Merge master into staging-next

81 files changed, 766 insertions, 903 deletions

diff --git a/maintainers/scripts/eval-release.nix b/maintainers/scripts/eval-release.nix
index 10acfe3284470..fb830981683f3 100644
--- a/maintainers/scripts/eval-release.nix
+++ b/maintainers/scripts/eval-release.nix
@@ -5,7 +5,7 @@ let
 
   trace = if builtins.getEnv "VERBOSE" == "1" then builtins.trace else (x: y: y);
 
-  rel = removeAttrs (import ../../pkgs/top-level/release.nix { }) [ "tarball" "unstable" "xbursttools" ];
+  rel = removeAttrs (import ../../pkgs/top-level/release.nix { }) [ "tarball" "unstable" ];
 
   # Add the ‘recurseForDerivations’ attribute to ensure that
   # nix-instantiate recurses into nested attribute sets.
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index f819cdb3b10b2..95508b70adfb2 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -633,7 +633,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - QtMultimedia has changed its default backend to `QT_MEDIA_BACKEND=ffmpeg` (previously `gstreamer` on Linux or `darwin` on MacOS).
   The previous native backends remain available but are now minimally maintained. Refer to [upstream documentation](https://doc.qt.io/qt-6/qtmultimedia-index.html#ffmpeg-as-the-default-backend) for further details about each platform.
 
-- The `drbd` out-of-tree Linux kernel driver has been added in version `9.2.7`. With it the DRBD 9.x features can be used instead of the 8.x features provided by the `8.4.11` in-tree driver.
+- The `drbd` out-of-tree Linux kernel driver has been added in version `9.2`. With it the DRBD 9.x features can be used instead of the 8.x features provided by the `8.4.11` in-tree driver.
 
 - The oil shell's c++ version is now available as `oils-for-unix`. The python version is still available as `oil`
 
diff --git a/nixos/modules/services/security/vaultwarden/default.nix b/nixos/modules/services/security/vaultwarden/default.nix
index b2920931f9a9e..33957be437b30 100644
--- a/nixos/modules/services/security/vaultwarden/default.nix
+++ b/nixos/modules/services/security/vaultwarden/default.nix
@@ -131,21 +131,13 @@ in {
         Additional environment file as defined in {manpage}`systemd.exec(5)`.
 
         Secrets like {env}`ADMIN_TOKEN` and {env}`SMTP_PASSWORD`
-        may be passed to the service without adding them to the world-readable Nix store.
+        should be passed to the service without adding them to the world-readable Nix store.
 
-        Note that this file needs to be available on the host on which
-        `vaultwarden` is running.
+        Note that this file needs to be available on the host on which `vaultwarden` is running.
 
-        As a concrete example, to make the Admin UI available
-        (from which new users can be invited initially),
+        As a concrete example, to make the Admin UI available (from which new users can be invited initially),
         the secret {env}`ADMIN_TOKEN` needs to be defined as described
-        [here](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page).
-        Setting `environmentFile` to `/var/lib/vaultwarden.env`
-        and ensuring permissions with e.g.
-        `chown vaultwarden:vaultwarden /var/lib/vaultwarden.env`
-        (the `vaultwarden` user will only exist after activating with
-        `enable = true;` before this), we can set the contents of the file to have
-        contents such as:
+        [here](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page):
 
         ```
         # Admin secret token, see
diff --git a/pkgs/applications/editors/jedit/build.xml.patch b/pkgs/applications/editors/jedit/build.xml.patch
deleted file mode 100644
index 2f630f18ab76e..0000000000000
--- a/pkgs/applications/editors/jedit/build.xml.patch
+++ /dev/null
@@ -1,257 +0,0 @@
---- a/build.xml	2015-02-04 08:47:37.000000000 +0100
-+++ b/build.xml	2015-02-17 14:06:42.455283148 +0100
-@@ -43,16 +43,6 @@
- 	<property name="textAreaPackage"
- 		  location="../textarea"/>
- 
--	<!-- Ivy Properties -->
--	<property name="config.ivy.version"
--		  value="2.2.0"/>
--	<property name="ivy.jar.dir"
--		  location="${lib.dir}/ivy"/>
--	<property name="ivy.jar.filename"
--		  value="ivy-${config.ivy.version}.jar"/>
--	<property name="ivy.jar.file"
--		  location="${ivy.jar.dir}/${ivy.jar.filename}"/>
--
- 	<!-- Miscellaneous -->
- 	<property name="jar.filename"
- 		  value="${ant.project.name}.jar"/>
-@@ -90,51 +80,8 @@
- 			  value="true"/>
- 	</target>
- 
--	<target name="check-ivy"
--		depends="init">
--		<available property="ivy.jar.present"
--			   file="${ivy.jar.file}"
--			   type="file"/>
--	</target>
--
--	<target name="download-ivy"
--		depends="init,check-ivy"
--		unless="ivy.jar.present">
--		<mkdir dir="${ivy.jar.dir}"/>
--		<get src="http://repo2.maven.org/maven2/org/apache/ivy/ivy/${config.ivy.version}/ivy-${config.ivy.version}.jar"
--		     dest="${ivy.jar.file}"
--		     usetimestamp="true"/>
--	</target>
--
--	<target name="init-ivy"
--		depends="init,download-ivy"
--		unless="ivy.done">
--		<property name="ivy.retrieve.pattern"
--			  value="${lib.dir}/[conf]/[artifact](-[classifier]).[ext]"/>
--		<taskdef resource="org/apache/ivy/ant/antlib.xml"
--			 classpath="${ivy.jar.file}"
--			 loaderref="ivy.loader"
--			 uri="antlib:org.apache.ivy.ant"/>
--		<ivy:settings file="ivysettings.xml"/>
--	</target>
--
--	<target name="retrieve"
--		description="retrieve the dependencies"
--		depends="init,init-ivy"
--		unless="ivy.done">
--		<ivy:retrieve sync="true"/>
--		<ivy:retrieve pattern="${lib.dir}/ivy/[artifact]-[revision].[ext]"
--			      organisation="org.apache.ivy"
--			      module="ivy"
--			      revision="${config.ivy.version}"
--			      conf="default"
--			      inline="true"/>
--		<property name="ivy.done"
--			  value="true"/>
--	</target>
--
- 	<target name="setup"
--		depends="init,retrieve">
-+		depends="init">
- 		<taskdef resource="net/sf/antcontrib/antlib.xml"
- 			 uri="antlib:net.sf.antcontrib">
- 			<classpath>
-@@ -239,37 +186,6 @@
- 		</javac>
- 	</target>
- 
--	<target name="compile-test"
--		depends="init,retrieve,compile">
--		<mkdir dir="${classes.dir}/test"/>
--		<depend srcDir="${basedir}/test"
--			destDir="${classes.dir}/test"
--			cache="${classes.dir}"/>
--		<dependset>
--			<srcfilelist files="build.xml"/>
--			<srcfilelist files="ivy.xml"/>
--			<targetfileset dir="${classes.dir}/test"/>
--		</dependset>
--		<javac srcdir="test"
--		       destdir="${classes.dir}/test"
--		       debug="true"
--		       debuglevel="${config.build.debuglevel}"
--		       nowarn="${config.build.nowarn}"
--		       deprecation="${config.build.deprecation}"
--		       source="${target.java.version}"
--		       target="${target.java.version}"
--		       compiler="modern"
--		       encoding="UTF-8"
--		       includeAntRuntime="false">
--			<classpath id="classpath.test">
--				<fileset dir="${lib.dir}/test"
--					 includes="*.jar"/>
--				<pathelement location="${classes.dir}/core"/>
--			</classpath>
--			<compilerarg line="${config.build.compilerarg}"/>
--		</javac>
--	</target>
--
- 	<target name="prepare-textArea"
- 		depends="init">
- 		<delete includeemptydirs="true"
-@@ -423,33 +339,8 @@
- 		</javac>
- 	</target>
- 
--	<target name="test"
--		depends="init,retrieve,compile,compile-test"
--		description="run unit tests"
--		unless="skip.tests">
--		<delete dir="${build.dir}/test/raw-reports"/>
--		<mkdir dir="${build.dir}/test/raw-reports"/>
--		<junit printsummary="true"
--		       failureproperty="tests.failed"
--		       enabletestlistenerevents="true">
--			<classpath refid="classpath.test"/>
--			<classpath location="${classes.dir}/test"/>
--			<formatter type="xml"/>
--			<batchtest todir="${build.dir}/test/raw-reports">
--				<fileset dir="test"/>
--			</batchtest>
--		</junit>
--		<mkdir dir="${build.dir}/test/merged-reports"/>
--		<junitreport todir="${build.dir}/test/merged-reports">
--			<fileset dir="${build.dir}/test/raw-reports"/>
--			<report todir="${build.dir}/test/reports"/>
--		</junitreport>
--		<fail message="Unit test(s) failed! See reports at ${build.dir}/test/reports/index.html"
--		      if="tests.failed"/>
--	</target>
--
- 	<target name="build"
--		depends="init,retrieve,setup,compile"
-+		depends="init,setup,compile"
- 		description="build the jEdit JAR-file with full debug-information">
- 		<mkdir dir="${jar.location}"/>
- 		<jar destfile="${jar.location}/${jar.filename}"
-@@ -504,11 +395,10 @@
- 				</copy>
- 			</contrib:then>
- 		</contrib:if>
--		<antcall target="test" />
- 	</target>
- 
- 	<target name="build-exe-launcher"
--		depends="init,retrieve,setup,filter-package-files"
-+		depends="init,setup,filter-package-files"
- 		description="build the EXE launcher">
- 		<contrib:if>
- 			<os family="windows"/>
-@@ -622,7 +512,7 @@
- 	</target>
- 
- 	<target name="unpack-docbook-xsl"
--		depends="init,retrieve">
-+		depends="init">
- 		<unzip src="${lib.dir}/docbook/docbook-xsl-resources.zip"
- 		       dest="${build.dir}/docbook-xsl/"/>
- 	</target>
-@@ -668,7 +558,7 @@
- 	</presetdef>
- 
- 	<target name="generate-doc-faq"
--		depends="init,retrieve,setup,unpack-docbook-xsl">
-+		depends="init,setup,unpack-docbook-xsl">
- 		<dependset.html>
- 			<srcfileset dir="doc/FAQ"/>
- 			<targetfileset dir="${jar.location}/doc/FAQ"/>
-@@ -692,7 +582,7 @@
- 	</target>
- 
- 	<target name="generate-doc-news"
--		depends="init,retrieve,setup,unpack-docbook-xsl">
-+		depends="init,setup,unpack-docbook-xsl">
- 		<dependset.html>
- 			<srcfileset dir="doc/whatsnew"/>
- 			<targetfileset dir="${jar.location}/doc/whatsnew"/>
-@@ -716,7 +606,7 @@
- 	</target>
- 
- 	<target name="generate-doc-users-guide"
--		depends="init,retrieve,setup,unpack-docbook-xsl">
-+		depends="init,setup,unpack-docbook-xsl">
- 		<dependset.html>
- 			<srcfileset dir="doc/users-guide"/>
- 			<targetfileset dir="${jar.location}/doc/users-guide"/>
-@@ -851,7 +741,7 @@
- 	</target>
- 
- 	<target name="generate-pdf-users-guide"
--		depends="init,retrieve,setup,unpack-docbook-xsl">
-+		depends="init,setup,unpack-docbook-xsl">
- 		<fail message="Please set the property &quot;paper.type&quot;"
- 		      unless="paper.type"/>
- 		<contrib:switch value="${paper.type}">
-@@ -1154,7 +1044,7 @@
- 	</target>
- 
- 	<target name="compile-jarbundler"
--		depends="init,retrieve">
-+		depends="init">
- 		<mkdir dir="${classes.dir}/jarbundler"/>
- 		<depend srcDir="${basedir}"
- 			destDir="${classes.dir}/jarbundler"
-@@ -1180,7 +1070,7 @@
- 	</target>
- 
- 	<target name="dist-mac-finish"
--		depends="init,retrieve,setup"
-+		depends="init,setup"
- 		description="finish building the Mac OS X disk image (DMG-file) on Mac OS X">
- 		<fail message="The disk image (DMG-file) for easy distribution on Mac OS X can only be built on Mac OS X currently">
- 			<condition>
-@@ -1295,7 +1185,7 @@
- 	</target>
- 
- 	<target name="dist-mac"
--		depends="init,retrieve,setup,prepare-dist-files"
-+		depends="init,setup,prepare-dist-files"
- 		description="build the Mac OS X disk image (DMG-file)">
- 		<antcall target="compile-jarbundler">
- 			<param name="config.build.debuglevel"
-@@ -1411,7 +1301,7 @@
- 	</target>
- 
- 	<target name="prepare-dist-files"
--		depends="init,retrieve,setup">
-+		depends="init,setup">
- 		<antcall target="build">
- 			<param name="config.build.debuglevel"
- 			       value="lines,source"/>
-@@ -1592,7 +1482,7 @@
- 	</target>
- 
- 	<target name="dist-deb"
--		depends="init,retrieve,setup,prepare-dist-files"
-+		depends="init,setup,prepare-dist-files"
- 		description="build the DEB Package">
- 		<antcall target="compile-ar">
- 			<param name="config.build.debuglevel"
-@@ -1838,7 +1728,7 @@
- 	</target>
- 
- 	<target name="dist-sign-deb-Release"
--		depends="init,retrieve,setup"
-+		depends="init,setup"
- 		description="sign the DEB Release file">
- 		<contrib:if>
- 			<not>
diff --git a/pkgs/applications/editors/jedit/default.nix b/pkgs/applications/editors/jedit/default.nix
index fe9284873551e..8fdf8e7c8de26 100644
--- a/pkgs/applications/editors/jedit/default.nix
+++ b/pkgs/applications/editors/jedit/default.nix
@@ -1,63 +1,118 @@
-{ lib, stdenv, fetchurl, ant, jdk, commonsBsf, commonsLogging, bsh }:
+{
+  lib,
+  stdenv,
+  fetchsvn,
+  ant,
+  jdk,
+  jre,
+  xmlstarlet,
+  makeWrapper,
+  stripJavaArchivesHook,
+}:
 
-let
-  version = "5.2.0";
-  bcpg = fetchurl {
-    url = "mirror://maven/org/bouncycastle/bcpg-jdk16/1.46/bcpg-jdk16-1.46.jar";
-    sha256 = "16xhmwks4l65m5x150nd23y5lyppha9sa5fj65rzhxw66gbli82d";
-  };
-  jsr305 = fetchurl {
-    url = "mirror://maven/com/google/code/findbugs/jsr305/2.0.0/jsr305-2.0.0.jar";
-    sha256 = "0s74pv8qjc42c7q8nbc0c3b1hgx0bmk3b8vbk1z80p4bbgx56zqy";
-  };
-in
-
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "jedit";
-  inherit version;
-  src = fetchurl {
-    url = "mirror://sourceforge/jedit/jedit${version}source.tar.bz2";
-    sha256 = "03wmbh90rl5lsc35d7jwcp9j5qyyzq1nccxf4fal8bmnx8n4si0x";
+  version = "5.6.0-unstable-2023-11-19";
+
+  src = fetchsvn {
+    url = "https://svn.code.sf.net/p/jedit/svn/jEdit/trunk";
+    rev = "25703";
+    hash = "sha256-z1KTZqKl6Dlqayw/3h/JvHQK3kSfio02R8V6aCb4g4Q=";
   };
 
