Merge release-23.11 into staging-next-23.11

34 files changed, 194 insertions, 90 deletions

diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 954defbcc4ddd..b399ccc38f58d 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -27,13 +27,7 @@ let
       encoding = "utf8";
       pool = cfg.databasePool;
     } // cfg.extraDatabaseConfig;
-  in if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.9" then {
-    production.main = val;
-    # Starting with GitLab 15.9, single connections were deprecated and will be
-    # removed in GitLab 17.0. The CI connection however requires database_tasks set
-    # to false.
-    production.ci = val // { database_tasks = false; };
-  } else if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.0" then {
+  in if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.0" then {
     production.main = val;
   } else {
     production = val;
@@ -1378,12 +1372,11 @@ in {
                 fi
 
                 jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
-                   '.${if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.0" then "production.main" else "production"}.password = $ENV.db_password ${if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.9" then "| .production.ci.password = $ENV.db_password | .production.main as $main | del(.production.main) | .production |= {main: $main} + ." else ""}' \
+                   '.${if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.0" then "production.main" else "production"}.password = $ENV.db_password' \
                    >'${cfg.statePath}/config/database.yml'
               ''
               else ''
                 jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
-                   '${if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.9" then ".production.main as $main | del(.production.main) | .production |= {main: $main} + ." else ""}' \
                    >'${cfg.statePath}/config/database.yml'
               ''
             }
diff --git a/nixos/modules/services/misc/guix/default.nix b/nixos/modules/services/misc/guix/default.nix
index 2bfa3b77971f4..7174ff36b7090 100644
--- a/nixos/modules/services/misc/guix/default.nix
+++ b/nixos/modules/services/misc/guix/default.nix
@@ -22,11 +22,19 @@ let
       })
       (builtins.genList guixBuildUser numberOfUsers));
 
-  # A set of Guix user profiles to be linked at activation.
+  # A set of Guix user profiles to be linked at activation. All of these should
+  # be default profiles managed by Guix CLI and the profiles are located in
+  # `${cfg.stateDir}/profiles/per-user/$USER/$PROFILE`.
   guixUserProfiles = {
-    # The current Guix profile that is created through `guix pull`.
+    # The default Guix profile managed by `guix pull`. Take note this should be
+    # the profile with the most precedence in `PATH` env to let users use their
+    # updated versions of `guix` CLI.
     "current-guix" = "\${XDG_CONFIG_HOME}/guix/current";
 
+    # The default Guix home profile. This profile contains more than exports
+    # such as an activation script at `$GUIX_HOME_PROFILE/activate`.
+    "guix-home" = "$HOME/.guix-home/profile";
+
     # The default Guix profile similar to $HOME/.nix-profile from Nix.
     "guix-profile" = "$HOME/.guix-profile";
   };
@@ -256,20 +264,31 @@ in
       # ephemeral setups where only certain part of the filesystem is
       # persistent (e.g., "Erase my darlings"-type of setup).
       system.userActivationScripts.guix-activate-user-profiles.text = let
+        guixProfile = profile: "${cfg.stateDir}/guix/profiles/per-user/\${USER}/${profile}";
+        linkProfile = profile: location: let
+          userProfile = guixProfile profile;
+        in ''
+          [ -d "${userProfile}" ] && ln -sfn "${userProfile}" "${location}"
+        '';
         linkProfileToPath = acc: profile: location: let
-          guixProfile = "${cfg.stateDir}/guix/profiles/per-user/\${USER}/${profile}";
-          in acc + ''
-            [ -d "${guixProfile}" ] && [ -L "${location}" ] || ln -sf "${guixProfile}" "${location}"
-          '';
+          in acc + (linkProfile profile location);
 
-        activationScript = lib.foldlAttrs linkProfileToPath "" guixUserProfiles;
+        # This should contain export-only Guix user profiles. The rest of it is
+        # handled manually in the activation script.
+        guixUserProfiles' = lib.attrsets.removeAttrs guixUserProfiles [ "guix-home" ];
+
+        linkExportsScript = lib.foldlAttrs linkProfileToPath "" guixUserProfiles';
       in ''
         # Don't export this please! It is only expected to be used for this
         # activation script and nothing else.
         XDG_CONFIG_HOME=''${XDG_CONFIG_HOME:-$HOME/.config}
 
