Merge staging-next into staging

75 files changed, 1099 insertions, 335 deletions

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 6344ca3902eed..7bca80f5af88c 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -24,10 +24,10 @@
 # Libraries
 /lib                        @edolstra @infinisil
 /lib/systems                @alyssais @ericson2314 @amjoseph-nixpkgs
-/lib/generators.nix         @edolstra @Profpatsch
-/lib/cli.nix                @edolstra @Profpatsch
-/lib/debug.nix              @edolstra @Profpatsch
-/lib/asserts.nix            @edolstra @Profpatsch
+/lib/generators.nix         @infinisil @edolstra @Profpatsch
+/lib/cli.nix                @infinisil @edolstra @Profpatsch
+/lib/debug.nix              @infinisil @edolstra @Profpatsch
+/lib/asserts.nix            @infinisil @edolstra @Profpatsch
 /lib/path.*                 @infinisil @fricklerhandwerk
 /lib/fileset                @infinisil
 /doc/functions/fileset.section.md @infinisil
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index eeb7bb0889d49..7fe2ed736f38d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2608,12 +2608,6 @@
     githubId = 200617;
     name = "Ben Sima";
   };
-  bstrik = {
-    email = "dutchman55@gmx.com";
-    github = "bstrik";
-    githubId = 7716744;
-    name = "Berno Strik";
-  };
   btlvr = {
     email = "btlvr@protonmail.com";
     github = "btlvr";
@@ -3886,6 +3880,13 @@
     githubId = 107034852;
     name = "Daniyal Suri";
   };
+  dannixon = {
+    email = "dan@dan-nixon.com";
+    github = "DanNixon";
+    githubId = 4037377;
+    name = "Dan Nixon";
+    matrix = "@dannixon:matrix.org";
+  };
   dansbandit = {
     github = "dansbandit";
     githubId = 4530687;
@@ -14804,6 +14805,12 @@
     githubId = 165283;
     name = "Alexey Kutepov";
   };
+  rexxDigital = {
+    email = "joellarssonpriv@gmail.com";
+    github = "rexxDigital";
+    githubId = 44014925;
+    name = "Rexx Larsson";
+  };
   rgnns = {
     email = "jglievano@gmail.com";
     github = "rgnns";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 02609d2986bf1..85a6227634f13 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -612,6 +612,7 @@ with lib.maintainers; {
 
   minimal-bootstrap = {
     members = [
+      alejandrosame
       artturin
       emilytrau
       ericson2314
diff --git a/nixos/doc/manual/development/activation-script.section.md b/nixos/doc/manual/development/activation-script.section.md
index c339258c6dc48..cc317a6a01aa8 100644
--- a/nixos/doc/manual/development/activation-script.section.md
+++ b/nixos/doc/manual/development/activation-script.section.md
@@ -69,4 +69,4 @@ do:
   `/etc/group` and `/etc/shadow`. This also creates home directories
 - `usrbinenv` creates `/usr/bin/env`
 - `var` creates some directories in `/var` that are not service-specific
-- `wrappers` creates setuid wrappers like `ping` and `sudo`
+- `wrappers` creates setuid wrappers like `sudo`
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 204f421eed6c2..38e249c9bb5e1 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -347,6 +347,8 @@
 
 - DocBook option documentation is no longer supported, all module documentation now uses markdown.
 
+- `services.outline` can now be configured to use local filesystem storage instead of S3 storage using [services.outline.storage.storageType](#opt-services.outline.storage.storageType).
+
 - `buildGoModule` `go-modules` attrs have been renamed to `goModules`.
 
 - The `fonts.fonts` and `fonts.enableDefaultFonts` options have been renamed to `fonts.packages` and `fonts.enableDefaultPackages` respectively.
diff --git a/nixos/modules/config/qt.nix b/nixos/modules/config/qt.nix
index 2b09281e467f9..f82b7ab85a8c3 100644
--- a/nixos/modules/config/qt.nix
+++ b/nixos/modules/config/qt.nix
@@ -1,121 +1,154 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
-
   cfg = config.qt;
 
-  isQGnome = cfg.platformTheme == "gnome" && builtins.elem cfg.style ["adwaita" "adwaita-dark"];
-  isQtStyle = cfg.platformTheme == "gtk2" && !(builtins.elem cfg.style ["adwaita" "adwaita-dark"]);
-  isQt5ct = cfg.platformTheme == "qt5ct";
-  isLxqt = cfg.platformTheme == "lxqt";
-  isKde = cfg.platformTheme == "kde";
-
-  packages =
-    if isQGnome then [
-      pkgs.qgnomeplatform
-      pkgs.adwaita-qt
-      pkgs.qgnomeplatform-qt6
-      pkgs.adwaita-qt6
-    ]
-    else if isQtStyle then [ pkgs.libsForQt5.qtstyleplugins pkgs.qt6Packages.qt6gtk2 ]
-    else if isQt5ct then [ pkgs.libsForQt5.qt5ct pkgs.qt6Packages.qt6ct ]
-    else if isLxqt then [ pkgs.lxqt.lxqt-qtplugin pkgs.lxqt.lxqt-config ]
-    else if isKde then [ pkgs.libsForQt5.plasma-integration pkgs.libsForQt5.systemsettings ]
-    else throw "`qt.platformTheme` ${cfg.platformTheme} and `qt.style` ${cfg.style} are not compatible.";
+  platformPackages = with pkgs; {
+    gnome = [ qgnomeplatform qgnomeplatform-qt6 ];
+    gtk2 = [ libsForQt5.qtstyleplugins qt6Packages.qt6gtk2 ];
+    kde = [ libsForQt5.plasma-integration libsForQt5.systemsettings ];
+    lxqt = [ lxqt.lxqt-qtplugin lxqt.lxqt-config ];
+    qt5ct = [ libsForQt5.qt5ct qt6Packages.qt6ct ];
+  };
+
+  stylePackages = with pkgs; {
+    bb10bright = [ libsForQt5.qtstyleplugins ];
+    bb10dark = [ libsForQt5.qtstyleplugins ];
+    cde = [ libsForQt5.qtstyleplugins ];
+    cleanlooks = [ libsForQt5.qtstyleplugins ];
+    gtk2 = [ libsForQt5.qtstyleplugins qt6Packages.qt6gtk2 ];
+    motif = [ libsForQt5.qtstyleplugins ];
+    plastique = [ libsForQt5.qtstyleplugins ];
 
-in
+    adwaita = [ adwaita-qt adwaita-qt6 ];
+    adwaita-dark = [ adwaita-qt adwaita-qt6 ];
+    adwaita-highcontrast = [ adwaita-qt adwaita-qt6 ];
+    adwaita-highcontrastinverse = [ adwaita-qt adwaita-qt6 ];
+
+    breeze = [ libsForQt5.breeze-qt5 ];
 
+    kvantum = [ libsForQt5.qtstyleplugin-kvantum qt6Packages.qtstyleplugin-kvantum ];
+  };
+in
 {
-  meta.maintainers = [ maintainers.romildo ];
+  meta.maintainers = with lib.maintainers; [ romildo thiagokokada ];
 
   imports = [
-    (mkRenamedOptionModule ["qt5" "enable" ] ["qt" "enable" ])
-    (mkRenamedOptionModule ["qt5" "platformTheme" ] ["qt" "platformTheme" ])
-    (mkRenamedOptionModule ["qt5" "style" ] ["qt" "style" ])
+    (lib.mkRenamedOptionModule [ "qt5" "enable" ] [ "qt" "enable" ])
+    (lib.mkRenamedOptionModule [ "qt5" "platformTheme" ] [ "qt" "platformTheme" ])
+    (lib.mkRenamedOptionModule [ "qt5" "style" ] [ "qt" "style" ])
   ];
 
   options = {
     qt = {
+      enable = lib.mkEnableOption "" // {
+        description = lib.mdDoc ''
+          Whether to enable Qt configuration, including theming.
 
-      enable = mkEnableOption (lib.mdDoc "Qt theming configuration");
+          Enabling this option is necessary for Qt plugins to work in the
+          installed profiles (e.g.: `nix-env -i` or `environment.systemPackages`).
+        '';
+      };
 
-      platformTheme = mkOption {
-        type = types.enum [
-          "gtk2"
-          "gnome"
-          "lxqt"
-          "qt5ct"
-          "kde"
-        ];
+      platformTheme = lib.mkOption {
+        type = with lib.types; nullOr (enum (lib.attrNames platformPackages));
+        default = null;
         example = "gnome";
         relatedPackages = [
           "qgnomeplatform"
           "qgnomeplatform-qt6"
-          ["libsForQt5" "qtstyleplugins"]
-          ["libsForQt5" "qt5ct"]
-          ["lxqt" "lxqt-qtplugin"]
-          ["libsForQt5" "plasma-integration"]
+          [ "libsForQt5" "plasma-integration" ]
+          [ "libsForQt5" "qt5ct" ]
+          [ "libsForQt5" "qtstyleplugins" ]
+          [ "libsForQt5" "systemsettings" ]
+          [ "lxqt" "lxqt-config" ]
+          [ "lxqt" "lxqt-qtplugin" ]
+          [ "qt6Packages" "qt6ct" ]
+          [ "qt6Packages" "qt6gtk2" ]
         ];
         description = lib.mdDoc ''
           Selects the platform theme to use for Qt applications.
 