-  buildInputs = [ ant jdk commonsBsf commonsLogging ];
+  ivyDeps = stdenv.mkDerivation {
+    name = "${finalAttrs.pname}-${finalAttrs.version}-ivy-deps";
+    inherit (finalAttrs) src;
+
+    nativeBuildInputs = [
+      ant
+      jdk
+      xmlstarlet
+    ];
 
-  # This patch removes from the build process:
-  #  - the automatic download of dependencies (see configurePhase);
-  #  - the tests
-  patches = [ ./build.xml.patch ];
+    # set defaultCacheDir to something that can exist
+    # this directory won't get copied, but needs to be set properly
+    configurePhase = ''
+      runHook preConfigure
 
-  configurePhase = ''
-    mkdir -p lib/ant-contrib/ lib/scripting lib/compile lib/default-plugins
-    cp ${ant}/lib/ant/lib/ant-contrib-*.jar lib/ant-contrib/
-    cp ${bsh} ${bcpg} lib/scripting/
-    cp ${jsr305} lib/compile/
+      xmlstarlet ed --subnode /ivysettings -t elem -n caches ivysettings.xml \
+          | xmlstarlet ed --insert /ivysettings/caches -t attr -n defaultCacheDir -v "$(pwd)/ivy-cache" \
+          > ivysettings.xml.tmp
+      mv ivysettings.xml.tmp ivysettings.xml
+
+      runHook postConfigure
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+      ant retrieve
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/lib
+      cp -r lib/* $out/lib
+      runHook postInstall
+    '';
+
+    outputHashMode = "recursive";
+    outputHashAlgo = "sha256";
+    outputHash = "sha256-J5i5IhXlXw84y/4K6Vt84au4eVXVLupmtfscO+y1Fi0=";
+  };
+
+  # ignore a test failing because of the build environment
+  postPatch = ''
+    substituteInPlace test/org/gjt/sp/jedit/MiscUtilitiesTest.java \
+        --replace-fail "public class MiscUtilitiesTest" "@org.junit.Ignore public class MiscUtilitiesTest"
   '';
 
-  buildPhase = "ant build";
+  nativeBuildInputs = [
+    ant
+    jdk
+    makeWrapper
+    stripJavaArchivesHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    ln -s ${finalAttrs.ivyDeps}/lib ./lib
+    ant build -Divy.done=true
+    runHook postBuild
+  '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/jEdit
-    cp -r build/jedit.jar doc icons keymaps macros modes startup $out/share/jEdit
-
-    sed -i "s|Icon=.*|Icon=$out/share/jEdit/icons/jedit-icon48.png|g" package-files/linux/deb/jedit.desktop
-    mkdir -p $out/share/applications
-    mv package-files/linux/deb/jedit.desktop $out/share/applications/jedit.desktop
-
-    # specify the correct JAVA_HOME
-    sed -i '1a JAVA_HOME=${jdk}' package-files/linux/jedit
-    sed -i "s|/usr/share/jEdit/@jar.filename@|$out/share/jEdit/jedit.jar|g" package-files/linux/jedit
-    mkdir -p $out/bin
-    cp package-files/linux/jedit $out/bin/jedit
-    chmod +x $out/bin/jedit
+    cp -r build/jedit.jar doc keymaps macros modes startup $out/share/jEdit
+
+    install -Dm644 icons/jedit-icon48.png $out/share/icons/hicolor/48x48/apps/jedit.png
+    install -Dm644 package-files/linux/deb/jedit.desktop -t $out/share/applications
+
+    sed -i $out/share/applications/jedit.desktop \
+        -e "s|Icon=.*|Icon=jedit|g" \
+        -e "s|Exec=.*|Exec=jedit|g"
+
+    install -Dm755 package-files/linux/jedit -t $out/bin
+    substituteInPlace $out/bin/jedit \
+        --replace-fail "/usr/share/jEdit/@jar.filename@" "$out/share/jEdit/jedit.jar"
+
+    wrapProgram $out/bin/jedit --set JAVA_HOME ${jre}
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
-    description = "Mature programmer's text editor (Java based)";
+  meta = {
+    description = "A programmer's text editor written in Java";
     homepage = "http://www.jedit.org";
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
-    license = licenses.gpl2;
-    platforms = platforms.unix;
-    maintainers = [ ];
+    license = lib.licenses.gpl2Only;
+    mainProgram = "jedit";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    platforms = lib.platforms.unix;
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode # ivyDeps contains .jar dependencies
+    ];
   };
-}
+})
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 99d6d4986c581..1fade4c0b1bcd 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -4715,14 +4715,14 @@ final: prev:
 
   hydra-nvim = buildVimPlugin {
     pname = "hydra.nvim";
-    version = "2023-02-06";
+    version = "2024-03-15";
     src = fetchFromGitHub {
-      owner = "anuvyklack";
+      owner = "nvimtools";
       repo = "hydra.nvim";
-      rev = "3ced42c0b6a6c85583ff0f221635a7f4c1ab0dd0";
-      sha256 = "1dwhi2543drbncrqx80nsi5hw48d6my4wbsp71gx6m0clkp4469h";
+      rev = "8578056a2226ed49fc608167edc143a87f75d809";
+      sha256 = "sha256-Qxp2FigXlupAw/ZwZRVJ+hRKzVRtupV6L4a6jOslwI0=";
     };
-    meta.homepage = "https://github.com/anuvyklack/hydra.nvim/";
+    meta.homepage = "https://github.com/nvimtools/hydra.nvim/";
   };
 
   i3config-vim = buildVimPlugin {
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 8fa26fd32adcd..ce39e6a488a79 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -394,7 +394,7 @@ https://github.com/smoka7/hop.nvim/,,
 https://github.com/rktjmp/hotpot.nvim/,,
 https://github.com/lewis6991/hover.nvim/,HEAD,
 https://github.com/othree/html5.vim/,HEAD,
-https://github.com/anuvyklack/hydra.nvim/,HEAD,
+https://github.com/nvimtools/hydra.nvim/,HEAD,
 https://github.com/mboughaba/i3config.vim/,,
 https://github.com/cocopon/iceberg.vim/,,
 https://github.com/idris-hackers/idris-vim/,,
diff --git a/pkgs/applications/misc/ablog/default.nix b/pkgs/applications/misc/ablog/default.nix
index 932db21317c66..67b21e5199de5 100644
--- a/pkgs/applications/misc/ablog/default.nix
+++ b/pkgs/applications/misc/ablog/default.nix
@@ -5,12 +5,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ablog";
-  version = "0.11.6";
+  version = "0.11.8";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fV4W4AaiqyruIz3OQ7/lGkMPMKmyiFa+fdU2QeeQCvs=";
+    hash = "sha256-PpNBfa4g14l8gm9+PxOFc2NDey031D7Ohutx2OGUeak=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/misc/authy/default.nix b/pkgs/applications/misc/authy/default.nix
deleted file mode 100644
index 95a439b675390..0000000000000
--- a/pkgs/applications/misc/authy/default.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{ autoPatchelfHook
-, electron
-, fetchurl
-, lib
-, makeWrapper
-, squashfsTools
-, stdenv
-}:
-
-stdenv.mkDerivation rec {
-  pname = "authy";
-  # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/authy?channel=stable' | jq '.download_url,.version'
-  version = "2.4.1";
-  rev = "21";
-
-  src = fetchurl {
-    url = "https://api.snapcraft.io/api/v1/snaps/download/H8ZpNgIoPyvmkgxOWw5MSzsXK1wRZiHn_${rev}.snap";
-    hash = "sha256-a5z6Lwdgody88f7has/f2AMg9m9fGWsJSexZM6KUGOY=";
-  };
-
-  nativeBuildInputs = [ autoPatchelfHook makeWrapper squashfsTools ];
-
-  unpackPhase = ''
-    runHook preUnpack
-    unsquashfs "$src"
-    cd squashfs-root
-    if ! grep -q '${version}' meta/snap.yaml; then
-      echo "Package version differs from version found in snap metadata:"
-      grep 'version: ' meta/snap.yaml
-      echo "While the nix package specifies: ${version}."
-      echo "You probably chose the wrong revision or forgot to update the nix version."
-      exit 1
-    fi
-    runHook postUnpack
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin $out/share/applications $out/share/pixmaps/apps
-
-    # Copy only what is needed
-    cp -r resources* $out/
-    cp -r locales* $out/
-    cp meta/gui/authy.desktop $out/share/applications/
-    cp meta/gui/icon.png $out/share/pixmaps/authy.png
-
-    # Replace icon name in Desktop file
-    sed -i 's|''${SNAP}/meta/gui/icon.png|authy|g' "$out/share/applications/authy.desktop"
-
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/resources/app.asar
-  '';
-
-  meta = with lib; {
-    homepage = "https://www.authy.com";
-    description = "Twilio Authy two factor authentication desktop application";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = with maintainers; [ iammrinal0 ];
-    platforms = [ "x86_64-linux" ];
-    mainProgram = "authy";
-  };
-}
diff --git a/pkgs/applications/misc/cobang/default.nix b/pkgs/applications/misc/cobang/default.nix
index e36ece60d751c..336b4d7c1a507 100644
--- a/pkgs/applications/misc/cobang/default.nix
+++ b/pkgs/applications/misc/cobang/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonApplication rec {
   pname = "cobang";
-  version = "0.10.5";
+  version = "0.10.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "hongquan";
     repo = "CoBang";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CfT/farNOJiWIioFBPx2q7bAFAE4khcojdZ7AsYaU6o=";
+    hash = "sha256-xOP2XkmHOGMe50dn4StX/9veTdloLHq76ENWEUK4Keo=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index b4e2acc645fbe..947c18050ea76 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpxsee";
-  version = "13.18";
+  version = "13.19";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = finalAttrs.version;
-    hash = "sha256-FetXV1D1aW7eanhPQkNzcGwKMMwzXLhBZjrzg1LD980=";
+    hash = "sha256-Q/Na+uc6a+OSLvJK75MEIxgdJhg/At830SBrix38Qj8=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/networking/cluster/timoni/default.nix b/pkgs/applications/networking/cluster/timoni/default.nix
index a756212d3d67a..40511cc74ebc3 100644
--- a/pkgs/applications/networking/cluster/timoni/default.nix
+++ b/pkgs/applications/networking/cluster/timoni/default.nix
@@ -6,16 +6,16 @@
 
 buildGo122Module rec {
   pname = "timoni";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "stefanprodan";
     repo = "timoni";
     rev = "v${version}";
-    hash = "sha256-zQawfzwQNQvtta7lIOtePGI67Y4iXzEBGqd5YiOKAVY=";
+    hash = "sha256-LN2VxXKjEaUgLSVc0G+OlhmaZ4anBmyXbOBOrGIeYG0=";
   };
 
-  vendorHash = "sha256-xQgSABaWY5FWHh2kcBB36fm3povFNpU18PjD4J6M4QM=";
+  vendorHash = "sha256-Vj7P0o0UM35WTv9s1BAcW6MuzjIinADOFsuCK1bpKP0=";
 
   subPackages = [ "cmd/timoni" ];
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index eda54f85a0cac..9f4c5a98c4497 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20240415-2";
+  version = "20240420-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-fMt5F+ykMxaP/6gEVN7TabENTSKbO4Gpms5yD+MBzPc=";
+    hash = "sha256-FRsJeLOm29nlouTMPv5mdnDYWD28ydWQxsakvLxJ4Lg=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/office/qownnotes/default.nix b/pkgs/applications/office/qownnotes/default.nix
index 2009c6f9a0bcb..924f683b52aa8 100644
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@@ -21,14 +21,14 @@
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "24.4.2";
+  version = "24.4.3";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-HnWxIcOy7Te6Q5YfZYhvITpfsgeQw8Tt/Nr++wcpxEU=";
+    hash = "sha256-dthb+FkytNiiS2s7VdMgYxvNbGeBx5gONOYkHHphigY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/an/antares/package.nix b/pkgs/by-name/an/antares/package.nix
index ff2dff5dc4d56..7e2537d211bbd 100644
--- a/pkgs/by-name/an/antares/package.nix
+++ b/pkgs/by-name/an/antares/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "antares";
-  version = "0.7.22";
+  version = "0.7.23";
 
   src = fetchFromGitHub {
     owner = "antares-sql";
     repo = "antares";
     rev = "v${version}";
-    hash = "sha256-SYnhrwxoyVw+bwfN1PGMsoul+mTfi8UkiP0fNOvVTBc=";
+    hash = "sha256-7bj0f7JrUgHr2g489ABjNLfRERQFx0foDP0YqBTNkzI=";
   };
 
-  npmDepsHash = "sha256-5khFw8Igu2d5SYLh7OiCpUDMOVH5gAje+VnvoESQboo=";
+  npmDepsHash = "sha256-pRrg7fY5P2awds1ncsnD/lDvKmiOKhzjNcKXKy70bcs=";
 
   buildInputs = [ nodejs ];
 
diff --git a/pkgs/by-name/ap/api-linter/package.nix b/pkgs/by-name/ap/api-linter/package.nix
index c3501889915d7..ca82f079395ed 100644
--- a/pkgs/by-name/ap/api-linter/package.nix
+++ b/pkgs/by-name/ap/api-linter/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "api-linter";
-  version = "1.65.1";
+  version = "1.65.2";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     rev = "v${version}";
-    hash = "sha256-YGawN0mAJHfWkre+0tunPM/psd9aBWtSVsJoar0WVwY=";
+    hash = "sha256-UBGFY6MamoQyzPmjmz6TmeiF8DTXV/Lpl5HFbxMUPE8=";
   };
 
