
+  version = "2.23.0";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-MWNbwCJ5ltAV1qmy8LPYkb6VTH0UVi2S5QEZZfpcnGM=" "zip";
-    i686-linux = fetch "linux_386" "sha256-lqwEm7fCiM2WNZvlAt/HeqI2zxnal/OMbTMGvvmXkvY=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-GfQ441a5mIgCTtxnk6L9UXodNGXek7f/jxJXWYJUb+0=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-yF0dy4MUgvSJUremXFfxCIHcGmYrCcjofcv1sBD9qyI=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-WBUHS1qoKHGJb6ktw8BD3V0H0419BO3EyTh675UnZRA=" "zip";
+    i686-linux = fetch "linux_386" "sha256-pulMvdE8COwRBk3IBBXqYPk2+A1XuCN9TxtGqm1HFeM=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-w0ieg9MxjmkABc4LRZIGyfDjbOter0pKRigLZBhosz4=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-fRkvkLnhr0oZCcCGhQd53Oj8uTxsgaSUkxD7p7CPOwI=" "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 7a6db59bf66..24ea7287160 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -3,7 +3,7 @@
 , libjpeg, libpng, libsamplerate, libsndfile
 , libtiff, libwebp, libGLU, libGL, openal, opencolorio, openexr, openimagedenoise, openimageio, openjpeg, python310Packages
 , openvdb, libXxf86vm, tbb, alembic
-, zlib, zstd, fftw, opensubdiv, freetype, jemalloc, ocl-icd, addOpenGLRunpath
+, zlib, zstd, fftw, fftwFloat, opensubdiv, freetype, jemalloc, ocl-icd, addOpenGLRunpath
 , jackaudioSupport ? false, libjack2
 , cudaSupport ? config.cudaSupport, cudaPackages ? { }
 , hipSupport ? false, rocmPackages # comes with a significantly larger closure size
@@ -30,15 +30,19 @@ let
     url = "https://developer.download.nvidia.com/redist/optix/v7.3/OptiX-7.3.0-Include.zip";
     sha256 = "0max1j4822mchj0xpz9lqzh91zkmvsn4py0r174cvqfz8z8ykjk8";
   };
+  libdecor' = libdecor.overrideAttrs (old: {
+    # Blender uses private APIs, need to patch to expose them
+    patches = (old.patches or [ ]) ++ [ ./libdecor.patch ];
+  });
 
 in
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "blender";
-  version = "3.6.5";
+  version = "4.0.1";
 
   src = fetchurl {
     url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    hash = "sha256-QAHA/pn22HLsfH6VX4Sp7r25raFxAPS1Gergjez38kM=";
+    hash = "sha256-/jLU0noX5RxhQ+26G16nGFylm65Lzfm9s11oCWCC43Q=";
   };
 
   patches = [
@@ -53,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: rec {
   buildInputs =
     [ boost ffmpeg gettext glew ilmbase
       freetype libjpeg libpng libsamplerate libsndfile libtiff libwebp
-      opencolorio openexr openimageio openjpeg python zlib zstd fftw jemalloc
+      opencolorio openexr openimageio openjpeg python zlib zstd fftw fftwFloat jemalloc
       alembic
       (opensubdiv.override { inherit cudaSupport; })
       tbb
@@ -65,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: rec {
       openpgl
     ]
     ++ lib.optionals waylandSupport [
-      wayland wayland-protocols libffi libdecor libxkbcommon dbus
+      wayland wayland-protocols libffi libdecor' libxkbcommon dbus
     ]
     ++ lib.optionals (!stdenv.isAarch64) [
       openimagedenoise
diff --git a/pkgs/applications/misc/blender/libdecor.patch b/pkgs/applications/misc/blender/libdecor.patch
new file mode 100644
index 00000000000..73c32f983cc
--- /dev/null
+++ b/pkgs/applications/misc/blender/libdecor.patch
@@ -0,0 +1,34 @@
+diff --git a/src/libdecor-plugin.h b/src/libdecor-plugin.h
+index ba80ce6..59199dd 100644
+--- a/src/libdecor-plugin.h
++++ b/src/libdecor-plugin.h
+@@ -132,12 +132,6 @@ struct libdecor_plugin_interface {
+ struct wl_surface *
+ libdecor_frame_get_wl_surface(struct libdecor_frame *frame);
+ 
+-int
+-libdecor_frame_get_content_width(struct libdecor_frame *frame);
+-
+-int
+-libdecor_frame_get_content_height(struct libdecor_frame *frame);
+-
+ enum libdecor_window_state
+ libdecor_frame_get_window_state(struct libdecor_frame *frame);
+ 
+diff --git a/src/libdecor.h b/src/libdecor.h
+index af67e2f..b5eba41 100644
+--- a/src/libdecor.h
++++ b/src/libdecor.h
+@@ -532,6 +532,12 @@ bool
+ libdecor_configuration_get_window_state(struct libdecor_configuration *configuration,
+ 					enum libdecor_window_state *window_state);
+ 
++int
++libdecor_frame_get_content_width(struct libdecor_frame *frame);
++
++int
++libdecor_frame_get_content_height(struct libdecor_frame *frame);
++
+ #ifdef __cplusplus
+ }
+ #endif
diff --git a/pkgs/applications/misc/keepass-plugins/keepassrpc/default.nix b/pkgs/applications/misc/keepass-plugins/keepassrpc/default.nix
index cbcb88b9d1a..2690db2d9fb 100644
--- a/pkgs/applications/misc/keepass-plugins/keepassrpc/default.nix
+++ b/pkgs/applications/misc/keepass-plugins/keepassrpc/default.nix
@@ -18,17 +18,10 @@ let
       maintainers = with maintainers; [ mjanczyk svsdep mgregoire ];
     };
 
-    pluginFilename = "KeePassRPC.plgx";
-
-    unpackCmd = ''
-      mkdir deps/
-      cp -p $src deps/$pluginFilename
-    '';
-    sourceRoot = "deps";
-
+    dontUnpack = true;
     installPhase = ''
       mkdir -p $out/lib/dotnet/keepass/
-      cp $pluginFilename $out/lib/dotnet/keepass/$pluginFilename
+      cp $src $out/lib/dotnet/keepass/
     '';
   };
 in
diff --git a/pkgs/applications/misc/llpp/default.nix b/pkgs/applications/misc/llpp/default.nix
index 38da8824cb0..d7db123ef4e 100644
--- a/pkgs/applications/misc/llpp/default.nix
+++ b/pkgs/applications/misc/llpp/default.nix
@@ -1,27 +1,19 @@
 { stdenv, lib, substituteAll, makeWrapper, fetchFromGitHub, fetchpatch, ocaml, pkg-config, mupdf, libX11, jbig2dec, openjpeg, libjpeg , lcms2, harfbuzz,
-libGLU, libGL, gumbo, freetype, zlib, xclip, inotify-tools, procps }:
+libGLU, libGL, gumbo, freetype, zlib, xclip, inotify-tools, procps, darwin }:
 
 assert lib.versionAtLeast (lib.getVersion ocaml) "4.07";
 
 stdenv.mkDerivation rec {
   pname = "llpp";
-  version = "41";
+  version = "42";
 
   src = fetchFromGitHub {
     owner = "criticic";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Doj0zLYI1pi7eK01+29xFLYPtc8+fWzj10292+PmToE=";
+    hash = "sha256-B/jKvBtBwMOErUVmGFGXXIT8FzMl1DFidfDCHIH41TU=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "system-makedeps-and-ocaml5.patch";
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/system-makedeps-and-ocaml5.patch?h=llpp&id=32955e115f914bb96348d288f9af9c6e3e80a02b";
-      hash = "sha256-3rcPsR+M8Jx7M8GHUIsw0WNBvp6aE7BcPr4yk2vT9Ik=";
-    })
-  ];
-
   postPatch = ''
     sed -i "2d;s/ver=.*/ver=${version}/" build.bash
   '';
@@ -29,7 +21,9 @@ stdenv.mkDerivation rec {
   strictDeps = true;
 
   nativeBuildInputs = [ makeWrapper ocaml pkg-config ];
-  buildInputs = [ mupdf libX11 libGLU libGL freetype zlib gumbo jbig2dec openjpeg libjpeg lcms2 harfbuzz ];
+  buildInputs = [ mupdf libX11 freetype zlib gumbo jbig2dec openjpeg libjpeg lcms2 harfbuzz ]
+    ++ lib.optionals stdenv.isLinux [ libGLU libGL ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.OpenGL darwin.apple_sdk.frameworks.Cocoa ];
 
   dontStrip = true;
 
@@ -46,7 +40,7 @@ stdenv.mkDerivation rec {
     install -d $out/bin
     install build/llpp $out/bin
     install misc/llpp.inotify $out/bin/llpp.inotify
-
+  '' + lib.optionalString stdenv.isLinux ''
     wrapProgram $out/bin/llpp \
         --prefix PATH ":" "${xclip}/bin"
 
@@ -59,7 +53,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://repo.or.cz/w/llpp.git";
     description = "A MuPDF based PDF pager written in OCaml";
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ pSub ];
     license = licenses.gpl3;
   };
diff --git a/pkgs/applications/misc/ulauncher/default.nix b/pkgs/applications/misc/ulauncher/default.nix
index 96f033744e6..232a4456e60 100644
--- a/pkgs/applications/misc/ulauncher/default.nix
+++ b/pkgs/applications/misc/ulauncher/default.nix
@@ -21,11 +21,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ulauncher";
-  version = "5.15.4";
+  version = "5.15.6";
 
   src = fetchurl {
     url = "https://github.com/Ulauncher/Ulauncher/releases/download/${version}/ulauncher_${version}.tar.gz";
-    sha256 = "sha256-5pEpYnJFHQKEfTve07ngFVDAOM9+kwrx6hc30gEwsko=";
+    sha256 = "sha256-WOWDekh9rcXeiN/ejiYC4BELhJwd98GkmyDOLN26ayU=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 4714704c0e7..d11dce5a105 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -15,9 +15,9 @@
         version = "2023-09-12";
       };
     };
-    hash = "sha256-UR8EowMYZ668qQ/6C9C/M+0HSguyUGKVhY46FTG+ShA=";
-    hash_deb_amd64 = "sha256-PIBWkCwU/7N242wR/WmpJDDJKLDGk/sJxPxa05bOQSE=";
-    version = "119.0.6045.123";
+    hash = "sha256-8xPm3vNF0HjfL7ewTz7iz7GMfiJi6mhMK1YSC7VeoSM=";
+    hash_deb_amd64 = "sha256-xAm7bPsnnJD7UWNTtHKMv5enHo3rM9w0M81QPqZVlP4=";
+    version = "119.0.6045.159";
   };
   ungoogled-chromium = {
     deps = {
@@ -28,12 +28,12 @@
         version = "2023-09-12";
       };
       ungoogled-patches = {
-        hash = "sha256-4EbfM62KuG8nHrYWwp183V5G9ac7FICjpyJahnKbQjE=";
-        rev = "119.0.6045.123-1";
+        hash = "sha256-kgUrYXy2avfwfRckSYI6YPMW1uuvl2Osg4Vr9Q1ksMc=";
+        rev = "119.0.6045.159-1";
       };
     };
-    hash = "sha256-UR8EowMYZ668qQ/6C9C/M+0HSguyUGKVhY46FTG+ShA=";
-    hash_deb_amd64 = "sha256-PIBWkCwU/7N242wR/WmpJDDJKLDGk/sJxPxa05bOQSE=";
-    version = "119.0.6045.123";
+    hash = "sha256-8xPm3vNF0HjfL7ewTz7iz7GMfiJi6mhMK1YSC7VeoSM=";
+    hash_deb_amd64 = "sha256-xAm7bPsnnJD7UWNTtHKMv5enHo3rM9w0M81QPqZVlP4=";
+    version = "119.0.6045.159";
   };
 }
diff --git a/pkgs/applications/networking/cluster/arkade/default.nix b/pkgs/applications/networking/cluster/arkade/default.nix
index 2e2ca3341d8..9c5225eb1b4 100644
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.10.13";
+  version = "0.10.15";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    hash = "sha256-DhMoNI1eRzP9FK752Z8sAcuj5dpu2vRqXRv4tbSYmLE=";
+    hash = "sha256-1r/f3CoTaOA2ZfM9UBGftZDZdCL9JIrs6SvaSO8BI6w=";
   };
 
   CGO_ENABLED = 0;
diff --git a/pkgs/applications/networking/cluster/calico/default.nix b/pkgs/applications/networking/cluster/calico/default.nix
index 29428d8360e..b1ca2a74542 100644
--- a/pkgs/applications/networking/cluster/calico/default.nix
+++ b/pkgs/applications/networking/cluster/calico/default.nix
@@ -2,16 +2,16 @@
 
 builtins.mapAttrs (pname: { doCheck ? true, mainProgram ? pname, subPackages }: buildGoModule rec {
   inherit pname;
-  version = "3.26.3";
+  version = "3.26.4";
 
   src = fetchFromGitHub {
     owner = "projectcalico";
     repo = "calico";
     rev = "v${version}";
-    hash = "sha256-KbtQ5oMZ1ygYwbaKpyAKTprPZ6+ikDbGLafwOShVd6w=";
+    hash = "sha256-idpvGgtvjtLuW+eQIldWihqgzWIFEM0bK0Ux61dD//w=";
   };
 
-  vendorHash = "sha256-1PBdDpc/cvI5uN6/msxXoMXbx7Osgq12W1VqtZ7XtGE=";
+  vendorHash = "sha256-Dl0YLXrw/roKLmp8cZUa1v2n/UwzOGoL0AN8fNVMknU=";
 
   inherit doCheck subPackages;
 
diff --git a/pkgs/applications/networking/cluster/cilium/default.nix b/pkgs/applications/networking/cluster/cilium/default.nix
index 8e1c1c14fd1..0a7f5178ef1 100644
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.15.11";
+  version = "0.15.12";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-czU5o6QS4MsXyyedQ0nzwDiCQacHcDsbm2iDk7nU+Y8=";
+    hash = "sha256-Js//4dB8b3w9AOvMhXt91G87FzQ8jHq3W3pJHzLbluA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/cmctl/default.nix b/pkgs/applications/networking/cluster/cmctl/default.nix
index 8396889f532..5d280425114 100644
--- a/pkgs/applications/networking/cluster/cmctl/default.nix
+++ b/pkgs/applications/networking/cluster/cmctl/default.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "cmctl";
-  version = "1.13.1";
+  version = "1.13.2";
 
   src = fetchFromGitHub {
     owner = "cert-manager";
     repo = "cert-manager";
     rev = "v${version}";
-    hash = "sha256-l0D7uVoYTwiVI+b8yYpsJk/eAG5XYidR9CaQ595aTjw=";
+    hash = "sha256-TfFdHKXbbi0yqvyQjZArY9GbkwjUq1Z00UuNAldyDuc=";
   };
 
   sourceRoot = "${src.name}/cmd/ctl";
 
-  vendorHash = "sha256-3Ws2ObyBVYog7oVqHeEgIeWeRQpV1Z+Clilp8wI/PUA=";
+  vendorHash = "sha256-63XxGvVsIRDpQ0ri6VkjciyD+k7eEMBcg0w8NU8ypYs=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index ac142ca3597..f67d650e77a 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -20,13 +20,13 @@
 
 buildGoModule rec {
   pname = "kubernetes";
-  version = "1.28.3";
+  version = "1.28.4";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    hash = "sha256-lb9FAk3b6J92viyHzLCzbYRxhQS94/FQvDr1m1kdTq8=";
+    hash = "sha256-aaGcAIyy0hFJGFfOq5FaF0qAlygXcs2WcwgvMe5dkbo=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 1862cf6e04a..6a5cdfd152d 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -1,14 +1,14 @@
 { branch ? "stable", callPackage, fetchurl, lib, stdenv }:
 let
   versions = if stdenv.isLinux then {
-    stable = "0.0.33";
-    ptb = "0.0.53";
-    canary = "0.0.173";
-    development = "0.0.1";
+    stable = "0.0.35";
+    ptb = "0.0.56";
+    canary = "0.0.184";
+    development = "0.0.0";
   } else {
-    stable = "0.0.282";
-    ptb = "0.0.84";
-    canary = "0.0.329";
+    stable = "0.0.284";
+    ptb = "0.0.87";
+    canary = "0.0.340";
     development = "0.0.2";
   };
   version = versions.${branch};
@@ -16,33 +16,33 @@ let
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-UVgufPNIS7fa3VDzjCWwgK3xxmqNivq461qWLgirClc=";
+        hash = "sha256-VcSRV9LDiUXduRt20kVeAnwinl6FmACQgn//W6eFyys=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-g2NhwkfNi5Yf+n9vHq/MJ0kylPF3MPocgF/zYfCvoZM=";
+        hash = "sha256-RDXApmhlu2aQTjWVXMyRp0CL29btsQufIPuxjjtJGIU=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-YFjGUAaZMy1JhtKhAqLbfYTKQSgS9TKWqR078cERNUI=";
+        hash = "sha256-Pu0kei/ls9yrDEpRQcgDAaEkRbYkFmp/jTwOkljoy18=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-ogLOZZ9pTXB01TqdnmdORIzZ8GbGzskUzbG4E68gZwY=";
+        hash = "sha256-/+9NyreRkXu2++uhwCh3/C1Cos39hfzB0Yjf0Otg9pk=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-3WeC+4W9+tpXNXqETorQfnE1HZWCqRkBqW0JM7whRCw=";
+        hash = "sha256-TTzhc6P0hFG9BFMviNx8CCg1cVEKDiB3gtb8oR/slNA=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-e2gvjXUw0Yx8UY6utg1SdX8/buewuVYPl5I8fS3QtrI=";
+        hash = "sha256-cl6+kTth/7j+HJHPU4Oy1N5EnmMbpdvltKzrU1by+Ik=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-B4LPFts+sx8GpZp9iRbwapUYrK4c9unH+mAoODGqDgU=";
+        hash = "sha256-LfixXyCoTnifw2GVAnCDnBla757JyGzbvUJwY4UhgGI=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
diff --git a/pkgs/applications/networking/instant-messengers/session-desktop/default.nix b/pkgs/applications/networking/instant-messengers/session-desktop/default.nix
index 7989713d4a3..214551cf237 100644
--- a/pkgs/applications/networking/instant-messengers/session-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/session-desktop/default.nix
@@ -8,12 +8,12 @@
 }:
 
 let
-  version = "1.11.3";
+  version = "1.11.4";
   pname = "session-desktop";
 
   src = fetchurl {
     url = "https://github.com/oxen-io/session-desktop/releases/download/v${version}/session-desktop-linux-x86_64-${version}.AppImage";
-    hash = "sha256-HdgW7Ls0h75BXKXGzzf37K9w4bgkfA9eAUEmBrSDT+U=";
+    hash = "sha256-fSa113BYpTZ4jvxroQsoslAkWfQr4/ROkgVOFyiVsKQ=";
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index a18afedaecd..0e66707349d 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -1,12 +1,12 @@
 { callPackage }: builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; })) {
   signal-desktop = {
     dir = "Signal";
-    version = "6.38.0";
-    hash = "sha256-y2mwO7Qc01vuIeJUcAxYDD97DXOwXCd8wNZmkG4maF0=";
+    version = "6.39.0";
+    hash = "sha256-cG8ZFWpx92haTgMkpMMcFDV0OB7lmU540g9fNj4ofy8=";
   };
   signal-desktop-beta = {
     dir = "Signal Beta";
-    version = "6.39.0-beta.2";
-    hash = "sha256-1+1wvkMtEovBBs2bS9zUV5kpSxkPy0EqBAU01el8uko=";
+    version = "6.40.0-beta.1";
+    hash = "sha256-daXh1Uh2lHw0NA/j7qhQK7nrVljbr/fP2iLjcqnuvns=";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/tg_owt.nix b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/tg_owt.nix
index b5879ffe5b4..694021d0f7f 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/tg_owt.nix
@@ -82,15 +82,15 @@ stdenv.mkDerivation {
     })
   ];
 
-  postPatch = lib.optionalString stdenv.isLinux ''
+  postPatch = ''
+    rm -r src/third_party/libsrtp
+    cp -r --no-preserve=mode ${libsrtp} src/third_party/libsrtp
+  '' + lib.optionalString stdenv.isLinux ''
     substituteInPlace src/modules/desktop_capture/linux/egl_dmabuf.cc \
       --replace '"libEGL.so.1"' '"${libGL}/lib/libEGL.so.1"' \
       --replace '"libGL.so.1"' '"${libGL}/lib/libGL.so.1"' \
       --replace '"libgbm.so.1"' '"${mesa}/lib/libgbm.so.1"' \
       --replace '"libdrm.so.2"' '"${libdrm}/lib/libdrm.so.2"'
-
-    rm -r src/third_party/libsrtp
-    cp -r --no-preserve=mode ${libsrtp} src/third_party/libsrtp
   '';
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/applications/networking/mailreaders/afew/default.nix b/pkgs/applications/networking/mailreaders/afew/default.nix
index c5a07a89c35..a9becb9d8c9 100644
--- a/pkgs/applications/networking/mailreaders/afew/default.nix
+++ b/pkgs/applications/networking/mailreaders/afew/default.nix
@@ -1,40 +1,48 @@
-{ lib, python3Packages, fetchPypi, notmuch }:
+{ lib, python3Packages, fetchPypi, pkgs }:
 
 python3Packages.buildPythonApplication rec {
   pname = "afew";
   version = "3.0.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "0wpfqbqjlfb9z0hafvdhkm7qw56cr9kfy6n8vb0q42dwlghpz1ff";
   };
 
-  nativeBuildInputs = with python3Packages; [ sphinx setuptools-scm ];
-
-  propagatedBuildInputs = with python3Packages; [
-    python3Packages.setuptools python3Packages.notmuch chardet dkimpy
+  nativeBuildInputs = with python3Packages; [
+    sphinxHook
+    setuptools
+    setuptools-scm
   ];
 
-  nativeCheckInputs = with python3Packages; [
-    freezegun notmuch
+  sphinxBuilders = [
+    "html"
+    "man"
   ];
 
-  makeWrapperArgs = [
-    ''--prefix PATH ':' "${notmuch}/bin"''
+  propagatedBuildInputs = with python3Packages; [
+    chardet
+    dkimpy
+    notmuch
   ];
 
-  outputs = [ "out" "doc" ];
+  nativeCheckInputs = [
+    pkgs.notmuch
+  ] ++ (with python3Packages; [
+    freezegun
+    pytestCheckHook
+  ]);
 
-  postBuild =  ''
-    ${python3Packages.python.pythonOnBuildForHost.interpreter} setup.py build_sphinx -b html,man
-  '';
-
-  postInstall = ''
-    install -D -v -t $out/share/man/man1 build/sphinx/man/*
-    mkdir -p $out/share/doc/afew
-    cp -R build/sphinx/html/* $out/share/doc/afew
-  '';
+  makeWrapperArgs = [
+    ''--prefix PATH ':' "${pkgs.notmuch}/bin"''
+  ];
 
+  outputs = [
+    "out"
+    "doc"
+    "man"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/afewmail/afew";
diff --git a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
index 44eba5bc021..0d0be882f43 100644
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@@ -3,12 +3,12 @@ electron, libsecret }:
 
 stdenv.mkDerivation rec {
   pname = "tutanota-desktop";
-  version = "3.118.13";
+  version = "3.118.27";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/${pname}-${version}-unpacked-linux.tar.gz";
     name = "tutanota-desktop-${version}.tar.gz";
-    hash = "sha256-3kpfF/XG7w6qUooS5UsntMKnggG1LhmV9f+R35kkmb0=";
+    hash = "sha256-z2Ir8O7IDiE7cYuLshpMQMnOJanaECUvKlUEyPayIPo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/newsreaders/pan/default.nix b/pkgs/applications/networking/newsreaders/pan/default.nix
index 839766e2ac7..82f8ec4d55b 100644
--- a/pkgs/applications/networking/newsreaders/pan/default.nix
+++ b/pkgs/applications/networking/newsreaders/pan/default.nix
@@ -22,14 +22,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pan";
-  version = "0.154";
+  version = "0.155";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-o+JFUraSoQ0HDmldHvTX+X7rl2L4n4lJmI4UFZrsfkQ=";
+    hash = "sha256-DsoTqZLcZOc3HlpCC8rmu/rcFeHkb9IWd4PSLwxKqJI=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config gettext intltool itstool libxml2 makeWrapper ];
diff --git a/pkgs/applications/networking/onionshare/default.nix b/pkgs/applications/networking/onionshare/default.nix
index b9c88bf3bdc..d1aef518083 100644
--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@@ -8,6 +8,8 @@
 , flask
 , flask-httpauth
 , flask-socketio
+, gevent-socketio
+, gevent-websocket
 , cepa
 , psutil
 , pyqt5
@@ -80,6 +82,8 @@ rec {
       flask
       flask-httpauth
       flask-socketio
+      gevent-socketio
+      gevent-websocket
       cepa
       psutil
       pycrypto
diff --git a/pkgs/applications/office/timeular/default.nix b/pkgs/applications/office/timeular/default.nix
index c576319643f..824a20a3132 100644
--- a/pkgs/applications/office/timeular/default.nix
+++ b/pkgs/applications/office/timeular/default.nix
@@ -5,12 +5,12 @@
 }:
 
 let
-  version = "6.5.0";
+  version = "6.6.0";
   pname = "timeular";
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/timeular-desktop-packages/linux/production/Timeular-${version}.AppImage";
-    sha256 = "sha256-RO8PhEjvDye6p6vgqNexIJ1ymTlVtF8yWQAUbJGaZYk=";
+    sha256 = "sha256-RmWRNKy2w3BM/ipQyFpkNC3+XXsJXjN6VYWNo8OKpy0=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/radio/freedv/default.nix b/pkgs/applications/radio/freedv/default.nix
index 66a932b9c99..a337470664a 100644
--- a/pkgs/applications/radio/freedv/default.nix
+++ b/pkgs/applications/radio/freedv/default.nix
@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freedv";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "drowe67";
     repo = "freedv-gui";
     rev = "v${version}";
-    hash = "sha256-3SQ3a1gg4/cXy8BJXazTgh6nkS/KQpM0fCA6JcbHOPc=";
+    hash = "sha256-uCWdDmHzNx1vkZFttQZLD4YfXoXz5VZQfir9sGOoDhw=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
       --replace "-Wl,-ld_classic" ""
     substituteInPlace src/CMakeLists.txt \
       --replace "\''${CMAKE_SOURCE_DIR}/macdylibbundler/dylibbundler" "dylibbundler"
-    sed -i "/hdiutil/d" src/CMakeLists.txt
+    sed -i "/codesign/d;/hdiutil/d" src/CMakeLists.txt
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/electronics/picoscope/sources.json b/pkgs/applications/science/electronics/picoscope/sources.json
index 15a748dc7ce..6b1d81978b9 100644
--- a/pkgs/applications/science/electronics/picoscope/sources.json
+++ b/pkgs/applications/science/electronics/picoscope/sources.json
@@ -1,69 +1,69 @@
 {
   "x86_64-linux": {
     "libpicocv": {
-      "sha256": "feddc1cb9082005e80c4e2c2732ee4c537915c463ea327aa53a642aab95b8691",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libpicocv/libpicocv_1.1.33-beta2r167_amd64.deb",
-      "version": "1.1.33-beta2r167"
+      "sha256": "c0c5bec33c2c7fdd0f26b035ed942175f87012e33d6764c3abf1da31b5626037",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libpicocv/libpicocv_1.1.34-beta2r172_amd64.deb",
+      "version": "1.1.34-beta2r172"
     },
     "libpicoipp": {
-      "sha256": "2d749b8fd5dbd811c270e4aa78c5ee9cd33832b90d089ae386b0f85aed2d0204",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libpicoipp/libpicoipp_1.4.0-4r136_amd64.deb",
-      "version": "1.4.0-4r136"
+      "sha256": "4a84f0af7f4e8cba91fad620eac0cd23c36b2fdda4637904be564286b10ffe1d",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libpicoipp/libpicoipp_1.4.0-4r161_amd64.deb",
+      "version": "1.4.0-4r161"
     },
     "libps2000": {
-      "sha256": "d306890d1e87651ae83ef00143c8e62b82fae2be39886b6884408751cb910fa4",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps2000/libps2000_3.0.89-3r3163_amd64.deb",
-      "version": "3.0.89-3r3163"
+      "sha256": "473b065e79a7414c1e2b8c8468c8d2654333ac28f3a8c33b535626b33c60d2ca",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps2000/libps2000_3.0.127-3r5552_amd64.deb",
+      "version": "3.0.127-3r5552"
     },
     "libps2000a": {
-      "sha256": "38391dfbe6c6c04ba5b5c99bd53404d5342e40c9eca703e3d95cbc6302114270",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps2000a/libps2000a_2.1.89-5r3163_amd64.deb",
-      "version": "2.1.89-5r3163"
+      "sha256": "8eba0052f9c7ef327710f2fba5aa11bec0c20225b39d77bb7b69cf80055c039c",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps2000a/libps2000a_2.1.127-5r5552_amd64.deb",
+      "version": "2.1.127-5r5552"
     },
     "libps3000": {
-      "sha256": "39b4b56a839eb5d7abcf1de2bab472c2de2d8aa5ffc3ba445e99d5aa8178ba07",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps3000/libps3000_4.0.89-3r3163_amd64.deb",
-      "version": "4.0.89-3r3163"
+      "sha256": "4e786036b8de0dd0f922aed947f30a53d31bed46b2df5132e8c9480c8a5d93e9",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps3000/libps3000_4.0.127-3r5552_amd64.deb",
+      "version": "4.0.127-3r5552"
     },
     "libps3000a": {
-      "sha256": "ea96735b90d02c72c9c7b517413fed0d366ac634100e22467a39c780985669e4",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps3000a/libps3000a_2.1.89-6r3163_amd64.deb",
-      "version": "2.1.89-6r3163"
+      "sha256": "d2bb1e5bb151b0953ed30ca5421bb93d05dab898c33cdc89927e943ea991867a",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps3000a/libps3000a_2.1.127-6r5552_amd64.deb",
+      "version": "2.1.127-6r5552"
     },
     "libps4000": {
-      "sha256": "7177cd4debf811fa7d7105703a4fc546fe1a79fc3275e3f36326b014c1334f55",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps4000/libps4000_2.1.89-2r3163_amd64.deb",
-      "version": "2.1.89-2r3163"
+      "sha256": "4c127e67949835b5ab5c5c8caa55f73c69df354d761aa53d6df99c8f8ac39009",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps4000/libps4000_2.1.127-2r5552_amd64.deb",
+      "version": "2.1.127-2r5552"
     },
     "libps4000a": {
-      "sha256": "ebe94d6d9f349e5082dcbed55d059ac77c0129b967467786d1cef3f662ebac99",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps4000a/libps4000a_2.1.89-2r3163_amd64.deb",
-      "version": "2.1.89-2r3163"
+      "sha256": "26df82bc946e5bb30d599c4c365247bdbaa01e830d4d00630b46a6abcc1eef04",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps4000a/libps4000a_2.1.127-2r5552_amd64.deb",
+      "version": "2.1.127-2r5552"
     },
     "libps5000": {
-      "sha256": "732164658acb4bdfdbf3fc785419ea6a4944ed2892be9dde134b345a976c3318",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps5000/libps5000_2.1.89-3r3163_amd64.deb",
-      "version": "2.1.89-3r3163"
+      "sha256": "106ef17862e98c3621f95c377f271c843664f481f84ef918d9eadd013561cd1b",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps5000/libps5000_2.1.127-3r5552_amd64.deb",
+      "version": "2.1.127-3r5552"
     },
     "libps5000a": {
-      "sha256": "3438f51c8646e3ac5a479c88aa7a89b3dfcce2090720317b4efb8db538372cdb",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps5000a/libps5000a_2.1.89-5r3163_amd64.deb",
-      "version": "2.1.89-5r3163"
+      "sha256": "fe9def134ef9df6654485911f14ece7b2ee3d79113aeee7826dd6e36bb5de3b4",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps5000a/libps5000a_2.1.127-5r5552_amd64.deb",
+      "version": "2.1.127-5r5552"
     },
     "libps6000": {
-      "sha256": "fe4165ab0d323728b473347b61439b074486809d673e47f169d0062cf917191c",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps6000/libps6000_2.1.89-6r3163_amd64.deb",
-      "version": "2.1.89-6r3163"
+      "sha256": "9b08c5b7fb2d34b0e2e98f2e0452a59105f612cd445a9e45d3cac14d931d18f2",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps6000/libps6000_2.1.127-6r5552_amd64.deb",
+      "version": "2.1.127-6r5552"
     },
     "libps6000a": {
-      "sha256": "0552811f92a015ef47b09947631f5f5d8c30b122425de083bea79df88957a9c7",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps6000a/libps6000a_1.0.89-0r3163_amd64.deb",
-      "version": "1.0.89-0r3163"
+      "sha256": "2a23ccad72b9be83b87d449b6bb8ded23fd29c85ec9f78a45b6d45b38ccf335b",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/libp/libps6000a/libps6000a_1.0.127-0r5552_amd64.deb",
+      "version": "1.0.127-0r5552"
     },
     "picoscope": {
-      "sha256": "b060edb02bc2de5d10a45d31d4b7f9c767d18511e2f65a1ebdd70cc3e8780262",
-      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/p/picoscope/picoscope_7.0.100-1r11387_amd64.deb",
-      "version": "7.0.100-1r11387"
+      "sha256": "d95f269171da7273b596dae95452789e889f12ef0f15c3baea26dd1b3a8117fc",
+      "url": "https://labs.picotech.com/rc/picoscope7/debian/pool/main/p/picoscope/picoscope_7.1.17-1r17318_amd64.deb",
+      "version": "7.1.17-1r17318"
     }
   }
 }
diff --git a/pkgs/applications/science/math/eigenmath/default.nix b/pkgs/applications/science/math/eigenmath/default.nix
index 603a3c4f60b..1e80d9a06eb 100644
--- a/pkgs/applications/science/math/eigenmath/default.nix
+++ b/pkgs/applications/science/math/eigenmath/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "unstable-2023-10-26";
+  version = "unstable-2023-11-17";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "043895fbaed27a4baace7c7c0c1f69ea5a9f3d1a";
-    hash = "sha256-roPyRaT89I3HbyvBK/owiigMus1EeKEhhKHFsgfzp10=";
+    rev = "b0d822f10243ad5b1c88efb5a82b43a0bbf1bfbc";
+    hash = "sha256-eJ/EmzV5UZGxwZNIna/XXkYY+vkLc610KcywBFPRfyM=";
   };
 
   checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
diff --git a/pkgs/applications/terminal-emulators/rio/default.nix b/pkgs/applications/terminal-emulators/rio/default.nix
index afd3205343e..950d2f8f401 100644
--- a/pkgs/applications/terminal-emulators/rio/default.nix
+++ b/pkgs/applications/terminal-emulators/rio/default.nix
@@ -1,4 +1,6 @@
 { lib
+, stdenv
+, darwin
 , fetchFromGitHub
 , rustPlatform
 , nixosTests
@@ -14,18 +16,21 @@
 , vulkan-loader
 , libxkbcommon
 
-, withX11 ? true
+, withX11 ? !stdenv.isDarwin
 , libX11
 , libXcursor
 , libXi
 , libXrandr
 , libxcb
 
-, withWayland ? true
+, withWayland ? !stdenv.isDarwin
 , wayland
 }:
 let
-  rlinkLibs = [
+  rlinkLibs = if stdenv.isDarwin then [
+    darwin.libobjc
+    darwin.apple_sdk.frameworks.AppKit
+  ] else [
     (lib.getLib gcc-unwrapped)
     fontconfig
     libGL
@@ -55,9 +60,10 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-XD+/DaaJEJ9jHZITTUma/wfsbduPUTc/SralPOx46Yo=";
 
   nativeBuildInputs = [
-    autoPatchelfHook
     ncurses
+  ] ++ lib.optionals stdenv.isLinux [
     pkg-config
+    autoPatchelfHook
   ];
 
   runtimeDependencies = rlinkLibs;
@@ -67,10 +73,9 @@ rustPlatform.buildRustPackage rec {
   outputs = [ "out" "terminfo" ];
 
   buildNoDefaultFeatures = true;
-  buildFeatures = [
-    (lib.optionalString withX11 "x11")
-    (lib.optionalString withWayland "wayland")
-  ];
+  buildFeatures = [ ]
+    ++ lib.optional withX11 "x11"
+    ++ lib.optional withWayland "wayland";
 
   checkFlags = [
     # Fail to run in sandbox environment.
@@ -86,6 +91,11 @@ rustPlatform.buildRustPackage rec {
     tic -xe rio,rio-direct -o "$terminfo/share/terminfo" misc/rio.terminfo
     mkdir -p $out/nix-support
     echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
+  '' + lib.optionalString stdenv.isDarwin ''
+    mkdir $out/Applications/
+    mv misc/osx/Rio.app/ $out/Applications/
+    mkdir $out/Applications/Rio.app/Contents/MacOS/
+    ln -s $out/bin/rio $out/Applications/Rio.app/Contents/MacOS/
   '';
 
   passthru = {
diff --git a/pkgs/applications/video/showmethekey/default.nix b/pkgs/applications/video/showmethekey/default.nix
index 6a403e25c64..cd61cfc9d0d 100644
--- a/pkgs/applications/video/showmethekey/default.nix
+++ b/pkgs/applications/video/showmethekey/default.nix
@@ -7,19 +7,20 @@
 , json-glib
 , libinput
 , gtk4
+, libadwaita
 , wrapGAppsHook4
 , libxkbcommon
 , pkg-config
 }:
 stdenv.mkDerivation rec {
   pname = "showmethekey";
-  version = "1.8.1";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "AlynxZhou";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IfegYHHFbZbMTA8JWXAun9Gl3BpykH/5RqUIrlYlLhk=";
+    hash = "sha256-eeObomb4Gv/vpvViHsi3+O0JR/rYamrlZNZaXKL6KJw=";
   };
 
   nativeBuildInputs = [
@@ -32,6 +33,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     gtk4
+    libadwaita
     libevdev
     libinput
     libxkbcommon
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index 3ff03781732..82e814610dc 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "1.7.8";
+  version = "1.7.9";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    hash = "sha256-p16qHJD0i0ZNEFGEbfmbxiedX9/uHkZxhCeB3x/5iLM=";
+    hash = "sha256-/kCnzOL8CJuJJglHzmev3alt8cMwTUbIiZhNft9zwps=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/ecs-agent/default.nix b/pkgs/applications/virtualization/ecs-agent/default.nix
index 34cb0cc757c..8a016147686 100644
--- a/pkgs/applications/virtualization/ecs-agent/default.nix
+++ b/pkgs/applications/virtualization/ecs-agent/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "amazon-ecs-agent";
-  version = "1.78.0";
+  version = "1.78.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aws";
     repo = pname;
-    hash = "sha256-/FppBl25AgwZhNcwWmUc0ThaTm1U4lhaoCTTJ/R/srI=";
+    hash = "sha256-8/hHv5veTQXNg8c5oew+5FWLAQkytTD2+Gdb30sY9lo=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index 9c19818b2f6..e35a5d16a49 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.18.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-GmIrz23z/vV6Ut31pajUmPfT9V37Ajs5JaIMD1Ociu8=";
+    sha256 = "sha256-yeZGhE+ImWXW3HPpAo+E1GOSEwPr7yK78XVmCocGqH4=";
   };
 
-  cargoHash = "sha256-AwDaIHuD/0H/SkhxT/V0/4K/5yp+s5DI34e8JQgajgc=";
+  cargoHash = "sha256-xqKYd80PCM7Rnj+9dV2XjigE4sweOnL4HfOQiOYzCEQ=";
 
