Merge master into staging-next

145 files changed, 1320 insertions, 542 deletions

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3d88282a854c2..edb4f243cc102 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17819,6 +17819,12 @@
       fingerprint = "E628 C811 6FB8 1657 F706  4EA4 F251 ADDC 9D04 1C7E";
     }];
   };
+  sailord = {
+    name = "Sailord";
+    email = "sailord328@gmail.com";
+    github = "Sail0rd";
+    githubId = 55802415;
+  };
   samalws = {
     email = "sam@samalws.com";
     name = "Sam Alws";
@@ -20692,6 +20698,11 @@
     githubId = 9870613;
     name = "Hubert Mühlhans";
   };
+  trishtzy = {
+    github = "trishtzy";
+    githubId = 5356506;
+    name = "Tricia Tan";
+  };
   trobert = {
     email = "thibaut.robert@gmail.com";
     github = "trobert";
@@ -21892,6 +21903,12 @@
     github = "wr0belj";
     githubId = 40501814;
   };
+  wr7 = {
+    name = "wr7";
+    email = "d-wr7@outlook.com";
+    github = "wr7";
+    githubId = 53203261;
+  };
   wraithm = {
     name = "Matthew Wraith";
     email = "wraithm@gmail.com";
diff --git a/pkgs/applications/audio/ncspot/default.nix b/pkgs/applications/audio/ncspot/default.nix
index 1bc391b4b55c8..d5abb66d23981 100644
--- a/pkgs/applications/audio/ncspot/default.nix
+++ b/pkgs/applications/audio/ncspot/default.nix
@@ -20,16 +20,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "hrkfdn";
     repo = "ncspot";
     rev = "v${version}";
-    hash = "sha256-RgA3jV/vD6qgIVQCZ0Sm+9CST4SlqN4MUurVM3nIdh0=";
+    hash = "sha256-Sl4i9HFl+Dth9jmW6hPZzgh0Y35pRo1Xi9LRxCuSIP4=";
   };
 
-  cargoHash = "sha256-8ZUgm1O4NmZpxgNRKnh1MNhiFNoBWQHo22kyP3hWJwI=";
+  cargoHash = "sha256-INgDavtBI75h+qVlxTncYu3su+SH/D7HTlThRHJzwkY=";
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optional withClipboard python3;
diff --git a/pkgs/applications/emulators/retroarch/hashes.json b/pkgs/applications/emulators/retroarch/hashes.json
index 4115c489b2e4e..ead0a41cbe3c5 100644
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@@ -419,10 +419,10 @@
         "src": {
             "owner": "libretro",
             "repo": "mame2000-libretro",
-            "rev": "1472da3a39ab14fff8325b1f51a1dfdb8eabb5c8",
-            "hash": "sha256-Nd5OqkoMJZ8TzEZGqDT0YX6lHK/H3I5EqJ841PteLi8="
+            "rev": "905808fbcc3adf8c610c1c60f0e41ce4b35db1c5",
+            "hash": "sha256-2J3QGlSb4YhDZND4T0wmt9zzDjOuNiscsMxn9zA1TtI="
         },
-        "version": "unstable-2023-10-31"
+        "version": "unstable-2024-05-07"
     },
     "mame2003": {
         "fetcher": "fetchFromGitHub",
@@ -652,11 +652,11 @@
         "src": {
             "owner": "jpd002",
             "repo": "Play-",
-            "rev": "9f8d623f5d7e6a9bb6fa7ff30ce4d5b1fdf72a1e",
-            "hash": "sha256-DtPIAQGHXR3urmKeFXNfKIdqQVU3HrrH6M28Ctwj3eI=",
+            "rev": "700a44a1548d099705c901203414724518c90d43",
+            "hash": "sha256-OZO8vVA2B/SdckC2Rm/v35cdJDzkpdU9lJhFYEyyl1U=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-05-01"
+        "version": "unstable-2024-05-05"
     },
     "ppsspp": {
         "fetcher": "fetchFromGitHub",
diff --git a/pkgs/applications/emulators/wine/base.nix b/pkgs/applications/emulators/wine/base.nix
index b290a324f9700..1c62a9aad97d3 100644
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -12,10 +12,9 @@
 with import ./util.nix { inherit lib; };
 
 let
-  patches' = patches;
   prevName = pname;
-  prevPlatforms = platforms;
   prevConfigFlags = configureFlags;
+
   setupHookDarwin = makeSetupHook {
     name = "darwin-mingw-hook";
     substitutions = {
@@ -23,30 +22,37 @@ let
       mingwGccsSuffixSalts = map (gcc: gcc.suffixSalt) mingwGccs;
     };
   } ./setup-hook-darwin.sh;
-  darwinUnsupportedFlags = [ "alsaSupport" "cairoSupport" "dbusSupport" "fontconfigSupport" "gtkSupport" "netapiSupport" "pulseaudioSupport" "udevSupport" "v4lSupport" "vaSupport" "waylandSupport" "x11Support" "xineramaSupport" ];
-  darwinUnsupported = builtins.any (name: builtins.getAttr name supportFlags) darwinUnsupportedFlags;
+
+  darwinFrameworks = lib.optionals stdenv.isDarwin (
+    toBuildInputs pkgArches (pkgs: with pkgs.buildPackages.darwin.apple_sdk.frameworks; [
+      CoreServices Foundation ForceFeedback AppKit OpenGL IOKit DiskArbitration PCSC Security
+      ApplicationServices AudioToolbox CoreAudio AudioUnit CoreMIDI OpenCL Cocoa Carbon
+    ])
+  );
+  # Building Wine with these flags isn’t supported on Darwin. Using any of them will result in an evaluation failures
+  # because they will put Darwin in `meta.badPlatforms`.
+  darwinUnsupportedFlags = [
+    "alsaSupport" "cairoSupport" "dbusSupport" "fontconfigSupport" "gtkSupport" "netapiSupport" "pulseaudioSupport"
+    "udevSupport" "v4lSupport" "vaSupport" "waylandSupport" "x11Support" "xineramaSupport"
+  ];
+
+  badPlatforms = lib.optional (!supportFlags.mingwSupport || lib.any (flag: supportFlags.${flag}) darwinUnsupportedFlags) "x86_64-darwin";
 in
-stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
-  builder = buildScript;
-}) // (lib.optionalAttrs stdenv.isDarwin {
-  postConfigure = ''
-    # dynamic fallback, so this shouldn’t cause problems for older versions of macOS and will
-    # provide additional functionality on newer ones. This can be removed once the x86_64-darwin
-    # SDK is updated.
-    sed 's|/\* #undef HAVE_MTLDEVICE_REGISTRYID \*/|#define HAVE_MTLDEVICE_REGISTRYID 1|' \
-      -i include/config.h
-  '';
-  postBuild = ''
-    # The Wine preloader must _not_ be linked to any system libraries, but `NIX_LDFLAGS` will link
-    # to libintl, libiconv, and CoreFoundation no matter what. Delete the one that was built and
-    # rebuild it with empty NIX_LDFLAGS.
-    for preloader in wine-preloader wine64-preloader; do
-      rm loader/$preloader &> /dev/null \
-      && ( echo "Relinking loader/$preloader"; make loader/$preloader NIX_LDFLAGS="" NIX_LDFLAGS_${stdenv.cc.suffixSalt}="" ) \
-      || echo "loader/$preloader not built, skipping relink."
-    done
-  '';
-}) // rec {
+stdenv.mkDerivation (finalAttrs:
+lib.optionalAttrs (buildScript != null) { builder = buildScript; }
+// lib.optionalAttrs stdenv.isDarwin {
+    postBuild = ''
+      # The Wine preloader must _not_ be linked to any system libraries, but `NIX_LDFLAGS` will link
+      # to libintl, libiconv, and CoreFoundation no matter what. Delete the one that was built and
+      # rebuild it with empty NIX_LDFLAGS.
+      for preloader in wine-preloader wine64-preloader; do
+        rm loader/$preloader &> /dev/null \
+        && ( echo "Relinking loader/$preloader"; make loader/$preloader NIX_LDFLAGS="" NIX_LDFLAGS_${stdenv.cc.suffixSalt}="" ) \
+        || echo "loader/$preloader not built, skipping relink."
+      done
+    '';
+}
+// {
   inherit version src;
 
   pname = prevName + lib.optionalString (wineRelease != "stable" && wineRelease != "unstable") "-${wineRelease}";
@@ -95,10 +101,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
   ++ lib.optionals openclSupport [ pkgs.opencl-headers pkgs.ocl-icd ]
   ++ lib.optionals tlsSupport    [ pkgs.openssl pkgs.gnutls ]
   ++ lib.optionals (openglSupport && !stdenv.isDarwin) [ pkgs.libGLU pkgs.libGL pkgs.mesa.osmesa pkgs.libdrm ]
-  ++ lib.optionals stdenv.isDarwin (with pkgs.buildPackages.darwin.apple_sdk.frameworks; [
-     CoreServices Foundation ForceFeedback AppKit OpenGL IOKit DiskArbitration PCSC Security
-     ApplicationServices AudioToolbox CoreAudio AudioUnit CoreMIDI OpenCL Cocoa Carbon
-  ])
+  ++ lib.optionals stdenv.isDarwin darwinFrameworks
   ++ lib.optionals (x11Support) (with pkgs.xorg; [
     libX11 libXcomposite libXcursor libXext libXfixes libXi libXrandr libXrender libXxf86vm
   ])
@@ -107,29 +110,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
      mesa # for libgbm
   ])));
 
-  patches = [ ]
-    ++ lib.optionals stdenv.isDarwin [
-      # Wine uses `MTLDevice.registryID` in `winemac.drv`, but that property is not available in
-      # the 10.12 SDK (current SDK on x86_64-darwin). That can be worked around by using selector
-      # syntax. As of Wine 8.12, the logic has changed and uses selector syntax, but it still
-      # uses property syntax in one place. The first patch is necessary only with older
-      # versions of Wine. The second is needed on all versions of Wine.
-      (lib.optional (lib.versionOlder version "8.12") ./darwin-metal-compat-pre8.12.patch)
-      (lib.optional (lib.versionOlder version "8.18") ./darwin-metal-compat-pre8.18.patch)
-      (lib.optional (lib.versionAtLeast version "8.18") ./darwin-metal-compat.patch)
-      # Wine requires `qos.h`, which is not included by default on the 10.12 SDK in nixpkgs.
-      ./darwin-qos.patch
-    ]
-    ++ patches';
-
-  # Because the 10.12 SDK doesn’t define `registryID`, clang assumes the undefined selector returns
-  # `id`, which is a pointer. This causes implicit pointer to integer errors in clang 15+.
-  # The following post-processing step adds a cast to `uint64_t` before the selector invocation to
-  # silence these errors.
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    sed -e 's|\(\[[A-Za-z_][][A-Za-z_0-9]* registryID\]\)|(uint64_t)\1|' \
-      -i dlls/winemac.drv/cocoa_display.m
-  '';
+  inherit patches;
 
   configureFlags = prevConfigFlags
     ++ lib.optionals supportFlags.waylandSupport [ "--with-wayland" ]
@@ -140,7 +121,9 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
   # them to the RPATH so that the user doesn't have to set them in
   # LD_LIBRARY_PATH.
   NIX_LDFLAGS = toString (map (path: "-rpath " + path) (
-      map (x: "${lib.getLib x}/lib") ([ stdenv.cc.cc ] ++ buildInputs)
+      map (x: "${lib.getLib x}/lib") ([ stdenv.cc.cc ]
+        # Avoid adding rpath references to non-existent framework `lib` paths.
+        ++ lib.subtractLists darwinFrameworks finalAttrs.buildInputs)
       # libpulsecommon.so is linked but not found otherwise
       ++ lib.optionals supportFlags.pulseaudioSupport (map (x: "${lib.getLib x}/lib/pulseaudio")
           (toBuildInputs pkgArches (pkgs: [ pkgs.libpulseaudio ])))
@@ -210,9 +193,8 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
       fromSource
       binaryNativeCode  # mono, gecko
     ];
-    broken = stdenv.isDarwin && !supportFlags.mingwSupport;
     description = "An Open Source implementation of the Windows API on top of X, OpenGL, and Unix";
-    platforms = if darwinUnsupported then (lib.remove "x86_64-darwin" prevPlatforms) else prevPlatforms;
+    inherit badPlatforms platforms;
     maintainers = with lib.maintainers; [ avnik raskin bendlas jmc-figueira reckenrode ];
     inherit mainProgram;
   };
diff --git a/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch b/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch
deleted file mode 100644
index aaf8a1b89bfdf..0000000000000
--- a/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/dlls/winemac.drv/cocoa_display.m b/dlls/winemac.drv/cocoa_display.m
---- a/dlls/winemac.drv/cocoa_display.m
-+++ b/dlls/winemac.drv/cocoa_display.m
-@@ -289,7 +289,7 @@ static int macdrv_get_gpus_from_metal(struct macdrv_gpu** new_gpus, int* count)
-      * the primary GPU because we need to hide the integrated GPU for an automatic graphic switching pair to avoid apps
-      * using the integrated GPU. This is the behavior of Windows on a Mac. */
-     primary_device = [MTLCreateSystemDefaultDevice() autorelease];
--    if (macdrv_get_gpu_info_from_registry_id(&primary_gpu, primary_device.registryID))
-+    if (macdrv_get_gpu_info_from_registry_id(&primary_gpu, [primary_device registryID]))
-         goto done;
-
-     /* Hide the integrated GPU if the system default device is a dedicated GPU */
-@@ -301,7 +301,7 @@ static int macdrv_get_gpus_from_metal(struct macdrv_gpu** new_gpus, int* count)
-
-     for (i = 0; i < devices.count; i++)
-     {
--        if (macdrv_get_gpu_info_from_registry_id(&gpus[gpu_count], devices[i].registryID))
-+        if (macdrv_get_gpu_info_from_registry_id(&gpus[gpu_count], [devices[i] registryID]))
-             goto done;
-
-         if (hide_integrated && devices[i].isLowPower)
-
diff --git a/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.18.patch b/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.18.patch
deleted file mode 100644
index 181b2a0d1a47a..0000000000000
--- a/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.18.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/dlls/winemac.drv/cocoa_display.m b/dlls/winemac.drv/cocoa_display.m
---- a/dlls/winemac.drv/cocoa_display.m
-+++ b/dlls/winemac.drv/cocoa_display.m
-@@ -354,7 +354,7 @@ static int macdrv_get_gpu_info_from_display_id_using_metal(struct macdrv_gpu* gp
- 
-     device = [CGDirectDisplayCopyCurrentMetalDevice(display_id) autorelease];
-     if (device && [device respondsToSelector:@selector(registryID)])
--        ret = macdrv_get_gpu_info_from_registry_id(gpu, device.registryID);
-+        ret = macdrv_get_gpu_info_from_registry_id(gpu, [device registryID]);
- 
- done:
-     [pool release];
diff --git a/pkgs/applications/emulators/wine/darwin-metal-compat.patch b/pkgs/applications/emulators/wine/darwin-metal-compat.patch
deleted file mode 100644
index 8176be8ef3830..0000000000000
--- a/pkgs/applications/emulators/wine/darwin-metal-compat.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/dlls/winemac.drv/cocoa_display.m b/dlls/winemac.drv/cocoa_display.m
-index fbbe16efcbf..2db375ff3d5 100644
---- a/dlls/winemac.drv/cocoa_display.m
-+++ b/dlls/winemac.drv/cocoa_display.m
-@@ -387,7 +387,7 @@ static int macdrv_get_gpu_info_from_display_id_using_metal(struct macdrv_gpu* gp
- 
-     device = [CGDirectDisplayCopyCurrentMetalDevice(display_id) autorelease];
-     if (device && [device respondsToSelector:@selector(registryID)])
--        return macdrv_get_gpu_info_from_registry_id(gpu, device.registryID);
-+        return macdrv_get_gpu_info_from_registry_id(gpu, [device registryID]);
-     else
-         return -1;
- }
diff --git a/pkgs/applications/emulators/wine/darwin-qos.patch b/pkgs/applications/emulators/wine/darwin-qos.patch
deleted file mode 100644
index e9bd813feaab0..0000000000000
--- a/pkgs/applications/emulators/wine/darwin-qos.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/dlls/ntdll/unix/loader.c b/dlls/ntdll/unix/loader.c
-index cde37c48b0d..be237bc0ad3 100644
---- a/dlls/ntdll/unix/loader.c
-+++ b/dlls/ntdll/unix/loader.c
-@@ -65,6 +65,7 @@
- # undef LoadResource
- # undef GetCurrentThread
- # include <pthread.h>
-+# include <pthread/qos.h>
- # include <mach/mach.h>
- # include <mach/mach_error.h>
- # include <mach-o/getsect.h>
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 9ee1f53601a3b..62fc12dd4eaf3 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -69,9 +69,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "9.7";
+    version = "9.8";
     url = "https://dl.winehq.org/wine/source/9.x/wine-${version}.tar.xz";
-    hash = "sha256-2fPDM2VuiL1M71Mx80sci2nJZKUnWe73RdjdrlGhU1M=";
+    hash = "sha256-hpQ8g47aj62aeUDUCZcDOUvx0b6aEBQ0L+2HnH3DuZM=";
     inherit (stable) patches;
 
     ## see http://wiki.winehq.org/Gecko
@@ -117,7 +117,7 @@ in rec {
   staging = fetchFromGitLab rec {
     # https://gitlab.winehq.org/wine/wine-staging
     inherit (unstable) version;
-    hash = "sha256-KU6i1P81Fr+4aZH/SJ+YibaIfX88SZMPdPcGS2mT2CE=";
+    hash = "sha256-c69E+jr5DKdD8JJxQhM3ILJgvmGvOe54FqMghcVPkpg=";
     domain = "gitlab.winehq.org";
     owner = "wine";
     repo = "wine-staging";
diff --git a/pkgs/applications/emulators/wine/staging.nix b/pkgs/applications/emulators/wine/staging.nix
index 0a99e6d42a87b..56525d4fa0674 100644
--- a/pkgs/applications/emulators/wine/staging.nix
+++ b/pkgs/applications/emulators/wine/staging.nix
@@ -1,4 +1,4 @@
-{ lib, callPackage, autoconf, hexdump, perl, python3, wineUnstable }:
+{ lib, stdenv, callPackage, autoconf, hexdump, perl, python3, wineUnstable }:
 
 with callPackage ./util.nix {};
 
@@ -7,8 +7,8 @@ let patch = (callPackage ./sources.nix {}).staging;
       (mkBuildInputs wineUnstable.pkgArches pkgNames) ++ extra;
 in assert lib.versions.majorMinor wineUnstable.version == lib.versions.majorMinor patch.version;
 