-  vendorHash = "sha256-CsOnHHq3UjNWjfMy1TjXy20B0Bni6Fr3ZMJGvU7QDFA=";
+  vendorHash = "sha256-VPCTyJI02KL6Gn+gdTy36uEbDI71ORrSZnXuWqP0KrM=";
 
   subPackages = [ "cmd/api-linter" ];
 
diff --git a/pkgs/by-name/co/converseen/package.nix b/pkgs/by-name/co/converseen/package.nix
index 59d8988903782..8250d0edb5919 100644
--- a/pkgs/by-name/co/converseen/package.nix
+++ b/pkgs/by-name/co/converseen/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "converseen";
-  version = "0.12.2.2";
+  version = "0.12.2.3";
 
   src = fetchFromGitHub {
     owner = "Faster3ck";
     repo = "Converseen";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-nAX5o+rqQCwBTizqwLPewmhlYQbxlPj158U+v3Z08fQ=";
+    hash = "sha256-ISXEEJHE7C1gqEmhIAPuu8ibrh0Cvh7EyRKsFeDuLDE=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/hy/hyprlock/cmake.patch b/pkgs/by-name/hy/hyprlock/cmake.patch
new file mode 100644
index 0000000000000..92c21d643c0f3
--- /dev/null
+++ b/pkgs/by-name/hy/hyprlock/cmake.patch
@@ -0,0 +1,15 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 07e2338..720810b 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -83,9 +83,4 @@ protocol("unstable/linux-dmabuf/linux-dmabuf-unstable-v1.xml" "linux-dmabuf-unst
+ # Installation
+ install(TARGETS hyprlock)
+ 
+-install(CODE "
+-    if (NOT EXISTS \"${CMAKE_INSTALL_FULL_SYSCONFDIR}/pam.d/hyprlock\")
+-        install(FILES \"${CMAKE_SOURCE_DIR}/pam/hyprlock\" DESTINATION \"${CMAKE_INSTALL_FULL_SYSCONFDIR}/pam.d\")
+-    endif()
+-")
+-
++install(FILES "${CMAKE_SOURCE_DIR}/pam/hyprlock" DESTINATION "${CMAKE_INSTALL_FULL_SYSCONFDIR}/pam.d")
diff --git a/pkgs/by-name/hy/hyprlock/package.nix b/pkgs/by-name/hy/hyprlock/package.nix
index 5bac39c63d49e..fb59a96321a09 100644
--- a/pkgs/by-name/hy/hyprlock/package.nix
+++ b/pkgs/by-name/hy/hyprlock/package.nix
@@ -18,15 +18,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprlock";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprlock";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1p6Y/8+ETaz7GQ8wsXLUTrk2dD0YN9ySOfwjRp2TSG4=";
+    hash = "sha256-rbzVe2WNdHynJrnyJsKOOrV8yuuJ7QIuah3ZHWERSnA=";
   };
 
+  patches = [
+    # remove PAM file install check
+    ./cmake.patch
+  ];
+
   strictDeps = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/i3/i3bar-river/package.nix b/pkgs/by-name/i3/i3bar-river/package.nix
index b31e4ca12910d..e629dd32b95e9 100644
--- a/pkgs/by-name/i3/i3bar-river/package.nix
+++ b/pkgs/by-name/i3/i3bar-river/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "i3bar-river";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "MaxVerevkin";
     repo = "i3bar-river";
     rev = "v${version}";
-    hash = "sha256-wtyC8cGK408KZYpWniW2y4XI1ScTSBZJJlUt6b2Z5KA=";
+    hash = "sha256-mLRB4o8FR/R9QUpRkcNppiE2XcWFWE05wPxuKdxG18M=";
   };
 
-  cargoHash = "sha256-PdSMDsV3yFy3kSNS6OBxFdrZsIn70gXOTd2AhyU4a9o=";
+  cargoHash = "sha256-INjuI3XTSzAjLqk/P+cd7rMhXsOBDSqMaZZN9kFyreg=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ pango ];
diff --git a/pkgs/by-name/ma/makima/package.nix b/pkgs/by-name/ma/makima/package.nix
index 31552c840fe2f..176432cdee7a3 100644
--- a/pkgs/by-name/ma/makima/package.nix
+++ b/pkgs/by-name/ma/makima/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec{
   pname = "makima";
-  version = "0.5.2";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "cyber-sushi";
     repo = "makima";
     rev = "v${version}";
-    hash = "sha256-x8vjTXB6kFJ9o6EGCtlX6eT/VrzLF17fIA2gDLFumzY=";
+    hash = "sha256-Zhr8j1JWxjwUZ3fjXKUEaKp3T6/dekeAxUDys6eniMQ=";
   };
 
-  cargoHash = "sha256-p4oMeDL7T/a9OCgMdriGtgHkZq8tZVzPspEsU4IPfAo=";
+  cargoHash = "sha256-LdgS833MKJOEnUmfvnH/sWG9RrRMNwbe5gAgXTUYzh8=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ udev ];
diff --git a/pkgs/by-name/me/megapixels/package.nix b/pkgs/by-name/me/megapixels/package.nix
index eef5e4c7add3a..74ced5c3af268 100644
--- a/pkgs/by-name/me/megapixels/package.nix
+++ b/pkgs/by-name/me/megapixels/package.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "megapixels";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitLab {
     owner = "megapixels-org";
     repo = "Megapixels";
     rev = finalAttrs.version;
-    hash = "sha256-J94kDSqQkfdltbYbzvJofd5o/Dhivtld475CaQs7+Ok=";
+    hash = "sha256-TXiPJbd4TPpsEvmD97F7xkm4rS1g+ViTVTNlxeXrQaw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/dns/pdns-recursor/default.nix b/pkgs/by-name/pd/pdns-recursor/package.nix
index d56b4c7c03594..e2ba9cf842fbe 100644
--- a/pkgs/servers/dns/pdns-recursor/default.nix
+++ b/pkgs/by-name/pd/pdns-recursor/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdns-recursor";
-  version = "5.0.3";
+  version = "5.0.4";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-AdFwooUOsqylAdaDijREE2WJmA1cssK1M5K3ZFnjjAc=";
+    hash = "sha256-1SqrEIoK2ei+HeIXmmk7uF6ZXGpNlYpQcC3Pee7I7yg=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
diff --git a/pkgs/by-name/rq/rqbit/Cargo.lock b/pkgs/by-name/rq/rqbit/Cargo.lock
index a24314e30eb91..e8515b5987b25 100644
--- a/pkgs/by-name/rq/rqbit/Cargo.lock
+++ b/pkgs/by-name/rq/rqbit/Cargo.lock
@@ -91,9 +91,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.81"
+version = "1.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0952808a6c2afd1aa8947271f3a60f1a6763c7b912d210184c5149b5cf147247"
+checksum = "f538837af36e6f6a9be0faa67f9a314f8119e4e4b5867c6ab40ed60360142519"
 
 [[package]]
 name = "async-recursion"
@@ -130,9 +130,9 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.79"
+version = "0.1.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a507401cad91ec6a857ed5513a2073c82a9b9048762b885bb98655b306964681"
+checksum = "c6fa2087f2753a7da8cc1c0dbfcf89579dd57458e36769de5ac750b4671737ca"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -186,7 +186,7 @@ dependencies = [
  "http 1.1.0",
  "http-body 1.0.0",
  "http-body-util",
- "hyper 1.2.0",
+ "hyper 1.3.1",
  "hyper-util",
  "itoa",
  "matchit",
@@ -199,7 +199,7 @@ dependencies = [
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
- "sync_wrapper 1.0.0",
+ "sync_wrapper 1.0.1",
  "tokio",
  "tower",
  "tower-layer",
@@ -327,9 +327,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.15.4"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ff69b9dd49fd426c69a0db9fc04dd934cdb6645ff000864d98f7e2af8830eaa"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
 name = "byteorder"
@@ -345,9 +345,9 @@ checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
 
 [[package]]
 name = "cc"
-version = "1.0.90"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cd6604a82acf3039f1144f54b8eb34e91ffba622051189e71b781822d5ee1f5"
+checksum = "d32a725bc159af97c3e629873bb9f88fb8cf8a4867175f76dc987815ea07c83b"
 
 [[package]]
 name = "cfg-if"
@@ -357,9 +357,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chrono"
-version = "0.4.37"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a0d04d43504c61aa6c7531f1871dd0d418d91130162063b789da00fd7057a5e"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -367,7 +367,7 @@ dependencies = [
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-targets 0.52.4",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -643,15 +643,15 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
+checksum = "a47c1c47d2f5964e29c61246e81db715514cd532db6b5116a25ea3c03d6780a2"
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.33"
+version = "0.8.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
+checksum = "b45de904aa0b010bce2ab45264d0631681847fa7b6f2eaa7dab7619943bc4f59"
 dependencies = [
  "cfg-if",
 ]
@@ -840,9 +840,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a06fddc2749e0528d2813f95e050e87e52c8cbbae56223b9babf73b3e53b0cc6"
+checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
  "cfg-if",
  "libc",
@@ -1042,9 +1042,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.2.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "186548d73ac615b32a73aafe38fb4f56c0d340e110e5a200bcadbaf2e199263a"
+checksum = "fe575dd17d0862a9a33781c8c4696a55c320909004a67a00fb286ba8b1bc496d"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -1069,7 +1069,7 @@ checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
 dependencies = [
  "futures-util",
  "http 1.1.0",
- "hyper 1.2.0",
+ "hyper 1.3.1",
  "hyper-util",
  "rustls",
  "rustls-pki-types",
@@ -1098,7 +1098,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.2.0",
+ "hyper 1.3.1",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -1117,7 +1117,7 @@ dependencies = [
  "futures-util",
  "http 1.1.0",
  "http-body 1.0.0",
- "hyper 1.2.0",
+ "hyper 1.3.1",
  "pin-project-lite",
  "socket2",
  "tokio",
@@ -1261,7 +1261,7 @@ dependencies = [
 
 [[package]]
 name = "librqbit"
-version = "5.6.0"
+version = "5.6.1"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -1384,7 +1384,7 @@ dependencies = [
 
 [[package]]
 name = "librqbit-peer-protocol"
-version = "3.5.2"
+version = "3.5.3"
 dependencies = [
  "anyhow",
  "bincode",
@@ -1843,9 +1843,9 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.79"
+version = "1.0.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835ff2298f5721608eb1a980ecaee1aef2c132bf95ecc026a11b7bf3c01c02e"
+checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
 dependencies = [
  "unicode-ident",
 ]
@@ -1884,9 +1884,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
 dependencies = [
  "proc-macro2",
 ]
@@ -1993,9 +1993,9 @@ checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
 
 [[package]]
 name = "reqwest"
-version = "0.12.3"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e6cc1e89e689536eb5aeede61520e874df5a4707df811cd5da4aa5fbb2aae19"
+checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
 dependencies = [
  "base64 0.22.0",
  "bytes",
@@ -2006,7 +2006,7 @@ dependencies = [
  "http 1.1.0",
  "http-body 1.0.0",
  "http-body-util",
- "hyper 1.2.0",
+ "hyper 1.3.1",
  "hyper-rustls",
  "hyper-tls",
  "hyper-util",
@@ -2064,7 +2064,7 @@ dependencies = [
 
 [[package]]
 name = "rqbit"
-version = "5.6.0"
+version = "5.6.1"
 dependencies = [
  "anyhow",
  "bytes",
@@ -2093,9 +2093,9 @@ checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
 [[package]]
 name = "rustix"
-version = "0.38.32"
+version = "0.38.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65e04861e65f21776e67888bfbea442b3642beaa0138fdb1dd7a84a52dffdb89"
+checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
 dependencies = [
  "bitflags 2.5.0",
  "errno",
@@ -2106,9 +2106,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.22.3"
+version = "0.22.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99008d7ad0bbbea527ec27bddbc0e432c5b87d8175178cee68d2eec9c4a1813c"
+checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432"
 dependencies = [
  "log",
  "ring",
@@ -2120,25 +2120,25 @@ dependencies = [
 
 [[package]]
 name = "rustls-pemfile"
-version = "2.1.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f48172685e6ff52a556baa527774f61fcaa884f59daf3375c62a3f1cd2549dab"
+checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.0",
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.4.1"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecd36cc4259e3e4514335c4a138c6b43171a8d61d8f5c9348f9fc7529416f247"
+checksum = "beb461507cee2c2ff151784c52762cf4d9ff6a61f3e80968600ed24fa837fa54"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.102.2"
+version = "0.102.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faaa0a62740bedb9b2ef5afa303da42764c012f743917351dc9a237ea1663610"
+checksum = "f3bce581c0dd41bce533ce695a1437fa16a7ab5ac3ccfa99fe1a620a7885eabf"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -2147,9 +2147,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ffc183a10b4478d04cbbbfc96d0873219d962dd5accaff2ffbd4ceb7df837f4"
+checksum = "80af6f9131f277a45a3fba6ce8e2258037bb0477a67e610d3c1fe046ab31de47"
 
 [[package]]
 name = "ryu"
@@ -2197,9 +2197,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.197"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
+checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
 dependencies = [
  "serde_derive",
 ]
@@ -2218,9 +2218,9 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.197"
+version = "1.0.198"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
+checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2229,9 +2229,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.115"
+version = "1.0.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12dc5c46daa8e9fdf4f5e71b6cf9a53f2487da0e86e55808e2d35539666497dd"
+checksum = "3e17db7126d17feb94eb3fad46bf1a96b034e8aacbc2e775fe81505f8b0b2813"
 dependencies = [
  "itoa",
  "ryu",
@@ -2365,9 +2365,9 @@ checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
 
 [[package]]
 name = "syn"
-version = "2.0.58"
+version = "2.0.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44cfb93f38070beee36b3fef7d4f5a16f27751d94b187b666a5cc5e9b0d30687"
+checksum = "909518bc7b1c9b779f1bbf07f2929d35af9f0f37e47c6e9ef7f9dddc1e1821f3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2382,9 +2382,9 @@ checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
 [[package]]
 name = "sync_wrapper"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "384595c11a4e2969895cad5a8c4029115f5ab956a9e5ef4de79d11a426e5f20c"
+checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394"
 
 [[package]]
 name = "system-configuration"
@@ -2427,18 +2427,18 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.58"
+version = "1.0.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03468839009160513471e86a034bb2c5c0e4baae3b43f79ffc55c4a5427b3297"
+checksum = "f0126ad08bff79f29fc3ae6a55cc72352056dfff61e3ff8bb7129476d44b23aa"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.58"
+version = "1.0.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61f3ba182994efc43764a46c018c347bc492c79f024e705f46567b418f6d4f7"
+checksum = "d1cd413b5d558b4c5bf3680e324a6fa5014e7b7c067a51e69dbdf47eb7148b66"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2467,9 +2467,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.34"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
@@ -2488,9 +2488,9 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.17"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
  "num-conv",
  "time-core",
@@ -2978,7 +2978,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.4",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -2996,7 +2996,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.4",
+ "windows-targets 0.52.5",
 ]
 
 [[package]]
@@ -3016,17 +3016,18 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
+checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.4",
- "windows_aarch64_msvc 0.52.4",
- "windows_i686_gnu 0.52.4",
- "windows_i686_msvc 0.52.4",
- "windows_x86_64_gnu 0.52.4",
- "windows_x86_64_gnullvm 0.52.4",
- "windows_x86_64_msvc 0.52.4",
+ "windows_aarch64_gnullvm 0.52.5",
+ "windows_aarch64_msvc 0.52.5",
+ "windows_i686_gnu 0.52.5",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.5",
+ "windows_x86_64_gnu 0.52.5",
+ "windows_x86_64_gnullvm 0.52.5",
+ "windows_x86_64_msvc 0.52.5",
 ]
 