   # skip test due FHS dependency
   doCheck = false;
diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix
index 99ab52dece2..8a86f06785b 100644
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@@ -38,20 +38,20 @@ let
   singularity = callPackage
     (import ./generic.nix rec {
       pname = "singularity-ce";
-      version = "4.0.1";
+      version = "4.0.2";
       projectName = "singularity";
 
       src = fetchFromGitHub {
         owner = "sylabs";
         repo = "singularity";
         rev = "refs/tags/v${version}";
-        hash = "sha256-rdpIAiLh4mlSu+1UUDN79gIzxy5X5wOB5XOW9oBm+HU=";
+        hash = "sha256-R+vAKYR4lJmC7PIITYyg4UeGYjGXoPqqUai3HmPzwG0=";
       };
 
       # Update by running
       # nix-prefetch -E "{ sha256 }: ((import ./. { }).singularity.override { vendorHash = sha256; }).goModules"
       # at the root directory of the Nixpkgs repository
-      vendorHash = "sha256-kV4Yu9MBoF8spJroWqLOUt2v8YV79AoNUG9hYgPgXRc=";
+      vendorHash = "sha256-z3VozeMpaqh4ddZxB3xqo25Gm+8JYeIwASOq+Mmerr4=";
 
       # Do not build conmon and squashfuse from the Git submodule sources,
       # Use Nixpkgs provided version
diff --git a/pkgs/applications/window-managers/cagebreak/default.nix b/pkgs/applications/window-managers/cagebreak/default.nix
index 63a5e8613e1..1f07da0a7bc 100644
--- a/pkgs/applications/window-managers/cagebreak/default.nix
+++ b/pkgs/applications/window-managers/cagebreak/default.nix
@@ -6,6 +6,7 @@
 , libevdev
 , libinput
 , libxkbcommon
+, xcbutilwm
 , makeWrapper
 , mesa
 , meson
@@ -24,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cagebreak";
-  version = "1.9.1";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "project-repo";
     repo = pname;
     rev = version;
-    hash = "sha256-pU1QHYOqnkb3L4iSKbZY9Vo60Z6EaX9mp2Nw48NSPic=";
+    hash = "sha256-cJEJ8V9lDbNb07eY3nWmNcT7ULGlcmOeyb9UDOLGWfI=";
   };
 
   nativeBuildInputs = [
@@ -48,6 +49,7 @@ stdenv.mkDerivation rec {
     libevdev
     libinput
     libxkbcommon
+    xcbutilwm
     mesa # for libEGL headers
     pango
     pixman
@@ -69,6 +71,8 @@ stdenv.mkDerivation rec {
 
     # Patch cagebreak to read its default configuration from $out/share/cagebreak
     sed -i "s|/etc/xdg/cagebreak|$out/share/cagebreak|" meson.build cagebreak.c
+    substituteInPlace meson.build \
+      --replace "/usr/share/licenses" "$out/share/licenses"
   '';
 
   postFixup = lib.optionalString withXwayland ''
diff --git a/pkgs/applications/window-managers/e16/default.nix b/pkgs/applications/window-managers/e16/default.nix
index 2f9475054c3..d47b63dda4d 100644
--- a/pkgs/applications/window-managers/e16/default.nix
+++ b/pkgs/applications/window-managers/e16/default.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "e16";
-  version = "1.0.28";
+  version = "1.0.29";
 
   src = fetchurl {
     url = "mirror://sourceforge/enlightenment/e16-${version}.tar.xz";
-    hash = "sha256-k3W2IoBc75DNQ2QSjChsC/yVRO/aZT3E31Tl/njgH30=";
+    hash = "sha256-LvLiw6+hduAl8dNBTtBwqvgKBRwojBUd5tNm1hZl5Hs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/window-managers/leftwm/default.nix b/pkgs/applications/window-managers/leftwm/default.nix
index 91a13df5c21..bbf1cefacd4 100644
--- a/pkgs/applications/window-managers/leftwm/default.nix
+++ b/pkgs/applications/window-managers/leftwm/default.nix
@@ -1,4 +1,9 @@
-{ stdenv, lib, fetchFromGitHub, rustPlatform, libX11, libXinerama }:
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, libX11
+, libXinerama
+}:
 
 let
   rpathLibs = [ libXinerama libX11 ];
@@ -6,16 +11,16 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "leftwm";
-  version = "0.4.2";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "leftwm";
     repo = "leftwm";
-    rev = version;
-    sha256 = "sha256-SjEp0gQHwq3Omhx/EPnyLeQJ50Ov0rHDxmYVWBwIDBs=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-wn5DurPWFwSUtc5naEL4lBSQpKWTJkugpN9mKx+Ed2Y=";
   };
 
-  cargoSha256 = "sha256-kdGqnfzO+Ev9QeZcZqISPTehEXZzCWT5S8p6JbTBreE=";
+  cargoHash = "sha256-TylRxdpAVuGtZ3Lm8je6FZ0JUwetBi6mOGRoT2M3Jyk=";
 
   buildInputs = rpathLibs;
 
@@ -23,16 +28,18 @@ rustPlatform.buildRustPackage rec {
     for p in $out/bin/left*; do
       patchelf --set-rpath "${lib.makeLibraryPath rpathLibs}" $p
     done
+
+    install -D -m 0555 leftwm/doc/leftwm.1 $out/share/man/man1/leftwm.1
   '';
 
   dontPatchELF = true;
 
-  meta = with lib; {
+  meta = {
     description = "A tiling window manager for the adventurer";
     homepage = "https://github.com/leftwm/leftwm";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ yanganto ];
-    changelog = "https://github.com/leftwm/leftwm/blob/${version}/CHANGELOG";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ yanganto ];
+    changelog = "https://github.com/leftwm/leftwm/blob/${version}/CHANGELOG.md";
   };
 }
diff --git a/pkgs/by-name/de/devdash/package.nix b/pkgs/by-name/de/devdash/package.nix
new file mode 100644
index 00000000000..210a016277f
--- /dev/null
+++ b/pkgs/by-name/de/devdash/package.nix
@@ -0,0 +1,52 @@
+{
+  lib
+, buildGoModule
+, fetchFromGitHub
+, nix-update-script
+, coreutils
+}:
+
+buildGoModule rec {
+  pname = "devdash";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "Phantas0s";
+    repo = "devdash";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-RUPpgMVl9Cm8uhztdfKnuQ6KdMn9m9PewlT59NnTSiY=";
+  };
+
+  vendorHash = "sha256-xuc8rAkyCInNFxs5itwabqBe4CPg/sAuhcTJsapx7Q8=";
+
+  ldflags = [
+    "-s -w"
+    "-X github.com/Phantas0s/devdash/cmd.current=${version}"
+    "-X github.com/Phantas0s/devdash/cmd.buildDate=1970-01-01-00:00:01"
+  ];
+
+  patchPhase = ''
+    runHook prePatch
+
+    shopt -s globstar
+    substituteInPlace **/*.go --replace '"/bin/' '"/usr/bin/env '
+    shopt -u globstar
+
+    runHook postPatch
+  '';
+
+  runtimeDependencies = [
+    coreutils
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Highly configurable terminal dashboard for developers and creators";
+    homepage = "https://github.com/Phantas0s/devdash";
+    changelog = "https://github.com/Phantas0s/devdash/blob/v${version}/CHANGELOG.md";
+    maintainers = with lib.maintainers; [ h7x4 ];
+    license = lib.licenses.asl20;
+    mainProgram = "devdash";
+  };
+}
diff --git a/pkgs/by-name/dx/dxvk_1/package.nix b/pkgs/by-name/dx/dxvk_1/package.nix
index 44a39eeaba2..a02680d77ee 100644
--- a/pkgs/by-name/dx/dxvk_1/package.nix
+++ b/pkgs/by-name/dx/dxvk_1/package.nix
@@ -9,9 +9,6 @@
 , enableMoltenVKCompat ? false
 }:
 
-let
-  isCross = stdenv.hostPlatform != stdenv.targetPlatform;
-in
 stdenv.mkDerivation (finalAttrs:  {
   pname = "dxvk";
   version = "1.10.3";
@@ -36,15 +33,10 @@ stdenv.mkDerivation (finalAttrs:  {
   nativeBuildInputs = [ glslang meson ninja ];
   buildInputs = [ windows.pthreads ];
 
-  mesonFlags =
-    let
-      arch = if stdenv.is32bit then "32" else "64";
-    in
-    [
-      "--buildtype" "release"
-      "--prefix" "${placeholder "out"}"
-    ]
-    ++ lib.optionals isCross [ "--cross-file" "build-win${arch}.txt" ];
+  mesonFlags = [
+    "--buildtype" "release"
+    "--prefix" "${placeholder "out"}"
+  ];
 
   meta = {
     description = "A Vulkan-based translation layer for Direct3D 9/10/11";
diff --git a/pkgs/by-name/dx/dxvk_2/package.nix b/pkgs/by-name/dx/dxvk_2/package.nix
index e1fa64ffee0..8c589fd7258 100644
--- a/pkgs/by-name/dx/dxvk_2/package.nix
+++ b/pkgs/by-name/dx/dxvk_2/package.nix
@@ -19,7 +19,6 @@
 assert !sdl2Support || !glfwSupport;
 
 let
-  isCross = stdenv.hostPlatform != stdenv.targetPlatform;
   isWindows = stdenv.hostPlatform.uname.system == "Windows";
 in
 stdenv.mkDerivation (finalAttrs:  {
@@ -51,18 +50,12 @@ stdenv.mkDerivation (finalAttrs:  {
     mkdir -p include/spirv/include include/vulkan/include
   '';
 
-  mesonFlags =
-    let
-      arch = if stdenv.is32bit then "32" else "64";
-    in
-    [
-      "--buildtype" "release"
-      "--prefix" "${placeholder "out"}"
-    ]
-    ++ lib.optionals isCross [ "--cross-file" "build-win${arch}.txt" ]
-    ++ lib.optional glfwSupport "-Ddxvk_native_wsi=glfw";
+  mesonFlags = [
+    "--buildtype" "release"
+    "--prefix" "${placeholder "out"}"
+  ] ++ lib.optional glfwSupport "-Ddxvk_native_wsi=glfw";
 
-  doCheck = !isCross;
+  doCheck = true;
 
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
diff --git a/pkgs/by-name/ek/eksctl/package.nix b/pkgs/by-name/ek/eksctl/package.nix
index a670490ef0a..28ebab5239a 100644
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.163.0";
+  version = "0.164.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-rpyLjoHMSgEHTILeEQpUKD7BOJHn/uT3GK6Fquirzdk=";
+    hash = "sha256-ENlMcwk4bMbIzV353vt+EG776+/ajrg5la3JeA81QS4=";
   };
 
   vendorHash = "sha256-NOhssVWEkvoXpmnsCVVT7Li0ePGWDSGIlB2MyFtMnpI=";
diff --git a/pkgs/applications/misc/free42/default.nix b/pkgs/by-name/fr/free42/package.nix
index dd8405772ca..d821bbf628f 100644
--- a/pkgs/applications/misc/free42/default.nix
+++ b/pkgs/by-name/fr/free42/package.nix
@@ -1,22 +1,22 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, makeDesktopItem
+, alsa-lib
 , copyDesktopItems
-, pkg-config
 , gtk3
-, alsa-lib
+, makeDesktopItem
+, pkg-config
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "free42";
-  version = "3.0.21";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner = "thomasokken";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-zRO0buYfKtybUisWZJRkvLJVLJYZwLcDnT04rnQWy+s=";
+    repo = "free42";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-v3nZMjV9KnoTefeu2jl3k1B7efnJnNVOAfDVLyce6QI=";
   };
 
   nativeBuildInputs = [
@@ -35,6 +35,27 @@ stdenv.mkDerivation rec {
 
   dontConfigure = true;
 
+  desktopItems = [
+    (makeDesktopItem {
+      name = "com.thomasokken.free42bin";
+      desktopName = "Free42Bin";
+      genericName = "Calculator";
+      exec = "free42bin";
+      type = "Application";
+      comment = finalAttrs.meta.description;
+      categories = [ "Utility" "Calculator" ];
+    })
+    (makeDesktopItem {
+      name = "com.thomasokken.free42dec";
+      desktopName = "Free42Dec";
+      genericName = "Calculator";
+      exec = "free42dec";
+      type = "Application";
+      comment = finalAttrs.meta.description;
+      categories = [ "Utility" "Calculator" ];
+    })
+  ];
+
   buildPhase = ''
     runHook preBuild
 
@@ -50,48 +71,28 @@ stdenv.mkDerivation rec {
     runHook preInstall
 
     install --directory $out/bin \
-                        $out/share/doc/${pname} \
-                        $out/share/${pname}/skins \
+                        $out/share/doc/free42 \
+                        $out/share/free42/skins \
                         $out/share/icons/hicolor/48x48/apps \
                         $out/share/icons/hicolor/128x128/apps
 
     install -m755 gtk/free42dec gtk/free42bin $out/bin
-    install -m644 gtk/README $out/share/doc/${pname}/README-GTK
-    install -m644 README $out/share/doc/${pname}/README
+    install -m644 gtk/README $out/share/doc/free42/README-GTK
+    install -m644 README $out/share/doc/free42/README
 
     install -m644 gtk/icon-48x48.xpm $out/share/icons/hicolor/48x48/apps
     install -m644 gtk/icon-128x128.xpm $out/share/icons/hicolor/128x128/apps
-    install -m644 skins/* $out/share/${pname}/skins
+    install -m644 skins/* $out/share/free42/skins
 
     runHook postInstall
   '';
 
-  desktopItems = [
-    (makeDesktopItem {
-      name = "com.thomasokken.free42bin";
-      desktopName = "Free42Bin";
-      genericName = "Calculator";
-      exec = "free42bin";
-      type = "Application";
-      comment = meta.description;
-      categories = [ "Utility" "Calculator" ];
-    })
-    (makeDesktopItem {
-      name = "com.thomasokken.free42dec";
-      desktopName = "Free42Dec";
-      genericName = "Calculator";
-      exec = "free42dec";
-      type = "Application";
-      comment = meta.description;
-      categories = [ "Utility" "Calculator" ];
-    })
-  ];
-
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/thomasokken/free42";
     description = "A software clone of HP-42S Calculator";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ AndersonTorres plabadens ];
-    platforms = with platforms; unix;
+    license = with lib.licenses; [ gpl2Only ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    mainProgram = "free42dec";
+    platforms = with lib.platforms; unix;
   };
-}
+})
diff --git a/pkgs/by-name/ho/hof/package.nix b/pkgs/by-name/ho/hof/package.nix
new file mode 100644
index 00000000000..d5ca54ea5be
--- /dev/null
+++ b/pkgs/by-name/ho/hof/package.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "hof";
+  version = "0.6.9-beta.1";
+
+  src = fetchFromGitHub {
+    owner = "hofstadter-io";
+    repo = "hof";
+    rev = "v${version}";
+    hash = "sha256-4yVP6DRHrsp52VxBhr7qppPhInYEsvPbIfxxQcRwHTw=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  vendorHash = "sha256-cDUcYwcxPn+9TEP5lhVJXofijCZX94Is+Qt41PqUgjI=";
+
+  subPackages = [ "./cmd/hof/main.go" ];
+
+  postInstall = ''
+    mv $out/bin/main $out/bin/hof
+    local INSTALL="$out/bin/hof"
+    installShellCompletion --cmd hof \
+      --bash <($out/bin/hof completion bash) \
+      --fish <($out/bin/hof completion fish) \
+      --zsh <($out/bin/hof completion zsh)
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/hofstadter-io/hof";
+    description = "Framework that joins data models, schemas, code generation, and a task engine. Language and technology agnostic";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jfvillablanca ];
+    mainProgram = "hof";
+  };
+}
diff --git a/pkgs/by-name/ni/nix-web/package.nix b/pkgs/by-name/ni/nix-web/package.nix
new file mode 100644
index 00000000000..e41e760a293
--- /dev/null
+++ b/pkgs/by-name/ni/nix-web/package.nix
@@ -0,0 +1,48 @@
+{ lib
+, rustPlatform
+, fetchFromGitea
+, pkg-config
+, openssl
+, nix
+}:
+
+let
+  cargoFlags = [ "-p" "nix-web" ];
+in
+rustPlatform.buildRustPackage rec {
+  pname = "nix-web";
+  version = "0.1.0";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "gorgon";
+    repo = "gorgon";
+    rev = "nix-web-v${version}";
+    hash = "sha256-+IDvoMRuMt1nS69yFhPPVs+s6Dj0dgXVdjjd9f3+spk=";
+  };
+  cargoHash = "sha256-uVBfIw++MRxgVAC+KzGVuMZra8oktUfHcZQk90FF1a8=";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  postPatch = ''
+    substituteInPlace nix-web/nix-web.service \
+      --replace 'ExecStart=nix-web' "ExecStart=$out/bin/nix-web"
+  '';
+  postInstall = ''
+    install -m 644 -D nix-web/nix-web.service $out/lib/systemd/system/nix-web.service
+  '';
+
+  cargoBuildFlags = cargoFlags;
+  cargoTestFlags = cargoFlags;
+
+  NIX_WEB_BUILD_NIX_CLI_PATH = "${nix}/bin/nix";
+
+  meta = with lib; {
+    description = "Web interface for the Nix store";
+    homepage = "https://codeberg.org/gorgon/gorgon/src/branch/main/nix-web";
+    license = licenses.eupl12;
+    maintainers = with maintainers; [ embr ];
+    mainProgram = "nix-web";
+  };
+}
diff --git a/pkgs/applications/networking/browsers/offpunk/default.nix b/pkgs/by-name/of/offpunk/package.nix
index e1b4fdcfa20..e0814a43ef8 100644
--- a/pkgs/applications/networking/browsers/offpunk/default.nix
+++ b/pkgs/by-name/of/offpunk/package.nix
@@ -1,14 +1,15 @@
-{
-  fetchFromSourcehut,
-  installShellFiles,
-  less,
-  lib,
-  offpunk,
-  python3Packages,
-  testers,
-  timg,
-  xdg-utils,
-  xsel,
+{ fetchFromSourcehut
+, file
+, installShellFiles
+, less
+, lib
+, offpunk
+, python3Packages
+, testers
+, timg
+, xdg-utils
+, xsel
+,
 }:
 
 let
@@ -23,6 +24,7 @@ let
     setproctitle
   ];
   otherDependencies = [
+    file
     less
     timg
     xdg-utils
@@ -31,7 +33,7 @@ let
 in
 python3Packages.buildPythonPackage rec {
   pname = "offpunk";
-  version = "1.10";
+  version = "2.0";
   format = "pyproject";
 
   disabled = python3Packages.pythonOlder "3.7";
@@ -40,23 +42,21 @@ python3Packages.buildPythonPackage rec {
     owner = "~lioploum";
     repo = "offpunk";
     rev = "v${version}";
-    hash = "sha256-+jGKPPnKZHn+l6VAwuae6kICwR7ymkYJjsM2OHQAEmU=";
+    hash = "sha256-6ftc2goCNgvXf5kszvjeSHn24Hn73jq26Irl5jiN6pk=";
   };
 
-  nativeBuildInputs = [ python3Packages.flit-core installShellFiles ];
+  nativeBuildInputs = [ python3Packages.hatchling installShellFiles ];
   propagatedBuildInputs = otherDependencies ++ pythonDependencies;
 
   postInstall = ''
     installManPage man/*.1
   '';
 
-  passthru.tests.version = testers.testVersion { package = offpunk; };
-
   meta = with lib; {
     description = "An Offline-First browser for the smolnet ";
     homepage = src.meta.homepage;
     maintainers = with maintainers; [ DamienCassou ];
     platforms = platforms.linux;
-    license = licenses.bsd2;
+    license = licenses.agpl3Plus;
   };
 }
diff --git a/pkgs/by-name/op/openai-triton-llvm/package.nix b/pkgs/by-name/op/openai-triton-llvm/package.nix
index 2fb56d0a635..5744cfa10c1 100644
--- a/pkgs/by-name/op/openai-triton-llvm/package.nix
+++ b/pkgs/by-name/op/openai-triton-llvm/package.nix
@@ -1,27 +1,49 @@
-{ config
-, lib
+{ lib
 , stdenv
 , fetchFromGitHub
+, pkgsBuildBuild
 , pkg-config
 , cmake
 , ninja
 , git
-, doxygen
-, sphinx
 , libxml2
 , libxcrypt
 , libedit
 , libffi
+, libpfm
 , mpfr
 , zlib
 , ncurses
+, doxygen
+, sphinx
+, which
+, sysctl
 , python3Packages
 , buildDocs ? true
 , buildMan ? true
 , buildTests ? true
+, llvmTargetsToBuild ? [ "NATIVE" ] # "NATIVE" resolves into x86 or aarch64 depending on stdenv
+, llvmProjectsToBuild ? [ "llvm" "mlir" ]
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+let
+  llvmNativeTarget =
+    if stdenv.hostPlatform.isx86_64 then "X86"
+    else if stdenv.hostPlatform.isAarch64 then "AArch64"
+    else throw "Currently unsupported LLVM platform '${stdenv.hostPlatform.config}'";
+
+  inferNativeTarget = t: if t == "NATIVE" then llvmNativeTarget else t;
+  llvmTargetsToBuild' = [ "AMDGPU" "NVPTX" ] ++ builtins.map inferNativeTarget llvmTargetsToBuild;
+
+  # This LLVM version can't seem to find pygments/pyyaml,
+  # but a later update will likely fix this (openai-triton-2.1.0)
+  python =
+    if buildTests
+    then python3Packages.python.withPackages (p: with p; [ psutil pygments pyyaml ])
+    else python3Packages.python;
+
+  isNative = stdenv.hostPlatform == stdenv.buildPlatform;
+in stdenv.mkDerivation (finalAttrs: {
   pname = "openai-triton-llvm";
   version = "14.0.6-f28c006a5895";
 
@@ -33,7 +55,8 @@ stdenv.mkDerivation (finalAttrs: {
     "man"
   ];
 
-  # See https://github.com/openai/triton/blob/main/python/setup.py and https://github.com/ptillet/triton-llvm-releases/releases
+  # See https://github.com/openai/triton/blob/main/python/setup.py
+  # and https://github.com/ptillet/triton-llvm-releases/releases
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "llvm-project";
@@ -46,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
     git
-    python3Packages.python
+    python
   ] ++ lib.optionals (buildDocs || buildMan) [
     doxygen
     sphinx
@@ -58,6 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxcrypt
     libedit
     libffi
+    libpfm
     mpfr
   ];
 
@@ -69,37 +93,55 @@ stdenv.mkDerivation (finalAttrs: {
   sourceRoot = "${finalAttrs.src.name}/llvm";
 
   cmakeFlags = [
-    "-DLLVM_TARGETS_TO_BUILD=${
-      let
-        # Targets can be found in
-        # https://github.com/llvm/llvm-project/tree/f28c006a5895fc0e329fe15fead81e37457cb1d1/clang/lib/Basic/Targets
-        # NOTE: Unsure of how "host" would function, especially given that we might be cross-compiling.
-        llvmTargets = [ "AMDGPU" "NVPTX" ]
-        ++ lib.optionals stdenv.isAarch64 [ "AArch64" ]
-        ++ lib.optionals stdenv.isx86_64 [ "X86" ];
-      in
-      lib.concatStringsSep ";" llvmTargets
-    }"
-    "-DLLVM_ENABLE_PROJECTS=llvm;mlir"
-    "-DLLVM_INSTALL_UTILS=ON"
-  ] ++ lib.optionals (buildDocs || buildMan) [
-    "-DLLVM_INCLUDE_DOCS=ON"
-    "-DMLIR_INCLUDE_DOCS=ON"
-    "-DLLVM_BUILD_DOCS=ON"
-    # "-DLLVM_ENABLE_DOXYGEN=ON" Way too slow, only uses one core
-    "-DLLVM_ENABLE_SPHINX=ON"
-    "-DSPHINX_OUTPUT_HTML=ON"
-    "-DSPHINX_OUTPUT_MAN=ON"
-    "-DSPHINX_WARNINGS_AS_ERRORS=OFF"
-  ] ++ lib.optionals buildTests [
-    "-DLLVM_INCLUDE_TESTS=ON"
-    "-DMLIR_INCLUDE_TESTS=ON"
-    "-DLLVM_BUILD_TESTS=ON"
-  ];
+    (lib.cmakeFeature "LLVM_TARGETS_TO_BUILD" (lib.concatStringsSep ";" llvmTargetsToBuild'))
+    (lib.cmakeFeature "LLVM_ENABLE_PROJECTS" (lib.concatStringsSep ";" llvmProjectsToBuild))
+    (lib.cmakeFeature "LLVM_HOST_TRIPLE" stdenv.hostPlatform.config)
+    (lib.cmakeFeature "LLVM_DEFAULT_TARGET_TRIPLE" stdenv.hostPlatform.config)
+    (lib.cmakeBool "LLVM_INSTALL_UTILS" true)
+    (lib.cmakeBool "LLVM_INCLUDE_DOCS" (buildDocs || buildMan))
+    (lib.cmakeBool "MLIR_INCLUDE_DOCS" (buildDocs || buildMan))
+    (lib.cmakeBool "LLVM_BUILD_DOCS" (buildDocs || buildMan))
+    # Way too slow, only uses one core
+    # (lib.cmakeBool "LLVM_ENABLE_DOXYGEN" (buildDocs || buildMan))
+    (lib.cmakeBool "LLVM_ENABLE_SPHINX" (buildDocs || buildMan))
+    (lib.cmakeBool "SPHINX_OUTPUT_HTML" buildDocs)
+    (lib.cmakeBool "SPHINX_OUTPUT_MAN" buildMan)
+    (lib.cmakeBool "SPHINX_WARNINGS_AS_ERRORS" false)
+    (lib.cmakeBool "LLVM_INCLUDE_TESTS" buildTests)
+    (lib.cmakeBool "MLIR_INCLUDE_TESTS" buildTests)
+    (lib.cmakeBool "LLVM_BUILD_TESTS" buildTests)
+  # Cross compilation code taken/modified from LLVM 16 derivation
+  ] ++ lib.optionals (!isNative) (let
+    nativeToolchainFlags = let
+      nativeCC = pkgsBuildBuild.targetPackages.stdenv.cc;
+      nativeBintools = nativeCC.bintools.bintools;
+    in [
+      (lib.cmakeFeature "CMAKE_C_COMPILER" "${nativeCC}/bin/${nativeCC.targetPrefix}cc")
+      (lib.cmakeFeature "CMAKE_CXX_COMPILER" "${nativeCC}/bin/${nativeCC.targetPrefix}c++")
+      (lib.cmakeFeature "CMAKE_AR" "${nativeBintools}/bin/${nativeBintools.targetPrefix}ar")
+      (lib.cmakeFeature "CMAKE_STRIP" "${nativeBintools}/bin/${nativeBintools.targetPrefix}strip")
+      (lib.cmakeFeature "CMAKE_RANLIB" "${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib")
+    ];
+
+    # We need to repass the custom GNUInstallDirs values, otherwise CMake
+    # will choose them for us, leading to wrong results in llvm-config-native
+    nativeInstallFlags = [
+      (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" (placeholder "out"))
+      (lib.cmakeFeature "CMAKE_INSTALL_BINDIR" "${placeholder "out"}/bin")
+      (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "${placeholder "out"}/include")
+      (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "${placeholder "out"}/lib")
+      (lib.cmakeFeature "CMAKE_INSTALL_LIBEXECDIR" "${placeholder "out"}/libexec")
+    ];
+  in [
+    (lib.cmakeBool "CMAKE_CROSSCOMPILING" true)
+    (lib.cmakeFeature "CROSS_TOOLCHAIN_FLAGS_NATIVE" (lib.concatStringsSep ";"
+      (lib.concatLists [ nativeToolchainFlags nativeInstallFlags ])))
+  ]);
 
   postPatch = ''
     # `CMake Error: cannot write to file "/build/source/llvm/build/lib/cmake/mlir/MLIRTargets.cmake": Permission denied`
     chmod +w -R ../mlir
+    patchShebangs ../mlir/test/mlir-reduce
 
     # FileSystem permissions tests fail with various special bits
     rm test/tools/llvm-objcopy/ELF/mirror-permissions-unix.test
@@ -107,9 +149,21 @@ stdenv.mkDerivation (finalAttrs: {
 
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "Path.cpp" ""
+  '' + lib.optionalString stdenv.isAarch64 ''
+    # Not sure why this fails
+    rm test/tools/llvm-exegesis/AArch64/latency-by-opcode-name.s
+  '';
+
+  postInstall = lib.optionalString (!isNative) ''
+    cp -a NATIVE/bin/llvm-config $out/bin/llvm-config-native
   '';
 
   doCheck = buildTests;
+
+  nativeCheckInputs = [ which ]
+    ++ lib.optionals stdenv.isDarwin [ sysctl ];
+
+  checkTarget = "check-all";
   requiredSystemFeatures = [ "big-parallel" ];
 
   meta = with lib; {
@@ -117,9 +171,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/llvm/llvm-project";
     license = with licenses; [ ncsa ];
     maintainers = with maintainers; [ SomeoneSerge Madouura ];
-    platforms = platforms.linux;
-    # Consider the derivation broken if we're not building for CUDA or ROCm, or if we're building for aarch64
-    # and ROCm is enabled. See https://github.com/RadeonOpenCompute/ROCm/issues/1831#issuecomment-1278205344.
-    broken = stdenv.isAarch64 && !config.cudaSupport;
+    platforms = with platforms; aarch64 ++ x86;
   };
 })
diff --git a/pkgs/by-name/py/pyprland/package.nix b/pkgs/by-name/py/pyprland/package.nix
index 751dbbd61e0..51bf3960959 100644
--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyprland";
-  version = "1.5.3";
+  version = "1.6.0";
   format = "pyproject";
 
   disabled = python3Packages.pythonOlder "3.10";
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
     owner = "hyprland-community";
     repo = "pyprland";
     rev = version;
-    hash = "sha256-PmE52pbEhc4+SkuyEeVUZoMVcbgK6CYA8HNwYPpgaIw=";
+    hash = "sha256-QbbBpaBIlU4IoU/NM7igDap8TxOKePQ8JI3ZlH944Bs=";
   };
 
   nativeBuildInputs = with python3Packages; [ poetry-core ];
diff --git a/pkgs/by-name/si/signaturepdf/package.nix b/pkgs/by-name/si/signaturepdf/package.nix
new file mode 100644
index 00000000000..be7c2fdd308
--- /dev/null
+++ b/pkgs/by-name/si/signaturepdf/package.nix
@@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, php
+, makeWrapper
+, imagemagick
+, librsvg
+, potrace
+, pdftk
+, ghostscript
+}:
+
+stdenv.mkDerivation rec {
+  pname = "signaturepdf";
+  version = "1.5.0";
+
+  src = fetchFromGitHub {
+    owner = "24eme";
+    repo = "${pname}";
+    rev = "v${version}";
+    hash = "sha256-7yhvTxpjxHcmRxTE7avM+dN+yz9iVr8Ea/e2yfkBURA=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/signaturepdf $out/bin
+
+    cp --target-directory=$out/share/signaturepdf --recursive \
+      app.php config locale public templates vendor
+
+    makeWrapper ${lib.getExe php} $out/bin/signaturepdf \
+      --inherit-argv0 \
+      --chdir $out/share/signaturepdf \
+      --prefix PATH : ${lib.makeBinPath [ imagemagick librsvg potrace pdftk ghostscript ]} \
+      --run 'port=$1' \
+      --run '[ $# -ge 1 ] || ( echo "Usage $0 <port> -d upload_max_filesize=24M -d post_max_size=24M -d max_file_uploads=201" >&2 && exit 1 )' \
+      --run 'shift' \
+      --run 'echo "You may now open a web browser on http://localhost:$port"' \
+      --add-flags '-S "localhost:$port" -t public'
+
+    runHook preInstall
+  '';
+
+  meta = with lib; {
+    description = "Web software for signing PDFs and also organize pages, edit metadata and compress pdf";
+    homepage = "https://pdf.24eme.fr/";
+    changelog =
+      "https://github.com/24eme/signaturepdf/releases/tag/v${version}";
+    license = licenses.agpl3;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ DamienCassou ];
+  };
+}
diff --git a/pkgs/by-name/sw/sway-audio-idle-inhibit/package.nix b/pkgs/by-name/sw/sway-audio-idle-inhibit/package.nix
new file mode 100644
index 00000000000..ae41f6a2368
--- /dev/null
+++ b/pkgs/by-name/sw/sway-audio-idle-inhibit/package.nix
@@ -0,0 +1,39 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, libpulseaudio
+, wayland
+, wayland-protocols
+}:
+stdenv.mkDerivation {
+  pname = "sway-audio-idle-inhibit";
+  version = "unstable-2023-08-09";
+
+  src = fetchFromGitHub {
+    owner = "ErikReider";
+    repo = "SwayAudioIdleInhibit";
+    rev = "c850bc4812216d03e05083c69aa05326a7fab9c7";
+    sha256 = "sha256-MKzyF5xY0uJ/UWewr8VFrK0y7ekvcWpMv/u9CHG14gs=";
+  };
+
+  nativeBuildInputs = [
+    meson ninja pkg-config
+  ];
+
+  buildInputs = [
+    libpulseaudio wayland wayland-protocols
+  ];
+
+  meta = with lib; {
+    description = "Prevents swayidle from sleeping while any application is outputting or receiving audio";
+    homepage = "https://github.com/ErikReider/SwayAudioIdleInhibit";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ rafaelrc ];
+    mainProgram = "sway-audio-idle-inhibit";
+  };
+}
+
diff --git a/pkgs/by-name/sw/sway-overfocus/package.nix b/pkgs/by-name/sw/sway-overfocus/package.nix
new file mode 100644
index 00000000000..08b6158d4f1
--- /dev/null
+++ b/pkgs/by-name/sw/sway-overfocus/package.nix
@@ -0,0 +1,30 @@
+{ fetchFromGitHub, lib, nix-update-script, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "sway-overfocus";
+  version = "0.2.3-fix";
+
+  src = fetchFromGitHub {
+    owner = "korreman";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-KHbYlxgrrZdNKJ7R9iVflbbP1c6qohM/NHBSYuzxEt4=";
+  };
+
+  cargoHash = "sha256-zp6PSu8P+ZUhrqi5Vxpe+z9zBaSkdVQBMGNP0FVOviQ=";
+
+  # Crate without tests.
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = ''"Better" focus navigation for sway and i3.'';
+    homepage = "https://github.com/korreman/sway-overfocus";
+    changelog = "https://github.com/korreman/sway-overfocus/releases/tag/${src.rev}";
+    license = licenses.mit;
+    maintainers = [ maintainers.ivan770 ];
+    mainProgram = "sway-overfocus";
+  };
+}
+
diff --git a/pkgs/by-name/wo/wordlists/package.nix b/pkgs/by-name/wo/wordlists/package.nix
index 16106707fd9..5edd1f5ece4 100644
--- a/pkgs/by-name/wo/wordlists/package.nix
+++ b/pkgs/by-name/wo/wordlists/package.nix
@@ -1,11 +1,8 @@
 { lib
-, callPackage
+, symlinkJoin
 , nmap
 , rockyou
-, runtimeShell
 , seclists
-, symlinkJoin
-, tree
 , wfuzz
 , lists ? [
     nmap
@@ -13,33 +10,39 @@
     seclists
     wfuzz
   ]
+, writeShellScriptBin
+, tree
 }:
+let
+  wordlistsCollection = symlinkJoin {
+    name = "wordlists-collection";
+    paths = lists;
 
-symlinkJoin rec {
-  pname = "wordlists";
-  version = "unstable-2023-10-10";
-
-  name = "${pname}-${version}";
-  paths = lists;
+    postBuild = ''
+      shopt -s extglob
+      rm -rf $out/!(share)
+      rm -rf $out/share/!(wordlists)
+      shopt -u extglob
+    '';
+  };
 
-  postBuild = ''
-    mkdir -p $out/bin
+  # A command to show the location of the links.
+  wordlistsBin = writeShellScriptBin "wordlists" ''
+    ${lib.getExe tree} ${wordlistsCollection}/share/wordlists
+  '';
+  # A command for easy access to the wordlists.
+  wordlistsPathBin = writeShellScriptBin "wordlists_path" ''
+    printf "${wordlistsCollection}/share/wordlists\n"
+  '';
 
-    # Create a command to show the location of the links.
-    cat >> $out/bin/wordlists << __EOF__
-    #!${runtimeShell}
-    ${tree}/bin/tree ${placeholder "out"}/share/wordlists
-    __EOF__
-    chmod +x $out/bin/wordlists
+in symlinkJoin {
+  name = "wordlists";
 
-    # Create a handy command for easy access to the wordlists.
-    # e.g.: `cat "$(wordlists_path)/rockyou.txt"`, or `ls "$(wordlists_path)/dirbuster"`
-    cat >> $out/bin/wordlists_path << __EOF__
-    #!${runtimeShell}
-    printf "${placeholder "out"}/share/wordlists\n"
-    __EOF__
-    chmod +x $out/bin/wordlists_path
-  '';
+  paths = [
+    wordlistsCollection
+    wordlistsBin
+    wordlistsPathBin
+  ];
 
   meta = with lib; {
     description = "A collection of wordlists useful for security testing";
@@ -65,6 +68,6 @@ symlinkJoin rec {
       If you want to add a new package that provides wordlist/s the convention
       is to copy it to {file}`$out/share/wordlists/myNewWordlist`.
     '';
-    maintainers = with maintainers; [ janik pamplemousse ];
+    maintainers = with maintainers; [ janik pamplemousse h7x4 ];
   };
 }
diff --git a/pkgs/data/misc/clash-geoip/default.nix b/pkgs/data/misc/clash-geoip/default.nix
index b344ca0d4aa..c7ca80ccb00 100644
--- a/pkgs/data/misc/clash-geoip/default.nix
+++ b/pkgs/data/misc/clash-geoip/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "clash-geoip";
-  version = "20231012";
+  version = "20231112";
 
   src = fetchurl {
     url = "https://github.com/Dreamacro/maxmind-geoip/releases/download/${version}/Country.mmdb";
-    sha256 = "sha256-KXmHaoIZ01M6Nu2LlVgTZarUp+5VPpLfnkc7d/Xl4z0=";
+    sha256 = "sha256-CTygf2/CbxNO/9e8OfxeGZFaSrKXdlQdvUgywZX1U9o=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix b/pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix
index c297ec27a3a..f2946f49920 100644
--- a/pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix
+++ b/pkgs/desktops/pantheon/artwork/elementary-gtk-theme/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenvNoCC
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , gettext
 , meson
@@ -12,24 +11,15 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "elementary-gtk-theme";
-  version = "7.2.0";
+  version = "7.3.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "stylesheet";
     rev = version;
-    sha256 = "sha256-ZR0FJ8DkPlO1Zatvxv3NghAVBPo2j+1m0k4C+gvYPVA=";
+    sha256 = "sha256-KrpeDQH43n7seeSPVYKETxy1g0JuUowZerjgktLQg/4=";
   };
 
-  patches = [
-    # Headerbars: fix missing default-decoration
-    # https://github.com/elementary/stylesheet/pull/1258
-    (fetchpatch {
-      url = "https://github.com/elementary/stylesheet/commit/9cea2383bec8f90d25f1e9b854b5221737487521.patch";
-      sha256 = "sha256-6komROS4+nxwoGoKoiDmnrTfLNZAvnTU6hIEOQQfmxc=";
-    })
-  ];
-
   nativeBuildInputs = [
     gettext
     meson
diff --git a/pkgs/desktops/plasma-5/discover.nix b/pkgs/desktops/plasma-5/discover.nix
index b9d3dd80a23..2c2600845b2 100644
--- a/pkgs/desktops/plasma-5/discover.nix
+++ b/pkgs/desktops/plasma-5/discover.nix
@@ -8,7 +8,6 @@
 , flatpak
 , fwupd
 , ostree
-, packagekit-qt
 , pcre
 , util-linux
 , qtquickcontrols2
@@ -42,7 +41,6 @@ mkDerivation {
     flatpak
     fwupd
     ostree
-    packagekit-qt
     pcre
     util-linux
     qtquickcontrols2
diff --git a/pkgs/development/compilers/elm/packages/node-composition.nix b/pkgs/development/compilers/elm/packages/node-composition.nix
index b6110ac4db9..c825c6c6634 100644
--- a/pkgs/development/compilers/elm/packages/node-composition.nix
+++ b/pkgs/development/compilers/elm/packages/node-composition.nix
@@ -2,7 +2,7 @@
 