-(lib.overrideDerivation (wineUnstable.override { wineRelease = "staging"; }) (self: {
-  buildInputs = build-inputs [ "perl" "util-linux" "autoconf" "gitMinimal" ] self.buildInputs;
+(wineUnstable.override { wineRelease = "staging"; }).overrideAttrs (self: {
+  buildInputs = build-inputs ([ "perl" "autoconf" "gitMinimal" ] ++ lib.optional stdenv.isLinux "util-linux") self.buildInputs;
   nativeBuildInputs = [ autoconf hexdump perl python3 ] ++ self.nativeBuildInputs;
 
   prePatch = self.prePatch or "" + ''
@@ -18,7 +18,7 @@ in assert lib.versions.majorMinor wineUnstable.version == lib.versions.majorMino
     patchShebangs ./patches/gitapply.sh
     python3 ./staging/patchinstall.py DESTDIR="$PWD" --all ${lib.concatMapStringsSep " " (ps: "-W ${ps}") patch.disabledPatchsets}
   '';
-})) // {
+}) // {
   meta = wineUnstable.meta // {
     description = wineUnstable.meta.description + " (with staging patches)";
   };
diff --git a/pkgs/applications/graphics/lightburn/default.nix b/pkgs/applications/graphics/lightburn/default.nix
index e9ca6b52a0410..19455d89c930b 100644
--- a/pkgs/applications/graphics/lightburn/default.nix
+++ b/pkgs/applications/graphics/lightburn/default.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lightburn";
-  version = "1.5.06";
+  version = "1.6.00";
 
   nativeBuildInputs = [
     p7zip
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/LightBurnSoftware/deployment/releases/download/${version}/LightBurn-Linux64-v${version}.7z";
-    sha256 = "sha256-VJMfvZHqdgUQXLyBBZLEV3nyP0qzibuXLnZyBhBBg9E=";
+    sha256 = "sha256-R9DBlmqvV23QXzC45Z4GN0t+ysv4WM63POJGU5N7jbw=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/graphics/oculante/default.nix b/pkgs/applications/graphics/oculante/default.nix
index a0c8da4705556..c2f2840a5dee2 100644
--- a/pkgs/applications/graphics/oculante/default.nix
+++ b/pkgs/applications/graphics/oculante/default.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oculante";
-  version = "0.8.19";
+  version = "0.8.21";
 
   src = fetchFromGitHub {
     owner = "woelper";
     repo = "oculante";
     rev = version;
-    hash = "sha256-oCgnz1WMg7YypIT8Tjk2m+f/43Aj88rDVCxQ92aL3RY=";
+    hash = "sha256-2QX7cD9SjhLb82O8T90BTQGsy3/gDaNwoX4Mbe2H6s4=";
   };
 
-  cargoHash = "sha256-vlU7egAht+kgA5Vx0HAwQOIax9qD4FLRo1ZUNx4RieY=";
+  cargoHash = "sha256-VAWLs15xsjoT0VSJjS/j0wd5P7OjQGrvyUSHp4B8hHI=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/misc/exercism/default.nix b/pkgs/applications/misc/exercism/default.nix
index d91f359804049..b3ea4b96b9151 100644
--- a/pkgs/applications/misc/exercism/default.nix
+++ b/pkgs/applications/misc/exercism/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "exercism";
-  version = "3.3.0";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "exercism";
     repo  = "cli";
     rev   = "refs/tags/v${version}";
-    hash  = "sha256-Mtb5c1/k8kp7bETOSE0X969BV176jpoprr1/mQ3E4Vg=";
+    hash  = "sha256-+Tg9b7JZtriF5b+mnLgOeTTLiswH/dSGg3Mj1TBt4Wk=";
   };
 
-  vendorHash = "sha256-fnsSvbuVGRAndU88su2Ck7mV8QBDhxozdmwI3XGtxcA=";
+  vendorHash = "sha256-xY3C3emqtPIKyxIN9aEkrLXhTxWNmo0EJXNZVtbtIvs=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/misc/ttdl/default.nix b/pkgs/applications/misc/ttdl/default.nix
index d4a74e6bdbc1c..a67742aa63308 100644
--- a/pkgs/applications/misc/ttdl/default.nix
+++ b/pkgs/applications/misc/ttdl/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ttdl";
-  version = "4.2.1";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "VladimirMarkelov";
     repo = "ttdl";
     rev = "v${version}";
-    sha256 = "sha256-fspqUzF3QqFpd16J1dbcNMdqjcR3PIiRu/s+VB4KgwQ=";
+    sha256 = "sha256-5v3Eu85x3xNvTRgfxhlDz4hiJ4UO010pZPY7UPHk7mQ=";
   };
 
-  cargoHash = "sha256-dvzm9lbVGGM4t6KZcHSlqwo55jssxi8HyFREMaj5I0Q=";
+  cargoHash = "sha256-+jYl/oUeJaABgDX/OBTyeo/B7RYc2MUTreU1ySLG0XQ=";
 
   meta = with lib; {
     description = "A CLI tool to manage todo lists in todo.txt format";
diff --git a/pkgs/applications/misc/wmenu/default.nix b/pkgs/applications/misc/wmenu/default.nix
index 23d9f2404ea20..72d437f74cc40 100644
--- a/pkgs/applications/misc/wmenu/default.nix
+++ b/pkgs/applications/misc/wmenu/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "wmenu";
-  version = "0.1.7";
+  version = "0.1.8";
 
   strictDeps = true;
 
@@ -24,17 +24,9 @@ stdenv.mkDerivation rec {
     owner = "~adnano";
     repo = "wmenu";
     rev = version;
-    hash = "sha256-9do7zL7yaZuqVjastySwjsByo5ja+KUP3590VjIyVnI=";
+    hash = "sha256-gVoqRHQ5bcY58LTgKxpPM1PnZJrLRoSOJUiYYqc/vRI=";
   };
 
-  # Upstream patch needed to fix NULL deref
-  patches = [
-    (fetchpatch {
-      url = "https://git.sr.ht/~adnano/wmenu/commit/2856dddcac861ddf248143e66ba164d7aa05a0bb.patch";
-      hash = "sha256-P7SEjMssA8unNAlrgrTHm0uW5pefjpupPb4s/u2fTAM=";
-    })
-  ];
-
   nativeBuildInputs = [ pkg-config meson ninja wayland-scanner ];
   buildInputs = [ cairo pango wayland libxkbcommon wayland-protocols scdoc ];
 
diff --git a/pkgs/applications/networking/avalanchego/default.nix b/pkgs/applications/networking/avalanchego/default.nix
index a6e0f5d588606..63d45b86fa7a5 100644
--- a/pkgs/applications/networking/avalanchego/default.nix
+++ b/pkgs/applications/networking/avalanchego/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "avalanchego";
-  version = "1.11.4";
+  version = "1.11.5";
 
   src = fetchFromGitHub {
     owner = "ava-labs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-0YS+q1gy7YmTx/DwxaElBG1tzosXReXqPu6RpR3hTjw=";
+    hash = "sha256-IZ4Q67b+VsmBN/NEBPDzN2PYO8cVfLpHBU0tCo+v3Xc=";
   };
 
-  vendorHash = "sha256-et1PVLJQ/vBsg5438s6d9MA2oV40zahp9YKQOE0RX58=";
+  vendorHash = "sha256-z6MF/Kb///BSirdRycNs+7SMThv+yS7WmcrIcgiwBNg=";
   # go mod vendor has a bug, see: https://github.com/golang/go/issues/57529
   proxyVendor = true;
 
diff --git a/pkgs/applications/networking/browsers/opera/default.nix b/pkgs/applications/networking/browsers/opera/default.nix
index e8638a1313f9e..fc80fd76c102f 100644
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@@ -51,11 +51,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "opera";
-  version = "109.0.5097.38";
+  version = "109.0.5097.80";
 
   src = fetchurl {
     url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    hash = "sha256-eljVXaHN7gPqpoL3z+Fz/BH6b+1qxSHtFln6NCxl9tc=";
+    hash = "sha256-3NSinITYisulR5rNhSnwQC3D9pKWj4SdBtFt/9OgCvo=";
   };
 
   unpackPhase = "dpkg-deb -x $src .";
diff --git a/pkgs/applications/networking/cluster/atmos/default.nix b/pkgs/applications/networking/cluster/atmos/default.nix
index d5cd9a0851421..2163adf6d5b26 100644
--- a/pkgs/applications/networking/cluster/atmos/default.nix
+++ b/pkgs/applications/networking/cluster/atmos/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "atmos";
-  version = "1.71.0";
+  version = "1.72.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RnBMVVbZQrJ85uPVLniNjpcledYnOyu5zxIYsvV63qk=";
+    sha256 = "sha256-d4TgVSXTqrzgTdpGl1uXIdEvwb0EIgzqiEjOaWYAZgk=";
   };
 
-  vendorHash = "sha256-dcQWD6UrsSPJZzasovBSXUKaXvL9mZF6cLp458Ia8O4=";
+  vendorHash = "sha256-T3FvJfyGseW5vwN/mMCFEjpcpW90MG8QPkmaXJafD4s=";
 
   ldflags = [ "-s" "-w" "-X github.com/cloudposse/atmos/cmd.Version=v${version}" ];
 
diff --git a/pkgs/applications/networking/cluster/k0sctl/default.nix b/pkgs/applications/networking/cluster/k0sctl/default.nix
index 674adcf585d6a..ff8957db2b2cb 100644
--- a/pkgs/applications/networking/cluster/k0sctl/default.nix
+++ b/pkgs/applications/networking/cluster/k0sctl/default.nix
@@ -2,20 +2,22 @@
 , buildGoModule
 , fetchFromGitHub
 , installShellFiles
+, testers
+, k0sctl
 }:
 
 buildGoModule rec {
   pname = "k0sctl";
-  version = "0.17.5";
+  version = "0.17.8";
 
   src = fetchFromGitHub {
     owner = "k0sproject";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NHfS1iJtpt0t2iIqXBETiD4rpA2XzA8eOg5mP4N8El4=";
+    hash = "sha256-QHTVNrPglNDT9CUQWwc6oD7ttwEUBq8WIX49DiAXf8s=";
   };
 
-  vendorHash = "sha256-MPTdOcNoveBnHMJ2YHqHuvOHHe6IdisZLc05qViA1YQ=";
+  vendorHash = "sha256-6Kj1kHKXbbPMr9thkDTmGYbZvCSW7CvSzASpk6agEpI=";
 
   ldflags = [
     "-s"
@@ -34,6 +36,13 @@ buildGoModule rec {
     done
   '';
 
+  passthru.tests.version = testers.testVersion {
+    package = k0sctl;
+    command = "k0sctl version";
+    # See https://github.com/carlmjohnson/versioninfo/discussions/12
+    version = "version: (devel)\ncommit: v${version}\n";
+  };
+
   meta = with lib; {
     description = "A bootstrapping and management tool for k0s clusters.";
     homepage = "https://k0sproject.io/";
diff --git a/pkgs/applications/networking/cluster/kubefirst/default.nix b/pkgs/applications/networking/cluster/kubefirst/default.nix
index 2e654d15d0b0c..5e76464523838 100644
--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "kubefirst";
-  version = "2.4.6";
+  version = "2.4.8";
 
   src = fetchFromGitHub {
     owner = "kubefirst";
     repo = "kubefirst";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PjqTtu9n9AqHaYnc/2yVQeIWLiQrQcFNdumDSigY7dY=";
+    hash = "sha256-r5y1eWjcw0HP/E9AQodEdCgWgKikGrwV6TvZ2mVcuoE=";
   };
 
   vendorHash = "sha256-ZcZl4knlyKAwTsiyZvlkN5e2ox30B5aNzutI/2UEE9U=";
diff --git a/pkgs/applications/networking/cluster/nerdctl/default.nix b/pkgs/applications/networking/cluster/nerdctl/default.nix
index 8f7a59c70e8ad..0ef96ddf69a4a 100644
--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "nerdctl";
-  version = "1.7.5";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-eGDshnJ26rrRuM9lWwcdRg8udA4uE5ee6c+SYES7qt4=";
+    hash = "sha256-z83c8Ji0zSM1QDwjB4FwhHW6XCqG0Hb5crM3jjK46jk=";
   };
 
-  vendorHash = "sha256-GsI695T7nkwwAt78l7mc5JCD9wXAUcTxwsiLLFcANBI=";
+  vendorHash = "sha256-KqWmwwQRrWoyRehuSJBnlyPQgwk5hUGk2/d0Ue/reVc=";
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
 
@@ -48,13 +48,13 @@ buildGoModule rec {
     runHook postInstallCheck
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/containerd/nerdctl/";
     changelog = "https://github.com/containerd/nerdctl/releases/tag/v${version}";
     description = "A Docker-compatible CLI for containerd";
     mainProgram = "nerdctl";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ jk developer-guy ];
-    platforms = platforms.linux;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ developer-guy jk ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/applications/networking/datovka/default.nix b/pkgs/applications/networking/datovka/default.nix
index bfffc97df6e69..3ed7a26138c87 100644
--- a/pkgs/applications/networking/datovka/default.nix
+++ b/pkgs/applications/networking/datovka/default.nix
@@ -12,11 +12,11 @@
 
 mkDerivation rec {
   pname = "datovka";
-  version = "4.23.6";
+  version = "4.23.7";
 
   src = fetchurl {
     url = "https://gitlab.nic.cz/datovka/datovka/-/archive/v${version}/datovka-v${version}.tar.gz";
-    sha256 = "sha256-g6IMUAE8z5uoLSUpoT+GradQRgwyIXNANt7g4JPOCxg=";
+    sha256 = "sha256-mGuTxOqudDhoJKZ9517H+A4PZxBqAOD+PfBHunhPXGw=";
   };
 
   buildInputs = [ libdatovka qmake qtbase qtsvg libxml2 qtwebsockets ];
diff --git a/pkgs/applications/networking/gns3/server.nix b/pkgs/applications/networking/gns3/server.nix
index f9939000f7440..3e4764a145024 100644
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@@ -4,16 +4,17 @@
 }:
 
 { lib
-, python3
+, python3Packages
 , fetchFromGitHub
 , pkgsStatic
 , stdenv
 , nixosTests
 , testers
+, util-linux
 , gns3-server
 }:
 
-python3.pkgs.buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "gns3-server";
   inherit version;
 
@@ -29,7 +30,7 @@ python3.pkgs.buildPythonApplication {
     cp ${pkgsStatic.busybox}/bin/busybox gns3server/compute/docker/resources/bin/busybox
   '';
 
-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python3Packages; [
     aiofiles
     aiohttp
     aiohttp-cors
@@ -55,6 +56,9 @@ python3.pkgs.buildPythonApplication {
     rm $out/bin/gns3loopback
   '';
 
+  # util-linux (script program) is required for Docker support
+  makeWrapperArgs = [ "--suffix PATH : ${lib.makeBinPath [ util-linux ]}" ];
+
   doCheck = true;
 
   # Otherwise tests will fail to create directory
@@ -63,7 +67,7 @@ python3.pkgs.buildPythonApplication {
     export HOME=$(mktemp -d)
   '';
 
-  checkInputs = with python3.pkgs; [
+  checkInputs = with python3Packages; [
     pytest-aiohttp
     pytest-rerunfailures
     (pytestCheckHook.override { pytest = pytest_7; })
diff --git a/pkgs/applications/networking/ids/suricata/default.nix b/pkgs/applications/networking/ids/suricata/default.nix
index 7661ec3cfbbef..823a455fe857b 100644
--- a/pkgs/applications/networking/ids/suricata/default.nix
+++ b/pkgs/applications/networking/ids/suricata/default.nix
@@ -33,11 +33,11 @@
 in
 stdenv.mkDerivation rec {
   pname = "suricata";
-  version = "7.0.4";
+  version = "7.0.5";
 
   src = fetchurl {
     url = "https://www.openinfosecfoundation.org/download/${pname}-${version}.tar.gz";
-    hash = "sha256-ZABgEgAkvnDb6B9uxu/HLkYlD8s2IZ3/Z+ZBciD/Ibc=";
+    hash = "sha256-H/tWgVjyZcCFVEZL+4VOZWjvaDvwMxKSO1HyjFB5Ck4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/alfaview/default.nix b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
index c8bea44ddd787..f1c8367b91c30 100644
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "alfaview";
-  version = "9.9.1";
+  version = "9.10.1";
 
   src = fetchurl {
     url = "https://assets.alfaview.com/stable/linux/deb/${pname}_${version}.deb";
-    hash = "sha256-GZLIVpXQ22W4JykdLJ7pTogOFhDaiukgsLa2E7giiaU=";
+    hash = "sha256-k58v8l/LE0lWQFbQ6p2XGiRjMMwzArW3KVbIxlKC1SA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
index 29a892942018d..d82fe6652afef 100644
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@@ -5,11 +5,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "tutanota-desktop";
-  version = "220.240321.0";
+  version = "227.240502.0";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-LbvldnhvKHvBEaOwkxA2acuUKMcYi16ceYPuMW73qLs=";
+    hash = "sha256-D7qWwIFuCJmBvfdgf4Dsd2/jvi39tbAttaHOwLND4DY=";
   };
 
   extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ pkgs.libsecret ];
diff --git a/pkgs/applications/networking/newsreaders/pan/default.nix b/pkgs/applications/networking/newsreaders/pan/default.nix
index eb9b5ad3af95e..3a8418e48bda5 100644
--- a/pkgs/applications/networking/newsreaders/pan/default.nix
+++ b/pkgs/applications/networking/newsreaders/pan/default.nix
@@ -22,14 +22,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pan";
-  version = "0.157";
+  version = "0.158";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+zzAnppP6ICIhhlqXGVF4h/yIDa6oE1lxenmzcr2BQo=";
+    hash = "sha256-gcs3TsUzZAW8PhNPMzyOfwu+2SNynjRgfxdGIfAHrpA=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config gettext intltool itstool libxml2 makeWrapper ];
diff --git a/pkgs/applications/networking/sync/storj-uplink/default.nix b/pkgs/applications/networking/sync/storj-uplink/default.nix
index 6ac38b50e8355..d2505a1a568f7 100644
--- a/pkgs/applications/networking/sync/storj-uplink/default.nix
+++ b/pkgs/applications/networking/sync/storj-uplink/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.102.4";
+  version = "1.104.1";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-ryOWnVcJOUs9kToXtwjUTk7nwuAW0NCDn5Npn27hKXU=";
+    hash = "sha256-wB8SK91eJp+8Jjc/bfMqDQQC3FYtSLEjpqVdxEq9P3c=";
   };
 
   subPackages = [ "cmd/uplink" ];
 