 [[package]]
@@ -3037,9 +3038,9 @@ checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
+checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
 
 [[package]]
 name = "windows_aarch64_msvc"
@@ -3049,9 +3050,9 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
+checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
 
 [[package]]
 name = "windows_i686_gnu"
@@ -3061,9 +3062,15 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.4"
+version = "0.52.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
+checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
 
 [[package]]
 name = "windows_i686_msvc"
@@ -3073,9 +3080,9 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
+checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
 
 [[package]]
 name = "windows_x86_64_gnu"
@@ -3085,9 +3092,9 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
+checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -3097,9 +3104,9 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
+checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
 
 [[package]]
 name = "windows_x86_64_msvc"
@@ -3109,9 +3116,9 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.4"
+version = "0.52.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"
+checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
 
 [[package]]
 name = "winreg"
diff --git a/pkgs/by-name/rq/rqbit/package.nix b/pkgs/by-name/rq/rqbit/package.nix
index 6ce43d31dbdbf..a33a69718f0d1 100644
--- a/pkgs/by-name/rq/rqbit/package.nix
+++ b/pkgs/by-name/rq/rqbit/package.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rqbit";
-  version = "5.6.0";
+  version = "5.6.1";
 
   src = fetchFromGitHub {
     owner = "ikatson";
     repo = "rqbit";
     rev = "v${version}";
-    hash = "sha256-KpwKSbj9B/O/RBO1PLkcYguZiuxrGcYyX3Wt4sQhe2o=";
+    hash = "sha256-SRom/rLyF7R+ESWsAKeLLujvuj5w7+Evlsm+8BKe2f0=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/ti/tinymist/Cargo.lock b/pkgs/by-name/ti/tinymist/Cargo.lock
index 8880b3dbab131..9d42baf5a617f 100644
--- a/pkgs/by-name/ti/tinymist/Cargo.lock
+++ b/pkgs/by-name/ti/tinymist/Cargo.lock
@@ -625,7 +625,7 @@ version = "0.15.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0e1f83fc076bd6dd27517eacdf25fef6c4dfe5f1d7448bafaaf3a26f13b5e4eb"
 dependencies = [
- "encode_unicode",
+ "encode_unicode 0.3.6",
  "lazy_static",
  "libc",
  "windows-sys 0.52.0",
@@ -926,6 +926,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "dirs-next"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b98cf8ebf19c3d1b223e151f99a4f9f0690dca41414773390fc824184ac833e1"
+dependencies = [
+ "cfg-if",
+ "dirs-sys-next",
+]
+
+[[package]]
 name = "dirs-sys"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -938,6 +948,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "dirs-sys-next"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ebda144c4fe02d1f7ea1a7d9641b6fc6b580adcfa024ae48797ecdeb6825b4d"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
 name = "displaydoc"
 version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1015,6 +1036,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
 
 [[package]]
+name = "encode_unicode"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
+
+[[package]]
 name = "encoding_rs"
 version = "0.8.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1910,6 +1937,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "is-terminal"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f23ff5ef2b80d608d61efee834934d862cd92461afc0560dedf493e4c033738b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
 name = "is-wsl"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2634,6 +2672,20 @@ dependencies = [
 ]
 
 [[package]]
+name = "prettytable-rs"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eea25e07510aa6ab6547308ebe3c036016d162b8da920dbb079e3ba8acf3d95a"
+dependencies = [
+ "csv",
+ "encode_unicode 1.0.0",
+ "is-terminal",
+ "lazy_static",
+ "term",
+ "unicode-width",
+]
+
+[[package]]
 name = "proc-macro2"
 version = "1.0.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2962,6 +3014,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3cd14fd5e3b777a7422cca79358c57a8f6e3a703d9ac187448d0daf220c2407f"
 
 [[package]]
+name = "rust_iso3166"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e676677b94480848a8d88c74553bad50aed2ee77d8c0985aa50d8c4e26f3054b"
+dependencies = [
+ "js-sys",
+ "phf",
+ "prettytable-rs",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "rust_iso639"
+version = "0.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a079fa995fd99d42d7244f325b6737677852036ce2efe5244227d2c75ff4bd73"
+dependencies = [
+ "phf",
+ "prettytable-rs",
+ "wasm-bindgen",
+]
+
+[[package]]
 name = "rustc-demangle"
 version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3575,6 +3650,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "term"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c59df8ac95d96ff9bede18eb7300b0fda5e5d8d90960e76f8e14ae765eedbf1f"
+dependencies = [
+ "dirs-next",
+ "rustversion",
+ "winapi",
+]
+
+[[package]]
 name = "termcolor"
 version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3595,7 +3681,7 @@ dependencies = [
 
 [[package]]
 name = "tests"
-version = "0.11.4"
+version = "0.11.5"
 dependencies = [
  "insta",
  "lsp-server",
@@ -3692,7 +3778,7 @@ dependencies = [
 
 [[package]]
 name = "tinymist"
-version = "0.11.4"
+version = "0.11.5"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3743,7 +3829,7 @@ dependencies = [
 
 [[package]]
 name = "tinymist-query"
-version = "0.11.4"
+version = "0.11.5"
 dependencies = [
  "anyhow",
  "comemo 0.4.0",
@@ -3764,6 +3850,8 @@ dependencies = [
  "percent-encoding",
  "reflexo",
  "regex",
+ "rust_iso3166",
+ "rust_iso639",
  "serde",
  "serde_json",
  "sha2",
@@ -3779,7 +3867,7 @@ dependencies = [
 
 [[package]]
 name = "tinymist-render"
-version = "0.11.4"
+version = "0.11.5"
 dependencies = [
  "base64 0.22.0",
  "log",
@@ -4370,9 +4458,9 @@ dependencies = [
 
 [[package]]
 name = "typstyle"
-version = "0.11.13"
+version = "0.11.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38f04e5495bff9deed2a9155dca07889ec0fe1c79f48eb2d9ea99fc272459499"
+checksum = "f701eb3c275c8250b3e5e18c3c081e36861cdd5b2e78538ff4984735cbfd9591"
 dependencies = [
  "anyhow",
  "clap",
diff --git a/pkgs/by-name/ti/tinymist/package.nix b/pkgs/by-name/ti/tinymist/package.nix
index 371e4d6f2118c..cc0d0c6451f2b 100644
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -13,13 +13,13 @@ rustPlatform.buildRustPackage rec {
   pname = "tinymist";
   # Please update the corresponding vscode extension when updating
   # this derivation.
-  version = "0.11.4";
+  version = "0.11.5";
 
   src = fetchFromGitHub {
     owner = "Myriad-Dreamin";
     repo = "tinymist";
     rev = "v${version}";
-    hash = "sha256-zMwyM4Y+nn/u/UXGlOxGB/JApgmYQW4qAek40uJO0Fc=";
+    hash = "sha256-VwyuK0Ct0ifx1R5tqeucqQNrkzqzhgxPqYeuETr8SkY=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/tw/twitch-dl/package.nix b/pkgs/by-name/tw/twitch-dl/package.nix
index 29340a7f06c66..c88047d8ccff8 100644
--- a/pkgs/by-name/tw/twitch-dl/package.nix
+++ b/pkgs/by-name/tw/twitch-dl/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "twitch-dl";
-  version = "2.2.0";
+  version = "2.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ihabunek";
     repo = "twitch-dl";
     rev = "refs/tags/${version}";
-    hash = "sha256-H2SxZgEjVdj/GRguJ2v/WWUrh0VTrwFV9mZVn/EYyPg=";
+    hash = "sha256-Os27uqH3MA3v9+8WzfL5KIEUewAzf8JUyRtsWSzw81o=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/xe/xeve/package.nix b/pkgs/by-name/xe/xeve/package.nix
index 5132656e58c25..efcc31e3905bc 100644
--- a/pkgs/by-name/xe/xeve/package.nix
+++ b/pkgs/by-name/xe/xeve/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xeve";
-  version = "0.4.3";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "mpeg5";
     repo = "xeve";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8YueEx2oIh24jV38bzpDlCVHNZB7HDOXeP5MANM8zBc=";
+    hash = "sha256-8jXntm/yFme9ZPImdW54jAr11hEsU1K+N5/7RLmITPs=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ya/yazi-unwrapped/package.nix b/pkgs/by-name/ya/yazi-unwrapped/package.nix
index 12350c6123411..d0a0d77ecfec6 100644
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yazi";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "sxyazi";
     repo = "yazi";
     rev = "v${version}";
-    hash = "sha256-c8fWWCOVBqQVdQch9BniCaJPrVEOCv35lLH8/hMIbvE=";
+    hash = "sha256-RwkgJX4naD3t97ce4Zg/VWJ41QiVFFqDW5nHpyMtISY=";
   };
 
-  cargoHash = "sha256-VeDyO+KCD3Axse4iPIoRxIvoAn3L33e2ObBZFV/REeg=";
+  cargoHash = "sha256-qnbinuTuaPiD7ib3aCJzSwuA4s3naFzi+txqX7jkHIo=";
 
   env.YAZI_GEN_COMPLETIONS = true;
 
diff --git a/pkgs/data/icons/numix-icon-theme-square/default.nix b/pkgs/data/icons/numix-icon-theme-square/default.nix
index 7641a9a7ba7c6..4b4c5305ffa92 100644
--- a/pkgs/data/icons/numix-icon-theme-square/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-square/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-square";
-  version = "24.04.16";
+  version = "24.04.22";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-PYsGP0Snn9A5cJ5CG+RyjC+TJwAqJOFQdnYIUkugnq0=";
+    sha256 = "sha256-Co6tMvYFl0v4pZSGtamlIb6g6koAUyC0xyxcQig62J4=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/data/icons/tela-icon-theme/default.nix b/pkgs/data/icons/tela-icon-theme/default.nix
index f77ab73032c3c..d49e77fd0d2e5 100644
--- a/pkgs/data/icons/tela-icon-theme/default.nix
+++ b/pkgs/data/icons/tela-icon-theme/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "tela-icon-theme";
-  version = "2023-06-25";
+  version = "2024-04-19";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = "tela-icon-theme";
     rev = version;
-    hash = "sha256-tv0C4mW2A3dScUXBWa7a3lkG4lPIjZTsj5b1/oEVuiw=";
+    hash = "sha256-Z1U0KJMnNNXL5fn3kPoZ2RZNi95T27/tnWVgR8kTj1o=";
   };
 
   nativeBuildInputs = [ gtk3 jdupes ];
diff --git a/pkgs/development/libraries/ctranslate2/default.nix b/pkgs/development/libraries/ctranslate2/default.nix
index dbd213f8a3f07..369630c81243a 100644
--- a/pkgs/development/libraries/ctranslate2/default.nix
+++ b/pkgs/development/libraries/ctranslate2/default.nix
@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ctranslate2";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "OpenNMT";
     repo = "CTranslate2";
     rev = "v${version}";
-    hash = "sha256-P/aXrzaCF6Rz99Pz9CkpR/FlWXCj04q/4swiAddcwKk=";
+    hash = "sha256-Bg25HL7BDM+SHtM0m7mJ3mAdpFe4kefdiDx5Ek1pQBs=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/openexr/disable-iex-test.patch b/pkgs/development/libraries/openexr/disable-iex-test.patch
index f8fff65aceb4a..f1ceb13d3a017 100644
--- a/pkgs/development/libraries/openexr/disable-iex-test.patch
+++ b/pkgs/development/libraries/openexr/disable-iex-test.patch
@@ -1,13 +1,13 @@
 diff --git a/src/test/CMakeLists.txt b/src/test/CMakeLists.txt
-index 44d9185d..8ffcd2b2 100644
+index 25f429da..918f56e9 100644
 --- a/src/test/CMakeLists.txt
 +++ b/src/test/CMakeLists.txt
-@@ -4,7 +4,7 @@
- # We require this to get object library link library support and
+@@ -5,7 +5,7 @@
  # combined python 2 + 3 support
  
--add_subdirectory(IexTest)
-+#add_subdirectory(IexTest)
- add_subdirectory(OpenEXRCoreTest)
- add_subdirectory(OpenEXRTest)
- add_subdirectory(OpenEXRUtilTest)
+ if (OPENEXR_TEST_LIBRARIES)
+-  add_subdirectory(IexTest)
++  #add_subdirectory(IexTest)
+   add_subdirectory(OpenEXRCoreTest)
+   add_subdirectory(OpenEXRTest)
+   add_subdirectory(OpenEXRUtilTest)
diff --git a/pkgs/development/python-modules/faster-whisper/default.nix b/pkgs/development/python-modules/faster-whisper/default.nix
index 847afc47a3523..2fe0b785cea6e 100644
--- a/pkgs/development/python-modules/faster-whisper/default.nix
+++ b/pkgs/development/python-modules/faster-whisper/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, pythonRelaxDepsHook
 
 # build-system
 , setuptools
@@ -30,6 +31,11 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "tokenizers"
   ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/llama-index-program-openai/default.nix b/pkgs/development/python-modules/llama-index-program-openai/default.nix
index 70640d4a4bbe1..4f8ca5ae68c99 100644
--- a/pkgs/development/python-modules/llama-index-program-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-program-openai/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-program-openai";
-  version = "0.1.5";
+  version = "0.1.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_program_openai";
     inherit version;
-    hash = "sha256-wzqi0odq0P8fmip1XU59SRckCEfQF057LQuEdEmbtwA=";
+    hash = "sha256-xqSYDF6oJgiLKLTe4zZ+2yAiHm0F6w4FAZBJGQEx13I=";
   };
 
   pythonRelaxDeps = [
@@ -28,6 +28,9 @@ buildPythonPackage rec {
 
   build-system = [
     poetry-core
+  ];
+
+  nativeBuildInputs = [
     pythonRelaxDepsHook
   ];
 
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index 179ecd1a312e4..9fc4de88fb9f2 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "3.4.1";
+  version = "3.5.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "oelint_parser";
-    hash = "sha256-AZkbLTMWSUfrbgXZzvKy+maNaB7AwLPoh3Q8QT4Zq5U=";
+    hash = "sha256-MvLHi0/tMkWBARyIVm/cuMbS2euK37xvQUbkmOrUyVU=";
   };
 
   buildInputs = [ pip ];
diff --git a/pkgs/development/python-modules/omegaconf/default.nix b/pkgs/development/python-modules/omegaconf/default.nix
index 8ee54d3c6925e..445d15f439401 100644
--- a/pkgs/development/python-modules/omegaconf/default.nix
+++ b/pkgs/development/python-modules/omegaconf/default.nix
@@ -18,11 +18,12 @@ buildPythonPackage rec {
   pname = "omegaconf";
   version = "2.3.0";
   pyproject = true;
+
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "omry";
-    repo = pname;
+    repo = "omegaconf";
     rev = "refs/tags/v${version}";
     hash = "sha256-Qxa4uIiX5TAyQ5rFkizdev60S4iVAJ08ES6FpNqf8zI=";
   };
@@ -45,12 +46,15 @@ buildPythonPackage rec {
     sed -i 's/antlr4-python3-runtime==.*/antlr4-python3-runtime/' requirements/base.txt
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
+  ];
+
+  nativeBuildInputs = [
     jre_minimal
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     antlr4-python3-runtime
     pyyaml
   ];
@@ -71,6 +75,10 @@ buildPythonPackage rec {
     "ignore::DeprecationWarning"
   ];
 