           The options are
-          - `gtk`: Use GTK theme with [qtstyleplugins](https://github.com/qt/qtstyleplugins)
           - `gnome`: Use GNOME theme with [qgnomeplatform](https://github.com/FedoraQt/QGnomePlatform)
+          - `gtk2`: Use GTK theme with [qtstyleplugins](https://github.com/qt/qtstyleplugins)
+          - `kde`: Use Qt settings from Plasma.
           - `lxqt`: Use LXQt style set using the [lxqt-config-appearance](https://github.com/lxqt/lxqt-config)
              application.
           - `qt5ct`: Use Qt style set using the [qt5ct](https://sourceforge.net/projects/qt5ct/)
-             application.
-          - `kde`: Use Qt settings from Plasma.
+             and [qt6ct](https://github.com/trialuser02/qt6ct) applications.
         '';
       };
 
-      style = mkOption {
-        type = types.enum [
-          "adwaita"
-          "adwaita-dark"
-          "cleanlooks"
-          "gtk2"
-          "motif"
-          "plastique"
-        ];
+      style = lib.mkOption {
+        type = with lib.types; nullOr (enum (lib.attrNames stylePackages));
+        default = null;
         example = "adwaita";
         relatedPackages = [
           "adwaita-qt"
           "adwaita-qt6"
-          ["libsForQt5" "qtstyleplugins"]
-          ["qt6Packages" "qt6gtk2"]
+          [ "libsForQt5" "breeze-qt5" ]
+          [ "libsForQt5" "qtstyleplugin-kvantum" ]
+          [ "libsForQt5" "qtstyleplugins" ]
+          [ "qt6Packages" "qt6gtk2" ]
+          [ "qt6Packages" "qtstyleplugin-kvantum" ]
         ];
         description = lib.mdDoc ''
           Selects the style to use for Qt applications.
 
           The options are
-          - `adwaita`, `adwaita-dark`: Use Adwaita Qt style with
+          - `adwaita`, `adwaita-dark`, `adwaita-highcontrast`, `adawaita-highcontrastinverse`:
+            Use Adwaita Qt style with
             [adwaita](https://github.com/FedoraQt/adwaita-qt)
-          - `cleanlooks`, `gtk2`, `motif`, `plastique`: Use styles from
+          - `breeze`: Use the Breeze style from
+            [breeze](https://github.com/KDE/breeze)
+          - `bb10bright`, `bb10dark`, `cleanlooks`, `gtk2`, `motif`, `plastique`:
+            Use styles from
             [qtstyleplugins](https://github.com/qt/qtstyleplugins)
+          - `kvantum`: Use styles from
+            [kvantum](https://github.com/tsujan/Kvantum)
         '';
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
+    assertions =
+      let
+        gnomeStyles = [
+          "adwaita"
+          "adwaita-dark"
+          "adwaita-highcontrast"
+          "adwaita-highcontrastinverse"
+          "breeze"
+        ];
+      in
+      [
+        {
+          assertion = cfg.platformTheme == "gnome" -> (builtins.elem cfg.style gnomeStyles);
+          message = ''
+            `qt.platformTheme` "gnome" must have `qt.style` set to a theme that supports both Qt and Gtk,
+            for example: ${lib.concatStringsSep ", " gnomeStyles}.
+          '';
+        }
+      ];
 
     environment.variables = {
-      QT_QPA_PLATFORMTHEME = cfg.platformTheme;
-      QT_STYLE_OVERRIDE = mkIf (! (isQt5ct || isLxqt || isKde)) cfg.style;
+      QT_QPA_PLATFORMTHEME = lib.mkIf (cfg.platformTheme != null) cfg.platformTheme;
+      QT_STYLE_OVERRIDE = lib.mkIf (cfg.style != null) cfg.style;
     };
 
-    environment.profileRelativeSessionVariables = let
-      qtVersions = with pkgs; [ qt5 qt6 ];
-    in {
-      QT_PLUGIN_PATH = map (qt: "/${qt.qtbase.qtPluginPrefix}") qtVersions;
-      QML2_IMPORT_PATH = map (qt: "/${qt.qtbase.qtQmlPrefix}") qtVersions;
-    };
-
-    environment.systemPackages = packages;
+    environment.profileRelativeSessionVariables =
+      let
+        qtVersions = with pkgs; [ qt5 qt6 ];
+      in
+      {
+        QT_PLUGIN_PATH = map (qt: "/${qt.qtbase.qtPluginPrefix}") qtVersions;
+        QML2_IMPORT_PATH = map (qt: "/${qt.qtbase.qtQmlPrefix}") qtVersions;
+      };
 
+    environment.systemPackages =
+      lib.optionals (cfg.platformTheme != null) (platformPackages.${cfg.platformTheme})
+      ++ lib.optionals (cfg.style != null) (stylePackages.${cfg.style});
   };
 }
diff --git a/nixos/modules/programs/fish.nix b/nixos/modules/programs/fish.nix
index b500b8f24b2cb..e6ac6e9957bac 100644
--- a/nixos/modules/programs/fish.nix
+++ b/nixos/modules/programs/fish.nix
@@ -208,7 +208,7 @@ in
         end
 
         # if we haven't sourced the login config, do it
-        status --is-login; and not set -q __fish_nixos_login_config_sourced
+        status is-login; and not set -q __fish_nixos_login_config_sourced
         and begin
           ${sourceEnv "loginShellInit"}
 
@@ -220,7 +220,7 @@ in
         end
 
         # if we haven't sourced the interactive config, do it
-        status --is-interactive; and not set -q __fish_nixos_interactive_config_sourced
+        status is-interactive; and not set -q __fish_nixos_interactive_config_sourced
         and begin
           ${fishAbbrs}
           ${fishAliases}
diff --git a/nixos/modules/security/apparmor/profiles.nix b/nixos/modules/security/apparmor/profiles.nix
index 8eb630b5a48a5..0bf90a0086556 100644
--- a/nixos/modules/security/apparmor/profiles.nix
+++ b/nixos/modules/security/apparmor/profiles.nix
@@ -2,10 +2,4 @@
 let apparmor = config.security.apparmor; in
 {
 config.security.apparmor.packages = [ pkgs.apparmor-profiles ];
-config.security.apparmor.policies."bin.ping".profile = lib.mkIf apparmor.policies."bin.ping".enable ''
-  include "${pkgs.iputils.apparmor}/bin.ping"
-  include "${pkgs.inetutils.apparmor}/bin.ping"
-  # Note that including those two profiles in the same profile
-  # would not work if the second one were to re-include <tunables/global>.
-'';
 }
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 7dc08d4356aab..99bac86a8e9a6 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -588,11 +588,12 @@ in {
           "~@privileged"
         ] ++ optionals (any useComponent componentsUsingPing) [
           "capset"
+          "setuid"
         ];
         UMask = "0077";
       };
       path = [
-        "/run/wrappers" # needed for ping
+        pkgs.unixtools.ping # needed for ping
       ];
     };
 
diff --git a/nixos/modules/services/web-apps/outline.nix b/nixos/modules/services/web-apps/outline.nix
index 1d8298963e6df..0e3bd07c1fc14 100644
--- a/nixos/modules/services/web-apps/outline.nix
+++ b/nixos/modules/services/web-apps/outline.nix
@@ -117,13 +117,14 @@ in
     storage = lib.mkOption {
       description = lib.mdDoc ''
         To support uploading of images for avatars and document attachments an
-        s3-compatible storage must be provided. AWS S3 is recommended for
+        s3-compatible storage can be provided. AWS S3 is recommended for
         redundancy however if you want to keep all file storage local an
         alternative such as [minio](https://github.com/minio/minio)
         can be used.
+        Local filesystem storage can also be used.
 
-        A more detailed guide on setting up S3 is available
-        [here](https://wiki.generaloutline.com/share/125de1cc-9ff6-424b-8415-0d58c809a40f).
+        A more detailed guide on setting up storage is available
+        [here](https://docs.getoutline.com/s/hosting/doc/file-storage-N4M0T6Ypu7).
       '';
       example = lib.literalExpression ''
         {
@@ -136,6 +137,19 @@ in
       '';
       type = lib.types.submodule {
         options = {
+          storageType = lib.mkOption {
+            type = lib.types.enum [ "local" "s3" ];
+            description = lib.mdDoc "File storage type, it can be local or s3.";
+            default = "s3";
+          };
+          localRootDir = lib.mkOption {
+            type = lib.types.str;
+            description = lib.mdDoc ''
+              If `storageType` is `local`, this sets the parent directory
+              under which all attachments/images go.
+            '';
+            default = "/var/lib/outline/data";
+          };
           accessKey = lib.mkOption {
             type = lib.types.str;
             description = lib.mdDoc "S3 access key.";
@@ -557,7 +571,10 @@ in
     systemd.tmpfiles.rules = [
       "f ${cfg.secretKeyFile} 0600 ${cfg.user} ${cfg.group} -"
       "f ${cfg.utilsSecretFile} 0600 ${cfg.user} ${cfg.group} -"
-      "f ${cfg.storage.secretKeyFile} 0600 ${cfg.user} ${cfg.group} -"
+      (if (cfg.storage.storageType == "s3") then
+        "f ${cfg.storage.secretKeyFile} 0600 ${cfg.user} ${cfg.group} -"
+      else
+        "d ${cfg.storage.localRootDir} 0700 ${cfg.user} ${cfg.group} - -")
     ];
 
     services.postgresql = lib.mkIf (cfg.databaseUrl == "local") {
@@ -599,14 +616,6 @@ in
           URL = cfg.publicUrl;
           PORT = builtins.toString cfg.port;
 
