Merge master into staging-next

82 files changed, 760 insertions, 204 deletions

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3cc123be431e5..55232e9c3a545 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -378,7 +378,7 @@ The staging workflow exists to batch Hydra builds of many packages together.
 It works by directing commits that cause [mass rebuilds][mass-rebuild] to a separate `staging` branch that isn't directly built by Hydra.
 Regularly, the `staging` branch is _manually_ merged into a `staging-next` branch to be built by Hydra using the [`nixpkgs:staging-next` jobset](https://hydra.nixos.org/jobset/nixpkgs/staging-next).
 The `staging-next` branch should then only receive direct commits in order to fix Hydra builds.
-Once it is verified that there are no major regressions, it is merged into `master` using [a pull requests](https://github.com/NixOS/nixpkgs/pulls?q=head%3Astaging-next).
+Once it is verified that there are no major regressions, it is merged into `master` using [a pull request](https://github.com/NixOS/nixpkgs/pulls?q=head%3Astaging-next).
 This is done manually in order to ensure it's a good use of Hydra's computing resources.
 By keeping the `staging-next` branch separate from `staging`, this batching does not block developers from merging changes into `staging`.
 
diff --git a/nixos/modules/image/repart-image.nix b/nixos/modules/image/repart-image.nix
index b4a1dfe51ff3a..a12b4fb14fb16 100644
--- a/nixos/modules/image/repart-image.nix
+++ b/nixos/modules/image/repart-image.nix
@@ -10,6 +10,8 @@
 , systemd
 , fakeroot
 , util-linux
+
+  # filesystem tools
 , dosfstools
 , mtools
 , e2fsprogs
@@ -18,8 +20,13 @@
 , btrfs-progs
 , xfsprogs
 
+  # compression tools
+, zstd
+, xz
+
   # arguments
-, name
+, imageFileBasename
+, compression
 , fileSystems
 , partitions
 , split
@@ -52,14 +59,25 @@ let
   };
 
   fileSystemTools = builtins.concatMap (f: fileSystemToolMapping."${f}") fileSystems;
+
+  compressionPkg = {
+    "zstd" = zstd;
+    "xz" = xz;
+  }."${compression.algorithm}";
+
+  compressionCommand = {
+    "zstd" = "zstd --no-progress --threads=0 -${toString compression.level}";
+    "xz" = "xz --keep --verbose --threads=0 -${toString compression.level}";
+  }."${compression.algorithm}";
 in
 
-runCommand name
+runCommand imageFileBasename
 {
   nativeBuildInputs = [
     systemd
     fakeroot
     util-linux
+    compressionPkg
   ] ++ fileSystemTools;
 } ''
   amendedRepartDefinitions=$(${amendRepartDefinitions} ${partitions} ${definitionsDirectory})
@@ -67,6 +85,7 @@ runCommand name
   mkdir -p $out
   cd $out
 
+  echo "Building image with systemd-repart..."
   unshare --map-root-user fakeroot systemd-repart \
     --dry-run=no \
     --empty=create \
@@ -75,6 +94,17 @@ runCommand name
     --definitions="$amendedRepartDefinitions" \
     --split="${lib.boolToString split}" \
     --json=pretty \
-    image.raw \
+    ${imageFileBasename}.raw \
     | tee repart-output.json
+
+  # Compression is implemented in the same derivation as opposed to in a
+  # separate derivation to allow users to save disk space. Disk images are
+  # already very space intensive so we want to allow users to mitigate this.
+  if ${lib.boolToString compression.enable}; then
+    for f in ${imageFileBasename}*; do
+      echo "Compressing $f with ${compression.algorithm}..."
+      # Keep the original file when compressing and only delete it afterwards
+      ${compressionCommand} $f && rm $f
+    done
+  fi
 ''
diff --git a/nixos/modules/image/repart.nix b/nixos/modules/image/repart.nix
index da4f45d9a6392..ed584d9bf997b 100644
--- a/nixos/modules/image/repart.nix
+++ b/nixos/modules/image/repart.nix
@@ -66,7 +66,53 @@ in
 
     name = lib.mkOption {
       type = lib.types.str;
-      description = lib.mdDoc "The name of the image.";
+      description = lib.mdDoc ''
+        Name of the image.
+
+        If this option is unset but config.system.image.id is set,
+        config.system.image.id is used as the default value.
+      '';
+    };
+
+    version = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = config.system.image.version;
+      defaultText = lib.literalExpression "config.system.image.version";
+      description = lib.mdDoc "Version of the image";
+    };
+
+    imageFileBasename = lib.mkOption {
+      type = lib.types.str;
+      readOnly = true;
+      description = lib.mdDoc ''
+        Basename of the image filename without any extension (e.g. `image_1`).
+      '';
+    };
+
+    imageFile = lib.mkOption {
+      type = lib.types.str;
+      readOnly = true;
+      description = lib.mdDoc ''
+        Filename of the image including all extensions (e.g `image_1.raw` or
+        `image_1.raw.zst`).
+      '';
+    };
+
+    compression = {
+      enable = lib.mkEnableOption (lib.mdDoc "Image compression");
+
+      algorithm = lib.mkOption {
+        type = lib.types.enum [ "zstd" "xz" ];
+        default = "zstd";
+        description = lib.mdDoc "Compression algorithm";
+      };
+
+      level = lib.mkOption {
+        type = lib.types.int;
+        description = lib.mdDoc ''
+          Compression level. The available range depends on the used algorithm.
+        '';
+      };
     };
 
     seed = lib.mkOption {
@@ -131,6 +177,32 @@ in
 
   config = {
 
+    image.repart =
+      let
+        version = config.image.repart.version;
+        versionInfix = if version != null then "_${version}" else "";
+        compressionSuffix = lib.optionalString cfg.compression.enable
+          {
+            "zstd" = ".zst";
+            "xz" = ".xz";
+          }."${cfg.compression.algorithm}";
+      in
+      {
+        name = lib.mkIf (config.system.image.id != null) (lib.mkOptionDefault config.system.image.id);
+        imageFileBasename = cfg.name + versionInfix;
+        imageFile = cfg.imageFileBasename + ".raw" + compressionSuffix;
+
+        compression = {
+          # Generally default to slightly faster than default compression
+          # levels under the assumption that most of the building will be done
+          # for development and release builds will be customized.
+          level = lib.mkOptionDefault {
+            "zstd" = 3;
+            "xz" = 3;
+          }."${cfg.compression.algorithm}";
+        };
+      };
+
     system.build.image =
       let
         fileSystems = lib.filter
@@ -160,7 +232,7 @@ in
       in
       pkgs.callPackage ./repart-image.nix {
         systemd = cfg.package;
-        inherit (cfg) name split seed;
+        inherit (cfg) imageFileBasename compression split seed;
         inherit fileSystems definitionsDirectory partitions;
       };
 
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index 45dbf45b3ae70..c929c3b37285b 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -28,6 +28,8 @@ let
     DOCUMENTATION_URL = lib.optionalString (cfg.distroId == "nixos") "https://nixos.org/learn.html";
     SUPPORT_URL = lib.optionalString (cfg.distroId == "nixos") "https://nixos.org/community.html";
     BUG_REPORT_URL = lib.optionalString (cfg.distroId == "nixos") "https://github.com/NixOS/nixpkgs/issues";
+    IMAGE_ID = lib.optionalString (config.system.image.id != null) config.system.image.id;
+    IMAGE_VERSION = lib.optionalString (config.system.image.version != null) config.system.image.version;
   } // lib.optionalAttrs (cfg.variant_id != null) {
     VARIANT_ID = cfg.variant_id;
   };
@@ -110,6 +112,38 @@ in
       example = "installer";
     };
 
+    image = {
+
+      id = lib.mkOption {
+        type = types.nullOr (types.strMatching "^[a-z0-9._-]+$");
+        default = null;
+        description = lib.mdDoc ''
+          Image identifier.
+
+          This corresponds to the IMAGE_ID field in os-release. See the
+          upstream docs for more details on valid characters for this field:
+          https://www.freedesktop.org/software/systemd/man/latest/os-release.html#IMAGE_ID=
+
+          You would only want to set this option if you're build NixOS appliance images.
+        '';
+      };
+
+      version = lib.mkOption {
+        type = types.nullOr (types.strMatching "^[a-z0-9._-]+$");
+        default = null;
+        description = lib.mdDoc ''
+          Image version.
+
+          This corresponds to the IMAGE_VERSION field in os-release. See the
+          upstream docs for more details on valid characters for this field:
+          https://www.freedesktop.org/software/systemd/man/latest/os-release.html#IMAGE_VERSION=
+
+          You would only want to set this option if you're build NixOS appliance images.
+        '';
+      };
+
+    };
+
     stateVersion = mkOption {
       type = types.str;
       # TODO Remove this and drop the default of the option so people are forced to set it.
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
index 9d55c21077d13..3b140726c2d6a 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@@ -81,7 +81,11 @@ in {
 
       type = types.bool;
 
-      description = lib.mdDoc "Whether to enable the systemd-boot (formerly gummiboot) EFI boot manager";
+      description = lib.mdDoc ''
+        Whether to enable the systemd-boot (formerly gummiboot) EFI boot manager.
+        For more information about systemd-boot:
+        https://www.freedesktop.org/wiki/Software/systemd/systemd-boot/
+      '';
     };
 
     editor = mkOption {
diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
index ec0b713e58b38..47382f9beab00 100644
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -150,26 +150,33 @@ in
 
   };
 
-  config = lib.mkIf cfg.enable
-    {
+  config =
+    let
+      networkConfig = ({
+        dns_enabled = false;
+        driver = "bridge";
+        id = "0000000000000000000000000000000000000000000000000000000000000000";
+        internal = false;
+        ipam_options = { driver = "host-local"; };
+        ipv6_enabled = false;
+        name = "podman";
+        network_interface = "podman0";
+        subnets = [{ gateway = "10.88.0.1"; subnet = "10.88.0.0/16"; }];
+      } // cfg.defaultNetwork.settings);
+      inherit (networkConfig) dns_enabled network_interface;
+    in
+    lib.mkIf cfg.enable {
       environment.systemPackages = [ cfg.package ]
         ++ lib.optional cfg.dockerCompat dockerCompat;
 
       # https://github.com/containers/podman/blob/097cc6eb6dd8e598c0e8676d21267b4edb11e144/docs/tutorials/basic_networking.md#default-network
       environment.etc."containers/networks/podman.json" = lib.mkIf (cfg.defaultNetwork.settings != { }) {
-        source = json.generate "podman.json" ({
-          dns_enabled = false;
-          driver = "bridge";
-          id = "0000000000000000000000000000000000000000000000000000000000000000";
-          internal = false;
-          ipam_options = { driver = "host-local"; };
-          ipv6_enabled = false;
-          name = "podman";
-          network_interface = "podman0";
-          subnets = [{ gateway = "10.88.0.1"; subnet = "10.88.0.0/16"; }];
-        } // cfg.defaultNetwork.settings);
+        source = json.generate "podman.json" networkConfig;
       };
 