+  disabledTests = [
+    "test_eq"
+  ];
+
   meta = with lib; {
     description = "Framework for configuring complex applications";
     homepage = "https://github.com/omry/omegaconf";
diff --git a/pkgs/development/python-modules/pipe/default.nix b/pkgs/development/python-modules/pipe/default.nix
new file mode 100644
index 0000000000000..b59ea62f924f6
--- /dev/null
+++ b/pkgs/development/python-modules/pipe/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "pipe";
+  version = "2.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "JulienPalard";
+    repo = "Pipe";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-/xMhh70g2KPOOivTjpAuyfu+Z44tBE5zAwpSIEKhK6M=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "pipe" ];
+
+  disabledTests = [
+    # Test require network access
+    "test_netcat"
+  ];
+
+  meta = with lib; {
+    description = "Module to use infix notation";
+    homepage = "https://github.com/JulienPalard/Pipe";
+    changelog = "https://github.com/JulienPalard/Pipe/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pure-protobuf/default.nix b/pkgs/development/python-modules/pure-protobuf/default.nix
index ed413f8d8c951..e68746ddd8dbb 100644
--- a/pkgs/development/python-modules/pure-protobuf/default.nix
+++ b/pkgs/development/python-modules/pure-protobuf/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pure-protobuf";
-  version = "3.0.1";
+  version = "3.1.0";
 
   format = "pyproject";
   # < 3.10 requires get-annotations which isn't packaged yet
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "eigenein";
     repo = "protobuf";
     rev = "refs/tags/${version}";
-    hash = "sha256-sGKnta+agrpJkQB0twFkqRreD5WB2O/06g75N0ic4mc=";
+    hash = "sha256-JXC68iEX5VepIe4qpugvY0Qb3JlM5mPGHnUVWvb1TDA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyathena/default.nix b/pkgs/development/python-modules/pyathena/default.nix
index 3acb1f67f09fb..00c4fd2bd8740 100644
--- a/pkgs/development/python-modules/pyathena/default.nix
+++ b/pkgs/development/python-modules/pyathena/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pyathena";
-  version = "3.6.0";
+  version = "3.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2jf7mw/cTS5xW3GLZYk60uULUIIlk01on4942Ow2rwY=";
+    hash = "sha256-PqIrXLsdi4jAE7K5WUFuTdRPs29GLUefNQlU6hzrLWI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pydevd/default.nix b/pkgs/development/python-modules/pydevd/default.nix
index 25ca54297f25c..f603e9accfd09 100644
--- a/pkgs/development/python-modules/pydevd/default.nix
+++ b/pkgs/development/python-modules/pydevd/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pydevd";
-  version = "2.10.0";
+  version = "3.0.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,15 +23,15 @@ buildPythonPackage rec {
     owner = "fabioz";
     repo = "PyDev.Debugger";
     rev = "pydev_debugger_${lib.replaceStrings ["."] ["_"] version}";
-    hash = "sha256-1tWiPj30x/ZXIBu2qzUCpyF1bLsJ0wW1QaxklD3h3A8=";
+    hash = "sha256-aylmLN7lVUza2lt2K48rJsx3XatXPgPjcmPZ05raLX0=";
   };
 
-  nativeBuildInputs = [
+  __darwinAllowLocalNetworking = true;
+
+  build-system = [
     setuptools
   ];
 
-  __darwinAllowLocalNetworking = true;
-
   nativeCheckInputs = [
     numpy
     psutil
@@ -55,8 +55,11 @@ buildPythonPackage rec {
     # https://github.com/fabioz/PyDev.Debugger/issues/227
     "test_to_server_and_to_client"
     # AssertionError pydevd_tracing.set_trace_to_threads(tracing_func) == 0
-    "test_tracing_other_threads"
+    "test_step_next_step_in_multi_threads"
     "test_tracing_basic"
+    "test_tracing_other_threads"
+    # subprocess.CalledProcessError
+    "test_find_main_thread_id"
   ] ++ lib.optionals (pythonAtLeast "3.12") [
     "test_case_handled_and_unhandled_exception_generator"
     "test_case_stop_async_iteration_exception"
@@ -73,9 +76,9 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "PyDev.Debugger (used in PyDev, PyCharm and VSCode Python)";
-    mainProgram = "pydevd";
     homepage = "https://github.com/fabioz/PyDev.Debugger";
     license = licenses.epl10;
     maintainers = with maintainers; [ onny ];
+    mainProgram = "pydevd";
   };
 }
diff --git a/pkgs/development/python-modules/stone/default.nix b/pkgs/development/python-modules/stone/default.nix
index 888c98cd6279d..a2053f60aeeb8 100644
--- a/pkgs/development/python-modules/stone/default.nix
+++ b/pkgs/development/python-modules/stone/default.nix
@@ -1,36 +1,39 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, mock
-, ply
-, pytestCheckHook
-, six
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  mock,
+  ply,
+  pytestCheckHook,
+  pythonAtLeast,
+  pythonOlder,
+  setuptools,
+  six,
 }:
 
 buildPythonPackage rec {
   pname = "stone";
-  version = "3.3.1";
-  format = "setuptools";
+  version = "3.3.3";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  # distutils removal, https://github.com/dropbox/stone/issues/323
+  disabled = pythonOlder "3.7" || pythonAtLeast "3.12";
 
   src = fetchFromGitHub {
     owner = "dropbox";
-    repo = pname;
+    repo = "stone";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0FWdYbv+paVU3Wj6g9OrSNUB0pH8fLwTkhVIBPeFB/U=";
+    hash = "sha256-l86j2fd6x57bKt/TFGiyg+ZFjZFFCo43rE48MoPvXWc=";
   };
 
   postPatch = ''
-    # https://github.com/dropbox/stone/issues/288
-    substituteInPlace stone/frontend/ir_generator.py \
-      --replace "inspect.getargspec" "inspect.getfullargspec"
     substituteInPlace setup.py \
-      --replace "'pytest-runner == 5.2.0'," ""
+      --replace-fail "'pytest-runner == 5.3.2'," ""
   '';
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     ply
     six
   ];
@@ -40,20 +43,14 @@ buildPythonPackage rec {
     mock
   ];
 
-  disabledTests = [
-    "test_type_name_with_module"
-  ];
-
-  pythonImportsCheck = [
-    "stone"
-  ];
+  pythonImportsCheck = [ "stone" ];
 
   meta = with lib; {
     description = "Official Api Spec Language for Dropbox";
-    mainProgram = "stone";
     homepage = "https://github.com/dropbox/stone";
     changelog = "https://github.com/dropbox/stone/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
+    mainProgram = "stone";
   };
 }
diff --git a/pkgs/development/rocm-modules/5/clr/default.nix b/pkgs/development/rocm-modules/5/clr/default.nix
index 3fcd551cd423f..0c702dace2b81 100644
--- a/pkgs/development/rocm-modules/5/clr/default.nix
+++ b/pkgs/development/rocm-modules/5/clr/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , callPackage
 , fetchFromGitHub
+, fetchurl
 , rocmUpdateScript
 , makeWrapper
 , cmake
@@ -33,6 +34,16 @@ let
     "--set HSA_PATH ${rocm-runtime}"
     "--set ROCM_PATH $out"
   ];
+
+  # https://github.com/NixOS/nixpkgs/issues/305641
+  # Not needed when 3.29.2 is in unstable
+  cmake' = cmake.overrideAttrs(old: rec {
+    version = "3.29.2";
+    src = fetchurl {
+      url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
+      hash = "sha256-NttLaSaqt0G6bksuotmckZMiITIwi03IJNQSPLcwNS4=";
+    };
+  });
 in stdenv.mkDerivation (finalAttrs: {
   pname = "clr";
   version = "5.7.1";
@@ -51,7 +62,7 @@ in stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     makeWrapper
-    cmake
+    cmake'
     perl
     python3Packages.python
     python3Packages.cppheaderparser
diff --git a/pkgs/development/rocm-modules/6/clr/default.nix b/pkgs/development/rocm-modules/6/clr/default.nix
index 05acf86478d38..c5a3f641ff41a 100644
--- a/pkgs/development/rocm-modules/6/clr/default.nix
+++ b/pkgs/development/rocm-modules/6/clr/default.nix
@@ -3,6 +3,7 @@
 , callPackage
 , fetchFromGitHub
 , fetchpatch
+, fetchurl
 , rocmUpdateScript
 , makeWrapper
 , cmake
@@ -34,6 +35,16 @@ let
     "--set HSA_PATH ${rocm-runtime}"
     "--set ROCM_PATH $out"
   ];
+
+  # https://github.com/NixOS/nixpkgs/issues/305641
+  # Not needed when 3.29.2 is in unstable
+  cmake' = cmake.overrideAttrs(old: rec {
+    version = "3.29.2";
+    src = fetchurl {
+      url = "https://cmake.org/files/v${lib.versions.majorMinor version}/cmake-${version}.tar.gz";
+      hash = "sha256-NttLaSaqt0G6bksuotmckZMiITIwi03IJNQSPLcwNS4=";
+    };
+  });
 in stdenv.mkDerivation (finalAttrs: {
   pname = "clr";
   version = "6.0.2";
@@ -52,7 +63,7 @@ in stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     makeWrapper
-    cmake
+    cmake'
     perl
     python3Packages.python
     python3Packages.cppheaderparser
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index c9ce9386a8446..603c0865419ce 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.30.1";
+  version = "1.31.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-1He9Vei2OXiBszZvATk1ALGWAneC4yucPohp/O6gsTo=";
+    hash = "sha256-CNt7ZfUMRQNNVusaBgEW64WH1TFYz8yEBfKksGVRVUM=";
   };
 
-  vendorHash = "sha256-OXzEcpEYnYndYHRhKm2oYsm463ZWeujOvQpIj0zz7+g=";
+  vendorHash = "sha256-kagSvwxVE+URRY2C5tRtdRwtHBIdQh3BWUG1b3+L8Os=";
 
   patches = [
     # Skip a test that requires networking to be available to work,
diff --git a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
index be2f7f75229ad..a86db85067f6a 100644
--- a/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
+++ b/pkgs/development/tools/continuous-integration/cirrus-cli/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "cirrus-cli";
-  version = "0.116.0";
+  version = "0.117.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cij6Yw8UEPDHsm9Oy809PWxfPpbCGXUFRALKFH80pqM=";
+    sha256 = "sha256-dJq2/XxhSvqlRQwMHX2RHct6KQu9uik3SPeWD2/rwto=";
   };
 
-  vendorHash = "sha256-tkKxg08uL1vlOyD/tpRLzjHpOVWOmYZxcq8B+Q7/3Zo=";
+  vendorHash = "sha256-d3cHXO4SFeNybiVDc3dUmd1XzUJ1SlMqSw7KPC3ZrXQ=";
 
   ldflags = [
     "-X github.com/cirruslabs/cirrus-cli/internal/version.Version=v${version}"
diff --git a/pkgs/development/tools/go-mockery/default.nix b/pkgs/development/tools/go-mockery/default.nix
index 770f4b5db181f..ec3b23b86098e 100644
--- a/pkgs/development/tools/go-mockery/default.nix
+++ b/pkgs/development/tools/go-mockery/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-mockery";
-  version = "2.42.2";
+  version = "2.42.3";
 
   src = fetchFromGitHub {
     owner = "vektra";
     repo = "mockery";
     rev = "v${version}";
-    sha256 = "sha256-y0HMoQvv001smvWlK1qN0bYeHgNDLz1uKQCaRmDnoM4=";
+    sha256 = "sha256-8DbUbgzTNcQiCXZFuRPkLiW4PyQLHDo4sN04l1I5rMI=";
   };
 
   preCheck = ''
diff --git a/pkgs/development/tools/language-servers/lua-language-server/default.nix b/pkgs/development/tools/language-servers/lua-language-server/default.nix
index 7491968b1b5a9..f63cacb910e3c 100644
--- a/pkgs/development/tools/language-servers/lua-language-server/default.nix
+++ b/pkgs/development/tools/language-servers/lua-language-server/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lua-language-server";
-  version = "3.7.4";
+  version = "3.8.3";
 
   src = fetchFromGitHub {
     owner = "luals";
     repo = "lua-language-server";
     rev = finalAttrs.version;
-    hash = "sha256-wJOOzKM2pgxfRqx5WZjOcCyRapz0Sub3AYm51LRYpFU=";
+    hash = "sha256-Zl57KmsAuyMWbcKnU19m7ljox/LqWsa6gXbjaWiznfg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/tools/micronaut/default.nix b/pkgs/development/tools/micronaut/default.nix
index 99f51272c573b..0b1711283dbd3 100644
--- a/pkgs/development/tools/micronaut/default.nix
+++ b/pkgs/development/tools/micronaut/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "micronaut";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchzip {
     url = "https://github.com/micronaut-projects/micronaut-starter/releases/download/v${version}/micronaut-cli-${version}.zip";
-    sha256 = "sha256-hoy7hvabXvrU/ZcW9dRJnO1l4fnOIFpbgvAZ+CBnSbA=";
+    sha256 = "sha256-tXXGjpf6nwx9yW9vBSi7iKlDJE+IeItcl+JE4drA7OM=";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index 56b07f8aee0f4..cd73494140da1 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "19.21.0";
+  version = "19.24.2";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Vhqk7U4FKl9r7WMX/FJ/4LEtuTUsZquM98A+nQRFqMQ=";
+    hash = "sha256-xr6ULlOBmRF1s/oge+AnANLGkP30U6T1tgoBvnCLf/4=";
   };
 