         # Linking the usual Guix profiles into the home directory.
-        ${activationScript}
+        ${linkExportsScript}
+
+        # Activate all of the default Guix non-exports profiles manually.
+        ${linkProfile "guix-home" "$HOME/.guix-home"}
+        [ -L "$HOME/.guix-home" ] && "$HOME/.guix-home/activate"
       '';
 
       # GUIX_LOCPATH is basically LOCPATH but for Guix libc which in turn used by
diff --git a/pkgs/applications/misc/remnote/default.nix b/pkgs/applications/misc/remnote/default.nix
index c564e42ec4259..db8a19e11b621 100644
--- a/pkgs/applications/misc/remnote/default.nix
+++ b/pkgs/applications/misc/remnote/default.nix
@@ -6,11 +6,11 @@ stdenv.mkDerivation (finalAttrs: let
 in
 {
   pname = "remnote";
-  version = "1.13.0";
+  version = "1.13.34";
 
   src = fetchurl {
     url = "https://download.remnote.io/remnote-desktop/RemNote-${version}.AppImage";
-    hash = "sha256-ovM7MnRqzy/mgz+h87hqIuvquODIfmxjdJG1NZYobbk=";
+    hash = "sha256-QOfU1pZWQfShq8bQPh9ZiGKxzIV6LH8S/sQk3MQVKD0=";
   };
   appexec = appimageTools.wrapType2 {
     inherit pname version src;
@@ -36,8 +36,8 @@ in
     runHook preInstall
 
     install -D ${appexec}/bin/remnote-${version} $out/bin/remnote
-    install -D "${desktopItem}/share/applications/"* -t $out/share/applications/
-    install -D ${icon} $out/share/pixmaps/remnote.png
+    install -m 444 -D "${desktopItem}/share/applications/"* -t $out/share/applications/
+    install -m 444 -D ${icon} $out/share/pixmaps/remnote.png
 
     runHook postInstall
   '';
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
index f9afe7b680fa4..5c37bff9d2a56 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@@ -2,7 +2,7 @@
 callPackage ./generic.nix {} rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "6.43.1";
+  version = "6.44.0";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-mDxZFs+rI2eHkkvkmflras1WqBa/HBVBDpdk9NKaC2E=";
+  hash = "sha256-04KhjExUx+X2/vxSlobVOk9A50XwTlXcdVuttnUmJEw=";
 }
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 8247763e63ba7..461c83695d5c7 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "16.7.0",
-  "repo_hash": "sha256-l5TkjkVny2zQLUfbscG6adkmkC1KjxMAeFbSyUA1UbI=",
+  "version": "16.7.2",
+  "repo_hash": "sha256-YIwZkmTVmxXlZ07lCUco9VEbylMvE92LQdFOeZXWB2M=",
   "yarn_hash": "1qxz2p969qg7kzyvhwxws5zwdw986gdq9gxllzi58c5c56jz49zf",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v16.7.0-ee",
+  "rev": "v16.7.2-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "16.7.0",
-    "GITLAB_PAGES_VERSION": "16.7.0",
+    "GITALY_SERVER_VERSION": "16.7.2",
+    "GITLAB_PAGES_VERSION": "16.7.2",
     "GITLAB_SHELL_VERSION": "14.32.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "4.5.0",
-    "GITLAB_WORKHORSE_VERSION": "16.7.0"
+    "GITLAB_WORKHORSE_VERSION": "16.7.2"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index b56edca8fa9c2..c2f295b3b589b 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "16.7.0";
+  version = "16.7.2";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -18,7 +18,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-YLynUHE1lb0dfsZsalz91jSSk1Y5r7kqT2AcE27xf04=";
+      hash = "sha256-3R7x8eaUJqJ1mKlQ4kYThKyaSfSaow7lGx5EfNo+GNY=";
     };
 