-  vendorHash = "sha256-atIb/SmOShLIhvEsTcegX7+xoDXN+SI5a7TQrXpqdUg=";
+  vendorHash = "sha256-Eo6JHcTcfC8zmKZh9sXrZ90RhIgdEBgTldIUnvNm8ms=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/office/mendeley/default.nix b/pkgs/applications/office/mendeley/default.nix
index c8ea46d0978e6..48384eca2998b 100644
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@@ -7,13 +7,13 @@
 
 let
   pname = "mendeley";
-  version = "2.111.0";
+  version = "2.114.0";
 
   executableName = "${pname}-reference-manager";
 
   src = fetchurl {
     url = "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-${version}-x86_64.AppImage";
-    hash = "sha256-tN76RKHETTMkJ239I6+a36RPTuWqYlCSs+tEP+BcB+M=";
+    hash = "sha256-1eLxk+nlgHoe0Gmo/DXlTOnWssrN9cAubvqpV6SqQS8=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/office/planify/default.nix b/pkgs/applications/office/planify/default.nix
index 595b12bf9ab24..86117b22e8036 100644
--- a/pkgs/applications/office/planify/default.nix
+++ b/pkgs/applications/office/planify/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.7";
+  version = "4.7.2";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
     rev = version;
-    hash = "sha256-5hiVTU1w3Rk/BdxYwDB0Y+EZFnSAaEWtx19IB1ak1yY=";
+    hash = "sha256-G0A3U0TUGL4RT1wpIXw/cIwDDlaLCPpo5QG6bJfoIYc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/radio/quisk/default.nix b/pkgs/applications/radio/quisk/default.nix
index 8fa180e705c66..733f908ffc44f 100644
--- a/pkgs/applications/radio/quisk/default.nix
+++ b/pkgs/applications/radio/quisk/default.nix
@@ -8,11 +8,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "quisk";
-  version = "4.2.32";
+  version = "4.2.33";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-zzcygf7oVICO2/wfgyej1GD78fQB1xNRGHq19w6K4uY=";
+    sha256 = "sha256-41eyqYxRg0crtN6qp239eHWSFPt7XuJneTAndZuS3EY=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/radio/tqsl/default.nix b/pkgs/applications/radio/tqsl/default.nix
index bf6ee947785e9..01059cc434308 100644
--- a/pkgs/applications/radio/tqsl/default.nix
+++ b/pkgs/applications/radio/tqsl/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tqsl";
-  version = "2.7.2";
+  version = "2.7.3";
 
   src = fetchurl {
     url = "https://www.arrl.org/files/file/LoTW%20Instructions/${pname}-${version}.tar.gz";
-    sha256 = "sha256-T4NBCUTYHT6ugSg1gSfjQBOBndqwSwyWLr/qlDPQGKI=";
+    sha256 = "sha256-Ca9PsytjPvrU4u+b/x6pIbQc8CDNWI6hNM6jF60Bds8=";
   };
 
   nativeBuildInputs = [ cmake wrapGAppsHook3 ];
diff --git a/pkgs/applications/science/misc/snakemake/default.nix b/pkgs/applications/science/misc/snakemake/default.nix
index 3f5567be03d54..bc69b0947e087 100644
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "snakemake";
-  version = "8.11.2";
+  version = "8.11.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "snakemake";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-rIA757FIIkb6h/QNzyVbIbipkZTwysNonHrPHLqFOyI=";
+    hash = "sha256-wNs5OW8bM5LU0Ik77VU47dEq2PlrsfNNtl6Zedocnm4=";
     # https://github.com/python-versioneer/python-versioneer/issues/217
     postFetch = ''
       sed -i "$out"/snakemake/_version.py -e 's#git_refnames = ".*"#git_refnames = " (tag: v${version})"#'
diff --git a/pkgs/applications/terminal-emulators/terminator/default.nix b/pkgs/applications/terminal-emulators/terminator/default.nix
index 3eb374af71abb..175d3766594b7 100644
--- a/pkgs/applications/terminal-emulators/terminator/default.nix
+++ b/pkgs/applications/terminal-emulators/terminator/default.nix
@@ -7,6 +7,7 @@
 , gtk3
 , gobject-introspection
 , libnotify
+, makeBinaryWrapper
 , wrapGAppsHook3
 , vte
 , nixosTests
@@ -27,6 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     file
     intltool
     gobject-introspection
+    makeBinaryWrapper
     wrapGAppsHook3
     python3.pkgs.pytest-runner
   ];
@@ -55,8 +57,15 @@ python3.pkgs.buildPythonApplication rec {
 
   dontWrapGApps = true;
 
+  # HACK: 'wrapPythonPrograms' will add things to the $PATH in the wrapper. This bleeds into the
+  # terminal session produced by terminator. To avoid this, we force wrapPythonPrograms to only
+  # use gappsWrapperArgs by redefining wrapProgram to ignore its arguments and only apply the
+  # wrapper arguments we want it to use.
+  # TODO: Adjust wrapPythonPrograms to respect an argument that tells it to leave $PATH alone.
   preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+    wrapProgram() {
+      wrapProgramBinary "$1" "''${gappsWrapperArgs[@]}"
+    }
   '';
 
   passthru.tests.test = nixosTests.terminal-emulators.terminator;
diff --git a/pkgs/applications/video/rtabmap/default.nix b/pkgs/applications/video/rtabmap/default.nix
index b44389045187c..6d5270d344ea3 100644
--- a/pkgs/applications/video/rtabmap/default.nix
+++ b/pkgs/applications/video/rtabmap/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rtabmap";
-  version = "0.21.4";
+  version = "0.21.4.1";
 
   src = fetchFromGitHub {
     owner = "introlab";
     repo = "rtabmap";
     rev = "refs/tags/${version}";
-    hash = "sha256-HrIATYRuhFfTlO4oTRZo7CM30LFVyatZJON31Fe4HTQ=";
+    hash = "sha256-y/p1uFSxVQNXO383DLGCg4eWW7iu1esqpWlyPMF3huk=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook wrapGAppsHook3 ];
diff --git a/pkgs/applications/virtualization/podman-tui/default.nix b/pkgs/applications/virtualization/podman-tui/default.nix
index d1339b0d5f2c3..b1ff999cd89c2 100644
--- a/pkgs/applications/virtualization/podman-tui/default.nix
+++ b/pkgs/applications/virtualization/podman-tui/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "podman-tui";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman-tui";
     rev = "v${version}";
-    hash = "sha256-sJaiZJeT0oUAnSg9Kv8uMp1XoumumC3LB77lelmwSgw=";
+    hash = "sha256-t1vrUXv0ZP+vmOcUIue/yvB34DP+gduopuN0U9oixBQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/virtualization/tart/default.nix b/pkgs/applications/virtualization/tart/default.nix
index e8791404fb875..921a8b7e3dbc9 100644
--- a/pkgs/applications/virtualization/tart/default.nix
+++ b/pkgs/applications/virtualization/tart/default.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tart";
-  version = "2.7.2";
+  version = "2.10.0";
 
   src = fetchurl {
       url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart-arm64.tar.gz";
-      hash = "sha256-Z/LZ8g1/FYT7Jh943tFxN8L5HeNf0CVz1VEJj+2fCd8=";
+      hash = "sha256-9spBDqNm47nUZEGCCOfISjNpGx/22OtPPheB7iJTq1A=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/build-support/lib/meson.nix b/pkgs/build-support/lib/meson.nix
index 456c10fcb8eeb..9ffc5b8c1710f 100644
--- a/pkgs/build-support/lib/meson.nix
+++ b/pkgs/build-support/lib/meson.nix
@@ -23,6 +23,10 @@ let
     [binaries]
     llvm-config = 'llvm-config-native'
     rust = ['rustc', '--target', '${stdenv.targetPlatform.rust.rustcTargetSpec}']
+    # Meson refuses to consider any CMake binary during cross compilation if it's
+    # not explicitly specified here, in the cross file.
+    # https://github.com/mesonbuild/meson/blob/0ed78cf6fa6d87c0738f67ae43525e661b50a8a2/mesonbuild/cmake/executor.py#L72
+    cmake = 'cmake'
   '';
 
   crossFlags = optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--cross-file=${crossFile}" ];
diff --git a/pkgs/by-name/al/alephone-durandal/package.nix b/pkgs/by-name/al/alephone-durandal/package.nix
index d8376457f6441..b1bd2da8c8a36 100644
--- a/pkgs/by-name/al/alephone-durandal/package.nix
+++ b/pkgs/by-name/al/alephone-durandal/package.nix
@@ -3,13 +3,13 @@
 alephone.makeWrapper rec {
   pname = "durandal";
   desktopName = "Marathon-Durandal";
-  version = "20240119";
+  version = "20240510";
   icon = alephone.icons + "/marathon2.png";
 
   zip = fetchurl {
     url =
       "https://github.com/Aleph-One-Marathon/alephone/releases/download/release-${version}/Marathon2-${version}-Data.zip";
-    sha256 = "sha256-Tp9EWMIY0moK6RLIpxB7rMzLOQ7zPfV58oeAyQsTbnM=";
+    sha256 = "sha256-uoBl1/7XlXmMLqpk3tvme9w18q4Yh0WCrmqSzjGxNz0=";
   };
 
   meta = {
diff --git a/pkgs/by-name/al/alephone-infinity/package.nix b/pkgs/by-name/al/alephone-infinity/package.nix
index 466f3bb7d4b65..d2ba3968f5959 100644
--- a/pkgs/by-name/al/alephone-infinity/package.nix
+++ b/pkgs/by-name/al/alephone-infinity/package.nix
@@ -3,13 +3,13 @@
 alephone.makeWrapper rec {
   pname = "marathon-infinity";
   desktopName = "Marathon-Infinity";
-  version = "20240119";
+  version = "20240510";
   icon = alephone.icons + "/marathon-infinity.png";
 
   zip = fetchurl {
     url =
       "https://github.com/Aleph-One-Marathon/alephone/releases/download/release-${version}/MarathonInfinity-${version}-Data.zip";
-    sha256 = "sha256-KfFu+cboaZMfjnu3W84/Qbcrc9kbkIZ2Y0GM1fXeXh8=";
+    sha256 = "sha256-+FPym4Avqzyo4cZtfYPHXCS+q21+g9AIdKOImkd/UjU=";
   };
 
   meta = {
diff --git a/pkgs/by-name/al/alephone-marathon/package.nix b/pkgs/by-name/al/alephone-marathon/package.nix
index 38018ec021b05..4710d47090d5b 100644
--- a/pkgs/by-name/al/alephone-marathon/package.nix
+++ b/pkgs/by-name/al/alephone-marathon/package.nix
@@ -3,13 +3,13 @@
 alephone.makeWrapper rec {
   pname = "marathon";
   desktopName = "Marathon";
-  version = "20240119";
+  version = "20240510";
   icon = alephone.icons + "/marathon.png";
 
   zip = fetchurl {
     url =
       "https://github.com/Aleph-One-Marathon/alephone/releases/download/release-${version}/Marathon-${version}-Data.zip";
-    sha256 = "sha256-60+dvXyzHe5PDepyKHcEIdWoRiGMvx5zYehubWKqaB0=";
+    sha256 = "sha256-shZ82e7veaaT/petxDQ8Fd7YtJPmTgxSCStf0kGfrFs=";
   };
 
   meta = {
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 0c7221679a88c..3e9cf6b51fdcf 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -27,20 +27,20 @@ let
 in
 buildNpmPackage' rec {
   pname = "bruno";
-  version = "1.16.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     rev = "v${version}";
-    hash = "sha256-rP3PHS6kuJCgbCQy4h+bJksmJAJvHDBMSysLM5FxQjk=";
+    hash = "sha256-z4KL6CX1jtuC4lxqYA6Mg1zPSc9/OpRb530jPIQK3Is=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-p4rBEOK9zKGO1q3SCKpfdX3EPMkYHRvn9UnGBhsksSE=";
+  npmDepsHash = "sha256-NIf7aMDAeE39+putw/7GTYODIdVmjJIvIwnL5O+sBmI=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bu/bugstalker/package.nix b/pkgs/by-name/bu/bugstalker/package.nix
new file mode 100644
index 0000000000000..ccbf397e71d93
--- /dev/null
+++ b/pkgs/by-name/bu/bugstalker/package.nix
@@ -0,0 +1,104 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, libunwind
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "bugstalker";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "godzie44";
+    repo = "BugStalker";
+    rev = "v${version}";
+    hash = "sha256-16bmvz6/t8H8Sx/32l+fp3QqP5lwi0o1Q9KqDHqF22U=";
+  };
+
+  cargoHash = "sha256-kp0GZ0cM57BMpH/8lhxevnBuJhUSH0rtxP4B/9fXYiU=";
+
+  buildInputs = [ libunwind ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  # Tests which require access to example source code fail in the sandbox. I
+  # haven't managed to figure out how to fix this.
+  checkFlags = [
+    "--skip=breakpoints::test_breakpoint_at_fn_with_monomorphization"
+    "--skip=breakpoints::test_breakpoint_at_line_with_monomorphization"
+    "--skip=breakpoints::test_brkpt_on_function"
+    "--skip=breakpoints::test_brkpt_on_function_name_collision"
+    "--skip=breakpoints::test_brkpt_on_line"
+    "--skip=breakpoints::test_brkpt_on_line2"
+    "--skip=breakpoints::test_brkpt_on_line_collision"
+    "--skip=breakpoints::test_debugee_run"
+    "--skip=breakpoints::test_deferred_breakpoint"
+    "--skip=breakpoints::test_multiple_brkpt_on_addr"
+    "--skip=breakpoints::test_set_breakpoint_idempotence"
+    "--skip=io::test_backtrace"
+    "--skip=io::test_read_register_write"
+    "--skip=io::test_read_value_u64"
+    "--skip=multithreaded::test_multithreaded_app_running"
+    "--skip=multithreaded::test_multithreaded_backtrace"
+    "--skip=multithreaded::test_multithreaded_breakpoints"
+    "--skip=multithreaded::test_multithreaded_trace"
+    "--skip=signal::test_signal_stop_multi_thread"
+    "--skip=signal::test_signal_stop_multi_thread_multiple_signal"
+    "--skip=signal::test_signal_stop_single_thread"
+    "--skip=signal::test_transparent_signals"
+    "--skip=steps::test_step_into"
+    "--skip=steps::test_step_into_recursion"
+    "--skip=steps::test_step_out"
+    "--skip=steps::test_step_over"
+    "--skip=steps::test_step_over_inline_code"
+    "--skip=steps::test_step_over_on_fn_decl"
+    "--skip=symbol::test_symbol"
+    "--skip=test_debugger_disassembler"
+    "--skip=test_debugger_graceful_shutdown"
+    "--skip=test_debugger_graceful_shutdown_multithread"
+    "--skip=test_frame_cfa"
+    "--skip=test_registers"
+    "--skip=variables::test_arguments"
+    "--skip=variables::test_btree_map"
+    "--skip=variables::test_cast_pointers"
+    "--skip=variables::test_cell"
+    "--skip=variables::test_circular_ref_types"
+    "--skip=variables::test_lexical_blocks"
+    "--skip=variables::test_read_array"
+    "--skip=variables::test_read_atomic"
+    "--skip=variables::test_read_btree_set"
+    "--skip=variables::test_read_closures"
+    "--skip=variables::test_read_enum"
+    "--skip=variables::test_read_hashmap"
+    "--skip=variables::test_read_hashset"
+    "--skip=variables::test_read_only_local_variables"
+    "--skip=variables::test_read_pointers"
+    "--skip=variables::test_read_scalar_variables"
+    "--skip=variables::test_read_scalar_variables_at_place"
+    "--skip=variables::test_read_static_in_fn_variable"
+    "--skip=variables::test_read_static_variables"
+    "--skip=variables::test_read_static_variables_different_modules"
+    "--skip=variables::test_read_strings"
+    "--skip=variables::test_read_struct"
+    "--skip=variables::test_read_tls_variables"
+    "--skip=variables::test_read_type_alias"
+    "--skip=variables::test_read_union"
+    "--skip=variables::test_read_uuid"
+    "--skip=variables::test_read_vec_and_slice"
+    "--skip=variables::test_read_vec_deque"
+    "--skip=variables::test_shared_ptr"
+    "--skip=variables::test_slice_operator"
+    "--skip=variables::test_type_parameters"
+    "--skip=variables::test_zst_types"
+  ];
+
+  meta = {
+    description = "Rust debugger for Linux x86-64";
+    homepage = "https://github.com/godzie44/BugStalker";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jacg ];
+    mainProgram = "bs";
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/servers/caddy/default.nix b/pkgs/by-name/ca/caddy/package.nix
index 399ce426d9dc6..73ab67366483b 100644
--- a/pkgs/servers/caddy/default.nix
+++ b/pkgs/by-name/ca/caddy/package.nix
@@ -5,6 +5,7 @@
 , caddy
 , testers
 , installShellFiles
+, stdenv
 }:
 let
   version = "2.7.6";
@@ -40,8 +41,13 @@ buildGoModule {
   postInstall = ''
     install -Dm644 ${dist}/init/caddy.service ${dist}/init/caddy-api.service -t $out/lib/systemd/system
 
-    substituteInPlace $out/lib/systemd/system/caddy.service --replace "/usr/bin/caddy" "$out/bin/caddy"
-    substituteInPlace $out/lib/systemd/system/caddy-api.service --replace "/usr/bin/caddy" "$out/bin/caddy"
+    substituteInPlace $out/lib/systemd/system/caddy.service \
+      --replace-fail "/usr/bin/caddy" "$out/bin/caddy"
+    substituteInPlace $out/lib/systemd/system/caddy-api.service \
+      --replace-fail "/usr/bin/caddy" "$out/bin/caddy"
+  '' + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    # Generating man pages and completions fail on cross-compilation
+    # https://github.com/NixOS/nixpkgs/issues/308283
 
     $out/bin/caddy manpage --directory manpages
     installManPage manpages/*
diff --git a/pkgs/by-name/ca/caligula/package.nix b/pkgs/by-name/ca/caligula/package.nix
new file mode 100644
index 0000000000000..f0f5c14664fc1
--- /dev/null
+++ b/pkgs/by-name/ca/caligula/package.nix
@@ -0,0 +1,42 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "caligula";
+  version = "0.4.5";
+
+  src = fetchFromGitHub {
+    owner = "ifd3f";
+    repo = "caligula";
+    rev = "v${version}";
+    hash = "sha256-9+aLpxmMP76CsLFFmr1mhKgbaT7Zz0lx4D2jQCUA9VY=";
+  };
+
+  cargoHash = "sha256-VwtmU5jTQPn3hpNuLckPQl6joEFPfuax1gRVG0/nceg=";
+
+  buildInputs = lib.optionals stdenv.isDarwin (
+    with darwin.apple_sdk.frameworks; [
+      Cocoa
+      IOKit
+      Foundation
+      DiskArbitration
+    ]
+  );
+
+  RUSTFLAGS = "--cfg tracing_unstable";
+
+  meta = with lib; {
+    description = "A user-friendly, lightweight TUI for disk imaging";
+    homepage = "https://github.com/ifd3f/caligula/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ sodiboo ];
+    platforms = platforms.linux ++ platforms.darwin;
+    # https://github.com/ifd3f/caligula/issues/105
+    broken = stdenv.hostPlatform.isDarwin;
+    mainProgram = "caligula";
+  };
+}
diff --git a/pkgs/development/tools/misc/cli11/default.nix b/pkgs/by-name/cl/cli11/package.nix
index 8c4c58c052b0b..d88470fa4d510 100644
--- a/pkgs/development/tools/misc/cli11/default.nix
+++ b/pkgs/by-name/cl/cli11/package.nix
@@ -1,29 +1,34 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, boost
-, catch2
-, cmake
-, gtest
-, python3
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  boost,
+  catch2,
+  cmake,
+  python3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cli11";
   version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "CLIUtils";
     repo = "CLI11";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-x3/kBlf5LdzkTO4NYOKanZBfcU4oK+fJw9L7cf88LsY=";
   };
 
+  buildInputs = [ catch2 ];
   nativeBuildInputs = [ cmake ];
 