 {pkgs ? import <nixpkgs> {
     inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_14"}:
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_18"}:
 
 let
   nodeEnv = import ../../../node-packages/node-env.nix {
diff --git a/pkgs/development/compilers/llvm/7/lldb/default.nix b/pkgs/development/compilers/llvm/7/lldb/default.nix
index 0a0aa3be18a..02e3cdcb8eb 100644
--- a/pkgs/development/compilers/llvm/7/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/7/lldb/default.nix
@@ -52,7 +52,11 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.libobjc
     darwin.apple_sdk.libs.xpc
-    darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa
+    darwin.apple_sdk.frameworks.Foundation
+    darwin.bootstrap_cmds
+    darwin.apple_sdk.frameworks.Carbon
+    darwin.apple_sdk.frameworks.Cocoa
+    darwin.apple_sdk.frameworks.DebugSymbols
   ];
 
   CXXFLAGS = "-fno-rtti";
diff --git a/pkgs/development/interpreters/cel-go/default.nix b/pkgs/development/interpreters/cel-go/default.nix
index d45abd4c0f4..821e8da2ee3 100644
--- a/pkgs/development/interpreters/cel-go/default.nix
+++ b/pkgs/development/interpreters/cel-go/default.nix
@@ -5,24 +5,18 @@
 
 buildGoModule rec {
   pname = "cel-go";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "cel-go";
     rev = "v${version}";
-    hash = "sha256-eXltZkg5QjdCrL9sk2ngVtirSnjBBqk+OdNLY4QtVx4=";
+    hash = "sha256-c4MVOHkDaUGlRVYb9YS9BH4ld2zS3SR5efP6amLhTig=";
   };
 
   modRoot = "repl";
 
-  vendorHash = "sha256-kalTHpyMYrKZHayxNKLc8vtogiDKyyQLExOQhqp1MUY=";
-
-  patches = [
-    # repl/go.mod and repl/go.sum are outdated
-    # ran `go mod tidy` in the repl directory
-    ./go-mod-tidy.patch
-  ];
+  vendorHash = "sha256-Oj/XUUmuj5scD5WT6zBxnU1hSapDyRBBz75rbIdY4Ho=";
 
   subPackages = [
     "main"
diff --git a/pkgs/development/interpreters/cel-go/go-mod-tidy.patch b/pkgs/development/interpreters/cel-go/go-mod-tidy.patch
deleted file mode 100644
index a1f4f06ae83..00000000000
--- a/pkgs/development/interpreters/cel-go/go-mod-tidy.patch
+++ /dev/null
@@ -1,52 +0,0 @@
---- a/repl/go.mod
-+++ b/repl/go.mod
-@@ -6,16 +6,16 @@ require (
- 	github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230321174746-8dcc6526cfb1
- 	github.com/chzyer/readline v1.5.1
- 	github.com/google/cel-go v0.14.0
--	google.golang.org/genproto/googleapis/api v0.0.0-20230525234035-dd9d682886f9
--	google.golang.org/protobuf v1.30.0
-+	google.golang.org/genproto/googleapis/api v0.0.0-20230803162519-f966b187b2e5
-+	google.golang.org/protobuf v1.31.0
- )
- 
- require (
- 	github.com/stoewer/go-strcase v1.3.0 // indirect
- 	golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // indirect
--	golang.org/x/sys v0.7.0 // indirect
-+	golang.org/x/sys v0.8.0 // indirect
- 	golang.org/x/text v0.9.0 // indirect
--	google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19 // indirect
-+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230803162519-f966b187b2e5 // indirect
- )
- 
- replace github.com/google/cel-go => ../.
---- a/repl/go.sum
-+++ b/repl/go.sum
-@@ -26,18 +26,18 @@ github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o
- golang.org/x/exp v0.0.0-20230321023759-10a507213a29 h1:ooxPy7fPvB4kwsA2h+iBNHkAbp/4JxTSwCmvdjEYmug=
- golang.org/x/exp v0.0.0-20230321023759-10a507213a29/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
- golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
--golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
--golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-+golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
- golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
- golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
- golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
--google.golang.org/genproto/googleapis/api v0.0.0-20230525234035-dd9d682886f9 h1:m8v1xLLLzMe1m5P+gCTF8nJB9epwZQUBERm20Oy1poQ=
--google.golang.org/genproto/googleapis/api v0.0.0-20230525234035-dd9d682886f9/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
--google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19 h1:0nDDozoAU19Qb2HwhXadU8OcsiO/09cnTqhUtq2MEOM=
--google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
-+google.golang.org/genproto/googleapis/api v0.0.0-20230803162519-f966b187b2e5 h1:nIgk/EEq3/YlnmVVXVnm14rC2oxgs1o0ong4sD/rd44=
-+google.golang.org/genproto/googleapis/api v0.0.0-20230803162519-f966b187b2e5/go.mod h1:5DZzOUPCLYL3mNkQ0ms0F3EuUNZ7py1Bqeq6sxzI7/Q=
-+google.golang.org/genproto/googleapis/rpc v0.0.0-20230803162519-f966b187b2e5 h1:eSaPbMR4T7WfH9FvABk36NBMacoTUKdWCvV0dx+KfOg=
-+google.golang.org/genproto/googleapis/rpc v0.0.0-20230803162519-f966b187b2e5/go.mod h1:zBEcrKX2ZOcEkHWxBPAIvYUWOKKMIhYcmNiUIu2ji3I=
- google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
--google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
--google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
- gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
- gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
- gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/pkgs/development/interpreters/expr/default.nix b/pkgs/development/interpreters/expr/default.nix
index be783c6a041..cda9cc7b78e 100644
--- a/pkgs/development/interpreters/expr/default.nix
+++ b/pkgs/development/interpreters/expr/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "expr";
-  version = "1.15.3";
+  version = "1.15.4";
 
   src = fetchFromGitHub {
     owner = "antonmedv";
     repo = "expr";
     rev = "v${version}";
-    hash = "sha256-r+XlcDvCQarzh8wO3NL87PJThnioeVC73OZdJ8kW4RM=";
+    hash = "sha256-x96I6HHhm3RIrlg1/KVCIbFkelazGt0H2nk8juUWjKg=";
   };
 
   sourceRoot = "${src.name}/repl";
 
-  vendorHash = "sha256-WxYqP8L64U5MAYG7XTpKrRW1aaqGB4hJr+e/RKdb1lU=";
+  vendorHash = "sha256-ZVB6P0WdjyDK9OlEgKjR3D3IVBkDbDx9bOpLC/H2JLs=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/development/libraries/ada/xmlada/default.nix b/pkgs/development/libraries/ada/xmlada/default.nix
index e80371e092e..77e8094277a 100644
--- a/pkgs/development/libraries/ada/xmlada/default.nix
+++ b/pkgs/development/libraries/ada/xmlada/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xmlada";
-  version = "23.0.0";
+  version = "24.0.0";
 
   src = fetchFromGitHub {
     name = "xmlada-${version}-src";
     owner = "AdaCore";
     repo = "xmlada";
     rev = "v${version}";
-    sha256 = "sha256-covcSwlQQjRKTv0DdMEgahXXlch0TeKnvSyOsGO9+e0=";
+    sha256 = "sha256-vvM7bdf3dAa3zKgxbGeAGlBT6fvafzmleimJHyRdlvc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/duckdb/default.nix b/pkgs/development/libraries/duckdb/default.nix
index c9f6711780b..801ad7979ae 100644
--- a/pkgs/development/libraries/duckdb/default.nix
+++ b/pkgs/development/libraries/duckdb/default.nix
@@ -15,13 +15,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "duckdb";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-UG/vV/6WxVLq9mdze8pSDFJIekOgGsg93dzMq6eP6Dg=";
+    hash = "sha256-QFK8mEMcqQwALFNvAdD8yWixwMYHSbeo6xqx86PvejU=";
   };
 
   patches = [ ./version.patch ];
diff --git a/pkgs/development/libraries/imgui/default.nix b/pkgs/development/libraries/imgui/default.nix
index ca7a47d3638..73bc80ef9d5 100644
--- a/pkgs/development/libraries/imgui/default.nix
+++ b/pkgs/development/libraries/imgui/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "imgui";
-  version = "1.89.9";
+  version = "1.90";
 
   src = fetchFromGitHub {
     owner = "ocornut";
     repo = "imgui";
     rev = "v${version}";
-    sha256 = "sha256-0k9jKrJUrG9piHNFQaBBY3zgNIKM23ZA879NY+MNYTU=";
+    sha256 = "sha256-rJMWCPVhho34NcPvJZaB5d6EbZkJyLXEfeotplOOaiA=";
   };
 
   dontBuild = true;
diff --git a/pkgs/development/libraries/libepc/default.nix b/pkgs/development/libraries/libepc/default.nix
index 9755d0977c8..a2822eae8d5 100644
--- a/pkgs/development/libraries/libepc/default.nix
+++ b/pkgs/development/libraries/libepc/default.nix
@@ -1,30 +1,51 @@
-{ lib, stdenv, fetchurl, pkg-config, intltool, gtk-doc, glib, avahi, gnutls, libuuid, libsoup, gtk3, gnome }:
+{ stdenv
+, lib
+, fetchurl
+, autoreconfHook
+, pkg-config
+, intltool
+, gtk-doc
+, glib
+, avahi
+, gnutls
+, libuuid
+, libsoup
+, gtk3
+, gnome
+}:
 
-let
-  avahiWithGtk = avahi.override { gtk3Support = true; };
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libepc";
   version = "0.4.6";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    url = "mirror://gnome/sources/libepc/${lib.versions.majorMinor finalAttrs.version}/libepc-${finalAttrs.version}.tar.xz";
     sha256 = "1s3svb2slqjsrqfv50c2ymnqcijcxb5gnx6bfibwh9l5ga290n91";
   };
 
+  patches = [
+    # Remove dependency that is only needed by uninstalled examples.
+    ./no-avahi-ui.patch
+  ];
+
   nativeBuildInputs = [
+    autoreconfHook
+    gnome.gnome-common
     pkg-config
     intltool
     gtk-doc
   ];
+
   buildInputs = [
     glib
     libuuid
     gtk3
   ];
+
   propagatedBuildInputs = [
-    avahiWithGtk
+    avahi
     gnutls
     libsoup
   ];
@@ -33,7 +54,7 @@ in stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = "libepc";
       versionPolicy = "odd-unstable";
     };
   };
@@ -45,4 +66,4 @@ in stdenv.mkDerivation rec {
     maintainers = teams.gnome.members;
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/development/libraries/libepc/no-avahi-ui.patch b/pkgs/development/libraries/libepc/no-avahi-ui.patch
new file mode 100644
index 00000000000..4649ecbe27c
--- /dev/null
+++ b/pkgs/development/libraries/libepc/no-avahi-ui.patch
@@ -0,0 +1,36 @@
+diff --git a/Makefile.am b/Makefile.am
+index acf0d25..13022d1 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -32,8 +32,6 @@ noinst_PROGRAMS = \
+ 	examples/lookup-resource \
+ 	examples/service-browser \
+ 	examples/simple-publisher \
+-	examples/consumer-ui \
+-	examples/publisher-ui \
+ 	examples/server-credentials \
+ 	$(TESTS)
+ TESTS = \
+@@ -155,10 +153,6 @@ examples_service_browser_LDADD			= $(example_epc_libs)
+ examples_simple_publisher_CFLAGS		= $(example_epc_cflags)
+ examples_simple_publisher_LDADD			= $(example_epc_libs)
+ 
+-examples_consumer_ui_CFLAGS			= $(example_epc_ui_cflags) $(AVAHI_UI_CFLAGS)
+-examples_consumer_ui_LDADD			= $(example_epc_ui_libs) $(AVAHI_UI_LIBS)
+-examples_publisher_ui_CFLAGS			= $(example_epc_ui_cflags) $(AVAHI_UI_CFLAGS) -rdynamic
+-examples_publisher_ui_LDADD			= $(example_epc_ui_libs) $(AVAHI_UI_LIBS)
+ examples_server_credentials_CFLAGS		= $(example_epc_ui_cflags)
+ examples_server_credentials_LDADD		= $(example_epc_ui_libs)
+ 
+diff --git a/configure.ac b/configure.ac
+index d68bf94..89bd471 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -53,7 +53,6 @@ PKG_CHECK_EXISTS([$GIO_REQUIREMENT],
+                   GIO=$GIO_REQUIREMENT],
+                  [AC_MSG_RESULT([no])])
+ 
+-PKG_CHECK_MODULES(AVAHI_UI,  [avahi-ui-gtk3     >= 0.6])
+ PKG_CHECK_MODULES(LIBEPC,    [avahi-client >= 0.6
+                               avahi-glib   >= 0.6
+                               glib-2.0     >= 2.36
diff --git a/pkgs/development/libraries/libspatialindex/default.nix b/pkgs/development/libraries/libspatialindex/default.nix
index 455d42c3bb4..16c98abf441 100644
--- a/pkgs/development/libraries/libspatialindex/default.nix
+++ b/pkgs/development/libraries/libspatialindex/default.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Extensible spatial index library in C++";
     homepage = "https://libspatialindex.org";
     license = licenses.mit;
+    maintainers = teams.geospatial.members;
     platforms = platforms.unix;
   };
 })
diff --git a/pkgs/development/libraries/libusbsio/default.nix b/pkgs/development/libraries/libusbsio/default.nix
index 1982311919b..090683898a1 100644
--- a/pkgs/development/libraries/libusbsio/default.nix
+++ b/pkgs/development/libraries/libusbsio/default.nix
@@ -1,7 +1,13 @@
-{ lib, stdenv, fetchzip, pkg-config, libusb1, systemdMinimal }:
-let
-  binDirPrefix = if stdenv.isDarwin then "osx_" else "linux_";
-in
+{ lib
+, stdenv
+, fetchzip
+, pkg-config
+, fixDarwinDylibNames
+, libusb1
+, systemdMinimal
+, darwin
+}:
+
 stdenv.mkDerivation rec {
   pname = "libusbsio";
   version = "2.1.11";
@@ -15,15 +21,30 @@ stdenv.mkDerivation rec {
     rm -r bin/*
   '';
 
-  nativeBuildInputs = [ pkg-config ];
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "BINDIR="
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ] ++ lib.optionals stdenv.isDarwin [
+    fixDarwinDylibNames
+  ];
+
   buildInputs = [
     libusb1
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    AppKit
+    CoreFoundation
+    IOKit
+  ]) ++ lib.optionals stdenv.isLinux [
     systemdMinimal # libudev
   ];
 
   installPhase = ''
     runHook preInstall
-    install -D bin/${binDirPrefix}${stdenv.hostPlatform.parsed.cpu.name}/libusbsio${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libusbsio${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -D bin/libusbsio${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libusbsio${stdenv.hostPlatform.extensions.sharedLibrary}
     runHook postInstall
   '';
 
diff --git a/pkgs/development/libraries/oneDNN/default.nix b/pkgs/development/libraries/oneDNN/default.nix
index e6bf2a4c549..2518cecb9b6 100644
--- a/pkgs/development/libraries/oneDNN/default.nix
+++ b/pkgs/development/libraries/oneDNN/default.nix
@@ -9,13 +9,13 @@
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation (finalAttrs: {
   pname = "oneDNN";
-  version = "3.3";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "oneDNN";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dC4Z1OvqIF8YhuSeVo+E0CohdXYIfkeTEw3/QuYA/90=";
+    hash = "sha256-br2ssI4MRk9O6u+5voBmxBZtmTFPKoJJe3ZEN2blq7Y=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/simdjson/default.nix b/pkgs/development/libraries/simdjson/default.nix
index 5ac49ac278f..53a5e09413c 100644
--- a/pkgs/development/libraries/simdjson/default.nix
+++ b/pkgs/development/libraries/simdjson/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "simdjson";
-  version = "3.4.0";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "simdjson";
     repo = "simdjson";
     rev = "v${version}";
-    sha256 = "sha256-d1tJJCHbx+7klS918Db7S2N8zCdvd9MhI5ybxJpncUw=";
+    sha256 = "sha256-g1jrjRls9tJWh0koMg7MsUgRSNaty8YI+ivlwL6FCsk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/tracker-miners/default.nix b/pkgs/development/libraries/tracker-miners/default.nix
index f6c49b9cfb6..63a86ed55b5 100644
--- a/pkgs/development/libraries/tracker-miners/default.nix
+++ b/pkgs/development/libraries/tracker-miners/default.nix
@@ -11,6 +11,7 @@
 , gexiv2
 , tracker
 , meson
+, mesonEmulatorHook
 , ninja
 , pkg-config
 , vala
@@ -68,6 +69,7 @@ stdenv.mkDerivation rec {
     docbook-xsl-nons
     docbook_xml_dtd_45
     gettext
+    glib
     itstool
     libxslt
     meson
@@ -75,6 +77,8 @@ stdenv.mkDerivation rec {
     pkg-config
     vala
     wrapGAppsNoGuiHook
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
   ];
 
   # TODO: add libenca, libosinfo
@@ -83,7 +87,6 @@ stdenv.mkDerivation rec {
     dbus
     exempi
     giflib
-    glib
     gexiv2
     totem-pl-parser
     tracker
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index d1dc513c0b0..b22090a7593 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "18.4.1";
+  version = "18.5.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-o1Yv4/wSM2k+L2/JP3teUj129QlyLjoShCRWJ3lIN98=";
+    hash = "sha256-kj4FHsNsGsMxK+EI1jgqBfvldkyAoBkCTGT1yiZMmzY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
index af7635184a0..463518ef2f9 100644
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@@ -17,8 +17,8 @@
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "5.5.2";
-  format = "pyproject";
+  version = "5.5.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "AppThreat";
     repo = "vulnerability-db";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ioFTayuPkxXIaaKKVHBLyU47jID6dGWCX1G9kVkD5Yo=";
+    hash = "sha256-6kfkHLW5PftzrhKjywc670HpKCrrU0POEiJ3u2doBTk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/bbox/default.nix b/pkgs/development/python-modules/bbox/default.nix
index 4f1d0cef7fd..df28d568b01 100644
--- a/pkgs/development/python-modules/bbox/default.nix
+++ b/pkgs/development/python-modules/bbox/default.nix
@@ -1,23 +1,40 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
+, pytestCheckHook
 , pythonOlder
-, pyquaternion
+, matplotlib
 , numpy
+, pendulum
+, pillow
+, poetry-core
+, pyquaternion
 }:
 
 buildPythonPackage rec {
   pname = "bbox";
   version = "0.9.4";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-GGQhKkdwmrYPEhtldPY3WUInSniU/B40NZvt1gXEuzg=";
+  src = fetchFromGitHub {
+    owner = "varunagrawal";
+    repo = pname;
+    # matches 0.9.4 on PyPi + tests
+    rev = "d3f07ed0e38b6015cf4181e3b3edae6a263f8565";
+    hash = "sha256-FrJ8FhlqwmnEB/QvPlkDfqZncNGPhwY9aagM9yv1LGs=";
   };
 
   propagatedBuildInputs = [ pyquaternion numpy ];
+  buildInputs = [ poetry-core ];
+
+  nativeCheckInputs = [
+    matplotlib
+    pendulum
+    pillow
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "bbox" ];
 
diff --git a/pkgs/development/python-modules/brian2/default.nix b/pkgs/development/python-modules/brian2/default.nix
index 2b3bcbff507..a85e26b485f 100644
--- a/pkgs/development/python-modules/brian2/default.nix
+++ b/pkgs/development/python-modules/brian2/default.nix
@@ -22,12 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-XMXSOwcH8fLgzXCcT+grjYxhBdtF4H/Vr+S7J4GYZSw=";
   };
 
-  patches = [
-    # Fix deprecated numpy types
-    # https://sources.debian.org/data/main/b/brian/2.5.1-3/debian/patches/numpy1.24.patch
-    ./numpy1.24.patch
-  ];
-
   propagatedBuildInputs = [
     cython
     jinja2
diff --git a/pkgs/development/python-modules/brian2/numpy1.24.patch b/pkgs/development/python-modules/brian2/numpy1.24.patch
deleted file mode 100644
index 01af8f77c0e..00000000000
--- a/pkgs/development/python-modules/brian2/numpy1.24.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-Description: Remove deprecated use of np.float
-Author: Marcel Stimberg <marcel.stimberg@inserm.fr>
-Bug-Debian: https://bugs.debian.org/1027193
-Applied-Upstream: 61ef84b316a3d0a892298adf51abd8ac50900758
-Last-Update: 2023-01-06
----
-This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
---- brian.orig/brian2/units/fundamentalunits.py
-+++ brian/brian2/units/fundamentalunits.py
-@@ -1597,7 +1597,7 @@
-         unitless = np.array(self / best_unit, copy=False)
-         threshold = np.get_printoptions()['threshold'] // 100
-         if unitless.ndim == 0:
--            sympy_quantity = np.float(unitless)
-+            sympy_quantity = float(unitless)
-         elif unitless.ndim == 1:
-             array_str = np.array2string(unitless, separator=" & ", threshold=threshold,
-                                         max_line_width=sys.maxsize)
diff --git a/pkgs/development/python-modules/django-hijack/default.nix b/pkgs/development/python-modules/django-hijack/default.nix
index 01e1593a82c..5832d9a0693 100644
--- a/pkgs/development/python-modules/django-hijack/default.nix
+++ b/pkgs/development/python-modules/django-hijack/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , fetchNpmDeps
 , buildPythonPackage
+, nix-update-script
 
 # build-system
 , gettext
@@ -19,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "django-hijack";
-  version = "3.4.1";
+  version = "3.4.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "django-hijack";
     repo = "django-hijack";
     rev = "refs/tags/${version}";
-    hash = "sha256-y8KT/Fbk2eQDbGzcJtLdwS6jPCNoTWXousvqY+GlFnQ=";
+    hash = "sha256-E5gM/5MIB65gdyv/I+Kuw8rbjPvtUnbCPXpasaIDzyo=";
   };
 
   postPatch = ''
@@ -39,7 +40,7 @@ buildPythonPackage rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-FLfMCn2jsLlTTsC+LRMX0dmVCCbNAr2pQUsSQRKgo6E=";
+    hash = "sha256-4ZVb+V/oYfflIZdme6hbpoSBFVV7lk5wLfEzzBqZv/Y=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -67,6 +68,9 @@ buildPythonPackage rec {
     "-W" "ignore::DeprecationWarning"
   ];
 
+  # needed for npmDeps update
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Allows superusers to hijack (=login as) and work on behalf of another user";
     homepage = "https://github.com/arteria/django-hijack";
diff --git a/pkgs/development/python-modules/echo/default.nix b/pkgs/development/python-modules/echo/default.nix
new file mode 100644
index 00000000000..af3a3d43a6d
--- /dev/null
+++ b/pkgs/development/python-modules/echo/default.nix
@@ -0,0 +1,63 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, setuptools
+, setuptools-scm
+, libxcrypt
+, numpy
+, qt6
+, qtpy
+, pyqt6
+, pytestCheckHook
+, pytest-cov
+}:
+
+buildPythonPackage rec {
+  pname = "echo";
+  version = "0.8.0";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "glue-viz";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-0FmUA7kOFSRZXwbj8d7asujBPOjE2pFhu6TDNSGD4r0=";
+  };
+
+  nativeBuildInputs = [ setuptools setuptools-scm qt6.wrapQtAppsHook ];
+
+  buildInputs = lib.optionals (pythonOlder "3.9") [
+    libxcrypt
+  ];
+
+  propagatedBuildInputs = [
+    qt6.qtconnectivity
+    qt6.qtbase
+    qt6.qttools
+    pyqt6
+    numpy
+    qtpy
+  ];
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  # collecting ... qt.qpa.xcb: could not connect to display
+  # qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.
+  doCheck = false;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov
+  ];
+
+  pythonImportsCheck = [ "echo" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/glue-viz/echo";
+    description = "Callback Properties in Python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ifurther ];
+  };
+}
diff --git a/pkgs/development/python-modules/fast-histogram/default.nix b/pkgs/development/python-modules/fast-histogram/default.nix
new file mode 100644
index 00000000000..fd00ff5df8e
--- /dev/null
+++ b/pkgs/development/python-modules/fast-histogram/default.nix
@@ -0,0 +1,54 @@
+{ lib
+, buildPythonPackage
+, pytestCheckHook
+, fetchFromGitHub
+, python
+, pythonOlder
+, setuptools
+, setuptools-scm
+, numpy
+, wheel
+, hypothesis
+, pytest-cov
+}:
+
+buildPythonPackage rec {
+  pname = "fast-histogram";
+  version = "0.12";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "astrofrog";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-Cz4BgbtxbUPxL2NSzvZYjbYIN4KUuliUV0bXRRtyvfM=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  propagatedBuildInputs = [ numpy ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    hypothesis
+    pytest-cov
+  ];
+
+  pytestFlagsArray = [ "${builtins.placeholder "out"}/${python.sitePackages}" ];
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  pythonImportsCheck = [ "fast_histogram" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/astrofrog/fast-histogram";
+    description = "Fast 1D and 2D histogram functions in Python";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ ifurther ];
+  };
+}
diff --git a/pkgs/development/python-modules/glueviz/default.nix b/pkgs/development/python-modules/glueviz/default.nix
new file mode 100644
index 00000000000..c6fb2859b41
--- /dev/null
+++ b/pkgs/development/python-modules/glueviz/default.nix
@@ -0,0 +1,87 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, dill
+, astropy
+, numpy
+, pandas
+, qt6
+, pyqt6
+, pyqt-builder
+, qtconsole
+, setuptools
+, setuptools-scm
+, scipy
+, ipython
+, ipykernel
+, h5py
+, matplotlib
+, xlrd
+, mpl-scatter-density
+, pvextractor
+, openpyxl
+, echo
+, pytest
+, pytest-flakes
+, pytest-cov
+}:
+
+buildPythonPackage rec {
+  pname = "glueviz";
+  version = "1.14.1";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "glue-viz";
+    repo = "glue";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-pHUcvyDziE7l0foEz7cygMuAwggnIWzsQy9SFZCDkXA=";
+  };
+
+  buildInputs = [ pyqt-builder ];
+  nativeBuildInputs = [ setuptools setuptools-scm qt6.wrapQtAppsHook ];
+  propagatedBuildInputs = [
+    astropy
+    dill
+    setuptools
+    scipy
+    numpy
+    matplotlib
+    pandas
+    pyqt6
+    qtconsole
+    ipython
+    ipykernel
+    h5py
+    xlrd
+    mpl-scatter-density
+    pvextractor
+    openpyxl
+    echo
+  ];
+
+  dontConfigure = true;
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  # collecting ... qt.qpa.xcb: could not connect to display
+  # qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.
+  doCheck = false;
+
+  nativeCheckInputs = [ pytest pytest-flakes pytest-cov ];
+
+  pythonImportsCheck = [ "glue" ];
+
+  preFixup = ''
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+  '';
+
+  meta = with lib; {
+    homepage = "https://glueviz.org";
+    description = "Linked Data Visualizations Across Multiple Files";
+    license = licenses.bsd3; # https://github.com/glue-viz/glue/blob/main/LICENSE
+    maintainers = with maintainers; [ ifurther ];
+  };
+}
diff --git a/pkgs/development/python-modules/google-cloud-org-policy/default.nix b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
index 2aa7834ace8..2e91f2704c7 100644
--- a/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-org-policy";
-  version = "1.8.2";
+  version = "1.8.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-SJpjS72keOf9QF1imsWLbgMSzxCDloO4tuc4vUy8ZBk=";
+    hash = "sha256-VU+vB+x2DElwzl1cO7qTdV91Mn1i2Dsq2safnMrwuqI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hcloud/default.nix b/pkgs/development/python-modules/hcloud/default.nix
index 336f8ed962c..1e460fa3c7f 100644
--- a/pkgs/development/python-modules/hcloud/default.nix
+++ b/pkgs/development/python-modules/hcloud/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "hcloud";
-  version = "1.31.0";
+  version = "1.32.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hF+gptNLAeLtpZGrwOezwFeihDt1smCp4QkK5lENMHo=";
+    hash = "sha256-vX85fDFNGJ8zJe6YCPn7VFOdvPkT35VbM3Do+cP2b/Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/lightning-utilities/default.nix b/pkgs/development/python-modules/lightning-utilities/default.nix
index e03e005ad7b..65d5f064ce5 100644
--- a/pkgs/development/python-modules/lightning-utilities/default.nix
+++ b/pkgs/development/python-modules/lightning-utilities/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "lightning-utilities";
-  version = "0.9.0";
+  version = "0.10.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "utilities";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vSeHtvsIt4L4qJCVlTPVjIjd62+08JWBnr9+9+ujOfw=";
+    hash = "sha256-lp/+ArgoMIa7Q2ufWghr8OYUMlFcj8123Et73ORNI5U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/linknlink/default.nix b/pkgs/development/python-modules/linknlink/default.nix
new file mode 100644
index 00000000000..59c02c46609
--- /dev/null
+++ b/pkgs/development/python-modules/linknlink/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, cryptography
+, fetchFromGitHub
+, pythonOlder
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "linknlink";
+  version = "0.1.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "xuanxuan000";
+    repo = "python-linknlink";
+    rev = "refs/tags/${version}";
+    hash = "sha256-pr0FwNweg7hFcvaOHQyXjIzH1L6Q4q/1llwfdl9k0Sk=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    cryptography
+  ];
+
+  pythonImportsCheck = [
+    "linknlink"
+  ];
+
+  # Module has no test
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Module and CLI for controlling Linklink devices locally";
+    homepage = "https://github.com/xuanxuan000/python-linknlink";
+    changelog = "";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/md-toc/default.nix b/pkgs/development/python-modules/md-toc/default.nix
index 800fc6227b0..18aeac19b3c 100644
--- a/pkgs/development/python-modules/md-toc/default.nix
+++ b/pkgs/development/python-modules/md-toc/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "md-toc";
-  version = "8.2.0";
+  version = "8.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "frnmst";
     repo = pname;
     rev = version;
-    hash = "sha256-7Udmon/5E741+v2vBHHL7h31r91RR33hN1WhL3FiDQc=";
+    hash = "sha256-fL3JlZWTEEinYILNeHw0cuvVza27atLLxjrBZkVLRiU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/meraki/default.nix b/pkgs/development/python-modules/meraki/default.nix
index c97624c73c8..0720a290cb9 100644
--- a/pkgs/development/python-modules/meraki/default.nix
+++ b/pkgs/development/python-modules/meraki/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "meraki";
-  version = "1.38.0";
+  version = "1.39.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LYwjcm4qZfzrDSujQ9eaxjPN9z0qWDSfT+IU1f32cY0=";
+    hash = "sha256-B3+2KnRXWkB83Sy/NH9kJwgSha9L17tx37fFwBjT3Mw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/mitmproxy-macos/default.nix b/pkgs/development/python-modules/mitmproxy-macos/default.nix
new file mode 100644
index 00000000000..39798d90b15
--- /dev/null
+++ b/pkgs/development/python-modules/mitmproxy-macos/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, hatchling
+}:
+
+buildPythonPackage rec {
+  pname = "mitmproxy-macos";
+  version = "0.3.11";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "mitmproxy";
+    repo = "mitmproxy_rs";
+    rev = version;
+    hash = "sha256-V6LUr1jJiTo0+53jipkTyzG5JSw6uHaS6ziyBaFbETw=";
+  };
+
+  sourceRoot = "${src.name}/mitmproxy-macos";
+  pythonImportsCheck = [ "mitmproxy_macos" ];
+  nativeBuildInputs = [
+    hatchling
+  ];
+
+  meta = with lib; {
+    description = "The MacOS Rust bits in mitmproxy";
+    homepage = "https://github.com/mitmproxy/mitmproxy_rs/tree/main/mitmproxy-macos";
+    changelog = "https://github.com/mitmproxy/mitmproxy_rs/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ boltzmannrain ];
+    platforms = platforms.darwin;
+  };
+}
diff --git a/pkgs/development/python-modules/mitmproxy-rs/default.nix b/pkgs/development/python-modules/mitmproxy-rs/default.nix
index 15850ab7cd7..d90e1e0c2a9 100644
--- a/pkgs/development/python-modules/mitmproxy-rs/default.nix
+++ b/pkgs/development/python-modules/mitmproxy-rs/default.nix
@@ -4,6 +4,8 @@
 , fetchFromGitHub
 , rustPlatform
 , darwin
+, libiconv
+, mitmproxy-macos
 }:
 
 buildPythonPackage rec {
@@ -34,13 +36,15 @@ buildPythonPackage rec {
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
+    libiconv
+    mitmproxy-macos
   ];
 
   pythonImportsCheck = [ "mitmproxy_rs" ];
 
   meta = with lib; {
     description = "The Rust bits in mitmproxy";
-    homepage = " https://github.com/mitmproxy/mitmproxy_rs";
+    homepage = "https://github.com/mitmproxy/mitmproxy_rs";
     changelog = "https://github.com/mitmproxy/mitmproxy_rs/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 1c57361a640..566c1e0b329 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , buildPythonPackage
 , pythonOlder
+, stdenv
   # Mitmproxy requirements
 , aioquic
 , asgiref
@@ -15,6 +16,7 @@
 , hyperframe
 , kaitaistruct
 , ldap3
+, mitmproxy-macos
 , mitmproxy-rs
 , msgpack
 , passlib
@@ -81,6 +83,8 @@ buildPythonPackage rec {
     urwid
     wsproto
     zstandard
+  ] ++ lib.optionals stdenv.isDarwin [
+    mitmproxy-macos
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/mopeka-iot-ble/default.nix b/pkgs/development/python-modules/mopeka-iot-ble/default.nix
index 318bd9a00bb..a5bb698aa1a 100644
--- a/pkgs/development/python-modules/mopeka-iot-ble/default.nix
+++ b/pkgs/development/python-modules/mopeka-iot-ble/default.nix
@@ -12,8 +12,8 @@
 
 buildPythonPackage rec {
   pname = "mopeka-iot-ble";
-  version = "0.4.1";
-  format = "pyproject";
+  version = "0.5.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
@@ -21,9 +21,14 @@ buildPythonPackage rec {
     owner = "bluetooth-devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-x/cKg2NC6kssUQeBuQH4yghlRDgs/fJ0bWWL+qnHgcM=";
+    hash = "sha256-m27As3tB77JbgY0kDDJ6kmYFTv2O/Sh6y9tFiKDIjbI=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=mopeka_iot_ble --cov-report=term-missing:skip-covered" ""
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -39,11 +44,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace " --cov=mopeka_iot_ble --cov-report=term-missing:skip-covered" ""
-  '';
-
   pythonImportsCheck = [
     "mopeka_iot_ble"
   ];
diff --git a/pkgs/development/python-modules/mpl-scatter-density/default.nix b/pkgs/development/python-modules/mpl-scatter-density/default.nix
new file mode 100644
index 00000000000..f0523c3594d
--- /dev/null
+++ b/pkgs/development/python-modules/mpl-scatter-density/default.nix
@@ -0,0 +1,67 @@
+{ lib
+, buildPythonPackage
+, pytestCheckHook
+, fetchFromGitHub
+, fetchpatch
+, pythonOlder
+, setuptools-scm
+, setuptools
+, fast-histogram
+, matplotlib
+, numpy
+, wheel
+, pytest-mpl
+}:
+
+buildPythonPackage rec {
+  pname = "mpl-scatter-density";
+  version = "0.7";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "astrofrog";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-MMxM+iv5p9ZLcBpqa3tBBPbsMM/PTg6BXaDpGgSw+DE=";
+  };
+
+  patches = [
+    # https://github.com/astrofrog/mpl-scatter-density/pull/37
+    (fetchpatch {
+      name = "distutils-removal.patch";
+      url = "https://github.com/ifurther/mpl-scatter-density/commit/6feedabe1e82da67d8eec46a80eb370d9f334251.patch";
+      sha256 = "sha256-JqWlSm8mIwqjRPa+kMEaKipJyzGEO+gJK+Q045N1MXA=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  propagatedBuildInputs = [ matplotlib numpy fast-histogram ];
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-mpl
+  ];
+
+  disabledTests = [
+    # AssertionError: (240, 240) != (216, 216)
+    # Erroneous pinning of figure DPI, sensitive to runtime environment
+    "test_default_dpi"
+  ];
+
+  pythonImportsCheck = [ "mpl_scatter_density" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/astrofrog/mpl-scatter-density";
+    description = "Fast scatter density plots for Matplotlib";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ ifurther ];
+  };
+}
diff --git a/pkgs/development/python-modules/msprime/default.nix b/pkgs/development/python-modules/msprime/default.nix
index 008ce7f2711..2ec32c255df 100644
--- a/pkgs/development/python-modules/msprime/default.nix
+++ b/pkgs/development/python-modules/msprime/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , oldest-supported-numpy
 , setuptools-scm
 , wheel
@@ -26,6 +27,16 @@ buildPythonPackage rec {
     hash = "sha256-YAJa2f0w2CenKubnYLbP8HodDhabLB2hAkyw/CPkp6o=";
   };
 