     vendorHash = "sha256-btWHZMy1aBSsUVs30IqrdBCO79XQvTMXxkxYURF2Nqs=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
index 23e269b0f669f..94867f855133a 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "16.7.0";
+  version = "16.7.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-8jODsK5+o1fEaTuFv6bXfZp4oA87JUQbTdYQn66DKJA=";
+    hash = "sha256-rUSZDsQt6faNES3ibzo7fJqpzEmXRbbTXOkhOn7jggA=";
   };
 
   vendorHash = "sha256-NMky8v0YmN2pSeKJ7G0+DWAZvUx2JlwFbqPHvciYroM=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index c839269a1f935..b3dec6385c28e 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "16.7.0";
+  version = "16.7.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/applications/virtualization/cloud-hypervisor/Cargo.lock b/pkgs/applications/virtualization/cloud-hypervisor/Cargo.lock
index 346e3f45f6335..0a96a9afb1394 100644
--- a/pkgs/applications/virtualization/cloud-hypervisor/Cargo.lock
+++ b/pkgs/applications/virtualization/cloud-hypervisor/Cargo.lock
@@ -348,7 +348,7 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "cloud-hypervisor"
-version = "35.0.0"
+version = "35.1.0"
 dependencies = [
  "anyhow",
  "api_client",
diff --git a/pkgs/applications/virtualization/cloud-hypervisor/default.nix b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
index d7182b8131070..2bcfddb1b94f4 100644
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cloud-hypervisor";
-  version = "35.0";
+  version = "35.1";
 
   src = fetchFromGitHub {
     owner = "cloud-hypervisor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-HZt5xfsP9l18S6nPyVhLNAs5vgDSVYOMFwThzCCon7E=";
+    sha256 = "sha256-SgbEF1iflVQ/5wK8w+kyqwqIHjeEPc0gPVPwaDOlQMg=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/ni/nix-lib-nmd/package.nix b/pkgs/by-name/ni/nix-lib-nmd/package.nix
new file mode 100644
index 0000000000000..1c7e43c4f875c
--- /dev/null
+++ b/pkgs/by-name/ni/nix-lib-nmd/package.nix
@@ -0,0 +1,32 @@
+{ lib, stdenv, fetchurl }:
+
+let version = "0.5.0";
+in stdenv.mkDerivation {
+  pname = "nix-lib-nmd";
+  inherit version;
+
+  # TODO: Restore when Sourcehut once its back from DDoS attack.
+  # src = fetchFromSourcehut {
+  #   owner = "~rycee";
+  #   repo = "nmd";
+  #   rev = "v${version}";
+  #   hash = "sha256-1glxIg/b+8qr+ZsSsBqZIqGpsYWzRuMyz74/sy765Uk=";
+  # };
+
+  src = fetchurl {
+    url = "https://rycee.net/tarballs/nmd-${version}.tar.gz";
+    hash = "sha256-+65+VYFgnbFGzCyyQytyxVStSZwEP989qi/6EDOdA8A=";
+  };
+
+  installPhase = ''
+    mkdir -v "$out"
+    cp -rv * "$out"
+  '';
+
+  meta = {
+    homepage = "https://git.sr.ht/~rycee/nmd";
+    description = "A documentation framework for projects based on NixOS modules";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ rycee ];
+  };
+}
diff --git a/pkgs/by-name/ni/nix-lib-nmt/package.nix b/pkgs/by-name/ni/nix-lib-nmt/package.nix
new file mode 100644
index 0000000000000..bfe6085b30d1f
--- /dev/null
+++ b/pkgs/by-name/ni/nix-lib-nmt/package.nix
@@ -0,0 +1,32 @@
+{ lib, stdenv, fetchurl }:
+
+let version = "0.5.0";
+in stdenv.mkDerivation {
+  pname = "nix-lib-nmt";
+  inherit version;
+
+  # TODO: Restore when Sourcehut once its back from DDoS attack.
+  # src = fetchFromSourcehut {
+  #   owner = "~rycee";
+  #   repo = "nmt";
+  #   rev = "v${version}";
+  #   hash = "sha256-1glxIg/b+8qr+ZsSsBqZIqGpsYWzRuMyz74/sy765Uk=";
+  # };
+
+  src = fetchurl {
+    url = "https://rycee.net/tarballs/nmt-${version}.tar.gz";
+    hash = "sha256-AO1iLsfZSLbR65tRBsAqJ98CewfSl5yNf7C6XaZj0wM=";
+  };
+
+  installPhase = ''
+    mkdir -pv "$out"
+    cp -rv * "$out"
+  '';
+
+  meta = {
+    homepage = "https://git.sr.ht/~rycee/nmt";
+    description = "A basic test framework for projects using the Nixpkgs module system";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ rycee ];
+  };
+}
diff --git a/pkgs/by-name/ni/nix-web/package.nix b/pkgs/by-name/ni/nix-web/package.nix
index e41e760a29397..bc79ba376e1e0 100644
--- a/pkgs/by-name/ni/nix-web/package.nix
+++ b/pkgs/by-name/ni/nix-web/package.nix
@@ -1,9 +1,12 @@
 { lib
+, stdenv
 , rustPlatform
 , fetchFromGitea
 , pkg-config
 , openssl
-, nix
+, nixVersions
+, nixPackage ? nixVersions.nix_2_17
+, darwin
 }:
 