-          AWS_ACCESS_KEY_ID = cfg.storage.accessKey;
-          AWS_REGION = cfg.storage.region;
-          AWS_S3_UPLOAD_BUCKET_URL = cfg.storage.uploadBucketUrl;
-          AWS_S3_UPLOAD_BUCKET_NAME = cfg.storage.uploadBucketName;
-          AWS_S3_UPLOAD_MAX_SIZE = builtins.toString cfg.storage.uploadMaxSize;
-          AWS_S3_FORCE_PATH_STYLE = builtins.toString cfg.storage.forcePathStyle;
-          AWS_S3_ACL = cfg.storage.acl;
-
           CDN_URL = cfg.cdnUrl;
           FORCE_HTTPS = builtins.toString cfg.forceHttps;
           ENABLE_UPDATES = builtins.toString cfg.enableUpdateCheck;
@@ -622,8 +631,21 @@ in
           RATE_LIMITER_ENABLED = builtins.toString cfg.rateLimiter.enable;
           RATE_LIMITER_REQUESTS = builtins.toString cfg.rateLimiter.requests;
           RATE_LIMITER_DURATION_WINDOW = builtins.toString cfg.rateLimiter.durationWindow;
+
+          FILE_STORAGE = cfg.storage.storageType;
+          FILE_STORAGE_UPLOAD_MAX_SIZE = builtins.toString cfg.storage.uploadMaxSize;
+          FILE_STORAGE_LOCAL_ROOT_DIR = cfg.storage.localRootDir;
         }
 
+        (lib.mkIf (cfg.storage.storageType == "s3") {
+          AWS_ACCESS_KEY_ID = cfg.storage.accessKey;
+          AWS_REGION = cfg.storage.region;
+          AWS_S3_UPLOAD_BUCKET_URL = cfg.storage.uploadBucketUrl;
+          AWS_S3_UPLOAD_BUCKET_NAME = cfg.storage.uploadBucketName;
+          AWS_S3_FORCE_PATH_STYLE = builtins.toString cfg.storage.forcePathStyle;
+          AWS_S3_ACL = cfg.storage.acl;
+        })
+
         (lib.mkIf (cfg.slackAuthentication != null) {
           SLACK_CLIENT_ID = cfg.slackAuthentication.clientId;
         })
@@ -676,7 +698,9 @@ in
       script = ''
         export SECRET_KEY="$(head -n1 ${lib.escapeShellArg cfg.secretKeyFile})"
         export UTILS_SECRET="$(head -n1 ${lib.escapeShellArg cfg.utilsSecretFile})"
-        export AWS_SECRET_ACCESS_KEY="$(head -n1 ${lib.escapeShellArg cfg.storage.secretKeyFile})"
+        ${lib.optionalString (cfg.storage.storageType == "s3") ''
+          export AWS_SECRET_ACCESS_KEY="$(head -n1 ${lib.escapeShellArg cfg.storage.secretKeyFile})"
+        ''}
         ${lib.optionalString (cfg.slackAuthentication != null) ''
           export SLACK_CLIENT_SECRET="$(head -n1 ${lib.escapeShellArg cfg.slackAuthentication.secretFile})"
         ''}
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
index 6f0a62d0ea899..64c8ab74bba6a 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@@ -49,7 +49,7 @@ let
     '';
   };
 
-  checkedSystemdBootBuilder = pkgs.runCommand "systemd-boot" {
+  checkedSystemdBootBuilder = pkgs.runCommandLocal "systemd-boot" {
     nativeBuildInputs = [ pkgs.mypy ];
   } ''
     install -m755 ${systemdBootBuilder} $out
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index cd0de51a6e08a..853a2cb31432b 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1406,28 +1406,6 @@ in
           val = tempaddrValues.${opt}.sysctl;
          in nameValuePair "net.ipv6.conf.${replaceStrings ["."] ["/"] i.name}.use_tempaddr" val));
 
-    security.wrappers = {
-      ping = {
-        owner = "root";
-        group = "root";
-        capabilities = "cap_net_raw+p";
-        source = "${pkgs.iputils.out}/bin/ping";
-      };
-    };
-    security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter ''
-      /run/wrappers/bin/ping {
-        include <abstractions/base>
-        include <nixos/security.wrappers/ping>
-        rpx /run/wrappers/wrappers.*/ping,
-      }
-      /run/wrappers/wrappers.*/ping {
-        include <abstractions/base>
-        include <nixos/security.wrappers/ping>
-        capability net_raw,
-        capability setpcap,
-      }
-    '');
-
     # Set the host and domain names in the activation script.  Don't
     # clear it if it's not configured in the NixOS configuration,
     # since it may have been set by dhcpcd in the meantime.
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index 5a1c4b67f221c..1a39cc73c8868 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -180,7 +180,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
 
     # Do some IP traffic
     output_ping = machine.succeed(
-        "systemd-run --wait -- /run/wrappers/bin/ping -c 1 127.0.0.1 2>&1"
+        "systemd-run --wait -- ping -c 1 127.0.0.1 2>&1"
     )
 
     with subtest("systemd reports accounting data on system.slice"):
diff --git a/pkgs/README.md b/pkgs/README.md
index bfa7e611255d3..4845cfa31755c 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -362,7 +362,7 @@ All versions of a package _must_ be included in `all-packages.nix` to make sure
   * If there is no upstream license, `meta.license` should default to `lib.licenses.unfree`.
   * If in doubt, try to contact the upstream developers for clarification.
 * `meta.mainProgram` must be set when appropriate.
-* `meta.maintainers` should be set.
+* `meta.maintainers` must be set for new packages.
 
 See the Nixpkgs manual for more details on [standard meta-attributes](https://nixos.org/nixpkgs/manual/#sec-standard-meta-attributes).
 
diff --git a/pkgs/applications/misc/leetcode-cli/default.nix b/pkgs/applications/misc/leetcode-cli/default.nix
index be9102b6120b3..4ea55b39c5315 100644
--- a/pkgs/applications/misc/leetcode-cli/default.nix
+++ b/pkgs/applications/misc/leetcode-cli/default.nix
@@ -2,6 +2,7 @@
 , fetchCrate
 , rustPlatform
 , pkg-config
+, installShellFiles
 , openssl
 , dbus
 , sqlite
@@ -24,6 +25,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
+    installShellFiles
   ];
 
   buildInputs = [
@@ -32,6 +34,13 @@ rustPlatform.buildRustPackage rec {
     sqlite
   ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
+  postInstall = ''
+    installShellCompletion --cmd leetcode \
+      --bash <($out/bin/leetcode completions bash) \
+      --fish <($out/bin/leetcode completions fish) \
+      --zsh <($out/bin/leetcode completions zsh)
+  '';
+
   passthru.tests = testers.testVersion {
     package = leetcode-cli;
     command = "leetcode -V";
diff --git a/pkgs/applications/misc/slweb/default.nix b/pkgs/applications/misc/slweb/default.nix
index 1c6931fadcd46..ee5e01b79956a 100644
--- a/pkgs/applications/misc/slweb/default.nix
+++ b/pkgs/applications/misc/slweb/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slweb";
-  version = "0.6.11";
+  version = "0.9.0";
 
   src = fetchFromSourcehut {
     owner = "~strahinja";
     repo = "slweb";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+bKapK/s1pmo1NRRslf7V4ogWTtchFNWpzi+S8YG6+4=";
+    hash = "sha256-QDHcp5pCmapgOlJpDDyyC12JOfh/biDyF6O+iKGbOGg=";
   };
 
   nativeBuildInputs = [ redo-apenwarr ];
diff --git a/pkgs/applications/networking/cluster/kaniko/default.nix b/pkgs/applications/networking/cluster/kaniko/default.nix
index 7639c95a971f5..13ccf5599ce7d 100644
--- a/pkgs/applications/networking/cluster/kaniko/default.nix
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "kaniko";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "kaniko";
     rev = "v${version}";
-    hash = "sha256-PTcPlYJ0IHWNQKBJcMiotGp6GPH3qY3f6sJKgUVSTZU=";
+    hash = "sha256-O4FPz62QnvG+Q2l4Gr/O0XFpkXE2G4RO/G6KNDdanzk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index 97d3a3140209a..ac142ca3597e4 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -20,13 +20,13 @@
 
 buildGoModule rec {
   pname = "kubernetes";
-  version = "1.28.2";
+  version = "1.28.3";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    hash = "sha256-7juoX4nFvQbIIbhTlnIYVUEYUJGwu+aKrpw4ltujjXI=";
+    hash = "sha256-lb9FAk3b6J92viyHzLCzbYRxhQS94/FQvDr1m1kdTq8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/sync/storj-uplink/default.nix b/pkgs/applications/networking/sync/storj-uplink/default.nix
index f8b381b4384e2..f1cf8489c8086 100644
--- a/pkgs/applications/networking/sync/storj-uplink/default.nix
+++ b/pkgs/applications/networking/sync/storj-uplink/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.89.2";
+  version = "1.90.1";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-tbzdfKA3ojwTvJ+t7jLLy3iKQ/x/0lXDcb2w1XcyEhs=";
+    hash = "sha256-LJtNsemNbN+TLyUxSgB/wftKxOfI/y/t+qv1TjcsXzQ=";
   };
 
   subPackages = [ "cmd/uplink" ];
 