+  patches = [
+    # upstream patch fixes 2 failing unittests. remove on update
+    (fetchpatch {
+      name = "python311.patch";
+      url = "https://github.com/tskit-dev/msprime/commit/639125ec942cb898cf4a80638f229e11ce393fbc.patch";
+      hash = "sha256-peli4tdu8Bv21xIa5H8SRdfjQnTMO72IPFqybmSBSO8=";
+      includes = [ "tests/test_ancestry.py" ];
+    })
+  ];
+
   nativeBuildInputs = [
     gsl
     oldest-supported-numpy
diff --git a/pkgs/development/python-modules/oca-port/default.nix b/pkgs/development/python-modules/oca-port/default.nix
index 0a603b0b91c..7b948c4ffdf 100644
--- a/pkgs/development/python-modules/oca-port/default.nix
+++ b/pkgs/development/python-modules/oca-port/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "oca-port";
-  version = "0.13";
+  version = "0.14";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "oca_port";
-    hash = "sha256-9ihqjnGdBPasiRD2pZeaiibwzFQKI9t+s/zMzvyLLHQ=";
+    hash = "sha256-P+uCoC2u5lR4oTtloNFd4N+CjssUa5PbzbnhEulaRoc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/oslo-log/default.nix b/pkgs/development/python-modules/oslo-log/default.nix
index 85f92e47835..64df3dc82e4 100644
--- a/pkgs/development/python-modules/oslo-log/default.nix
+++ b/pkgs/development/python-modules/oslo-log/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "oslo-log";
-  version = "5.3.0";
+  version = "5.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "oslo.log";
     inherit version;
-    hash = "sha256-zJSqvbUOHiVxxsvEs5lpSgVBV2c1kIqYSgIjqeH72z4=";
+    hash = "sha256-LrNVtYVw8lgR2nb6gUU7h1x8lEoZoj0sMFtKTf670iM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/plaid-python/default.nix b/pkgs/development/python-modules/plaid-python/default.nix
index a88ce34ab0d..1fcff9e4780 100644
--- a/pkgs/development/python-modules/plaid-python/default.nix
+++ b/pkgs/development/python-modules/plaid-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "plaid-python";
-  version = "17.0.0";
+  version = "18.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rVYyS2Wc3PC3BvkzUSe88sSXxJCElmP5s7B1NxSFAWY=";
+    hash = "sha256-1OV/oybxZXF2kjLoSA2KyQaTR91jqEWstpELSlUIg2o=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 0802156dcd3..14e77c816b8 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.34.5";
+  version = "0.35.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Lg8oNFb0nc6T8E0fksv2w/bkHB/7PPXipMDGC0i8Kc0=";
+    hash = "sha256-eHJQXLiuWmJo/Eo4B8gEo44rwpPA7ASjxKSmdu6Tv9M=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pvextractor/default.nix b/pkgs/development/python-modules/pvextractor/default.nix
new file mode 100644
index 00000000000..315d0411b8e
--- /dev/null
+++ b/pkgs/development/python-modules/pvextractor/default.nix
@@ -0,0 +1,61 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, astropy
+, qtpy
+, pyqt6
+, pyqt-builder
+, setuptools
+, setuptools-scm
+, scipy
+, matplotlib
+, spectral-cube
+, pytestCheckHook
+, pytest-astropy
+}:
+
+buildPythonPackage rec {
+  pname = "pvextractor";
+  version = "0.3";
+
+  disabled = pythonOlder "3.5";
+
+  src = fetchFromGitHub {
+    owner = "radio-astro-tools";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-HYus2Gk3hzKq+3lJLOJQ+EE6LeO+DrvqLK3NpqrUYeI=";
+  };
+
+  buildInputs = [ pyqt-builder ];
+  nativeBuildInputs = [ setuptools setuptools-scm ];
+  propagatedBuildInputs = [
+    astropy
+    scipy
+    matplotlib
+    pyqt6
+    qtpy
+    spectral-cube
+  ];
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  # collecting ... qt.qpa.xcb: could not connect to display
+  # qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.
+  doCheck = false;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-astropy
+  ];
+
+  pythonImportsCheck = [ "pvextractor" ];
+
+  meta = with lib; {
+    homepage = "http://pvextractor.readthedocs.io";
+    description = "Position-velocity diagram extractor";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ifurther ];
+  };
+}
diff --git a/pkgs/development/python-modules/pygobject-stubs/default.nix b/pkgs/development/python-modules/pygobject-stubs/default.nix
index f2c2668f404..9dde5d01222 100644
--- a/pkgs/development/python-modules/pygobject-stubs/default.nix
+++ b/pkgs/development/python-modules/pygobject-stubs/default.nix
@@ -1,25 +1,23 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, setuptools
-, black
-, codespell
-, isort
-, mypy
-, pre-commit
 , pygobject3
+, pythonOlder
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "pygobject-stubs";
-  version = "2.9.0";
-  format = "pyproject";
+  version = "2.10.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "pygobject";
     repo = "pygobject-stubs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-A28vH5S5xxY7VIJORbgQ7jAi/wG4WiffNGryiumHWf0=";
+    hash = "sha256-fz+qzFWl9JJu9CEVkeiV6XUIPDvwWgrfhTo/nj1EH5c=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +30,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "PEP 561 Typing Stubs for PyGObject";
     homepage = "https://github.com/pygobject/pygobject-stubs";
-    changelog = "https://github.com/pygobject/pygobject-stubs/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/pygobject/pygobject-stubs/blob/${version}/CHANGELOG.md";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ hacker1024 ];
   };
diff --git a/pkgs/development/python-modules/pyinsteon/default.nix b/pkgs/development/python-modules/pyinsteon/default.nix
index 8980da8e24b..176e9fcd154 100644
--- a/pkgs/development/python-modules/pyinsteon/default.nix
+++ b/pkgs/development/python-modules/pyinsteon/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyinsteon";
-  version = "1.5.1";
+  version = "1.5.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-H2rgPA0GW6neFIHZVZxmAP50HJUPCWDZcJ90QxLGXJ8=";
+    hash = "sha256-7iiB/a8E8E2TSkGuAWR08ESExDz8DKTMjqp4Xnp3wHU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-ldap/default.nix b/pkgs/development/python-modules/python-ldap/default.nix
index db9565607a6..5bc9f3fecfc 100644
--- a/pkgs/development/python-modules/python-ldap/default.nix
+++ b/pkgs/development/python-modules/python-ldap/default.nix
@@ -2,27 +2,41 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, pyasn1
-, pyasn1-modules
-, pythonAtLeast
 , pythonOlder
-, pytestCheckHook
+
+# build-system
+, setuptools
+
+# native dependencies
 , openldap
 , cyrus_sasl
+
+# dependencies
+, pyasn1
+, pyasn1-modules
+
+# tests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "python-ldap";
-  version = "3.4.3";
+  version = "3.4.4";
+  pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "python-ldap";
+    repo = "python-ldap";
     rev = "refs/tags/python-ldap-${version}";
-    hash = "sha256-/ehvSs2qjuTPhaaOP0agPbWyyRugBpUlPq/Ny9t2C58=";
+    hash = "sha256-v1cWoRGxbvvFnHqnwoIfmiQQcxfaA8Bf3+M5bE5PtuU=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   buildInputs = [
     openldap
     cyrus_sasl
@@ -53,7 +67,9 @@ buildPythonPackage rec {
   doCheck = !stdenv.isDarwin;
 
   meta = with lib; {
+    changelog = "https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-${version}";
     description = "Python modules for implementing LDAP clients";
+    downloadPage = "https://github.com/python-ldap/python-ldap";
     homepage = "https://www.python-ldap.org/";
     license = licenses.psfl;
   };
diff --git a/pkgs/development/python-modules/pyudev/default.nix b/pkgs/development/python-modules/pyudev/default.nix
index 29b1e5f8d53..8c3c0d86f3b 100644
--- a/pkgs/development/python-modules/pyudev/default.nix
+++ b/pkgs/development/python-modules/pyudev/default.nix
@@ -1,5 +1,13 @@
-{ lib, fetchPypi, buildPythonPackage
-, six, udev, pytest, mock, hypothesis, docutils
+{ lib
+, fetchPypi
+, buildPythonPackage
+, six
+, udev
+, pytest
+, mock
+, hypothesis
+, docutils
+, stdenvNoCC
 }:
 
 buildPythonPackage rec {
@@ -11,7 +19,7 @@ buildPythonPackage rec {
     hash = "sha256-deVNNyGPWsRbDaHw/ZzF5SajysPvHPrUEM96sziwFHE=";
   };
 
-  postPatch = ''
+  postPatch = lib.optionalString stdenvNoCC.isLinux ''
     substituteInPlace src/pyudev/_ctypeslib/utils.py \
       --replace "find_library(name)" "'${lib.getLib udev}/lib/libudev.so'"
     '';
@@ -27,9 +35,10 @@ buildPythonPackage rec {
   # https://github.com/pyudev/pyudev/issues/187
   doCheck = false;
 
-  meta = {
+  meta = with lib; {
     homepage = "https://pyudev.readthedocs.org/";
     description = "Pure Python libudev binding";
-    license = lib.licenses.lgpl21Plus;
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ frogamic ];
   };
 }
diff --git a/pkgs/development/python-modules/pyvmomi/default.nix b/pkgs/development/python-modules/pyvmomi/default.nix
index 7a740efe5a4..f395f88bf7d 100644
--- a/pkgs/development/python-modules/pyvmomi/default.nix
+++ b/pkgs/development/python-modules/pyvmomi/default.nix
@@ -1,14 +1,16 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, lxml
 , requests
 , six
+, pyopenssl
 , pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "pyvmomi";
-  version = "8.0.2.0";
+  version = "8.0.2.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +19,7 @@ buildPythonPackage rec {
     owner = "vmware";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-IoYxk/lS7dhw0q3kfpq7y/oDNmc1dOra0YA3CiHe8YM=";
+    hash = "sha256-Y7Zor70P4lhkAslckg/prfCmnszVMFPntWdJpfWnvIM=";
   };
 
   propagatedBuildInputs = [
@@ -25,6 +27,13 @@ buildPythonPackage rec {
     six
   ];
 
+  passthru.optional-dependencies = {
+    sso = [
+      lxml
+      pyopenssl
+    ];
+  };
+
   # Requires old version of vcrpy
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/ring-doorbell/default.nix b/pkgs/development/python-modules/ring-doorbell/default.nix
index f56921a691a..674c508696b 100644
--- a/pkgs/development/python-modules/ring-doorbell/default.nix
+++ b/pkgs/development/python-modules/ring-doorbell/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "ring-doorbell";
-  version = "0.8.0";
+  version = "0.8.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "ring_doorbell";
     inherit version;
-    hash = "sha256-6kfD87GlEb+f6hUSqhyPIy4Xg63f8zDdGKMaOxQYWoM=";
+    hash = "sha256-A7FQeeYym0nAQlkbpejpZqd5ZgX2cw3/DbshDxlrivw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/siobrultech-protocols/default.nix b/pkgs/development/python-modules/siobrultech-protocols/default.nix
index c0439dcec70..e21580162cf 100644
--- a/pkgs/development/python-modules/siobrultech-protocols/default.nix
+++ b/pkgs/development/python-modules/siobrultech-protocols/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "siobrultech-protocols";
-  version = "0.12.0";
+  version = "0.13.0";
 
   disabled = pythonOlder "3.8";
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "sdwilsh";
     repo = "siobrultech-protocols";
     rev = "refs/tags/v${version}";
-    hash = "sha256-71iFZS5CLYXNw57psLXswNJKfvbeKOqSncLoSsNXqjc=";
+    hash = "sha256-6BGhelyv0FoPyGwzgIX5Gbbu9Ks19MtL1AZQRZWKzhM=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index 88c2ccf4596..3f91435b3aa 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -1,23 +1,28 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, requests
 , pythonOlder
+, requests
+, setuptools
 , typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "7.4.0";
-  format = "setuptools";
+  version = "7.5.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Pcfdgjk20yYt1DCr5XQ4rzLokQNS27NOspa/21nvCuw=";
+    hash = "sha256-duDfcHHaXvORNNkpuMf6zxMZqkfCIr8ScrSKxVq/PW8=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     requests
     typing-extensions
diff --git a/pkgs/development/python-modules/succulent/default.nix b/pkgs/development/python-modules/succulent/default.nix
index 3b191bae9b8..e1ad7981b04 100644
--- a/pkgs/development/python-modules/succulent/default.nix
+++ b/pkgs/development/python-modules/succulent/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "succulent";
-  version = "0.2.5";
+  version = "0.2.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "firefly-cpp";
     repo = "succulent";
-    rev = version;
-    hash = "sha256-fSsb2UQM69AAjJd/Rvzuok7jBeAa6udbB8FbuNP8Ztw=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-CGDgt6tv+KysrytJsgDKwf2yv6shXizvD67XsGBg+nI=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/syrupy/default.nix b/pkgs/development/python-modules/syrupy/default.nix
index 8759f356259..84bc944317e 100644
--- a/pkgs/development/python-modules/syrupy/default.nix
+++ b/pkgs/development/python-modules/syrupy/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "syrupy";
-  version = "4.5.0";
+  version = "4.6.0";
   format = "pyproject";
 
   disabled = lib.versionOlder python.version "3.8.1";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "tophat";
     repo = "syrupy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HRCURqnFzo1l+PjX1LtXTSVZGA36OaRgmy4xKizeuOg=";
+    hash = "sha256-FjDGwSOKvDWx+LwUCNGEOBKV3rFG+09gtFpLLi0xgD4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/testrail-api/default.nix b/pkgs/development/python-modules/testrail-api/default.nix
index 6da3e202672..b6bb8a1b225 100644
--- a/pkgs/development/python-modules/testrail-api/default.nix
+++ b/pkgs/development/python-modules/testrail-api/default.nix
@@ -1,29 +1,44 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, requests
 , pytestCheckHook
+, pythonOlder
+, requests
 , responses
+, setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "testrail-api";
-  version = "1.12.0";
+  version = "1.12.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "tolstislon";
     repo = "testrail-api";
-    rev = version;
-    sha256 = "sha256-VuAW5Dl3pkA6mtn/mbzxTFoavO5jPoqFSFVlrxc7KRk=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-lIlTrAdNtBJdwiSFwpcHA2e+fRC+MbHS0PX7prAN+RY=";
   };
 
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
     responses
   ];
 
-  propagatedBuildInputs = [
-    requests
+  pythonImportsCheck = [
+    "testrail_api"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index 4217b87e81e..f89fed489f8 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -16,9 +16,10 @@
   filelock,
   jinja2,
   networkx,
-  openai-triton,
   sympy,
   numpy, pyyaml, cffi, click, typing-extensions,
+  # ROCm build and `torch.compile` requires `openai-triton`
+  tritonSupport ? (!stdenv.isDarwin), openai-triton,
 
   # Unit tests
   hypothesis, psutil,
@@ -303,12 +304,13 @@ in buildPythonPackage rec {
     "-Wno-pass-failed"
   ] ++ [
     "-Wno-unused-command-line-argument"
-    "-Wno-maybe-uninitialized"
     "-Wno-uninitialized"
     "-Wno-array-bounds"
-    "-Wno-stringop-overflow"
     "-Wno-free-nonheap-object"
     "-Wno-unused-result"
+  ] ++ lib.optionals stdenv.cc.isGNU [
+    "-Wno-maybe-uninitialized"
+    "-Wno-stringop-overflow"
   ]));
 
   nativeBuildInputs = [
@@ -377,12 +379,10 @@ in buildPythonPackage rec {
     # the following are required for tensorboard support
     pillow six future tensorboard protobuf
 
-    # ROCm build and `torch.compile` requires openai-triton
-    openai-triton
-
     # torch/csrc requires `pybind11` at runtime
     pybind11
   ]
+  ++ lib.optionals tritonSupport [ openai-triton ]
   ++ lib.optionals MPISupport [ mpi ]
   ++ lib.optionals rocmSupport [ rocmtoolkit_joined ];
 
diff --git a/pkgs/development/python-modules/total-connect-client/default.nix b/pkgs/development/python-modules/total-connect-client/default.nix
index 5ce5deace5d..fb510b7e764 100644
--- a/pkgs/development/python-modules/total-connect-client/default.nix
+++ b/pkgs/development/python-modules/total-connect-client/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "total-connect-client";
-  version = "2023.7";
+  version = "2023.11";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "craigjmidwinter";
     repo = "total-connect-client";
     rev = "refs/tags/${version}";
-    hash = "sha256-sx4KfWQCvGS+w83tECJSyLLWU9GkwYpo39gt4EKndPk=";
+    hash = "sha256-UTMYuSKNn5ACKg9BmeUf1SFhDV1jknbxggkmCgzB/xk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wakeonlan/default.nix b/pkgs/development/python-modules/wakeonlan/default.nix
index 801b108e504..97ceedec0d2 100644
--- a/pkgs/development/python-modules/wakeonlan/default.nix
+++ b/pkgs/development/python-modules/wakeonlan/default.nix
@@ -8,15 +8,16 @@
 
 buildPythonPackage rec {
   pname = "wakeonlan";
-  version = "3.0.0";
-  disabled = pythonOlder "3.6";
-  format = "pyproject";
+  version = "3.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "remcohaszing";
     repo = "pywakeonlan";
     rev = "refs/tags/${version}";
-    hash = "sha256-7BDE7TmTT8rSaG0rEn5QwH+izGWA2PeQzxpGiv7+3fo=";
+    hash = "sha256-VPdklyD3GVn0cex4I6zV61I0bUr4KQp8DdMKAM/r4io=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +39,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for wake on lan";
     homepage = "https://github.com/remcohaszing/pywakeonlan";
+    changelog = "https://github.com/remcohaszing/pywakeonlan/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ peterhoeg ];
   };
diff --git a/pkgs/development/python-modules/xlsxwriter/default.nix b/pkgs/development/python-modules/xlsxwriter/default.nix
index f19fe38366c..5bd96b3aa1b 100644
--- a/pkgs/development/python-modules/xlsxwriter/default.nix
+++ b/pkgs/development/python-modules/xlsxwriter/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "xlsxwriter";
-  version = "3.1.7";
+  version = "3.1.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "jmcnamara";
     repo = "XlsxWriter";
     rev = "RELEASE_${version}";
-    hash = "sha256-ZOKS9sTZvlopfIYOEhOk/rq4qtcMrNQ4Bwb8lDtKfxs=";
+    hash = "sha256-FkSInLinyn/eXBMSuivzFxCTZijOKdSG4l+gHyKENuY=";
   };
 
   nativeCheckInputs = [
@@ -30,6 +30,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module for creating Excel XLSX files";
     homepage = "https://xlsxwriter.readthedocs.io/";
+    changelog = "https://xlsxwriter.readthedocs.io/changes.html";
     license = licenses.bsd2;
     maintainers = with maintainers; [ jluttine ];
   };
diff --git a/pkgs/development/python-modules/xnd/default.nix b/pkgs/development/python-modules/xnd/default.nix
index 3657997f5a7..eac1153b4f5 100644
--- a/pkgs/development/python-modules/xnd/default.nix
+++ b/pkgs/development/python-modules/xnd/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchpatch
 , buildPythonPackage
 , python
 , ndtypes
@@ -15,6 +16,17 @@ buildPythonPackage {
 
   propagatedBuildInputs = [ ndtypes ];
 
+  buildInputs = [ libndtypes ];
+
+  patches = [
+    # python311 fixes which are on main. remove on update
+    (fetchpatch {
+      name = "python311.patch";
+      url = "https://github.com/xnd-project/xnd/commit/e1a06d9f6175f4f4e1da369b7e907ad6b2952c00.patch";
+      hash = "sha256-xzrap+FL5be13bVdsJ3zeV7t57ZC4iyhuZhuLsOzHyE=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace setup.py \
       --replace 'include_dirs = ["libxnd", "ndtypes/python/ndtypes"] + INCLUDES' \
diff --git a/pkgs/development/python-modules/ytmusicapi/default.nix b/pkgs/development/python-modules/ytmusicapi/default.nix
index 2531a6648e3..40af2c4fb62 100644
--- a/pkgs/development/python-modules/ytmusicapi/default.nix
+++ b/pkgs/development/python-modules/ytmusicapi/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "ytmusicapi";
-  version = "1.3.1";
+  version = "1.3.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "sigma67";
     repo = "ytmusicapi";
     rev = "refs/tags/${version}";
-    hash = "sha256-6dsMOFyZ8cX2zKXX682b5znJvXYTeKt99Wafz7RkfQw=";
+    hash = "sha256-vDkrKVqyisPkswvfb+UPH95mehwNgyFxRmeT+1UHvXs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/api-linter/default.nix b/pkgs/development/tools/api-linter/default.nix
index b34e2ed4f80..5b0e8e7c592 100644
--- a/pkgs/development/tools/api-linter/default.nix
+++ b/pkgs/development/tools/api-linter/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "api-linter";
-  version = "1.59.0";
+  version = "1.59.1";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     rev = "v${version}";
-    hash = "sha256-rT7mN/vW7o7Qj2BUYmwePJtvURYdgvRK7Oi7Rw/RK4A=";
+    hash = "sha256-PgDdCcXiy9Dpop2myuRoi8KQROZdJ76ce4ax7wU4bpc=";
   };
 
-  vendorHash = "sha256-TV0lA0DkQu3e9aq2uX4Ea8vrvDXxM8vgOn7EXGjld9E=";
+  vendorHash = "sha256-egAZ4CeSSStfkN2mGgzGHTBojHKHoVEf3o0oi+OpMkw=";
 
   subPackages = [ "cmd/api-linter" ];
 
@@ -23,7 +23,7 @@ buildGoModule rec {
     "-w"
   ];
 
-  # reference: https://github.com/googleapis/api-linter/blob/v1.59.0/.github/workflows/release.yaml#L76
+  # reference: https://github.com/googleapis/api-linter/blob/v1.59.1/.github/workflows/release.yaml#L76
   preBuild = ''
     cat > cmd/api-linter/version.go <<EOF
     package main
diff --git a/pkgs/development/tools/bazelisk/default.nix b/pkgs/development/tools/bazelisk/default.nix
index dda16c23843..be59f6686d5 100644
--- a/pkgs/development/tools/bazelisk/default.nix
+++ b/pkgs/development/tools/bazelisk/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "bazelisk";
-  version = "1.18.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NZDdSIXNQFSCoav+YN1VLFrHQSKZfoZDp2TWXtmQC6o=";
+    sha256 = "sha256-no1+sQ+8Ead1diCYytC3MXVA68SuWWxt40OFVrGWYdQ=";
   };
 
-  vendorHash = "sha256-oYagIEb/u/XCTbZkvynxcOtORhW75hReinrVAkdOApM=";
+  vendorHash = "sha256-hjV7Pc3DFExSCsA0jKVxb1GxoXQ7LRFGuot3V0IHG58=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/buildah/default.nix b/pkgs/development/tools/buildah/default.nix
index a2215059436..a6761a7350c 100644
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "buildah";
-  version = "1.32.1";
+  version = "1.32.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "buildah";
     rev = "v${version}";
-    hash = "sha256-imhl8CezFoSi0M0nMxIFL/ZVa8eDAA4s/ZVIMr/QUJ4=";
+    hash = "sha256-Av4wrJ+anVu1pTSFTpaseBhj+7ECsRoKb1bATrUKYuo=";
   };
 
   outputs = [ "out" "man" ];
diff --git a/pkgs/development/tools/continuous-integration/github-runner/default.nix b/pkgs/development/tools/continuous-integration/github-runner/default.nix
index 57a78dbb310..c0c15a12173 100644
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@@ -15,12 +15,11 @@
 , runtimeShell
   # List of Node.js runtimes the package should support
 , nodeRuntimes ? [ "node20" ]
-, nodejs_16
 , nodejs_20
 }:
 
 # Node.js runtimes supported by upstream
-assert builtins.all (x: builtins.elem x [ "node16" "node20" ]) nodeRuntimes;
+assert builtins.all (x: builtins.elem x [ "node20" ]) nodeRuntimes;
 
 buildDotnetModule rec {
   pname = "github-runner";
@@ -210,8 +209,6 @@ buildDotnetModule rec {
 
   preCheck = ''
     mkdir -p _layout/externals
-  '' + lib.optionalString (lib.elem "node16" nodeRuntimes) ''
-    ln -s ${nodejs_16} _layout/externals/node16
   '' + lib.optionalString (lib.elem "node20" nodeRuntimes) ''
     ln -s ${nodejs_20} _layout/externals/node20
   '';
@@ -250,8 +247,6 @@ buildDotnetModule rec {
     # externals/node$version. As opposed to the official releases, we don't
     # link the Alpine Node flavors.
     mkdir -p $out/lib/externals
-  '' + lib.optionalString (lib.elem "node16" nodeRuntimes) ''
-    ln -s ${nodejs_16} $out/lib/externals/node16
   '' + lib.optionalString (lib.elem "node20" nodeRuntimes) ''
     ln -s ${nodejs_20} $out/lib/externals/node20
   '' + ''
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index f07ac564b88..479f319c542 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitLab, fetchurl, bash }:
 
 let
-  version = "16.5.0";
+  version = "16.6.0";
 in
 buildGoModule rec {
   inherit version;
@@ -17,13 +17,13 @@ buildGoModule rec {
   # For patchShebangs
   buildInputs = [ bash ];
 
-  vendorHash = "sha256-C37ijxvyY9PG/Qn29Fmk0pxK+hq45kHIBveBltfIfTo=";
+  vendorHash = "sha256-m0+iAJITX0JfBd5ZboqlcG6eNbPJ35gHa4LV21jX5d8=";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "sha256-NLidtwn1zT7BxzMEF5K41fwbZaICA/KuAr8MIjpJD+A=";
+    sha256 = "sha256-4N00+yO7Ps0+jy7WmHhm4Eh4MXt3beH00ScZ1RWNByE=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/darklua/default.nix b/pkgs/development/tools/darklua/default.nix
index 3703cc757c6..ba7ebe5db17 100644
--- a/pkgs/development/tools/darklua/default.nix
+++ b/pkgs/development/tools/darklua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "darklua";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "seaofvoices";
     repo = "darklua";
     rev = "v${version}";
-    hash = "sha256-lBnEMQqAUkr377aYNRvpbIyZMmB6NIY/bmB1Oe8QPIM=";
+    hash = "sha256-9ukhKAhN4dD36Em90Eox8o+7W1eXboG2xAE8+oPlhaI=";
   };
 
-  cargoHash = "sha256-YmtOVS58I8YdNpWBXBuwSFUVKQsVSuGlql70SPFkamM=";
+  cargoHash = "sha256-hi9kzCwsw8c1tcvSsFV0do/jQ/KyDz3TcTEfOqHNxyw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
diff --git a/pkgs/development/tools/database/sqlcmd/default.nix b/pkgs/development/tools/database/sqlcmd/default.nix
index e36f0760ec1..80883ebfe99 100644
--- a/pkgs/development/tools/database/sqlcmd/default.nix
+++ b/pkgs/development/tools/database/sqlcmd/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "sqlcmd";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     repo = "go-sqlcmd";
     owner = "microsoft";
     rev = "v${version}";
-    sha256 = "sha256-SSt3QOc8eKpcCHxfOuY+eAkH/xiFBUp2bJ9QXP9pq9M=";
+    sha256 = "sha256-T7Jfxup3yTh0YhalUO/wxyAT4209BhZkUTbCGZggcJ0=";
   };
 
-  vendorHash = "sha256-ODIDlP0w3t1t7H5jevXkKmFpWVSJFUwmT66LOS+ySI4=";
+  vendorHash = "sha256-NYWmTXGxt2ko/puNiY2Z0K6gFZW4IC//iT6xQcqSVsQ=";
   proxyVendor = true;
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
diff --git a/pkgs/development/tools/fsautocomplete/default.nix b/pkgs/development/tools/fsautocomplete/default.nix
index a8d8c7348b0..b6ff7cc91c2 100644
--- a/pkgs/development/tools/fsautocomplete/default.nix
+++ b/pkgs/development/tools/fsautocomplete/default.nix
@@ -5,13 +5,13 @@ let
 in
 buildDotnetModule rec {
   pname = "fsautocomplete";
-  version = "0.67.0";
+  version = "0.68.0";
 
   src = fetchFromGitHub {
     owner = "fsharp";
     repo = "FsAutoComplete";
     rev = "v${version}";
-    sha256 = "sha256-txHkQDLyIejsEZGpfIGqeiJ8EUePZq1btxfd+EZD4aM=";
+    sha256 = "sha256-wAPTJXD2CxZQA2EG4rQCM9v3dIu6hn3q23K7Vv9wkAk=";
   };
 
   nugetDeps = ./deps.nix;
diff --git a/pkgs/development/tools/fsautocomplete/deps.nix b/pkgs/development/tools/fsautocomplete/deps.nix
index dab6f0aa4fb..a04c8a9e14e 100644
--- a/pkgs/development/tools/fsautocomplete/deps.nix
+++ b/pkgs/development/tools/fsautocomplete/deps.nix
@@ -15,7 +15,6 @@
   (fetchNuGet { pname = "DotNet.ReproducibleBuilds"; version = "1.1.1"; sha256 = "0wa0xwbwv1lzjmqwg1vq06vrpb9kkbv3xw5nq50savj0dzhqakzq"; })
   (fetchNuGet { pname = "Expecto"; version = "10.1.0"; sha256 = "127yy5i0p2lybhm5xcy2wa6j1rcahk61mb1nbym687b23pgizrq9"; })
   (fetchNuGet { pname = "Expecto.Diff"; version = "9.0.4"; sha256 = "06g6nbr5kdr7hyayh24ry6xfghxpcfkqc8kma5qa5lcvhmy56f7j"; })
-  (fetchNuGet { pname = "fake-cli"; version = "5.23.0"; sha256 = "1bmw5kyc9q1sqd08pamibgk0qm5xwylawc5nfrnfx3pl1pifd71y"; })
   (fetchNuGet { pname = "Fake.Api.GitHub"; version = "5.20.4"; sha256 = "1hgzqin7bm5fm0n97w7s9cq3zcxyncjmd6xk2da3p12wi7kghx0v"; })
   (fetchNuGet { pname = "Fake.Core.CommandLineParsing"; version = "5.23.1"; sha256 = "10zlkri6w2xly19v4qqvg9vii5mjwbjqfynn525swzwyna9jws76"; })
   (fetchNuGet { pname = "Fake.Core.Context"; version = "5.23.1"; sha256 = "1z3a77d53f5084sai9r9w9cdnyp4xn3x0262nhsi0znx52vizppl"; })
@@ -39,17 +38,17 @@
   (fetchNuGet { pname = "Fake.IO.Zip"; version = "5.23.1"; sha256 = "0iac86jlxb5bwgiich3zzvr7bz5aw8xq53ly263mwxhv9lrsd815"; })
   (fetchNuGet { pname = "Fake.Net.Http"; version = "5.23.1"; sha256 = "1g0dpxi5b78qh7myz09pmjxzb0iblj3rqx5mpaammbppbbazvzdk"; })
   (fetchNuGet { pname = "Fake.Tools.Git"; version = "5.23.1"; sha256 = "0cg1sbp7zl1d18cjhbs94ix8580hr6gyaxjw17q246lbaj9bfg8l"; })
-  (fetchNuGet { pname = "fantomas"; version = "6.2.0"; sha256 = "0jmr63c2a4maf1blcsiyxz9najrc31xk1ignc7j7l2sswis6hx7k"; })
+  (fetchNuGet { pname = "fantomas"; version = "6.2.2"; sha256 = "1ln1czswz8njwn1wgsq0psh7dcw6smjcilqxg8978mq05ki7i4dg"; })
   (fetchNuGet { pname = "Fantomas.Client"; version = "0.9.0"; sha256 = "1zixwk61fyk7y9q6f8266kwxi6byr8fmyp1lf57qhbbvhq2waj9d"; })
   (fetchNuGet { pname = "Fantomas.Core"; version = "6.2.0"; sha256 = "07yl2hr06zk1nl66scm24di3nf1zbrnd6329prwirnv370rz4q92"; })
   (fetchNuGet { pname = "Fantomas.FCS"; version = "6.2.0"; sha256 = "1hhsa7hbxsm2d8ap4sqzwlzjmf4wsgg74i731rprr0nshjvd8ic7"; })
   (fetchNuGet { pname = "FParsec"; version = "1.1.1"; sha256 = "01s3zrxl9kfx0264wy0m555pfx0s0z165n4fvpgx63jlqwbd8m04"; })
   (fetchNuGet { pname = "FSharp.Analyzers.SDK"; version = "0.11.0"; sha256 = "0djgbxnygmpdkrw923z2vgirs5kamrvf94ls7pvnk43c52xlb0pf"; })
-  (fetchNuGet { pname = "FSharp.Compiler.Service"; version = "43.7.400"; sha256 = "1sdc63vyplw02s5wzrly1kdsmhb144arj57q22yggigmsrhzqlag"; })
+  (fetchNuGet { pname = "FSharp.Compiler.Service"; version = "43.8.100"; sha256 = "0lk8pqasbxkqp37fsnnidw8556l1k6s8w9qhq51w8zfnp7nw1xwm"; })
   (fetchNuGet { pname = "FSharp.Control.AsyncSeq"; version = "3.2.1"; sha256 = "02c8d8snd529rrcj6lsmab3wdq2sjh90j8sanx50ck9acfn9jd3v"; })
   (fetchNuGet { pname = "FSharp.Control.Reactive"; version = "5.0.5"; sha256 = "0ahvd3s5wfv610ks3b00ya5r71cqm34ap8ywx0pyrzhlsbk1ybqg"; })
   (fetchNuGet { pname = "FSharp.Core"; version = "6.0.5"; sha256 = "07929km96znf6xnqzmxdk3h48kz2rg9msf4c5xxmnjqr0ikfb8c6"; })
-  (fetchNuGet { pname = "FSharp.Core"; version = "7.0.400"; sha256 = "1pl6iqqcpm9djfn7f6ms5j1xbcyz00nb808qd6pmsjrnylflalgp"; })
+  (fetchNuGet { pname = "FSharp.Core"; version = "8.0.100"; sha256 = "06z3vg8yj7i83x6gmnzl2lka1bp4hzc07h6mrydpilxswnmy2a0l"; })
   (fetchNuGet { pname = "FSharp.Data.Adaptive"; version = "1.2.13"; sha256 = "16l1h718h110yl2q83hzy1rpalyqlicdaxln7g0bf8kzq9b2v6rz"; })
   (fetchNuGet { pname = "FSharp.Formatting"; version = "14.0.1"; sha256 = "0sx4jlxzmrdcmc937arc9v0r90qkpf2gd1m9ngkpg88qvqcx4xsa"; })
   (fetchNuGet { pname = "FSharp.UMX"; version = "1.1.0"; sha256 = "1rzf5m38fcpphfhcv359plk2sval16kj00gdfwzpm9gi8wjw8j8k"; })
@@ -67,19 +66,19 @@
   (fetchNuGet { pname = "Grpc.Net.Common"; version = "2.51.0"; sha256 = "1b7iwf5qk4c449mi5lsnf6j99pwwrj79y8zkinzf5j2rslc97r0z"; })
   (fetchNuGet { pname = "Humanizer.Core"; version = "2.14.1"; sha256 = "1ai7hgr0qwd7xlqfd92immddyi41j3ag91h3594yzfsgsy6yhyqi"; })
   (fetchNuGet { pname = "Iced"; version = "1.17.0"; sha256 = "1999xavgpy2h83rh4indiq5mx5l509swqdi1raxj3ab6zvk49zpb"; })
-  (fetchNuGet { pname = "IcedTasks"; version = "0.5.4"; sha256 = "0584bbld25f6hzglzsah1n215658d4lwnzwxcazrwzyy25rmansl"; })
+  (fetchNuGet { pname = "IcedTasks"; version = "0.9.2"; sha256 = "1i4sg398qvxyrprca9jssn4lccwn67zndbg1a3a37cmsms5rlbvj"; })
   (fetchNuGet { pname = "ICSharpCode.Decompiler"; version = "7.2.1.6856"; sha256 = "19z68rgzl93lh1h8anbgzw119mhvcgr9nh5q2nxk6qihl2mx97ba"; })
   (fetchNuGet { pname = "Ionide.KeepAChangelog.Tasks"; version = "0.1.8"; sha256 = "066zla2rp1sal6by3h3sg6ibpkk52kbhn30bzk58l6ym7q1kqa6b"; })
-  (fetchNuGet { pname = "Ionide.LanguageServerProtocol"; version = "0.4.19"; sha256 = "1n910ipbscr7b3cr873cr5zh40ysn0n9z47dlqlndbq0g3kl6vi5"; })
+  (fetchNuGet { pname = "Ionide.LanguageServerProtocol"; version = "0.4.20"; sha256 = "08ym8lljnkqk638f2djw3c0p6h0nzxycifz1dqhzzd2my5ss46zf"; })
   (fetchNuGet { pname = "Ionide.ProjInfo"; version = "0.62.0"; sha256 = "1da6hhca9vd6hxbz9jmwxwx2pc7d5ayd41sp6mzzmbk4n3jk32q2"; })
   (fetchNuGet { pname = "Ionide.ProjInfo.FCS"; version = "0.62.0"; sha256 = "1mkw4b1sawv1p0c4a1fidkw02bh9iik7fi80ffgqi0msc3ql8lmg"; })
   (fetchNuGet { pname = "Ionide.ProjInfo.ProjectSystem"; version = "0.62.0"; sha256 = "0kj9h5gvvrl720kg5jylx8w1jjmcci7bdhabr57sbq31vbgav74d"; })
   (fetchNuGet { pname = "Ionide.ProjInfo.Sln"; version = "0.62.0"; sha256 = "05yxz0hhpi1b0kdyzbjbb0klmpbaq8i5d0s4y59wr2qbz2318xpa"; })
   (fetchNuGet { pname = "LinkDotNet.StringBuilder"; version = "1.18.0"; sha256 = "0lgh4yjnim9qbqkmkgpx5fi2lha1cgcdbddvbsiw9jzp18fndxly"; })
   (fetchNuGet { pname = "McMaster.NETCore.Plugins"; version = "1.4.0"; sha256 = "1k2qz0qnf2b1kfwbzcynivy93jm7dcwl866d0fl7qlgq5vql7niy"; })
-  (fetchNuGet { pname = "MessagePack"; version = "2.4.35"; sha256 = "0y8pz073ync51cv39lxldc797nmcm39r4pdhy2il6r95rppjqg5h"; })
-  (fetchNuGet { pname = "MessagePack.Annotations"; version = "2.4.35"; sha256 = "1jny2r6rwq7xzwymm779w9x8a5rhyln97mxzplxwd53wwbb0wbzd"; })
-  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; sha256 = "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"; })
+  (fetchNuGet { pname = "MessagePack"; version = "2.5.108"; sha256 = "0cnaz28lhrdmavnxjkakl9q8p2yv8mricvp1b0wxdfnz8v41gwzs"; })
+  (fetchNuGet { pname = "MessagePack.Annotations"; version = "2.5.108"; sha256 = "0nb1fx8dwl7304kw0bc375bvlhb7pg351l4cl3vqqd7d8zqjwx5v"; })
+  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "7.0.0"; sha256 = "1waiggh3g1cclc81gmjrqbh128kwfjky3z79ma4bd2ms9pa3gvfm"; })
   (fetchNuGet { pname = "Microsoft.Bcl.HashCode"; version = "1.1.0"; sha256 = "1ggsadahlp76zcn1plapszd5v5ja8rh479fwrahqd3knql4dfnr0"; })
   (fetchNuGet { pname = "Microsoft.Build"; version = "17.2.0"; sha256 = "09hs74nr0kv83wc1way9x7vq3nmxbr2s4vdy99hx78kj25pylcr7"; })
   (fetchNuGet { pname = "Microsoft.Build"; version = "17.4.0"; sha256 = "0j8rqwl8h2hh4yl4bvsijm0rl8356a8vfvdqj4jk5blmvfcfs7b4"; })
@@ -131,36 +130,36 @@
   (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.4.1"; sha256 = "0s68wf9yphm4hni9p6kwfk0mjld85f4hkrs93qbk5lzf6vv3kba1"; })
   (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.4.1"; sha256 = "1n9ilq8n5rhyxcri06njkxb0h2818dbmzddwd2rrvav91647m2s4"; })
   (fetchNuGet { pname = "Microsoft.VisualStudio.Setup.Configuration.Interop"; version = "3.6.2115"; sha256 = "0924lvb8i1y1majjph1hczi8p72mxlvkk3b7apdqgv5hmbn9sdxq"; })
-  (fetchNuGet { pname = "Microsoft.VisualStudio.Threading"; version = "17.3.44"; sha256 = "07w5ca1jwmiynpznb36xhxpf42y97v9flj6rxsmg4gqsh1h430i1"; })
-  (fetchNuGet { pname = "Microsoft.VisualStudio.Threading.Analyzers"; version = "17.3.44"; sha256 = "0l1hh2xb183xr5nk8xvbd8zz45n7h15cxlicg5zii6q68q8z49wf"; })
-  (fetchNuGet { pname = "Microsoft.VisualStudio.Validation"; version = "17.0.64"; sha256 = "1qm2dc9v1glpgy2blbcmsljwrsx55k82rjw4hiqh031h8idwryrl"; })
+  (fetchNuGet { pname = "Microsoft.VisualStudio.Threading"; version = "17.6.40"; sha256 = "1iv67ndrvls7qa3wrh7mnswqbhx8ggr0w1hi7md1grfm4f0nqyz4"; })
+  (fetchNuGet { pname = "Microsoft.VisualStudio.Threading.Analyzers"; version = "17.6.40"; sha256 = "0ba9r9y3jsx3s3j190mv4gg47ibyl44s58whwvas9c64hhs4n22s"; })
+  (fetchNuGet { pname = "Microsoft.VisualStudio.Validation"; version = "17.6.11"; sha256 = "0qx4nzsx28galgzzjkgf541254d433dgxcaf7y2y1qyyxgsfjj1f"; })
   (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "5.0.0"; sha256 = "102hvhq2gmlcbq8y2cb7hdr2dnmjzfp2k3asr1ycwrfacwyaak7n"; })
   (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "7.0.0"; sha256 = "1bh77misznh19m1swqm3dsbji499b8xh9gk6w74sgbkarf6ni8lb"; })
   (fetchNuGet { pname = "Mono.Cecil"; version = "0.11.4"; sha256 = "1yxa7mh432s7g7p9r7scqxvxjk5ypwc567qdbf0gmk8fbf0d3f8y"; })
   (fetchNuGet { pname = "Mono.Posix.NETStandard"; version = "1.0.0"; sha256 = "0xlja36hwpjm837haq15mjh2prcf68lyrmn72nvgpz8qnf9vappw"; })
   (fetchNuGet { pname = "MSBuild.StructuredLogger"; version = "2.1.844"; sha256 = "0fp2gng4gk63ac0wz231zwbnpy6a35mq04gy8fc81gra6px4sy5v"; })
-  (fetchNuGet { pname = "Nerdbank.Streams"; version = "2.8.61"; sha256 = "1wxhrqlhb8wq1x5kn3wacylicznl3fgmfdqvx6r3s97yv89zyzy4"; })
+  (fetchNuGet { pname = "Nerdbank.Streams"; version = "2.10.66"; sha256 = "04p4vd2v3mj1g315jj0fcb9ajwdr6clnbnl80mn6nyj3wmjb56nz"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.2"; sha256 = "1p9splg1min274dpz7xdfgzrwkyfd3xlkygwpr1xgjvvyjvs6b0i"; })
-  (fetchNuGet { pname = "NuGet.Common"; version = "6.3.0"; sha256 = "0j4ahrzakkrqqppp465bqi39bf4wn31020b96n4zl3j2zvppc0bg"; })
-  (fetchNuGet { pname = "NuGet.Configuration"; version = "6.3.0"; sha256 = "0adafjzzrbm285hhdfn2nd57xzn4r5ldm1zm2w9yaj97cdqd228f"; })
+  (fetchNuGet { pname = "NuGet.Common"; version = "6.7.0"; sha256 = "0h6k5ywqmnl3mn30d6hhvzzk0344f0cy3ks2rxvjfas1822hbpz9"; })
+  (fetchNuGet { pname = "NuGet.Configuration"; version = "6.7.0"; sha256 = "0bskqxz2b4z1f9m8kak6my9l08ngd8r0cnd7ac1h6pbf39iwfq0a"; })
   (fetchNuGet { pname = "NuGet.Frameworks"; version = "6.3.0"; sha256 = "05mqbfgkif9qa5hg1sjmcvx69ifdhiqs2xjplqjrvrj9ybmd5i0c"; })
-  (fetchNuGet { pname = "NuGet.Packaging"; version = "6.3.0"; sha256 = "0gw2r7iajdk8c52vv0g2bgwlnx79zsacy5n7yv5g2niggxrbm82x"; })
-  (fetchNuGet { pname = "NuGet.Protocol"; version = "6.3.0"; sha256 = "0vv8wbwrgvr02niv5dclcbhykxyw0mxhkmpnlh9i8rvajn0gfb0a"; })
-  (fetchNuGet { pname = "NuGet.Versioning"; version = "6.3.0"; sha256 = "1fimxklifac8ahdf02gq01533k502izay6plxcd1j8rg24xrjz6p"; })
+  (fetchNuGet { pname = "NuGet.Frameworks"; version = "6.7.0"; sha256 = "02sg1qa00dq4hfrj4zrrlccpbrmr1ymac8vcp48q9ffsx5wx6895"; })
+  (fetchNuGet { pname = "NuGet.Packaging"; version = "6.7.0"; sha256 = "0q1q21cl6987f3q73g9549h637gm2qal3x1wy81qbag4aaxfqpb0"; })
+  (fetchNuGet { pname = "NuGet.Protocol"; version = "6.7.0"; sha256 = "1v5ibnq2mp801vw68zyj169hkj3xm7h55824i33n1jxxj2vs3vbk"; })
+  (fetchNuGet { pname = "NuGet.Versioning"; version = "6.7.0"; sha256 = "1k9dzgm3a9ahalykdvjnnd47940py8lqkfrjd1k9lkiczn1bkqmi"; })
   (fetchNuGet { pname = "Octokit"; version = "0.48.0"; sha256 = "17ria1shx04rb6knbaswpqndmwam6v3r3lsfsd486q584798ccn8"; })
-  (fetchNuGet { pname = "octonav"; version = "0.0.1"; sha256 = "1zzv8nqgrrrh3ay4rvwx3npx3q0xvnsqib5q3xww5h17a6lzcbni"; })
   (fetchNuGet { pname = "OpenTelemetry"; version = "1.3.2"; sha256 = "1v9ipc75ipwjhhz4mkyjygw85i6ba5flcbhyspmf90vfi2nk7b79"; })
   (fetchNuGet { pname = "OpenTelemetry.Api"; version = "1.3.2"; sha256 = "0fgl99k6nm3n47vv9mx6y36pnljj2b5g641cs2zsw6l86n57qwv1"; })
   (fetchNuGet { pname = "OpenTelemetry.Exporter.OpenTelemetryProtocol"; version = "1.3.2"; sha256 = "14p6rn68mqrch3ani17vwyl4ggjz680nxkw1nf65xmf1ljlkb4iq"; })
-  (fetchNuGet { pname = "Paket"; version = "7.2.1"; sha256 = "1d3ic5kw1yxb7ja07hzrsfjcv8vky6x60han5h6rjm0qbsnwb6xj"; })
+  (fetchNuGet { pname = "Paket"; version = "8.0.0-alpha002"; sha256 = "1c2kdndyb04plgwvqp78224zwk26dkicjy94pqh7shc9ifskrvsb"; })
   (fetchNuGet { pname = "Perfolizer"; version = "0.2.1"; sha256 = "012aqqi3y3nfikqmn26yajpwd52c04zlzp0p91iyslw7mf26qncy"; })
   (fetchNuGet { pname = "SemanticVersioning"; version = "2.0.2"; sha256 = "025l5akirkd9g7d5g5wydvkn1wabglcyvbfshkmly7j3r0k596vp"; })
   (fetchNuGet { pname = "Serilog"; version = "2.11.0"; sha256 = "1nvd3hm615xlcdmw1i7llkd3xvwvpv66c4y4s28npv47v3yci3lh"; })
   (fetchNuGet { pname = "Serilog.Sinks.Async"; version = "1.5.0"; sha256 = "0bcb3n6lmg5wfj806mziybfmbb8gyiszrivs3swf0msy8w505gyg"; })
   (fetchNuGet { pname = "Serilog.Sinks.Console"; version = "4.0.1"; sha256 = "080vh9kcyn9lx4j7p34146kp9byvhqlaz5jn9wzx70ql9cwd0hlz"; })
   (fetchNuGet { pname = "Serilog.Sinks.File"; version = "5.0.0"; sha256 = "097rngmgcrdfy7jy8j7dq3xaq2qky8ijwg0ws6bfv5lx0f3vvb0q"; })
-  (fetchNuGet { pname = "StreamJsonRpc"; version = "2.12.27"; sha256 = "15k0z6y3dsgipzfaa73irf5xjddr5mj9z26k27s8p6viay608cxc"; })
+  (fetchNuGet { pname = "StreamJsonRpc"; version = "2.16.36"; sha256 = "1bwbbzd8rg1mjsig046ihs53gn8ywf5j9mjfy32axfziisqr1c2w"; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.5.1"; sha256 = "04kb1mdrlcixj9zh1xdi5as0k0qi8byr5mi3p3jcxx72qz93s2y3"; })
   (fetchNuGet { pname = "System.CodeDom"; version = "6.0.0"; sha256 = "1i55cxp8ycc03dmxx4n22qi6jkwfl23cgffb95izq7bjar8avxxq"; })
   (fetchNuGet { pname = "System.Collections.Immutable"; version = "7.0.0"; sha256 = "1n9122cy6v3qhsisc9lzwa1m1j62b8pi2678nsmnlyvfpk0zdagm"; })
@@ -178,7 +177,8 @@
   (fetchNuGet { pname = "System.Diagnostics.EventLog"; version = "7.0.0"; sha256 = "16p8z975dnzmncfifa9gw9n3k9ycpr2qvz7lglpghsvx0fava8k9"; })
   (fetchNuGet { pname = "System.Drawing.Common"; version = "7.0.0"; sha256 = "0jwyv5zjxzr4bm4vhmz394gsxqa02q6pxdqd2hwy1f116f0l30dp"; })
   (fetchNuGet { pname = "System.Formats.Asn1"; version = "6.0.0"; sha256 = "1vvr7hs4qzjqb37r0w1mxq7xql2b17la63jwvmgv65s1hj00g8r9"; })
-  (fetchNuGet { pname = "System.IO.Pipelines"; version = "6.0.3"; sha256 = "1jgdazpmwc21dd9naq3l9n5s8a1jnbwlvgkf1pnm0aji6jd4xqdz"; })
+  (fetchNuGet { pname = "System.Formats.Asn1"; version = "7.0.0"; sha256 = "1a14kgpqz4k7jhi7bs2gpgf67ym5wpj99203zxgwjypj7x47xhbq"; })
+  (fetchNuGet { pname = "System.IO.Pipelines"; version = "7.0.0"; sha256 = "1ila2vgi1w435j7g2y7ykp2pdbh9c5a02vm85vql89az93b7qvav"; })
   (fetchNuGet { pname = "System.Management"; version = "6.0.0"; sha256 = "0ra1g75ykapg6i5y0za721kpjd6xcq6dalijkdm6fsxxmz8iz4dr"; })
   (fetchNuGet { pname = "System.Memory"; version = "4.5.5"; sha256 = "08jsfwimcarfzrhlyvjjid61j02irx6xsklf32rv57x2aaikvx0h"; })
   (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.5.0"; sha256 = "1kzrj37yzawf1b19jq0253rcs8hsq1l2q8g69d7ipnhzb0h97m59"; })
@@ -194,7 +194,8 @@
   (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
   (fetchNuGet { pname = "System.Security.AccessControl"; version = "6.0.0"; sha256 = "0a678bzj8yxxiffyzy60z2w1nczzpi8v97igr4ip3byd2q89dv58"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "5.0.0"; sha256 = "06hkx2za8jifpslkh491dfwzm5dxrsyxzj5lsc0achb6yzg4zqlw"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "6.0.1"; sha256 = "0wswhbvm3gh06azg9k1zfvmhicpzlh7v71qzd4x5zwizq4khv7iq"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "6.0.4"; sha256 = "0hh5h38pnxmlrnvs72f2hzzpz4b2caiiv6xf8y7fzdg84r3imvfr"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "7.0.3"; sha256 = "0gw07qhch88jvx393m7ibl4g3dml60s42f3pa8a9f3v88ckkaxws"; })
   (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "6.0.0"; sha256 = "05kd3a8w7658hjxq9vvszxip30a479fjmfq4bq1r95nrsvs4hbss"; })
   (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "7.0.1"; sha256 = "1nq9ngkqha70rv41692c79zq09cx6m85wkp3xj9yc31s62afyl5i"; })
   (fetchNuGet { pname = "System.Security.Cryptography.Xml"; version = "6.0.1"; sha256 = "15d0np1njvy2ywf0qzdqyjk5sjs4zbfxg917jrvlbfwrqpqxb5dj"; })
@@ -203,9 +204,12 @@
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "6.0.0"; sha256 = "0gm2kiz2ndm9xyzxgi0jhazgwslcs427waxgfa30m7yqll1kcrww"; })
   (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "7.0.0"; sha256 = "0sn6hxdjm7bw3xgsmg041ccchsa4sp02aa27cislw3x61dbr68kq"; })
   (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "6.0.0"; sha256 = "06n9ql3fmhpjl32g3492sj181zjml5dlcc5l76xq2h38c4f87sai"; })
+  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "7.0.0"; sha256 = "1151hbyrcf8kyg1jz8k9awpbic98lwz9x129rg7zk1wrs6vjlpxl"; })
   (fetchNuGet { pname = "System.Text.Json"; version = "6.0.5"; sha256 = "12fg196sdq3gcjcz365kypfkkmdrprpcw2fvjnww9jqa4yn8v99l"; })
+  (fetchNuGet { pname = "System.Text.Json"; version = "7.0.3"; sha256 = "0zjrnc9lshagm6kdb9bdh45dmlnkpwcpyssa896sda93ngbmj8k9"; })
   (fetchNuGet { pname = "System.Threading.Channels"; version = "6.0.0"; sha256 = "1qbyi7yymqc56frqy7awvcqc1m7x3xrpx87a37dgb3mbrjg9hlcj"; })
   (fetchNuGet { pname = "System.Threading.Tasks.Dataflow"; version = "6.0.0"; sha256 = "1b4vyjdir9kdkiv2fqqm4f76h0df68k8gcd7jb2b38zgr2vpnk3c"; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Dataflow"; version = "7.0.0"; sha256 = "0ham9l8xrmlq2qwin53n82iz1wanci2h695i3cq83jcw4n28qdr9"; })
   (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.4"; sha256 = "0y6ncasgfcgnjrhynaf0lwpkpkmv4a07sswwkwbwb5h7riisj153"; })
   (fetchNuGet { pname = "System.Windows.Extensions"; version = "7.0.0"; sha256 = "11r9f0v7qp365bdpq5ax023yra4qvygljz18dlqs650d44iay669"; })
   (fetchNuGet { pname = "YoloDev.Expecto.TestSdk"; version = "0.14.2"; sha256 = "1877gr3f8wl1x3njhgss9psxm21xpqv6cpg625f2mvvak79fzrra"; })
diff --git a/pkgs/development/tools/kafkactl/default.nix b/pkgs/development/tools/kafkactl/default.nix
index b602f2b4fc6..8626daa9c76 100644
--- a/pkgs/development/tools/kafkactl/default.nix
+++ b/pkgs/development/tools/kafkactl/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "kafkactl";
-  version = "3.4.0";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "deviceinsight";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-8/MqcJ7kxlmVkZCa7PWZ6kzo6D/9Zwx2rOJs675mJUE=";
+    hash = "sha256-HGOLPns7kBq02hF5TVs0DdTdJ+16JGs996JZ66k83Os=";
   };
 