 let
@@ -11,19 +14,20 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "nix-web";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "gorgon";
     repo = "gorgon";
     rev = "nix-web-v${version}";
-    hash = "sha256-+IDvoMRuMt1nS69yFhPPVs+s6Dj0dgXVdjjd9f3+spk=";
+    hash = "sha256-M/0nlD2jUtvdWJ647QHrp8JcUUVYxiLJlGjnZ+cfpYU=";
   };
-  cargoHash = "sha256-uVBfIw++MRxgVAC+KzGVuMZra8oktUfHcZQk90FF1a8=";
+  cargoHash = "sha256-6kcpP/CFiy571B98Y96/cdcClH50gdyPLZ28Npva7B4=";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ];
+  buildInputs = lib.optional (!stdenv.isDarwin) openssl
+    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
 
   postPatch = ''
     substituteInPlace nix-web/nix-web.service \
@@ -36,12 +40,13 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = cargoFlags;
   cargoTestFlags = cargoFlags;
 
-  NIX_WEB_BUILD_NIX_CLI_PATH = "${nix}/bin/nix";
+  NIX_WEB_BUILD_NIX_CLI_PATH = "${nixPackage}/bin/nix";
 
   meta = with lib; {
     description = "Web interface for the Nix store";
     homepage = "https://codeberg.org/gorgon/gorgon/src/branch/main/nix-web";
     license = licenses.eupl12;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ embr ];
     mainProgram = "nix-web";
   };
diff --git a/pkgs/desktops/gnome/core/gnome-shell/default.nix b/pkgs/desktops/gnome/core/gnome-shell/default.nix
index 85f5b5d42cb04..f3d4317f461a7 100644
--- a/pkgs/desktops/gnome/core/gnome-shell/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-shell/default.nix
@@ -67,13 +67,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell";
-  version = "45.2";
+  version = "45.3";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell/${lib.versions.major finalAttrs.version}/gnome-shell-${finalAttrs.version}.tar.xz";
-    sha256 = "igz7+HKxp2JpbIbhPe/p82dekteVFOup0AC1thHCaiM=";
+    sha256 = "OhlyRyDYJ03GvO1o4N1fx2aKBM15l4y7uCI0dMzdqas=";
   };
 
   patches = [
diff --git a/pkgs/desktops/gnome/core/mutter/default.nix b/pkgs/desktops/gnome/core/mutter/default.nix
index 119ee0efeb54e..cfd202f8c5240 100644
--- a/pkgs/desktops/gnome/core/mutter/default.nix
+++ b/pkgs/desktops/gnome/core/mutter/default.nix
@@ -67,13 +67,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mutter";
-  version = "45.2";
+  version = "45.3";
 
   outputs = [ "out" "dev" "man" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
-    sha256 = "rz+Ym/IqVg3CSS+44Z+do3zm1xRLPgUZgLDVUFiWANw=";
+    sha256 = "t4rqfz4r7IMioq8EBHFr4iaZBcfVDASwsqcaOIFPzQE=";
   };
 
   mesonFlags = [
diff --git a/pkgs/desktops/gnome/core/rygel/default.nix b/pkgs/desktops/gnome/core/rygel/default.nix
index 059fcde8ea3ca..dd890ab17f9c4 100644
--- a/pkgs/desktops/gnome/core/rygel/default.nix
+++ b/pkgs/desktops/gnome/core/rygel/default.nix
@@ -28,14 +28,14 @@
 
 stdenv.mkDerivation rec {
   pname = "rygel";
-  version = "0.42.4";
+  version = "0.42.5";
 