-  vendorHash = "sha256-AME5EM2j7PQ/DodK+3BiVepTRbwMqqItQbmCJ2lrGM8=";
+  vendorHash = "sha256-R713WhFrWT7Cgstk3SLuvvyk3/ZtT1LOH0qqmFcWzKw=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index e7181d59afaff..804446d6fe7a6 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.14.2";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-eST70KMdGgbTo4FNL3K5YGn9lwIGroG4y4ExKDb30hU=";
+    hash = "sha256-52vBN/EdO0R2Lt/Iv33Odl437I8kgUhxXwtUuiaAcAU=";
   };
 
-  cargoHash = "sha256-h5ooNR0IeXWyY6PuZM/bQLkX4F0eZsEY2eoIgo0nRFA=";
+  cargoHash = "sha256-j6FsI6FpBXtaNcVDY84UBcqifXuJxBRW5Gdln8pq7Iw=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/re/reactphysics3d/package.nix b/pkgs/by-name/re/reactphysics3d/package.nix
new file mode 100644
index 0000000000000..f775d7d542409
--- /dev/null
+++ b/pkgs/by-name/re/reactphysics3d/package.nix
@@ -0,0 +1,23 @@
+{ lib, stdenv, fetchFromGitHub, cmake }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "reactphysics3d";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "DanielChappuis";
+    repo = "reactphysics3d";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-AUdsUXsygsGfS8H+AHEV1fSrrX7zGmfsaTONYUG3zqk=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "An open source C++ physics engine library";
+    homepage = "https://www.reactphysics3d.com";
+    maintainers = with maintainers; [ rexxDigital ];
+    license = licenses.zlib;
+    platforms = platforms.all;
+  };
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix b/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix
index e22b02825b758..a6b78b70b2443 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix
@@ -1,38 +1,47 @@
-{ lib, stdenv, dockapps-sources, pkg-config, libX11, libXpm, libXext, alsa-lib }:
-
-stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, alsa-lib
+, dockapps-sources
+, libX11
+, libXext
+, libXpm
+, pkg-config
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "AlsaMixer.app";
-  version = "0.2.1";
 
-  src = dockapps-sources;
+  inherit (dockapps-sources) version src;
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libX11 libXpm libXext alsa-lib ];
+  sourceRoot = "${finalAttrs.src.name}/AlsaMixer.app";
 
-  setSourceRoot = ''
-    export sourceRoot=$(echo */${pname})
-  '';
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
-  dontConfigure = true;
+  buildInputs = [
+    alsa-lib
+    libX11
+    libXpm
+    libXext
+  ];
 
-  preInstall = ''
-    install -d ${placeholder "out"}/bin
-  '';
+  hardeningDisable = [ "fortify" ];
+
+  dontConfigure = true;
 
   installPhase = ''
     runHook preInstall
-    install -t ${placeholder "out"}/bin AlsaMixer.app
+    install -D -t ${placeholder "out"}/bin/ AlsaMixer.app
+    pushd ${placeholder "out"}/bin
+    ln -vs AlsaMixer.app AlsaMixer
     runHook postInstall
   '';
 
-  postInstall = ''
-    ln -s ${placeholder "out"}/bin/AlsaMixer.app ${placeholder "out"}/bin/AlsaMixer
-  '';
-
-  meta = with lib; {
+  meta = {
     description = "Alsa mixer application for Windowmaker";
     homepage = "https://www.dockapps.net/alsamixerapp";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.bstrik ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/cputnik.nix b/pkgs/by-name/wi/windowmaker/dockapps/cputnik.nix
new file mode 100644
index 0000000000000..6ac10e374e0fd
--- /dev/null
+++ b/pkgs/by-name/wi/windowmaker/dockapps/cputnik.nix
@@ -0,0 +1,46 @@
+{ lib
+, stdenv
+, dockapps-sources
+, libX11
+, libXext
+, libXpm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cputnik";
+
+  inherit (dockapps-sources) version src;
+
+  sourceRoot = "${finalAttrs.src.name}/cputnik/src";
+
+  buildInputs = [
+    libX11
+    libXpm
+    libXext
+  ];
+
+  preBuild = ''
+    makeFlagsArray+=(
+      INCS="-I${libX11.dev}/include -I${libXext.dev}/include -I${libXpm.dev}/include"
+      LIBS="-L${libX11}/lib -L${libXext}/lib -L${libXpm}/lib -lX11 -lXpm -lXext"
+    )
+  '';
+
+  hardeningDisable = [ "format" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 -t $out/bin/ cputnik
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A Calendar clock with antialiased text";
+    homepage = "https://www.dockapps.net/wmcalclock";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/default.nix b/pkgs/by-name/wi/windowmaker/dockapps/default.nix
index 8a66fdbd67f23..84cfe01bddf35 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/default.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/default.nix
@@ -1,20 +1,29 @@
 { config, lib, pkgs }:
 
-lib.makeScope pkgs.newScope (self: with self; {
+lib.makeScope pkgs.newScope (self: {
 
-  dockapps-sources = pkgs.fetchgit {
-    url = "https://repo.or.cz/dockapps.git";
-    rev = "b2b9d872ee61c9b329e4597c301e4417cbd9c3ea";
-    sha256 = "sha256-BuSnwPIj3gUWMjj++SK+117xm/77u4gXLQzRFttei0w=";
+  dockapps-sources = {
+    pname = "dockapps-sources";
+    version = "2023-10-11"; # Shall correspond to src.rev
+
+    src = pkgs.fetchFromRepoOrCz {
+      repo = "dockapps";
+      rev = "1bbb32008ecb58acaec9ea70e00b4ea1735408fc";
+      hash = "sha256-BLUDe/cIIuh9mCtafbcBSDatUXSRD83FeyYhcbem5FU=";
+    };
   };
 
-  libdockapp = callPackage ./libdockapp.nix { };
+  AlsaMixer-app = self.callPackage ./AlsaMixer-app.nix { };
+
+  cputnik = self.callPackage ./cputnik.nix { };
+
+  libdockapp = self.callPackage ./libdockapp.nix { };
 
-  AlsaMixer-app = callPackage ./AlsaMixer-app.nix { };
+  wmCalClock = self.callPackage ./wmCalClock.nix { };
 
-  wmCalClock = callPackage ./wmCalClock.nix { };
+  wmcube = self.callPackage ./wmcube.nix { };
 
-  wmsm-app = callPackage ./wmsm-app.nix { };
+  wmsm-app = self.callPackage ./wmsm-app.nix { };
 
-  wmsystemtray = callPackage ./wmsystemtray.nix { };
+  wmsystemtray = self.callPackage ./wmsystemtray.nix { };
 })
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix b/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix
index aaf99ec932e62..12446bfc7262f 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix
@@ -1,30 +1,36 @@
-{ lib, stdenv, dockapps-sources, autoreconfHook, pkg-config
-, libX11, libXext, libXpm, mkfontdir, fontutil }:
+{ lib
+, stdenv
+, autoreconfHook
+, dockapps-sources
+, fontutil
+, libX11
+, libXext
+, libXpm
+, mkfontdir
+, pkg-config
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libdockapp";
-  version = "0.7.3";
 
-  src = dockapps-sources;
+  inherit (dockapps-sources) version src;
+
+  sourceRoot = "${finalAttrs.src.name}/libdockapp";
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [ libX11 libXext libXpm fontutil mkfontdir ];
 
-  setSourceRoot = ''
-    export sourceRoot=$(echo */${pname})
-  '';
-
   # There is a bug on --with-font
   configureFlags = [
     "--with-examples=no"
     "--with-font=no"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "A library providing a framework for dockapps";
     homepage = "https://www.dockapps.net/libdockapp";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.bstrik ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix
index 9f49b4508c1ca..1dc130971ded4 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix
@@ -1,17 +1,23 @@
-{ lib, stdenv, dockapps-sources
-, libX11, libXpm, libXext }:
-
-stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, dockapps-sources
+, libX11
+, libXext
+, libXpm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "wmCalClock";
-  version = "1.25";
 
-  src = dockapps-sources;
+  inherit (dockapps-sources) version src;
 
-  buildInputs = [ libX11 libXpm libXext ];
+  sourceRoot = "${finalAttrs.src.name}/wmCalClock";
 
-  setSourceRoot = ''
-    export sourceRoot=$(echo */${pname}/Src)
-  '';
+  buildInputs = [
+    libX11
+    libXpm
+    libXext
+  ];
 
   preBuild = ''
     makeFlagsArray+=(
@@ -28,11 +34,11 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "DESTDIR=${placeholder "out"}" ];
 