+      # containers cannot reach aardvark-dns otherwise
+      networking.firewall.interfaces.${network_interface}.allowedUDPPorts = lib.mkIf dns_enabled [ 53 ];
+
       virtualisation.containers = {
         enable = true; # Enable common /etc/containers configuration
         containersConf.settings = {
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a3b8ba3277d09..1f6d8b8ced0e2 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -588,6 +588,7 @@ in {
   nginx-globalredirect = handleTest ./nginx-globalredirect.nix {};
   nginx-http3 = handleTest ./nginx-http3.nix {};
   nginx-modsecurity = handleTest ./nginx-modsecurity.nix {};
+  nginx-moreheaders = handleTest ./nginx-moreheaders.nix {};
   nginx-njs = handleTest ./nginx-njs.nix {};
   nginx-proxyprotocol = handleTest ./nginx-proxyprotocol {};
   nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
diff --git a/nixos/tests/appliance-repart-image.nix b/nixos/tests/appliance-repart-image.nix
index 3f256db846214..1c4495baba131 100644
--- a/nixos/tests/appliance-repart-image.nix
+++ b/nixos/tests/appliance-repart-image.nix
@@ -8,6 +8,9 @@
 let
   rootPartitionLabel = "root";
 
+  imageId = "nixos-appliance";
+  imageVersion = "1-rc1";
+
   bootLoaderConfigPath = "/loader/entries/nixos.conf";
   kernelPath = "/EFI/nixos/kernel.efi";
   initrdPath = "/EFI/nixos/initrd.efi";
@@ -29,6 +32,9 @@ in
     # TODO(raitobezarius): revisit this when #244907 lands
     boot.loader.grub.enable = false;
 
+    system.image.id = imageId;
+    system.image.version = imageVersion;
+
     virtualisation.fileSystems = lib.mkForce {
       "/" = {
         device = "/dev/disk/by-partlabel/${rootPartitionLabel}";
@@ -99,7 +105,7 @@ in
       "-f",
       "qcow2",
       "-b",
-      "${nodes.machine.system.build.image}/image.raw",
+      "${nodes.machine.system.build.image}/${nodes.machine.image.repart.imageFile}",
       "-F",
       "raw",
       tmp_disk_image.name,
@@ -108,6 +114,10 @@ in
     # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
     os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
 
+    os_release = machine.succeed("cat /etc/os-release")
+    assert 'IMAGE_ID="${imageId}"' in os_release
+    assert 'IMAGE_VERSION="${imageVersion}"' in os_release
+
     bootctl_status = machine.succeed("bootctl status")
     assert "${bootLoaderConfigPath}" in bootctl_status
     assert "${kernelPath}" in bootctl_status
diff --git a/nixos/tests/nginx-moreheaders.nix b/nixos/tests/nginx-moreheaders.nix
new file mode 100644
index 0000000000000..560dcf9ce0b82
--- /dev/null
+++ b/nixos/tests/nginx-moreheaders.nix
@@ -0,0 +1,37 @@
+import ./make-test-python.nix {
+  name = "nginx-more-headers";
+
+  nodes = {
+    webserver = { pkgs, ... }: {
+      services.nginx = {
+        enable = true;
+
+        virtualHosts.test = {
+          locations = {
+            "/".return = "200 blub";
+            "/some" =  {
+              return = "200 blub";
+              extraConfig = ''
+                more_set_headers "Referrer-Policy: no-referrer";
+              '';
+            };
+          };
+          extraConfig = ''
+            more_set_headers "X-Powered-By: nixos";
+          '';
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_open_port(80)
+
+    webserver.succeed("curl --fail --resolve test:80:127.0.0.1 --head --verbose http://test | grep -q \"X-Powered-By: nixos\"")
+    webserver.fail("curl --fail --resolve test:80:127.0.0.1 --head --verbose http://test | grep -q \"Referrer-Policy: no-referrer\"")
+
+    webserver.succeed("curl --fail --resolve test:80:127.0.0.1 --head --verbose http://test/some | grep -q \"X-Powered-By: nixos\"")
+    webserver.succeed("curl --fail --resolve test:80:127.0.0.1 --head --verbose http://test/some | grep -q \"Referrer-Policy: no-referrer\"")
+  '';
+}
diff --git a/nixos/tests/podman/default.nix b/nixos/tests/podman/default.nix
index 0e1f420f2a7de..3eea45832f0a6 100644
--- a/nixos/tests/podman/default.nix
+++ b/nixos/tests/podman/default.nix
@@ -24,8 +24,6 @@ import ../make-test-python.nix (
         virtualisation.podman.enable = true;
 
         virtualisation.podman.defaultNetwork.settings.dns_enabled = true;
-
-        networking.firewall.allowedUDPPorts = [ 53 ];
       };
       docker = { pkgs, ... }: {
         virtualisation.podman.enable = true;
diff --git a/pkgs/applications/editors/lapce/default.nix b/pkgs/applications/editors/lapce/default.nix
index 3efa3acaa939d..dce0ad1681066 100644
--- a/pkgs/applications/editors/lapce/default.nix
+++ b/pkgs/applications/editors/lapce/default.nix
@@ -131,5 +131,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/lapce/lapce";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ elliot ];
+    mainProgram = "lapce";
   };
 }
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index b13c2a1efb894..553638dc3e258 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -7067,6 +7067,18 @@ final: prev:
     meta.homepage = "https://github.com/theHamsta/nvim-dap-virtual-text/";
   };
 
+  nvim-docs-view = buildVimPlugin {
+    pname = "nvim-docs-view";
+    version = "2023-10-19";
+    src = fetchFromGitHub {
+      owner = "amrbashir";
+      repo = "nvim-docs-view";
+      rev = "74a5e989e3fdcfd9418bb9dfec0ace308e00a5a0";
+      sha256 = "sha256-EmQbnleqxE+VHO5bMI9U/gMpwbJbPdNhrEWE7357MCE=";
+    };
+    meta.homepage = "https://github.com/amrbashir/nvim-docs-view/";
+  };
+
   nvim-expand-expr = buildVimPlugin {
     pname = "nvim-expand-expr";
     version = "2021-08-14";
@@ -9713,6 +9725,18 @@ final: prev:
     meta.homepage = "https://github.com/vim-scripts/taglist.vim/";
   };
 
+  tailwindcss-colors-nvim = buildVimPlugin {
+    pname = "tailwindcss-colors.nvim";
+    version = "2021-12-24";
+    src = fetchFromGitHub {
+      owner = "themaxmarchuk";
+      repo = "tailwindcss-colors.nvim";
+      rev = "ccb5be2f84673c1a0ef90a0c0a76733e85e5265b";
+      sha256 = "sha256-2eUr4rB8gpax0xJ8U4O2O93UXUxF+HZV6Co8LwPZ3JE=";
+    };
+    meta.homepage = "https://github.com/themaxmarchuk/tailwindcss-colors.nvim/";
+  };
+
   targets-vim = buildVimPlugin {
     pname = "targets.vim";
     version = "2023-02-22";
@@ -15758,6 +15782,18 @@ final: prev:
     meta.homepage = "https://github.com/liuchengxu/vista.vim/";
   };
 
+  vscode-nvim = buildVimPlugin {
+    pname = "vscode.nvim";
+    version = "2023-12-21";
+    src = fetchFromGitHub {
+      owner = "Mofiqul";
+      repo = "vscode.nvim";
+      rev = "39841d05ab4a5c03ea0985196b9f3dfa48d83411";
+      sha256 = "1xnfvyc1996c0vkpvqc1f4ys0wklq4f4k0lv557zfwmp96dl6x8f";
+    };
+    meta.homepage = "https://github.com/Mofiqul/vscode.nvim/";
+  };
+
   wal-vim = buildVimPlugin {
     pname = "wal.vim";
     version = "2020-11-08";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 6c68c0ea92b4b..d3786120bc88e 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -594,6 +594,7 @@ https://github.com/leoluz/nvim-dap-go/,HEAD,
 https://github.com/mfussenegger/nvim-dap-python/,HEAD,
 https://github.com/rcarriga/nvim-dap-ui/,,
 https://github.com/theHamsta/nvim-dap-virtual-text/,,
+https://github.com/amrbashir/nvim-docs-view/,HEAD,
 https://github.com/allendang/nvim-expand-expr/,,
 https://github.com/vijaymarupudi/nvim-fzf/,,
 https://github.com/vijaymarupudi/nvim-fzf-commands/,,
@@ -816,6 +817,7 @@ https://github.com/godlygeek/tabular/,,
 https://github.com/AndrewRadev/tagalong.vim/,,
 https://github.com/preservim/tagbar/,,
 https://github.com/vim-scripts/taglist.vim/,,
+https://github.com/themaxmarchuk/tailwindcss-colors.nvim/,HEAD,
 https://github.com/wellle/targets.vim/,,
 https://github.com/tools-life/taskwiki/,,
 https://github.com/tomtom/tcomment_vim/,,
@@ -1328,6 +1330,7 @@ https://github.com/jubnzv/virtual-types.nvim/,HEAD,
 https://github.com/vim-scripts/vis/,,
 https://github.com/navicore/vissort.vim/,,
 https://github.com/liuchengxu/vista.vim/,,
+https://github.com/Mofiqul/vscode.nvim/,,
 https://github.com/dylanaraps/wal.vim/,,
 https://github.com/mattn/webapi-vim/,,
 https://github.com/DingDean/wgsl.vim/,HEAD,
diff --git a/pkgs/applications/logging/sosreport/default.nix b/pkgs/applications/logging/sosreport/default.nix
index b04a9835a86bd..467feb4b496ec 100644
--- a/pkgs/applications/logging/sosreport/default.nix
+++ b/pkgs/applications/logging/sosreport/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "sosreport";
-  version = "4.4";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "sosreport";
     repo = "sos";
-    rev = version;
-    sha256 = "sha256-xbL/4CmDnygiL/u3Jsa6fAkO4YfklDzuFMsxSGy1Ra4=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-IW3b+zAxXnr7H+/XxJA+tJZYNte1nVdDaMhW3TcGxzo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/ausweisapp/default.nix b/pkgs/applications/misc/ausweisapp/default.nix
index d6f863576a27a..25599f383819a 100644
--- a/pkgs/applications/misc/ausweisapp/default.nix
+++ b/pkgs/applications/misc/ausweisapp/default.nix
@@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ausweisapp";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "Governikus";
     repo = "AusweisApp2";
     rev = finalAttrs.version;
-    hash = "sha256-m+GZkaJyuqErsvkUXi+uAsrMXHyQg9Vd77ZkfGxMqg4=";
+    hash = "sha256-pnGtlNXwYNG+m3mmo815dqp2i098I/i7EKdLrDm/Su8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/logseq/default.nix b/pkgs/applications/misc/logseq/default.nix
index d42981a95cf29..837efc04491b6 100644
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@@ -14,11 +14,11 @@ stdenv.mkDerivation (finalAttrs: let
 