   # TODO: split out lib
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "YxDfqi0zK2YRm5sCD61qS9J9m8Yfr3gMpcoLYoEzA/c=";
+    sha256 = "ETNgLS5nEKreayKqmNkzhMjVY5bzRHY0E+luARC32J8=";
   };
 
   patches = [
diff --git a/pkgs/development/beam-modules/default.nix b/pkgs/development/beam-modules/default.nix
index b7b2cc9c7dcfe..791f596be4160 100644
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@@ -45,6 +45,11 @@ let
       # BEAM-based languages.
       elixir = elixir_1_15;
 
+      elixir_1_16 = lib'.callElixir ../interpreters/elixir/1.16.nix {
+        inherit erlang;
+        debugInfo = true;
+      };
+
       elixir_1_15 = lib'.callElixir ../interpreters/elixir/1.15.nix {
         inherit erlang;
         debugInfo = true;
diff --git a/pkgs/development/compilers/vlang/default.nix b/pkgs/development/compilers/vlang/default.nix
index 66b8715590575..a0acfd263474f 100644
--- a/pkgs/development/compilers/vlang/default.nix
+++ b/pkgs/development/compilers/vlang/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, glfw, freetype, openssl, makeWrapper, upx, boehmgc, xorg, binaryen, darwin }:
 
 let
-  version = "0.4.3";
+  version = "0.4.4";
   ptraceSubstitution = ''
     #include <sys/types.h>
     #include <sys/ptrace.h>
@@ -10,12 +10,12 @@ let
   # So we fix its rev to correspond to the V version.
   vc = stdenv.mkDerivation {
     pname = "v.c";
-    version = "0.4.3";
+    version = "0.4.4";
     src = fetchFromGitHub {
       owner = "vlang";
       repo = "vc";
-      rev = "5e691a82c01957870b451e06216a9fb3a4e83a18";
-      hash = "sha256-Ti2b88NDG1pppj34BeK8+UsT2HiG/jcAF2mHgiBBRaI=";
+      rev = "66eb8eae253d31fa5622e35a69580d9ad8efcccb";
+      hash = "sha256-YGlzr0Qq7+NtrnbaFPBuclzjOZBOnTe3BOhsuwdsQ5c=";
     };
 
     # patch the ptrace reference for darwin
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
     owner = "vlang";
     repo = "v";
     rev = version;
-    hash = "sha256-ZFBQD7SP38VnEMoOnwr/n8zZuLtR7GR3OCYhvfz3apI=";
+    hash = "sha256-Aqecw8K+igHx5R34lQiWtdNfeGn+umcjcS4w0vXgpLM=";
   };
 
   propagatedBuildInputs = [ glfw freetype openssl ]
diff --git a/pkgs/development/interpreters/elixir/1.16.nix b/pkgs/development/interpreters/elixir/1.16.nix
new file mode 100644
index 0000000000000..8a320eae7bb2e
--- /dev/null
+++ b/pkgs/development/interpreters/elixir/1.16.nix
@@ -0,0 +1,8 @@
+{ mkDerivation }:
+mkDerivation {
+  version = "1.16.0";
+  sha256 = "sha256-nM3TpX18zdjDAFkljsAqwKx/1AQmwDMIQCeL75etTQc=";
+  # https://hexdocs.pm/elixir/1.16.0/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp
+  minimumOTPVersion = "24";
+  escriptPath = "lib/elixir/scripts/generate_app.escript";
+}
diff --git a/pkgs/development/libraries/folks/default.nix b/pkgs/development/libraries/folks/default.nix
index b3c6f0a591561..582a05d2ea85d 100644
--- a/pkgs/development/libraries/folks/default.nix
+++ b/pkgs/development/libraries/folks/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "folks";
-  version = "0.15.6";
+  version = "0.15.7";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "yGZjDFU/Kc6b4cemAmfLQICmvM9LjVUdxMfmI02EAkg=";
+    sha256 = "Eg8hnvYyEsqpWuf2rrZOKZKLCxqLlFIFQwSgDQ80eHE=";
   };
 