-  nativeCheckInputs = [ boost python3 catch2 ];
+  nativeCheckInputs = [
+    boost
+    python3
+  ];
 
   doCheck = true;
+  strictDeps = true;
 
   meta = with lib; {
     description = "Command line parser for C++11";
@@ -32,5 +37,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ ];
     license = licenses.bsd3;
   };
-
-}
+})
diff --git a/pkgs/by-name/fr/free42/package.nix b/pkgs/by-name/fr/free42/package.nix
index 415f6f6f8b9d4..679e43fc1d2c6 100644
--- a/pkgs/by-name/fr/free42/package.nix
+++ b/pkgs/by-name/fr/free42/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "free42";
-  version = "3.1.5";
+  version = "3.1.8";
 
   src = fetchFromGitHub {
     owner = "thomasokken";
     repo = "free42";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YFTmEyOd/r8Pbj+PzD+VYkkB0gqDJ4wteLBTdwa1qcE=";
+    hash = "sha256-z1HlI2e3mCRJ/sWMdsLF7IpcvTh+Zlrk77M8gaJXMzQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gl/glsl_analyzer/package.nix b/pkgs/by-name/gl/glsl_analyzer/package.nix
new file mode 100644
index 0000000000000..ed57790a27d66
--- /dev/null
+++ b/pkgs/by-name/gl/glsl_analyzer/package.nix
@@ -0,0 +1,39 @@
+{ lib
+, pkgs
+, fetchFromGitHub
+, zig_0_12
+, darwin
+}:
+
+let stdenv = if pkgs.stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else pkgs.stdenv; in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "glsl_analyzer";
+  version = "1.4.5";
+
+  src = fetchFromGitHub {
+    owner = "nolanderc";
+    repo = "glsl_analyzer";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-+eYBw/F1RzI5waAkLgbV0J/Td91hbNcAtHcisQaL82k=";
+  };
+
+  nativeBuildInputs = [
+    zig_0_12.hook
+  ];
+
+  postPatch = ''
+    substituteInPlace build.zig \
+      --replace-fail 'b.run(&.{ "git", "describe", "--tags", "--always" })' '"${finalAttrs.src.rev}"'
+  '';
+
+  meta = {
+    description = "Language server for GLSL (OpenGL Shading Language)";
+    changelog = "https://github.com/nolanderc/glsl_analyzer/releases/tag/v${finalAttrs.version}";
+    homepage = "https://github.com/nolanderc/glsl_analyzer";
+    mainProgram = "glsl_analyzer";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ wr7 ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/go/go-passbolt-cli/package.nix b/pkgs/by-name/go/go-passbolt-cli/package.nix
new file mode 100644
index 0000000000000..e774769ae45e0
--- /dev/null
+++ b/pkgs/by-name/go/go-passbolt-cli/package.nix
@@ -0,0 +1,52 @@
+{ buildGoModule, fetchFromGitHub, installShellFiles, lib, stdenv }:
+
+buildGoModule rec {
+  pname = "go-passbolt-cli";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "passbolt";
+    repo = "go-passbolt-cli";
+    rev = "v${version}";
+    hash = "sha256-I+niNUowKTFDMa7yOnRToMFPzO/CbnjXHJr5nAhhHcg=";
+  };
+
+  vendorHash = "sha256-XRHGq3Qeq7VWHzw5WWVv4x5orQu740lttGVreiu7qP4=";
+
+  ldflags = [
+    "-X=main.version=${version}"
+    "-X=main.commit=${src.rev}"
+    "-X=main.date=1970-01-01T00:00:00Z"
+  ];
+
+  subPackages = [ "." ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D $GOPATH/bin/go-passbolt-cli $out/bin/passbolt
+    runHook postInstall
+  '';
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd passbolt \
+      --bash <($out/bin/passbolt completion bash) \
+      --fish <($out/bin/passbolt completion fish) \
+      --zsh <($out/bin/passbolt completion zsh)
+
+    export tmpDir=$(mktemp -d)
+    cd $tmpDir && mkdir man && $out/bin/passbolt gendoc --type man && installManPage man/*
+  '';
+
+  meta = with lib; {
+    description = "CLI tool to interact with Passbolt, an open source password manager for teams";
+    homepage = "https://github.com/passbolt/go-passbolt-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pbek ];
+    mainProgram = "passbolt";
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}
diff --git a/pkgs/by-name/ha/halo/package.nix b/pkgs/by-name/ha/halo/package.nix
index bbe71993674a7..998e1f3706989 100644
--- a/pkgs/by-name/ha/halo/package.nix
+++ b/pkgs/by-name/ha/halo/package.nix
@@ -7,10 +7,10 @@
 }:
 stdenv.mkDerivation rec {
   pname = "halo";
-  version = "2.15.1";
+  version = "2.15.2";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${version}/${pname}-${version}.jar";
-    hash = "sha256-6qgbUXd0E38Rhv0Jf1qP54yJhQiB1a/Jr1FYw3bC4qI=";
+    hash = "sha256-BCcIDaWtn8OkI+GWs741nWgqyO8qlE9m2hZ3e+iViUI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hyprland-workspaces/package.nix b/pkgs/by-name/hy/hyprland-workspaces/package.nix
index 4ca89b0da1188..11307059e6806 100644
--- a/pkgs/by-name/hy/hyprland-workspaces/package.nix
+++ b/pkgs/by-name/hy/hyprland-workspaces/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprland-workspaces";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "FieldofClay";
     repo = "hyprland-workspaces";
     rev = "v${version}";
-    hash = "sha256-4QGLTimIpx74gWUyHCheUZZT1WgVzBoJRY8OlUDdOh4=";
+    hash = "sha256-GhUjvFMlgjTdgtV9ASW7IqE2dBktPyOlRwg6qM1r7vc=";
   };
 
-  cargoHash = "sha256-9ndP0nyRBCdOGth4UWA263IvjbgnVW2x9PK8oTaMrxg=";
+  cargoHash = "sha256-RZVQSkegX8Fa9SNY7tGNxyu312oeDjXK4U1+1/UIAyA=";
 
   meta = with lib; {
     description = "A multi-monitor aware Hyprland workspace widget";
diff --git a/pkgs/by-name/kc/kcl-cli/package.nix b/pkgs/by-name/kc/kcl-cli/package.nix
index ea0b5536b5289..a6aa42ead1b99 100644
--- a/pkgs/by-name/kc/kcl-cli/package.nix
+++ b/pkgs/by-name/kc/kcl-cli/package.nix
@@ -5,14 +5,14 @@
 
 buildGoModule rec {
   pname = "kcl-cli";
-  version = "0.8.7";
+  version = "0.8.8";
   src = fetchFromGitHub {
     owner = "kcl-lang";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-OKRMgxynKmHnO+5tcKlispFkpQehHINzB6qphH+lwHQ=";
+    hash = "sha256-Bk/sCNMDupdY/YyKT+VoPIzEfjFDa5z9pevcCPnTX8U=";
   };
-  vendorHash = "sha256-dF0n1/SmQVd2BUVOPmvZWWUJYTn2mMnbgZC92luSY2s=";
+  vendorHash = "sha256-Xv8Tfq9Kb1xGFCWZQwBFDX9xZW9j99td/DUb7jBtkpE=";
   ldflags = [
     "-X=kcl-lang.io/cli/pkg/version.version=${version}"
   ];
diff --git a/pkgs/by-name/li/libation/package.nix b/pkgs/by-name/li/libation/package.nix
index 75cc9c128187f..692de5d3d909a 100644
--- a/pkgs/by-name/li/libation/package.nix
+++ b/pkgs/by-name/li/libation/package.nix
@@ -1,20 +1,21 @@
-{ lib
-, stdenv
-, buildDotnetModule
-, fetchFromGitHub
-, dotnetCorePackages
-, wrapGAppsHook3
+{
+  lib,
+  stdenv,
+  buildDotnetModule,
+  fetchFromGitHub,
+  dotnetCorePackages,
+  wrapGAppsHook3,
 
-, libX11
-, libICE
-, libSM
-, libXi
-, libXcursor
-, libXext
-, libXrandr
-, fontconfig
-, glew
-, gtk3
+  libX11,
+  libICE,
+  libSM,
+  libXi,
+  libXcursor,
+  libXext,
+  libXrandr,
+  fontconfig,
+  glew,
+  gtk3,
 }:
 
 buildDotnetModule rec {
@@ -61,10 +62,10 @@ buildDotnetModule rec {
   ];
 
   postInstall = ''
-    install -Dm644 LoadByOS/LinuxConfigApp/libation_glass.svg $out/share/icons/hicolor/scalable/apps/${pname}.svg
-    install -Dm644 LoadByOS/LinuxConfigApp/Libation.desktop $out/share/applications/${pname}.desktop
-    substituteInPlace $out/share/applications/${pname}.desktop \
-        --replace "/usr/bin/libation" "${meta.mainProgram}"
+    install -Dm644 LoadByOS/LinuxConfigApp/libation_glass.svg $out/share/icons/hicolor/scalable/apps/libation.svg
+    install -Dm644 LoadByOS/LinuxConfigApp/Libation.desktop $out/share/applications/libation.desktop
+    substituteInPlace $out/share/applications/libation.desktop \
+        --replace-fail "/usr/bin/libation" "${meta.mainProgram}"
   '';
 
   # wrap manually, because we need lower case excutables
diff --git a/pkgs/by-name/li/litmusctl/package.nix b/pkgs/by-name/li/litmusctl/package.nix
new file mode 100644
index 0000000000000..83ba16b98da25
--- /dev/null
+++ b/pkgs/by-name/li/litmusctl/package.nix
@@ -0,0 +1,43 @@
+{ buildGoModule
+, fetchFromGitHub
+, installShellFiles
+, kubectl
+, lib
+}:
+
+buildGoModule rec {
+  pname = "litmusctl";
+  version = "1.5.0";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  buildInputs = [
+    kubectl
+  ];
+
+  src = fetchFromGitHub {
+    owner = "litmuschaos";
+    repo = "litmusctl";
+    rev = "${version}";
+    hash = "sha256-FORrvPKDTG48WV03+HbXiBJa1IHfHV7yMDhQX64kn6U=";
+  };
+
+  vendorHash = "sha256-U4dp2E2TZ3rds63PS6GzUVhb2qDSv92bf9JCkWpdLew=";
+
+  postInstall = ''
+    installShellCompletion --cmd litmusctl \
+      --bash <($out/bin/litmusctl completion bash) \
+      --fish <($out/bin/listmusctl completion fish) \
+      --zsh <($out/bin/litmusctl completion zsh)
+  '';
+
+  meta = {
+    description = "Command-Line tool to manage Litmuschaos's agent plane";
+    homepage = "https://github.com/litmuschaos/litmusctl";
+    license = lib.licenses.asl20;
+    mainProgram = "litmusctl";
+    maintainers = with lib.maintainers; [ vinetos sailord ];
+  };
+}
diff --git a/pkgs/by-name/ni/nim_lk/package.nix b/pkgs/by-name/ni/nim_lk/package.nix
index 680ba976b5bdd..184d1e27745ad 100644
--- a/pkgs/by-name/ni/nim_lk/package.nix
+++ b/pkgs/by-name/ni/nim_lk/package.nix
@@ -1,23 +1,26 @@
-{ lib
-, buildNimPackage
-, fetchFromSourcehut
-, nim
-, nix-prefetch
-, nix-prefetch-git
-, openssl
-, makeWrapper
+{
+  lib,
+  buildNimPackage,
+  fetchFromSourcehut,
+  nim,
+  nix-prefetch,
+  nix-prefetch-git,
+  openssl,
+  makeWrapper,
 }:
 
-let nim' = nim.passthru.nim;
-in buildNimPackage (finalAttrs: {
+let
+  nim' = nim.passthru.nim;
+in
+buildNimPackage (finalAttrs: {
   pname = "nim_lk";
-  version = "20240210";
+  version = "20240510";
 
   src = fetchFromSourcehut {
     owner = "~ehmry";
     repo = "nim_lk";
     rev = finalAttrs.version;
-    hash = "sha256-LLOf8HNee0Mol+e7/dvu9hQUCmpaVBNggTxaAl/wV6Y=";
+    hash = "sha256-fwoGyYkbGstWG0qw15dOq1gmr3GyIn6ZEBeBmEivHlA=";
   };
 
   lockFile = ./lock.json;
@@ -29,7 +32,13 @@ in buildNimPackage (finalAttrs: {
 
   postFixup = ''
     wrapProgram $out/bin/nim_lk \
-      --suffix PATH : ${lib.makeBinPath [ nim' nix-prefetch nix-prefetch-git ]}
+      --suffix PATH : ${
+        lib.makeBinPath [
+          nim'
+          nix-prefetch
+          nix-prefetch-git
+        ]
+      }
   '';
 
   meta = finalAttrs.src.meta // {
diff --git a/pkgs/by-name/nr/nrr/package.nix b/pkgs/by-name/nr/nrr/package.nix
index 0992152aed3e9..7d43400dba3e9 100644
--- a/pkgs/by-name/nr/nrr/package.nix
+++ b/pkgs/by-name/nr/nrr/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nrr";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "ryanccn";
     repo = "nrr";
     rev = "v${version}";
-    hash = "sha256-94BeBCYCxZBoOp6xo4I/uxd6ULjIfmF4nw/vUWoaEpo=";
+    hash = "sha256-wof/KmoHiBkcn2aTh+M6bNH/B6Le3H6hnT8BzUCs0Pw=";
   };
 
-  cargoHash = "sha256-DTQTIAk914XC+LecQTXk1TdBc/5sMFG8KiD9lO5HLiM=";
+  cargoHash = "sha256-BtYZNZxFjgY/BFd1kwGyy/F1iRezSDxoPHF4exrNzuk=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreFoundation
diff --git a/pkgs/by-name/on/onedriver/package.nix b/pkgs/by-name/on/onedriver/package.nix
index ae2ad038d58e2..c4e3ba572d28a 100644
--- a/pkgs/by-name/on/onedriver/package.nix
+++ b/pkgs/by-name/on/onedriver/package.nix
@@ -7,6 +7,7 @@
 , fuse
 , installShellFiles
 , wrapGAppsHook3
+, glib-networking
 , wrapperDir ? "/run/wrappers/bin"
 }:
 let
@@ -25,7 +26,7 @@ buildGoModule {
   vendorHash = "sha256-OOiiKtKb+BiFkoSBUQQfqm4dMfDW3Is+30Kwcdg8LNA=";
 
   nativeBuildInputs = [ pkg-config installShellFiles wrapGAppsHook3 ];
-  buildInputs = [ webkitgtk_4_1 glib fuse ];
+  buildInputs = [ webkitgtk_4_1 glib fuse glib-networking ];
 
   ldflags = [ "-X github.com/jstaf/onedriver/cmd/common.commit=v${version}" ];
 
diff --git a/pkgs/by-name/ot/oterm/package.nix b/pkgs/by-name/ot/oterm/package.nix
index 797ca5a058237..c321aca862362 100644
--- a/pkgs/by-name/ot/oterm/package.nix
+++ b/pkgs/by-name/ot/oterm/package.nix
@@ -1,59 +1,58 @@
-{ lib
-, python3Packages
-, fetchFromGitHub
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "oterm";
-  version = "0.2.7";
+  version = "0.2.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ggozad";
     repo = "oterm";
     rev = "refs/tags/${version}";
-    hash = "sha256-vKVGSIneKQkFO1uoNaW/Yr6QTDhgokmIpkYFYIbm+U4=";
+    hash = "sha256-6UFNsEc6bYBrBYfCbeiDfemueeRMEXHGCT8junZVFtk=";
   };
 
   pythonRelaxDeps = [
     "aiosqlite"
-    "pillow"
     "httpx"
+    "ollama"
     "packaging"
+    "pillow"
     "typer"
   ];
 
+  build-system = with python3Packages; [ poetry-core ];
+
+  nativeBuildInputs = with python3Packages; [ pythonRelaxDepsHook ];
+
   propagatedBuildInputs = with python3Packages; [
-    ollama
-    textual
-    typer
-    python-dotenv
-    httpx
+    aiohttp
     aiosql
     aiosqlite
-    pyperclip
+    httpx
+    ollama
     packaging
-    rich-pixels
     pillow
-    aiohttp
-  ];
-
-  nativeBuildInputs = with python3Packages; [
-    poetry-core
-    pythonRelaxDepsHook
+    pyperclip
+    python-dotenv
+    rich-pixels
+    textual
+    typer
   ];
 
-  pythonImportsCheck = [
-    "oterm"
-  ];
+  pythonImportsCheck = [ "oterm" ];
 
   # Tests require a HTTP connection to ollama
   doCheck = false;
 
   meta = {
-    changelog = "https://github.com/ggozad/oterm/releases/tag/${version}";
     description = "A text-based terminal client for Ollama";
     homepage = "https://github.com/ggozad/oterm";
+    changelog = "https://github.com/ggozad/oterm/releases/tag/${version}";
     license = lib.licenses.mit;
     mainProgram = "oterm";
     maintainers = with lib.maintainers; [ suhr ];
diff --git a/pkgs/by-name/pr/pragtical/package.nix b/pkgs/by-name/pr/pragtical/package.nix
new file mode 100644
index 0000000000000..cfa6269b89f44
--- /dev/null
+++ b/pkgs/by-name/pr/pragtical/package.nix
@@ -0,0 +1,86 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cacert,
+  meson,
+  ninja,
+  pkg-config,
+  freetype,
+  libgit2,
+  libuchardet,
+  libzip,
+  lua5_4,
+  luajit,
+  mbedtls_2,
+  pcre2,
+  SDL2,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pragtical";
+  version = "3.3.1";
+  pluginManagerVersion = "1.2.9";
+
+  src = fetchFromGitHub {
+    owner = "pragtical";
+    repo = "pragtical";
+    rev = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+
+    # also fetch required git submodules
+    postFetch = ''
+      cd "$out"
+
+      export NIX_SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
+
+      substituteInPlace subprojects/ppm.wrap \
+          --replace-fail 'revision = head' 'revision = v${finalAttrs.pluginManagerVersion}'
+
+      ${lib.getExe meson} subprojects download \
+          colors plugins ppm
+
+      find subprojects -type d -name .git -prune -execdir rm -r {} +
+    '';
+
+    hash = "sha256-T0IHpfMfx4P84RyBLtaYNead6a7cID2cUYwkyNnYMgc=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    freetype
+    libgit2
+    libuchardet
+    libzip
+    lua5_4
+    luajit
+    mbedtls_2
+    pcre2
+    SDL2
+    zlib
+  ];
+
+  # workaround for `libmbedx509.so.1, libmbedcrypto.so.7: error adding symbols: DSO missing from command line`
+  env.NIX_LDFLAGS = "-lmbedx509 -lmbedcrypto";
+
+  mesonFlags = [ "-Duse_system_lua=true" ];
+
+  meta = {
+    changelog = "https://github.com/pragtical/pragtical/blob/${finalAttrs.src.rev}/changelog.md";
+    description = "A practical and pragmatic code editor";
+    homepage = "https://pragtical.dev";
+    license = lib.licenses.mit;
+    mainProgram = "pragtical";
+    maintainers = with lib.maintainers; [
+      suhr
+      tomasajt
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/sb/sbom-utility/package.nix b/pkgs/by-name/sb/sbom-utility/package.nix
index 213dc94cff579..0b3b9ffba21fa 100644
--- a/pkgs/by-name/sb/sbom-utility/package.nix
+++ b/pkgs/by-name/sb/sbom-utility/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "sbom-utility";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "sbom-utility";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tNLMrtJj1eeJ4sVhDRR24/KVI1HzZSRquiImuDTNZFI=";
+    hash = "sha256-EqK2TGlv2RGfvR95lzYz3EHJkfq4q4Ty5H2zFdd9cME=";
   };
 