 in {
   pname = "logseq";
-  version = "0.10.4";
+  version = "0.10.5";
 
   src = fetchurl {
     url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    hash = "sha256-vFCNhnhfxlSLeieB1DJgym5nbzPKO1ngArTUXvf+DAU=";
+    hash = "sha256-F3YbqgvL04P0nXaIVkJlCq/z8hUE0M0UutkBs2omuBE=";
     name = "${pname}-${version}.AppImage";
   };
 
diff --git a/pkgs/applications/misc/p2pool/default.nix b/pkgs/applications/misc/p2pool/default.nix
index f190925990098..53a05157b9961 100644
--- a/pkgs/applications/misc/p2pool/default.nix
+++ b/pkgs/applications/misc/p2pool/default.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "p2pool";
-  version = "3.9";
+  version = "3.10";
 
   src = fetchFromGitHub {
     owner = "SChernykh";
     repo = "p2pool";
     rev = "v${version}";
-    sha256 = "sha256-3CzQVK/1kLL50UdlTsDvHVfx9ZY8B3M0qzcIlonII6k=";
+    sha256 = "sha256-IDOtwrIKzP/pbwqIespvZtNS1VdR3246uXxgxR3V6VI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/tippecanoe/default.nix b/pkgs/applications/misc/tippecanoe/default.nix
index 4986f40837ab7..ef6d83703ac9e 100644
--- a/pkgs/applications/misc/tippecanoe/default.nix
+++ b/pkgs/applications/misc/tippecanoe/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tippecanoe";
-  version = "2.40.0";
+  version = "2.41.0";
 
   src = fetchFromGitHub {
     owner = "felt";
     repo = "tippecanoe";
     rev = finalAttrs.version;
-    hash = "sha256-zp0+I+Se9spYPEHlxYeYuLaV8EMw80y88zqvfAD9ZsU=";
+    hash = "sha256-tuoSRZ2vSMWwvKFac7x67q+maYoDx7CfpfGfA8NLAnA=";
   };
 
   buildInputs = [ sqlite zlib ];
diff --git a/pkgs/applications/radio/fllog/default.nix b/pkgs/applications/radio/fllog/default.nix
index e762dbe65716c..b9490e47e5a54 100644
--- a/pkgs/applications/radio/fllog/default.nix
+++ b/pkgs/applications/radio/fllog/default.nix
@@ -7,12 +7,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.7";
+  version = "1.2.8";
   pname = "fllog";
 
   src = fetchurl {
     url = "mirror://sourceforge/fldigi/${pname}-${version}.tar.gz";
-    sha256 = "sha256-HxToZ+f1IJgDKGPHBeVuS7rRkh3+KfpyoYPBwfyqsC8=";
+    sha256 = "sha256-kJLb1ifd8sUOwGgNsIEmlhH29fQLdTfDMjKLrzK7r1I=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/video/mpv/scripts/occivink.nix b/pkgs/applications/video/mpv/scripts/occivink.nix
index f4ea27c1c1aae..1f17a27172872 100644
--- a/pkgs/applications/video/mpv/scripts/occivink.nix
+++ b/pkgs/applications/video/mpv/scripts/occivink.nix
@@ -13,12 +13,12 @@ let
   mkScript = name: args:
     let self = rec {
       pname = camelToKebab name;
-      version = "unstable-2023-12-18";
+      version = "unstable-2024-01-11";
       src = fetchFromGitHub {
         owner = "occivink";
         repo = "mpv-scripts";
-        rev = "f0426bd6b107b1f4b124552dae923b62f58ce3b6";
-        hash = "sha256-oag5lcDoezyNXs5EBr0r0UE3ikeftvbfxSzfbxV1Oy0=";
+        rev = "d0390c8e802c2e888ff4a2e1d5e4fb040f855b89";
+        hash = "sha256-pc2aaO7lZaoYMEXv5M0WI7PtmqgkNbdtNiLZZwVzppM=";
       };
       passthru.updateScript = unstableGitUpdater {};
 
diff --git a/pkgs/applications/video/ustreamer/default.nix b/pkgs/applications/video/ustreamer/default.nix
index 04c1296b0e34c..88baeafe1871f 100644
--- a/pkgs/applications/video/ustreamer/default.nix
+++ b/pkgs/applications/video/ustreamer/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ustreamer";
-  version = "5.45";
+  version = "5.48";
 
   src = fetchFromGitHub {
     owner = "pikvm";
     repo = "ustreamer";
     rev = "v${version}";
-    hash = "sha256-2WJXOv15oZRk2doecd+xOURygbX4oGyeMAJiiuiRBi4=";
+    hash = "sha256-R1HL8tYFDtHrxArcoJwlM0Y7MbSyNxNiZ2tjyh1OCn4=";
   };
 
   buildInputs = [ libbsd libevent libjpeg ];
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index 47381e4d1a1b2..09e50b4fb9eb2 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "1.7.11";
+  version = "1.7.12";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    hash = "sha256-kvBD9Qh10kRowr32zDzjpHYh2IZC6+w+nOO4joShgEE=";
+    hash = "sha256-o3ZqSE7ahUAihY/tqXdNgKzs64h0DBxrZaxjSF9smcs=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/gl/glauth/package.nix b/pkgs/by-name/gl/glauth/package.nix
index 7f279e8613e76..22929707c72b4 100644
--- a/pkgs/by-name/gl/glauth/package.nix
+++ b/pkgs/by-name/gl/glauth/package.nix
@@ -48,7 +48,7 @@ buildGoModule rec {
     description = "A lightweight LDAP server for development, home use, or CI";
     homepage = "https://github.com/glauth/glauth";
     license = licenses.mit;
-    maintainers = with maintainers; [ bjornfor ];
+    maintainers = with maintainers; [ bjornfor christoph-heiss ];
     mainProgram = "glauth";
   };
 }
diff --git a/pkgs/by-name/in/incus/package.nix b/pkgs/by-name/in/incus/package.nix
index e02876407a7b2..d4a9ef55c611d 100644
--- a/pkgs/by-name/in/incus/package.nix
+++ b/pkgs/by-name/in/incus/package.nix
@@ -11,19 +11,27 @@
 , attr
 , bash
 , btrfs-progs
+, cdrkit
 , criu
 , dnsmasq
+, e2fsprogs
+, getent
 , gnutar
 , gptfdisk
 , gzip
 , iproute2
 , iptables
+, kmod
+, lvm2
+, minio
+, nftables
 , OVMF
 , qemu_kvm
 , qemu-utils
 , rsync
 , spice-gtk
 , squashfsTools
+, thin-provisioning-tools
 , util-linux
 , virtiofsd
 , xz
@@ -34,17 +42,25 @@ let
     attr
     bash
     btrfs-progs
+    cdrkit
     criu
     dnsmasq
+    e2fsprogs
+    getent
     gnutar
     gptfdisk
     gzip
     iproute2
     iptables
+    kmod
+    lvm2
+    minio
+    nftables
     qemu_kvm
     qemu-utils
     rsync
     squashfsTools
+    thin-provisioning-tools
     util-linux
     virtiofsd
     xz
diff --git a/pkgs/by-name/te/terrapin-scanner/package.nix b/pkgs/by-name/te/terrapin-scanner/package.nix
index df8dd1158c1a9..2bf04dc676de7 100644
--- a/pkgs/by-name/te/terrapin-scanner/package.nix
+++ b/pkgs/by-name/te/terrapin-scanner/package.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "terrapin-scanner";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "RUB-NDS";
     repo = "Terrapin-Scanner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LBcoD/adIcda6ZxlEog8ArW0thr3g14fvEMFfgxiTsI=";
+    hash = "sha256-PmKfHvad+YAwLcdoiDSOBMQFgOKzJ6NbGbt4v570gyI=";
   };
 
   vendorHash = "sha256-x3fzs/TNGRo+u+RufXzzjDCeQayEZIKlgokdEQJRNaI=";
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index 8a3ebbb12bd14..2edb32b891fac 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -6,20 +6,27 @@
 , tigerbeetle
 , nix-update-script
 }:
+let
+  # Read [these comments](pkgs/development/compilers/zig/hook.nix#L12-L30) on the default Zig flags, and the associated links. tigerbeetle stopped exposing the `-Doptimize` build flag, so we can't use the default Nixpkgs zig hook as-is. tigerbeetle only exposes a boolean `-Drelease` flag which we'll add in the tigerbeetle derivation in this file.
+  custom_zig_hook = zig_0_11.hook.overrideAttrs (previousAttrs: {
+    zig_default_flags = builtins.filter (flag: builtins.match "-Doptimize.*" flag == null) previousAttrs.zig_default_flags;
+  });
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.14.171";
+  version = "0.14.175";
 
   src = fetchFromGitHub {
     owner = "tigerbeetle";
     repo = "tigerbeetle";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-MjsNQarRXsrWKJZ2aBi/Wc2HAYm3isLBNw81a75+nhc=";
+    hash = "sha256-MabY6kfK/SZ2ps8RZkI6cDhMdHasc1fk6+PKBfVMRm0=";
   };
 