-  vendorHash = "sha256-5LHL0L7xTmy3yBs7rtrC1uvUjLKBU8LpjQaHyeRyFhw=";
+  vendorHash = "sha256-jUuJBGEb4pSdyuRd3qHINyC8aRwqyJnsb/raM9nEh84=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/kubepug/default.nix b/pkgs/development/tools/kubepug/default.nix
index 7cab2059451..fc6f9c30daa 100644
--- a/pkgs/development/tools/kubepug/default.nix
+++ b/pkgs/development/tools/kubepug/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubepug";
-  version = "1.5.1";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
-    owner = "rikatz";
+    owner = "kubepug";
     repo = "kubepug";
     rev = "v${version}";
-    hash = "sha256-HjnkGEzTobtILqML5xcjpYVtg6a5PqMKYyaGTYrqEDo=";
+    hash = "sha256-VNxaYQy81U0JWd6KS0jCvMexpyWL4v1cKpjxLRkxBLE=";
   };
 
-  vendorHash = "sha256-w2WwJa8qaXmgFwZJo2r2TowcTehgQY0nGY4u1UROaxM=";
+  vendorHash = "sha256-HVsaQBd7fSZp2fOpOOmlDhYrHcHqWKiYWPFLQX0azEw=";
 
   ldflags = [
     "-s"
@@ -19,13 +19,9 @@ buildGoModule rec {
     "-X sigs.k8s.io/release-utils/version.gitVersion=${version}"
   ];
 
-  patches = [
-    ./skip-external-network-tests.patch
-  ];
-
   meta = with lib; {
     description = "Checks a Kubernetes cluster for objects using deprecated API versions";
-    homepage = "https://github.com/rikatz/kubepug";
+    homepage = "https://github.com/kubepug/kubepug";
     license = licenses.asl20;
     maintainers = with maintainers; [ mausch ];
   };
diff --git a/pkgs/development/tools/kubepug/skip-external-network-tests.patch b/pkgs/development/tools/kubepug/skip-external-network-tests.patch
deleted file mode 100644
index e24aa01ad17..00000000000
--- a/pkgs/development/tools/kubepug/skip-external-network-tests.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/pkg/utils/downloader_test.go b/pkg/utils/downloader_test.go
-index b227760..b72dee9 100644
---- a/pkg/utils/downloader_test.go
-+++ b/pkg/utils/downloader_test.go
-@@ -7,6 +7,7 @@ import (
- )
- 
- func TestDownloadSwaggerFile(t *testing.T) {
-+    t.Skipf("Nix sandbox does not have networking")
- 	var tmpdir string
- 	// Github actions does not have a temporary dir :/
- 	tmpdir = os.Getenv("RUNNER_TEMP")
diff --git a/pkgs/development/tools/misc/kibana/7.x.nix b/pkgs/development/tools/misc/kibana/7.x.nix
deleted file mode 100644
index a4faa31a421..00000000000
--- a/pkgs/development/tools/misc/kibana/7.x.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{ elk7Version
-, enableUnfree ? true
-, lib
-, stdenv
-, makeWrapper
-, fetchurl
-, nodejs_16
-, coreutils
-, which
-}:
-
-let
-  nodejs = nodejs_16;
-  inherit (builtins) elemAt;
-  info = lib.splitString "-" stdenv.hostPlatform.system;
-  arch = elemAt info 0;
-  plat = elemAt info 1;
-  hashes =
-    {
-      x86_64-linux  = "sha512-09XokG5krjxGnk34DhxpLOGRLjb2jd82uZtwGfrzSuuqMpBhkEptK2oySGxuGdHF8uowwlR5p5YO2TvBwMsWkQ==";
-      x86_64-darwin = "sha512-cqRJnvu730Jfkr6vwbHUFuZube1g522cmvnDwTzhGGK6VN/7+9XL3vavqtUPDVdTLTUk+DrNiIQK7MaJH3SHMg==";
-      aarch64-linux = "sha512-zhtYThz5j4+w5gI1JWSnHv709Tk23eegVsrtYmdaYhZiTw2yvCTYI5uNAfBjBr8XPdp6CKF4e6Bh2wHKDYg1mg==";
-      aarch64-darwin = "sha512-cqRJnvu730Jfkr6vwbHUFuZube1g522cmvnDwTzhGGK6VN/7+9XL3vavqtUPDVdTLTUk+DrNiIQK7MaJH3SHMg==";
-    };
-
-in stdenv.mkDerivation rec {
-  pname = "kibana";
-  version = elk7Version;
-
-  src = fetchurl {
-    url = "https://artifacts.elastic.co/downloads/kibana/${pname}-${version}-${plat}-${arch}.tar.gz";
-    hash = hashes.${stdenv.hostPlatform.system} or (throw "Unknown architecture");
-  };
-
-  patches = [
-    # Kibana specifies it specifically needs nodejs 10.15.2 but nodejs in nixpkgs is at 10.15.3.
-    # The <nixpkgs/nixos/tests/elk.nix> test succeeds with this newer version so lets just
-    # disable the version check.
-    ./disable-nodejs-version-check-7.patch
-  ];
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = ''
-    mkdir -p $out/libexec/kibana $out/bin
-    mv * $out/libexec/kibana/
-    rm -r $out/libexec/kibana/node
-    makeWrapper $out/libexec/kibana/bin/kibana $out/bin/kibana \
-      --prefix PATH : "${lib.makeBinPath [ nodejs coreutils which ]}"
-    sed -i 's@NODE=.*@NODE=${nodejs}/bin/node@' $out/libexec/kibana/bin/kibana
-  '';
-
-  meta = with lib; {
-    description = "Visualize logs and time-stamped data";
-    homepage = "http://www.elasticsearch.org/overview/kibana";
-    license = licenses.elastic20;
-    maintainers = with maintainers; [ offline basvandijk ];
-    platforms = with platforms; unix;
-  };
-}
diff --git a/pkgs/development/tools/misc/kibana/disable-nodejs-version-check-7.patch b/pkgs/development/tools/misc/kibana/disable-nodejs-version-check-7.patch
deleted file mode 100644
index ef4c207764c..00000000000
--- a/pkgs/development/tools/misc/kibana/disable-nodejs-version-check-7.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff --git a/src/setup_node_env/node_version_validator.js b/src/setup_node_env/node_version_validator.js
-index 3f611e5a..f5c60c85 100644
---- a/src/setup_node_env/node_version_validator.js
-+++ b/src/setup_node_env/node_version_validator.js
-@@ -25,11 +25,11 @@ var pkg = require('../../package.json'); // Note: This is written in ES5 so we c
- var currentVersion = process && process.version || null;
- var rawRequiredVersion = pkg && pkg.engines && pkg.engines.node || null;
- var requiredVersion = rawRequiredVersion ? 'v' + rawRequiredVersion : rawRequiredVersion;
--var isVersionValid = !!currentVersion && !!requiredVersion && currentVersion === requiredVersion; // Validates current the NodeJS version compatibility when Kibana starts.
-+var isVersionValid = !!currentVersion && !!requiredVersion; // Validates current the NodeJS version compatibility when Kibana starts.
- 
- if (!isVersionValid) {
-   var errorMessage = 'Kibana does not support the current Node.js version ' + currentVersion + '. Please use Node.js ' + requiredVersion + '.'; // Actions to apply when validation fails: error report + exit.
- 
-   console.error(errorMessage);
-   process.exit(1);
--}
-\ No newline at end of file
-+}
diff --git a/pkgs/development/tools/misc/uncrustify/default.nix b/pkgs/development/tools/misc/uncrustify/default.nix
index 6899c590e95..0929aa5286b 100644
--- a/pkgs/development/tools/misc/uncrustify/default.nix
+++ b/pkgs/development/tools/misc/uncrustify/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "uncrustify";
-  version = "0.77.1";
+  version = "0.78.0";
 
   src = fetchFromGitHub {
     owner = "uncrustify";
     repo = "uncrustify";
     rev = "uncrustify-${version}";
-    sha256 = "sha256-9U6PTeU/LVFL9XzP9XSFjDx18CR3athThEz+h2+5qZ8=";
+    sha256 = "sha256-wuwZFTa8XGMN3dlpdaMYiKvyS3DJMUgqRgaDtj/s7vI=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/tools/rust/cargo-llvm-cov/default.nix b/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
index 43df364abae..0da95637741 100644
--- a/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
+++ b/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
@@ -26,7 +26,7 @@
 
 let
   pname = "cargo-llvm-cov";
-  version = "0.5.36";
+  version = "0.5.37";
 
   owner = "taiki-e";
   homepage = "https://github.com/${owner}/${pname}";
@@ -37,7 +37,7 @@ let
   cargoLock = fetchurl {
     name = "Cargo.lock";
     url = "https://crates.io/api/v1/crates/${pname}/${version}/download";
-    sha256 = "sha256-ZI5vxtMcIEtVPIeedha3S6GEvvQDBB9eyOFwkAAO22I=";
+    sha256 = "sha256-UJXZ7FhbkIcVAv4PymO4sCqhJ0KFORCCO3w0w9W46qQ=";
     downloadToTemp = true;
     postFetch = ''
       tar xzf $downloadedFile ${pname}-${version}/Cargo.lock
@@ -55,7 +55,7 @@ rustPlatform.buildRustPackage {
     inherit owner;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Ii21kjQ4nWEttvGY9bxhGmfLkI2MrAsYJZcwfE2y6uQ=";
+    sha256 = "sha256-aJIMG2gaotu1XdNxcE2xJS78qAqlNzF3p2RMvqBraTk=";
     leaveDotGit = true;
   };
 
@@ -64,7 +64,7 @@ rustPlatform.buildRustPackage {
     cp ${cargoLock} source/Cargo.lock
   '';
 
-  cargoSha256 = "sha256-BHocUJpk4qplwMfpSXNTZjOpUCZGS676xYrqtSFnP7s=";
+  cargoSha256 = "sha256-dbC8OcH/Ae98SUx9d4rsBdhYQfzsWZpiGqJoIGPDSbY=";
 
   # `cargo-llvm-cov` reads these environment variables to find these binaries,
   # which are needed to run the tests
diff --git a/pkgs/development/tools/rust/cargo-show-asm/default.nix b/pkgs/development/tools/rust/cargo-show-asm/default.nix
index 37cc46a74e0..3a8dbfb08c6 100644
--- a/pkgs/development/tools/rust/cargo-show-asm/default.nix
+++ b/pkgs/development/tools/rust/cargo-show-asm/default.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-show-asm";
-  version = "0.2.21";
+  version = "0.2.22";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-0Fj+yC464XdqeMWBgBj5g6ZQGrurFM5LbqSe9GSgbGg=";
+    hash = "sha256-yj895sAjTQAUmhU38nv9ea6r7lIwqjZFBEeGSHd0J98=";
   };
 
-  cargoHash = "sha256-fW+WvsZv34ZpwaRCs6Uom7t0cV+9yPIlN5pbRea9YEk=";
+  cargoHash = "sha256-JbS72/sE2vCocC7o4X6vZfqGz0Tb0FvO/omzj0LhnHQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/development/tools/rust/cargo-zigbuild/default.nix b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
index 5a4e14a733c..3741be37772 100644
--- a/pkgs/development/tools/rust/cargo-zigbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-zigbuild/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-zigbuild";
-  version = "0.17.4";
+  version = "0.17.5";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7XY2hFmc4Vqh8fVCSrpQkoXZKZxX3kqppIDGc3T7qRw=";
+    hash = "sha256-x0TPbqwoCaXUlrjYQ47+x5KohsiK5yCrI2Q8yA2K8Zs=";
   };
 
-  cargoHash = "sha256-a/WRXiTSmQyAlxXqeFUWWSPFbHKL7Sifv2CW7rgbLWk=";
+  cargoHash = "sha256-FK6tTAbhP1f4VasG9HCahbMTDrJ9A6zXt/T6cs3HOZE=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/development/tools/unityhub/default.nix b/pkgs/development/tools/unityhub/default.nix
index 1f3f0765db2..c8c51055313 100644
--- a/pkgs/development/tools/unityhub/default.nix
+++ b/pkgs/development/tools/unityhub/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.5.2";
+  version = "3.6.1";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/unityhub-amd64-${version}.deb";
-    sha256 = "sha256-MiehcBs+Egfen7MzkzzWxLuTrWrHkqIj1y47sPI3Y74=";
+    sha256 = "sha256-rpH87aFvbYanthwPw/SlluOH/rtj6owcVetBD4+TJeU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/web/deno/default.nix b/pkgs/development/web/deno/default.nix
index 603c9bf5d9e..27303fb8602 100644
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.38.0";
+  version = "1.38.2";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-x01KggCu/sJnVvfJW/NZ+ARcl2Nl9LKn9dPBVmZcLi4=";
+    hash = "sha256-DLVeI1pnHpUya8muVUP6VNXiLmlaedOOPPef3tHNOng=";
   };
 
-  cargoHash = "sha256-PEKdQoAYhPpeHfv2pKGTsNaA1EANpf/GJw/3s+6TCoA=";
+  cargoHash = "sha256-qTvPpUBinPm3eQ5PLcqdCcZEG5Q6kGyt35mL914K9jk=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds
@@ -44,6 +44,9 @@ rustPlatform.buildRustPackage rec {
     (with darwin.apple_sdk.frameworks; [ Security CoreServices Metal Foundation QuartzCore ])
   );
 
+  # work around "error: unknown warning group '-Wunused-but-set-parameter'"
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unknown-warning-option";
+
   buildAndTestSubdir = "cli";
 
   # The v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
diff --git a/pkgs/development/web/nodejs/v14.nix b/pkgs/development/web/nodejs/v14.nix
deleted file mode 100644
index c2d5d58bea7..00000000000
--- a/pkgs/development/web/nodejs/v14.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ callPackage, lib, overrideCC, pkgs, buildPackages, openssl, python3, enableNpm ? true }:
-
-let
-  # Clang 16+ cannot build Node v14 due to -Wenum-constexpr-conversion errors.
-  # Use an older version of clang with the current libc++ for compatibility (e.g., with icu).
-  ensureCompatibleCC = packages:
-    if packages.stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion packages.stdenv.cc.cc) "16"
-      then overrideCC packages.llvmPackages_15.stdenv (packages.llvmPackages_15.stdenv.cc.override {
-        inherit (packages.llvmPackages) libcxx;
-        extraPackages = [ packages.llvmPackages.libcxxabi ];
-      })
-      else packages.stdenv;
-
-  buildNodejs = callPackage ./nodejs.nix {
-    inherit openssl;
-    stdenv = ensureCompatibleCC pkgs;
-    buildPackages = buildPackages // { stdenv = ensureCompatibleCC buildPackages; };
-    python = python3;
-  };
-in
-  buildNodejs {
-    inherit enableNpm;
-    version = "14.21.3";
-    sha256 = "sha256-RY7AkuYK1wDdzwectj1DXBXaTHuz0/mbmo5YqZ5UB14=";
-    patches = lib.optional pkgs.stdenv.isDarwin ./bypass-xcodebuild.diff;
-  }
diff --git a/pkgs/development/web/nodejs/v16.nix b/pkgs/development/web/nodejs/v16.nix
deleted file mode 100644
index 930b648ca55..00000000000
--- a/pkgs/development/web/nodejs/v16.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ callPackage, lib, overrideCC, pkgs, buildPackages, openssl, python3, fetchpatch, enableNpm ? true }:
-
-let
-  # Clang 16+ cannot build Node v14 due to -Wenum-constexpr-conversion errors.
-  # Use an older version of clang with the current libc++ for compatibility (e.g., with icu).
-  ensureCompatibleCC = packages:
-    if packages.stdenv.cc.isClang && lib.versionAtLeast (lib.getVersion packages.stdenv.cc.cc) "16"
-      then overrideCC packages.llvmPackages_15.stdenv (packages.llvmPackages_15.stdenv.cc.override {
-        inherit (packages.llvmPackages) libcxx;
-        extraPackages = [ packages.llvmPackages.libcxxabi ];
-      })
-      else packages.stdenv;
-
-  buildNodejs = callPackage ./nodejs.nix {
-    inherit openssl;
-    stdenv = ensureCompatibleCC pkgs;
-    buildPackages = buildPackages // { stdenv = ensureCompatibleCC buildPackages; };
-    python = python3;
-  };
-
-  npmPatches = callPackage ./npm-patches.nix { };
-in
-  buildNodejs {
-    inherit enableNpm;
-    # If you do upgrade here, please update in pkgs/top-level/release.nix
-    # the permitted insecure version to ensure it gets cached for our users
-    # and backport this to stable release (23.05).
-    version = "16.20.2";
-    sha256 = "sha256-V28aA8RV5JGo0TK1h+trO4RlH8iXS7NjhDPdRNIsj0k=";
-    patches = [
-      ./disable-darwin-v8-system-instrumentation.patch
-      ./bypass-darwin-xcrun-node16.patch
-      ./node-npm-build-npm-package-logic-node16.patch
-    ] ++ npmPatches;
-  }
diff --git a/pkgs/development/web/playwright-test/default.nix b/pkgs/development/web/playwright-test/default.nix
index b795f708f18..d9c0daef783 100644
--- a/pkgs/development/web/playwright-test/default.nix
+++ b/pkgs/development/web/playwright-test/default.nix
@@ -2,7 +2,7 @@
 
 {pkgs ? import <nixpkgs> {
     inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_14"}:
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_18"}:
 
 let
   nodeEnv = import ./node-env.nix {
diff --git a/pkgs/games/itch/default.nix b/pkgs/games/itch/default.nix
index a075a789f9d..897d8f3941c 100644
--- a/pkgs/games/itch/default.nix
+++ b/pkgs/games/itch/default.nix
@@ -3,7 +3,7 @@
 , fetchzip
 , fetchFromGitHub
 , butler
-, electron_11
+, electron
 , steam-run
 , makeWrapper
 , copyDesktopItems
@@ -11,12 +11,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "itch";
-  version = "25.6.2";
+  version = "26.1.2";
 
+  # TODO: Using kitch instead of itch, revert when possible
   src = fetchzip {
-    url = "https://broth.itch.ovh/${pname}/linux-amd64/${version}/itch.zip";
+    url = "https://broth.itch.ovh/k${pname}/linux-amd64/${version}/archive/default#.zip";
     stripRoot = false;
-    sha256 = "sha256-F/vaYBHCygseiKNMJ+jBy31YDIFqYToAETGUl/pkHII=";
+    sha256 = "sha256-thXe+glpltSiKNGIRgvOZQZPJWfDHWo3dLdziyp2BM4=";
   };
 
   itch-setup = fetchzip {
@@ -29,8 +30,8 @@ stdenvNoCC.mkDerivation rec {
     fetchFromGitHub {
         owner = "itchio";
         repo = pname;
-        rev = "v25.6.1-canary"; # Use ${version} if possible
-        hash = "sha256-iBp7K7AW97SOlRa8N8TW2LcVtmUi9JU00fYUuPwKORc=";
+        rev = "v${version}-canary";
+        sha256 = "sha256-veZiKs9qHge+gCEpJ119bAT56ssXJAH3HBcYkEHqBFg=";
         sparseCheckout = [ sparseCheckout ];
       } + sparseCheckout;
 
@@ -53,6 +54,10 @@ stdenvNoCC.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
+    # TODO: Remove when the next stable Itch is stabilized
+    substituteInPlace ./resources/app/package.json \
+      --replace "kitch" "itch"
+
     mkdir -p $out/bin $out/share/${pname}/resources/app
     cp -r resources/app "$out/share/${pname}/resources/"
 
@@ -72,7 +77,7 @@ stdenvNoCC.mkDerivation rec {
 
   postFixup = ''
     makeWrapper ${steam-run}/bin/steam-run $out/bin/${pname} \
-      --add-flags ${electron_11}/bin/electron \
+      --add-flags ${electron}/bin/electron \
       --add-flags $out/share/${pname}/resources/app \
       --set BROTH_USE_LOCAL butler,itch-setup \
       --prefix PATH : ${butler}/bin/:${itch-setup}
diff --git a/pkgs/misc/cups/drivers/brother/dcp375cw/default.nix b/pkgs/misc/cups/drivers/brother/dcp375cw/default.nix
new file mode 100644
index 00000000000..c9e92e839a0
--- /dev/null
+++ b/pkgs/misc/cups/drivers/brother/dcp375cw/default.nix
@@ -0,0 +1,97 @@
+{ lib, stdenv, fetchurl, cups, dpkg, gnused, makeWrapper, ghostscript, file
+, a2ps, coreutils, gnugrep, which, gawk }:
+
+let
+  version = "1.1.3";
+  model = "dcp375cw";
+in rec {
+  driver = stdenv.mkDerivation {
+    pname = "${model}-lpr";
+    inherit version;
+
+    src = fetchurl {
+      url =
+        "https://download.brother.com/welcome/dlf005427/dcp375cwlpr-${version}-1.i386.deb";
+      sha256 =
+        "6daf0144b5802ea8da394ca14db0e6f0200d4049545649283791f899b7f7bd26";
+    };
+
+    nativeBuildInputs = [ dpkg makeWrapper ];
+    buildInputs = [ cups ghostscript a2ps gawk ];
+    unpackPhase = "dpkg-deb -x $src $out";
+
+    installPhase = ''
+      substituteInPlace $out/opt/brother/Printers/${model}/lpd/filter${model} \
+      --replace /opt "$out/opt"
+
+      patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
+      $out/opt/brother/Printers/${model}/lpd/br${model}filter
+
+      mkdir -p $out/lib/cups/filter/
+      ln -s $out/opt/brother/Printers/${model}/lpd/filter${model} $out/lib/cups/filter/brlpdwrapper${model}
+
+      wrapProgram $out/opt/brother/Printers/${model}/lpd/filter${model} \
+        --prefix PATH ":" ${
+          lib.makeBinPath [
+            gawk
+            ghostscript
+            a2ps
+            file
+            gnused
+            gnugrep
+            coreutils
+            which
+          ]
+        }
+    '';
+
+    meta = with lib; {
+      homepage = "http://www.brother.com/";
+      description = "Brother ${model} printer driver";
+      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+      license = licenses.unfree;
+      platforms = platforms.linux;
+      downloadPage =
+        "https://support.brother.com/g/b/downloadlist.aspx?c=gb&lang=en&prod=${model}_all&os=128";
+      maintainers = with maintainers; [ marcovergueira ];
+    };
+  };
+
+  cupswrapper = stdenv.mkDerivation {
+    pname = "${model}-cupswrapper";
+    inherit version;
+
+    src = fetchurl {
+      url =
+        "https://download.brother.com/welcome/dlf005429/dcp375cwcupswrapper-${version}-1.i386.deb";
+      sha256 =
+        "9a255728b595d2667b2caf9d0d332b677e1a6829a3ec1ed6d4e900a44069cf2d";
+    };
+
+    nativeBuildInputs = [ dpkg makeWrapper ];
+    buildInputs = [ cups ghostscript a2ps gawk ];
+    unpackPhase = "dpkg-deb -x $src $out";
+
+    installPhase = ''
+      for f in $out/opt/brother/Printers/${model}/cupswrapper/cupswrapper${model}; do
+        wrapProgram $f --prefix PATH : ${
+          lib.makeBinPath [ coreutils ghostscript gnugrep gnused ]
+        }
+      done
+
+      mkdir -p $out/share/cups/model
+      ln -s $out/opt/brother/Printers/${model}/cupswrapper/brother_${model}_printer_en.ppd $out/share/cups/model/
+    '';
+
+    meta = with lib; {
+      homepage = "http://www.brother.com/";
+      description = "Brother ${model} printer CUPS wrapper driver";
+      sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+      license = licenses.unfree;
+      platforms = platforms.linux;
+      downloadPage =
+        "https://support.brother.com/g/b/downloadlist.aspx?c=gb&lang=en&prod=${model}_all&os=128";
+      maintainers = with maintainers; [ marcovergueira ];
+    };
+  };
+}
diff --git a/pkgs/misc/cups/drivers/brother/mfc465cncupswrapper/default.nix b/pkgs/misc/cups/drivers/brother/mfc465cncupswrapper/default.nix
new file mode 100644
index 00000000000..c64e48a86ce
--- /dev/null
+++ b/pkgs/misc/cups/drivers/brother/mfc465cncupswrapper/default.nix
@@ -0,0 +1,82 @@
+{ lib
+, stdenv
+, fetchurl
+, dpkg
+, makeWrapper
+, coreutils
+, gnugrep
+, gnused
+, mfc465cnlpr
+, pkgsi686Linux
+, psutils
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mfc465cncupswrapper";
+  version = "1.0.1-1";
+
+  src = fetchurl {
+    url = "https://download.brother.com/welcome/dlf006134/${pname}-${version}.i386.deb";
+    sha256 = "59a62ed3cf10f1565c08ace55832bd48bd5034f7067662870edf7ff3bf0cb76a";
+  };
+
+  unpackPhase = ''
+    dpkg-deb -x $src $out
+  '';
+
+  nativeBuildInputs = [
+    dpkg
+    makeWrapper
+  ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    lpr=${mfc465cnlpr}/usr/local/Brother/Printer/mfc465cn
+    dir=$out/usr/local/Brother/Printer/mfc465cn
+    interpreter=${pkgsi686Linux.glibc.out}/lib/ld-linux.so.2
+    patchelf --set-interpreter "$interpreter" "$dir/cupswrapper/brcupsconfpt1"
+    substituteInPlace $dir/cupswrapper/cupswrappermfc465cn \
+      --replace "mkdir -p /usr" ": # mkdir -p /usr" \
+      --replace '/''${printer_model}' "/mfc465cn" \
+      --replace 'br''${printer_model}' "brmfc465cn" \
+      --replace 'brlpdwrapper''${printer_model}' "brlpdwrappermfc465cn" \
+      --replace 'filter''${printer_model}' "filtermfc465cn" \
+      --replace ' ''${printer_name}' " MFC465CN" \
+      --replace ' ''${device_name}' " MFC-465CN" \
+      --replace '(''${device_name}' "(MFC-465CN" \
+      --replace ':''${device_name}' ":MFC-465CN" \
+      --replace '/''${device_name}' "/MFC-465CN" \
+      --replace 'BR''${pcfilename}' "BR465" \
+      --replace '/''${device_model}' "/Printer" \
+      --replace '/usr/lib64/cups/filter/brlpdwrappermfc465cn' "$out/lib/cups/filter/brlpdwrappermfc465cn" \
+      --replace '/usr/local/Brother/Printer/mfc465cn/lpd/filtermfc465cn' "$lpr/lpd/filtermfc465cn" \
+      --replace '/usr/share/ppd/brmfc465cn.ppd' "$dir/cupswrapper/brmfc465.ppd" \
+      --replace '/usr/share/cups/model/brmfc465cn.ppd' "$dir/cupswrapper/brmfc465.ppd" \
+      --replace '/usr/lib/cups/filter/brlpdwrappermfc465cn' "$out/usr/lib/cups/filter/brlpdwrappermfc465cn" \
+      --replace 'nup="psnup' "nup=\"${psutils}/bin/psnup" \
+      --replace '/usr/bin/psnup' "${psutils}/bin/psnup" \
+      --replace '/usr/local/Brother/Printer/mfc465cn/cupswrapper/brcupsconfpt1' "$dir/cupswrapper/brcupsconfpt1" \
+      --replace '/usr/local/Brother/Printer/mfc465cn/inf' "$lpr/inf"
+    # Create the PPD file from the cupswrapper file
+    sed -n '/ENDOFPPDFILE1/,/ENDOFPPDFILE1/p' "$dir/cupswrapper/cupswrappermfc465cn" | head -n -1 | tail -n +2 > $dir/cupswrapper/brmfc465.ppd
+    sed -n '/ENDOFPPDFILE_END/,/ENDOFPPDFILE_END/p' "$dir/cupswrapper/cupswrappermfc465cn" | head -n -1 | tail -n +2 >> $dir/cupswrapper/brmfc465.ppd
+    chmod 644 $dir/cupswrapper/brmfc465.ppd
+    mkdir -p $out/lib/cups/filter
+    mkdir -p $out/share/cups/model
+    ln $dir/cupswrapper/cupswrappermfc465cn $out/lib/cups/filter
+    ln $dir/cupswrapper/brmfc465.ppd $out/share/cups/model
+    sed -n '/!ENDOFWFILTER!/,/!ENDOFWFILTER!/p' "$dir/cupswrapper/cupswrappermfc465cn" | sed '1 br; b; :r s/.*/printer_model=mfc465cn; cat <<!ENDOFWFILTER!/'  | bash > $out/lib/cups/filter/brlpdwrappermfc465cn
+    sed -i "/#! \/bin\/sh/a PATH=${lib.makeBinPath [ coreutils gnused gnugrep ]}:\$PATH" $out/lib/cups/filter/brlpdwrappermfc465cn
+    chmod 755 $out/lib/cups/filter/brlpdwrappermfc465cn
+    '';
+
+  meta = with lib; {
+    description = "Brother MFC-465CN CUPS wrapper driver";
+    homepage = "http://www.brother.com/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ phrogg ];
+  };
+}
diff --git a/pkgs/misc/cups/drivers/brother/mfc465cnlpr/default.nix b/pkgs/misc/cups/drivers/brother/mfc465cnlpr/default.nix
new file mode 100644
index 00000000000..dc0be00a693
--- /dev/null
+++ b/pkgs/misc/cups/drivers/brother/mfc465cnlpr/default.nix
@@ -0,0 +1,67 @@
+{ stdenv
+, lib
+, fetchurl
+, dpkg
+, makeWrapper
+, coreutils
+, file
+, gawk
+, ghostscript
+, gnused
+, pkgsi686Linux
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mfc465cnlpr";
+  version = "1.0.1-1";
+
+  src = fetchurl {
+    url = "https://download.brother.com/welcome/dlf006132/${pname}-${version}.i386.deb";
+    sha256 = "cfe0289510bf36bee6014286ea78b1ebc6bbb948dbfd3aee02f0664a7743f99b";
+  };
+
+  unpackPhase = ''
+    dpkg-deb -x $src $out
+  '';
+
+  nativeBuildInputs = [
+    dpkg
+    makeWrapper
+  ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    dir=$out/usr/local/Brother/Printer/mfc465cn
+    patchelf --set-interpreter ${pkgsi686Linux.glibc.out}/lib/ld-linux.so.2 $dir/lpd/brmfc465cnfilter
+    wrapProgram $dir/inf/setupPrintcapij \
+      --prefix PATH : ${lib.makeBinPath [
+        coreutils
+      ]}
+    substituteInPlace $dir/lpd/filtermfc465cn \
+      --replace "BR_PRT_PATH=" "BR_PRT_PATH=\"$dir/\" #"
+    wrapProgram $dir/lpd/filtermfc465cn \
+      --prefix PATH : ${lib.makeBinPath [
+        coreutils
+        file
+        ghostscript
+        gnused
+      ]}
+    substituteInPlace $dir/lpd/psconvertij2 \
+      --replace '`which gs`' "${ghostscript}/bin/gs"
+    wrapProgram $dir/lpd/psconvertij2 \
+      --prefix PATH : ${lib.makeBinPath [
+        gnused
+        gawk
+      ]}
+    chmod -R a+w $dir/inf/
+  '';
+
+  meta = with lib; {
+    description = "Brother MFC-465CN LPR printer driver";
+    homepage = "http://www.brother.com/";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ phrogg ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
index 72ef086f599..6a3bddc211e 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
@@ -32,6 +32,7 @@ appleDerivation {
   ];
 