-  vendorHash = "sha256-EdzI5ypwZRksQVmcfGDUgEMa4CeAPcm237ZaKqmWQDY=";
+  vendorHash = "sha256-qh8kIwgrlmHkocM5ZoGnOY7ISJlct/TV7dAxvXlPw68=";
 
   preCheck = ''
     cd test
diff --git a/pkgs/by-name/su/superfile/package.nix b/pkgs/by-name/su/superfile/package.nix
new file mode 100644
index 0000000000000..21abce75d3d0f
--- /dev/null
+++ b/pkgs/by-name/su/superfile/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+let
+  version = "1.1.2";
+in
+buildGoModule {
+  pname = "superfile";
+  inherit version;
+
+  src =
+    fetchFromGitHub {
+      owner = "MHNightCat";
+      repo = "superfile";
+      rev = "v${version}";
+      hash = "sha256-Cn03oPGT+vCZQcC62p7COx8N8BGgra+qQaZyF+osVsA=";
+    }
+    + "/src";
+
+  vendorHash = "sha256-gWrhy3qzlXG072u5mW971N2Y4Vmt0KbZkB8SFsFgSzo=";
+
+  meta = {
+    changelog = "https://github.com/MHNightCat/superfile/blob/v${version}/changelog.md";
+    description = "Pretty fancy and modern terminal file manager";
+    homepage = "https://github.com/MHNightCat/superfile";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ momeemt ];
+    mainProgram = "superfile";
+  };
+}
diff --git a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
index 044334c602648..51b992bf7da76 100644
--- a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
+++ b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub }:
 
 let
-  version = "1.64.2";
+  version = "1.66.0";
 in
 buildGoModule {
   pname = "tailscale-nginx-auth";
@@ -11,9 +11,9 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-DS7C/G1Nj9gIjYwXaEeCLbtH9HbB0tRoJBDjZc/nq5g=";
+    hash = "sha256-ZI9/YlVHbdvEwD0YHWfUhciU2x4wp4GzTanwDvuIpz4=";
   };
-  vendorHash = "sha256-pYeHqYd2cCOVQlD1r2lh//KC+732H0lj1fPDBr+W8qA=";
+  vendorHash = "sha256-Hd77xy8stw0Y6sfk3/ItqRIbM/349M/4uf0iNy1xJGw=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/ue/ueberzugpp/package.nix b/pkgs/by-name/ue/ueberzugpp/package.nix
index 82fe4ef72ca82..cc0e0cd795358 100644
--- a/pkgs/by-name/ue/ueberzugpp/package.nix
+++ b/pkgs/by-name/ue/ueberzugpp/package.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ueberzugpp";
-  version = "2.9.4";
+  version = "2.9.5";
 
   src = fetchFromGitHub {
     owner = "jstkdng";
     repo = "ueberzugpp";
     rev = "v${version}";
-    hash = "sha256-D+7a+3Vxrt+XUq7c2F2eqi8ZGQ2eZd37aTqighWEKPs=";
+    hash = "sha256-BuVInCYpogkn1CnQ2hqLaTi1KJ0mHEEfRIOrTIg9duY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/wo/wowup-cf/package.nix b/pkgs/by-name/wo/wowup-cf/package.nix
new file mode 100644
index 0000000000000..2fcbd3600309b
--- /dev/null
+++ b/pkgs/by-name/wo/wowup-cf/package.nix
@@ -0,0 +1,37 @@
+{ lib, appimageTools, fetchurl }:
+
+let
+  version = "2.12.0";
+  pname = "wowup-cf";
+  name = "${pname}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/WowUp/WowUp.CF/releases/download/v${version}/WowUp-CF-${version}.AppImage";
+    hash = "sha256-uWz/EQBX/d1UBfpc9EL4x+UH72kINd6pqFIvJkV16e8=";
+  };
+
+  appimageContents = appimageTools.extractType1 { inherit name src; };
+in appimageTools.wrapType1 {
+  inherit name src;
+
+  extraInstallCommands = ''
+    mv $out/bin/${name} $out/bin/${pname}
+    install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/${pname}.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+    cp -r ${appimageContents}/usr/share/icons $out/share
+  '';
+
+  meta = with lib; {
+    description = "World of Warcraft addon updater with CurseForge support";
+    longDescription = ''
+    WowUp is the community centered World of Warcraft addon updater. We attempt to bring the addon community together in an easy to use updater application. We have an ever growing list of supported features.
+    '';
+    homepage = "https://wowup.io/";
+    downloadPage = "https://github.com/WowUp/WowUp.CF/releases";
+    license = licenses.unfree;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ pbek ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/servers/caddy/xcaddy/inject_version_info.diff b/pkgs/by-name/xc/xcaddy/inject_version_info.diff
index 4d87aa6878781..4d87aa6878781 100644
--- a/pkgs/servers/caddy/xcaddy/inject_version_info.diff
+++ b/pkgs/by-name/xc/xcaddy/inject_version_info.diff
diff --git a/pkgs/servers/caddy/xcaddy/default.nix b/pkgs/by-name/xc/xcaddy/package.nix
index 69a531c70767a..69a531c70767a 100644
--- a/pkgs/servers/caddy/xcaddy/default.nix
+++ b/pkgs/by-name/xc/xcaddy/package.nix
diff --git a/pkgs/servers/caddy/xcaddy/use_tmpdir_on_darwin.diff b/pkgs/by-name/xc/xcaddy/use_tmpdir_on_darwin.diff
index 064d8feb5a05a..064d8feb5a05a 100644
--- a/pkgs/servers/caddy/xcaddy/use_tmpdir_on_darwin.diff
+++ b/pkgs/by-name/xc/xcaddy/use_tmpdir_on_darwin.diff
diff --git a/pkgs/data/fonts/undefined-medium/default.nix b/pkgs/data/fonts/undefined-medium/default.nix
index c1b22f7871173..f981b9f85e29b 100644
--- a/pkgs/data/fonts/undefined-medium/default.nix
+++ b/pkgs/data/fonts/undefined-medium/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "undefined-medium";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchzip {
-    url = "https://github.com/andirueckel/undefined-medium/archive/v1.2.zip";
-    hash = "sha256-hgHwi25T+aM7ljzk5uR4x+CqoRJ3/IOyktdp/mDW46I=";
+    url = "https://github.com/andirueckel/undefined-medium/archive/v1.3.zip";
+    hash = "sha256-cVdk6a0xijAQ/18W5jalqRS7IiPufMJW27Scns+nbEY=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/icons/whitesur-cursors/default.nix b/pkgs/data/icons/whitesur-cursors/default.nix
index c16efa996d345..167c2b3578b7b 100644
--- a/pkgs/data/icons/whitesur-cursors/default.nix
+++ b/pkgs/data/icons/whitesur-cursors/default.nix
@@ -1,17 +1,18 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
 }:
 
 stdenvNoCC.mkDerivation {
   pname = "whitesur-cursors";
-  version = "unstable-2022-06-17";
+  version = "0-unstable-2022-06-17";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = "WhiteSur-cursors";
     rev = "5c94e8c22de067282f4cf6d782afd7b75cdd08c8";
-    sha256 = "sha256-CFse0XZzJu+PWDcqmvIXvue+3cKX47oavZU9HYRDAg0=";
+    hash = "sha256-CFse0XZzJu+PWDcqmvIXvue+3cKX47oavZU9HYRDAg0=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/compilers/llvm/common/llvm/default.nix b/pkgs/development/compilers/llvm/common/llvm/default.nix
index 72d626eed749a..705dfed8a2496 100644
--- a/pkgs/development/compilers/llvm/common/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/common/llvm/default.nix
@@ -28,7 +28,7 @@
 , sysctl
 , buildLlvmTools
 , debugVersion ? false
-, doCheck ? (if lib.versionOlder release_version "15" then stdenv.isLinux else true)
+, doCheck ? !stdenv.isAarch32 && (if lib.versionOlder release_version "15" then stdenv.isLinux else true)
   && (!stdenv.isx86_32 /* TODO: why */) && (!stdenv.hostPlatform.isMusl)
   && !(stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian)
   && (stdenv.hostPlatform == stdenv.buildPlatform)
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 4116952199719..75ead6184aa88 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -113,6 +113,15 @@ stdenv.mkDerivation (self: rec {
     # have it block a release.
     "futex-wait.test.sh"
   ];
+  patches = [
+    # Support the NIX_SBCL_DYNAMIC_SPACE_SIZE envvar. Upstream SBCL didn’t want
+    # to include this (see
+    # "https://sourceforge.net/p/sbcl/mailman/sbcl-devel/thread/2cf20df7-01d0-44f2-8551-0df01fe55f1a%400brg.net/"),
+    # but for Nix envvars are sufficiently useful that it’s worth maintaining
+    # this functionality downstream.
+    ./dynamic-space-size-envvar-feature.patch
+    ./dynamic-space-size-envvar-tests.patch
+  ];
   postPatch = lib.optionalString (self.disabledTestFiles != [ ]) ''
     (cd tests ; rm -f ${lib.concatStringsSep " " self.disabledTestFiles})
   ''
diff --git a/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-feature.patch b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-feature.patch
new file mode 100644
index 0000000000000..f1596958a6f8f
--- /dev/null
+++ b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-feature.patch
@@ -0,0 +1,63 @@
+From ac15f9f7c75c1fb5767514e64b609e2a75e6fe9d Mon Sep 17 00:00:00 2001
+From: Hraban Luyat <hraban@0brg.net>
+Date: Sat, 13 Apr 2024 14:04:57 -0400
+Subject: [PATCH] feat: NIX_SBCL_DYNAMIC_SPACE_SIZE envvar
+
+Read SBCL dynamic space size configuration from env if available.
+---
+ src/runtime/runtime.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/src/runtime/runtime.c b/src/runtime/runtime.c
+index 274687c8f..970caa8f4 100644
+--- a/src/runtime/runtime.c
++++ b/src/runtime/runtime.c
+@@ -422,6 +422,29 @@ static int is_memsize_arg(char *argv[], int argi, int argc, int *merge_core_page
+     return 0;
+ }
+ 
++/**
++ * Read memory options from the environment, if present.
++ *
++ * Memory settings are read in the following priority:
++ *
++ * 1. command line arguments
++ * 2. environment variable
++ * 3. embedded options in core
++ * 4. default
++ */
++static void
++read_memsize_from_env(void) {
++  const char *val = getenv("NIX_SBCL_DYNAMIC_SPACE_SIZE");
++  // The distinction is blurry between setting an envvar to the empty string and
++  // unsetting it entirely. Depending on the calling environment it can even be
++  // tricky to properly unset an envvar in the first place. An empty envvar is
++  // practically always intended to just mean “unset”, so let’s interpret it
++  // that way.
++  if (val != NULL && (strcmp(val, "") != 0)) {
++    dynamic_space_size = parse_size_arg(val, "NIX_SBCL_DYNAMIC_SPACE_SIZE");
++  }
++}
++
+ static struct cmdline_options
+ parse_argv(struct memsize_options memsize_options,
+            int argc, char *argv[], char *envp[], char *core)
+@@ -462,6 +485,7 @@ parse_argv(struct memsize_options memsize_options,
+         dynamic_space_size = memsize_options.dynamic_space_size;
+         thread_control_stack_size = memsize_options.thread_control_stack_size;
+         dynamic_values_bytes = memsize_options.thread_tls_bytes;
++        read_memsize_from_env();
+         int stop_parsing = 0; // have we seen '--'
+         int output_index = 1;
+ 
+@@ -488,6 +512,7 @@ parse_argv(struct memsize_options memsize_options,
+         }
+         sbcl_argv[output_index] = 0;
+     } else {
++        read_memsize_from_env();
+         bool end_runtime_options = 0;
+         /* Parse our any of the command-line options that we handle from C,
+          * stopping at the first one that we don't, and leave the rest */
+-- 
+2.44.0
+
diff --git a/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-tests.patch b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-tests.patch
new file mode 100644
index 0000000000000..1a507cc90381a
--- /dev/null
+++ b/pkgs/development/compilers/sbcl/dynamic-space-size-envvar-tests.patch
@@ -0,0 +1,104 @@
+From 9d4a886a8a76ea8be51bcf754cefacdf30986f46 Mon Sep 17 00:00:00 2001
+From: Hraban Luyat <hraban@0brg.net>
+Date: Sat, 13 Apr 2024 15:39:58 -0400
+Subject: [PATCH 2/2] test: dynamic space size envvar and precedence
+
+---
+ tests/memory-args.test.sh | 22 ++++++++++++++++++++++
+ tests/save7.test.sh       | 37 ++++++++++++++++++++++++++++++++-----
+ 2 files changed, 54 insertions(+), 5 deletions(-)
+ create mode 100755 tests/memory-args.test.sh
+
+diff --git a/tests/memory-args.test.sh b/tests/memory-args.test.sh
+new file mode 100755
+index 000000000..72ef0cc79
+--- /dev/null
++++ b/tests/memory-args.test.sh
+@@ -0,0 +1,22 @@
++#!/bin/sh
++
++. ./subr.sh
++
++use_test_subdirectory
++
++set -e
++
++# Allow slight shrinkage if heap relocation has to adjust for alignment
++NIX_SBCL_DYNAMIC_SPACE_SIZE=234mb run_sbcl_with_args --script <<EOF
++(assert (<= 0 (- (* 234 1024 1024) (sb-ext:dynamic-space-size)) 65536))
++EOF
++
++NIX_SBCL_DYNAMIC_SPACE_SIZE=555mb run_sbcl_with_args --dynamic-space-size 234mb --script <<EOF
++(assert (<= 0 (- (* 234 1024 1024) (sb-ext:dynamic-space-size)) 65536))
++EOF
++
++run_sbcl_with_args --dynamic-space-size 234mb --script <<EOF
++(assert (<= 0 (- (* 234 1024 1024) (sb-ext:dynamic-space-size)) 65536))
++EOF
++
++exit $EXIT_TEST_WIN
+diff --git a/tests/save7.test.sh b/tests/save7.test.sh
+index f9225543b..3c35e7b31 100644
+--- a/tests/save7.test.sh
++++ b/tests/save7.test.sh
+@@ -59,9 +59,9 @@ run_sbcl_with_core "$tmpcore" --noinform --control-stack-size 640KB \
+   (assert (eql (extern-alien "dynamic_values_bytes" (unsigned 32))
+                (* 5000 sb-vm:n-word-bytes)))
+   ; allow slight shrinkage if heap relocation has to adjust for alignment
+-  (defun dynamic-space-size-good-p ()
+-    (<= 0 (- (* 260 1048576) (dynamic-space-size)) 65536))
+-  (assert (dynamic-space-size-good-p))
++  (defun dynamic-space-size-good-p (expected-mb)
++    (<= 0 (- (* expected-mb 1024 1024) (dynamic-space-size)) 65536))
++  (assert (dynamic-space-size-good-p 260))
+   (save-lisp-and-die "${tmpcore}2" :executable t :save-runtime-options t)
+ EOF
+ chmod u+x "${tmpcore}2"
+@@ -70,15 +70,42 @@ echo "::: INFO: prepared test core"
+   (when (and (eql (extern-alien "thread_control_stack_size" unsigned) (* 640 1024))
+              (eql (extern-alien "dynamic_values_bytes" (unsigned 32))
+                   (* 5000 sb-vm:n-word-bytes))
+-             (dynamic-space-size-good-p))
++             (dynamic-space-size-good-p 260))
+     (exit :code 42))
+ EOF
+ status=$?
+-rm "$tmpcore" "${tmpcore}2"
+ if [ $status -ne 42 ]; then
+     echo "re-saved executable used wrong memory size options"
+     exit 1
+ fi
+ echo "::: Success"
+ 
++echo "::: Running :DYNAMIC-SPACE-SIZE-ENV"
++NIX_SBCL_DYNAMIC_SPACE_SIZE=432MB ./"${tmpcore}2" --no-userinit --no-sysinit --noprint <<EOF
++  (when (dynamic-space-size-good-p 432)
++    (exit :code 42))
++EOF
++status=$?
++if [ $status -ne 42 ]; then
++    echo "re-saved executable should have prioritized memory specification from env"
++    exit 1
++fi
++echo "::: Success"
++
++echo "::: Running :DYNAMIC-SPACE-SIZE-PRECEDENCE"
++NIX_SBCL_DYNAMIC_SPACE_SIZE=432MB ./"${tmpcore}2" --dynamic-space-size 333MB \
++  --no-userinit --no-sysinit --noprint <<EOF
++  (when (dynamic-space-size-good-p 333))
++    (exit :code 42))
++EOF
++status=$?
++rm "$tmpcore" "${tmpcore}2"
++if [ $status -ne 42 ]; then
++    echo "re-saved executable should have prioritized memory specification from arg"
++    exit 1
++fi
++echo "::: Success"
++
++
++
+ exit $EXIT_TEST_WIN
+-- 
+2.44.0
+
diff --git a/pkgs/development/compilers/terra/default.nix b/pkgs/development/compilers/terra/default.nix
index 3f6934f04212c..ae81adf5f5b0a 100644
--- a/pkgs/development/compilers/terra/default.nix
+++ b/pkgs/development/compilers/terra/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, llvmPackages, ncurses, cmake, libxml2
+{ lib, stdenv, fetchFromGitHub, llvmPackages_16, ncurses, cmake, libxml2
 , symlinkJoin, breakpointHook, cudaPackages, enableCUDA ? false
 , libffi, libobjc, libpfm, Cocoa, Foundation
 }:
@@ -14,6 +14,7 @@ let
     sha256 = "1g87pl014b5v6z2nnhiwn3wf405skawszfr5wdzyfbx00j3kgxd0";
   };
 
+  llvmPackages = llvmPackages_16;
   llvmMerged = symlinkJoin {
     name = "llvmClangMerged";
     paths = with llvmPackages; [
diff --git a/pkgs/development/interpreters/php/8.2.nix b/pkgs/development/interpreters/php/8.2.nix
index d839e372570ad..a63f1391616da 100644
--- a/pkgs/development/interpreters/php/8.2.nix
+++ b/pkgs/development/interpreters/php/8.2.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.2.18";
-    hash = "sha256-ygsHwlQgAyD1GKxbPfVAqc8U2GbzyT7cMBO1Lgb6x5Y=";
+    version = "8.2.19";
+    hash = "sha256-PBj3zlG3x7JreX4flwedOGswNH6wToF/XmyOmydeKmo=";
   });
 in
 base.withExtensions ({ all, ... }: with all; ([
diff --git a/pkgs/development/interpreters/php/8.3.nix b/pkgs/development/interpreters/php/8.3.nix
index d7ac07c1fb553..1da9841f78941 100644
--- a/pkgs/development/interpreters/php/8.3.nix
+++ b/pkgs/development/interpreters/php/8.3.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.3.6";
-    hash = "sha256-YySx3djrMCWwQQNLiNwrwLSBmwAiEp7q66N+R4AxCLw=";
+    version = "8.3.7";
+    hash = "sha256-AcIM3hxaVpZlGHXtIvUHhJZ5+6dA+MQhYWt9Q9f3l9o=";
   });
 in
 base.withExtensions ({ all, ... }: with all; ([
diff --git a/pkgs/development/libraries/java/commons/io/default.nix b/pkgs/development/libraries/java/commons/io/default.nix
index 4c010829c6ff4..2547090523486 100644
--- a/pkgs/development/libraries/java/commons/io/default.nix
+++ b/pkgs/development/libraries/java/commons/io/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "2.15.1";
+  version = "2.16.1";
   pname = "commons-io";
 
   src = fetchurl {
     url    = "mirror://apache/commons/io/binaries/${pname}-${version}-bin.tar.gz";
-    sha256 = "sha256-nYoYGHetdd3vFryFXLxuvvSUCIs6VZyPwWb8s0h+edg=";
+    sha256 = "sha256-4+YYSDyCHwUwlw71nAnGy4g9GOl1Z8qr3gHQEyv8EPo=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/java/commons/logging/default.nix b/pkgs/development/libraries/java/commons/logging/default.nix
index 085efc6e52b5f..f7debe8a7bdc7 100644
--- a/pkgs/development/libraries/java/commons/logging/default.nix
+++ b/pkgs/development/libraries/java/commons/logging/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "commons-logging";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchurl {
     url    = "mirror://apache/commons/logging/binaries/commons-logging-${version}-bin.tar.gz";
-    sha256 = "sha256-ij6jOi1Y/iQ/9Ht41nKtmOdZCvf0NmNseFGxBpyq1fg=";
+    sha256 = "sha256-mM85vfWDc88fNwwflvnRvoh/tb+jDH3o+96RZa9Sp7w=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/libsolv/default.nix b/pkgs/development/libraries/libsolv/default.nix
index 60e7da2907263..e044037eb79d8 100644
--- a/pkgs/development/libraries/libsolv/default.nix
+++ b/pkgs/development/libraries/libsolv/default.nix
@@ -17,14 +17,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.28";
+  version = "0.7.29";
   pname = "libsolv";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "libsolv";
     rev = version;
-    hash = "sha256-cL7SDwCzXM2qJQfiu/3nfAiFbcFNn1YXD23Sl3n9nzY=";
+    hash = "sha256-867sCGFvKib1As9BCiCi6LYVrLUK0pjtM5Bw9Yuu0D8=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/malcontent/default.nix b/pkgs/development/libraries/malcontent/default.nix
index 34d1731e8a097..f346906eadc23 100644
--- a/pkgs/development/libraries/malcontent/default.nix
+++ b/pkgs/development/libraries/malcontent/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "malcontent";
-  version = "0.11.1";
+  version = "0.12.0";
 
   outputs = [ "bin" "out" "lib" "pam" "dev" "man" "installedTests" ];
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     owner = "pwithnall";
     repo = "malcontent";
     rev = version;
-    hash = "sha256-NZwVCnQrEG2gecUjuWe1+cyWFR3OdYJCmj87V14Uwjw=";
+    hash = "sha256-UK/WVqDMkwIqkTFFjzh7PRCA/Ej8Iyu33FasnAEApRs=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/rutabaga_gfx/default.nix b/pkgs/development/libraries/rutabaga_gfx/default.nix
index 6875002727357..9b8f5bec42f37 100644
--- a/pkgs/development/libraries/rutabaga_gfx/default.nix
+++ b/pkgs/development/libraries/rutabaga_gfx/default.nix
@@ -54,15 +54,23 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-wuF3Isrp+u5J8jPQoPsIOWYGNKLSNa2pLfvladAWkLs=";
   };
 