-  nativeBuildInputs = [ zig_0_11.hook ];
+  nativeBuildInputs = [ custom_zig_hook ];
 
   zigBuildFlags = [
+    "-Drelease"
     "-Dgit-commit=0000000000000000000000000000000000000000"
     "-Dversion=${finalAttrs.version}"
   ];
@@ -37,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "A financial accounting database designed to be distributed and fast";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ danielsidhion ];
-    platforms = lib.platforms.unix;
+    platforms = lib.platforms.linux;
     mainProgram = "tigerbeetle";
   };
 })
diff --git a/pkgs/data/fonts/0xproto/default.nix b/pkgs/data/fonts/0xproto/default.nix
index 25a1fa585bc23..46fc708bc33f1 100644
--- a/pkgs/data/fonts/0xproto/default.nix
+++ b/pkgs/data/fonts/0xproto/default.nix
@@ -4,14 +4,14 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "0xproto";
-  version = "1.300";
+  version = "1.500";
 
   src = let
     underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
   in
     fetchzip {
       url = "https://github.com/0xType/0xProto/releases/download/${version}/0xProto_${underscoreVersion}.zip";
-      hash = "sha256-RanIMf9P2lFOF3kJS6jMlh/X6jttofbHSqFUJxWSqKk=";
+      hash = "sha256-4yZtYjNLHDsF16brUADzwS4/Ha0g+g0mU+sl8Gb9Zm0=";
     };
 
   installPhase = ''
diff --git a/pkgs/data/misc/clash-geoip/default.nix b/pkgs/data/misc/clash-geoip/default.nix
index 7dcb0c63e8de8..cd41a9076bf0e 100644
--- a/pkgs/data/misc/clash-geoip/default.nix
+++ b/pkgs/data/misc/clash-geoip/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "clash-geoip";
-  version = "20231212";
+  version = "20240112";
 
   src = fetchurl {
     url = "https://github.com/Dreamacro/maxmind-geoip/releases/download/${version}/Country.mmdb";
-    sha256 = "sha256-h6EojfOWfDwD5Akvb8NrSvg3xyQZhOUrKhUxlWwio8A=";
+    sha256 = "sha256-RnRPGMHb+gciKxVV0DoK/E/7sI7Zb9yvtqHYtYDC15Q=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/data/themes/alacritty-theme/default.nix b/pkgs/data/themes/alacritty-theme/default.nix
index a60f42107ce43..d7e1ea641bb8e 100644
--- a/pkgs/data/themes/alacritty-theme/default.nix
+++ b/pkgs/data/themes/alacritty-theme/default.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (self: {
   name = "alacritty-theme";
-  version = "unstable-2023-12-28";
+  version = "unstable-2024-01-15";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = "alacritty-theme";
-    rev = "b7a59c92fd54a005893b99479fb0aa466a37a4b7";
-    hash = "sha256-UBWH4Q9MliqcolFq1tZrfRdzCkUO1pRn84qvZEVw8Gg=";
+    rev = "489cb8d014e5e2d6aea8bc8a5680a10b8b13b0c3";
+    hash = "sha256-47F9YwhIDEvPK01zMwwUcAJ3xAetXhWfRHf1cfpuna4=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/desktops/budgie/plugins/budgie-media-player-applet/default.nix b/pkgs/desktops/budgie/plugins/budgie-media-player-applet/default.nix
new file mode 100644
index 0000000000000..ae3a44f22fd03
--- /dev/null
+++ b/pkgs/desktops/budgie/plugins/budgie-media-player-applet/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, glib
+, meson
+, ninja
+, python3Packages
+}:
+
+stdenv.mkDerivation {
+  pname = "budgie-media-player-applet";
+  version = "1.0.0-unstable-2023-12-31";
+
+  src = fetchFromGitHub {
+    owner = "zalesyc";
+    repo = "budgie-media-player-applet";
+    rev = "24500be1e0a1f92968df80f8befdf896723ba8ee";
+    hash = "sha256-jQgkE6vv8PIcB0MJgfsQvzMRkkMU51Gqefoa2G6YJCw=";
+  };
+
+  nativeBuildInputs = [
+    glib # glib-compile-schemas
+    meson
+    ninja
+    python3Packages.wrapPython
+  ];
+
+  pythonPath = with python3Packages; [
+    pillow
+    requests
+  ];
+
+  postPatch = ''
+    substituteInPlace meson.build --replace "/usr" "$out"
+    substituteInPlace meson_post_install.py --replace '"/", "usr"' "\"$out\""
+  '';
+
+  postFixup = ''
+    buildPythonPath "$out $pythonPath"
+    patchPythonScript "$out/lib/budgie-desktop/plugins/budgie-media-player-applet/applet.py"
+  '';
+
+  meta = {
+    description = "Media Control Applet for the Budgie Panel";
+    homepage = "https://github.com/zalesyc/budgie-media-player-applet";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ federicoschonborn ];
+  };
+}
diff --git a/pkgs/desktops/budgie/plugins/default.nix b/pkgs/desktops/budgie/plugins/default.nix
index e096802b66004..1958a8ef9ea21 100644
--- a/pkgs/desktops/budgie/plugins/default.nix
+++ b/pkgs/desktops/budgie/plugins/default.nix
@@ -1,4 +1,5 @@
 { callPackage }: {
   budgie-analogue-clock-applet = callPackage ./budgie-analogue-clock-applet { };
+  budgie-media-player-applet = callPackage ./budgie-media-player-applet { };
   budgie-user-indicator-redux = callPackage ./budgie-user-indicator-redux { };
 }
diff --git a/pkgs/development/compilers/circt/default.nix b/pkgs/development/compilers/circt/default.nix
index 6fb609699bad4..e44f8710cd487 100644
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@@ -17,12 +17,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.61.0";
+  version = "1.62.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    sha256 = "sha256-3zuaruaveUeJ7uKP5fMiDFPOGKcs6aTNuGOuhxV6nss=";
+    sha256 = "sha256-WUuH6rExuz6cQEW9wCVLM2ZTCry33UbUgob/eu4xnfM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/compilers/inform6/default.nix b/pkgs/development/compilers/inform6/default.nix
index 107ffaf57233e..49af7e6676e33 100644
--- a/pkgs/development/compilers/inform6/default.nix
+++ b/pkgs/development/compilers/inform6/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "inform6";
-  version = "6.41-r10";
+  version = "6.41-r11";
 
   src = fetchurl  {
     url = "https://ifarchive.org/if-archive/infocom/compilers/inform6/source/inform-${version}.tar.gz";
-    sha256 = "sha256-o2eBpzLczNjeCjoEtZsGgfobEwPVj1FEliDKC5qN6Hk=";
+    sha256 = "sha256-kfFfjJL03f3af1h/JdvkItuDFu8aGlM3BRa2eBB+ddY=";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/development/interpreters/php/8.2.nix b/pkgs/development/interpreters/php/8.2.nix
index b934647d9b8c4..2d2a705c30e57 100644
--- a/pkgs/development/interpreters/php/8.2.nix
+++ b/pkgs/development/interpreters/php/8.2.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.2.14";
-    hash = "sha256-+HHhMTM9YK5sU3sa3dvCrqVMQ2xWKvmG+4MJwGAEC54=";
+    version = "8.2.15";
+    hash = "sha256-UMPiILeqY6hXFiM8kC60TMCkZn7QuDNXIq4jkbE1Xno=";
   });
 in
 base.withExtensions ({ all, ... }: with all; ([
diff --git a/pkgs/development/libraries/draco/default.nix b/pkgs/development/libraries/draco/default.nix
index ee2c5b8e5b726..c4ed0730cdacf 100644
--- a/pkgs/development/libraries/draco/default.nix
+++ b/pkgs/development/libraries/draco/default.nix
@@ -16,14 +16,14 @@ let
   cmakeBool = b: if b then "ON" else "OFF";
 in
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.5.6";
+  version = "1.5.7";
   pname = "draco";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "draco";
     rev = finalAttrs.version;
-    hash = "sha256-2YQMav0JJMbJ2bvnN/Xv90tjE/OWLbrZDO4WlaOvcfI=";
+    hash = "sha256-p0Mn4kGeBBKL7Hoz4IBgb6Go6MdkgE7WZgxAnt1tE/0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/utf8cpp/default.nix b/pkgs/development/libraries/utf8cpp/default.nix
index 1ca767d98cb62..60ae45d2cd8e4 100644
--- a/pkgs/development/libraries/utf8cpp/default.nix
+++ b/pkgs/development/libraries/utf8cpp/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "utf8cpp";
-  version = "4.0.3";
+  version = "4.0.5";
 
   src = fetchFromGitHub {
     owner = "nemtrif";
     repo = "utfcpp";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-oUr476HMBYzX64x28Kcudw0B1BVqLUPVVdRzRe82AOc=";
+    hash = "sha256-Z27/31obVErsmW1b1SVcr45nKlFu01RqqpTMwS0LqJ8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/perl-modules/ham/default.nix b/pkgs/development/perl-modules/ham/default.nix
index 8005322cff731..8d1fce1ab8979 100644
--- a/pkgs/development/perl-modules/ham/default.nix
+++ b/pkgs/development/perl-modules/ham/default.nix
@@ -5,24 +5,24 @@
 , openssh
 , GitRepository
 , URI
-, XMLMini
+, XMLParser
 }:
 
 buildPerlPackage {
   pname = "ham-unstable";
-  version = "2022-10-26";
+  version = "2023-10-06";
 
   src = fetchFromGitHub {
     owner = "kernkonzept";
     repo = "ham";
-    rev = "f2f10516177d00a79fe81701351632df2544ba4e";
-    hash = "sha256-cxlZh1x8ycpZIwSeOwqB6BtwYaMoWtSPaeiyW41epdk=";
+    rev = "90d104ce481ee8f9b770be4b37d97f34eef5f82f";
+    hash = "sha256-DeHH7k9K7CmQW6eOyf8TCV/HNYS30oFnI1b8ztBDk/o=";
   };
 
   outputs = [ "out" ];
 
   nativeBuildInputs = [ makeWrapper ];
-  propagatedBuildInputs = [ openssh GitRepository URI XMLMini ];
+  propagatedBuildInputs = [ openssh GitRepository URI XMLParser ];
 
   preConfigure = ''
     patchShebangs .
@@ -38,8 +38,6 @@ buildPerlPackage {
       --prefix PATH : ${openssh}/bin
   '';
 
-  doCheck = false;
-
   meta = with lib; {
     description = "A tool to manage big projects consisting of multiple loosely-coupled git repositories";
     homepage = "https://github.com/kernkonzept/ham";
diff --git a/pkgs/development/php-packages/castor/default.nix b/pkgs/development/php-packages/castor/default.nix
index 25ce4df5403f0..70d07c1b8c700 100644
--- a/pkgs/development/php-packages/castor/default.nix
+++ b/pkgs/development/php-packages/castor/default.nix
@@ -8,16 +8,16 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "castor";
-  version = "0.10.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "jolicode";
     repo = "castor";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/pUo3Lure5N6vsh8o8cQDqlWj8vgOC0ctenO/93K3zQ=";
+    hash = "sha256-FqFCKvhOEtDERNRLB3613geEiNDOlQuLeCa5uVvoMdM=";
   };
 