   nativeBuildInputs = [
@@ -78,14 +78,15 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     "-Ddocs=true"
     "-Dtelepathy_backend=${lib.boolToString telepathySupport}"
-    # For some reason, the tests are getting stuck on 31/32,
-    # even though the one missing test finishes just fine on next run,
-    # when tests are permuted differently. And another test that
-    # previously passed will be stuck instead.
-    "-Dtests=false"
+    "-Dtests=${lib.boolToString stdenv.isLinux}"
   ];
 
-  doCheck = false;
+  # backends/eds/lib/libfolks-eds.so.26.0.0.p/edsf-persona-store.c:10697:4:
+  # error: call to undeclared function 'folks_persona_store_set_is_user_set_default';
+  # ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=implicit-function-declaration";
+
+  doCheck = stdenv.isLinux;
 
   # Prevents e-d-s add-contacts-stress-test from timing out
   checkPhase = ''
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index b02d38f0a813b..35560613b4f24 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -280,7 +280,7 @@ stdenv.mkDerivation (finalAttrs: {
       "gobject-2.0"
       "gthread-2.0"
     ];
-    platforms   = platforms.unix;
+    platforms   = platforms.unix ++ platforms.windows;
 
     longDescription = ''
       GLib provides the core application building blocks for libraries
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 88f373dd4afad..993fca591e841 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -115,7 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/harfbuzz/harfbuzz/raw/${version}/NEWS";
     maintainers = [ maintainers.eelco ];
     license = licenses.mit;
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
     pkgConfigModules = [
       "harfbuzz"
       "harfbuzz-gobject"
diff --git a/pkgs/development/libraries/libpanel/default.nix b/pkgs/development/libraries/libpanel/default.nix
index c5b325cb8217d..a4f8e71eba2ef 100644
--- a/pkgs/development/libraries/libpanel/default.nix
+++ b/pkgs/development/libraries/libpanel/default.nix
@@ -15,14 +15,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libpanel";
-  version = "1.4.0";
+  version = "1.4.1";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
   src = fetchurl {
     url = "mirror://gnome/sources/libpanel/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "gPFD2QDoztj/hPqG/jTra0gyPLYQvPtoWOpl2LmPFSw=";
+    sha256 = "mEENAOc0hX7N8zuaIN17D7ONi20x1Dabr8HGc5Krud4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libpeas/2.x.nix b/pkgs/development/libraries/libpeas/2.x.nix
index 2b3bd0bc57970..547d7f5c27efd 100644
--- a/pkgs/development/libraries/libpeas/2.x.nix
+++ b/pkgs/development/libraries/libpeas/2.x.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libpeas";
-  version = "2.0.0";
+  version = "2.0.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-VAesvAwS95D3DJ0rmCJKzBvjrEScYGA7gZLKAgtJcBE=";
+    hash = "sha256-ndwdUfOGY9pN9SFjBRt7LOo6JCz67p9afhQPB4TIqnc=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/mm-common/default.nix b/pkgs/development/libraries/mm-common/default.nix
index a8afd6e038f8e..cbc0f86e31b12 100644
--- a/pkgs/development/libraries/mm-common/default.nix
+++ b/pkgs/development/libraries/mm-common/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mm-common";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "cFxtKfQRaim95ONs/BsEbJK274xtrk6uyFAYdH5tpao=";
+    sha256 = "tVxGA3282rxc7js4nqEcw5EK22jr6IPpR3hHqmYIYuc=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index 5e7358fa15f9a..b0fe598cc2eee 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -48,6 +48,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl21;
     maintainers = [ maintainers.raskin ];
     mainProgram = "gr2fonttest";
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
   };
 }
diff --git a/pkgs/development/ocaml-modules/janestreet/0.16.nix b/pkgs/development/ocaml-modules/janestreet/0.16.nix
index 2df4c08e7d588..2c70445405741 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.16.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.16.nix
@@ -141,6 +141,7 @@ with self;
   };
 