   meta = {
+    mainProgram = "iconv";
     platforms = lib.platforms.darwin;
   };
 }
diff --git a/pkgs/os-specific/darwin/sketchybar/default.nix b/pkgs/os-specific/darwin/sketchybar/default.nix
index ab1c0b58185..9b3ef924dd0 100644
--- a/pkgs/os-specific/darwin/sketchybar/default.nix
+++ b/pkgs/os-specific/darwin/sketchybar/default.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sketchybar";
-  version = "2.19.3";
+  version = "2.19.4";
 
   src = fetchFromGitHub {
     owner = "FelixKratz";
     repo = "SketchyBar";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QT926AnV9jLc1KvYks6ukIAcMbVHOupTJWQ6vBHpcxc=";
+    hash = "sha256-6MqTyCqFv5suQgQ5a9t1mDA2njjFFgk67Kp7xO5OXoA=";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/darwin/skhd/default.nix b/pkgs/os-specific/darwin/skhd/default.nix
index fa6e1aa01e9..f979f7ec020 100644
--- a/pkgs/os-specific/darwin/skhd/default.nix
+++ b/pkgs/os-specific/darwin/skhd/default.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: {
     "BUILD_PATH=$(out)/bin"
   ];
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+
   postInstall = ''
     mkdir -p $out/Library/LaunchDaemons
     cp ${./org.nixos.skhd.plist} $out/Library/LaunchDaemons/org.nixos.skhd.plist
diff --git a/pkgs/os-specific/linux/checksec/0002-don-t-sanatize-the-environment.patch b/pkgs/os-specific/linux/checksec/0002-don-t-sanatize-the-environment.patch
new file mode 100644
index 00000000000..bd639574f63
--- /dev/null
+++ b/pkgs/os-specific/linux/checksec/0002-don-t-sanatize-the-environment.patch
@@ -0,0 +1,25 @@
+From 3b047ab4271919856ae0a3dee3a03a24045c0016 Mon Sep 17 00:00:00 2001
+From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
+Date: Mon, 13 Nov 2023 20:24:54 +0000
+Subject: [PATCH] don't sanatize the environment
+
+---
+ checksec | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/checksec b/checksec
+index 4fc3c31..135223a 100755
+--- a/checksec
++++ b/checksec
+@@ -2,9 +2,6 @@
+ # Do not edit this file directly, this file is generated from the files
+ # in the src directory. Any updates to this file will be overwritten when generated
+
+-# sanitize the environment before run
+-[[ "$(env | /bin/sed -r -e '/^(PWD|SHLVL|_)=/d')" ]] && exec -c "$0" "$@"
+-
+ # --- Modified Version ---
+ # Name    : checksec.sh
+ # Version : 1.7.0
+--
+2.42.0
diff --git a/pkgs/os-specific/linux/checksec/default.nix b/pkgs/os-specific/linux/checksec/default.nix
index 1bdd4cf5f67..07574722cd2 100644
--- a/pkgs/os-specific/linux/checksec/default.nix
+++ b/pkgs/os-specific/linux/checksec/default.nix
@@ -1,14 +1,30 @@
 { lib
 , stdenv
+, fetchpatch
 , fetchFromGitHub
 , makeWrapper
+, testers
+, runCommand
+
+  # dependencies
+, binutils
+, coreutils
+, curl
+, elfutils
 , file
 , findutils
-, binutils-unwrapped
+, gawk
 , glibc
-, coreutils
-, sysctl
+, gnugrep
+, gnused
 , openssl
+, procps
+, sysctl
+, wget
+, which
+
+  # tests
+, checksec
 }:
 
 stdenv.mkDerivation rec {
@@ -24,6 +40,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./0001-attempt-to-modprobe-config-before-checking-kernel.patch
+    # Tool would sanitize the environment, removing the PATH set by our wrapper.
+    ./0002-don-t-sanatize-the-environment.patch
+    # Fix the exit code of debug_report command. Check if PR 226 was merged when upgrading version.
+    (fetchpatch {
+      url = "https://github.com/slimm609/checksec.sh/commit/851ebff6972f122fde5507f1883e268bbff1f23d.patch";
+      hash = "sha256-DOcVF+oPGIR9VSbqE+EqWlcNANEvou1gV8qBvJLGLBE=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -33,22 +56,45 @@ stdenv.mkDerivation rec {
   installPhase =
     let
       path = lib.makeBinPath [
-        findutils
+        binutils
+        coreutils
+        curl
+        elfutils
         file
-        binutils-unwrapped
-        sysctl
+        findutils
+        gawk
+        gnugrep
+        gnused
         openssl
+        procps
+        sysctl
+        wget
+        which
       ];
     in
     ''
       mkdir -p $out/bin
       install checksec $out/bin
-      substituteInPlace $out/bin/checksec --replace /lib/libc.so.6 ${glibc.out}/lib/libc.so.6
-      substituteInPlace $out/bin/checksec --replace "/usr/bin/id -" "${coreutils}/bin/id -"
+      substituteInPlace $out/bin/checksec \
+        --replace "/bin/sed" "${gnused}/bin/sed" \
+        --replace "/usr/bin/id" "${coreutils}/bin/id" \
+        --replace "/lib/libc.so.6" "${glibc}/lib/libc.so.6"
       wrapProgram $out/bin/checksec \
         --prefix PATH : ${path}
     '';
 
+  passthru.tests = {
+    version = testers.testVersion {
+      package = checksec;
+      version = "v${version}";
+    };
+    debug-report = runCommand "debug-report" { buildInputs = [ checksec ]; } ''
+      checksec --debug_report || exit 1
+      echo "OK"
+      touch $out
+    '';
+  };
+
   meta = with lib; {
     description = "Tool for checking security bits on executables";
     homepage = "https://www.trapkit.de/tools/checksec/";
diff --git a/pkgs/servers/code-server/build-vscode-nogit.patch b/pkgs/servers/code-server/build-vscode-nogit.patch
deleted file mode 100644
index ec726c68d43..00000000000
--- a/pkgs/servers/code-server/build-vscode-nogit.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/ci/build/build-vscode.sh b/ci/build/build-vscode.sh
-index a72549fb..3aed1ad5 100755
---- a/ci/build/build-vscode.sh
-+++ b/ci/build/build-vscode.sh
-@@ -58,7 +58,6 @@ main() {
-   # telemetry available; telemetry can still be disabled by flag or setting).
-   # This needs to be done before building as Code will read this file and embed
-   # it into the client-side code.
--  git checkout product.json             # Reset in case the script exited early.
-   cp product.json product.original.json # Since jq has no inline edit.
-   jq --slurp '.[0] * .[1]' product.original.json <(
-     cat << EOF
-@@ -105,7 +104,6 @@ EOF
-   # Reset so if you develop after building you will not be stuck with the wrong
-   # commit (the dev client will use `oss-dev` but the dev server will still use
-   # product.json which will have `stable-$commit`).
--  git checkout product.json
- 
-   popd
- 
diff --git a/pkgs/servers/code-server/default.nix b/pkgs/servers/code-server/default.nix
deleted file mode 100644
index 0c5cb231085..00000000000
--- a/pkgs/servers/code-server/default.nix
+++ /dev/null
@@ -1,327 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, buildGoModule
-, makeWrapper
-, cacert
-, moreutils
-, jq
-, git
-, rsync
-, pkg-config
-, yarn
-, python3
-, esbuild
-, nodejs
-, node-gyp
-, libsecret
-, xorg
-, ripgrep
-, AppKit
-, Cocoa
-, CoreServices
-, Security
-, cctools
-, xcbuild
-, quilt
-, nixosTests
-}:
-
-let
-  system = stdenv.hostPlatform.system;
-
-  python = python3;
-  yarn' = yarn.override { inherit nodejs; };
-  defaultYarnOpts = [ ];
-
-  esbuild' = esbuild.override {
-    buildGoModule = args: buildGoModule (args // rec {
-      version = "0.16.17";
-      src = fetchFromGitHub {
-        owner = "evanw";
-        repo = "esbuild";
-        rev = "v${version}";
-        hash = "sha256-8L8h0FaexNsb3Mj6/ohA37nYLFogo5wXkAhGztGUUsQ=";
-      };
-      vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
-    });
-  };
-
-  # replaces esbuild's download script with a binary from nixpkgs
-  patchEsbuild = path: version: ''
-    mkdir -p ${path}/node_modules/esbuild/bin
-    jq "del(.scripts.postinstall)" ${path}/node_modules/esbuild/package.json | sponge ${path}/node_modules/esbuild/package.json
-    sed -i 's/${version}/${esbuild'.version}/g' ${path}/node_modules/esbuild/lib/main.js
-    ln -s -f ${esbuild'}/bin/esbuild ${path}/node_modules/esbuild/bin/esbuild
-  '';
-
-  # Comment from @code-asher, the code-server maintainer
-  # See https://github.com/NixOS/nixpkgs/pull/240001#discussion_r1244303617
-  #
-  # If the commit is missing it will break display languages (Japanese, Spanish,
-  # etc). For some reason VS Code has a hard dependency on the commit being set
-  # for that functionality.
-  # The commit is also used in cache busting. Without the commit you could run
-  # into issues where the browser is loading old versions of assets from the
-  # cache.
-  # Lastly, it can be helpful for the commit to be accurate in bug reports
-  # especially when they are built outside of our CI as sometimes the version
-  # numbers can be unreliable (since they are arbitrarily provided).
-  #
-  # To compute the commit when upgrading this derivation, do:
-  # `$ git rev-parse <git-rev>` where <git-rev> is the git revision of the `src`
-  # Example: `$ git rev-parse v4.16.1`
-  commit = "94ef3776ad7bebfb5780dfc9632e04d20d5c9a6c";
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "code-server";
-  version = "4.16.1";
-
-  src = fetchFromGitHub {
-    owner = "coder";
-    repo = "code-server";
-    rev = "v${finalAttrs.version}";
-    fetchSubmodules = true;
-    hash = "sha256-h4AooHHKV/EfN2S1z7CQKqnYW3uA3sKhSW4senlzjxI=";
-  };
-
-  yarnCache = stdenv.mkDerivation {
-    name = "${finalAttrs.pname}-${finalAttrs.version}-${system}-yarn-cache";
-    inherit (finalAttrs) src;
-
-    nativeBuildInputs = [ yarn' git cacert ];
-
-    buildPhase = ''
-      runHook preBuild
-
-      export HOME=$PWD
-      export GIT_SSL_CAINFO="${cacert}/etc/ssl/certs/ca-bundle.crt"
-
-      yarn --cwd "./vendor" install --modules-folder modules --ignore-scripts --frozen-lockfile
-
-      yarn config set yarn-offline-mirror $out
-      find "$PWD" -name "yarn.lock" -printf "%h\n" | \
-        xargs -I {} yarn --cwd {} \
-          --frozen-lockfile --ignore-scripts --ignore-platform \
-          --ignore-engines --no-progress --non-interactive
-
-      find ./lib/vscode -name "yarn.lock" -printf "%h\n" | \
-        xargs -I {} yarn --cwd {} \
-          --ignore-scripts --ignore-engines
-
-      runHook postBuild
-    '';
-
-    outputHashMode = "recursive";
-    outputHashAlgo = "sha256";
-    outputHash = "sha256-vkju+oxEYrEXFAnjz/Mf1g0ZhxBALLAaRuWE0swSWwM=";
-  };
-
-  nativeBuildInputs = [
-    nodejs
-    yarn'
-    python
-    pkg-config
-    makeWrapper
-    git
-    rsync
-    jq
-    moreutils
-    quilt
-  ];
-
-  buildInputs = lib.optionals (!stdenv.isDarwin) [ libsecret ]
-    ++ (with xorg; [ libX11 libxkbfile ])
-    ++ lib.optionals stdenv.isDarwin [
-    AppKit
-    Cocoa
-    CoreServices
-    Security
-    cctools
-    xcbuild
-  ];
-
-  patches = [
-    # Remove all git calls from the VS Code build script except `git rev-parse
-    # HEAD` which is replaced in postPatch with the commit.
-    ./build-vscode-nogit.patch
-  ];
-
-  postPatch = ''
-    export HOME=$PWD
-
-    patchShebangs ./ci
-
-    # inject git commit
-    substituteInPlace ./ci/build/build-vscode.sh \
-      --replace '$(git rev-parse HEAD)' "${commit}"
-    substituteInPlace ./ci/build/build-release.sh \
-      --replace '$(git rev-parse HEAD)' "${commit}"
-  '';
-
-  configurePhase = ''
-    runHook preConfigure
-
-    # run yarn offline by default
-    echo '--install.offline true' >> .yarnrc
-
-    # set default yarn opts
-    ${lib.concatMapStrings (option: ''
-      yarn --offline config set ${option}
-    '') defaultYarnOpts}
-
-    # set offline mirror to yarn cache we created in previous steps
-    yarn --offline config set yarn-offline-mirror "${finalAttrs.yarnCache}"
-
-    # skip unnecessary electron download
-    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
-
-    # set nodedir to prevent node-gyp from downloading headers
-    # taken from https://nixos.org/manual/nixpkgs/stable/#javascript-tool-specific
-    mkdir -p $HOME/.node-gyp/${nodejs.version}
-    echo 9 > $HOME/.node-gyp/${nodejs.version}/installVersion
-    ln -sfv ${nodejs}/include $HOME/.node-gyp/${nodejs.version}
-    export npm_config_nodedir=${nodejs}
-
-    # use updated node-gyp. fixes the following error on Darwin:
-    # PermissionError: [Errno 1] Operation not permitted: '/usr/sbin/pkgutil'
-    export npm_config_node_gyp=${node-gyp}/lib/node_modules/node-gyp/bin/node-gyp.js
-
-    runHook postConfigure
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    # install code-server dependencies
-    yarn --offline --ignore-scripts
-
-    # apply patches
-    quilt push -a
-
-    # patch shebangs of everything to allow binary packages to build
-    patchShebangs .
-
-    export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
-    export SKIP_SUBMODULE_DEPS=1
-    export NODE_OPTIONS=--openssl-legacy-provider
-
-    # rebuild binary packages now that scripts have been patched
-    echo "----- NPM rebuild"
-    npm rebuild --prefer-offline
-
-    # Replicate ci/dev/postinstall.sh
-    echo "----- Replicate ci/dev/postinstall.sh"
-    yarn --cwd "./vendor" install --modules-folder modules --offline --ignore-scripts --frozen-lockfile
-
-    # remove all built-in extensions, as these are 3rd party extensions that
-    # get downloaded from vscode marketplace
-    jq --slurp '.[0] * .[1]' "./lib/vscode/product.json" <(
-      cat << EOF
-    {
-      "builtInExtensions": []
-    }
-    EOF
-    ) | sponge ./lib/vscode/product.json
-
-    # disable automatic updates
-    sed -i '/update.mode/,/\}/{s/default:.*/default: "none",/g}' \
-      lib/vscode/src/vs/platform/update/common/update.config.contribution.ts
-
-    # Patch out remote download of nodejs from build script
-    patch -p1 -i ${./remove-node-download.patch}
-
-    # Fetch packages for vscode
-    find ./lib/vscode -name "yarn.lock" -printf "%h\n" | \
-        xargs -I {} yarn --cwd {} \
-          --frozen-lockfile --ignore-scripts --ignore-engines
-
-    # patch shebangs of everything to allow binary packages to build
-    patchShebangs .
-
-    ${patchEsbuild "./lib/vscode/build" "0.12.6"}
-    ${patchEsbuild "./lib/vscode/extensions" "0.11.23"}
-  '' + lib.optionalString stdenv.isDarwin ''
-    # use prebuilt binary for @parcel/watcher, which requires macOS SDK 10.13+
-    # (see issue #101229)
-    pushd ./lib/vscode/remote/node_modules/@parcel/watcher
-    mkdir -p ./build/Release
-    mv ./prebuilds/darwin-x64/node.napi.glibc.node ./build/Release/watcher.node
-    jq "del(.scripts) | .gypfile = false" ./package.json | sponge ./package.json
-    popd
-  '' + ''
-
-    # put ripgrep binary into bin, so postinstall does not try to download it
-    find -name ripgrep -type d \
-      -execdir mkdir -p {}/bin \; \
-      -execdir ln -s ${ripgrep}/bin/rg {}/bin/rg \;
-
-    # run postinstall scripts after patching
-    find ./lib/vscode \( -path "*/node_modules/*" -or -path "*/extensions/*" \) \
-      -and -type f -name "yarn.lock" -printf "%h\n" | \
-        xargs -I {} sh -c 'jq -e ".scripts.postinstall" {}/package.json >/dev/null && yarn --cwd {} postinstall --frozen-lockfile --offline || true'
-
-    # build code-server
-    yarn build
-
-    # build vscode
-    VERSION=${finalAttrs.version} yarn build:vscode
-
-    # inject version into package.json
-    jq --slurp '.[0] * .[1]' ./package.json <(
-      cat << EOF
-    {
-      "version": "${finalAttrs.version}"
-    }
-    EOF
-    ) | sponge ./package.json
-
-    # create release
-    yarn release
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/libexec/code-server $out/bin
-
-    # copy release to libexec path
-    cp -R -T release "$out/libexec/code-server"
-
-    # install only production dependencies
-    yarn --offline --cwd "$out/libexec/code-server" --production
-
-    # create wrapper
-    makeWrapper "${nodejs}/bin/node" "$out/bin/code-server" \
-      --add-flags "$out/libexec/code-server/out/node/entry.js"
-
-    runHook postInstall
-  '';
-
-  passthru = {
-    prefetchYarnCache = lib.overrideDerivation finalAttrs.yarnCache (d: {
-      outputHash = lib.fakeSha256;
-    });
-    tests = {
-      inherit (nixosTests) code-server;
-    };
-    # vscode-with-extensions compatibility
-    executableName = "code-server";
-    longName = "Visual Studio Code Server";
-  };
-
-  meta = {
-    description = "Run VS Code on a remote server";
-    longDescription = ''
-      code-server is VS Code running on a remote server, accessible through the
-      browser.
-    '';
-    homepage = "https://github.com/coder/code-server";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ offline henkery code-asher ];
-    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
-    mainProgram = "code-server";
-  };
-})
diff --git a/pkgs/servers/code-server/playwright.patch b/pkgs/servers/code-server/playwright.patch
deleted file mode 100644
index 95a74748189..00000000000
--- a/pkgs/servers/code-server/playwright.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- ./vendor/modules/code-oss-dev/node_modules/playwright/install.js
-+++ ./vendor/modules/code-oss-dev/node_modules/playwright/install.js
-@@ -14,6 +14,4 @@
-  * limitations under the License.
-  */
- 
--const { installDefaultBrowsersForNpmInstall } = require('playwright-core/lib/utils/registry');
--
--installDefaultBrowsersForNpmInstall();
-+process.stdout.write('Browser install disabled by Nix build script\n');
diff --git a/pkgs/servers/code-server/remove-node-download.patch b/pkgs/servers/code-server/remove-node-download.patch
deleted file mode 100644
index d19d4a2b5bf..00000000000
--- a/pkgs/servers/code-server/remove-node-download.patch
+++ /dev/null
@@ -1,28 +0,0 @@
---- ./lib/vscode/build/gulpfile.reh.js
-+++ ./lib/vscode/build/gulpfile.reh.js
-@@ -268,9 +268,6 @@
- 			.pipe(util.stripSourceMappingURL())
- 			.pipe(jsFilter.restore);
- 
--		const nodePath = `.build/node/v${nodeVersion}/${platform}-${arch}`;
--		const node = gulp.src(`${nodePath}/**`, { base: nodePath, dot: true });
--
- 		let web = [];
- 		if (type === 'reh-web') {
- 			web = [
-@@ -287,7 +284,6 @@
- 			license,
- 			sources,
- 			deps,
--			node,
- 			...web
- 		);
- 
-@@ -385,7 +381,6 @@
- 			const destinationFolderName = `vscode-${type}${dashed(platform)}${dashed(arch)}`;
- 
- 			const serverTaskCI = task.define(`vscode-${type}${dashed(platform)}${dashed(arch)}${dashed(minified)}-ci`, task.series(
--				gulp.task(`node-${platform}-${arch}`),
- 				util.rimraf(path.join(BUILD_ROOT, destinationFolderName)),
- 				packageTask(type, platform, arch, sourceFolderName, destinationFolderName)
- 			));
diff --git a/pkgs/servers/jitsi-excalidraw/default.nix b/pkgs/servers/jitsi-excalidraw/default.nix
new file mode 100644
index 00000000000..bb8bb6c2dfa
--- /dev/null
+++ b/pkgs/servers/jitsi-excalidraw/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+, nodejs
+, python3
+}:
+
+buildNpmPackage rec {
+  pname = "jitsi-excalidraw-backend";
+  version = "17";
+
+  src = fetchFromGitHub {
+    owner = "jitsi";
+    repo = "excalidraw-backend";
+    rev = "x${version}";
+    hash = "sha256-aQePkVA8KRL06VewiD0ePRpj88pAItcV7B2SBnRRtCs=";
+  };
+
+  npmDepsHash = "sha256-BJqjaqTeg5i+ECGMuiBYVToK2i2XCOVP9yeDFz6nP4k=";
+
+  nativeBuildInputs = [ python3 ];
+
+  installPhase = ''
+    mkdir -p $out/share
+    cp -r {node_modules,dist} $out/share
+  '';
+
+  postFixup = ''
+    makeWrapper ${nodejs}/bin/node $out/bin/jitsi-excalidraw-backend \
+      --add-flags dist/index.js \
+      --chdir $out/share
+  '';
+
+  meta = with lib; {
+    description = "Excalidraw collaboration backend for Jitsi";
+    homepage = "https://github.com/jitsi/excalidraw-backend";
+    license = licenses.mit;
+    maintainers = with maintainers; [ camillemndn ];
+  };
+}
diff --git a/pkgs/servers/mail/mailpit/default.nix b/pkgs/servers/mail/mailpit/default.nix
index baf15dce13e..cfc71d0c24a 100644
--- a/pkgs/servers/mail/mailpit/default.nix
+++ b/pkgs/servers/mail/mailpit/default.nix
@@ -34,6 +34,12 @@ let
       hash = "sha256-r4yv2qImIlNMPJagz5i1sxqBDnFAucc2kDUmjGktM6A=";
     };
 
+    env = lib.optionalAttrs (stdenv.isDarwin && stdenv.isx86_64) {
+      # Make sure libc++ uses `posix_memalign` instead of `aligned_alloc` on x86_64-darwin.
+      # Otherwise, nodejs would require the 11.0 SDK and macOS 10.15+.
+      NIX_CFLAGS_COMPILE = "-D__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__=101300";
+    };
+
     nativeBuildInputs = [ nodejs python3 libtool npmHooks.npmConfigHook ];
 
     buildPhase = ''
diff --git a/pkgs/servers/mautrix-whatsapp/default.nix b/pkgs/servers/mautrix-whatsapp/default.nix
index 8d201624a64..566f7d1cabf 100644
--- a/pkgs/servers/mautrix-whatsapp/default.nix
+++ b/pkgs/servers/mautrix-whatsapp/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
-  version = "0.10.3";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     rev = "v${version}";
-    hash = "sha256-lBseLxxk+3/eoJMdq4muOrA0TgEhwIReGtQO1OzqBFc=";
+    hash = "sha256-uouxOXvVbUNRHM83JearPhMTZQtMPEBfWvsVb7QJSO8=";
   };
 
   buildInputs = [ olm ];
 
-  vendorHash = "sha256-QUZ9x9BDlhoWLvdt8BTIKxHcsclT6arGICeJnOafs1g=";
+  vendorHash = "sha256-dgaI/gpngCcVRVK8SK6ac1hmc7/aYLJCnW2CCYRDXy0=";
 
   doCheck = false;
 
diff --git a/pkgs/servers/monitoring/uptime-kuma/default.nix b/pkgs/servers/monitoring/uptime-kuma/default.nix
index 917343ffecd..572b83ba9ce 100644
--- a/pkgs/servers/monitoring/uptime-kuma/default.nix
+++ b/pkgs/servers/monitoring/uptime-kuma/default.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "uptime-kuma";
-  version = "1.23.3";
+  version = "1.23.6";
 
   src = fetchFromGitHub {
     owner = "louislam";
     repo = "uptime-kuma";
     rev = version;
-    hash = "sha256-YffkCFws/61uX6BwYqTeuAq5vqLOC+FeUt6rtQG6xws=";
+    hash = "sha256-E/iyusAZnEnfXQ63LZA+9dgE0MvhFOKmrIXCEZ+LGi8=";
   };
 
-  npmDepsHash = "sha256-USyLvC6ior1YhiZz6YySaG7xiYziHB01SHC9BPwuvJo=";
+  npmDepsHash = "sha256-AeN6+0DKd+Q2g3I960PeL3IBla5S7X0od9J244HiwLU=";
 
   patches = [
     # Fixes the permissions of the database being not set correctly
diff --git a/pkgs/servers/mx-puppet-discord/node-composition.nix b/pkgs/servers/mx-puppet-discord/node-composition.nix
index 2042629fe9f..bd96f550554 100644
--- a/pkgs/servers/mx-puppet-discord/node-composition.nix
+++ b/pkgs/servers/mx-puppet-discord/node-composition.nix
@@ -2,7 +2,7 @@
 
 {pkgs ? import ../../.. {
     inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_14"}:
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_18"}:
 