-  vendorHash = "sha256-l/paOQmJs8/7YN/XsY6wklojLE3z3GIV3jrgZvyQp/8=";
+  vendorHash = "sha256-+ORwa3+tkVJ9KU+9URg+1lyHoL1swxg6DG5ex8HjigE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/php-packages/spx/default.nix b/pkgs/development/php-packages/spx/default.nix
index 020927ccf4910..b6f7598ffe5ad 100644
--- a/pkgs/development/php-packages/spx/default.nix
+++ b/pkgs/development/php-packages/spx/default.nix
@@ -1,7 +1,7 @@
 { buildPecl, lib, fetchFromGitHub, zlib }:
 
 let
-  version = "0.4.14";
+  version = "0.4.15";
 in buildPecl {
   inherit version;
   pname = "spx";
@@ -10,7 +10,7 @@ in buildPecl {
     owner = "NoiseByNorthwest";
     repo = "php-spx";
     rev = "v${version}";
-    hash = "sha256-LdR3ilknSUuNTAb9wfIpNGdaR3uwd4C47nZYRzfTfx8=";
+    hash = "sha256-gw6wbPt1Qy0vNfT0flq7bxpnGU3SgJvPVhk8H0Imvx4=";
   };
 
   configureFlags = [
diff --git a/pkgs/development/python-modules/aio-pika/default.nix b/pkgs/development/python-modules/aio-pika/default.nix
index 574d386b95deb..65f15fa639d53 100644
--- a/pkgs/development/python-modules/aio-pika/default.nix
+++ b/pkgs/development/python-modules/aio-pika/default.nix
@@ -7,36 +7,31 @@
 , poetry-core
 , pytestCheckHook
 , pythonOlder
-, setuptools
 , shortuuid
-, typing-extensions
 , yarl
 }:
 
 buildPythonPackage rec {
   pname = "aio-pika";
-  version = "9.3.1";
+  version = "9.4.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "mosquito";
     repo = "aio-pika";
     rev = "refs/tags/${version}";
-    hash = "sha256-RbDiJvbFNuXIqFvevLpk5sy5WDinwaWwSqa+XI6Dljo=";
+    hash = "sha256-EntV/CBvT4II4nxsVe3KjNA4EPV7Oc6h2G0fX0fHKTU=";
   };
 
   nativeBuildInputs = [
-    setuptools
     poetry-core
   ];
 
   propagatedBuildInputs = [
     aiormq
     yarl
-  ] ++ lib.optionals (pythonOlder "3.8") [
-    typing-extensions
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/aiormq/default.nix b/pkgs/development/python-modules/aiormq/default.nix
index 14c0d0f7b5133..214ffc714ee63 100644
--- a/pkgs/development/python-modules/aiormq/default.nix
+++ b/pkgs/development/python-modules/aiormq/default.nix
@@ -3,6 +3,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pythonOlder
+, pythonRelaxDepsHook
 , pytestCheckHook
 , pamqp
 , yarl
@@ -11,21 +12,25 @@
 
 buildPythonPackage rec {
   pname = "aiormq";
-  version = "6.7.6";
-  format = "pyproject";
+  version = "6.8.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "mosquito";
     repo = "aiormq";
-    # https://github.com/mosquito/aiormq/issues/189
-    rev = "72c44f55313fc14e2a760a45a09831237b64c48d";
-    hash = "sha256-IIlna8aQY6bIA7OZHthfvMFFWnf3DDRBP1uiFCD7+Do=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-XD1g4JXQJlJyXuZbo4hYW7cwQhy8+p4/inwNw2WOD9Y=";
   };
 
   nativeBuildInputs = [
     poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "pamqp"
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aioswitcher/default.nix b/pkgs/development/python-modules/aioswitcher/default.nix
index 7cb513897cb1f..245f9f44a3aeb 100644
--- a/pkgs/development/python-modules/aioswitcher/default.nix
+++ b/pkgs/development/python-modules/aioswitcher/default.nix
@@ -14,8 +14,8 @@
 
 buildPythonPackage rec {
   pname = "aioswitcher";
-  version = "3.4.1";
-  format = "pyproject";
+  version = "3.4.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
@@ -23,9 +23,11 @@ buildPythonPackage rec {
     owner = "TomerFi";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-jam0pyVajk8z7s/Uk5yQZfbFQLDiJ2yRKDk7VMJpCKo=";
+    hash = "sha256-UpwIzwOl1yKqK8KxFDXAWoZFkQ+1r1sUcDfx6AxRdNw=";
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -50,7 +52,6 @@ buildPythonPackage rec {
     "test_schedule_parser_with_a_daily_recurring_enabled_schedule_data"
     "test_schedule_parser_with_a_partial_daily_recurring_enabled_schedule_data"
     "test_schedule_parser_with_a_non_recurring_enabled_schedule_data"
-    "test_hexadecimale_timestamp_to_localtime_with_the_current_timestamp_should_return_a_time_string"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/birch/default.nix b/pkgs/development/python-modules/birch/default.nix
index 3afd6d3df06a9..1dd4848427e52 100644
--- a/pkgs/development/python-modules/birch/default.nix
+++ b/pkgs/development/python-modules/birch/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , setuptools
 , strct
 , pytestCheckHook
@@ -19,11 +20,24 @@ buildPythonPackage rec {
     hash = "sha256-KdQZzQJvJ+logpcLQfaqqEEZJ/9VmNTQX/a4v0oBC98=";
   };
 
+  patches = [
+    # https://github.com/shaypal5/birch/pull/4
+    (fetchpatch {
+      name = "fix-versioneer-on-python312.patch";
+      url = "https://github.com/shaypal5/birch/commit/84d597b2251ebb76fb15fb70fc86c83baa19dc0b.patch";
+      hash = "sha256-xXADCSIhq1ARny2twzrhR1J8LkMFWFl6tmGxrM8RvkU=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pytest.ini \
       --replace  \
         "--cov" \
         "#--cov"
+
+    # configure correct version, which fails due to missing .git
+    substituteInPlace versioneer.py birch/_version.py \
+      --replace '"0+unknown"' '"${version}"'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index 47c079328a175..66ea0f5c1cf80 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -45,7 +45,7 @@ buildPythonPackage rec {
   version = "4.2.9";
   format = "pyproject";
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/dvc-gdrive/default.nix b/pkgs/development/python-modules/dvc-gdrive/default.nix
new file mode 100644
index 0000000000000..e7b2b0d7c499c
--- /dev/null
+++ b/pkgs/development/python-modules/dvc-gdrive/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, dvc
+, fetchFromGitHub
+, pydrive2
+, pythonOlder
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "dvc-gdrive";
+  version = "3.0.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "iterative";
+    repo = "dvc-gdrive";
+    rev = "refs/tags/${version}";
+    hash = "sha256-oqHSMmwfR24ydJlpXGI3cCxIlF0BwNdgje5zKa0c7FA=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dvc
+    pydrive2
+  ];
+
+  # Circular dependency with dvc
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "dvc_gdrive"
+  ];
+
+  meta = with lib; {
+    description = "Google Drive plugin for DVC";
+    homepage = "https://github.com/iterative/dvc-gdrive";
+    changelog = "https://github.com/iterative/dvc-gdrive/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/dvc-hdfs/default.nix b/pkgs/development/python-modules/dvc-hdfs/default.nix
new file mode 100644
index 0000000000000..b532941e42ba5
--- /dev/null
+++ b/pkgs/development/python-modules/dvc-hdfs/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, dvc
+, fetchFromGitHub
+, fsspec
+, pythonOlder
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "dvc-hdfs";
+  version = "3.0.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "iterative";
+    repo = "dvc-hdfs";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Bo8+El5GC7iyT8SxaJquWFG29BOeilmEMDtTG+RkDGI=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dvc
+    fsspec
+  ] ++ fsspec.optional-dependencies.arrow;
+
+  # Circular dependency with dvc
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "dvc_hdfs"
+  ];
+
+  meta = with lib; {
+    description = "HDFS/WebHDFS plugin for dvc";
+    homepage = "https://github.com/iterative/dvc-hdfs";
+    changelog = "https://github.com/iterative/dvc-hdfs/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/dvc/default.nix b/pkgs/development/python-modules/dvc/default.nix
index 302c6a11e3568..33cddb5b0e996 100644
--- a/pkgs/development/python-modules/dvc/default.nix
+++ b/pkgs/development/python-modules/dvc/default.nix
@@ -1,24 +1,23 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, fetchpatch
-, pythonOlder
-, pythonRelaxDepsHook
-, setuptools-scm
 , appdirs
+, buildPythonPackage
 , colorama
 , configobj
 , distro
 , dpath
 , dvc-azure
 , dvc-data
+, dvc-gdrive
 , dvc-gs
+, dvc-hdfs
 , dvc-http
 , dvc-render
 , dvc-s3
 , dvc-ssh
 , dvc-studio-client
 , dvc-task
+, fetchFromGitHub
+, fetchpatch
 , flatten-dict
 , flufl_lock
 , funcy
@@ -36,10 +35,13 @@
 , pydot
 , pygtrie
 , pyparsing
+, pythonOlder
+, pythonRelaxDepsHook
 , requests
 , rich
 , ruamel-yaml
 , scmrepo
+, setuptools-scm
 , shortuuid
 , shtab
 , tabulate
@@ -56,14 +58,16 @@
 
 buildPythonPackage rec {
   pname = "dvc";
-  version = "3.40.0";
+  version = "3.40.1";
   pyproject = true;
 
+  disabled = pythonOlder "3.8";
+
   src = fetchFromGitHub {
     owner = "iterative";
     repo = "dvc";
     rev = "refs/tags/${version}";
-    hash = "sha256-MSbj8k7ZdjbB3jNq+AZ3gkwjyuT1DpfQuaWlgltsfrk=";
+    hash = "sha256-ik2WVq7cXhOc9kwBep38HELgvj0CGLtpx5EzzdJzAsc=";
   };
 
   pythonRelaxDeps = [
@@ -72,7 +76,8 @@ buildPythonPackage rec {
   ];
 
   postPatch = ''
-    substituteInPlace dvc/analytics.py --replace 'enabled = not os.getenv(DVC_NO_ANALYTICS)' 'enabled = False'
+    substituteInPlace dvc/analytics.py \
+      --replace 'enabled = not os.getenv(DVC_NO_ANALYTICS)' 'enabled = False'
     substituteInPlace dvc/daemon.py \
       --subst-var-by dvc "$out/bin/dcv"
   '';
@@ -135,9 +140,15 @@ buildPythonPackage rec {
     azure = [
       dvc-azure
     ];
+    gdrive = [
+      dvc-gdrive
+    ];
     gs = [
       dvc-gs
     ];
+    hdfs = [
+      dvc-hdfs
+    ];
     s3 = [
       dvc-s3
     ];
diff --git a/pkgs/development/python-modules/flake8-bugbear/default.nix b/pkgs/development/python-modules/flake8-bugbear/default.nix
index 3a24547016c2c..841aac2be5717 100644
--- a/pkgs/development/python-modules/flake8-bugbear/default.nix
+++ b/pkgs/development/python-modules/flake8-bugbear/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "flake8-bugbear";
-  version = "23.12.2";
+  version = "24.1.17";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-5l57t7TMtidp6j4tluz8/af5kgPdD8GKY7B7u/toc8I=";
+    hash = "sha256-dkegdW+yTZVmtDJDo67dSkLvEFaqvOw17FpZA4JgHN0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/griffe/default.nix b/pkgs/development/python-modules/griffe/default.nix
index 74efbd0eb6d7a..ac429dae7ca02 100644
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "griffe";
-  version = "0.39.0";
+  version = "0.39.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "mkdocstrings";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-mVIGT7kb8+eQcTAF7/S+0KraQiDzS9VdyrBsxzqpBHI=";
+    hash = "sha256-1YHfwiQzt348fuyKpr5YXLeAnXzZljargnTugytvNK0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index b6d29b5501f9c..dd3671ef25279 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -15,7 +15,7 @@
 , httpx
 }:
 let
-  version = "1.17.0";
+  version = "1.18.3";
 in
 buildPythonPackage rec {
   pname = "litellm";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "BerriAI";
     repo = "litellm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lH0J5QFjSHOkHZWZQaH5ig6d9vWm7Mj02ssVc6lE4Uo=";
+    hash = "sha256-V4OTEZMyhXDcva7k88uTVH6vJ1EsF549ZmqUqXETsB0=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pamqp/default.nix b/pkgs/development/python-modules/pamqp/default.nix
index 62c568e64818f..b3ad60e7d1c81 100644
--- a/pkgs/development/python-modules/pamqp/default.nix
+++ b/pkgs/development/python-modules/pamqp/default.nix
@@ -2,24 +2,29 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
-  version = "3.2.1";
+  version = "3.3.0";
   pname = "pamqp";
 
   disabled = pythonOlder "3.7";
 