-  meta = with lib; {
+  meta = {
     description = "A Calendar clock with antialiased text";
     homepage = "https://www.dockapps.net/wmcalclock";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.bstrik ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/wmcube.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmcube.nix
new file mode 100644
index 0000000000000..5aaa00e23e344
--- /dev/null
+++ b/pkgs/by-name/wi/windowmaker/dockapps/wmcube.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, dockapps-sources
+, libX11
+, libXpm
+, libXext
+, libdockapp
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "wmcube";
+
+  inherit (dockapps-sources) version src;
+
+  sourceRoot = "${finalAttrs.src.name}/wmcube/wmcube";
+
+  buildInputs = [
+    libX11
+    libXext
+    libXpm
+    libdockapp
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89";
+
+  preBuild = ''
+    makeFlagsArray=(
+      CC="${stdenv.cc.targetPrefix}cc"
+      PREFIX="${placeholder "out"}"
+      VERSION="${finalAttrs.version}"
+      LIBDIR="-L${lib.getLib libX11}/lib -L${lib.getLib libXext}/lib \
+-L${lib.getLib libXpm}/lib -L${lib.getLib libdockapp}/lib"
+      INCDIR="-I${lib.getDev libX11}/lib -I${lib.getDev libXext}/lib \
+-I${lib.getDev libXpm}/lib -I${lib.getDev libdockapp}/lib"
+      LIBS="-lm -lXpm -lXext -lX11 -ldockapp"
+    )
+  '';
+
+  preInstall = ''
+    mkdir -pv $out/{bin,doc/wmcube-${finalAttrs.version},share/wmcube,man/man1}
+  '';
+
+  meta = {
+    description = "System monitor for Windowmaker";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
+  };
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix
index 5c68a39a1ead5..6becfce9578bc 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix
@@ -1,20 +1,25 @@
-{ lib, stdenv, dockapps-sources
+{ lib
+, stdenv
+, dockapps-sources
 , libX11
 , libXpm
 , libXext
-, libdockapp }:
+, libdockapp
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation  (finalAttrs: {
   pname = "wmsm.app";
-  version = "0.2.1";
 
-  src = dockapps-sources;
+  inherit (dockapps-sources) version src;
 
-  buildInputs = [ libX11 libXpm libXext libdockapp ];
+  sourceRoot = "${src.name}/wmsm.app/wmsm";
 
-  setSourceRoot = ''
-    export sourceRoot=$(echo */${pname}/wmsm)
-  '';
+  buildInputs = [
+    libX11
+    libXext
+    libXpm
+    libdockapp
+  ];
 
   env.NIX_CFLAGS_COMPILE = "-std=gnu89";
 
@@ -24,7 +29,9 @@ stdenv.mkDerivation rec {
       --replace "/usr/bin/install" "install"
   '';
 
-  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
 
   installPhase = ''
     runHook preInstall
@@ -32,12 +39,14 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  installFlags = [ "PREFIX=${placeholder "out"}/bin" ];
+  installFlags = [
+    "PREFIX=${placeholder "out"}/bin"
+  ];
 
-  meta = with lib; {
+  meta = {
     description = "System monitor for Windowmaker";
     homepage = "https://www.dockapps.net/wmsmapp";
-    license = licenses.gpl2;
-    maintainers = [ maintainers.bstrik ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix
index ced4cad80556e..7f17475d318fa 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix
@@ -1,22 +1,40 @@
-{ lib, stdenv, fetchurl, pkg-config, libX11, libXpm, libXext, libXfixes, libXmu }:
+{ lib
+, stdenv
+, fetchurl
+, libX11
+, libXext
+, libXfixes
+, libXmu
+, libXpm
+, pkg-config
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "wmsystemtray";
   version = "1.4";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/${pname}/${pname}/${pname}-${version}.tar.gz";
-     sha256 = "sha256-jt70NpHp//BxAA4pFmx8GtQgwJVukGgVEGHogcisl+k=";
+    url = "mirror://sourceforge/project/wmsystemtray/wmsystemtray/wmsystemtray-${finalAttrs.version}.tar.gz";
+    hash = "sha256-jt70NpHp//BxAA4pFmx8GtQgwJVukGgVEGHogcisl+k=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libX11 libXpm libXext libXfixes libXmu ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
-  meta = with lib; {
+  buildInputs = [
+    libX11
+    libXext
+    libXfixes
+    libXmu
+    libXpm
+  ];
+
+  meta = {
     description = "A system tray for Windowmaker";
     homepage = "http://wmsystemtray.sourceforge.net";
     license = licenses.gpl2Only;
-    maintainers = [ maintainers.bstrik ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/package.nix b/pkgs/by-name/wi/windowmaker/package.nix
index 2381c16f41ae0..6c39eadeb05b5 100644
--- a/pkgs/by-name/wi/windowmaker/package.nix
+++ b/pkgs/by-name/wi/windowmaker/package.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromRepoOrCz
 , autoreconfHook
+, callPackage
 , pkg-config
 , imagemagick
 , libX11
@@ -62,6 +63,10 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-x"
   ];
 
+  passthru = {
+    dockapps = callPackage ./dockapps { };
+  };
+
   meta = {
     homepage = "http://windowmaker.org/";
     description = "NeXTSTEP-like window manager";
diff --git a/pkgs/data/fonts/sketchybar-app-font/default.nix b/pkgs/data/fonts/sketchybar-app-font/default.nix
index c66d649de187f..df68dbb844c5b 100644
--- a/pkgs/data/fonts/sketchybar-app-font/default.nix
+++ b/pkgs/data/fonts/sketchybar-app-font/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sketchybar-app-font";
-  version = "1.0.16";
+  version = "1.0.17";
 
   src = fetchurl {
     url = "https://github.com/kvndrsslr/sketchybar-app-font/releases/download/v${finalAttrs.version}/sketchybar-app-font.ttf";
-    hash = "sha256-58gRCEJix9pnZEcoo6bm2zWduP0xXl3WWC6mt36SGuo=";
+    hash = "sha256-sDMasHVcITTSUP9B87w4I7IZ44tYmabNNWl+kE3dUoE=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/annotated-types/default.nix b/pkgs/development/python-modules/annotated-types/default.nix
index 645e3c40c48c2..85e2379507c6c 100644
--- a/pkgs/development/python-modules/annotated-types/default.nix
+++ b/pkgs/development/python-modules/annotated-types/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "annotated-types";
-  version = "0.5.0";
+  version = "0.6.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "annotated-types";
     repo = "annotated-types";
-    rev = "v${version}";
-    hash = "sha256-zCsWfJ8BQuov8FN+hlm9XBKWAAQ/KHPK/x024A8k2kE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-SZ9/rXYcns4DFM6vk6SRKvuv3MY3T7xO9aW7WAQqtVE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aws-adfs/default.nix b/pkgs/development/python-modules/aws-adfs/default.nix
index 953140768d673..7dc2a217987fd 100644
--- a/pkgs/development/python-modules/aws-adfs/default.nix
+++ b/pkgs/development/python-modules/aws-adfs/default.nix
@@ -5,7 +5,6 @@
 , click
 , configparser
 , fetchFromGitHub
-, fetchpatch
 , fido2
 , lxml
 , poetry-core
@@ -20,9 +19,9 @@
 buildPythonPackage rec {
   pname = "aws-adfs";
   version = "2.8.2";
-  format = "pyproject";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "venth";
@@ -63,6 +62,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Command line tool to ease AWS CLI authentication against ADFS";
     homepage = "https://github.com/venth/aws-adfs";
+    changelog = "https://github.com/venth/aws-adfs/releases/tag/v${version}";
     license = licenses.psfl;
     maintainers = with maintainers; [ bhipple ];
   };
diff --git a/pkgs/development/python-modules/crytic-compile/default.nix b/pkgs/development/python-modules/crytic-compile/default.nix
index 4e725dd8cde2c..26e7080c21399 100644
--- a/pkgs/development/python-modules/crytic-compile/default.nix
+++ b/pkgs/development/python-modules/crytic-compile/default.nix
@@ -6,20 +6,21 @@
 , pythonOlder
 , setuptools
 , solc-select
+, toml
 }:
 
 buildPythonPackage rec {
   pname = "crytic-compile";
-  version = "0.3.4";
+  version = "0.3.5";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "crytic";
     repo = "crytic-compile";
     rev = "refs/tags/${version}";
-    hash = "sha256-CeoACtgvMweDbIvYguK2Ca+iTBFONWcE2b0qUkBbQSU=";
+    hash = "sha256-aO2K0lc3qjKK8CZAbu/lotI5QJ/R+8npSIRX4a6HdrI=";
   };
 
   propagatedBuildInputs = [
@@ -27,6 +28,7 @@ buildPythonPackage rec {
     pycryptodome
     setuptools
     solc-select
+    toml
   ];
 