 let
   nodeEnv = import ../../development/node-packages/node-env.nix {
diff --git a/pkgs/servers/nextcloud/packages/26.json b/pkgs/servers/nextcloud/packages/26.json
index 10146a31832..82d03843ad9 100644
--- a/pkgs/servers/nextcloud/packages/26.json
+++ b/pkgs/servers/nextcloud/packages/26.json
@@ -10,9 +10,9 @@
     ]
   },
   "calendar": {
-    "sha256": "1827l5hxsvfnyc2m78rs95cnb2fwi14nl7ricpl25ndh1j0a7ccz",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.5.2/calendar-v4.5.2.tar.gz",
-    "version": "4.5.2",
+    "sha256": "1iq8np72pjw2bn4zmbp2rmrh12n4z62rwrz2bb94xjza1fws7b2v",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.5.3/calendar-v4.5.3.tar.gz",
+    "version": "4.5.3",
     "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 Search! Find your events at ease\n* ☑️ Tasks! See tasks with a due date directly in the calendar\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
     "homepage": "https://github.com/nextcloud/calendar/",
     "licenses": [
@@ -29,6 +29,16 @@
       "agpl"
     ]
   },
+  "cookbook": {
+    "sha256": "18rzvdqd99nlkk3p0y9y8b17ihw5c4c9wsx8psq6xadspm97002y",
+    "url": "https://github.com/nextcloud/cookbook/releases/download/v0.10.2/Cookbook-0.10.2.tar.gz",
+    "version": "0.10.2",
+    "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "cospend": {
     "sha256": "1rg9k33yapbl8chpxx3bjyzc9h4krjavksbxsvw14kpm01rss3j9",
     "url": "https://github.com/julien-nc/cospend-nc/releases/download/v1.5.10/cospend-1.5.10.tar.gz",
@@ -40,9 +50,9 @@
     ]
   },
   "deck": {
-    "sha256": "0j228lbf0zrm2sq45f9abgkln1qzgrkw8ac5r6fhyi0qfxcpmm0m",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.9.3/deck-v1.9.3.tar.gz",
-    "version": "1.9.3",
+    "sha256": "15hir3fssvzyysazbaad8qiz0bv00x73c2wfdj5aviz9h0gp4x4v",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.9.4/deck-v1.9.4.tar.gz",
+    "version": "1.9.4",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -93,7 +103,7 @@
     "sha256": "0imddmyg9s1v3d20spr26g7mbyz2mwl3v2l1a4nz5kaxl3a6fsr2",
     "url": "https://github.com/nextcloud-releases/impersonate/releases/download/v1.13.1/impersonate-v1.13.1.tar.gz",
     "version": "1.13.1",
-    "description": "By installing the impersonate app of your Nextcloud you enable administrators to impersonate other users on the Nextcloud server. This is especially useful for debugging issues reported by users.\n\nTo impersonate a user an administrator has to simply follow the following four steps:\n\n1. Login as administrator to Nextcloud.\n2. Open users administration interface.\n3. Select the impersonate button on the affected user.\n4. Confirm the impersonation.\n\nThe administrator is then logged-in as the user, to switch back to the regular user account they simply have to press the logout button.\n\n**Note:**\n\n- This app is not compatible with instances that have encryption enabled.\n- While impersonate actions are logged note that actions performed impersonated will be logged as the impersonated user.\n- Impersonating a user is only possible after their first login.",
+    "description": "By installing the impersonate app of your Nextcloud you enable administrators to impersonate other users on the Nextcloud server. This is especially useful for debugging issues reported by users.\n\nTo impersonate a user an administrator has to simply follow the following four steps:\n\n1. Login as administrator to Nextcloud.\n2. Open users administration interface.\n3. Select the impersonate button on the affected user.\n4. Confirm the impersonation.\n\nThe administrator is then logged-in as the user, to switch back to the regular user account they simply have to press the logout button.\n\n**Note:**\n\n- This app is not compatible with instances that have encryption enabled.\n- While impersonate actions are logged note that actions performed impersonated will be logged as the impersonated user.\n- Impersonating a user is only possible after their first login.\n- You can limit which users/groups can use impersonation in Administration settings > Additional settings.",
     "homepage": "https://github.com/nextcloud/impersonate",
     "licenses": [
       "agpl"
@@ -110,10 +120,10 @@
     ]
   },
   "mail": {
-    "sha256": "0mr3npd48j444lalkph1z8rsz5jllpgdrcqsjdrqgmf70y0g55mh",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.4.3/mail-v3.4.3.tar.gz",
-    "version": "3.4.3",
-    "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!",
+    "sha256": "0ascail3vfkv3mm5s4s3ma74d6qxai76kdqxknmljnw56xb19qfv",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.4.4/mail-v3.4.4.tar.gz",
+    "version": "3.4.4",
+    "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
       "agpl"
@@ -130,15 +140,25 @@
     ]
   },
   "memories": {
-    "sha256": "0i146mlg27phs407clclksn1wjkyl0c5fb2zw0npbx5dvqnpglcd",
-    "url": "https://github.com/pulsejet/memories/releases/download/v6.0.1/memories.tar.gz",
-    "version": "6.0.1",
+    "sha256": "1yn1wkv4jxpc8faf4rl46yfddyplnryrkws3jz0x1wcr9zlxdkng",
+    "url": "https://github.com/pulsejet/memories/releases/download/v6.1.0/memories.tar.gz",
+    "version": "6.1.0",
     "description": "# Memories: Photo Management for Nextcloud\n\nMemories is a *batteries-included* photo management solution for Nextcloud with advanced features including:\n\n- **📸 Timeline**: Sort photos and videos by date taken, parsed from Exif data.\n- **⏪ Rewind**: Jump to any time in the past instantly and relive your memories.\n- **🤖 AI Tagging**: Group photos by people and objects, powered by [recognize](https://github.com/nextcloud/recognize) and [facerecognition](https://github.com/matiasdelellis/facerecognition).\n- **🖼️ Albums**: Create albums to group photos and videos together. Then share these albums with others.\n- **🫱🏻‍🫲🏻 External Sharing**: Share photos and videos with people outside of your Nextcloud instance.\n- **📱 Mobile Support**: Work from any device, of any shape and size through the web app.\n- **✏️ Edit Metadata**: Edit dates and other metadata on photos quickly and in bulk.\n- **📦 Archive**: Store photos you don't want to see in your timeline in a separate folder.\n- **📹 Video Transcoding**: Transcode videos and use HLS for maximal performance.\n- **🗺️ Map**: View your photos on a map, tagged with accurate reverse geocoding.\n- **📦 Migration**: Migrate easily from Nextcloud Photos and Google Takeout.\n- **⚡️ Performance**: Do all this very fast.\n\n## 🚀 Installation\n\n1. Install the app from the Nextcloud app store (try a demo [here](https://demo.memories.gallery/apps/memories/)).\n1. Perform the recommended [configuration steps](https://memories.gallery/config/).\n1. Run `php occ memories:index` to generate metadata indices for existing photos.\n1. Open the 📷 Memories app in Nextcloud and set the directory containing your photos.",
     "homepage": "https://memories.gallery",
     "licenses": [
       "agpl"
     ]
   },
+  "music": {
+    "sha256": "06w82v34csx4scl5n4k4fpdxiivrzjb3yvj3hh4bc15gdz68cis9",
+    "url": "https://github.com/owncloud/music/releases/download/v1.9.1/music_1.9.1_for_nextcloud.tar.gz",
+    "version": "1.9.1",
+    "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on various external apps e.g. on Android or iPhone",
+    "homepage": "https://github.com/owncloud/music",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "news": {
     "sha256": "1bkh73h0ibxyjpy3cmvhnlr7isvgqkcxdw2dw15mxksj2cln9wki",
     "url": "https://github.com/nextcloud/news/releases/download/24.0.0/news.tar.gz",
@@ -160,9 +180,9 @@
     ]
   },
   "notify_push": {
-    "sha256": "0hdxnkar2ibis5p0gp3yr1i6894la9wxq4pzrbqdrq2cgvsj6a18",
-    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.3/notify_push-v0.6.3.tar.gz",
-    "version": "0.6.3",
+    "sha256": "0lwyy1pnyfw464vab1v5k8q0rgarrj5w12cf1nsywjaafb8y1ym0",
+    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.5/notify_push-v0.6.5.tar.gz",
+    "version": "0.6.5",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
     "homepage": "",
     "licenses": [
@@ -180,9 +200,9 @@
     ]
   },
   "polls": {
-    "sha256": "1v5zb164f60qskfiv02l9x2v0d4rayacg5qivd70dawmyqnz4vmd",
-    "url": "https://github.com/nextcloud/polls/releases/download/v5.3.2/polls.tar.gz",
-    "version": "5.3.2",
+    "sha256": "1dmws4ybv3pzxz5g9c7ghblx0nfal2ssmsg7hjcs1n4xcjc6585p",
+    "url": "https://github.com/nextcloud/polls/releases/download/v5.4.2/polls.tar.gz",
+    "version": "5.4.2",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -240,9 +260,9 @@
     ]
   },
   "twofactor_nextcloud_notification": {
-    "sha256": "03fp8wcwhyp8ivrcf20klgg17sxc9fia5sa44rbrv3cicmwmw50b",
-    "url": "https://github.com/nextcloud-releases/twofactor_nextcloud_notification/releases/download/v3.7.0/twofactor_nextcloud_notification-v3.7.0.tar.gz",
-    "version": "3.7.0",
+    "sha256": "0gaqgzbryim580dxarak7p4g3wd8wp3w6lw9jhl84jh46wrsbrj8",
+    "url": "https://github.com/nextcloud-releases/twofactor_nextcloud_notification/releases/download/v3.8.0/twofactor_nextcloud_notification-v3.8.0.tar.gz",
+    "version": "3.8.0",
     "description": "Allows using any of your logged in devices as second factor",
     "homepage": "https://github.com/nextcloud/twofactor_nextcloud_notification",
     "licenses": [
@@ -250,9 +270,9 @@
     ]
   },
   "twofactor_webauthn": {
-    "sha256": "1lqcw74rsnl8c4sirw9208ra3c8zl8zp93scs7y8fv2n4n60l465",
-    "url": "https://github.com/nextcloud-releases/twofactor_webauthn/releases/download/v1.2.0/twofactor_webauthn-v1.2.0.tar.gz",
-    "version": "1.2.0",
+    "sha256": "0z6m2chq5kxc8f10g6n1lh51yi10svy2qp5gp0v8xs71apqcc2wx",
+    "url": "https://github.com/nextcloud-releases/twofactor_webauthn/releases/download/v1.3.0/twofactor_webauthn-v1.3.0.tar.gz",
+    "version": "1.3.0",
     "description": "A two-factor provider for WebAuthn devices",
     "homepage": "https://github.com/nextcloud/twofactor_webauthn#readme",
     "licenses": [
@@ -270,9 +290,9 @@
     ]
   },
   "user_saml": {
-    "sha256": "1gsq5mcn5nnxd56jlp4j2610gqq2gk3ma9yvhgy74wl0sqil98jd",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v5.2.2/user_saml-v5.2.2.tar.gz",
-    "version": "5.2.2",
+    "sha256": "04ivgqdls72p6x5yrh5p5ycbbfmxhzd0dqin1grblm6cbl7b4s2k",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v5.2.4/user_saml-v5.2.4.tar.gz",
+    "version": "5.2.4",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/27.json b/pkgs/servers/nextcloud/packages/27.json
index 257a773ecb7..6ecb1f3f522 100644
--- a/pkgs/servers/nextcloud/packages/27.json
+++ b/pkgs/servers/nextcloud/packages/27.json
@@ -10,9 +10,9 @@
     ]
   },
   "calendar": {
-    "sha256": "1827l5hxsvfnyc2m78rs95cnb2fwi14nl7ricpl25ndh1j0a7ccz",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.5.2/calendar-v4.5.2.tar.gz",
-    "version": "4.5.2",
+    "sha256": "1iq8np72pjw2bn4zmbp2rmrh12n4z62rwrz2bb94xjza1fws7b2v",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.5.3/calendar-v4.5.3.tar.gz",
+    "version": "4.5.3",
     "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 Search! Find your events at ease\n* ☑️ Tasks! See tasks with a due date directly in the calendar\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
     "homepage": "https://github.com/nextcloud/calendar/",
     "licenses": [
@@ -29,6 +29,16 @@
       "agpl"
     ]
   },
+  "cookbook": {
+    "sha256": "18rzvdqd99nlkk3p0y9y8b17ihw5c4c9wsx8psq6xadspm97002y",
+    "url": "https://github.com/nextcloud/cookbook/releases/download/v0.10.2/Cookbook-0.10.2.tar.gz",
+    "version": "0.10.2",
+    "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "cospend": {
     "sha256": "1rg9k33yapbl8chpxx3bjyzc9h4krjavksbxsvw14kpm01rss3j9",
     "url": "https://github.com/julien-nc/cospend-nc/releases/download/v1.5.10/cospend-1.5.10.tar.gz",
@@ -40,9 +50,9 @@
     ]
   },
   "deck": {
-    "sha256": "060im5zlj7w6x9d5jpxsziqc8ym6fk573dynvdz231jx360s52g6",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.11.0/deck-v1.11.0.tar.gz",
-    "version": "1.11.0",
+    "sha256": "18gscc95zay7nrzdm1h5b52r4bpmpzc1h1xb00214qnb59mydiwr",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.11.1/deck-v1.11.1.tar.gz",
+    "version": "1.11.1",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -93,7 +103,7 @@
     "sha256": "1rpqi7yqzhmdqfl2hq326zv91gn246bgqjzcimsiap20f22z169j",
     "url": "https://github.com/nextcloud-releases/impersonate/releases/download/v1.14.0/impersonate-v1.14.0.tar.gz",
     "version": "1.14.0",
-    "description": "By installing the impersonate app of your Nextcloud you enable administrators to impersonate other users on the Nextcloud server. This is especially useful for debugging issues reported by users.\n\nTo impersonate a user an administrator has to simply follow the following four steps:\n\n1. Login as administrator to Nextcloud.\n2. Open users administration interface.\n3. Select the impersonate button on the affected user.\n4. Confirm the impersonation.\n\nThe administrator is then logged-in as the user, to switch back to the regular user account they simply have to press the logout button.\n\n**Note:**\n\n- This app is not compatible with instances that have encryption enabled.\n- While impersonate actions are logged note that actions performed impersonated will be logged as the impersonated user.\n- Impersonating a user is only possible after their first login.",
+    "description": "By installing the impersonate app of your Nextcloud you enable administrators to impersonate other users on the Nextcloud server. This is especially useful for debugging issues reported by users.\n\nTo impersonate a user an administrator has to simply follow the following four steps:\n\n1. Login as administrator to Nextcloud.\n2. Open users administration interface.\n3. Select the impersonate button on the affected user.\n4. Confirm the impersonation.\n\nThe administrator is then logged-in as the user, to switch back to the regular user account they simply have to press the logout button.\n\n**Note:**\n\n- This app is not compatible with instances that have encryption enabled.\n- While impersonate actions are logged note that actions performed impersonated will be logged as the impersonated user.\n- Impersonating a user is only possible after their first login.\n- You can limit which users/groups can use impersonation in Administration settings > Additional settings.",
     "homepage": "https://github.com/nextcloud/impersonate",
     "licenses": [
       "agpl"
@@ -110,10 +120,10 @@
     ]
   },
   "mail": {
-    "sha256": "0mr3npd48j444lalkph1z8rsz5jllpgdrcqsjdrqgmf70y0g55mh",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.4.3/mail-v3.4.3.tar.gz",
-    "version": "3.4.3",
-    "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!",
+    "sha256": "0ascail3vfkv3mm5s4s3ma74d6qxai76kdqxknmljnw56xb19qfv",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.4.4/mail-v3.4.4.tar.gz",
+    "version": "3.4.4",
+    "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
       "agpl"
@@ -130,15 +140,25 @@
     ]
   },
   "memories": {
-    "sha256": "0i146mlg27phs407clclksn1wjkyl0c5fb2zw0npbx5dvqnpglcd",
-    "url": "https://github.com/pulsejet/memories/releases/download/v6.0.1/memories.tar.gz",
-    "version": "6.0.1",
+    "sha256": "1yn1wkv4jxpc8faf4rl46yfddyplnryrkws3jz0x1wcr9zlxdkng",
+    "url": "https://github.com/pulsejet/memories/releases/download/v6.1.0/memories.tar.gz",
+    "version": "6.1.0",
     "description": "# Memories: Photo Management for Nextcloud\n\nMemories is a *batteries-included* photo management solution for Nextcloud with advanced features including:\n\n- **📸 Timeline**: Sort photos and videos by date taken, parsed from Exif data.\n- **⏪ Rewind**: Jump to any time in the past instantly and relive your memories.\n- **🤖 AI Tagging**: Group photos by people and objects, powered by [recognize](https://github.com/nextcloud/recognize) and [facerecognition](https://github.com/matiasdelellis/facerecognition).\n- **🖼️ Albums**: Create albums to group photos and videos together. Then share these albums with others.\n- **🫱🏻‍🫲🏻 External Sharing**: Share photos and videos with people outside of your Nextcloud instance.\n- **📱 Mobile Support**: Work from any device, of any shape and size through the web app.\n- **✏️ Edit Metadata**: Edit dates and other metadata on photos quickly and in bulk.\n- **📦 Archive**: Store photos you don't want to see in your timeline in a separate folder.\n- **📹 Video Transcoding**: Transcode videos and use HLS for maximal performance.\n- **🗺️ Map**: View your photos on a map, tagged with accurate reverse geocoding.\n- **📦 Migration**: Migrate easily from Nextcloud Photos and Google Takeout.\n- **⚡️ Performance**: Do all this very fast.\n\n## 🚀 Installation\n\n1. Install the app from the Nextcloud app store (try a demo [here](https://demo.memories.gallery/apps/memories/)).\n1. Perform the recommended [configuration steps](https://memories.gallery/config/).\n1. Run `php occ memories:index` to generate metadata indices for existing photos.\n1. Open the 📷 Memories app in Nextcloud and set the directory containing your photos.",
     "homepage": "https://memories.gallery",
     "licenses": [
       "agpl"
     ]
   },
+  "music": {
+    "sha256": "06w82v34csx4scl5n4k4fpdxiivrzjb3yvj3hh4bc15gdz68cis9",
+    "url": "https://github.com/owncloud/music/releases/download/v1.9.1/music_1.9.1_for_nextcloud.tar.gz",
+    "version": "1.9.1",
+    "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on various external apps e.g. on Android or iPhone",
+    "homepage": "https://github.com/owncloud/music",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "news": {
     "sha256": "1bkh73h0ibxyjpy3cmvhnlr7isvgqkcxdw2dw15mxksj2cln9wki",
     "url": "https://github.com/nextcloud/news/releases/download/24.0.0/news.tar.gz",
@@ -160,9 +180,9 @@
     ]
   },
   "notify_push": {
-    "sha256": "0hdxnkar2ibis5p0gp3yr1i6894la9wxq4pzrbqdrq2cgvsj6a18",
-    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.3/notify_push-v0.6.3.tar.gz",
-    "version": "0.6.3",
+    "sha256": "0lwyy1pnyfw464vab1v5k8q0rgarrj5w12cf1nsywjaafb8y1ym0",
+    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.5/notify_push-v0.6.5.tar.gz",
+    "version": "0.6.5",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
     "homepage": "",
     "licenses": [
@@ -180,9 +200,9 @@
     ]
   },
   "polls": {
-    "sha256": "1v5zb164f60qskfiv02l9x2v0d4rayacg5qivd70dawmyqnz4vmd",
-    "url": "https://github.com/nextcloud/polls/releases/download/v5.3.2/polls.tar.gz",
-    "version": "5.3.2",
+    "sha256": "1dmws4ybv3pzxz5g9c7ghblx0nfal2ssmsg7hjcs1n4xcjc6585p",
+    "url": "https://github.com/nextcloud/polls/releases/download/v5.4.2/polls.tar.gz",
+    "version": "5.4.2",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -240,9 +260,9 @@
     ]
   },
   "twofactor_nextcloud_notification": {
-    "sha256": "03fp8wcwhyp8ivrcf20klgg17sxc9fia5sa44rbrv3cicmwmw50b",
-    "url": "https://github.com/nextcloud-releases/twofactor_nextcloud_notification/releases/download/v3.7.0/twofactor_nextcloud_notification-v3.7.0.tar.gz",
-    "version": "3.7.0",
+    "sha256": "0gaqgzbryim580dxarak7p4g3wd8wp3w6lw9jhl84jh46wrsbrj8",
+    "url": "https://github.com/nextcloud-releases/twofactor_nextcloud_notification/releases/download/v3.8.0/twofactor_nextcloud_notification-v3.8.0.tar.gz",
+    "version": "3.8.0",
     "description": "Allows using any of your logged in devices as second factor",
     "homepage": "https://github.com/nextcloud/twofactor_nextcloud_notification",
     "licenses": [
@@ -250,9 +270,9 @@
     ]
   },
   "twofactor_webauthn": {
-    "sha256": "1lqcw74rsnl8c4sirw9208ra3c8zl8zp93scs7y8fv2n4n60l465",
-    "url": "https://github.com/nextcloud-releases/twofactor_webauthn/releases/download/v1.2.0/twofactor_webauthn-v1.2.0.tar.gz",
-    "version": "1.2.0",
+    "sha256": "0z6m2chq5kxc8f10g6n1lh51yi10svy2qp5gp0v8xs71apqcc2wx",
+    "url": "https://github.com/nextcloud-releases/twofactor_webauthn/releases/download/v1.3.0/twofactor_webauthn-v1.3.0.tar.gz",
+    "version": "1.3.0",
     "description": "A two-factor provider for WebAuthn devices",
     "homepage": "https://github.com/nextcloud/twofactor_webauthn#readme",
     "licenses": [
@@ -270,9 +290,9 @@
     ]
   },
   "user_saml": {
-    "sha256": "1gsq5mcn5nnxd56jlp4j2610gqq2gk3ma9yvhgy74wl0sqil98jd",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v5.2.2/user_saml-v5.2.2.tar.gz",
-    "version": "5.2.2",
+    "sha256": "04ivgqdls72p6x5yrh5p5ycbbfmxhzd0dqin1grblm6cbl7b4s2k",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v5.2.4/user_saml-v5.2.4.tar.gz",
+    "version": "5.2.4",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/nextcloud-apps.json b/pkgs/servers/nextcloud/packages/nextcloud-apps.json
index bbbe556f6cb..8b6f49c524c 100644
--- a/pkgs/servers/nextcloud/packages/nextcloud-apps.json
+++ b/pkgs/servers/nextcloud/packages/nextcloud-apps.json
@@ -2,6 +2,7 @@
   "bookmarks": "agpl3Plus"
 , "calendar": "agpl3Plus"
 , "contacts": "agpl3Plus"
+, "cookbook": "agpl3Plus"
 , "cospend": "agpl3Plus"
 , "deck": "agpl3Plus"
 , "files_texteditor": "agpl3Plus"
@@ -13,6 +14,7 @@
 , "mail": "agpl3Plus"
 , "maps": "agpl3Plus"
 , "memories": "agpl3Plus"
+, "music": "agpl3Plus"
 , "news": "agpl3Plus"
 , "notes": "agpl3Plus"
 , "notify_push": "agpl3Plus"
diff --git a/pkgs/servers/slimserver/default.nix b/pkgs/servers/slimserver/default.nix
index f561eec0bac..08d9dbe97e6 100644
--- a/pkgs/servers/slimserver/default.nix
+++ b/pkgs/servers/slimserver/default.nix
@@ -5,13 +5,18 @@
 , lib
 , makeWrapper
 , monkeysAudio
-, perlPackages
+, nixosTests
+, perl538Packages
 , sox
 , stdenv
 , wavpack
 , zlib
+, enableUnfreeFirmware ? false
 }:
 
+let
+  perlPackages = perl538Packages;
+in
 perlPackages.buildPerlPackage rec {
   pname = "slimserver";
   version = "8.3.1";
@@ -25,10 +30,99 @@ perlPackages.buildPerlPackage rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  buildInputs = [ perlPackages.CryptOpenSSLRSA perlPackages.IOSocketSSL ];
+  buildInputs = with perlPackages; [
+    AnyEvent
+    ArchiveZip
+    AsyncUtil
+    AudioScan
+    CarpClan
+    CGI
+    ClassAccessor
+    ClassAccessorChained
+    ClassC3
+    # ClassC3Componentised # Error: DBIx::Class::Row::throw_exception(): DBIx::Class::Relationship::BelongsTo::belongs_to(): Can't infer join condition for track
+    ClassDataInheritable
+    ClassInspector
+    ClassISA
+    ClassMember
+    ClassSingleton
+    ClassVirtual
+    ClassXSAccessor
+    CompressRawZlib
+    CryptOpenSSLRSA
+    DataDump
+    DataPage
+    DataURIEncode
+    DBDSQLite
+    DBI
+    # DBIxClass # https://github.com/Logitech/slimserver/issues/138
+    DigestSHA1
+    EncodeDetect
+    EV
+    ExporterLite
+    FileBOM
+    FileCopyRecursive
+    FileNext
+    FileReadBackwards
+    FileSlurp
+    FileWhich
+    HTMLParser
+    HTTPCookies
+    HTTPDaemon
+    HTTPMessage
+    ImageScale
+    IOAIO
+    IOInterface
+    IOSocketSSL
+    IOString
+    JSONXS
+    JSONXSVersionOneAndTwo
+    # LogLog4perl # Internal error: Root Logger not initialized.
+    LWP
+    LWPProtocolHttps
+    MP3CutGapless
+    NetHTTP
+    NetHTTPSNB
+    PathClass
+    ProcBackground
+    # SQLAbstract # DBI Exception: DBD::SQLite::db prepare_cached failed: no such function: ARRAY
+    SQLAbstractLimit
+    SubName
+    TemplateToolkit
+    TextUnidecode
+    TieCacheLRU
+    TieCacheLRUExpires
+    TieRegexpHash
+    TimeDate
+    URI
+    URIFind
+    UUIDTiny
+    XMLParser
+    XMLSimple
+    YAMLLibYAML
+  ]
+  # ++ (lib.optional stdenv.isDarwin perlPackages.MacFSEvents)
+  ++ (lib.optional stdenv.isLinux perlPackages.LinuxInotify2);
 
   prePatch = ''
+    # remove vendored binaries
     rm -rf Bin
+
+    # remove most vendored modules, keeping necessary ones
+    mkdir -p CPAN_used/Class/C3/ CPAN_used/SQL
+    rm -r CPAN/SQL/Abstract/Limit.pm
+    cp -rv CPAN/Class/C3/Componentised.pm CPAN_used/Class/C3/
+    cp -rv CPAN/DBIx CPAN_used/
+    cp -rv CPAN/Log CPAN_used/
+    cp -rv CPAN/SQL/* CPAN_used/SQL/
+    rm -r CPAN
+    mv CPAN_used CPAN
+
+    ${lib.optionalString (!enableUnfreeFirmware) ''
+      # remove unfree firmware
+      rm -rf Firmware
+    ''}
+
     touch Makefile.PL
   '';
 
@@ -38,18 +132,26 @@ perlPackages.buildPerlPackage rec {
     cp -r . $out
     wrapProgram $out/slimserver.pl \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ zlib stdenv.cc.cc.lib ]}" \
-      --prefix PATH : "${lib.makeBinPath [ lame flac faad2 sox monkeysAudio wavpack ]}"
+      --prefix PATH : "${lib.makeBinPath ([ lame flac faad2 sox wavpack ] ++ (lib.optional stdenv.isLinux monkeysAudio))}"
+    mkdir $out/bin
+    ln -s $out/slimserver.pl $out/bin/slimserver
   '';
 
   outputs = [ "out" ];
 
+  passthru.tests = {
+    inherit (nixosTests) slimserver;
+  };
+
   meta = with lib; {
     homepage = "https://github.com/Logitech/slimserver";
     description = "Server for Logitech Squeezebox players. This server is also called Logitech Media Server";
-    # the firmware is not under a free license!
+    # the firmware is not under a free license, but not included in the default package
     # https://github.com/Logitech/slimserver/blob/public/8.3/License.txt
-    license = licenses.unfree;
+    license = if enableUnfreeFirmware then licenses.unfree else licenses.gpl2Only;
+    mainProgram = "slimserver";
     maintainers = with maintainers; [ adamcstephens jecaro ];
     platforms = platforms.unix;
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/servers/sql/dolt/default.nix b/pkgs/servers/sql/dolt/default.nix
index 7500c0ca4ff..73c826e968a 100644
--- a/pkgs/servers/sql/dolt/default.nix
+++ b/pkgs/servers/sql/dolt/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "dolt";
-  version = "1.21.4";
+  version = "1.24.0";
 
   src = fetchFromGitHub {
     owner = "dolthub";
     repo = "dolt";
     rev = "v${version}";
-    sha256 = "sha256-pa9xsbO/d5/3wCx2XKn4dzlqPlO3Ie/cGJiwfWTEUKc=";
+    sha256 = "sha256-bft4fa/ZABodrm7uwl7o2whqWhxuL7l3nLqCuTv4V0k=";
   };
 
   modRoot = "./go";
   subPackages = [ "cmd/dolt" ];
-  vendorHash = "sha256-1Cy0PmDmMPpPZ2PLDP6sywb39MuExv2yabqSeP3Of9M=";
+  vendorHash = "sha256-0UNIPwFiQisWDRFaCA3JuS9R0byhWcCDQb54DZXQJ2w=";
   proxyVendor = true;
   doCheck = false;
 
diff --git a/pkgs/servers/unifi/default.nix b/pkgs/servers/unifi/default.nix
index e705d8bc394..c961321a875 100644
--- a/pkgs/servers/unifi/default.nix
+++ b/pkgs/servers/unifi/default.nix
@@ -66,8 +66,7 @@ in rec {
   };
 
   unifi7 = generic {
-    version = "7.5.176";
-    suffix = "-1136930355";
-    sha256 = "sha256-prsFq09zYrB74p/MGKjwvZftw78k9wbIva5xFdk+Ztw=";
+    version = "7.5.187";
+    sha256 = "sha256-a5kl8gZbRnhS/p1imPl7soM0/QSFHdM0+2bNmDfc1mY=";
   };
 }
diff --git a/pkgs/shells/fish/plugins/done.nix b/pkgs/shells/fish/plugins/done.nix
index ad16e257bf6..1c1f5848aa3 100644
--- a/pkgs/shells/fish/plugins/done.nix
+++ b/pkgs/shells/fish/plugins/done.nix
@@ -2,13 +2,13 @@
 
 buildFishPlugin rec {
   pname = "done";
-  version = "1.17.1";
+  version = "1.19.1";
 
   src = fetchFromGitHub {
     owner = "franciscolourenco";
     repo = "done";
     rev = version;
-    hash = "sha256-aYKTkx5v7tB6k/UBcS0NOgA6SiRrjzn1lUTH/Xp5DFM=";
+    hash = "sha256-BGHfwKoMfOZUsa05kEt8W2luc1aC3Su/OyaGmcb4UiI=";
   };
 
   checkPlugins = [ fishtape ];
@@ -16,10 +16,10 @@ buildFishPlugin rec {
     fishtape test/done.fish
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Automatically receive notifications when long processes finish";
     homepage = "https://github.com/franciscolourenco/done";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ malo ];
+    license = licenses.mit;
+    maintainers = [ maintainers.malo ];
   };
 }
diff --git a/pkgs/shells/fish/plugins/github-copilot-cli-fish.nix b/pkgs/shells/fish/plugins/github-copilot-cli-fish.nix
index 83192ad092f..14b57b9a62c 100644
--- a/pkgs/shells/fish/plugins/github-copilot-cli-fish.nix
+++ b/pkgs/shells/fish/plugins/github-copilot-cli-fish.nix
@@ -2,13 +2,13 @@
 
 buildFishPlugin rec {
   pname = "github-copilot-cli.fish";
-  version = "0.1.33";
+  version = "0.1.33.1";
 
   src = fetchFromGitHub {
     owner = "z11i";
     repo = pname;
     rev = version;
-    hash = "sha256-dhACPlFrw1Z0dW0eA0IMnOelYJc7Fyz2D9u+rL1pyiM=";
+    hash = "sha256-CFXbeO0euC/UtvQV0KCz4WQfdJgsuXKPM6M9oaw7hvg=";
   };
 
   meta = with lib; {
diff --git a/pkgs/shells/zsh/zsh-prezto/default.nix b/pkgs/shells/zsh/zsh-prezto/default.nix
index 7c7ba87d848..1565fb8b16f 100644
--- a/pkgs/shells/zsh/zsh-prezto/default.nix
+++ b/pkgs/shells/zsh/zsh-prezto/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zsh-prezto";
-  version = "unstable-2023-09-12";
+  version = "unstable-2023-11-08";
 
   src = fetchFromGitHub {
     owner = "sorin-ionescu";
     repo = "prezto";
-    rev = "5ac930d96be3a51730f7d9d7330f28d9c9c36e0a";
-    sha256 = "tyroeGADhBRCQ9/WqNSqMV7kvFUPdC2fcs/B5G5qYhI=";
+    rev = "f04191aa8ae475cf71f491830d424226d84501c9";
+    sha256 = "7cdtDKNyTSUn3Fo6BO3f0SMBgOQs4/5SnHXB7JtAdkA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/tools/X11/srandrd/default.nix b/pkgs/tools/X11/srandrd/default.nix
index 4c79e11765c..84f43301bbd 100644
--- a/pkgs/tools/X11/srandrd/default.nix
+++ b/pkgs/tools/X11/srandrd/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "srandrd";
-  version = "0.6.0";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "jceb";
     repo = pname;
     rev = "v${version}";
-    sha256 = "07r1ck2ijj30n19ylndgw75ly9k3815kj9inpxblfnjpwbbw6ic0";
+    sha256 = "sha256-Wf+tVqDaNAiH6UHN8fFv2wM+LEch6wKlZOkqWEqLLkw=";
   };
 
   buildInputs = [ libX11 libXrandr libXinerama ];
diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
index 862b68be94e..e7d889e9009 100644
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "exoscale-cli";
-  version = "1.74.3";
+  version = "1.74.4";
 
   src = fetchFromGitHub {
     owner = "exoscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-upnwaY++tUg4LcuD/BMSvvM2bo/95OP+SUK/aOiq1Oo=";
+    sha256 = "sha256-PzjIcdzEmX+0PRurOX5ZQ4LQnBny9Av8eKhPsyiZb6c=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/filesystems/bcachefs-tools/default.nix b/pkgs/tools/filesystems/bcachefs-tools/default.nix
index e6263ca62c6..f6e1cb2e0b1 100644
--- a/pkgs/tools/filesystems/bcachefs-tools/default.nix
+++ b/pkgs/tools/filesystems/bcachefs-tools/default.nix
@@ -18,20 +18,19 @@
 , rustc
 , rustPlatform
 , makeWrapper
+, writeScript
 , fuseSupport ? false
 }:
-let
-  version = "1.3.3";
-in
-stdenv.mkDerivation {
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
-  inherit version;
+  version = "1.3.3";
 
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-73vgwgBqyRLQ/Tts7bl6DhZMOs8ndIOiCke5tN89Wps=";
   };
 
@@ -71,7 +70,7 @@ stdenv.mkDerivation {
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
-    "VERSION=${version}"
+    "VERSION=${finalAttrs.version}"
     "INITRAMFS_DIR=${placeholder "out"}/etc/initramfs-tools"
   ];
 
@@ -79,9 +78,30 @@ stdenv.mkDerivation {
     rm tests/test_fuse.py
   '';
 
-  passthru.tests = {
-    smoke-test = nixosTests.bcachefs;
-    inherit (nixosTests.installer) bcachefsSimple bcachefsEncrypted bcachefsMulti;
+  passthru = {
+    tests = {
+      smoke-test = nixosTests.bcachefs;
+
+      inherit (nixosTests.installer)
+        bcachefsSimple
+        bcachefsEncrypted
+        bcachefsMulti
+        bcachefsLinuxTesting
+        bcachefsUpgradeToLinuxTesting;
+    };
+
+    updateScript = writeScript "update-bcachefs-tools-and-cargo-lock.sh" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl jq common-updater-scripts
+      res="$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
+        -sL "https://api.github.com/repos/${finalAttrs.src.owner}/${finalAttrs.src.repo}/tags?per_page=1")"
+
+      version="$(echo $res | jq '.[0].name | split("v") | .[1]' --raw-output)"
+      update-source-version ${finalAttrs.pname} "$version" --ignore-same-hash
+
+      curl "https://raw.githubusercontent.com/${finalAttrs.src.owner}/${finalAttrs.src.repo}/v$version/rust-src/Cargo.lock" > \
+        "$(git rev-parse --show-toplevel)/pkgs/tools/filesystems/bcachefs-tools/Cargo.lock"
+    '';
   };
 
   enableParallelBuilding = true;
@@ -93,4 +113,4 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [ davidak Madouura ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/tools/graphics/lsix/default.nix b/pkgs/tools/graphics/lsix/default.nix
index a9f8aa21bf1..dcf078654b8 100644
--- a/pkgs/tools/graphics/lsix/default.nix
+++ b/pkgs/tools/graphics/lsix/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lsix";
-  version = "1.8";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "hackerb9";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Qx6/PFm1XBmEI6iI+Ref9jNe6sXIhsVL4VQ1CX+caZE=";
+    sha256 = "sha256-xlOlAfZonSo/RERt5WxPqMvppVrY5/Yhh7SgCCsYDQE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch
new file mode 100644
index 00000000000..7b7ca5a0bef
--- /dev/null
+++ b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40889.patch
@@ -0,0 +1,17 @@
+Simple bounds checks for CVE-2023-40889, based on third-party
+fix by Remi Meier @
+https://github.com/Raemi/zbar/commit/5e8acc6974f17e56c3ddaa5509870beb8d7a599c
+
+--- a/zbar/qrcode/qrdec.c
++++ b/zbar/qrcode/qrdec.c
+@@ -3900,8 +3900,8 @@ void qr_reader_match_centers(qr_reader *_reader,qr_code_data_list *_qrlist,
+     /*TODO: We might be able to accelerate this step significantly by
+        considering the remaining finder centers in a more intelligent order,
+        based on the first finder center we just chose.*/
+-    for(j=i+1;!mark[i]&&j<_ncenters;j++){
+-      for(k=j+1;!mark[j]&&k<_ncenters;k++)if(!mark[k]){
++    for(j=i+1; i < _ncenters && !mark[i]&&j<_ncenters;j++){
++      for(k=j+1; j < _ncenters && !mark[j]&&k<_ncenters;k++)if(!mark[k]){
+         qr_finder_center *c[3];
+         qr_code_data      qrdata;
+         int               version;
diff --git a/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch
new file mode 100644
index 00000000000..3576df214ae
--- /dev/null
+++ b/pkgs/tools/graphics/zbar/0.23.92-CVE-2023-40890.patch
@@ -0,0 +1,26 @@
+Simple bounds checks for CVE-2023-40890
+
+--- a/zbar/decoder/databar.c
++++ b/zbar/decoder/databar.c
+@@ -23,6 +23,8 @@
+ 
+ #include <config.h>
+ #include <zbar.h>
++#include <stdlib.h>
++#include <stdio.h>
+ 
+ #ifdef DEBUG_DATABAR
+ # define DEBUG_LEVEL (DEBUG_DATABAR)
+@@ -691,6 +693,12 @@ lookup_sequence (databar_segment_t *seg,
+             fixed = -1;
+         s <<= 1;
+         dbprintf(2, "%x", s);
++
++        if (i > 20) {
++            fprintf(stderr, "Bug: Out-of-bounds condition detected\n");
++            exit(99);
++        }
++
+         seq[i++] = s++;
+         seq[i++] = s;
+     }
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index f9b84d2656a..5a1d7e94fdf 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , imagemagickBig
 , pkg-config
 , withXorg ? true
@@ -42,6 +43,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VhVrngAX7pXZp+szqv95R6RGAJojp3svdbaRKigGb0w=";
   };
 
+  patches = [
+    ./0.23.92-CVE-2023-40889.patch
+    ./0.23.92-CVE-2023-40890.patch
+  ];
+
   nativeBuildInputs = [
     pkg-config
     xmlto
diff --git a/pkgs/tools/misc/entr/default.nix b/pkgs/tools/misc/entr/default.nix
index b46b9403708..efee9f7043e 100644
--- a/pkgs/tools/misc/entr/default.nix
+++ b/pkgs/tools/misc/entr/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "entr";
-  version = "5.4";
+  version = "5.5";
 
   src = fetchurl {
     url = "https://eradman.com/entrproject/code/${pname}-${version}.tar.gz";
-    hash = "sha256-SR3e0sw/Hc2NJvSWpMezqZa5HHqyCIPKN1A3o5giH54=";
+    hash = "sha256-EowM4u/qWua9P9M8PNMeFh6wwCYJ2HF6036VtBZW5SY=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/fend/default.nix b/pkgs/tools/misc/fend/default.nix
index fe1d957437d..074088f3f19 100644
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fend";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "printfn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-iF1E9wBX9UVv/zuCgznXqKLBF+Xk0LqVdJfxFNpmzRI=";
+    sha256 = "sha256-An1biuaqPeRniJZroxoT2o9IEA4XFf5l6ut4nmOsQJI=";
   };
 
-  cargoHash = "sha256-xf4Q6nk2sYuAV+B7dsRF+feiLRKLXDSHnlYmw+o5bNc=";
+  cargoHash = "sha256-gnFu0JsMt1wMfifF6EnjDwwydFnVyqpkHV0cyR5Qt3Y=";
 
   nativeBuildInputs = [ pandoc installShellFiles copyDesktopItems ];
   buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index c27e1ff1aac..8e783fc1550 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -25,13 +25,13 @@ let
 in
 buildGoModule rec {
   pname = "fzf";
-  version = "0.44.0";
+  version = "0.44.1";
 
   src = fetchFromGitHub {
     owner = "junegunn";
     repo = pname;
     rev = version;
-    hash = "sha256-YIMtLQzxORWFWCgdnLUQLmmE79aw40LhcxqiHCWjgNk=";
+    hash = "sha256-oL3AA/3RPKcXLBNYaBYleueQph7/xvN/UEhwcYM9lAs=";
   };
 
   vendorHash = "sha256-EutNjyW5bvGvMZP9xBrcu91TOAbl9TDZe2+g0/qnuAQ=";
diff --git a/pkgs/tools/misc/gh-actions-cache/default.nix b/pkgs/tools/misc/gh-actions-cache/default.nix
index 8bc735f4e52..46fe8cb704d 100644
--- a/pkgs/tools/misc/gh-actions-cache/default.nix
+++ b/pkgs/tools/misc/gh-actions-cache/default.nix
@@ -21,8 +21,9 @@ buildGoModule rec {
     "-w"
   ];
 
-  # Tests need network
-  doCheck = false;
+  # Needed for tests.
+  # https://github.com/actions/gh-actions-cache/issues/53#issuecomment-1464954495
+  env.GH_TOKEN = "dummy-token-to-facilitate-rest-client";
 
   meta = {
     description = "gh extension to manage GitHub Actions caches";
diff --git a/pkgs/tools/misc/rlwrap/default.nix b/pkgs/tools/misc/rlwrap/default.nix
index ec0f90a5c46..2d48edf2dfd 100644
--- a/pkgs/tools/misc/rlwrap/default.nix
+++ b/pkgs/tools/misc/rlwrap/default.nix
@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ readline ];
 
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-Wno-error=implicit-function-declaration";
+
   meta = with lib; {
     description = "Readline wrapper for console programs";
     homepage = "https://github.com/hanslub42/rlwrap";
diff --git a/pkgs/tools/misc/vtm/default.nix b/pkgs/tools/misc/vtm/default.nix
index 52b561e5790..a0acfcf7f7d 100644
--- a/pkgs/tools/misc/vtm/default.nix
+++ b/pkgs/tools/misc/vtm/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vtm";
-  version = "0.9.9w.1";
+  version = "0.9.16";
 
   src = fetchFromGitHub {
     owner = "netxs-group";
     repo = "vtm";
     rev = "v${version}";
-    sha256 = "sha256-/EQ8+8ac1MnWuXL9aNYl5U2ZfTpd/iThyvXygorbPmM=";
+    sha256 = "sha256-nX7T3TAGgxAB65X8D2HlI+3T6p7aH3bwG3N1pScX/4g=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/misc/wasm-tools/default.nix b/pkgs/tools/misc/wasm-tools/default.nix
index 6d772a8ba5c..2249ea83d1a 100644
--- a/pkgs/tools/misc/wasm-tools/default.nix
+++ b/pkgs/tools/misc/wasm-tools/default.nix
@@ -5,19 +5,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-tools";
-  version = "1.0.51";
+  version = "1.0.52";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "${pname}-${version}";
-    hash = "sha256-SeUwd9S2WMGbNqj9NzZZKW1tQWc0cbe+uZmHc1PWKR8=";
+    hash = "sha256-6x2H+WY23XxBWmAqD2Lsc4TdCY76XiR/BhSU++XuIFY=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
-  cargoHash = "sha256-G7pIy8KuDEEVVhH0WzY93eDhH2oTT9sP5CqTgfxYB0c=";
+  cargoHash = "sha256-1YnoHL+FKXhopcW0Scya22sRBwantRH9gF7w/rxU0H8=";
   cargoBuildFlags = [ "--package" "wasm-tools" ];
   cargoTestFlags = [ "--all" ];
 
diff --git a/pkgs/tools/package-management/dpkg/default.nix b/pkgs/tools/package-management/dpkg/default.nix
index 79bf6f8c508..59e25954199 100644
--- a/pkgs/tools/package-management/dpkg/default.nix
+++ b/pkgs/tools/package-management/dpkg/default.nix
@@ -18,12 +18,12 @@
 
 stdenv.mkDerivation rec {
   pname = "dpkg";
-  version = "1.22.0";
+  version = "1.22.1";
 
   src = fetchgit {
     url = "https://git.launchpad.net/ubuntu/+source/dpkg";
     rev = "applied/${version}";
-    hash = "sha256-q+kP0PuQyGKuKahA1/TwtJG380a/sNR433xZhxvGO9M=";
+    hash = "sha256-63XRO3Img+XS2F5Krb5DAw0LMhtxB+eJi754O03Lx8Q=";
   };
 
   configureFlags = [
diff --git a/pkgs/tools/security/cmospwd/default.nix b/pkgs/tools/security/cmospwd/default.nix
index fa04ac65207..db84fb55ba8 100644
--- a/pkgs/tools/security/cmospwd/default.nix
+++ b/pkgs/tools/security/cmospwd/default.nix
@@ -12,6 +12,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-8pbSl5eUsKa3JrgK/JLk0FnGXcJhKksJN3wWiDPYYvQ=";
   };
 
+  makeFlags = [ "CC:=$(CC)" ];
+
   preConfigure = ''
     cd src
 
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 509501d52cd..6bb2a5a0e6b 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-11-11";
+  version = "2023-11-18";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-oB28qKIvGHh/h726Wsy8C/zt3rFLBHcP5iRZe3U76U0=";
+    hash = "sha256-7W7HwHvRfm+nRms4H4TgB1la5OhGHv5lRHwbvjwRTMw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/ghidra/0001-Use-protobuf-gradle-plugin.patch b/pkgs/tools/security/ghidra/0001-Use-protobuf-gradle-plugin.patch
index 03ddf76e8ff..7fb7d53e352 100644
--- a/pkgs/tools/security/ghidra/0001-Use-protobuf-gradle-plugin.patch
+++ b/pkgs/tools/security/ghidra/0001-Use-protobuf-gradle-plugin.patch
@@ -1,112 +1,129 @@
 diff --git a/Ghidra/Debug/Debugger-gadp/build.gradle b/Ghidra/Debug/Debugger-gadp/build.gradle
-index f4dbd3cd0..6108e8534 100644
+index 9e1c57faf..3a3242eb5 100644
 --- a/Ghidra/Debug/Debugger-gadp/build.gradle
 +++ b/Ghidra/Debug/Debugger-gadp/build.gradle
-@@ -23,42 +23,18 @@ apply from: "${rootProject.projectDir}/gradle/javaTestProject.gradle"
+@@ -18,11 +18,16 @@ apply from: "${rootProject.projectDir}/gradle/javaProject.gradle"
+ apply from: "${rootProject.projectDir}/gradle/jacocoProject.gradle"
+ apply from: "${rootProject.projectDir}/gradle/javaTestProject.gradle"
  apply from: "${rootProject.projectDir}/gradle/distributableGhidraModule.gradle"
+-apply from: "${rootProject.projectDir}/gradle/debugger/hasProtobuf.gradle"
++apply plugin: 'com.google.protobuf'
  
  apply plugin: 'eclipse'
-+apply plugin: 'com.google.protobuf'
  eclipse.project.name = 'Debug Debugger-gadp'
  