-  # make install always rebuilds
-  dontBuild = true;
+  CARGO_BUILD_TARGET = stdenv.hostPlatform.rust.rustcTargetSpec;
+  "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_LINKER" =
+    "${stdenv.cc.targetPrefix}cc";
 
-  makeFlags = [ "prefix=$(out)" ];
-
-  preInstall = ''
+  postConfigure = ''
     cd rutabaga_gfx/ffi
+    substituteInPlace Makefile --replace-fail pkg-config "$PKG_CONFIG"
   '';
 
+  # make install always rebuilds
+  dontBuild = true;
+
+  makeFlags = [
+    "prefix=$(out)"
+    "OUT=target/${stdenv.hostPlatform.rust.cargoShortTarget}/release"
+  ];
+
   meta = with lib; {
     homepage = "https://crosvm.dev/book/appendix/rutabaga_gfx.html";
     description = "cross-platform abstraction for GPU and display virtualization";
diff --git a/pkgs/development/python-modules/asyncio-dgram/default.nix b/pkgs/development/python-modules/asyncio-dgram/default.nix
index f999cd3b3b344..cdd6ac9b97811 100644
--- a/pkgs/development/python-modules/asyncio-dgram/default.nix
+++ b/pkgs/development/python-modules/asyncio-dgram/default.nix
@@ -1,32 +1,33 @@
-{ lib
-, stdenv
-, buildPythonPackage
-, fetchFromGitHub
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "asyncio-dgram";
-  version = "2.1.2";
-  format = "setuptools";
+  version = "2.2.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.5";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "jsbronder";
-    repo = pname;
-    rev = "refs/tagsv${version}";
+    repo = "asyncio-dgram";
+    rev = "refs/tags/v${version}";
     hash = "sha256-Eb/9JtgPT2yOlfnn5Ox8M0kcQhSlRCuX8+Rq6amki8Q=";
   };
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  build-system = [ setuptools ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     pytest-asyncio
+    pytestCheckHook
   ];
 
   # OSError: AF_UNIX path too long
@@ -38,9 +39,7 @@ buildPythonPackage rec {
     "test_from_socket_bad_socket"
   ];
 
-  pythonImportsCheck = [
-    "asyncio_dgram"
-  ];
+  pythonImportsCheck = [ "asyncio_dgram" ];
 
   meta = with lib; {
     description = "Python support for higher level Datagram";
diff --git a/pkgs/development/python-modules/binance-connector/default.nix b/pkgs/development/python-modules/binance-connector/default.nix
new file mode 100644
index 0000000000000..c8d3b044b5582
--- /dev/null
+++ b/pkgs/development/python-modules/binance-connector/default.nix
@@ -0,0 +1,61 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pycryptodome
+, pythonOlder
+, requests
+, websocket-client
+# dependencies for tests
+, pytest-cov
+, pytest
+, sure
+, responses
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "binance-connector";
+  version = "3.7.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "binance";
+    repo = "${pname}-python";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-hmn8WKr+krzOzHNJ/aynXAbf+rHxDfyKDgycdQQU3xk=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    pycryptodome
+    websocket-client
+  ];
+
+  nativeCheckInputs = [
+    pytest-cov
+    pytest
+    sure
+    responses
+    pytestCheckHook
+  ];
+
+  # pytestCheckHook attempts to run examples directory, which requires
+  # network access
+  disabledTestPaths = [
+    "examples/"
+  ];
+
+  pythonImportsCheck = [
+    "binance.spot"
+    "binance.websocket"
+  ];
+
+  meta = with lib; {
+    description = "Simple connector to Binance Public API";
+    homepage = "https://github.com/binance/binance-connector-python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ trishtzy ];
+  };
+}
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index bb0a67a7ede09..6019b702efd55 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -366,7 +366,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.101";
+  version = "1.34.103";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -374,7 +374,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-GexON+k1FlMZID3tULcKLLxrVUscVMzS9fZNgD+rB4U=";
+    hash = "sha256-MxMTEnOQKpgEYyL4wZkl7NUykk66ZOm/wFKNBGrrbYw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/dask-jobqueue/default.nix b/pkgs/development/python-modules/dask-jobqueue/default.nix
index dc668ea2639ab..69ef4a56f9623 100644
--- a/pkgs/development/python-modules/dask-jobqueue/default.nix
+++ b/pkgs/development/python-modules/dask-jobqueue/default.nix
@@ -8,6 +8,7 @@
 , fetchPypi
 , pytest-asyncio
 , pytestCheckHook
+, pythonAtLeast
 , pythonOlder
 }:
 
@@ -16,7 +17,8 @@ buildPythonPackage rec {
   version = "0.8.5";
   format = "setuptools";
 
-  disabled = pythonOlder "3.8";
+  # Python 3.12 support should be added in 0.8.6
+  disabled = pythonOlder "3.8" || pythonAtLeast "3.12";
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/meilisearch/default.nix b/pkgs/development/python-modules/meilisearch/default.nix
index e5e47b934fd33..4ad70db3281b0 100644
--- a/pkgs/development/python-modules/meilisearch/default.nix
+++ b/pkgs/development/python-modules/meilisearch/default.nix
@@ -1,38 +1,35 @@
-{ lib
-, buildPythonPackage
-, camel-converter
-, fetchFromGitHub
-, pythonOlder
-, setuptools
-, requests
+{
+  lib,
+  buildPythonPackage,
+  camel-converter,
+  fetchFromGitHub,
+  pythonOlder,
+  setuptools,
+  requests,
 }:
 
 buildPythonPackage rec {
   pname = "meilisearch";
-  version = "0.31.0";
+  version = "0.31.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "meilisearch";
     repo = "meilisearch-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mgslzRd2hvDI0SbQR3eY2vzvaaOVI6mUihdNPKe4jcg=";
+    hash = "sha256-rD9f0J8Ez+WrpEyDZa3GVuBxj6Kv7McBzIuk9RtsjHk=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     camel-converter
     requests
   ] ++ camel-converter.optional-dependencies.pydantic;
 
-  pythonImportsCheck = [
-    "meilisearch"
-  ];
+  pythonImportsCheck = [ "meilisearch" ];
 
   # Tests spin up a local server and are not mocking the requests
   doCheck = false;
diff --git a/pkgs/development/python-modules/ollama/default.nix b/pkgs/development/python-modules/ollama/default.nix
index 4d1999a8aae87..299af4e9c9641 100644
--- a/pkgs/development/python-modules/ollama/default.nix
+++ b/pkgs/development/python-modules/ollama/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "ollama";
-  version = "0.1.9";
+  version = "0.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "ollama";
     repo = "ollama-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ilJgRMzCn/T+6Lr7IuvaCnKhN5cyyEOWuV0N1FtR+Yg=";
+    hash = "sha256-kfotKUUXBekUd0X32BYAjNWvQJO94bdEDCSrBg2yJRQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pydeck/default.nix b/pkgs/development/python-modules/pydeck/default.nix
index 6edd7a379b3ee..2ea1a86f356a0 100644
--- a/pkgs/development/python-modules/pydeck/default.nix
+++ b/pkgs/development/python-modules/pydeck/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "pydeck";
-  version = "0.8.0";
+  version = "0.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-B+3egz98/O9nSRJDURlap9zSRmPUkJ/XiY29C2+8Aew=";
+    hash = "sha256-/Yt19hyg1HEtMrTgc0QPHLdPLgwWoLV+V6AOZcVjzFQ=";
   };
 
   # upstream has an invalid pyproject.toml
diff --git a/pkgs/development/python-modules/pyexploitdb/default.nix b/pkgs/development/python-modules/pyexploitdb/default.nix
index c59205aa3f1a3..93f5e3567839b 100644
--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@@ -1,26 +1,30 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, gitpython
-, pytestCheckHook
-, pythonOlder
-, requests
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  gitpython,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pyexploitdb";
-  version = "0.2.9";
-  format = "setuptools";
+  version = "0.2.16";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "pyExploitDb";
     inherit version;
-    hash = "sha256-q16YB0lLlw9nXohcT20l41Bv40CqshWzE8nVBBSEppE=";
+    hash = "sha256-PP9dR8Jl4eWsky3vO9Pgraw0plik/5aWvmOAEc2/Qpo=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     gitpython
     requests
   ];
@@ -28,14 +32,12 @@ buildPythonPackage rec {
   # Module has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "pyExploitDb"
-  ];
+  pythonImportsCheck = [ "pyExploitDb" ];
 
   meta = with lib; {
     description = "Library to fetch the most recent exploit-database";
     homepage = "https://github.com/GoVanguard/pyExploitDb";
-    changelog = "https://github.com/GoVanguard/pyExploitDb/blob/master/Changelog.txt";
+    changelog = "https://github.com/GoVanguard/pyExploitDb/blob/master/ChangeLog.md";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/rq/default.nix b/pkgs/development/python-modules/rq/default.nix
index a0ed2d38b2d86..47a0a7dcfc5e2 100644
--- a/pkgs/development/python-modules/rq/default.nix
+++ b/pkgs/development/python-modules/rq/default.nix
@@ -47,16 +47,17 @@ buildPythonPackage rec {
     sentry-sdk
   ];
 
-  preCheck = lib.optionalString stdenv.isLinux ''
+  preCheck = ''
     PATH=$out/bin:$PATH
     ${redis-server}/bin/redis-server &
-    REDIS_PID=$!
   '';
 
-  postCheck = lib.optionalString stdenv.isLinux ''
-    kill $REDIS_PID
+  postCheck = ''
+    kill %%
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   disabledTests = [
     # https://github.com/rq/rq/commit/fd261d5d8fc0fe604fa396ee6b9c9b7a7bb4142f
     "test_clean_large_registry"
diff --git a/pkgs/development/python-modules/thriftpy2/default.nix b/pkgs/development/python-modules/thriftpy2/default.nix
index e6a696dec9bb8..4a125dd1775bc 100644
--- a/pkgs/development/python-modules/thriftpy2/default.nix
+++ b/pkgs/development/python-modules/thriftpy2/default.nix
@@ -1,32 +1,34 @@
-{ lib
-, buildPythonPackage
-, cython
-, fetchFromGitHub
-, ply
-, pythonOlder
-, six
-, tornado
+{
+  lib,
+  buildPythonPackage,
+  cython,
+  fetchFromGitHub,
+  ply,
+  pythonOlder,
+  six,
+  setuptools,
+  tornado,
 }:
 
 buildPythonPackage rec {
   pname = "thriftpy2";
-  version = "0.4.20";
-  format = "setuptools";
+  version = "0.5.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "Thriftpy";
-    repo = pname;
+    repo = "thriftpy2";
     rev = "refs/tags/v${version}";
-    hash = "sha256-IEYoSLaJUeQdwHaXR0UUlCZg5zBEh5Y2/IwB4RVEAcg=";
+    hash = "sha256-Pjy9OPwFfKaw+XVl7IbbAKPz050TlqI4+yLqSITOkSY=";
   };
 
-  nativeBuildInputs = [
-    cython
-  ];
+  build-system = [ setuptools ];
+
+  nativeBuildInputs = [ cython ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     ply
     six
     tornado
@@ -35,9 +37,7 @@ buildPythonPackage rec {
   # Not all needed files seems to be present
   doCheck = false;
 
-  pythonImportsCheck = [
-    "thriftpy2"
-  ];
+  pythonImportsCheck = [ "thriftpy2" ];
 
   meta = with lib; {
     description = "Python module for Apache Thrift";
diff --git a/pkgs/development/python-modules/types-pyopenssl/default.nix b/pkgs/development/python-modules/types-pyopenssl/default.nix
index a00f14c89395e..586e5138aaaca 100644
--- a/pkgs/development/python-modules/types-pyopenssl/default.nix
+++ b/pkgs/development/python-modules/types-pyopenssl/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "types-pyopenssl";
-  version = "24.0.0.20240417";
+  version = "24.1.0.20240425";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "types-pyOpenSSL";
     inherit version;
-    hash = "sha256-OOdfuCjScXvhc3cLuujCKBH97GjivD9YM5VBE+uEI30=";
+    hash = "sha256-Cn6CYmwZg9yNxZKSvyBlSlHDw4gby7mzN8HabjLwIE4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/analysis/stylelint/default.nix b/pkgs/development/tools/analysis/stylelint/default.nix
index 26bc3b7893feb..f2c478ea49cf1 100644
--- a/pkgs/development/tools/analysis/stylelint/default.nix
+++ b/pkgs/development/tools/analysis/stylelint/default.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "stylelint";
-  version = "16.4.0";
+  version = "16.5.0";
 
   src = fetchFromGitHub {
     owner = "stylelint";
     repo = "stylelint";
     rev = version;
-    hash = "sha256-N689OjxUo3KPN3mfNQ1cKYoe8DXcVTNkUO4NuZPGuXI=";
+    hash = "sha256-kbcf0OPAIeEdh5YI2qqaLJww+ZejfXt/llJTK10nE0M=";
   };
 
-  npmDepsHash = "sha256-V+hiUMenskHV+ccYysBDD5WoQH9vem+uEfQ5SWEdVFU=";
+  npmDepsHash = "sha256-tENUngFWjrmsJErvbmFflwGL0uxou0vQjC/MwfCpm+Y=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/development/tools/apko/default.nix b/pkgs/development/tools/apko/default.nix
index 6a1ffc9376e26..34cf2c2e3a154 100644
--- a/pkgs/development/tools/apko/default.nix
+++ b/pkgs/development/tools/apko/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "apko";
-  version = "0.13.2";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-PGRbJ7znsjvh/ATBF8k+pMnRO8wvGY0PAVswVmFaBUc=";
+    hash = "sha256-e9xWLDs0txl+eiqim3gj7vJRGOFY6MrqOAa1l0TaTbs=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -24,7 +24,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-aqxXCqhvCGQKI+4FDjbqPNeFvELZviQ7Inwxl65sowk=";
+  vendorHash = "sha256-FeljCUtHTKni0yU7JwnaeKYJU7pM527drqBgaxWH/cI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/biome/default.nix b/pkgs/development/tools/biome/default.nix
index 2072adf226419..5674846952518 100644
--- a/pkgs/development/tools/biome/default.nix
+++ b/pkgs/development/tools/biome/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "biome";
-  version = "1.6.3";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "cli/v${version}";
-    hash = "sha256-DooUOp+fr5oOrx04SLlTGro8xc2LieVPNtdvDyTLL/s=";
+    hash = "sha256-iSL0PRHj32PpKoUogej0bc/zXGpS4ZgZG/+9Pewhl4k=";
   };
 
-  cargoHash = "sha256-zMMfLDhiqG8Ahe+7PFjpOtwaBXbKkLDIIoHS329/4uQ=";
+  cargoHash = "sha256-no6ZrH1Ma+n66SLgA3h9dQX8FgeVjFVkxfqR35F/prs=";
 
   nativeBuildInputs = [
     pkg-config
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = [ "-p=biome_cli" ];
   cargoTestFlags = cargoBuildFlags ++
-    # skip a broken test from v1.6.3 release
+    # skip a broken test from v1.7.3 release
     # this will be removed on the next version
     [ "-- --skip=diagnostics::test::termination_diagnostic_size" ];
 
diff --git a/pkgs/development/tools/continuous-integration/drone/default.nix b/pkgs/development/tools/continuous-integration/drone/default.nix
index e6f6b8bf4c45c..26d98065c8207 100644
--- a/pkgs/development/tools/continuous-integration/drone/default.nix
+++ b/pkgs/development/tools/continuous-integration/drone/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "drone.io${lib.optionalString (!enableUnfree) "-oss"}";
-  version = "2.23.0";
+  version = "2.24.0";
 
   src = fetchFromGitHub {
     owner = "harness";
     repo = "drone";
     rev = "v${version}";
-    sha256 = "sha256-HkyR2h7dgbEhqexJXyGebP3zkoTLlzuY+1O2pidAveQ=";
+    sha256 = "sha256-IiSsw0bZDAVuOrm7JBTT14Cf7I/koeS2Yw6vWYBG7kA=";
   };
 
   vendorHash = "sha256-n4KbKkqAnHDIsXs8A/FE+rCkSKQKr5fv7npJ/X6t0mk=";
diff --git a/pkgs/development/tools/database/atlas/default.nix b/pkgs/development/tools/database/atlas/default.nix
index 270d134927855..8fc770f92cd75 100644
--- a/pkgs/development/tools/database/atlas/default.nix
+++ b/pkgs/development/tools/database/atlas/default.nix
@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "atlas";
-  version = "0.21.1";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "ariga";
     repo = "atlas";
     rev = "v${version}";
-    hash = "sha256-i0nqjlL22sM8eVXCD/SBJyNdy0l0Hq4rjW0Lr3CRZlE=";
+    hash = "sha256-NsSDNeciHwlc7LZmuTOzoLNVsjAE+4YGThD/omMbjaE=";
   };
 
   modRoot = "cmd/atlas";
 
   proxyVendor = true;
-  vendorHash = "sha256-48UmLwp93SjwPPrdySFVApjVf1Rsj3oNhi1lha4ZvyE=";
+  vendorHash = "sha256-rM2l7U/ZkL0NIGPPbmBQ+P6mzGxdX4aQeS8Hz6EFmQc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/ent/default.nix b/pkgs/development/tools/ent/default.nix
index a1357c8ab2d3a..58482135068c2 100644
--- a/pkgs/development/tools/ent/default.nix
+++ b/pkgs/development/tools/ent/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ent-go";
-  version = "0.12.5";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "ent";
     repo = "ent";
     rev = "v${version}";
-    sha256 = "sha256-g4n9cOTv/35WkvMjrtP2eEcbiu5kiafVXifz1zlEuCY=";
+    sha256 = "sha256-OEQWNWGVs0QYhPuCGEFgAVaUnfswmvWVt+e0cAdkBKE=";
   };
 
-  vendorHash = "sha256-DUi4Ik+qFbx4LIm9MDJ4H9/+sIfCzK8MMGKp0GIGX7w=";
+  vendorHash = "sha256-9KdSGIyi95EVQq9jGoVqK8aq3JXlQXB+Qwlh/Kfz4Oc=";
 
   subPackages = [ "cmd/ent" ];
 
@@ -29,13 +29,13 @@ buildGoModule rec {
       --zsh <($out/bin/ent completion zsh)
   '';
 