-  vendorHash = "sha256-rcw9HgN677NxrMZDrpNFLHNyHdlRXvgxCtQnLt0TRLw=";
+  vendorHash = "sha256-iSbQn86b1xZwlyo5nKYI7LEH5AyWCw7MLgD3Q0mtFfk=";
 
   sourceRoot = "${src.name}/src";
 
diff --git a/pkgs/os-specific/darwin/raycast/default.nix b/pkgs/os-specific/darwin/raycast/default.nix
index 9671b5885c828..b6626c4d4eade 100644
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@@ -10,12 +10,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.71.3";
+  version = "1.72.0";
 
   src = fetchurl {
     name = "Raycast.dmg";
     url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-jiGo4H38qAiGMh4ckswyeDcijYL2wbcjs+IubDFjobU=";
+    hash = "sha256-L6CXWRmBfit+uWODEWt7u71shFAadPOqtNifMnSp0BU=";
   };
 
   dontPatch = true;
diff --git a/pkgs/os-specific/linux/drbd/driver.nix b/pkgs/os-specific/linux/drbd/driver.nix
index efc771905e53a..d025fd5e229a7 100644
--- a/pkgs/os-specific/linux/drbd/driver.nix
+++ b/pkgs/os-specific/linux/drbd/driver.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "drbd-${version}-${kernel.version}";
-  version = "9.2.7";
+  version = "9.2.8";
 
   src = fetchurl {
     url = "https://pkg.linbit.com//downloads/drbd/9/drbd-${version}.tar.gz";
-    sha256 = "1355ns10z0fjgqsdpf09qfy01j8lg2n7zy4kclmar3s798n3mh56";
+    hash = "sha256-LqK1lPucab7wKvcB4VKGdvBIq+K9XtuO2m0DP5XtK3M=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -41,6 +41,12 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace 'SHELL=/bin/bash' 'SHELL=${builtins.getEnv "SHELL"}'
   '';
 
+  postFixup = ''
+    for ko in $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd/*.ko; do
+      xz --compress -6 --threads=0 $ko
+    done
+  '';
+
   enableParallelBuilding = true;
 
   meta = with lib; {
@@ -53,5 +59,6 @@ stdenv.mkDerivation rec {
        DRBD is a software-based, shared-nothing, replicated storage solution
        mirroring the content of block devices (hard disks, partitions, logical volumes, and so on) between hosts.
     '';
+    broken = lib.versionAtLeast kernel.version "6.8"; # wait until next DRBD release for 6.8 support https://github.com/LINBIT/drbd/issues/87#issuecomment-2059323084
   };
 }
diff --git a/pkgs/os-specific/linux/nct6687d/default.nix b/pkgs/os-specific/linux/nct6687d/default.nix
index 493d0e6af101d..35e77c7922dfd 100644
--- a/pkgs/os-specific/linux/nct6687d/default.nix
+++ b/pkgs/os-specific/linux/nct6687d/default.nix
@@ -2,17 +2,18 @@
 , stdenv
 , fetchFromGitHub
 , kernel
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "nct6687d";
-  version = "unstable-2023-09-22";
+  version = "0-unstable-2024-02-23";
 
   src = fetchFromGitHub {
     owner = "Fred78290";
     repo = "nct6687d";
-    rev = "cdfe855342a9383a9c4c918d51576c36d989070d";
-    hash = "sha256-iOLWxj4I6oYkNXFSkmw7meTQEnrIfb4Mw+/LkzgzDxM=";
+    rev = "0ee35ed9541bde22fe219305d1647b51ed010c5e";
+    hash = "sha256-g81U+ngnsOslBDCQP51uDDyHPpCv9T/j+KmFUAQfz/M=";
   };
 
   setSourceRoot = ''
@@ -30,6 +31,10 @@ stdenv.mkDerivation rec {
   installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
   installTargets = [ "modules_install" ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch=main" ];
+  };
+
   meta = with lib; {
     description = "Kernel module for the Nuvoton NCT6687-R chipset found on many B550/B650 motherboards from ASUS and MSI";
     license = with licenses; [ gpl2Only ];
diff --git a/pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch b/pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch
index fc10f59992334..8d7d63445c062 100644
--- a/pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch
+++ b/pkgs/servers/http/envoy/0001-nixpkgs-use-system-Python.patch
@@ -1,21 +1,22 @@
-From 4a9739da420b9584d5b9582c19cf3f86a6a90609 Mon Sep 17 00:00:00 2001
-From: Luke Granger-Brown <git@lukegb.com>
-Date: Fri, 12 May 2023 08:12:04 +0100
-Subject: [PATCH 1/3] nixpkgs: use system Python
+From 418d38868d63c0009460e1a3ca004987fe26346b Mon Sep 17 00:00:00 2001
+From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
+Date: Mon, 22 Apr 2024 11:52:59 +0200
+Subject: [PATCH 1/4] nixpkgs: use system Python
 
+Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 ---
  bazel/python_dependencies.bzl | 11 ++++-------
- bazel/repositories_extra.bzl  | 16 ----------------
- 2 files changed, 4 insertions(+), 23 deletions(-)
+ bazel/repositories_extra.bzl  | 17 +----------------
+ 2 files changed, 5 insertions(+), 23 deletions(-)
 
 diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl
-index ea50bf30ba..b82f374720 100644
+index b747fd0b9a..b82f374720 100644
 --- a/bazel/python_dependencies.bzl
 +++ b/bazel/python_dependencies.bzl
 @@ -1,27 +1,24 @@
- load("@rules_python//python:pip.bzl", "pip_parse")
--load("@python3_11//:defs.bzl", "interpreter")
 -load("@envoy_toolshed//:packages.bzl", "load_packages")
+-load("@python3_11//:defs.bzl", "interpreter")
+ load("@rules_python//python:pip.bzl", "pip_parse")
  
  def envoy_python_dependencies():
 -    # TODO(phlax): rename base_pip3 -> pip3 and remove this
@@ -45,15 +46,16 @@ index ea50bf30ba..b82f374720 100644
          extra_pip_args = ["--require-hashes"],
      )
 diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl
-index 40d348073f..17b98b1ea1 100644
+index a5bc2d5277..001de36a16 100644
 --- a/bazel/repositories_extra.bzl
 +++ b/bazel/repositories_extra.bzl
-@@ -1,29 +1,13 @@
+@@ -2,19 +2,11 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
+ load("@com_github_rules_proto_grpc//:repositories.bzl", "rules_proto_grpc_toolchains")
  load("@emsdk//:deps.bzl", emsdk_deps = "deps")
--load("@rules_python//python:repositories.bzl", "python_register_toolchains")
  load("@proxy_wasm_cpp_host//bazel/cargo/wasmtime:crates.bzl", "wasmtime_fetch_remote_crates")
+-load("@rules_python//python:repositories.bzl", "py_repositories", "python_register_toolchains")
++load("@rules_python//python:repositories.bzl", "py_repositories")
  load("//bazel/external/cargo:crates.bzl", "raze_fetch_remote_crates")
- load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
  
 -def _python_minor_version(python_version):
 -    return "_".join(python_version.split(".")[:-1])
@@ -68,7 +70,9 @@ index 40d348073f..17b98b1ea1 100644
          ignore_root_user_error = False):
      emsdk_deps()
      raze_fetch_remote_crates()
-     wasmtime_fetch_remote_crates()
+@@ -22,11 +14,4 @@ def envoy_dependencies_extra(
+     rules_proto_grpc_toolchains()
+     py_repositories()
  
 -    # Registers underscored Python minor version - eg `python3_10`
 -    python_register_toolchains(
@@ -79,5 +83,5 @@ index 40d348073f..17b98b1ea1 100644
 -
      aspect_bazel_lib_dependencies()
 -- 
-2.42.0
+2.44.0
 
diff --git a/pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch b/pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch
index 494b1e4e72622..b58bbdedf51ab 100644
--- a/pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch
+++ b/pkgs/servers/http/envoy/0002-nixpkgs-use-system-Go.patch
@@ -1,69 +1,32 @@
-From 10e577a3c300f76ead5a5512f2fe970f12e46592 Mon Sep 17 00:00:00 2001
-From: Luke Granger-Brown <git@lukegb.com>
-Date: Fri, 12 May 2023 08:13:21 +0100
-Subject: [PATCH 2/3] nixpkgs: use system Go
+From 0ecb8b5bc194fecb10c523d5856dc0b4cb78f6e4 Mon Sep 17 00:00:00 2001
+From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
+Date: Mon, 22 Apr 2024 11:58:00 +0200
+Subject: [PATCH 2/4] nixpkgs: use system Go
 
+Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 ---
- bazel/dependency_imports.bzl | 29 +----------------------------
- bazel/repositories.bzl       |  3 ---
- 2 files changed, 1 insertion(+), 31 deletions(-)
+ bazel/dependency_imports.bzl | 2 +-
+ bazel/repositories.bzl       | 3 ---
+ 2 files changed, 1 insertion(+), 4 deletions(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index b743a1936d..afa04ef5c0 100644
+index 0e29abb8d0..df19c84755 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
-@@ -18,7 +18,7 @@ load("@com_google_cel_cpp//bazel:deps.bzl", "parser_deps")
- load("@com_github_chrusty_protoc_gen_jsonschema//:deps.bzl", protoc_gen_jsonschema_go_dependencies = "go_dependencies")
+@@ -19,7 +19,7 @@ load("@rules_rust//rust:repositories.bzl", "rules_rust_dependencies", "rust_regi
+ load("@upb//bazel:workspace_deps.bzl", "upb_deps")
  
  # go version for rules_go
--GO_VERSION = "1.18"
+-GO_VERSION = "1.20"
 +GO_VERSION = "host"
  
- JQ_VERSION = "1.6"
+ JQ_VERSION = "1.7"
  YQ_VERSION = "4.24.4"
-@@ -27,7 +27,6 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
-     rules_foreign_cc_dependencies()
-     go_rules_dependencies()
-     go_register_toolchains(go_version)
--    envoy_download_go_sdks(go_version)
-     gazelle_dependencies(go_sdk = "go_sdk")
-     apple_rules_dependencies()
-     pip_dependencies()
-@@ -148,29 +147,3 @@ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, y
-     )
- 
-     protoc_gen_jsonschema_go_dependencies()
--
--def envoy_download_go_sdks(go_version):
--    go_download_sdk(
--        name = "go_linux_amd64",
--        goos = "linux",
--        goarch = "amd64",
--        version = go_version,
--    )
--    go_download_sdk(
--        name = "go_linux_arm64",
--        goos = "linux",
--        goarch = "arm64",
--        version = go_version,
--    )
--    go_download_sdk(
--        name = "go_darwin_amd64",
--        goos = "darwin",
--        goarch = "amd64",
--        version = go_version,
--    )
--    go_download_sdk(
--        name = "go_darwin_arm64",
--        goos = "darwin",
--        goarch = "arm64",
--        version = go_version,
--    )
 diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
-index 71667227f7..b10a47d344 100644
+index d91aa712bd..6623972286 100644
 --- a/bazel/repositories.bzl
 +++ b/bazel/repositories.bzl
-@@ -215,9 +215,6 @@ def _go_deps(skip_targets):
+@@ -246,9 +246,6 @@ def _go_deps(skip_targets):
      if "io_bazel_rules_go" not in skip_targets:
          external_http_archive(
              name = "io_bazel_rules_go",
@@ -74,5 +37,5 @@ index 71667227f7..b10a47d344 100644
          external_http_archive("bazel_gazelle")
  
 -- 
-2.42.0
+2.44.0
 
diff --git a/pkgs/servers/http/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch b/pkgs/servers/http/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
index 5a24e7e4a90d1..1e5a792f55a88 100644
--- a/pkgs/servers/http/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
+++ b/pkgs/servers/http/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
@@ -1,29 +1,30 @@
-From 6175deb13a2df8bd25a56021ba8754e4be445219 Mon Sep 17 00:00:00 2001
-From: Luke Granger-Brown <git@lukegb.com>
-Date: Fri, 13 Oct 2023 21:42:51 +0000
-Subject: [PATCH 3/3] nixpkgs: use system C/C++ toolchains
+From d2fbc618ea040360e08b3c462bcdf0f8f44dd434 Mon Sep 17 00:00:00 2001
+From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
+Date: Mon, 22 Apr 2024 11:59:22 +0200
+Subject: [PATCH 3/4] nixpkgs: use system C/C++ toolchains
 
+Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 ---
  bazel/dependency_imports.bzl | 6 +++++-
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index afa04ef5c0..a5ffaf4ff3 100644
+index df19c84755..9732a5d646 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
-@@ -24,7 +24,11 @@ JQ_VERSION = "1.6"
+@@ -25,7 +25,11 @@ JQ_VERSION = "1.7"
  YQ_VERSION = "4.24.4"
  
  def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, yq_version = YQ_VERSION):
 -    rules_foreign_cc_dependencies()
 +    rules_foreign_cc_dependencies(
 +        register_default_tools=False,  # no prebuilt toolchains
-+	register_built_tools=False,  # nor from source
-+	register_preinstalled_tools=True,  # use host tools (default)
++	    register_built_tools=False,  # nor from source
++	    register_preinstalled_tools=True,  # use host tools (default)
 +    )
      go_rules_dependencies()
      go_register_toolchains(go_version)
-     gazelle_dependencies(go_sdk = "go_sdk")
+     if go_version != "host":
 -- 
-2.42.0
+2.44.0
 
diff --git a/pkgs/servers/http/envoy/0004-nixpkgs-add-cstdint-in-dd-trace-cpp.patch b/pkgs/servers/http/envoy/0004-nixpkgs-add-cstdint-in-dd-trace-cpp.patch
new file mode 100644
index 0000000000000..31dfe08f91b90
--- /dev/null
+++ b/pkgs/servers/http/envoy/0004-nixpkgs-add-cstdint-in-dd-trace-cpp.patch
@@ -0,0 +1,29 @@
+From dd3509a7d646a970480f94a8e09f377e9783504d Mon Sep 17 00:00:00 2001
+From: Malte Poll <1780588+malt3@users.noreply.github.com>
+Date: Mon, 22 Apr 2024 16:07:58 +0200
+Subject: [PATCH 4/4] nixpkgs: add cstdint in dd-trace-cpp
+
+---
+ bazel/repositories.bzl | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
+index d91aa712bd..467348e773 100644
+--- a/bazel/repositories.bzl
++++ b/bazel/repositories.bzl
+@@ -772,7 +772,11 @@ def _io_opentelemetry_api_cpp():
+     )
+ 
+ def _com_github_datadog_dd_trace_cpp():
+-    external_http_archive("com_github_datadog_dd_trace_cpp")
++    external_http_archive(
++    	name = "com_github_datadog_dd_trace_cpp",
++	patch_args = ["-p1"],
++	patches = ["@envoy//bazel:dd_trace_cpp.patch"],
++    )
+     native.bind(
+         name = "dd_trace_cpp",
+         actual = "@com_github_datadog_dd_trace_cpp//:dd_trace_cpp",
+-- 
+2.42.0
+
diff --git a/pkgs/servers/http/envoy/dd_trace_cpp.patch b/pkgs/servers/http/envoy/dd_trace_cpp.patch
new file mode 100644
index 0000000000000..d9873c8f1a8c9
--- /dev/null
+++ b/pkgs/servers/http/envoy/dd_trace_cpp.patch
@@ -0,0 +1,25 @@
+From 4851a6a722b228ecbfd9df255dab3d8f30bd84b9 Mon Sep 17 00:00:00 2001
+From: Malte Poll <1780588+malt3@users.noreply.github.com>
+Date: Mon, 22 Apr 2024 15:36:33 +0200
+Subject: [PATCH] nixpkgs: add cstdint to fix compilation under GCC 13
+
+https://gcc.gnu.org/gcc-13/porting_to.html#header-dep-changes
+---
+ src/datadog/parse_util.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/datadog/parse_util.h b/src/datadog/parse_util.h
+index c603286..c8e4e83 100644
+--- a/src/datadog/parse_util.h
++++ b/src/datadog/parse_util.h
+@@ -2,6 +2,7 @@
+ 
+ // This component provides parsing-related miscellanea.
+ 
++#include <cstdint>
+ #include <string>
+ #include <unordered_map>
+ #include <vector>
+-- 
+2.42.0
+
diff --git a/pkgs/servers/http/envoy/default.nix b/pkgs/servers/http/envoy/default.nix
index 7e58f50fa1c64..6125463f1bffa 100644
--- a/pkgs/servers/http/envoy/default.nix
+++ b/pkgs/servers/http/envoy/default.nix
@@ -25,15 +25,15 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.27.5";
-    rev = "be4f1cfd31c79fc05651efa2f88429b3c03d1d9e";
-    hash = "sha256-+sjNqq91YfyW83aq/8WoSo7Jl5QZUmtWtsajnLLMgDc=";
+    version = "1.30.1";
+    rev = "816188b86a0a52095b116b107f576324082c7c02";
+    hash = "sha256-G0rT+OfMk2nitTXcxMr04jwUMYTfb4VBEV1zftalgFU=";
   };
 