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gmr";
     repo = "pamqp";
     rev = version;
-    hash = "sha256-zvvRoGMNP4NMy3Etjif5MYUPdRqmQXATbFgxaPp1TaM=";
+    hash = "sha256-0vjiPBLd8afnATjmV2sINsBd4j7L544u5DA3jLiLSsY=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
@@ -38,6 +43,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/gmr/pamqp/blob/${src.rev}/docs/changelog.rst";
     description = "RabbitMQ Focused AMQP low-level library";
     homepage = "https://github.com/gmr/pamqp";
     license = licenses.bsd3;
diff --git a/pkgs/development/python-modules/pydrive2/default.nix b/pkgs/development/python-modules/pydrive2/default.nix
index ad2d80c0a5e89..32bb5d78984f3 100644
--- a/pkgs/development/python-modules/pydrive2/default.nix
+++ b/pkgs/development/python-modules/pydrive2/default.nix
@@ -1,19 +1,25 @@
 { lib
+, appdirs
 , buildPythonPackage
 , fetchPypi
+, fsspec
+, funcy
 , google-api-python-client
 , oauth2client
 , pyopenssl
-, pyyaml
 , pythonOlder
+, pyyaml
+, setuptools
+, setuptools-scm
+, tqdm
 }:
 
 buildPythonPackage rec {
   pname = "pydrive2";
   version = "1.19.0";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "PyDrive2";
@@ -21,6 +27,11 @@ buildPythonPackage rec {
     hash = "sha256-Ia6n2idjXCw/cFDgICBhkfOwMFxlUDFebo491Sb4tTE=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
   propagatedBuildInputs = [
     google-api-python-client
     oauth2client
@@ -28,6 +39,16 @@ buildPythonPackage rec {
     pyyaml
   ];
 
+  passthru.optional-dependencies = {
+    fsspec = [
+      appdirs
+      fsspec
+      funcy
+      tqdm
+    ];
+  };
+
+  # Tests require a account and network access
   doCheck = false;
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pyduotecno/default.nix b/pkgs/development/python-modules/pyduotecno/default.nix
index 48f7aa8601e59..d3fbc87e25d85 100644
--- a/pkgs/development/python-modules/pyduotecno/default.nix
+++ b/pkgs/development/python-modules/pyduotecno/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyduotecno";
-  version = "2024.1.1";
+  version = "2024.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Cereal2nd";
     repo = "pyDuotecno";
     rev = "refs/tags/${version}";
-    hash = "sha256-+mPbx678QIV567umbmVKqBTq696pFlFXhlb4cMv54ak=";
+    hash = "sha256-lwtCTzZJn3bamZWbJoeiyxnzrIRZAi9JPjVgiVR0LG8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyosohotwaterapi/default.nix b/pkgs/development/python-modules/pyosohotwaterapi/default.nix
new file mode 100644
index 0000000000000..bd2b10976a070
--- /dev/null
+++ b/pkgs/development/python-modules/pyosohotwaterapi/default.nix
@@ -0,0 +1,63 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+, loguru
+, numpy
+, pythonOlder
+, setuptools
+, unasync
+, urllib3
+}:
+
+buildPythonPackage rec {
+  pname = "pyosohotwaterapi";
+  version = "1.1.4";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "osohotwateriot";
+    repo = "apyosohotwaterapi";
+    rev = "refs/tags/${version}";
+    hash = "sha256-7FLGmmndrFqSl4oC8QFIYNlFJPr+xbiZG5ZRt4vx8+s=";
+  };
+
+  postPatch = ''
+    # https://github.com/osohotwateriot/apyosohotwaterapi/pull/3
+    substituteInPlace requirements.txt \
+      --replace "pre-commit" ""
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    unasync
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    loguru
+    numpy
+    urllib3
+  ];
+
+  preBuild = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "apyosoenergyapi"
+  ];
+
+  meta = with lib; {
+    description = "Module for using the OSO Hotwater API";
+    homepage = "https://github.com/osohotwateriot/apyosohotwaterapi";
+    changelog = "https://github.com/osohotwateriot/apyosohotwaterapi/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyprusalink/default.nix b/pkgs/development/python-modules/pyprusalink/default.nix
index 0a1d8afc3bd1c..0356f899594b6 100644
--- a/pkgs/development/python-modules/pyprusalink/default.nix
+++ b/pkgs/development/python-modules/pyprusalink/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyprusalink";
-  version = "2.0.0";
+  version = "2.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-wboyISggzC50cZ+J/NC0ytWXwCLBmBpP9/MtPkRb+Zs=";
+    hash = "sha256-wwH4LE8wi8eb7QwT7N1mNtVleoWscDEOu2vrXKDktwU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-ansible/default.nix b/pkgs/development/python-modules/pytest-ansible/default.nix
index 705c578f3bd5f..b73ae05a8cce4 100644
--- a/pkgs/development/python-modules/pytest-ansible/default.nix
+++ b/pkgs/development/python-modules/pytest-ansible/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-ansible";
-  version = "24.1.1";
+  version = "24.1.2";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "ansible";
     repo = "pytest-ansible";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UPQx+CGJgaK4XVNngtzzncSueQN9LWh1gMmH5nGtPNk=";
+    hash = "sha256-NtGk+azpSZZm9PUf6Q1Qipo/zaUH+bed7k3oFnQyKjw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-tado/default.nix b/pkgs/development/python-modules/python-tado/default.nix
index 80687b9d3e1f5..60247f15d95bd 100644
--- a/pkgs/development/python-modules/python-tado/default.nix
+++ b/pkgs/development/python-modules/python-tado/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "python-tado";
-  version = "0.17.3";
+  version = "0.17.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.5";
@@ -16,9 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "wmalgadey";
     repo = "PyTado";
-    # https://github.com/wmalgadey/PyTado/issues/62
     rev = "refs/tags/${version}";
-    hash = "sha256-whpNYiAb2cqKI4m0HJN2lPt51FLuEzrkrRTSWs6uznU=";
+    hash = "sha256-Wdd9HdsQjaYlL8knhMuO87+dom+aTsmrLRK0UdrpsbQ=";
   };
 
   propagatedBuildInputs = [
@@ -30,9 +29,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description =
-      "Python binding for Tado web API. Pythonize your central heating!";
+    description = "Python binding for Tado web API. Pythonize your central heating!";
     homepage = "https://github.com/wmalgadey/PyTado";
+    changelog = "https://github.com/wmalgadey/PyTado/releases/tag/${version}";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ jamiemagee ];
   };
diff --git a/pkgs/development/python-modules/strct/default.nix b/pkgs/development/python-modules/strct/default.nix
index 7244002d41694..061e2a90c07c8 100644
--- a/pkgs/development/python-modules/strct/default.nix
+++ b/pkgs/development/python-modules/strct/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , buildPythonPackage
 , setuptools
 , pytestCheckHook
@@ -18,11 +19,24 @@ buildPythonPackage rec {
     hash = "sha256-ctafvdfSOdp7tlCUYg7d5XTXR1qBcWvOVtGtNUnhYIw=";
   };
 
+  patches = [
+    # https://github.com/shaypal5/strct/pull/4
+    (fetchpatch {
+      name = "fix-versioneer-on-python312.patch";
+      url = "https://github.com/shaypal5/strct/commit/a1e5b6ca9045b52efdfdbb3c82e12a01e251d41b.patch";
+      hash = "sha256-xXADCSIhq1ARny2twzrhR1J8LkMFWFl6tmGxrM8RvkU=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pytest.ini \
       --replace  \
         "--cov" \
         "#--cov"
+
+    # configure correct version, which fails due to missing .git
+    substituteInPlace versioneer.py strct/_version.py \
+      --replace '"0+unknown"' '"${version}"'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/svg2tikz/default.nix b/pkgs/development/python-modules/svg2tikz/default.nix
index 257a901aa7209..7e24071c9c7c2 100644
--- a/pkgs/development/python-modules/svg2tikz/default.nix
+++ b/pkgs/development/python-modules/svg2tikz/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "svg2tikz";
-  version = "3.0.0";
+  version = "3.0.1";
 
   disabled = pythonOlder "3.7";
 
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "xyz2tex";
     repo = "svg2tikz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YnWkj4xvjGzpKQv+H+spage+dy+fC9fJkqsOaQ6C1Ho=";
+    hash = "sha256-hvGvJFxhu7llj+tFfZvz12dZ8QYjY7zcLzB5S44l+IM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index 3199218ef6599..5e104532e2670 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.0.8";
+  version = "4.0.10";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FvMFC1h3gu61jZPSPmxYHQmxnxYKmtYAecc/0IT9E8I=";
+    hash = "sha256-NuM7EUXl1QW0HyUPGAyeVDI5Dht4CMu/ufULKNW0bNw=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/types-psycopg2/default.nix b/pkgs/development/python-modules/types-psycopg2/default.nix
index ba256ebc78de2..0e13f5be9f868 100644
--- a/pkgs/development/python-modules/types-psycopg2/default.nix
+++ b/pkgs/development/python-modules/types-psycopg2/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-psycopg2";
-  version = "2.9.21.20240106";
+  version = "2.9.21.20240118";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DQo1BElxS6KESMTxCgo67Dbp4+/RRQcw4ifhe3BKS+o=";
+    hash = "sha256-5KBjFufJaQJVF1w+5d/6W0fFBX8XGB9eNMbc2zQGbzU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 3d6b7b06ac833..7b35a15a6d80e 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.1.66";
+  version = "3.1.67";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-hvl29/K4qHvDiXM0Ufmi3ExMq+2JXQbSzaFYCCP0OhU=";
+    hash = "sha256-mwXR4KEkbkvWIwqeHuQPgm+8W7EdBtAwcBkFx0YFlhs=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/misc/rsonpath/default.nix b/pkgs/development/tools/misc/rsonpath/default.nix
index 76d6e4d4291ca..26b25b1b5d949 100644
--- a/pkgs/development/tools/misc/rsonpath/default.nix
+++ b/pkgs/development/tools/misc/rsonpath/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rsonpath";
-  version = "0.8.4";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "v0ldek";
     repo = "rsonpath";
     rev = "v${version}";
-    hash = "sha256-V7Ir1FGKjKYu/J2KSBaDwLdH/MHTS+aChHWcrVTu4dY=";
+    hash = "sha256-p1cbxEvnV5vR1fznNbglHfKa53DboIFJqEWAXBLoQ+s=";
   };
 