-  meta = with lib; {
+  meta = {
     description = "An entity framework for Go";
     homepage = "https://entgo.io/";
+    changelog = "https://github.com/ent/ent/releases/tag/v${version}";
     downloadPage = "https://github.com/ent/ent";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    license = lib.licenses.asl20;
+    maintainers = [ ];
     mainProgram = "ent";
   };
 }
-
diff --git a/pkgs/development/tools/faas-cli/default.nix b/pkgs/development/tools/faas-cli/default.nix
index 2149eb50c2786..da0151b8486ed 100644
--- a/pkgs/development/tools/faas-cli/default.nix
+++ b/pkgs/development/tools/faas-cli/default.nix
@@ -18,13 +18,13 @@ let
 in
 buildGoModule rec {
   pname = "faas-cli";
-  version = "0.16.26";
+  version = "0.16.27";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = version;
-    sha256 = "sha256-eyQpeud0rW07eb6wtcTYem10LWf/g2dxRwQEMH29wL8=";
+    sha256 = "sha256-CZvIvvkDfpb4YPQIe5i8vZcmhLu7x0zTQGXCL8SxcvM=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/git-ps-rs/default.nix b/pkgs/development/tools/git-ps-rs/default.nix
index 6d4a5be75418e..b9e41327237bd 100644
--- a/pkgs/development/tools/git-ps-rs/default.nix
+++ b/pkgs/development/tools/git-ps-rs/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-ps-rs";
-  version = "7.0.0";
+  version = "7.1.1";
 
   src = fetchFromGitHub {
     owner = "uptech";
     repo = "git-ps-rs";
     rev = version;
-    hash = "sha256-HPHFjYfug642NXeNmv50UzsdOAlDR9F/MtgYnzwiZP8=";
+    hash = "sha256-HkiCc/5Xx+1IKMz/vXPXwUp3c8qSjobhQaIJCzq8dqQ=";
   };
 
-  cargoHash = "sha256-mvRcOwCe5NQ+cJ9brnbZ6HLtLn+fnjYzSBQwA3Qn9PU=";
+  cargoHash = "sha256-r4cmnLkW8ocTcTECAbCk3S94T09lOUzHLQIGHv97W54=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/misc/astyle/default.nix b/pkgs/development/tools/misc/astyle/default.nix
index f7c7a1f09cdb0..a23e7936985c4 100644
--- a/pkgs/development/tools/misc/astyle/default.nix
+++ b/pkgs/development/tools/misc/astyle/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "astyle";
-  version = "3.4.14";
+  version = "3.4.15";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    hash = "sha256-YGqD85FGczGF9nYwWdKSQzxA85Prb1IELhY/jfThaj4=";
+    hash = "sha256-BQTHM7v+lmiLZsEHtt8/oFJj3vq7I4WOQsRLpVRYbms=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/tools/profiling/pprof/default.nix b/pkgs/development/tools/profiling/pprof/default.nix
index e81446d7f12e4..eba53210aa3e7 100644
--- a/pkgs/development/tools/profiling/pprof/default.nix
+++ b/pkgs/development/tools/profiling/pprof/default.nix
@@ -5,20 +5,19 @@
 
 buildGoModule rec {
   pname = "pprof";
-  version = "unstable-2024-02-27";
+  version = "0-unstable-2024-05-09";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "pprof";
-    rev = "401108e1b7e7e113ef887df16b6227698eb5bb0f";
-    hash = "sha256-TD285HHXkePQA2J9W/dEciK5tOLmvbDPr54KNXeE1b4=";
+    rev = "723abb6459b72e964cbfb3f7064446bf3bb321dc";
+    hash = "sha256-zw9/xp5E5V/0D0pf5diWcx/SHX3ujwBtZNfH9tioiL0=";
   };
 
-  vendorHash = "sha256-XOcOt+pe1lZj4XHafxROLslhyJk4mTC72yn7R1k2JCk=";
+  vendorHash = "sha256-bQyloQPfweK4PlrkO1IcCFjyctj99e8C9mQbCj+HCXQ=";
 
   meta = with lib; {
     description = "A tool for visualization and analysis of profiling data";
-    mainProgram = "pprof";
     homepage = "https://github.com/google/pprof";
     license = licenses.asl20;
     longDescription = ''
@@ -41,5 +40,7 @@ buildGoModule rec {
 
       This is not an official Google product.
     '';
+    mainProgram = "pprof";
+    maintainers = with maintainers; [ hzeller ];
   };
 }
diff --git a/pkgs/development/tools/sentry-cli/default.nix b/pkgs/development/tools/sentry-cli/default.nix
index 324218082bc3d..e291ed8eab377 100644
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@@ -11,13 +11,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.31.0";
+  version = "2.31.2";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    sha256 = "sha256-2F8f+vw559FI7CCiLkP8WLpLzDYzr3SHf/Ec8yFHu6g=";
+    sha256 = "sha256-UL8PJnz+fV67F0t24OEReF4tIUa8S2NzICYgUU7fgUo=";
   };
   doCheck = false;
 
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ CoreServices Security SystemConfiguration ];
   nativeBuildInputs = [ installShellFiles pkg-config ];
 
-  cargoHash = "sha256-G/c84j9BquLCJcl60H0ZZZDxjTHpaGHflfJL/hzdgYQ=";
+  cargoHash = "sha256-S1NwnPn3PRL6GoRBFEhhNuy9StrAhG5qCDW2uWNyU4E=";
 
   postInstall = ''
     installShellCompletion --cmd sentry-cli \
diff --git a/pkgs/development/tools/trunk/default.nix b/pkgs/development/tools/trunk/default.nix
index 55292d9d89fae..c4ec27393a486 100644
--- a/pkgs/development/tools/trunk/default.nix
+++ b/pkgs/development/tools/trunk/default.nix
@@ -12,13 +12,13 @@ SystemConfiguration
 
 rustPlatform.buildRustPackage rec {
   pname = "trunk";
-  version = "0.20.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "trunk-rs";
     repo = "trunk";
     rev = "v${version}";
-    hash = "sha256-iUW2tltF8RGyd84rN60Wv2NFgHS/x3cEFeD+YhMizhY=";
+    hash = "sha256-VcTlXGfNfkbFoJiNmOp0AS0/NApgTaiZEafZSV2PuTI=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
   # requires network
   checkFlags = [ "--skip=tools::tests::download_and_install_binaries" ];
 
-  cargoHash = "sha256-fUURwuOwuI9ED08AwrVLhQtltwczyX4Q2M4rZlNEAHU=";
+  cargoHash = "sha256-jXp6B9eTYKfDgzzgp1oRMzwVJOzsh9h0+igQLBZmdsk=";
 
   meta = with lib; {
     homepage = "https://github.com/trunk-rs/trunk";
diff --git a/pkgs/development/tools/yamlfmt/default.nix b/pkgs/development/tools/yamlfmt/default.nix
index 1b7b34c70bd0e..3b7fbc20ca389 100644
--- a/pkgs/development/tools/yamlfmt/default.nix
+++ b/pkgs/development/tools/yamlfmt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "yamlfmt";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hT5+7WaFl19iIdXWFPD82BE9z/2wzHKJJvVE4ZpZwsk=";
+    sha256 = "sha256-VAXDkD4JLoiTomCNtuex/ZEAZtWDEEg5cxETYemvQW8=";
   };
 
   vendorHash = "sha256-UfULQw7wAEJjTFp6+ACF5Ki04eFKeUEgmbt1c8pUolA=";
diff --git a/pkgs/games/nile/default.nix b/pkgs/games/nile/default.nix
index 18d1d3c28ae5a..928ba0743d04b 100644
--- a/pkgs/games/nile/default.nix
+++ b/pkgs/games/nile/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonApplication rec {
   pname = "nile";
-  version = "1.0.2-unstable-2024-03-09";
+  version = "1.0.3-unstable-2024-05-10";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "imLinguin";
     repo = "nile";
-    rev = "ae09acfc20fe4e462762666871f78caae70f6c74";
-    hash = "sha256-hqhIacsbultY3CvvkYAZHmhCkQLi1mkPQwkztaUOd10=";
+    rev = "74e3ca979b2a66f9174c04fd0279211e0276ac9c";
+    hash = "sha256-ezX9MLQsULRvX+X2NXYBQnKRzBRt9eN9JnJinzysI9o=";
   };
 
   disabled = pythonOlder "3.8";
diff --git a/pkgs/os-specific/linux/libbpf/0.x.nix b/pkgs/os-specific/linux/libbpf/0.x.nix
index 480e78d0803a8..b34cca4a51af4 100644
--- a/pkgs/os-specific/linux/libbpf/0.x.nix
+++ b/pkgs/os-specific/linux/libbpf/0.x.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "0.8.1";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-daVS+TErmDU8ksThOvcepg1A61iD8N8GIkC40cmc9/8=";
+    sha256 = "sha256-J5cUvfUYc+uLdkFa2jx/2bqBoZg/eSzc6SWlgKqcfIc=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/rtl8189es/default.nix b/pkgs/os-specific/linux/rtl8189es/default.nix
index e31a54f56c31a..553c6a309682e 100644
--- a/pkgs/os-specific/linux/rtl8189es/default.nix
+++ b/pkgs/os-specific/linux/rtl8189es/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "rtl8189es-${kernel.version}-${version}";
-  version = "2023-03-14";
+  version = "2024-01-21";
 
   src = fetchFromGitHub {
     owner = "jwrdegoede";
     repo = "rtl8189ES_linux";
-    rev = "ae7b31e55526ca0e01d2a3310118530bff4f1055";
-    sha256 = "sha256-l/xUxs63Y5LVT6ZafuRc+iaCXCSt2HwysYJLJ5hg3RM=";
+    rev = "eb51e021b0e1b6f94a4b49da3f4ee5c5fb20b715";
+    sha256 = "sha256-n7Bsstr1H1RvguAyJnVqk/JgEx8WEZWaVg7ZfEYykR0=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/rtl8189fs/default.nix b/pkgs/os-specific/linux/rtl8189fs/default.nix
index 67642f11d3222..0405fc8561a9b 100644
--- a/pkgs/os-specific/linux/rtl8189fs/default.nix
+++ b/pkgs/os-specific/linux/rtl8189fs/default.nix
@@ -3,13 +3,13 @@
 # rtl8189fs is a branch of the rtl8189es driver
 rtl8189es.overrideAttrs (drv: rec {
   name = "rtl8189fs-${kernel.version}-${version}";
-  version = "2023-03-27";
+  version = "2024-01-22";
 
   src = fetchFromGitHub {
     owner = "jwrdegoede";
     repo = "rtl8189ES_linux";
-    rev = "c223a25b1000d64432eca4201a8f012414dfc7ce";
-    sha256 = "sha256-5b5IshLbWxvmzcKy/xLsqKa3kZpwDQXTQtjqZLHyOCo=";
+    rev = "5d523593f41c0b8d723c6aa86b217ee1d0965786";
+    sha256 = "sha256-pziaUM6XfF4Tt9yfWUnLUiTw+sw6uZrr1HcaXdRQ31E=";
   };
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/rtl8192eu/default.nix b/pkgs/os-specific/linux/rtl8192eu/default.nix
index 32b97b59c52ea..529f16fc1db4f 100644
--- a/pkgs/os-specific/linux/rtl8192eu/default.nix
+++ b/pkgs/os-specific/linux/rtl8192eu/default.nix
@@ -4,15 +4,15 @@ with lib;
 
 let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wireless/realtek/rtl8192eu";
 
-in stdenv.mkDerivation rec {
+in stdenv.mkDerivation {
   pname = "rtl8192eu";
-  version = "${kernel.version}-4.4.1.20230613";
+  version = "${kernel.version}-4.4.1.20240507";
 
   src = fetchFromGitHub {
     owner = "Mange";
     repo = "rtl8192eu-linux-driver";
-    rev = "f2fc8af7ab58d2123eed1aa4428e713cdfc27976";
-    sha256 = "sha256-OgsxBcXoIP8h9Z0bLsG91/s/+r89Tdn2dPOt4p3sx8k=";
+    rev = "27410641da6926eb1ac565068ff89d35f7496328";
+    sha256 = "sha256-/BztTE3yKw35Oo7KkzHMtD+8qpJNXWiSwR3YjrotR0I=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/rtl8723ds/default.nix b/pkgs/os-specific/linux/rtl8723ds/default.nix
index be4b954c1b618..a9c1f18de0c2a 100644
--- a/pkgs/os-specific/linux/rtl8723ds/default.nix
+++ b/pkgs/os-specific/linux/rtl8723ds/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8723ds";
-  version = "${kernel.version}-unstable-2022-12-01";
+  version = "${kernel.version}-unstable-2023-11-14";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtl8723ds";
-    rev = "a638cc8639015b8b9390af3350fab0366b6c87e7";
-    sha256 = "sha256-qfVE7k71NPzw3FwoOaUxH66PnDjbpMAF6CyOyUVdSMA=";
+    rev = "52e593e8c889b68ba58bd51cbdbcad7fe71362e4";
+    sha256 = "sha256-SszvDuWN9opkXyVQAOLjnNtPp93qrKgnGvzK0y7Y9b0=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index ed330fc246375..d9fd92c4a9f09 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8812au";
-  version = "${kernel.version}-unstable-2024-01-19";
+  version = "${kernel.version}-unstable-2024-03-20";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8812au-20210629";
-    rev = "3b921c0beda8583c1d2d1b0b7e4692d11e7ea772";
-    hash = "sha256-Ji61Y23uGSTyj3Z5ia9iev5rVzSOv7XY/IfAClhz7Q8=";
+    rev = "8be3a1d7acf60f77c5d9c33b690b8d7301bdf127";
+    hash = "sha256-HchnRezJNzimOB72Sv5BwL4oXuxPxloAHVuaL+warj8=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/rtl8821cu/default.nix b/pkgs/os-specific/linux/rtl8821cu/default.nix
index 806df9f6dd4d8..9d83d4b4c28a1 100644
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel, bc }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "rtl8821cu";
-  version = "${kernel.version}-unstable-2023-09-10";
+  version = "${kernel.version}-unstable-2024-05-03";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8821cu-20210916";
-    rev = "f6d4598290c5e9c8e545130e8a31d130f6d135f4";
-    hash = "sha256-jpMf8K9diJ3mbEkP9Cp+VwairK+pwiEGU/AtUIouCqM=";
+    rev = "3eacc28b721950b51b0249508cc31e6e54988a0c";
+    hash = "sha256-JP7mvwhnKqmkb/B0l4vhc11TBjjUA1Ubzbj/IVEXvBM=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index dd86f22447451..f09d06370eafc 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2024.5.2";
+  version = "2024.5.3";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-bgXHEz8YuHcdGYzLpM7H8IVXixFC8Bz0i4SaatA49Qo=";
+    hash = "sha256-cWt5hOLnri+m7WXAjCA3z1k5ctDia2sAoZiyGe8zadI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/metabase/default.nix b/pkgs/servers/metabase/default.nix
index c75b4854daa55..79dd808eab29b 100644
--- a/pkgs/servers/metabase/default.nix
+++ b/pkgs/servers/metabase/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "metabase";
-  version = "0.49.2";
+  version = "0.49.9";
 
   src = fetchurl {
     url = "https://downloads.metabase.com/v${version}/metabase.jar";
-    hash = "sha256-PmfzYPnfIFX92I0tnXJoZa3EdOF7EFo5bc0T9bo4bS0=";
+    hash = "sha256-1QUrXYpMvn/Gm8ljmF5MYKFRCIQ/v3vpoMJEJcSR2vI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/snac2/default.nix b/pkgs/servers/snac2/default.nix
index e15add96d644e..9c2594c80f999 100644
--- a/pkgs/servers/snac2/default.nix
+++ b/pkgs/servers/snac2/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "snac2";
-  version = "2.51";
+  version = "2.52";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "grunfink";
     repo = pname;
     rev = version;
-    hash = "sha256-ahUWHWtVgJksOg6CTqJSQBaD577zaNu4u1sDG0ksr4g=";
+    hash = "sha256-2dDIbY6IaB53BbtNtzyOrigjzkGk7By2N2zZSuQhDAs=";
   };
 
   buildInputs = [ curl openssl ];
diff --git a/pkgs/shells/fish/plugins/default.nix b/pkgs/shells/fish/plugins/default.nix
index d69c2ac2c29ef..36a5a59e4398e 100644
--- a/pkgs/shells/fish/plugins/default.nix
+++ b/pkgs/shells/fish/plugins/default.nix
@@ -36,6 +36,8 @@ lib.makeScope newScope (self: with self; {
 
   github-copilot-cli-fish = callPackage ./github-copilot-cli-fish.nix { };
 
+  git-abbr = callPackage ./git-abbr.nix { };
+
   grc = callPackage ./grc.nix { };
 
   gruvbox = callPackage ./gruvbox.nix { };
diff --git a/pkgs/shells/fish/plugins/git-abbr.nix b/pkgs/shells/fish/plugins/git-abbr.nix
new file mode 100644
index 0000000000000..2ec33f6c7976a
--- /dev/null
+++ b/pkgs/shells/fish/plugins/git-abbr.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  buildFishPlugin,
+  fetchFromGitHub,
+}:
+buildFishPlugin rec {
+  pname = "fish-git-abbr";
+  version = "0.2.1-unstable-2023-06-19";
+
+  src = fetchFromGitHub {
+    owner = "lewisacidic";
+    repo = "fish-git-abbr";
+    rev = "dc590a5b9d9d2095f95f7d90608b48e55bea0b0e";
+    hash = "sha256-6z3Wr2t8CP85xVEp6UCYaM2KC9PX4MDyx19f/wjHkb0=";
+  };
+
+  meta = with lib; {
+    description = "Abbreviations for git for the fish shell 🐟";
+    homepage = "https://github.com/lewisacidic/fish-git-abbr";
+    license = licenses.mit;
+    maintainers = with maintainers; [hmajid2301];
+  };
+}
diff --git a/pkgs/tools/admin/fits-cloudctl/default.nix b/pkgs/tools/admin/fits-cloudctl/default.nix
index cab43f365692d..208107856896c 100644
--- a/pkgs/tools/admin/fits-cloudctl/default.nix
+++ b/pkgs/tools/admin/fits-cloudctl/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "fits-cloudctl";
-  version = "0.12.18";
+  version = "0.12.19";
 
   src = fetchFromGitHub {
     owner = "fi-ts";
     repo = "cloudctl";
     rev = "v${version}";
-    hash = "sha256-ScHdYSDZVs9YYIh1/U/8ZcGa9BF5L+fIHnSHWSRlB4k=";
+    hash = "sha256-4R+wBjlCjk/7/iucC3zptrQ5D5wtQeqdeyfJ1DiFusY=";
   };
 