   async_ssl = janePackage {
+    version = "0.16.1";
     pname = "async_ssl";
     hash = "sha256-83YKxvVb/JwBnQG4R/R1Ztik9T/hO4cbiNTfFnErpG4=";
     meta.description = "Async wrappers for SSL";
@@ -647,6 +648,7 @@ with self;
   };
 
   ppx_accessor = janePackage {
+    version = "0.16.1";
     pname = "ppx_accessor";
     hash = "sha256-o70q8eSbPeuGkIcCnKoK0BpaqPhy/NS7x2YYR6wfki8=";
     meta.description = "[@@deriving] plugin to generate accessors for use with the Accessor libraries";
@@ -1143,6 +1145,7 @@ with self;
   };
 
   streamable = janePackage {
+    version = "0.16.1";
     pname = "streamable";
     hash = "sha256-3djrUW2tPKaEmoOIpdjN6ok7U9i07yreqbi1kP+6pnY=";
     meta.description = "A collection of types suitable for incremental serialization";
diff --git a/pkgs/development/tools/rust/probe-rs/default.nix b/pkgs/development/tools/rust/probe-rs/default.nix
index 4bb0a4de6a184..90ab81e4ddde8 100644
--- a/pkgs/development/tools/rust/probe-rs/default.nix
+++ b/pkgs/development/tools/rust/probe-rs/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , rustPlatform
-, fetchCrate
+, fetchFromGitHub
 , pkg-config
 , libusb1
 , openssl
@@ -11,14 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "probe-rs";
-  version = "0.21.1";
+  version = "0.22.0";
 
-  src = fetchCrate {
-    inherit pname version;
-    hash = "sha256-UmQwz9Ejb5+epwGKsglV3QdWGqOEH/3DRqvKtfm14kg=";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-7bWx6ZILqdSDY/q51UP/BuCgMH0F4ePMSnclHeF2DY4=";
   };
 
-  cargoHash = "sha256-awa84xvIRrEhuPm4N2xt5bsYy2wbLjJokrKoAxCYvR4=";
+  cargoHash = "sha256-ynmKmXQrUnTcmo0S7FO+l/9EPuzgLCdUOPLuwoG4pbU=";
 
   cargoBuildFlags = [ "--features=cli" ];
 
diff --git a/pkgs/servers/http/tomcat/default.nix b/pkgs/servers/http/tomcat/default.nix
index 3ff672692e7b5..fdbafa313dc76 100644
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@@ -39,12 +39,12 @@ let
 
 in {
   tomcat9 = common {
-    version = "9.0.83";
-    hash = "sha256-dgktroncHzrm3RFATWSFJ2GkAfGM03PJO1/37yzk+Qo=";
+    version = "9.0.85";
+    hash = "sha256-oYdNXi5yADqBJ25alSAASsoRPxNfyEEzQim2j20luh4=";
   };
 
   tomcat10 = common {
-    version = "10.1.16";
-    hash = "sha256-QysLmKN3RQ8TuaR7gup9947QvPLuS3WRgrTH/cH+WEE=";
+    version = "10.1.18";
+    hash = "sha256-baC0y9MUDmSocZot4ZwgvzkC0mShQqgWrFUq4hat4xE=";
   };
 }
diff --git a/pkgs/servers/unifi/default.nix b/pkgs/servers/unifi/default.nix
index c961321a875fa..0346ca2195148 100644
--- a/pkgs/servers/unifi/default.nix
+++ b/pkgs/servers/unifi/default.nix
@@ -67,6 +67,7 @@ in rec {
 