   # these need to be updated for any changes to fetchAttrs
   depsHash = {
-    x86_64-linux = "sha256-4XJgPfNEPmbvAZMLlQcnIaoGzaFtyhsuEshdEjLh0OY=";
-    aarch64-linux = "sha256-85HLiK+xX/tabazh97J4fWk5KYc7kynbxj/g8HCGTD4=";
+    x86_64-linux = "sha256-Pj176fQts/H+BlzsVkx+OlUF+4+GHutnNZ5f+eagMmk=";
+    aarch64-linux = "sha256-5El0WOYTLiBKhYxRXKJFv1m2M8jZlN1cYrJDnRX2wYs=";
   }.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 in
 buildBazelPackage {
@@ -57,7 +57,7 @@ buildBazelPackage {
     sed -i '/javabase=/d' .bazelrc
     sed -i '/"-Werror"/d' bazel/envoy_internal.bzl
 
-    cp ${./protobuf.patch} bazel/protobuf.patch
+    cp ${./dd_trace_cpp.patch} bazel/dd_trace_cpp.patch
   '';
 
   patches = [
@@ -70,11 +70,10 @@ buildBazelPackage {
     # use system C/C++ tools
     ./0003-nixpkgs-use-system-C-C-toolchains.patch
 
-    # bump proxy-wasm-cpp-host until > 1.27.3/1.28.0
-    (fetchpatch {
-      url = "https://github.com/envoyproxy/envoy/pull/31451.patch";
-      hash = "sha256-n8k7bho3B8Gm0dJbgf43kU7ymvo15aGJ2Twi2xR450g=";
-    })
+    # apply patch to dd-trace-cpp
+    # remove once a version of dd-trace-cpp is released and adopted by envoy
+    # that contains https://github.com/DataDog/dd-trace-cpp/commit/3a8e1e9a3cf4e87ef053e954a39dc7a967ac6965
+    ./0004-nixpkgs-add-cstdint-in-dd-trace-cpp.patch
   ];
 
   nativeBuildInputs = [
@@ -91,9 +90,6 @@ buildBazelPackage {
     linuxHeaders
   ];
 
-  # external/com_github_grpc_grpc/src/core/ext/transport/binder/transport/binder_transport.cc:756:29: error: format not a string literal and no format arguments [-Werror=format-security]
-  hardeningDisable = [ "format" ];
-
   fetchAttrs = {
     sha256 = depsHash;
     dontUseCmakeConfigure = true;
@@ -172,6 +168,14 @@ buildBazelPackage {
     "--java_runtime_version=local_jdk"
     "--tool_java_runtime_version=local_jdk"
 
+    # undefined reference to 'grpc_core::*Metadata*::*Memento*
+    #
+    # During linking of the final binary, we see undefined references to grpc_core related symbols.
+    # The missing symbols would be instantiations of a template class from https://github.com/grpc/grpc/blob/v1.59.4/src/core/lib/transport/metadata_batch.h
+    # "ParseMemento" and "MementoToValue" are only implemented for some types
+    # and appear unused and unimplemented for the undefined cases reported by the linker.
+    "--linkopt=-Wl,--unresolved-symbols=ignore-in-object-files"
+
     "--define=wasm=${wasmRuntime}"
   ] ++ (lib.optionals stdenv.isAarch64 [
     # external/com_github_google_tcmalloc/tcmalloc/internal/percpu_tcmalloc.h:611:9: error: expected ':' or '::' before '[' token
diff --git a/pkgs/servers/http/envoy/protobuf.patch b/pkgs/servers/http/envoy/protobuf.patch
deleted file mode 100644
index dc7026350316c..0000000000000
--- a/pkgs/servers/http/envoy/protobuf.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-diff --git a/BUILD.bazel b/BUILD.bazel
-index 637882c49..2cb08f1b0 100644
---- a/BUILD.bazel
-+++ b/BUILD.bazel
-@@ -165,6 +165,8 @@ alias(
-     visibility = ["//visibility:public"],
- )
- 
-+# Envoy: Patch
-+
- cc_binary(
-     name = "protoc",
-     copts = COPTS,
-@@ -173,6 +175,14 @@ cc_binary(
-     deps = ["//src/google/protobuf/compiler:protoc_lib"],
- )
- 
-+alias(
-+    name = "protobuf_python_genproto",
-+    actual = "//python:well_known_types_py_pb2_genproto",
-+    visibility = ["//visibility:public"],
-+)
-+
-+# /Envoy: Patch
-+
- cc_binary(
-     name = "protoc_static",
-     copts = COPTS,
-diff --git a/python/google/protobuf/__init__.py b/python/google/protobuf/__init__.py
-index 88de4cf8a..b3e046997 100755
---- a/python/google/protobuf/__init__.py
-+++ b/python/google/protobuf/__init__.py
-@@ -31,3 +31,10 @@
- # Copyright 2007 Google Inc. All Rights Reserved.
- 
- __version__ = '4.23.1'
-+
-+
-+if __name__ != '__main__':
-+    try:
-+        __import__('pkg_resources').declare_namespace(__name__)
-+    except ImportError:
-+        __path__ = __import__('pkgutil').extend_path(__path__, __name__)
-diff --git a/src/google/protobuf/compiler/BUILD.bazel b/src/google/protobuf/compiler/BUILD.bazel
-index a2171c806..8aec6187f 100644
---- a/src/google/protobuf/compiler/BUILD.bazel
-+++ b/src/google/protobuf/compiler/BUILD.bazel
-@@ -306,7 +306,7 @@ cc_library(
-     srcs = ["retention.cc"],
-     hdrs = ["retention.h"],
-     include_prefix = "google/protobuf/compiler",
--    visibility = ["//src/google/protobuf:__subpackages__"],
-+    visibility = ["//visibility:public"],
-     deps = [
-         "//src/google/protobuf:protobuf_nowkt",
-         "@com_google_absl//absl/types:span",
-diff --git a/src/google/protobuf/io/BUILD.bazel b/src/google/protobuf/io/BUILD.bazel
-index 8f39625c2..2c2c73dcd 100644
---- a/src/google/protobuf/io/BUILD.bazel
-+++ b/src/google/protobuf/io/BUILD.bazel
-@@ -142,7 +142,7 @@ cc_library(
-         "@com_google_absl//absl/log:absl_log",
-     ] + select({
-         "//build_defs:config_msvc": [],
--        "//conditions:default": ["@zlib//:zlib"],
-+        "//conditions:default": ["//external:zlib"],
-     }),
- )
- 
-diff --git a/src/google/protobuf/map.h b/src/google/protobuf/map.h
-index 869ebf100..fec92e2b1 100644
---- a/src/google/protobuf/map.h
-+++ b/src/google/protobuf/map.h
-@@ -883,7 +883,7 @@ class KeyMapBase : public UntypedMapBase {
-         TreeConvert(b);
-       }
-       ABSL_DCHECK(TableEntryIsTree(b))
--          << (void*)table_[b] << " " << (uintptr_t)table_[b];
-+          << reinterpret_cast<void*>(table_[b]) << " " << static_cast<uintptr_t>(table_[b]);
-       InsertUniqueInTree(b, node);
-       index_of_first_non_null_ = (std::min)(index_of_first_non_null_, b);
-     }
-diff --git a/src/google/protobuf/map_field.h b/src/google/protobuf/map_field.h
-index 70b12b1e7..b8f46db45 100644
---- a/src/google/protobuf/map_field.h
-+++ b/src/google/protobuf/map_field.h
-@@ -345,7 +345,7 @@ class PROTOBUF_EXPORT MapFieldBase : public MapFieldBaseForParse {
- 
-  protected:
-   // "protected" stops users from deleting a `MapFieldBase *`
--  ~MapFieldBase();
-+  virtual ~MapFieldBase();
- 
-  public:
-   // Returns reference to internal repeated field. Data written using
-diff --git a/src/google/protobuf/port_def.inc b/src/google/protobuf/port_def.inc
-index 1c6a24945..6186c2ad1 100644
---- a/src/google/protobuf/port_def.inc
-+++ b/src/google/protobuf/port_def.inc
-@@ -1004,7 +1004,7 @@ static_assert(PROTOBUF_ABSL_MIN(20230125, 3),
- #pragma clang diagnostic ignored "-Wshorten-64-to-32"
- // Turn on -Wdeprecated-enum-enum-conversion. This deprecation comes in C++20
- // via http://wg21.link/p1120r0.
--#pragma clang diagnostic error "-Wdeprecated-enum-enum-conversion"
-+// #pragma clang diagnostic error "-Wdeprecated-enum-enum-conversion"
- // This error has been generally flaky, but we need to disable it specifically
- // to fix https://github.com/protocolbuffers/protobuf/issues/12313
- #pragma clang diagnostic ignored "-Wunused-parameter"
-@@ -1062,6 +1062,7 @@ static_assert(PROTOBUF_ABSL_MIN(20230125, 3),
- #pragma warning(disable: 4125)
- #endif
- 
-+#pragma GCC diagnostic ignored "-Wundef"
- #if PROTOBUF_ENABLE_DEBUG_LOGGING_MAY_LEAK_PII
- #define PROTOBUF_DEBUG true
- #else
diff --git a/pkgs/servers/komga/default.nix b/pkgs/servers/komga/default.nix
index 84d1b958a57b6..bb7930213ecf2 100644
--- a/pkgs/servers/komga/default.nix
+++ b/pkgs/servers/komga/default.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "1.10.4";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/${version}/${pname}-${version}.jar";
-    sha256 = "sha256-WKiybcQH+xxBUUbuXrN2u7oIBbQBp34Y1mgJe0u7hiI=";
+    sha256 = "sha256-bqWPkD8Pzlryv5wG65cEJNLoFVsu6yCymUgyfhrQR0M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 695e91d978944..0fa14ac36471d 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -30,7 +30,7 @@ buildGoModule {
 
   CGO_ENABLED = 0;
 
-  subPackages = [ "cmd/tailscale" "cmd/tailscaled" ];
+  subPackages = [ "cmd/tailscaled" ];
 
   ldflags = [
     "-w"
@@ -39,11 +39,18 @@ buildGoModule {
     "-X tailscale.com/version.shortStamp=${version}"
   ];
 
+  tags = [
+    "ts_include_cli"
+  ];
+
   doCheck = false;
 
-  postInstall = lib.optionalString stdenv.isLinux ''
-    wrapProgram $out/bin/tailscaled --prefix PATH : ${lib.makeBinPath [ iproute2 iptables getent shadow ]}
-    wrapProgram $out/bin/tailscale --suffix PATH : ${lib.makeBinPath [ procps ]}
+  postInstall = ''
+    ln -s $out/bin/tailscaled $out/bin/tailscale
+  '' + lib.optionalString stdenv.isLinux ''
+    wrapProgram $out/bin/tailscaled \
+      --prefix PATH : ${lib.makeBinPath [ iproute2 iptables getent shadow ]} \
+      --suffix PATH : ${lib.makeBinPath [ procps ]}
 
     sed -i -e "s#/usr/sbin#$out/bin#" -e "/^EnvironmentFile/d" ./cmd/tailscaled/tailscaled.service
     install -D -m0444 -t $out/lib/systemd/system ./cmd/tailscaled/tailscaled.service
diff --git a/pkgs/servers/web-apps/jitsi-meet/default.nix b/pkgs/servers/web-apps/jitsi-meet/default.nix
index a3e0696ac01c1..e7956b6c694ac 100644
--- a/pkgs/servers/web-apps/jitsi-meet/default.nix
+++ b/pkgs/servers/web-apps/jitsi-meet/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jitsi-meet";
-  version = "1.0.7874";
+  version = "1.0.7952";
 
   src = fetchurl {
     url = "https://download.jitsi.org/jitsi-meet/src/jitsi-meet-${version}.tar.bz2";
-    sha256 = "LP37K5xuvWvSiJrRmgRuRA60N7ll2m7mYUge8jZZt/c=";
+    sha256 = "K3CBISTOza8xhF4/DmqdTZaPL9zwu4ej+yqJXBawFEk=";
   };
 
   dontBuild = true;
diff --git a/pkgs/tools/admin/granted/default.nix b/pkgs/tools/admin/granted/default.nix
index c9547e2723401..4bee94dd94ed9 100644
--- a/pkgs/tools/admin/granted/default.nix
+++ b/pkgs/tools/admin/granted/default.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "granted";
-  version = "0.23.1";
+  version = "0.23.2";
 
   src = fetchFromGitHub {
     owner = "common-fate";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-w/vsS206gKZ8PbfD2BAsYxasXWJEX72AMpmwyR/NCcU=";
+    sha256 = "sha256-DPwNKaGiq+/gaQiD6ayKm8o19RZgh+BFuLcNZ9bMWF0=";
   };
 