-  vendorHash = "sha256-7vIcfxDmO8tmVewRDx6JhOgtkKeHOk0qyFZf1U0VQs4=";
+  vendorHash = "sha256-mK10DxDUrEkCdumq6MM6h7B8C8P1hGE466ko3yj1kto=";
 
   meta = with lib; {
     description = "Command-line client for FI-TS Finance Cloud Native services";
diff --git a/pkgs/tools/misc/gh-markdown-preview/default.nix b/pkgs/tools/misc/gh-markdown-preview/default.nix
index 68f041dbbf2d4..573cd607be419 100644
--- a/pkgs/tools/misc/gh-markdown-preview/default.nix
+++ b/pkgs/tools/misc/gh-markdown-preview/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gh-markdown-preview";
-  version = "1.4.2";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "yusukebe";
     repo = "gh-markdown-preview";
     rev = "v${version}";
-    hash = "sha256-UBveXL4/3GxxIVjqG0GuTbkGkzXFc/stew2s+dTj9BI=";
+    hash = "sha256-gi6Wza8v4V8PAHO75UycP0CEzvXEtm22hTEWs/dJ+LQ=";
   };
 
   vendorHash = "sha256-O6Q9h5zcYAoKLjuzGu7f7UZY0Y5rL2INqFyJT2QZJ/E=";
diff --git a/pkgs/tools/misc/mongodb-compass/default.nix b/pkgs/tools/misc/mongodb-compass/default.nix
index 6df35c2ea734f..c89018cf03a45 100644
--- a/pkgs/tools/misc/mongodb-compass/default.nix
+++ b/pkgs/tools/misc/mongodb-compass/default.nix
@@ -33,7 +33,7 @@ xorg,
 }:
 
 let
-  version = "1.42.5";
+  version = "1.43.0";
 
   rpath = lib.makeLibraryPath [
     alsa-lib
@@ -82,7 +82,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://downloads.mongodb.com/compass/mongodb-compass_${version}_amd64.deb";
-        sha256 = "sha256-46JQXC2Ydq37TomtQdnvk8DwSs8aCfozxqUaEO6hmxo=";
+        sha256 = "sha256-hzPhF0NGwv+Lm+q5SoS8qv10UmuKf4RarGMkEeCxp9w=";
       }
     else
       throw "MongoDB compass is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/tools/misc/panoply/default.nix b/pkgs/tools/misc/panoply/default.nix
index b79d6b7d8e35d..b5df3adc7b3d4 100644
--- a/pkgs/tools/misc/panoply/default.nix
+++ b/pkgs/tools/misc/panoply/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "panoply";
-  version = "5.3.4";
+  version = "5.4.0";
 
   src = fetchurl {
     url = "https://www.giss.nasa.gov/tools/panoply/download/PanoplyJ-${version}.tgz";
-    sha256 = "sha256-v7ieTtm2W8Sc/zhQ7QPh8rkMUgaqgfGYYXc6Ly+9iMg=";
+    sha256 = "sha256-mWk0wuTxkITVU3SwWYPHrX8Y9NceXeRMwyvpwEDWIiA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/misc/topicctl/default.nix b/pkgs/tools/misc/topicctl/default.nix
index 86debbf388007..c3252987c4ce3 100644
--- a/pkgs/tools/misc/topicctl/default.nix
+++ b/pkgs/tools/misc/topicctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "topicctl";
-  version = "1.16.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = "topicctl";
     rev = "v${version}";
-    sha256 = "sha256-Gx/ld651Se2mLlUG/CkHawfVBN2BsxV8w6vrnKFLHuE=";
+    sha256 = "sha256-S1i2Nv7FQzqCTTjkS5slEI0vdt3kXhVWdtaYyng1GsQ=";
   };
 
   vendorHash = "sha256-+mnnvdna1g6JE29weOJZmdO3jFp2a75dV9wK2XcWJ9s=";
diff --git a/pkgs/tools/misc/wootility/default.nix b/pkgs/tools/misc/wootility/default.nix
index 803ad53038e7a..f8590702ecb95 100644
--- a/pkgs/tools/misc/wootility/default.nix
+++ b/pkgs/tools/misc/wootility/default.nix
@@ -8,11 +8,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "wootility";
-  version = "4.6.15";
+  version = "4.6.18";
 
   src = fetchurl {
     url = "https://s3.eu-west-2.amazonaws.com/wooting-update/wootility-lekker-linux-latest/wootility-lekker-${version}.AppImage";
-    sha256 = "sha256-A/cjm9rhcgp68hbyjy7OfYPBKBcccl0OdD7MTdpEdPM=";
+    sha256 = "sha256-oiPt1xgmYGYO1dk01rDwwaUf+yhDAbRCqTTuOivR/kI=";
   };
 
   profile = ''
diff --git a/pkgs/tools/networking/brook/default.nix b/pkgs/tools/networking/brook/default.nix
index 77a70381b1d99..943ccbc9798ab 100644
--- a/pkgs/tools/networking/brook/default.nix
+++ b/pkgs/tools/networking/brook/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "brook";
-  version = "20240404";
+  version = "20240606";
 
   src = fetchFromGitHub {
     owner = "txthinking";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QqA0LnbC72bnAQ25AehTnoXgdqQPc8wztHcFd4Q19ko=";
+    sha256 = "sha256-rfCqYI0T/nbK+rlPGl5orLo3qHKITesdFNtXc/ECATA=";
   };
 
-  vendorHash = "sha256-1aaOPeKHPrZO6WK08EhX4+dME0A33raQnbZi/aNFpIw=";
+  vendorHash = "sha256-dYiifLUOq6RKAVSXuoGlok9Jp8jHmbXN/EjQeQpoqWw=";
 
   meta = with lib; {
     homepage = "https://github.com/txthinking/brook";
diff --git a/pkgs/tools/networking/ferm/default.nix b/pkgs/tools/networking/ferm/default.nix
index 63f247ab986b3..e14b3f8572b83 100644
--- a/pkgs/tools/networking/ferm/default.nix
+++ b/pkgs/tools/networking/ferm/default.nix
@@ -11,6 +11,10 @@ in stdenv.mkDerivation rec {
     sha256 = "sha256-wA2RDVOU5pZ1YI617g9QTVz9pB6ZCi2akbqsbfk+P5I=";
   };
 
+  patches = [
+    ./import-ferm-wrapped.patch
+  ];
+
   # perl is used at build time to gather the ferm version.
   nativeBuildInputs = [ makeWrapper perl ];
   buildInputs = [ perl ];
diff --git a/pkgs/tools/networking/ferm/import-ferm-wrapped.patch b/pkgs/tools/networking/ferm/import-ferm-wrapped.patch
new file mode 100644
index 0000000000000..3975c79af8868
--- /dev/null
+++ b/pkgs/tools/networking/ferm/import-ferm-wrapped.patch
@@ -0,0 +1,14 @@
+--- old/src/import-ferm
++++ new/src/import-ferm
+@@ -42,9 +42,9 @@
+     # find the main "ferm" program
+     my $ferm;
+     if ($0 =~ /^(.*)\//) {
+-        $ferm = "$1/ferm";
++        $ferm = "$1/.ferm-wrapped";
+     } else {
+-        $ferm = 'ferm';
++        $ferm = '.ferm-wrapped';
+     }
+ 
+     # Perl 5.24 requires this prefix or else it will only look in @INC
diff --git a/pkgs/tools/networking/lychee/default.nix b/pkgs/tools/networking/lychee/default.nix
index d141217591509..610869897b7b8 100644
--- a/pkgs/tools/networking/lychee/default.nix
+++ b/pkgs/tools/networking/lychee/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lychee";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "lycheeverse";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-luc6rzNYhS+c5B4S3/cOvDqnRF+LfRDY1aw99hkF+nE=";
+    hash = "sha256-L1tvP2lZsFD2swhP1MetQFxxxA+EbrI4aDYTJwbpkVI=";
   };
 
-  cargoHash = "sha256-kGdRz5m0L3v3DBeabYq1Zp0bEEPW5C0y+A7tTjWkCwM=";
+  cargoHash = "sha256-SQ9Dgtg3TKAaj9XkpEzA13U8CumGOlpwiW+Lv6leQW4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index d8f0661f7d0db..f946bdca45b3e 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.27.4";
+  version = "0.27.5";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+IcgzwLUA8OIa9od5LkGnI05FTbxC8PmOf8s5+akTrk=";
+    hash = "sha256-DWtTCx+vzOE4yE9jAUxB1oF1UubIXK4f7wptJY89az0=";
   };
 
   vendorHash = "sha256-LPq6ovulE+xdoRaQpwA0mNqw3kFxMs/am1ucO8UmDtU=";
diff --git a/pkgs/tools/networking/networkd-dispatcher/default.nix b/pkgs/tools/networking/networkd-dispatcher/default.nix
index a2a03d1f84049..3caadb67caf38 100644
--- a/pkgs/tools/networking/networkd-dispatcher/default.nix
+++ b/pkgs/tools/networking/networkd-dispatcher/default.nix
@@ -4,7 +4,7 @@
 , fetchpatch
 , python3Packages
 , asciidoc
-, makeWrapper
+, wrapGAppsNoGuiHook
 , iw
 }:
 
@@ -43,10 +43,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     asciidoc
-    makeWrapper
+    wrapGAppsNoGuiHook
     python3Packages.wrapPython
   ];
 
+  dontWrapGApps = true;
+
   checkInputs = with python3Packages; [
     dbus-python
     iw
@@ -72,9 +74,14 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  preFixup = ''
+    makeWrapperArgs+=( \
+      "''${gappsWrapperArgs[@]}" \
+      --prefix PATH : "${lib.makeBinPath [ iw ]}" \
+    )
+  '';
   postFixup = ''
     wrapPythonPrograms
-    wrapProgram $out/bin/networkd-dispatcher --prefix PATH : ${lib.makeBinPath [ iw ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/zap/default.nix b/pkgs/tools/networking/zap/default.nix
index e3fe7d1577430..e0ceade91f5ad 100644
--- a/pkgs/tools/networking/zap/default.nix
+++ b/pkgs/tools/networking/zap/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://www.owasp.org/index.php/ZAP";
+    homepage = "https://www.zaproxy.org/";
     description = "Java application for web penetration testing";
     maintainers = with maintainers; [ mog rafael ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/security/arti/default.nix b/pkgs/tools/security/arti/default.nix
index e410a86855560..0ad27f3d08ab2 100644
--- a/pkgs/tools/security/arti/default.nix
+++ b/pkgs/tools/security/arti/default.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "arti";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage rec {
     owner = "core";
     repo = "arti";
     rev = "arti-v${version}";
-    hash = "sha256-Ps1AIvL6hOnSYtvi4wbgJQiuv2eb1XIEPul/WypM9bo=";
+    hash = "sha256-DicOkh2yv6qbxf1x4fAZq34qtuD/T4twn8JMnI9XGCI=";
   };
 
-  cargoHash = "sha256-2u/8nn/9tz+hlNDz6I/g2cMPWXZSMVNV7FPsKFP8jqo=";
+  cargoHash = "sha256-ICJMcFTIHFLxB5XJeMRi1M6e9p0nKwT3vbqAZT22vmU=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/tools/security/ecdsatool/ctype-header-c99-implicit-function-declaration.patch b/pkgs/tools/security/ecdsatool/ctype-header-c99-implicit-function-declaration.patch
new file mode 100644
index 0000000000000..1bbe576e452ed
--- /dev/null
+++ b/pkgs/tools/security/ecdsatool/ctype-header-c99-implicit-function-declaration.patch
@@ -0,0 +1,12 @@
+diff --git a/libecdsaauth/base64.c b/libecdsaauth/base64.c
+index 0f9b7a3..84df22a 100644
+--- a/libecdsaauth/base64.c
++++ b/libecdsaauth/base64.c
+@@ -45,6 +45,7 @@
+ #include <string.h>
+ #include <unistd.h>
+ #include <assert.h>
++#include <ctype.h>
+ 
+ static const char Base64[] =
+ 	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
diff --git a/pkgs/tools/security/ecdsatool/default.nix b/pkgs/tools/security/ecdsatool/default.nix
index aa55facfd8e04..439ffac563c7a 100644
--- a/pkgs/tools/security/ecdsatool/default.nix
+++ b/pkgs/tools/security/ecdsatool/default.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation {
     ./configure --prefix=$out
   '';
 
+  patches = [
+    ./ctype-header-c99-implicit-function-declaration.patch
+    ./openssl-header-c99-implicit-function-declaration.patch
+  ];
+
   nativeBuildInputs = with pkgs; [openssl autoconf automake];
   buildInputs = with pkgs; [libuecc];
 
diff --git a/pkgs/tools/security/ecdsatool/openssl-header-c99-implicit-function-declaration.patch b/pkgs/tools/security/ecdsatool/openssl-header-c99-implicit-function-declaration.patch
new file mode 100644
index 0000000000000..1821743c18038
--- /dev/null
+++ b/pkgs/tools/security/ecdsatool/openssl-header-c99-implicit-function-declaration.patch
@@ -0,0 +1,33 @@
+diff --git a/libecdsaauth/keypair.c b/libecdsaauth/keypair.c
+index 5e098c5..b5dd21e 100644
+--- a/libecdsaauth/keypair.c
++++ b/libecdsaauth/keypair.c
+@@ -22,6 +22,7 @@
+ 
+ #include <string.h>
+ #include <stdlib.h>
++#include <openssl/pem.h>
+ 
+ static inline libecdsaauth_key_t *libecdsaauth_key_alloc(void)
+ {
+diff --git a/tool/main.c b/tool/main.c
+index 23d19a3..f88016c 100644
+--- a/tool/main.c
++++ b/tool/main.c
+@@ -21,6 +21,7 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
++#include <openssl/pem.h>
+ 
+ #include "libecdsaauth/keypair.h"
+ #include "libecdsaauth/op.h"
+@@ -41,7 +42,7 @@ static int tool_keygen(int argc, const char *argv[])
+ 	key = libecdsaauth_key_new();
+ 
+ 	pubout = fopen(argv[1], "w");
+-	PEM_write_ECPrivateKey(pubout, key->eckey, NULL, NULL, 0, NULL);
++	PEM_write_ECPrivateKey(pubout, key->eckey, NULL, NULL, 0, NULL, NULL);
+ 	fclose(pubout);
+ 
+ 	pubkey = libecdsaauth_key_public_key_base64(key);
diff --git a/pkgs/tools/security/fscan/default.nix b/pkgs/tools/security/fscan/default.nix
index 00ce9d8ec78e3..29fbf2453ee43 100644
--- a/pkgs/tools/security/fscan/default.nix
+++ b/pkgs/tools/security/fscan/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fscan";
-  version = "1.8.3-build3";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "shadow1ng";
     repo = "fscan";
     rev = version;
-    hash = "sha256-GtOCd8JaR6tx8hoB+P9QXrEnN7Wvmv7jddhc2/8hjvQ=";
+    hash = "sha256-5uFSvEkTBy0veMdeeg9BmSqu+qSqCwuozK0J3kerAdE=";
   };
 
-  vendorHash = "sha256-hvb2IfypwYauF3ubE36u0bTU+l/FWP/CZt6dFd9zc6s=";
+  vendorHash = "sha256-FFYqvGEFe7sUEb4G3ApQOuYoiDXeA54P7spmKfRiEF0=";
 
   meta = with lib; {
     description = "An intranet comprehensive scanning tool";
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index b6526540c77bd..03770b1cc6609 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.7"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.8"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 9e15c13be2d2c..0cbc2a918ad4e 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 2f47cc94d99413b39b5963e94355f0d1ae012cb5
-  ref: refs/tags/6.4.7
+  revision: e9f897a525576857abd73c96ac64beb0094ad547
+  ref: refs/tags/6.4.8
   specs:
-    metasploit-framework (6.4.7)
+    metasploit-framework (6.4.8)
       actionpack (~> 7.0.0)
       activerecord (~> 7.0.0)
       activesupport (~> 7.0.0)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 85b471c8e8c97..e9600b703bf87 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.4.7";
+  version = "6.4.8";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = "refs/tags/${version}";
-    hash = "sha256-HqISVgemx7heOxTfjjEf4si3wQle4pHGi5AW7nroPoc=";
+    hash = "sha256-a5Igd8i5K9qt6r5dHuzRMWLrXZn95PJtYnW4A4HcUNE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 7d3b53263be24..ee104260ca7bf 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -674,12 +674,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "2f47cc94d99413b39b5963e94355f0d1ae012cb5";
-      sha256 = "11ryx1xfw5lhig393qjy170vgj723wqqxpql7dgbiix60xb158hy";
+      rev = "e9f897a525576857abd73c96ac64beb0094ad547";
+      sha256 = "1lahvj0h7f3mc9nz5r7xk5fynqiis7n1wpdyxanxlaxrr1vj14kb";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.7";
+    version = "6.4.8";
   };
   metasploit-model = {
     groups = ["default"];
diff --git a/pkgs/tools/security/notation/default.nix b/pkgs/tools/security/notation/default.nix
index 07c9ef4997172..f9318296060f5 100644
--- a/pkgs/tools/security/notation/default.nix
+++ b/pkgs/tools/security/notation/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, testers, notation }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles, testers, notation }:
 
 buildGoModule rec {
   pname = "notation";
@@ -13,6 +13,10 @@ buildGoModule rec {
 
   vendorHash = "sha256-USkufc1dG4eyRfRJHSX4mVZHnvOc5onHenF98Aedac4=";
 
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
   # This is a Go sub-module and cannot be built directly (e2e tests).
   excludedPackages = [ "./test" ];
 
@@ -23,6 +27,13 @@ buildGoModule rec {
     "-X github.com/notaryproject/notation/internal/version.BuildMetadata="
   ];
 
+  postInstall = ''
+    installShellCompletion --cmd notation \
+      --bash <($out/bin/notation completion bash) \
+      --fish <($out/bin/notation completion fish) \
+      --zsh <($out/bin/notation completion zsh)
+  '';
+
   passthru.tests.version = testers.testVersion {
     package = notation;
     command = "notation version";
diff --git a/pkgs/tools/system/stress-ng/default.nix b/pkgs/tools/system/stress-ng/default.nix
index 0e87cbffd0504..6ff1a8931b6ea 100644
--- a/pkgs/tools/system/stress-ng/default.nix
+++ b/pkgs/tools/system/stress-ng/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "stress-ng";
-  version = "0.17.07";
+  version = "0.17.08";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-eXDCzyZ/YeumHjuLpr6stkWkApwfi8ExDx3uZTVa/cs=";
+    hash = "sha256-ipiR7vLNF0+y0YtXZC0qpp361lfpXzlIp3eLUbn0oXc=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/typesetting/tex/texpresso/default.nix b/pkgs/tools/typesetting/tex/texpresso/default.nix
index 4b53c6d6def77..52e8be777c09e 100644
--- a/pkgs/tools/typesetting/tex/texpresso/default.nix
+++ b/pkgs/tools/typesetting/tex/texpresso/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "texpresso";
-  version = "0-unstable-2024-04-30";
+  version = "0-unstable-2024-05-09";
 
   nativeBuildInputs = [
     makeWrapper
@@ -35,8 +35,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "let-def";
     repo = "texpresso";
-    rev = "a5241c3ac27eb5eda01bd58b6370982a64320106";
-    hash = "sha256-2RvbIFfYQQSsrXJ72q5LWyaCLCZvThTi7YuiOaJR9mE=";
+    rev = "8b6cfcd10c03596bc3645ac8425a48b105d8650d";
+    hash = "sha256-uLGanGEUGzxIYFbU3U8LLV3bpn/IN9XltvWCmwSlD7E=";
   };
 
   buildFlags = [ "texpresso" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 39fd9b8917035..7e6c6720c912a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4485,10 +4485,6 @@ with pkgs;
     '';
   });
 
-  caddy = callPackage ../servers/caddy { };
-
-  xcaddy = callPackage ../servers/caddy/xcaddy { };
-
   traefik = callPackage ../servers/traefik { };
 
   traefik-certs-dumper = callPackage ../tools/misc/traefik-certs-dumper { };
@@ -18550,8 +18546,6 @@ with pkgs;
 
   sigrok-firmware-fx2lafw = callPackage ../development/tools/sigrok-firmware-fx2lafw { };
 
-  cli11 = callPackage ../development/tools/misc/cli11 { };
-
   datree = callPackage ../development/tools/datree { };
 
   detekt = callPackage ../development/tools/detekt { };
@@ -40412,6 +40406,15 @@ with pkgs;
 
   winePackagesFor = wineBuild: lib.makeExtensible (self: with self; {
     callPackage = newScope self;
+    stdenv =
+      if pkgs.stdenv.isDarwin then
+        # Match upstream, which builds with the latest SDK and a 10.7 deployment target.
+        overrideSDK pkgs.stdenv {
+          darwinMinVersion = "10.7";
+          darwinSdkVersion = "11.0";
+        }
+      else
+        pkgs.stdenv;
 
     inherit wineBuild;
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1e3b6441ed368..399d87461a9a7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1515,6 +1515,8 @@ self: super: with self; {
 
   bimmer-connected = callPackage ../development/python-modules/bimmer-connected { };
 
+  binance-connector = callPackage ../development/python-modules/binance-connector { };
+
   binary = callPackage ../development/python-modules/binary { };
 
   binary2strings = callPackage ../development/python-modules/binary2strings { };