-  cargoHash = "sha256-eiYUlHA4vK/zhfULwekt3dRVx//u5mrQ6tRdQh0tmTc=";
+  cargoHash = "sha256-rVJbrHsbSF8ZF44gmCUFxlGGhloC/kLBT5vSJjglxHE=";
 
   cargoBuildFlags = [ "-p=rsonpath" ];
   cargoTestFlags = cargoBuildFlags;
diff --git a/pkgs/development/tools/reindeer/default.nix b/pkgs/development/tools/reindeer/default.nix
index bcb022ee10bd8..37def64e68f5d 100644
--- a/pkgs/development/tools/reindeer/default.nix
+++ b/pkgs/development/tools/reindeer/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "unstable-2024-01-11";
+  version = "unstable-2024-01-12";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = pname;
-    rev = "ff28220b43defa70f8cae77d7aa139a2f6048bf3";
-    sha256 = "sha256-jh0Gq29OUp7QmSd3sT9pC9OlCnyx8lHJEAEG7eBw448=";
+    rev = "8815ee8ac5463b7004751ff8db73d7daf0b281c4";
+    sha256 = "sha256-GIIvfiCzm/dpIZB1S1wCs1/VifKzvwZ+RYXVbjNDEY4=";
   };
 
-  cargoSha256 = "sha256-3F1Df66JgZnQbt1zHNOClJPb6IB7crwvCdy7YA4UIKA=";
+  cargoSha256 = "sha256-iAmwxOZTW5zLhufJG5U6m2h/yXck6NvmwXd2tsvBZh8=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs =
diff --git a/pkgs/development/tools/xc/default.nix b/pkgs/development/tools/xc/default.nix
index 441c995517f62..0e09b77e453e2 100644
--- a/pkgs/development/tools/xc/default.nix
+++ b/pkgs/development/tools/xc/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "xc";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "joerdav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ndaffdU+DYuILZzAwsjLTNWFWbq7CrTcAYBA0j3T3gA=";
+    sha256 = "sha256-vTyCS85xbJnAgbasWD6LFxij9EezzlJ1pyvCJptqmOU=";
   };
 
-  vendorHash = "sha256-AwlXX79L69dv6wbFtlbHAeZRuOeDy/r6KSiWwjoIgWw=";
+  vendorHash = "sha256-EbIuktQ2rExa2DawyCamTrKRC1yXXMleRB8/pcKFY5c=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/web/bun/default.nix b/pkgs/development/web/bun/default.nix
index 2f492ed603f56..bec04649d3cef 100644
--- a/pkgs/development/web/bun/default.nix
+++ b/pkgs/development/web/bun/default.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.0.22";
+  version = "1.0.23";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -51,19 +51,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-DbpDJe7QfWa+QK31mqmWUxJ9O/CUhDHk2RILBo5d1+A=";
+        hash = "sha256-qWg2WdWQHAYXLkIQd2RPQ2j1Bo3qKHhlxcFaqDIxcks=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-dROAnP6cTX4uteDdIXTFg/h+DX6IanRw2EuQgOev5xc=";
+        hash = "sha256-nojMZknNXG+pMsSWx7SkkcAweeXtF3W+XC8+QvQHtD4=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64.zip";
-        hash = "sha256-ZkFXtiUFsR2XX97vYHXvGVm0FulInL0d+44TvUZA+0U=";
+        hash = "sha256-MQjeSKVYtKwVMq9p2NLZZPaxdEJJYzDLQ6xusR8qZGM=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-+TCpIiI1s84TxOq+5YPfETKqgPUxgkdZDeM5KNyoZfY=";
+        hash = "sha256-IPQ4W8B4prlLljf7OviGpYtqNxSxMB1kHCMOrnbxldw=";
       };
     };
     updateScript = writeShellScript "update-bun" ''
diff --git a/pkgs/misc/rivalcfg/default.nix b/pkgs/misc/rivalcfg/default.nix
index f6b45af3af348..3633fa0878c1e 100644
--- a/pkgs/misc/rivalcfg/default.nix
+++ b/pkgs/misc/rivalcfg/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "rivalcfg";
-  version = "4.8.0";
+  version = "4.10.0";
 
   src = fetchFromGitHub {
     owner = "flozz";
     repo = "rivalcfg";
-    rev = "v${version}";
-    sha256 = "sha256-fCl+XY+R+QF7jWLkqii4v0sbXr7xoX3A3upm+XoBAms=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-8/2jEwEKdBGv31eQKao631siyUDlbtcy0HwP4+OGSok=";
   };
 
   propagatedBuildInputs = with python3Packages; [ hidapi setuptools ];
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index c8ac88c11528b..99e9660603e43 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -695,23 +695,23 @@ let
       VBOXGUEST = option no;
       DRM_VBOXVIDEO = option no;
 
-      XEN                         = mkIf stdenv.is64bit (option yes);
-      XEN_DOM0                    = mkIf stdenv.is64bit (option yes);
-      PCI_XEN                     = mkIf stdenv.is64bit (option yes);
-      HVC_XEN                     = mkIf stdenv.is64bit (option yes);
-      HVC_XEN_FRONTEND            = mkIf stdenv.is64bit (option yes);
-      XEN_SYS_HYPERVISOR          = mkIf stdenv.is64bit (option yes);
-      SWIOTLB_XEN                 = mkIf stdenv.is64bit (option yes);
-      XEN_BACKEND                 = mkIf stdenv.is64bit (option yes);
-      XEN_BALLOON                 = mkIf stdenv.is64bit (option yes);
-      XEN_BALLOON_MEMORY_HOTPLUG  = mkIf stdenv.is64bit (option yes);
-      XEN_EFI                     = mkIf stdenv.is64bit (option yes);
-      XEN_HAVE_PVMMU              = mkIf stdenv.is64bit (option yes);
-      XEN_MCE_LOG                 = mkIf stdenv.is64bit (option yes);
-      XEN_PVH                     = mkIf stdenv.is64bit (option yes);
-      XEN_PVHVM                   = mkIf stdenv.is64bit (option yes);
-      XEN_SAVE_RESTORE            = mkIf stdenv.is64bit (option yes);
-      XEN_SELFBALLOONING          = mkIf stdenv.is64bit (whenOlder "5.3" yes);
+      XEN                         = option yes;
+      XEN_DOM0                    = option yes;
+      PCI_XEN                     = option yes;
+      HVC_XEN                     = option yes;
+      HVC_XEN_FRONTEND            = option yes;
+      XEN_SYS_HYPERVISOR          = option yes;
+      SWIOTLB_XEN                 = option yes;
+      XEN_BACKEND                 = option yes;
+      XEN_BALLOON                 = option yes;
+      XEN_BALLOON_MEMORY_HOTPLUG  = option yes;
+      XEN_EFI                     = option yes;
+      XEN_HAVE_PVMMU              = option yes;
+      XEN_MCE_LOG                 = option yes;
+      XEN_PVH                     = option yes;
+      XEN_PVHVM                   = option yes;
+      XEN_SAVE_RESTORE            = option yes;
+      XEN_SELFBALLOONING          = whenOlder "5.3" yes;
 
       # Enable device detection on virtio-mmio hypervisors
       VIRTIO_MMIO_CMDLINE_DEVICES = yes;
diff --git a/pkgs/servers/fastnetmon-advanced/default.nix b/pkgs/servers/fastnetmon-advanced/default.nix
index 6d4fed7a7356e..8f11df7048ad6 100644
--- a/pkgs/servers/fastnetmon-advanced/default.nix
+++ b/pkgs/servers/fastnetmon-advanced/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fastnetmon-advanced";
-  version = "2.0.357";
+  version = "2.0.358";
 
   src = fetchurl {
     url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_jammy/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
-    hash = "sha256-AiFJaTyMDCp1fFLhdwxnj5rK+RrZt5ZB0zgaf7YRFtw=";
+    hash = "sha256-qL+LxePCZnSpbeeNANvI/f8ntNStHe02fSqMA+XKFng=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/audio/beets/builtin-plugins.nix b/pkgs/tools/audio/beets/builtin-plugins.nix
index e3bc102104418..ae6b7e17b26dc 100644
--- a/pkgs/tools/audio/beets/builtin-plugins.nix
+++ b/pkgs/tools/audio/beets/builtin-plugins.nix
@@ -14,6 +14,7 @@
   absubmit = {
     enable = lib.elem stdenv.hostPlatform.system essentia-extractor.meta.platforms;
     wrapperBins = [ essentia-extractor ];
+    testPaths = [ ];
   };
   acousticbrainz.propagatedBuildInputs = [ python3Packages.requests ];
   albumtypes = { };
diff --git a/pkgs/tools/misc/jfrog-cli/default.nix b/pkgs/tools/misc/jfrog-cli/default.nix
index 51b6422c086d5..1f46369070573 100644
--- a/pkgs/tools/misc/jfrog-cli/default.nix
+++ b/pkgs/tools/misc/jfrog-cli/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "jfrog-cli";
-  version = "2.52.8";
+  version = "2.52.9";
 
   src = fetchFromGitHub {
     owner = "jfrog";
     repo = "jfrog-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-u7hq0VHHcSZ7uiYEz6cqZ7CN0iwKRSwKmAh5+Hf17WU=";
+    hash = "sha256-VzItfVmt/+B+rTBxKIjhdrI1B+Xq2ca/VG+EXm99Bw4=";
   };
 