--configurations {
--	allProtocArtifacts
--	protocArtifact
--}
--
- def platform = getCurrentPlatformName()
- 
--dependencies {
--	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:windows-x86_64@exe'
--	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:linux-x86_64@exe'
--	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:linux-aarch_64@exe'
--	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:osx-x86_64@exe'
--	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:osx-aarch_64@exe'
--
--	if (isCurrentWindows()) {
--		protocArtifact 'com.google.protobuf:protoc:3.21.8:windows-x86_64@exe'
--	}
--	if (isCurrentLinux()) {
--		if (platform.endsWith("x86_64")) {
--			protocArtifact 'com.google.protobuf:protoc:3.21.8:linux-x86_64@exe'
--		}
--		else {
--			protocArtifact 'com.google.protobuf:protoc:3.21.8:linux-aarch_64@exe'
--		}
--	}
--	if (isCurrentMac()) {
--		if (platform.endsWith("x86_64")) {
--			protocArtifact 'com.google.protobuf:protoc:3.21.8:osx-x86_64@exe'
--		}
--		else {
--			protocArtifact 'com.google.protobuf:protoc:3.21.8:osx-aarch_64@exe'
--		}
 +buildscript {
 +	dependencies {
 +		classpath 'com.google.protobuf:protobuf-gradle-plugin:0.8.18'
- 	}
++	}
 +}
- 
-+dependencies {
+ dependencies {
  	api project(':Framework-AsyncComm')
  	api project(':Framework-Debugging')
- 	api project(':ProposedUtils')
-@@ -73,37 +49,3 @@ dependencies {
- 	}
- }*/
- 
--task generateProto {
--	ext.srcdir = file("src/main/proto")
--	ext.src = fileTree(srcdir) {
--		include "**/*.proto"
--	}
--	ext.outdir = file("build/generated/source/proto/main/java")
--	outputs.dir(outdir)
--	inputs.files(src)
--	dependsOn(configurations.protocArtifact)
--	doLast {
--		def exe = configurations.protocArtifact.first()
--		if (!isCurrentWindows()) {
--			exe.setExecutable(true)
--		}
--		exec {
--			commandLine exe, "--java_out=$outdir", "-I$srcdir"
--			args src
--		}
--	}
--}
--
--tasks.compileJava.dependsOn(tasks.generateProto)
--tasks.eclipse.dependsOn(tasks.generateProto)
--rootProject.tasks.prepDev.dependsOn(tasks.generateProto)
--
--sourceSets {
--	main {
--		java {
--			srcDir tasks.generateProto.outdir
--		}
--	}
--}
--zipSourceSubproject.dependsOn generateProto
--
 diff --git a/Ghidra/Debug/Debugger-isf/build.gradle b/Ghidra/Debug/Debugger-isf/build.gradle
-index 6bf945c2e..3225d095d 100644
+index d135294a0..785681ca2 100644
 --- a/Ghidra/Debug/Debugger-isf/build.gradle
 +++ b/Ghidra/Debug/Debugger-isf/build.gradle
-@@ -20,42 +20,18 @@ apply from: "${rootProject.projectDir}/gradle/javaTestProject.gradle"
+@@ -18,11 +18,15 @@ apply from: "${rootProject.projectDir}/gradle/javaProject.gradle"
+ apply from: "${rootProject.projectDir}/gradle/jacocoProject.gradle"
+ apply from: "${rootProject.projectDir}/gradle/javaTestProject.gradle"
  apply from: "${rootProject.projectDir}/gradle/distributableGhidraModule.gradle"
- 
- apply plugin: 'eclipse'
+-apply from: "${rootProject.projectDir}/gradle/debugger/hasProtobuf.gradle"
+-
 +apply plugin: 'com.google.protobuf'
+ apply plugin: 'eclipse'
  eclipse.project.name = 'Debug Debugger-isf'
  
++buildscript {
++	dependencies {
++		classpath 'com.google.protobuf:protobuf-gradle-plugin:0.8.18'
++	}
++}
+ dependencies {
+ 	api project(':Framework-AsyncComm')
+ 	api project(':Framework-Debugging')
+diff --git a/Ghidra/Debug/Debugger-rmi-trace/build.gradle b/Ghidra/Debug/Debugger-rmi-trace/build.gradle
+index eec00786e..666cccafc 100644
+--- a/Ghidra/Debug/Debugger-rmi-trace/build.gradle
++++ b/Ghidra/Debug/Debugger-rmi-trace/build.gradle
+@@ -18,12 +18,17 @@ apply from: "${rootProject.projectDir}/gradle/javaProject.gradle"
+ apply from: "${rootProject.projectDir}/gradle/jacocoProject.gradle"
+ apply from: "${rootProject.projectDir}/gradle/javaTestProject.gradle"
+ apply from: "${rootProject.projectDir}/gradle/distributableGhidraModule.gradle"
+-apply from: "${rootProject.projectDir}/gradle/debugger/hasProtobuf.gradle"
++apply plugin: 'com.google.protobuf'
+ apply from: "${rootProject.projectDir}/gradle/debugger/hasPythonPackage.gradle"
+ 
+ apply plugin: 'eclipse'
+ eclipse.project.name = 'Debug Debugger-rmi-trace'
+ 
++buildscript {
++	dependencies {
++		classpath 'com.google.protobuf:protobuf-gradle-plugin:0.8.18'
++	}
++}
+ dependencies {
+ 	api project(':Debugger')
+ }
+@@ -36,7 +41,7 @@ task generateProtoPy {
+ 	ext.outdir = file("build/generated/source/proto/main/py")
+ 	outputs.dir(outdir)
+ 	inputs.files(src)
+-	dependsOn(configurations.protocArtifact)
++	dependsOn(protobuf.generateProtoTasks.all())
+ 	doLast {
+ 		def exe = configurations.protocArtifact.first()
+ 		if (!isCurrentWindows()) {
+diff --git a/build.gradle b/build.gradle
+index b0c717fb1..5f56506a5 100644
+--- a/build.gradle
++++ b/build.gradle
+@@ -74,6 +74,12 @@ if (flatRepo.isDirectory()) {
+ 			jcenter()
+ 			flatDir name: "flat", dirs:["$flatRepo"]
+ 		}
++		buildscript {
++			repositories {
++				mavenLocal()
++				mavenCentral()
++			}
++		}
+ 	}
+ }
+ else {	
+diff --git a/gradle/debugger/hasProtobuf.gradle b/gradle/debugger/hasProtobuf.gradle
+deleted file mode 100644
+index 23b4ce74b..000000000
+--- a/gradle/debugger/hasProtobuf.gradle
++++ /dev/null
+@@ -1,94 +0,0 @@
+-/* ###
+- * IP: GHIDRA
+- *
+- * Licensed under the Apache License, Version 2.0 (the "License");
+- * you may not use this file except in compliance with the License.
+- * You may obtain a copy of the License at
+- * 
+- *      http://www.apache.org/licenses/LICENSE-2.0
+- * 
+- * Unless required by applicable law or agreed to in writing, software
+- * distributed under the License is distributed on an "AS IS" BASIS,
+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+- * See the License for the specific language governing permissions and
+- * limitations under the License.
+- */
+-/*plugins {
+-	id 'com.google.protobuf' version '0.8.10'
+-}*/
+-
 -configurations {
 -	allProtocArtifacts
 -	protocArtifact
 -}
 -
- def platform = getCurrentPlatformName()
- 
+-def platform = getCurrentPlatformName()
+-
+-
 -dependencies {
 -	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:windows-x86_64@exe'
 -	allProtocArtifacts 'com.google.protobuf:protoc:3.21.8:linux-x86_64@exe'
@@ -132,20 +149,15 @@ index 6bf945c2e..3225d095d 100644
 -		else {
 -			protocArtifact 'com.google.protobuf:protoc:3.21.8:osx-aarch_64@exe'
 -		}
-+buildscript {
-+	dependencies {
-+		classpath 'com.google.protobuf:protobuf-gradle-plugin:0.8.18'
- 	}
-+}
- 
-+dependencies {
- 	api project(':Framework-AsyncComm')
- 	api project(':Framework-Debugging')
- 	api project(':ProposedUtils')
-@@ -64,40 +40,6 @@ dependencies {
- 	testImplementation project(path: ':Framework-Debugging', configuration: 'testArtifacts')
- }
- 
+-	}
+-}
+-
+-/*protobuf {
+-	protoc {
+-		artifact = 'com.google.protobuf:protoc:3.21.8'
+-	}
+-}*/
+-
 -task generateProto {
 -	ext.srcdir = file("src/main/proto")
 -	ext.src = fileTree(srcdir) {
@@ -179,24 +191,3 @@ index 6bf945c2e..3225d095d 100644
 -	}
 -}
 -zipSourceSubproject.dependsOn generateProto
--
- // Include buildable native source in distribution
- rootProject.assembleDistribution {
-     from (this.project.projectDir.toString()) {
-diff --git a/build.gradle b/build.gradle
-index b0c717fb1..5f56506a5 100644
---- a/build.gradle
-+++ b/build.gradle
-@@ -74,6 +74,12 @@ if (flatRepo.isDirectory()) {
- 			jcenter()
- 			flatDir name: "flat", dirs:["$flatRepo"]
- 		}
-+		buildscript {
-+			repositories {
-+				mavenLocal()
-+				mavenCentral()
-+			}
-+		}
- 	}
- }
- else {	
diff --git a/pkgs/tools/security/ghidra/build.nix b/pkgs/tools/security/ghidra/build.nix
index 16bc1dbe5cd..50fd64656f4 100644
--- a/pkgs/tools/security/ghidra/build.nix
+++ b/pkgs/tools/security/ghidra/build.nix
@@ -10,18 +10,19 @@
 , icoutils
 , xcbuild
 , protobuf
+, fetchurl
 }:
 
 let
   pkg_path = "$out/lib/ghidra";
   pname = "ghidra";
-  version = "10.3.3";
+  version = "10.4";
 
   src = fetchFromGitHub {
     owner = "NationalSecurityAgency";
     repo = "Ghidra";
     rev = "Ghidra_${version}_build";
-    hash = "sha256-KDSiZ/JwAqX6Obg9UD8ZQut01l/eMXbioJy//GluXn0=";
+    hash = "sha256-g0JM6pm1vkCh9yBB5mfrOiNrImqoyWdQcEe2g+AO6LQ=";
   };
 
   gradle = gradle_7;
@@ -36,24 +37,6 @@ let
   };
 
   # postPatch scripts.
-  # Tells ghidra to use our own protoc binary instead of the prebuilt one.
-  fixProtoc = ''
-    cat >>Ghidra/Debug/Debugger-gadp/build.gradle <<HERE
-protobuf {
-  protoc {
-    path = '${protobuf}/bin/protoc'
-  }
-}
-HERE
-    cat >>Ghidra/Debug/Debugger-isf/build.gradle <<HERE
-protobuf {
-  protoc {
-    path = '${protobuf}/bin/protoc'
-  }
-}
-HERE
-  '';
-
   # Adds a gradle step that downloads all the dependencies to the gradle cache.
   addResolveStep = ''
     cat >>build.gradle <<HERE
@@ -85,7 +68,7 @@ HERE
     inherit version src;
 
     patches = [ ./0001-Use-protobuf-gradle-plugin.patch ];
-    postPatch = fixProtoc + addResolveStep;
+    postPatch = addResolveStep;
 
     nativeBuildInputs = [ gradle perl ] ++ lib.optional stdenv.isDarwin xcbuild;
     buildPhase = ''
@@ -116,13 +99,21 @@ in stdenv.mkDerivation {
   inherit pname version src;
 
   nativeBuildInputs = [
-    gradle unzip makeWrapper icoutils
+    gradle unzip makeWrapper icoutils protobuf
   ] ++ lib.optional stdenv.isDarwin xcbuild;
 
   dontStrip = true;
 
-  patches = [ ./0001-Use-protobuf-gradle-plugin.patch ];
-  postPatch = fixProtoc;
+  patches = [
+    ./0001-Use-protobuf-gradle-plugin.patch
+    # we use fetchurl since the fetchpatch normalization strips the whole diff
+    # https://github.com/NixOS/nixpkgs/issues/266556
+    (fetchurl {
+      name = "0002-remove-executable-bit.patch";
+      url = "https://github.com/NationalSecurityAgency/ghidra/commit/e2a945624b74e5d42dc85e9c1f992315dd154db1.diff";
+      sha256 = "07mjfl7hvag2akk65g4cknp330qlk07dgbmh20dyg9qxzmk91fyq";
+    })
+  ];
 
   buildPhase = ''
     export HOME="$NIX_BUILD_TOP/home"
diff --git a/pkgs/tools/security/gitleaks/default.nix b/pkgs/tools/security/gitleaks/default.nix
index 96c4b0f4e15..7fc15a3fb2b 100644
--- a/pkgs/tools/security/gitleaks/default.nix
+++ b/pkgs/tools/security/gitleaks/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.18.0";
+  version = "8.18.1";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-659wQBv8DuYB4vI+qnBLS9u22kGlg4ne4DyKFoomlOw=";
+    hash = "sha256-v0d/ulxYJRkyyhVctnQjKW2ODWtu+gSwp/qSkVLQ1Jo=";
   };
 
-  vendorHash = "sha256-PPEEQ2Bt20UK+mQL59jVnX8HtzCsqW4uRwR3mOdhDis=";
+  vendorHash = "sha256-lPfvoeHPYWSnFPuAR9CxG6+pQ++cZEw/jYuGgDrm57E=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 4d7b793a84b..539e6b8bc8d 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.42"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.43"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 58929753c59..adc032baf21 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: adf413fba45b298c4e16f7f1043dc69f99d2fbdb
-  ref: refs/tags/6.3.42
+  revision: 58dcabe21524d8b2c4d05618ca8509dc42cc6515
+  ref: refs/tags/6.3.43
   specs:
-    metasploit-framework (6.3.42)
+    metasploit-framework (6.3.43)
       actionpack (~> 7.0.0)
       activerecord (~> 7.0.0)
       activesupport (~> 7.0.0)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 44b672cd6e4..6f88b96cd6a 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.3.42";
+  version = "6.3.43";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-6ddW6VlbWV71BERJISF67UPRcwLQY8Hpw4kf80lCNBE=";
+    sha256 = "sha256-IWdSxXhJFGbNTo9xqEjBJNEWB6imzdwzgnXoUbfao/g=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 8ba7f0e698a..cf24944c403 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -654,12 +654,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "adf413fba45b298c4e16f7f1043dc69f99d2fbdb";
-      sha256 = "049l894z67w9qglw2qyh09rx2hzdg8hj2ja40ksmwnavb7lmdmz9";
+      rev = "58dcabe21524d8b2c4d05618ca8509dc42cc6515";
+      sha256 = "1y53vavm3s3mh8rxrkd6m03idl94q54ahwcg9v6nc529g32m4rr1";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.3.42";
+    version = "6.3.43";
   };
   metasploit-model = {
     groups = ["default"];
diff --git a/pkgs/tools/security/nitrokey-app2/default.nix b/pkgs/tools/security/nitrokey-app2/default.nix
index 3d35b4d0775..a3e3a82ec23 100644
--- a/pkgs/tools/security/nitrokey-app2/default.nix
+++ b/pkgs/tools/security/nitrokey-app2/default.nix
@@ -7,7 +7,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "nitrokey-app2";
-  version = "2.1.2";
+  version = "2.1.4";
   pyproject = true;
 
   disabled = python3.pythonOlder "3.9";
@@ -16,7 +16,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Nitrokey";
     repo = "nitrokey-app2";
     rev = "v${version}";
-    hash = "sha256-VyhIFNXxH/FohgjhBeZXoQYppP7PEz+ei0qzsWz1xhk=";
+    hash = "sha256-loOCa6XlLx1YEfqR0SUUalVIEPCoYsNEHFo2MIKexeA=";
   };
 
   # https://github.com/Nitrokey/nitrokey-app2/issues/152
@@ -63,7 +63,7 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/Nitrokey/nitrokey-app2";
     changelog = "https://github.com/Nitrokey/nitrokey-app2/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ _999eagle ];
+    maintainers = with maintainers; [ _999eagle panicgh ];
     mainProgram = "nitrokeyapp";
   };
 }
diff --git a/pkgs/tools/system/automatic-timezoned/default.nix b/pkgs/tools/system/automatic-timezoned/default.nix
index 709558fad50..7233a41142e 100644
--- a/pkgs/tools/system/automatic-timezoned/default.nix
+++ b/pkgs/tools/system/automatic-timezoned/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "automatic-timezoned";
-  version = "1.0.130";
+  version = "1.0.131";
 
   src = fetchFromGitHub {
     owner = "maxbrunet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uQg3segJamYrM8RRP5BEE7O1Jepr20ucdNUVwNllQlw=";
+    sha256 = "sha256-92OpvUt+0iN+UdEGjDdVCjUUlbuOjUgOjc+DGMUnx9U=";
   };
 
-  cargoHash = "sha256-8DEvGRerIV9PB4uPAzFwymb67gcg9wdO8rruENR2M6Q=";
+  cargoHash = "sha256-FaQwxt3XcDOXlzcKEdMyE9TpmGykQOnJdxtM3EqMpfU=";
 
   meta = with lib; {
     description = "Automatically update system timezone based on location";
diff --git a/pkgs/tools/system/nsc/default.nix b/pkgs/tools/system/nsc/default.nix
index c3d0394c658..bec4a311410 100644
--- a/pkgs/tools/system/nsc/default.nix
+++ b/pkgs/tools/system/nsc/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "nsc";
-  version = "2.8.1";
+  version = "2.8.5";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-kNfA/MQuXauQPWQhUspreqo4oOKb+qBqh9NdmQM1Q+A=";
+    hash = "sha256-9qsHZTbK2RCDiQ5wlo2D79GeI5dbCvL2LofPnF7f8Cc=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule rec {
     "-X main.builtBy=nixpkgs"
   ];
 
-  vendorHash = "sha256-8cTegiNVtGSZdf9O+KVoOgnjjMIv8w7YBSkFhk7gHfk=";
+  vendorHash = "sha256-B3uIFJaEsj9tpjPBiU+rXVlfcgVwZUQe3VSSoZQqBG8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -44,7 +44,7 @@ buildGoModule rec {
   # the test strips table formatting from the command output in a naive way
   # that removes all the table characters, including '-'.
   # The nix build directory looks something like:
-  # /private/tmp/nix-build-nsc-2.8.1.drv-0/nsc_test2000598938/keys
+  # /private/tmp/nix-build-nsc-2.8.5.drv-0/nsc_test2000598938/keys
   # Then the `-` are removed from the path unintentionally and the test fails.
   # This should be fixed upstream to avoid mangling the path when
   # removing the table decorations from the command output.
diff --git a/pkgs/tools/system/zps/default.nix b/pkgs/tools/system/zps/default.nix
index f4003ed934d..91ce2ed8f6a 100644
--- a/pkgs/tools/system/zps/default.nix
+++ b/pkgs/tools/system/zps/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zps";
-  version = "1.2.8";
+  version = "1.2.9";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "zps";
     rev = version;
-    hash = "sha256-t0kVMrJn+eqUUD98pp3iIK28MoLwOplLk0sYgRJkO4c=";
+    hash = "sha256-+evCYiTiH8tRmhvsse+49WlKGRP5XQtep7wGoCySvJ4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/system/zram-generator/Cargo.lock b/pkgs/tools/system/zram-generator/Cargo.lock
index d061c364b27..29c643c10bd 100644
--- a/pkgs/tools/system/zram-generator/Cargo.lock
+++ b/pkgs/tools/system/zram-generator/Cargo.lock
@@ -79,9 +79,9 @@ dependencies = [
 
 [[package]]
 name = "errno"
-version = "0.3.5"
+version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3e13f66a2f95e32a39eaa81f6b95d42878ca0e1db0c7543723dfe12557e860"
+checksum = "f258a7194e7f7c2a7837a8913aeab7fd8c383457034fa20ce4dd3dcb813e8eb8"
 dependencies = [
  "libc",
  "windows-sys",
@@ -107,9 +107,9 @@ checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
 
 [[package]]
 name = "getrandom"
-version = "0.2.10"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f"
 dependencies = [
  "cfg-if",
  "libc",
@@ -127,9 +127,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.149"
+version = "0.2.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
+checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
 
 [[package]]
 name = "liboverdrop"
@@ -142,9 +142,9 @@ dependencies = [
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"
+checksum = "969488b55f8ac402214f3f5fd243ebb7206cf82de60d3172994707a4bcc2b829"
 
 [[package]]
 name = "log"
@@ -240,9 +240,9 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.3.5"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
  "bitflags 1.3.2",
 ]
@@ -259,9 +259,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.20"
+version = "0.38.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67ce50cb2e16c2903e30d1cbccfd8387a74b9d4c938b6a4c5ec6cc7556f7a8a0"
+checksum = "9ad981d6c340a49cdc40a1028d9c6084ec7e9fa33fcb839cab656a267071e234"
 dependencies = [
  "bitflags 2.4.1",
  "errno",
@@ -283,9 +283,9 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.8.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
+checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
 dependencies = [
  "cfg-if",
  "fastrand",
diff --git a/pkgs/tools/text/difftastic/default.nix b/pkgs/tools/text/difftastic/default.nix
index 1db60b38a8d..98c3db975ed 100644
--- a/pkgs/tools/text/difftastic/default.nix
+++ b/pkgs/tools/text/difftastic/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , testers
 , difftastic
+, stdenv
 }:
 
 let
@@ -32,6 +33,11 @@ rustPlatform.buildRustPackage rec {
     };
   };
 
+  # Work around https://github.com/NixOS/nixpkgs/issues/166205.
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_LDFLAGS = "-l${stdenv.cc.libcxx.cxxabi.libName}";
+  };
+
   postPatch = ''
     patch -d $cargoDepsCopy/libmimalloc-sys-0.1.24/c_src/mimalloc \
       -p1 < ${mimallocPatch}
diff --git a/pkgs/tools/text/invoice2data/default.nix b/pkgs/tools/text/invoice2data/default.nix
index fd5ead9e0c3..aed1bd2afd5 100644
--- a/pkgs/tools/text/invoice2data/default.nix
+++ b/pkgs/tools/text/invoice2data/default.nix
@@ -10,14 +10,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "invoice2data";
-  version = "0.4.2";
+  version = "0.4.4";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "invoice-x";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ss2h8cg0sga+lzJyQHckrZB/Eb63Oj3FkqmGqWCzCQ8=";
+    hash = "sha256-pAvkp8xkHYi/7ymbxaT7/Jhu44j2P8emm8GyXC6IBnI=";
   };
 
   patches = [
@@ -38,6 +38,7 @@ python3.pkgs.buildPythonApplication rec {
     pdfminer-six
     pillow
     pyyaml
+    setuptools
   ];
 
   makeWrapperArgs = ["--prefix" "PATH" ":" (lib.makeBinPath [
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index d4ed3ba55a9..7ae0de13ed9 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "2.29.6";
+  version = "2.29.7";
 
   subPackages = [ "cmd/vale" ];
   outputs = [ "out" "data" ];
@@ -11,10 +11,10 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    hash = "sha256-0btFCTpVB50097yQEggpm1rmm4aciTgfdLAkczQ1mj4=";
+    hash = "sha256-5fOEZG+ucp9EpizNHvKzqksnDzV8x0miGSKnTelxmzs=";
   };
 
-  vendorHash = "sha256-EbhLz4agDWAlALfBcGUbVNz+teUvgroxzaSN8T19AJY=";
+  vendorHash = "sha256-FnzuumOIvjpoDr+yBaRc8UjMDNW8mgrJiz1ZyzNW0Ts=";
 
   postInstall = ''
     mkdir -p $data/share/vale
diff --git a/pkgs/tools/virtualization/govc/default.nix b/pkgs/tools/virtualization/govc/default.nix
index aa8e7664e08..a2c37dfb679 100644
--- a/pkgs/tools/virtualization/govc/default.nix
+++ b/pkgs/tools/virtualization/govc/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "govc";
-  version = "0.33.0";
+  version = "0.33.1";
 
   subPackages = [ "govc" ];
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "sha256-YY/rTrL6zEhZkeaYz2yG/h2s81IefClou4abbmQuDiU=";
+    sha256 = "sha256-5zFyOWfVxQL/QveOlX4Xkg8FBwo8mZzR7ea2IacSrS4=";
   };
 
   vendorHash = "sha256-DBcovHOOfIy4dfi8U9zaCUzz5Zz8oIG44JCqMKtdxgg=";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5b096430c1e..716ead49c30 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -152,6 +152,7 @@ mapAliases ({
   clasp = clingo; # added 2022-12-22
   claws-mail-gtk3 = claws-mail; # Added 2021-07-10
   cntk = throw "'cntk' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2023-10-09
+  code-server = throw "'code-server' has been removed from nixpkgs, as it was depending on EOL Node.js and is unmaintained."; # Added 2023-10-30
   codimd = hedgedoc; # Added 2020-11-29
   inherit (libsForQt5.mauiPackages) communicator; # added 2022-05-17
   compton = throw "'compton' has been renamed to/replaced by 'picom'"; # Converted to throw 2023-09-10
@@ -427,6 +428,8 @@ mapAliases ({
   keysmith = libsForQt5.kdeGear.keysmith; # Added 2021-07-14
   kfctl = throw "kfctl is broken and has been archived by upstream" ; # Added 2023-08-21
   kgx = gnome-console; # Added 2022-02-19
+  kibana7 = throw "Kibana 7.x has been removed from nixpkgs as it depends on an end of life Node.js version and received no maintenance in time."; # Added 2023-30-10
+  kibana = kibana7;
   kicad-with-packages3d = throw "'kicad-with-packages3d' has been renamed to/replaced by 'kicad'"; # Converted to throw 2023-09-10
   kio-admin = libsForQt5.kdeGear.kio-admin; # Added 2023-03-18
   kodiGBM = kodi-gbm;
@@ -622,10 +625,14 @@ mapAliases ({
   nixopsUnstable = nixops_unstable; # Added 2022-03-03
   nixosTest = testers.nixosTest; # Added 2022-05-05
   nmap-unfree = nmap; # Added 2021-04-06
+  nodejs_14 = throw "nodejs_14 has been removed as it is EOL."; # Added 2023-10-30
+  nodejs-slim_14 = throw "nodejs-slim_14 has been removed as it is EOL."; # Added 2023-10-30
   nodejs-14_x = nodejs_14; # Added 2022-11-06
   nodejs-slim-14_x = nodejs-slim_14; # Added 2022-11-06
+  nodejs_16 = throw "nodejs_16 has been removed as it is EOL."; # Added 2023-10-30
   nodejs-16_x = nodejs_16; # Added 2022-11-06
   nodejs-16_x-openssl_1_1 = throw "nodejs-16_x-openssl_1_1 has been removed."; # Added 2023-02-04
+  nodejs-slim_16 = throw "nodejs-slim_16 has been removed as it is EOL."; # Added 2022-11-06
   nodejs-slim-16_x = nodejs-slim_16; # Added 2022-11-06
   nodejs-18_x = nodejs_18; # Added 2022-11-06
   nodejs-slim-18_x = nodejs-slim_18; # Added 2022-11-06
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7fb9cdafdd7..bd84e39bbe2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8462,8 +8462,6 @@ with pkgs;
 
   fornalder = callPackage ../applications/version-management/fornalder { };
 
-  free42 = callPackage ../applications/misc/free42 { };
-
   galen = callPackage ../development/tools/galen { };
 
   gallery-dl = python3Packages.callPackage ../applications/misc/gallery-dl { };
@@ -9830,9 +9828,6 @@ with pkgs;
 
   kluctl = callPackage ../applications/networking/cluster/kluctl { };
 
-  kibana7 = callPackage ../development/tools/misc/kibana/7.x.nix { };
-  kibana = kibana7;
-
   kibi = callPackage ../applications/editors/kibi { };
 
   kio-fuse = libsForQt5.callPackage ../tools/filesystems/kio-fuse { };
@@ -10311,15 +10306,6 @@ with pkgs;
   nodejs-slim = nodejs-slim_18;
   corepack = hiPrio corepack_18;
 
-  nodejs_14 = callPackage ../development/web/nodejs/v14.nix { openssl = openssl_1_1; };
-  nodejs-slim_14 = callPackage ../development/web/nodejs/v14.nix {
-    openssl = openssl_1_1;
-    enableNpm = false;
-  };
-
-  nodejs_16 = callPackage ../development/web/nodejs/v16.nix { };
-  nodejs-slim_16 = callPackage ../development/web/nodejs/v16.nix { enableNpm = false; };
-
   nodejs_18 = callPackage ../development/web/nodejs/v18.nix { };
   nodejs-slim_18 = callPackage ../development/web/nodejs/v18.nix { enableNpm = false; };
   corepack_18 = hiPrio (callPackage ../development/web/nodejs/corepack.nix { nodejs = nodejs_18; });
@@ -19851,8 +19837,7 @@ with pkgs;
 
   qtcreator = qt6Packages.callPackage ../development/tools/qtcreator {
     inherit (linuxPackages) perf;
-    stdenv = llvmPackages_14.stdenv;
-    llvmPackages = llvmPackages_14;
+    stdenv = llvmPackages.stdenv;
   };
 
   qxmledit = libsForQt5.callPackage ../applications/editors/qxmledit {} ;
@@ -26552,6 +26537,8 @@ with pkgs;
 
   jicofo = callPackage ../servers/jicofo { };
 
+  jitsi-excalidraw = callPackage ../servers/jitsi-excalidraw { };
+
   jitsi-meet = callPackage ../servers/web-apps/jitsi-meet { };
 
   jitsi-meet-prosody = callPackage ../misc/jitsi-meet-prosody { };
@@ -28119,6 +28106,7 @@ with pkgs;
   linuxPackages_testing = linuxKernel.packages.linux_testing;
   linux_testing = linuxKernel.kernels.linux_testing;
 
+  # FIXME: Remove and alias to `linux(Packages)_testing`` after 23.11 is released
   linuxPackages_testing_bcachefs = linuxKernel.packages.linux_testing_bcachefs;
   linux_testing_bcachefs = linuxKernel.kernels.linux_testing_bcachefs;
 
@@ -32539,8 +32527,6 @@ with pkgs;
 
   noson = libsForQt5.callPackage ../applications/audio/noson { };
 
-  offpunk = callPackage ../applications/networking/browsers/offpunk { };
-
   owl-compositor = callPackage ../applications/window-managers/owl { };
 
   p2pool = callPackage ../applications/misc/p2pool { };
@@ -33113,7 +33099,7 @@ with pkgs;
       CoreMediaIO QuartzCore AppKit CoreWLAN WebKit IOKit GSS MediaPlayer IOSurface Metal MetalKit;
 
     stdenv = if stdenv.isDarwin
-      then darwin.apple_sdk_11_0.stdenv
+      then overrideLibcxx darwin.apple_sdk_11_0.llvmPackages_12.stdenv
       else stdenv;
 
     # telegram-desktop has random crashes when jemalloc is built with gcc.
@@ -33452,9 +33438,7 @@ with pkgs;
 
   linuxsampler = callPackage ../applications/audio/linuxsampler { };
 
-  llpp = callPackage ../applications/misc/llpp {
-    inherit (ocaml-ng.ocamlPackages_4_14) ocaml;
-  };
+  llpp = callPackage ../applications/misc/llpp { };
 
   lls = callPackage ../applications/networking/lls { };
 
@@ -36342,13 +36326,6 @@ with pkgs;
     inherit (nodePackages) node-gyp;
   };
 
-  code-server = callPackage ../servers/code-server {
-    nodejs = nodejs_16;
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa CoreServices Security;
-    inherit (darwin) cctools;
-    inherit (nodePackages) node-gyp;
-  };
-
   vue = callPackage ../applications/misc/vue { };
 
   vuze = callPackage ../applications/networking/p2p/vuze {
@@ -37678,6 +37655,9 @@ with pkgs;
 
   deliantra-server = callPackage ../games/deliantra/server.nix {
     stdenv = gcc10StdenvCompat;
+    # perl538 defines 'struct object' in sv.h. many conflicts result
+    perl = perl536;
+    perlPackages = perl536Packages;
   };
   deliantra-arch = callPackage ../games/deliantra/arch.nix {
     stdenv = gcc10StdenvCompat;
@@ -40232,6 +40212,10 @@ with pkgs;
 
   cups-bjnp = callPackage ../misc/cups/drivers/cups-bjnp { };
 
+  dcp375cwlpr = (pkgsi686Linux.callPackage ../misc/cups/drivers/brother/dcp375cw { }).driver;
+
+  dcp375cw-cupswrapper = (callPackage ../misc/cups/drivers/brother/dcp375cw { }).cupswrapper;
+
   dcp9020cdwlpr = (pkgsi686Linux.callPackage ../misc/cups/drivers/brother/dcp9020cdw { }).driver;
 
   dcp9020cdw-cupswrapper = (callPackage ../misc/cups/drivers/brother/dcp9020cdw { }).cupswrapper;
@@ -41046,6 +41030,9 @@ with pkgs;
 
   hll2390dw-cups = callPackage ../misc/cups/drivers/hll2390dw-cups { };
 
+  mfc465cncupswrapper = callPackage ../misc/cups/drivers/brother/mfc465cncupswrapper { };
+  mfc465cnlpr = callPackage ../misc/cups/drivers/brother/mfc465cnlpr { };
+
   mfcj470dw-cupswrapper = callPackage ../misc/cups/drivers/mfcj470dwcupswrapper { };
   mfcj470dwlpr = pkgsi686Linux.callPackage ../misc/cups/drivers/mfcj470dwlpr { };
 
@@ -41988,7 +41975,7 @@ with pkgs;
   bottom = darwin.apple_sdk_11_0.callPackage ../tools/system/bottom { };
 
   cagebreak = callPackage ../applications/window-managers/cagebreak {
-    wlroots = wlroots_0_15;
+    wlroots = wlroots_0_16;
   };
 
   psftools = callPackage ../os-specific/linux/psftools { };
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 2cd4319e665..12ad5a678f2 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -201,6 +201,7 @@ in {
        then latest
        else testing;
 
+    # FIXME: Remove after 23.11 is released
     linux_testing_bcachefs = callPackage ../os-specific/linux/kernel/linux-testing-bcachefs.nix {
       # Pinned on the last version which Kent's commits can be cleany rebased up.
       kernel = linux_6_5;
@@ -612,6 +613,7 @@ in {
 
     # Intentionally lacks recurseIntoAttrs, as -rc kernels will quite likely break out-of-tree modules and cause failed Hydra builds.
     linux_testing = packagesFor kernels.linux_testing;
+    # FIXME: Remove after 23.11 is released
     linux_testing_bcachefs = recurseIntoAttrs (packagesFor kernels.linux_testing_bcachefs);
 
     linux_hardened = recurseIntoAttrs (packagesFor kernels.linux_hardened);
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 49dfc0a0374..c96eac917c0 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1169,6 +1169,20 @@ with self; {
     };
   };
 
+  AsyncUtil = buildPerlPackage {
+    pname = "Async-Util";
+    version = "0.01";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/W/WH/WHITNEY/Async-Util-0.01.tar.gz";
+      hash = "sha256-jzKxHKvFD2Xjh79W8mWBV6IsNah5Nmbhtfis/hMQkQY=";
+    };
+    buildInputs = [ AnyEvent ListMoreUtils ];
+    meta = {
+      description = "Utilities for doing common async operations";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   ArchiveCpio = buildPerlPackage {
     pname = "Archive-Cpio";
     version = "0.10";
@@ -1253,6 +1267,18 @@ with self; {
     };
   };
 
+  AudioCuefileParser = buildPerlPackage {
+    pname = "Audio-Cuefile-Parser";
+    version = "0.02";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/M/MA/MATTK/Audio-Cuefile-Parser-0.02.tar.gz";
+      hash = "sha256-ulbQcMhz2WxoatmoH99P6JuETkPrSd/gAL+c70PFtmk=";
+    };
+    meta = {
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   AudioFLACHeader = buildPerlPackage {
     pname = "Audio-FLAC-Header";
     version = "2.4";
@@ -3602,6 +3628,19 @@ with self; {
     };
   };
 
+  ClassMember = buildPerlPackage {
+    pname = "Class-Member";
+    version = "1.6";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/O/OP/OPI/Class-Member-1.6.tar.gz";
+      hash = "sha256-p1KK8in6OhIF3NJakd59dKxvp9lSgbmTtV6Lb0+HuZE=";
+    };
+    meta = {
+      description = "A set of modules to make the module developement easier";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   ClassMethodMaker = buildPerlPackage {
     pname = "Class-MethodMaker";
     version = "2.24";
@@ -8801,6 +8840,19 @@ with self; {
     };
   };
 
+  ENVUtil = buildPerlPackage {
+    pname = "ENV-Util";
+    version = "0.03";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/G/GA/GARU/ENV-Util-0.03.tar.gz";
+      hash = "sha256-B1574ehSxD6wiGYvr978FS9O9WyEPB4F2QDaGQb3P60=";
+    };
+    meta = {
+      description = "Parse prefixed environment variables and dotnev (.env) files into Perl";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   Error = buildPerlModule {
     pname = "Error";
     version = "0.17029";
@@ -12712,6 +12764,19 @@ with self; {
     };
   };
 
+  IOInterface = buildPerlModule {
+    pname = "IO-Interface";
+    version = "1.09";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LD/LDS/IO-Interface-1.09.tar.gz";
+      hash = "sha256-5j6BxS6x4OYOwtmD9VUtJJPhFxeZJclnV/I8S9n6cTo=";
+    };
+    meta = {
+      description = "Access and modify network interface card configuration";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   IOInteractive = buildPerlPackage {
     pname = "IO-Interactive";
     version = "1.025";
@@ -17933,6 +17998,20 @@ with self; {
     };
   };
 
+  MP3CutGapless = buildPerlPackage {
+    pname = "MP3-Cut-Gapless";
+    version = "0.03";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/A/AG/AGRUNDMA/MP3-Cut-Gapless-0.03.tar.gz";
+      hash = "sha256-PoS3OdHx4902FvhR3GV14WXTKEZ/AySGB5UOWVH+pPM=";
+    };
+    propagatedBuildInputs = [ AudioCuefileParser ];
+    meta = {
+      description = "Split an MP3 file without gaps (based on pcutmp3)";
+      license = with lib.licenses; [ artistic1 ];
+    };
+  };
+
   MP3Info = buildPerlPackage {
     pname = "MP3-Info";
     version = "1.26";
@@ -18838,6 +18917,20 @@ with self; {
     };
   };
 
+  NetNVD = buildPerlPackage {
+    pname = "Net-NVD";
+    version = "0.0.3";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/G/GA/GARU/Net-NVD-0.0.3.tar.gz";
+      hash = "sha256-uKZXEg+UsO7R2OvbA4i8M2DSj6Xw+CNrnNjNrovv5Bg=";
+    };
+    propagatedBuildInputs = [ IOSocketSSL JSON ];
+    meta = {
+      description = "Query CVE data from NIST's NVD (National Vulnerability Database)";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   NetOAuth = buildPerlModule {
     pname = "Net-OAuth";
     version = "0.28";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0a2f0fea462..77430d7d558 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3441,6 +3441,8 @@ self: super: with self; {
 
   ecdsa = callPackage ../development/python-modules/ecdsa { };
 
+  echo = callPackage ../development/python-modules/echo { };
+
   ecoaliface = callPackage ../development/python-modules/ecoaliface { };
 
   ecos = callPackage ../development/python-modules/ecos { };
@@ -3803,6 +3805,8 @@ self: super: with self; {
 
   fastapi-mail = callPackage ../development/python-modules/fastapi-mail { };
 
+  fast-histogram = callPackage ../development/python-modules/fast-histogram { };
+
   fastavro = callPackage ../development/python-modules/fastavro { };
 
   fastbencode = callPackage ../development/python-modules/fastbencode { };
@@ -4508,6 +4512,8 @@ self: super: with self; {
 
   glom = callPackage ../development/python-modules/glom { };
 
+  glueviz = callPackage ../development/python-modules/glueviz { };
+
   glymur = callPackage ../development/python-modules/glymur { };
 
   gmpy2 = callPackage ../development/python-modules/gmpy2 { };
@@ -6354,6 +6360,8 @@ self: super: with self; {
 
   linkify-it-py = callPackage ../development/python-modules/linkify-it-py { };
 
+  linknlink = callPackage ../development/python-modules/linknlink { };
+
   linode-api = callPackage ../development/python-modules/linode-api { };
 
   linode = callPackage ../development/python-modules/linode { };
@@ -6885,6 +6893,8 @@ self: super: with self; {
 
   mitmproxy = callPackage ../development/python-modules/mitmproxy { };
 
+  mitmproxy-macos = callPackage ../development/python-modules/mitmproxy-macos { };
+
   mitmproxy-rs = callPackage ../development/python-modules/mitmproxy-rs { };
 
   mitmproxy-wireguard = callPackage ../development/python-modules/mitmproxy-wireguard { };
@@ -7070,6 +7080,8 @@ self: super: with self; {
 
   mplleaflet = callPackage ../development/python-modules/mplleaflet { };
 
+  mpl-scatter-density = callPackage ../development/python-modules/mpl-scatter-density { };
+
   mpmath = callPackage ../development/python-modules/mpmath { };
 
   mpris-server = callPackage ../development/python-modules/mpris-server { };
@@ -9692,6 +9704,8 @@ self: super: with self; {
 
   pushover-complete = callPackage ../development/python-modules/pushover-complete { };
 
+  pvextractor = callPackage ../development/python-modules/pvextractor { };
+
   pvlib = callPackage ../development/python-modules/pvlib { };
 
   pvo = callPackage ../development/python-modules/pvo { };