   # Test require network access
diff --git a/pkgs/development/python-modules/dramatiq/default.nix b/pkgs/development/python-modules/dramatiq/default.nix
new file mode 100644
index 0000000000000..8b7300d786f5f
--- /dev/null
+++ b/pkgs/development/python-modules/dramatiq/default.nix
@@ -0,0 +1,106 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, gevent
+, pika
+, prometheus-client
+, pylibmc
+, pytestCheckHook
+, redis
+, watchdog
+, watchdog-gevent
+}:
+
+buildPythonPackage rec {
+  pname = "dramatiq";
+  version = "1.14.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "Bogdanp";
+    repo = "dramatiq";
+    rev = "v${version}";
+    hash = "sha256-yv6HUJI7wsAQdBJ5QNv7qXhtzPvCsrF1389kyemAV7Y=";
+  };
+
+  propagatedBuildInputs = [
+    prometheus-client
+  ];
+
+  passthru.optional-dependencies = {
+    all = [
+      gevent
+      pika
+      pylibmc
+      redis
+      watchdog
+      watchdog-gevent
+    ];
+    gevent = [
+      gevent
+    ];
+    memcached = [
+      pylibmc
+    ];
+    rabbitmq = [
+      pika
+    ];
+    redis = [
+      redis
+    ];
+    watch = [
+      watchdog
+      watchdog-gevent
+    ];
+  };
+
+  nativeCheckInputs = [ pytestCheckHook pika redis pylibmc ];
+
+  postPatch = ''
+    sed -i ./setup.cfg \
+      -e 's:--cov dramatiq::' \
+      -e 's:--cov-report html::' \
+      -e 's:--benchmark-autosave::' \
+      -e 's:--benchmark-compare::' \
+  '';
+
+  disabledTests = [
+    # Requires a running redis
+    "test_after_process_boot_call_has_no_blocked_signals"
+    "test_cli_can_be_reloaded_on_sighup"
+    "test_cli_can_watch_for_source_code_changes"
+    "test_cli_fork_functions_have_no_blocked_signals"
+    "test_consumer_threads_have_no_blocked_signals"
+    "test_middleware_fork_functions_have_no_blocked_signals"
+    "test_redis_broker_can_connect_via_client"
+    "test_redis_broker_can_connect_via_url"
+    "test_redis_process_100k_messages_with_cli"
+    "test_redis_process_10k_fib_with_cli"
+    "test_redis_process_1k_latency_with_cli"
+    "test_worker_threads_have_no_blocked_signals"
+    # Requires a running rabbitmq
+    "test_rabbitmq_broker_can_be_passed_a_list_of_parameters_for_failover"
+    "test_rabbitmq_broker_can_be_passed_a_list_of_uri_for_failover"
+    "test_rabbitmq_broker_can_be_passed_a_semicolon_separated_list_of_uris"
+    "test_rabbitmq_broker_connections_are_lazy"
+    "test_rabbitmq_process_100k_messages_with_cli"
+    "test_rabbitmq_process_10k_fib_with_cli"
+    "test_rabbitmq_process_1k_latency_with_cli"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Takes too long for darwin ofborg
+    "test_retry_exceptions_can_specify_a_delay"
+  ];
+
+  pythonImportsCheck = [ "dramatiq" ];
+
+  meta = with lib; {
+    description = "Background Processing for Python 3";
+    homepage = "https://github.com/Bogdanp/dramatiq";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/flask-dramatiq/default.nix b/pkgs/development/python-modules/flask-dramatiq/default.nix
new file mode 100644
index 0000000000000..6f8884516f498
--- /dev/null
+++ b/pkgs/development/python-modules/flask-dramatiq/default.nix
@@ -0,0 +1,85 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitLab
+, poetry-core
+, dramatiq
+, flask
+, requests
+, pytestCheckHook
+, flask-migrate
+, periodiq
+, postgresql
+, postgresqlTestHook
+, psycopg2
+}:
+
+buildPythonPackage {
+  pname = "flask-dramatiq";
+  version = "0.6.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitLab {
+    owner = "bersace";
+    repo = "flask-dramatiq";
+    rev = "840209e9bf582b4dda468e8bba515f248f3f8534";
+    hash = "sha256-qjV1zyVzHPXMt+oUeGBdP9XVlbcSz2MF9Zygj543T4w=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'poetry>=0.12' 'poetry-core' \
+      --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
+
+    patchShebangs --build ./example.py
+
+    sed -i ./tests/unit/pytest.ini \
+      -e 's:--cov=flask_dramatiq::' \
+      -e 's:--cov-report=term-missing::'
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    dramatiq
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    flask
+    requests
+    flask-migrate
+    periodiq
+    postgresql
+    postgresqlTestHook
+    psycopg2
+  ] ++ dramatiq.optional-dependencies.rabbitmq;
+
+  postgresqlTestSetupPost = ''
+    substituteInPlace config.py \
+      --replace 'SQLALCHEMY_DATABASE_URI = f"postgresql://{PGUSER}:{PGPASSWORD}@{PGHOST}/{PGDATABASE}"' \
+        "SQLALCHEMY_DATABASE_URI = \"postgresql://$PGUSER/$PGDATABASE?host=$PGHOST\""
+    python3 ./example.py db upgrade
+  '';
+
+  pytestFlagsArray = [ "-x" "tests/func/" "tests/unit"];
+
+  pythonImportsCheck = [ "flask_dramatiq" ];
+
+  # Does HTTP requests to localhost
+  disabledTests = [
+    "test_fast"
+    "test_other"
+  ];
+
+  meta = with lib; {
+    description = "Adds Dramatiq support to your Flask application";
+    homepage = "https://gitlab.com/bersace/flask-dramatiq";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/google-cloud-asset/default.nix b/pkgs/development/python-modules/google-cloud-asset/default.nix
index f38a83a2c0872..c430d23c32f6b 100644
--- a/pkgs/development/python-modules/google-cloud-asset/default.nix
+++ b/pkgs/development/python-modules/google-cloud-asset/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-asset";
-  version = "3.19.1";
+  version = "3.20.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Rmd01HHVOThqSwfnoIrTaMjxqHFuGcKAjwKp3hD4S5o=";
+    hash = "sha256-lJLC1igiY0OYLu3eyuOvJ2KmFr9n4su8T7LPgWlUtCk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-automl/default.nix b/pkgs/development/python-modules/google-cloud-automl/default.nix
index fcbddee2fdde0..b12ee489cc29f 100644
--- a/pkgs/development/python-modules/google-cloud-automl/default.nix
+++ b/pkgs/development/python-modules/google-cloud-automl/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-automl";
-  version = "2.11.2";
+  version = "2.11.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-w4kzOe8az6zcMLoNYbfkvC5Aq5zCbSNw6+PHYZkEZqI=";
+    hash = "sha256-VcqQn7w2sTpDHKfniwkwsEXDa8YIV+G1jlbPOu8NVl0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/logilab/common.nix b/pkgs/development/python-modules/logilab/common.nix
index 9467f003c7039..b03fd98eefe80 100644
--- a/pkgs/development/python-modules/logilab/common.nix
+++ b/pkgs/development/python-modules/logilab/common.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "logilab-common";
-  version = "1.10.0";
+  version = "1.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MoXt3tta5OimJUjOkWSMDCmXV0aS8N0W5bcANwAelYY=";
+    hash = "sha256-lWl6654nbOBCec24iJ7GGKEcYy/gYDn9wMil3PPqWkk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/periodiq/default.nix b/pkgs/development/python-modules/periodiq/default.nix
new file mode 100644
index 0000000000000..5ed6a028aa38e
--- /dev/null
+++ b/pkgs/development/python-modules/periodiq/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitLab
+, poetry-core
+, dramatiq
+, pendulum
+, setuptools
+, pytest-mock
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "periodiq";
+  version = "0.12.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.5";
+
+  src = fetchFromGitLab {
+    owner = "bersace";
+    repo = "periodiq";
+    rev = "v${version}";
+    hash = "sha256-Ar0n+Wi1OUtRdhVxrU7Nz4je8ylaHgPZbXE0a30hzU0=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'poetry>=0.12' 'poetry-core' \
+      --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    dramatiq
+    pendulum
+    setuptools
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook pytest-mock ];
+
+  pytestFlagsArray = [ "tests/unit" ];
+
+  pythonImportsCheck = [ "periodiq" ];
+
+  meta = with lib; {
+    description = "Simple Scheduler for Dramatiq Task Queue";
+    homepage = "https://pypi.org/project/periodiq/";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/rtree/default.nix b/pkgs/development/python-modules/rtree/default.nix
index 7d4e141963146..0de516ec85f03 100644
--- a/pkgs/development/python-modules/rtree/default.nix
+++ b/pkgs/development/python-modules/rtree/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "rtree";
-  version = "1.0.1";
+  version = "1.1.0";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Rtree";
     inherit version;
-    hash = "sha256-IiEhaZwwOmQGXYSb9wOLHsq8N7Zcf6NAvts47w6AVCk=";
+    hash = "sha256-b47lBN3l0AWyWwiq9b4LNASvOtX+zm4d3N41kIp5ipU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/staticmap/default.nix b/pkgs/development/python-modules/staticmap/default.nix
new file mode 100644
index 0000000000000..bb3eac8655bdf
--- /dev/null
+++ b/pkgs/development/python-modules/staticmap/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pillow
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "staticmap";
+  version = "0.5.7";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-x6lrkCumEpLoGMILCBBhnWuBps21C8wauS1QrE2yCn8=";
+  };
+
+  propagatedBuildInputs = [ requests pillow ];
+
+  pythonImportsCheck = [ "staticmap" ];
+
+  # Tests seem to be broken
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A small, python-based library for creating map images with lines and markers";
+    homepage = "https://pypi.org/project/staticmap/";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/types-click/default.nix b/pkgs/development/python-modules/types-click/default.nix
new file mode 100644
index 0000000000000..78c99fe42808a
--- /dev/null
+++ b/pkgs/development/python-modules/types-click/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+}:
+
+let
+  pname = "types-click";
+  version = "7.1.8";
+in
+buildPythonPackage {
+  inherit pname version;
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-tmBJaL5kAdxRYxHKUHCKCii6p6DLhA79dBLw27/04JI=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  meta = with lib; {
+    description = "Collection of library stubs for Python, with static types";
+    homepage = "https://github.com/python/typeshed";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jfvillablanca ];
+  };
+}
diff --git a/pkgs/development/python-modules/universal-pathlib/default.nix b/pkgs/development/python-modules/universal-pathlib/default.nix
index 966e9c459d868..23667d02c2835 100644
--- a/pkgs/development/python-modules/universal-pathlib/default.nix
+++ b/pkgs/development/python-modules/universal-pathlib/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "universal-pathlib";
-  version = "0.1.3";
+  version = "0.1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "universal_pathlib";
     inherit version;
-    hash = "sha256-GgUqteBRcwHfZr5lF+n+Y82fwAgT5c5xpzcBRBrCtcg=";
+    hash = "sha256-guXYbRaifg6hrcfYisvLqdAtWkVIgWMXT5bZrCidsuQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/watchdog-gevent/default.nix b/pkgs/development/python-modules/watchdog-gevent/default.nix
new file mode 100644
index 0000000000000..e1b812b9612f1
--- /dev/null
+++ b/pkgs/development/python-modules/watchdog-gevent/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, gevent
+, pytestCheckHook
+, watchdog
+}:
+
+buildPythonPackage rec {
+  pname = "watchdog-gevent";
+  version = "0.1.1";
+  format = "setuptools";
+
+  # Need to fetch from github because tests are not present in pypi
+  src = fetchFromGitHub {
+    owner = "Bogdanp";
+    repo = "watchdog_gevent";
+    rev = "v${version}";
+    hash = "sha256-FESm3fNuLmOg2ilI/x8U9LuAimHLnahcTHYzW/nzOVY=";
+  };
+
+  propagatedBuildInputs = [ watchdog gevent ];
+
+  postPatch = ''
+    sed -i setup.cfg \
+      -e 's:--cov watchdog_gevent::' \
+      -e 's:--cov-report html::'
+  '';
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "watchdog_gevent" ];
+
+  meta = with lib; {
+    description = "A gevent-based observer for watchdog";
+    homepage = "https://github.com/Bogdanp/watchdog_gevent";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/tools/continuous-integration/jenkins/default.nix b/pkgs/development/tools/continuous-integration/jenkins/default.nix
index c90845ddcd73f..aa4de161d9ce2 100644
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jenkins";
-  version = "2.414.2";
+  version = "2.414.3";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${version}/jenkins.war";
-    hash = "sha256-kiu/Ymn92tYUu2VAJB7QzlUjpKUyginhX157t//VZbg=";
+    hash = "sha256-LZMlS8GG3zSbxK0GtrHddXxJMZDwVY0RHb2pUXqEe1k=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/misc/runme/default.nix b/pkgs/development/tools/misc/runme/default.nix
index 67a69db814264..3795476c3e163 100644
--- a/pkgs/development/tools/misc/runme/default.nix
+++ b/pkgs/development/tools/misc/runme/default.nix
@@ -12,7 +12,7 @@
 