-  vendorHash = "sha256-xLkzoQWT4jRBC5+11pAboxlynu+cmhynMnh3yh+qn/8=";
+  vendorHash = "sha256-zGhVAcTQN//YIQQhD9qLN5BTJZ54cVGj1NZd6NXNgjI=";
 
   postInstall = ''
     # Name the output the same way as the original build script does
diff --git a/pkgs/tools/misc/qt5ct/default.nix b/pkgs/tools/misc/qt5ct/default.nix
index d9ee0358a76aa..38f9f10d9838c 100644
--- a/pkgs/tools/misc/qt5ct/default.nix
+++ b/pkgs/tools/misc/qt5ct/default.nix
@@ -23,7 +23,7 @@ mkDerivation rec {
 
   meta = with lib; {
     description = "Qt5 Configuration Tool";
-    homepage = "https://www.opendesktop.org/content/show.php?content=168066";
+    homepage = "https://sourceforge.net/projects/qt5ct/";
     platforms = platforms.linux;
     license = licenses.bsd2;
     maintainers = with maintainers; [ ralith ];
diff --git a/pkgs/tools/misc/tz/default.nix b/pkgs/tools/misc/tz/default.nix
index 58cf17384ee3d..4059125353f71 100644
--- a/pkgs/tools/misc/tz/default.nix
+++ b/pkgs/tools/misc/tz/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tz";
-  version = "0.6.3";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "oz";
     repo = "tz";
     rev = "v${version}";
-    sha256 = "sha256-yeCoBDorwwj3+tqKzoAjtMdYmjqscks/qU8EkmO/D5k=";
+    sha256 = "sha256-Mnb0GdJ9dgaUanWBP5JOo6++6MfrUgncBRp4NIbhxf0=";
   };
 
   vendorHash = "sha256-lcCra4LyebkmelvBs0Dd2mn6R64Q5MaUWc5AP8V9pec=";
diff --git a/pkgs/tools/networking/dnsperf/default.nix b/pkgs/tools/networking/dnsperf/default.nix
index 7c8913a7f4304..5be21155feea8 100644
--- a/pkgs/tools/networking/dnsperf/default.nix
+++ b/pkgs/tools/networking/dnsperf/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dnsperf";
-  version = "2.13.1";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "DNS-OARC";
     repo = "dnsperf";
     rev = "v${version}";
-    hash = "sha256-iNTuLcN9bsBPyXZ8SL96moFaI2pTcEhFey8+4xo9iyk=";
+    hash = "sha256-eDDVNFMjj+0wEBe1qO6r4Bai554Sp+EmP86reJ/VXGk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/gost/default.nix b/pkgs/tools/networking/gost/default.nix
index f36ee2d3e206e..6e7743fb990ca 100644
--- a/pkgs/tools/networking/gost/default.nix
+++ b/pkgs/tools/networking/gost/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, buildGoModule }:
+{ stdenv, lib, fetchFromGitHub, buildGoModule, fetchpatch }:
 
 buildGoModule rec {
   pname = "gost";
@@ -11,7 +11,15 @@ buildGoModule rec {
     sha256 = "sha256-UBjrWeBw9+qKQ/+1T1W/3e0vrigp540URIyM2d9iCE8=";
   };
 
-  vendorHash = "sha256-lA4uW0cc0XqU9pjVEMapFLb3eD20Lea9PbkgL3sjJns=";
+  patches = [
+    # Add go1.20 support. Remove with the next release.
+    (fetchpatch {
+      url = "https://github.com/ginuerzh/gost/commit/0f7376bd10c913c7e6b1e7e02dd5fd7769975d78.patch";
+      hash = "sha256-pQNCvl7/huNrkM3+XHkGnvLYCzdjbMV6nef1KcMnKEw=";
+    })
+  ];
+
+  vendorHash = "sha256-wAdNfhSPj9JUcI6Gcja6nRy68bVhV8B4PARR0WS9rjQ=";
 
   postPatch = ''
     substituteInPlace http2_test.go \
@@ -41,8 +49,9 @@ buildGoModule rec {
       --replace '{url.UserPassword("AES-256-GCM", "123456"), url.UserPassword("AES-256-GCM", "123456"), true},' ""
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "A simple tunnel written in golang";
     homepage = "https://github.com/ginuerzh/gost";
     license = licenses.mit;
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index 9412973404395..ffcf397ea1a17 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "i2pd";
-  version = "2.50.1";
+  version = "2.50.2";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "sha256-LFr6vqhGu830xHLSp7kHud4gNWhDDYXfJ3PB01JmHjQ=";
+    sha256 = "sha256-6BzY7t+bFYYwKnj+uuX+vWHg0w0BOuMGwgMg1yIF578=";
   };
 
   buildInputs = [ boost zlib openssl ]
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 0f1cc974b4b3b..e7e31b204d470 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sudo";
-  version = "1.9.15p4";
+  version = "1.9.15p5";
 
   src = fetchurl {
     url = "https://www.sudo.ws/dist/${pname}-${version}.tar.gz";
-    hash = "sha256-LiDsmGXu7qExbG9J7GrEZ4hptonU2QtEJDv0iH1t1TI=";
+    hash = "sha256-VY0QuaGZH7O5+n+nsH7EQFt677WzywsIcdvIHjqI5Vg=";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/system/datefudge/default.nix b/pkgs/tools/system/datefudge/default.nix
index e32fb70e2e094..f1810c24a8fe7 100644
--- a/pkgs/tools/system/datefudge/default.nix
+++ b/pkgs/tools/system/datefudge/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "datefudge";
-  version = "1.24";
+  version = "1.25";
 
   src = fetchgit {
     url = "https://salsa.debian.org/debian/${pname}.git";
     rev = "debian/${version}";
-    sha256 = "1nh433yx4y4djp0bs6aawqbwk7miq7fsbs9wpjlyh2k9dvil2lrm";
+    sha256 = "sha256-FDrwd5kahIfKGfUBIm7BBuqHwrQ/+UE1gRQrJNd031o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/text/fanficfare/default.nix b/pkgs/tools/text/fanficfare/default.nix
index 7d27a45b56fd1..f60832e29bc2e 100644
--- a/pkgs/tools/text/fanficfare/default.nix
+++ b/pkgs/tools/text/fanficfare/default.nix
@@ -2,20 +2,28 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "FanFicFare";
-  version = "4.25.0";
+  version = "4.29.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ky6N/AcfoXJahW7tw++WtnpTnpRv4ZUraMTWjVXDjEE=";
+    hash = "sha256-dfPb/PWguUIUAR3EdriPygs5sozc69WZmN9bcqrNPFM=";
   };
 
+  nativeBuildInputs = with python3Packages; [
+    setuptools
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     beautifulsoup4
+    brotli
     chardet
     cloudscraper
     html5lib
     html2text
+    requests
     requests-file
+    urllib3
   ];
 
   doCheck = false; # no tests exist
diff --git a/pkgs/tools/virtualization/govc/default.nix b/pkgs/tools/virtualization/govc/default.nix
index 9c9fb8f2c8fba..e3fd16538e4d3 100644
--- a/pkgs/tools/virtualization/govc/default.nix
+++ b/pkgs/tools/virtualization/govc/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "govc";
-  version = "0.34.1";
+  version = "0.34.2";
 
   subPackages = [ "govc" ];
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "sha256-c31omDUjd5VywvYNLTjk5FQlqNRnFPLJ0eVEJLdF6N0=";
+    sha256 = "sha256-UrGHuzUZvXWZRy4VJ1HlMBs2C8MuaUYhM6dlYIoG7vE=";
   };
 
   vendorHash = "sha256-1Y2Q2Ep3aqhUCSWey+sD4m7CgVEjlPt6ri3OKV8eERU=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 422445d87e1d6..ffbd3aca4be7b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1043,7 +1043,7 @@ with pkgs;
 
   fetchpijul = callPackage ../build-support/fetchpijul { };
 
-  inherit (callPackage ../build-support/node/fetch-yarn-deps { })
+  inherit (callPackages ../build-support/node/fetch-yarn-deps { })
     prefetch-yarn-deps
     fetchYarnDeps;
 
@@ -1921,7 +1921,7 @@ with pkgs;
 
   immich-cli = callPackage ../tools/misc/immich-cli { };
 
-  inherit (callPackage ../tools/networking/ivpn/default.nix {}) ivpn ivpn-service;
+  inherit (callPackages ../tools/networking/ivpn/default.nix {}) ivpn ivpn-service;
 
   jobber = callPackage ../tools/system/jobber { };
 
@@ -4406,7 +4406,7 @@ with pkgs;
   buttercup-desktop = callPackage ../tools/security/buttercup-desktop { };
 
   charles = charles4;
-  inherit (callPackage ../applications/networking/charles {})
+  inherit (callPackages ../applications/networking/charles {})
     charles3
     charles4
   ;
@@ -4759,7 +4759,7 @@ with pkgs;
 
   copyright-update = callPackage ../tools/text/copyright-update { };
 
-  inherit (callPackage ../tools/misc/coreboot-utils { })
+  inherit (callPackages ../tools/misc/coreboot-utils { })
     msrtool
     cbmem
     ifdtool
@@ -8471,7 +8471,7 @@ with pkgs;
 
   gaphor = python3Packages.callPackage ../tools/misc/gaphor { };
 
-  inherit (callPackage ../tools/filesystems/garage {
+  inherit (callPackages ../tools/filesystems/garage {
     inherit (darwin.apple_sdk.frameworks) Security;
   })
     garage
@@ -8810,7 +8810,7 @@ with pkgs;
   goreplay = callPackage ../tools/networking/goreplay { };
 
   gost = callPackage ../tools/networking/gost {
-    buildGoModule = buildGo119Module; # go 1.20 build failure
+    buildGoModule = buildGo120Module; # go 1.21 build failure
   };
 
   gource = callPackage ../applications/version-management/gource { };
@@ -11205,7 +11205,7 @@ with pkgs;
 
   grocy = callPackage ../servers/grocy { };
 
-  inherit (callPackage ../servers/nextcloud {})
+  inherit (callPackages ../servers/nextcloud {})
     nextcloud26 nextcloud27 nextcloud28;
 
   nextcloud26Packages = callPackage ../servers/nextcloud/packages {
@@ -11238,7 +11238,7 @@ with pkgs;
 
   noip = callPackage ../tools/networking/noip { };
 
-  inherit (callPackage ../applications/networking/cluster/nomad { })
+  inherit (callPackages ../applications/networking/cluster/nomad { })
     nomad
     nomad_1_4
     nomad_1_5
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3d1415d4140f7..d9c4a3371db2a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3474,8 +3474,12 @@ self: super: with self; {
 
   dvc-data = callPackage ../development/python-modules/dvc-data {  };
 
+  dvc-gdrive = callPackage ../development/python-modules/dvc-gdrive {  };
+
   dvc-gs = callPackage ../development/python-modules/dvc-gs { };
 
+  dvc-hdfs = callPackage ../development/python-modules/dvc-hdfs {  };
+
   dvc-http = callPackage ../development/python-modules/dvc-http {  };
 
   dvc-objects = callPackage ../development/python-modules/dvc-objects {  };
@@ -10928,6 +10932,8 @@ self: super: with self; {
     inherit (pkgs) lz4;
   };
 
+  pyosohotwaterapi = callPackage ../development/python-modules/pyosohotwaterapi { };
+
   pyotgw = callPackage ../development/python-modules/pyotgw { };
 
   pyotp = callPackage ../development/python-modules/pyotp { };