-  vendorHash = "sha256-F8KkBeig0TofMRdg2puFjqPXB6TnUc15enodiE57pxA=";
+  vendorHash = "sha256-XzoN8gOQTU8LMInsV6gVetUp1xlPOxedF1ksQ0V1ynY=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/tools/filesystems/tar2ext4/default.nix b/pkgs/tools/filesystems/tar2ext4/default.nix
index dd4ab499de92f..aa1abaef4796e 100644
--- a/pkgs/tools/filesystems/tar2ext4/default.nix
+++ b/pkgs/tools/filesystems/tar2ext4/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tar2ext4";
-  version = "0.12.1";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "hcsshim";
     rev = "v${version}";
-    sha256 = "sha256-p0sNdCC8T5MDVimkS2DJusfuM788QxEtgKJNGlqrkAU=";
+    sha256 = "sha256-xBlol+09rogbNSYM6Ok5EWb6IEfrVb+/wNMqAA3ZELU=";
   };
 
   sourceRoot = "${src.name}/cmd/tar2ext4";
diff --git a/pkgs/tools/games/minecraft/mcaselector/default.nix b/pkgs/tools/games/minecraft/mcaselector/default.nix
index a2099c4e382e8..cbd0ce7036a1a 100644
--- a/pkgs/tools/games/minecraft/mcaselector/default.nix
+++ b/pkgs/tools/games/minecraft/mcaselector/default.nix
@@ -2,22 +2,25 @@
 , stdenvNoCC
 , fetchurl
 , makeWrapper
+, wrapGAppsHook
 , jre
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mcaselector";
-  version = "2.3";
+  version = "2.4";
 
   src = fetchurl {
     url = "https://github.com/Querz/mcaselector/releases/download/${finalAttrs.version}/mcaselector-${finalAttrs.version}.jar";
-    hash = "sha256-8ivqTqgO6hvEgwnAfnPXuruFGS3s/wD/WKt+5Bg/5Z0=";
+    hash = "sha256-6WQIvDmyVVmxHFOMk2emT1a4PMGVjvtC0aSkryvwARs=";
   };
 
   dontUnpack = true;
   dontBuild = true;
 
-  nativeBuildInputs = [ jre makeWrapper ];
+  nativeBuildInputs = [ jre makeWrapper wrapGAppsHook ];
+
+  dontWrapGApps = true;
 
   installPhase = ''
     runHook preInstall
@@ -25,7 +28,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     mkdir -p $out/{bin,lib/mcaselector}
     cp $src $out/lib/mcaselector/mcaselector.jar
     makeWrapper ${jre}/bin/java $out/bin/mcaselector \
-      --add-flags "-jar $out/lib/mcaselector/mcaselector.jar"
+      --add-flags "-jar $out/lib/mcaselector/mcaselector.jar" \
+      ''${gappsWrapperArgs[@]}
 
     runHook postInstall
   '';
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 580d01376eb87..55a02002e2576 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -168,7 +168,7 @@ python3.pkgs.buildPythonApplication rec {
     jsondiff
     libarchive-c
     progressbar33
-    pypdf2
+    pypdf
     python-magic
     pyxattr
     rpm
@@ -215,7 +215,8 @@ python3.pkgs.buildPythonApplication rec {
       guestfs
       h5py
       pdfminer-six
-      # docx2txt, breaks the tests.
+      r2pipe
+      # docx2txt, nixpkgs packages another project named the same, which does not work
     ])
     # oggvideotools is broken on Darwin, please put it back when it will be fixed?
     ++ lib.optionals stdenv.isLinux [ oggvideotools ]
diff --git a/pkgs/tools/misc/envchain/default.nix b/pkgs/tools/misc/envchain/default.nix
index a204f31a7484e..643eb86cb576a 100644
--- a/pkgs/tools/misc/envchain/default.nix
+++ b/pkgs/tools/misc/envchain/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "envchain";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "sorah";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0qxwiqhb8cg0zbn5p0mvnbyxx1xwvgiricrkjlvxz13sf2ngq87p";
+    sha256 = "sha256-QUy38kJzMbYOyT86as4/yq2ctcszSnB8a3eVWxgd4Fo=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/fdupes/default.nix b/pkgs/tools/misc/fdupes/default.nix
index e4e52115c3563..fefb3992749b9 100644
--- a/pkgs/tools/misc/fdupes/default.nix
+++ b/pkgs/tools/misc/fdupes/default.nix
@@ -1,18 +1,33 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, ncurses, pcre2 }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, ncurses
+, pcre2
+, sqlite
+}:
 
 stdenv.mkDerivation rec {
   pname = "fdupes";
-  version = "2.2.1";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "adrianlopezroche";
-    repo  = "fdupes";
-    rev   = "v${version}";
-    hash  = "sha256-8GYQfnUxS790pDXw2sjnDZNB55PMDaCcO6daIa/MPMw=";
+    repo = "fdupes";
+    rev = "v${version}";
+    hash = "sha256-BW6a5vKRAuXs/zWPHhtZs6Y4scyCEfqHEAkGUSUiwkI=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ ncurses pcre2 ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+  buildInputs = [
+    ncurses
+    pcre2
+    sqlite
+  ];
 
   meta = with lib; {
     description = "Identifies duplicate files residing within specified directories";
diff --git a/pkgs/tools/misc/ostree/default.nix b/pkgs/tools/misc/ostree/default.nix
index 025b57a8eb442..aff0968b7f102 100644
--- a/pkgs/tools/misc/ostree/default.nix
+++ b/pkgs/tools/misc/ostree/default.nix
@@ -132,7 +132,7 @@ in stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Git for operating system binaries";
-    homepage = "https://ostree.readthedocs.io/en/latest/";
+    homepage = "https://ostreedev.github.io/ostree/";
     license = licenses.lgpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ copumpkin ];
diff --git a/pkgs/tools/networking/oha/default.nix b/pkgs/tools/networking/oha/default.nix
index cbe629234b404..40eedfffb7a64 100644
--- a/pkgs/tools/networking/oha/default.nix
+++ b/pkgs/tools/networking/oha/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oha";
-  version = "1.4.1";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "hatoo";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-r5jYHs+oVflgFTQZpKvdNs56TmZtyljZKDJMVP+iUNY=";
+    hash = "sha256-ghzBP7Y76eUmVbKAym7bujXdwJtHxuZKBt3kcbBriY4=";
   };
 
-  cargoHash = "sha256-Q3ixlB/P/99h6ZuT37KrM9fxyBzcmlmM5jw6xDT2lPE=";
+  cargoHash = "sha256-2QY4vmLvJ+QcSAfeDPGGW/YcUWd1kKeqKbYThYf4uOA=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [
     pkg-config
diff --git a/pkgs/tools/security/ospd-openvas/default.nix b/pkgs/tools/security/ospd-openvas/default.nix
index 82afa1e0fec1d..9b20f221447ec 100644
--- a/pkgs/tools/security/ospd-openvas/default.nix
+++ b/pkgs/tools/security/ospd-openvas/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ospd-openvas";
-  version = "22.7.0";
+  version = "22.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "ospd-openvas";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aBrJODymUMj0sflJW/+dMYZBRPYqtS1L2UBENDXb2Xw=";
+    hash = "sha256-bFZTwNITDG5OpoWD7F1Ad6BQFpY4Q5CGUGbYy7rTuc0=";
   };
 
   pythonRelaxDeps = [
@@ -20,8 +20,11 @@ python3.pkgs.buildPythonApplication rec {
     "python-gnupg"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [
     poetry-core
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
     pythonRelaxDepsHook
   ];
 
diff --git a/pkgs/tools/security/ssh-audit/default.nix b/pkgs/tools/security/ssh-audit/default.nix
index d704832f248d2..0551a7b10b222 100644
--- a/pkgs/tools/security/ssh-audit/default.nix
+++ b/pkgs/tools/security/ssh-audit/default.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ssh-audit";
-  version = "3.1.0";
+  version = "3.2.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "jtesta";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-pO6qpY1gqE40bb7q8J/35Dd0XckoFAaIBwWjFsxFO3c=";
+    sha256 = "sha256-g5h0A1BJqzOZaSVUxyi7IsCcrbto4+7+HpiVjFZy50Y=";
   };
 
   nativeCheckInputs = with python3Packages; [
diff --git a/pkgs/tools/text/vale/default.nix b/pkgs/tools/text/vale/default.nix
index 5bb73a50f9e64..18d4484687f3a 100644
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@@ -36,6 +36,9 @@ buildGoModule rec {
       wrapProgram "$out/bin/vale" \
         --set VALE_STYLES_PATH "$out/share/vale/styles/"
     '';
+    meta = {
+      inherit (vale.meta) mainProgram;
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f879d9ca98f07..408d9b77705f2 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -92,6 +92,7 @@ mapAliases ({
   atomEnv = throw "'atomEnv' has been removed because 'atom' is discontinued and deprecated. Consider using 'pulsar', a maintained fork"; # Added 2023-10-01
   atomPackages = throw "'atomPackages' has been removed because 'atom' is discontinued and deprecated. Consider using 'pulsar', a maintained fork"; # Added 2023-10-01
   auditBlasHook = throw "'auditBlasHook' has been removed since it never worked"; # Added 2024-04-02
+  authy = throw "'authy' has been removed since it reached end of life"; # Added 2024-04-19
   avldrums-lv2 = x42-avldrums; # Added 2020-03-29
   awesome-4-0 = awesome; # Added 2022-05-05
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index caad4c568c21a..61c4c606d2b80 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -313,8 +313,6 @@ with pkgs;
 
   assemblyscript = callPackage ../development/compilers/assemblyscript { };
 
-  authy = callPackage ../applications/misc/authy { };
-
   authz0 = callPackage ../tools/security/authz0 { };
 
   auth0-cli = callPackage ../tools/admin/auth0-cli { };
@@ -27938,8 +27936,6 @@ with pkgs;
 
   dnsdist = callPackage ../servers/dns/dnsdist { };
 
-  pdns-recursor = callPackage ../servers/dns/pdns-recursor { };
-
   powertop = callPackage ../os-specific/linux/powertop { };
 
   pps-tools = callPackage ../os-specific/linux/pps-tools { };
diff --git a/pkgs/top-level/make-tarball.nix b/pkgs/top-level/make-tarball.nix
index 17df40fa0fb16..78b90082547be 100644
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -1,10 +1,5 @@
-/* Hydra job to build a tarball for Nixpkgs from a Git checkout.  It
-   also builds the documentation and tests whether the Nix expressions
-   evaluate correctly. */
-
 { nixpkgs
 , officialRelease
-, supportedSystems
 , pkgs ? import nixpkgs.outPath {}
 , nix ? pkgs.nix
 , lib-tests ? import ../../lib/tests/release.nix { inherit pkgs; }
@@ -32,54 +27,50 @@ pkgs.releaseTools.sourceTarball {
     echo "git-revision is $(cat .git-revision)"
   '';
 
-  requiredSystemFeatures = [ "big-parallel" ]; # 1 thread but ~36G RAM (!) see #227945
+  dontUnpack = true;
 
   dontBuild = false;
 
   doCheck = true;
 
   checkPhase = ''
-    set -o pipefail
-
-    export NIX_STATE_DIR=$TMPDIR
-    export NIX_PATH=nixpkgs=$TMPDIR/barf.nix
-    opts=(--option build-users-group "")
-    nix-store --init
+    echo "generating packages.json"
 
-    echo "checking eval-release.nix"
-    nix-instantiate --eval --strict --show-trace ./maintainers/scripts/eval-release.nix > /dev/null
+    (
+      echo -n '{"version":2,"packages":'
+      NIX_STATE_DIR=$TMPDIR NIX_PATH= nix-env -f $src -qa --meta --json --show-trace --arg config 'import ${./packages-config.nix}'
+      echo -n '}'
+    ) | sed "s|$src/||g" | jq -c > packages.json
 
-    echo "checking find-tarballs.nix"
-    nix-instantiate --readonly-mode --eval --strict --show-trace --json \
-       ./maintainers/scripts/find-tarballs.nix \
-      --arg expr 'import ./maintainers/scripts/all-tarballs.nix' > $TMPDIR/tarballs.json
-    nrUrls=$(jq -r '.[].url' < $TMPDIR/tarballs.json | wc -l)
-    echo "found $nrUrls URLs"
-    if [ "$nrUrls" -lt 10000 ]; then
-      echo "suspiciously low number of URLs"
+    # Arbitrary number. The index has ~115k packages as of April 2024.
+    if [ $(jq -r '.packages | length' < packages.json) -lt 100000 ]; then
+      echo "ERROR: not enough packages in the search index, bailing out!"
       exit 1
     fi
 
-    echo "generating packages.json"
-    mkdir -p $out/nix-support
-    echo -n '{"version":2,"packages":' > tmp
-    nix-env -f . -I nixpkgs=$src -qa --meta --json --show-trace --arg config 'import ${./packages-config.nix}' "''${opts[@]}" >> tmp
-    echo -n '}' >> tmp
     packages=$out/packages.json.br
-    < tmp sed "s|$(pwd)/||g" | jq -c | brotli -9 > $packages
-    rm tmp
 
+    mkdir -p $out/nix-support
+    brotli -9 < packages.json > $packages
     echo "file json-br $packages" >> $out/nix-support/hydra-build-products
   '';
 
   distPhase = ''
     mkdir -p $out/tarballs
-    mkdir ../$releaseName
-    cp -prd . ../$releaseName
-    (cd .. && tar cfa $out/tarballs/$releaseName.tar.xz $releaseName) || false
+    XZ_OPT="-T0" tar \
+      --create \
+      --xz \
+      --file=$out/tarballs/$releaseName.tar.xz \
+      --absolute-names \
+      --transform="s|^$src|$releaseName|g" \
+      --transform="s|^$(pwd)|$releaseName|g" \
+      --owner=0 \
+      --group=0 \
+      --numeric-owner \
+      --format=gnu \
+      --sort=name \
+      --mtime="@$SOURCE_DATE_EPOCH" \
+      --mode=ug+w \
+      $src $(pwd)/{.version-suffix,.git-revision}
   '';
-
-  meta = {
-    maintainers = [ ];
-  };
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5d242bc0114fd..5c71519110ba4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9771,6 +9771,8 @@ self: super: with self; {
 
   pipdeptree = callPackage ../development/python-modules/pipdeptree { };
 
+  pipe = callPackage ../development/python-modules/pipe { };
+
   pipenv-poetry-migrate = callPackage ../development/python-modules/pipenv-poetry-migrate { };
 
   piper-phonemize = callPackage ../development/python-modules/piper-phonemize {
diff --git a/pkgs/top-level/release-small.nix b/pkgs/top-level/release-small.nix
index 2b143248948fa..0212464acb62d 100644
--- a/pkgs/top-level/release-small.nix
+++ b/pkgs/top-level/release-small.nix
@@ -18,7 +18,7 @@ in
 {
 
   tarball = import ./make-tarball.nix {
-    inherit nixpkgs supportedSystems;
+    inherit nixpkgs;
     officialRelease = false;
   };
 
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 2da2d7d64675c..d11d1d1dbd43b 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -78,7 +78,7 @@ let
   ] (arch: elem "${arch}-darwin" supportedSystems);
 
   nonPackageJobs =
-    { tarball = import ./make-tarball.nix { inherit pkgs nixpkgs officialRelease supportedSystems; };
+    { tarball = import ./make-tarball.nix { inherit pkgs nixpkgs officialRelease; };
 
       release-checks = import ./nixpkgs-basic-release-checks.nix { inherit pkgs nixpkgs supportedSystems; };