 buildGo121Module rec {
   pname = "runme";
-  version = "1.7.7";
+  version = "1.7.8";
 
   src = fetchFromGitHub {
     owner = "stateful";
diff --git a/pkgs/development/tools/misc/slint-lsp/default.nix b/pkgs/development/tools/misc/slint-lsp/default.nix
index 028f2f8d50292..0eb55d14c0055 100644
--- a/pkgs/development/tools/misc/slint-lsp/default.nix
+++ b/pkgs/development/tools/misc/slint-lsp/default.nix
@@ -25,14 +25,14 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "slint-lsp";
-  version = "1.1.1";
+  version = "1.2.2";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-ENv17Az6yzUwD39HDfoD7Bmvs6LHjVp85PaYkTw6jW0=";
+    sha256 = "sha256-+1nuezax7aV9b+L11zzIouA8QEWduqBzPiT6jvCGMac=";
   };
 
-  cargoHash = "sha256-wL46QhY3Cq2KFLETPRhUWb77o1vNrRA2w1NBAtBc0yo=";
+  cargoHash = "sha256-o7HDhNtjA0/JybJCiEejR8PcRIdJim+/wq4q8xj9A5Q=";
 
   nativeBuildInputs = [ cmake pkg-config fontconfig ];
   buildInputs = rpathLibs ++ [ xorg.libxcb.dev ]
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index 2cbc016a2933c..530fbb1666c78 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -11,6 +11,8 @@
 , zstd
 
 , buildPackages
+, clangStdenv
+, gccStdenv
 , hello
 , mold
 , mold-wrapped
@@ -21,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mold";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = "mold";
     rev = "v${version}";
-    hash = "sha256-ePX80hzzIzSJdGUX96GyxYWcdbXxXyuyNQqj5RDSkKU=";
+    hash = "sha256-TgDGAYdJjqGQradB7UJlV2emvG7q4F9ctzPaGRUgvxU=";
   };
 
   nativeBuildInputs = [
@@ -89,11 +91,13 @@ stdenv.mkDerivation rec {
       in
       {
         version = testers.testVersion { package = mold; };
+      } // lib.optionalAttrs stdenv.isLinux {
+        adapter-gcc = helloTest "adapter-gcc" (hello.override (old: { stdenv = useMoldLinker gccStdenv; }));
+        adapter-llvm = helloTest "adapter-llvm" (hello.override (old: { stdenv = useMoldLinker clangStdenv; }));
         wrapped = helloTest "wrapped" (hello.overrideAttrs (previousAttrs: {
           nativeBuildInputs = (previousAttrs.nativeBuildInputs or [ ]) ++ [ mold-wrapped ];
           NIX_CFLAGS_LINK = toString (previousAttrs.NIX_CFLAGS_LINK or "") + " -fuse-ld=mold";
         }));
-        adapter = helloTest "adapter" (hello.override (old: { stdenv = useMoldLinker old.stdenv; }));
       };
   };
 
diff --git a/pkgs/development/tools/symfony-cli/default.nix b/pkgs/development/tools/symfony-cli/default.nix
index d626027ee1862..4f7dd010b844c 100644
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.5.10";
-  vendorHash = "sha256-eeVi/O4p7bF4CPqJBCpLfx1Yc5vZZ3b8RV5ERcIL8H4=";
+  version = "5.6.0";
+  vendorHash = "sha256-1BqgnWFMk8hWwra75a5o6Rwbj5wiCUIdSnsAcB+7Mno=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    hash = "sha256-n0R+J41lJYxswMnknYAAEKwwIqOremZF73cRBYfD3CE=";
+    hash = "sha256-AtHRuzpKXp+WlFser0J5MR63rbO0xO4N/L3U0Q3iax8=";
   };
 
   ldflags = [
diff --git a/pkgs/misc/vencord/default.nix b/pkgs/misc/vencord/default.nix
index d26e13e95d7bb..287799bcf1e0d 100644
--- a/pkgs/misc/vencord/default.nix
+++ b/pkgs/misc/vencord/default.nix
@@ -6,8 +6,8 @@
 , buildWebExtension ? false
 }:
 let
-  version = "1.5.6";
-  gitHash = "925d709";
+  version = "1.5.7";
+  gitHash = "5d7ede3";
 in
 buildNpmPackage rec {
   pname = "vencord";
@@ -17,7 +17,7 @@ buildNpmPackage rec {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${version}";
-    hash = "sha256-0vYnhDy7J+JFg6uMtwK+uQsHtxoXi8QskIqyQm1HsqM=";
+    hash = "sha256-/LrM9lBxuM5+KQJqRlP/lBV+krwZIV2GjMi33N/s+V0=";
   };
 
   ESBUILD_BINARY_PATH = lib.getExe (esbuild.override {
@@ -37,7 +37,7 @@ buildNpmPackage rec {
   npmRebuildFlags = [ "|| true" ];
 
   makeCacheWritable = true;
-  npmDepsHash = "sha256-/oMQHIigAY7Jdy6S1lRXjzOnxYrvpzbyvP4z+s+k9Lw=";
+  npmDepsHash = "sha256-Moy7VlAgl31H8QO+aOVano92C4L/wclHhj+JTnbRM6c=";
   npmFlags = [ "--legacy-peer-deps" ];
   npmBuildScript = if buildWebExtension then "buildWeb" else "build";
   npmBuildFlags = [ "--" "--standalone" "--disable-updater" ];
diff --git a/pkgs/misc/vencord/package-lock.json b/pkgs/misc/vencord/package-lock.json
index 26b54c655b081..eb01a29cb26c8 100644
--- a/pkgs/misc/vencord/package-lock.json
+++ b/pkgs/misc/vencord/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "vencord",
-    "version": "1.5.6",
+    "version": "1.5.7",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "vencord",
-            "version": "1.5.6",
+            "version": "1.5.7",
             "license": "GPL-3.0-or-later",
             "dependencies": {
                 "@sapphi-red/web-noise-suppressor": "0.3.3",
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
index eb4fe9bcf993f..9d7480d239f21 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
@@ -6,7 +6,7 @@
 , gnupatch
 }:
 let
-  pname = "coreutils";
+  pname = "bootstrap-coreutils";
   version = "5.0";
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
index dece020a5e795..14584e0a7e6d6 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
@@ -12,7 +12,7 @@
 , gzip
 }:
 let
-  pname = "coreutils";
+  pname = "bootstrap-coreutils-musl";
   version = "9.4";
 