   unifi7 = generic {
     version = "7.5.187";
+    suffix = "-f57f5bf7ab";
     sha256 = "sha256-a5kl8gZbRnhS/p1imPl7soM0/QSFHdM0+2bNmDfc1mY=";
   };
 }
diff --git a/pkgs/tools/misc/wasm-tools/default.nix b/pkgs/tools/misc/wasm-tools/default.nix
index 443cfa85f808f..e192b4a229de4 100644
--- a/pkgs/tools/misc/wasm-tools/default.nix
+++ b/pkgs/tools/misc/wasm-tools/default.nix
@@ -5,19 +5,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-tools";
-  version = "1.0.54";
+  version = "1.0.55";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "${pname}-${version}";
-    hash = "sha256-ZiOuD7aiBI1virfcXzxHnX5/uPZRc+Nntg24K2b9Mbo=";
+    hash = "sha256-9HcHM5ao0lSGctvjYQZNb5wlNsYPTD3NtPDZA/kHJdY=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
-  cargoHash = "sha256-OPNxs5WSQEatIJQ48GYjCzwM4twvQd38W/xsFgU9dB0=";
+  cargoHash = "sha256-fU9tpN+tVlwbTNWinylcRACSLhDD/uPPGW6GNWm/tvo=";
   cargoBuildFlags = [ "--package" "wasm-tools" ];
   cargoTestFlags = [ "--all" ];
 
diff --git a/pkgs/tools/package-management/apx/default.nix b/pkgs/tools/package-management/apx/default.nix
index eb7b0f3a8c712..3ef16403f474d 100644
--- a/pkgs/tools/package-management/apx/default.nix
+++ b/pkgs/tools/package-management/apx/default.nix
@@ -2,21 +2,24 @@
 , buildGoModule
 , fetchFromGitHub
 , distrobox
+, installShellFiles
 }:
 
 buildGoModule rec {
   pname = "apx";
-  version = "2.1.2";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "Vanilla-OS";
     repo = "apx";
     rev = "v${version}";
-    hash = "sha256-0xQfbnLvNB1X1B8440CYHZWFGSQV319IU5tgXS3lyUI=";
+    hash = "sha256-za3QS0ZJuxSCt5xbYa/Kt4ARsDhUn34vJTy0fJoqr9U=";
   };
 
   vendorHash = null;
 
+  nativeBuildInputs = [ installShellFiles ];
+
   ldflags = [ "-s" "-w" ];
 
   postPatch = ''
@@ -28,8 +31,8 @@ buildGoModule rec {
   '';
 
   postInstall = ''
-    install -D config/apx.json -t $out/share/apx/
-    install -D man/man1/apx.1 -t $out/man/man1/
+    install -m 444 -D config/apx.json -t $out/share/apx/
+    installManPage man/man1/*
   '';
 
   meta = with lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8613d8c215693..8200a046d1946 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -17632,7 +17632,7 @@ with pkgs;
   inherit (beam.interpreters)
     erlang erlang_26 erlang_25 erlang_24
     erlang_odbc erlang_javac erlang_odbc_javac
-    elixir elixir_1_15 elixir_1_14 elixir_1_13 elixir_1_12 elixir_1_11 elixir_1_10
+    elixir elixir_1_16 elixir_1_15 elixir_1_14 elixir_1_13 elixir_1_12 elixir_1_11 elixir_1_10
     elixir-ls;
 
   erlang_nox = beam_nox.interpreters.erlang;
diff --git a/pkgs/top-level/beam-packages.nix b/pkgs/top-level/beam-packages.nix
index ff9d1f62ab1f3..ce3ed5e0647d4 100644
--- a/pkgs/top-level/beam-packages.nix
+++ b/pkgs/top-level/beam-packages.nix
@@ -85,7 +85,7 @@ in
     # access for example elixir built with different version of Erlang, use
     # `beam.packages.erlang_24.elixir`.
     inherit (self.packages.erlang)
-      elixir elixir_1_15 elixir_1_14 elixir_1_13 elixir_1_12 elixir_1_11 elixir_1_10 elixir-ls lfe lfe_2_1;
+      elixir elixir_1_16 elixir_1_15 elixir_1_14 elixir_1_13 elixir_1_12 elixir_1_11 elixir_1_10 elixir-ls lfe lfe_2_1;
   } // interpretersAliases;
 
   # Helper function to generate package set with a specific Erlang version.