   src = fetchurl {
diff --git a/pkgs/servers/geospatial/fit-trackee/default.nix b/pkgs/servers/geospatial/fit-trackee/default.nix
new file mode 100644
index 0000000000000..c7bc7fbc2e5b6
--- /dev/null
+++ b/pkgs/servers/geospatial/fit-trackee/default.nix
@@ -0,0 +1,105 @@
+{ lib
+, python3
+, fetchFromGitHub
+, fetchPypi
+, postgresql
+, postgresqlTestHook
+}:
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+        version = "1.4.49";
+        src = fetchPypi {
+          pname = "SQLAlchemy";
+          inherit version;
+          hash = "sha256-Bv8ly64ww5bEt3N0ZPKn/Deme32kCZk7GCsCTOyArtk=";
+        };
+        # Remove "test/typing" that does not exist
+        disabledTestPaths = [
+          "test/aaa_profiling"
+          "test/ext/mypy"
+        ];
+      });
+    };
+  };
+
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "fit-trackee";
+  version = "0.7.22";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "SamR1";
+    repo = "FitTrackee";
+    rev = "v${version}";
+    hash = "sha256-aPQ8jLssN9nx0Bpd/44E3sQi2w0cR8ecG76DJjreeHA=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace psycopg2-binary psycopg2 \
+      --replace 'poetry>=0.12' 'poetry-core' \
+      --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
+  '';
+
+  nativeBuildInputs = [
+    python3.pkgs.poetry-core
+  ];
+
+  propagatedBuildInputs = with python.pkgs; [
+    authlib
+    babel
+    dramatiq
+    flask
+    flask-bcrypt
+    flask-dramatiq
+    flask-limiter
+    flask-migrate
+    gpxpy
+    gunicorn
+    humanize
+    psycopg2
+    pyjwt
+    pyopenssl
+    pytz
+    shortuuid
+    sqlalchemy
+    staticmap
+    ua-parser
+  ] ++ dramatiq.optional-dependencies.redis;
+
+  pythonImportsCheck = [ "fittrackee" ];
+
+  nativeCheckInputs = with python.pkgs; [
+    pytestCheckHook
+    freezegun
+    postgresqlTestHook
+    postgresql
+  ];
+
+  pytestFlagsArray = [
+    "fittrackee"
+  ];
+
+  postgresqlTestSetupPost = ''
+    export DATABASE_TEST_URL=postgresql://$PGUSER/$PGDATABAS?host=$PGHOST
+  '';
+
+  postInstall = ''
+    mkdir -p $out/var/share/fittrackee-instance
+  '';
+
+  preCheck = ''
+    export TMP=$(mktemp -d)
+  '';
+
+  meta = with lib; {
+    description = "Self-hosted outdoor activity tracker :bicyclist";
+    homepage = "https://github.com/SamR1/FitTrackee";
+    changelog = "https://github.com/SamR1/FitTrackee/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/servers/monitoring/plugins/default.nix b/pkgs/servers/monitoring/plugins/default.nix
index c7823789081bf..2f6122caa69e8 100644
--- a/pkgs/servers/monitoring/plugins/default.nix
+++ b/pkgs/servers/monitoring/plugins/default.nix
@@ -21,6 +21,7 @@
 , openldap
 , procps
 , runtimeShell
+, unixtools
 }:
 
 let
@@ -33,6 +34,7 @@ let
     lm_sensors
     net-snmp
     procps
+    unixtools.ping
   ];
 
   mailq = runCommand "mailq-wrapper" { preferLocalBuild = true; } ''
@@ -58,7 +60,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-yLhHOSrPFRjW701aOL8LPe4OnuJxL6f+dTxNqm0evIg=";
   };
 
-  # TODO: Awful hack. Grrr... this of course only works on NixOS.
+  # TODO: Awful hack. Grrr...
   # Anyway the check that configure performs to figure out the ping
   # syntax is totally impure, because it runs an actual ping to
   # localhost (which won't work for ping6 if IPv6 support isn't
@@ -74,8 +76,8 @@ stdenv.mkDerivation rec {
       -e 's|^DEFAULT_PATH=.*|DEFAULT_PATH=\"${binPath}\"|'
 
     configureFlagsArray+=(
-      --with-ping-command='/run/wrappers/bin/ping -4 -n -U -w %d -c %d %s'
-      --with-ping6-command='/run/wrappers/bin/ping -6 -n -U -w %d -c %d %s'
+      --with-ping-command='ping -4 -n -U -w %d -c %d %s'
+      --with-ping6-command='ping -6 -n -U -w %d -c %d %s'
     )
 
     install -Dm555 ${share} $out/share
diff --git a/pkgs/servers/snac2/default.nix b/pkgs/servers/snac2/default.nix
index b13b6c2b9fcfa..49c2c27890ff0 100644
--- a/pkgs/servers/snac2/default.nix
+++ b/pkgs/servers/snac2/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "snac2";
-  version = "2.41";
+  version = "2.42";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "grunfink";
     repo = pname;
     rev = version;
-    hash = "sha256-WVbGORth3paDo1eK/J7MPUstVQifcU7ksVEb87vknN0=";
+    hash = "sha256-cLSbmEZj5lyMtZMM2vaWqdrXFk1/VPws9yBPhSUka2E=";
   };
 
   buildInputs = [ curl openssl ];
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 4df95a9ca6fe5..bd816f9a89919 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -79,7 +79,7 @@ let
     # note that this is required:
     #   1. For all shells, not just login shells (mosh needs this as do some other command-line utilities)
     #   2. Before the shell is initialized, so that config snippets can find the commands they use on the PATH
-    builtin status --is-login
+    builtin status is-login
     or test -z "$__fish_nixos_env_preinit_sourced" -a -z "$ETC_PROFILE_SOURCED" -a -z "$ETC_ZSHENV_SOURCED"
     ${if fishEnvPreInit != null then ''
     and begin
diff --git a/pkgs/shells/fish/plugins/tide.nix b/pkgs/shells/fish/plugins/tide.nix
index 94cbfaa6b8f9f..39afd487afdba 100644
--- a/pkgs/shells/fish/plugins/tide.nix
+++ b/pkgs/shells/fish/plugins/tide.nix
@@ -4,13 +4,13 @@
 # Refer to the following comment to get you setup: https://github.com/NixOS/nixpkgs/pull/201646#issuecomment-1320893716
 buildFishPlugin rec {
   pname = "tide";
-  version = "5.6.0";
+  version = "6.0.1";
 
   src = fetchFromGitHub {
     owner = "IlanCosman";
     repo = "tide";
     rev = "v${version}";
-    hash = "sha256-cCI1FDpvajt1vVPUd/WvsjX/6BJm6X1yFPjqohmo1rI=";
+    hash = "sha256-oLD7gYFCIeIzBeAW1j62z5FnzWAp3xSfxxe7kBtTLgA=";
   };
 
   #buildFishplugin will only move the .fish files, but tide has a tide configure function
diff --git a/pkgs/shells/fish/wrapper.nix b/pkgs/shells/fish/wrapper.nix
index 75213809821f2..62ae03ec9ef99 100644
--- a/pkgs/shells/fish/wrapper.nix
+++ b/pkgs/shells/fish/wrapper.nix
@@ -18,7 +18,7 @@ let
     name = "wrapfish.aliases.fish";
     destination = "/share/fish/vendor_conf.d/aliases.fish";
     text = ''
-      status --is-interactive; and begin
+      status is-interactive; and begin
         # Aliases
         ${aliasesStr}
       end
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 05aaaea4f1059..7c64fd7e39284 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -198,16 +198,10 @@ rec {
       '';
     };
   in stdenv.override (old: {
-    cc = stdenv.cc.override {
-      inherit bintools;
-    };
-    allowedRequisites =
-      (lib.optional (stdenv.allowedRequisites or null != null) stdenv.allowedRequisites)
-        ++ [ bintools pkgs.mold ]
-        # need to `outputSpecified = false` to make getLib work
-        ++ (builtins.map (p: lib.getLib (p // { outputSpecified = false; })) pkgs.mold.buildInputs);
-      # gcc >12.1.0 supports '-fuse-ld=mold'
-      # the wrap ld above in bintools supports gcc <12.1.0 and shouldn't harm >12.1.0
+    allowedRequisites = null;
+    cc = stdenv.cc.override { inherit bintools; };
+    # gcc >12.1.0 supports '-fuse-ld=mold'
+    # the wrap ld above in bintools supports gcc <12.1.0 and shouldn't harm >12.1.0
     # https://github.com/rui314/mold#how-to-use
     } // lib.optionalAttrs (stdenv.cc.isClang || (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12")) {
     mkDerivationFromStdenv = extendMkDerivationArgs old (args: {
diff --git a/pkgs/tools/audio/openai-whisper-cpp/default.nix b/pkgs/tools/audio/openai-whisper-cpp/default.nix
index f6d83690824fe..f19425201cde2 100644
--- a/pkgs/tools/audio/openai-whisper-cpp/default.nix
+++ b/pkgs/tools/audio/openai-whisper-cpp/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "whisper-cpp";
-  version = "1.4.0";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "whisper.cpp";
     rev = "refs/tags/v${version}" ;
-    hash = "sha256-176MpooVQrq1dXC62h8Yyyhw6IjCA50tp1J4DQPSePQ=";
+    hash = "sha256-Qea9zGLJ41D+l8h1Sg/KJI6Ou02jtbRIxYPGoabM8nY=";
   };
 
   # The upstream download script tries to download the models to the
diff --git a/pkgs/tools/misc/dooit/default.nix b/pkgs/tools/misc/dooit/default.nix
index ab7db4a2cb7c4..b8aa6c8809ff7 100644
--- a/pkgs/tools/misc/dooit/default.nix
+++ b/pkgs/tools/misc/dooit/default.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dooit";
-  version = "2.0.1";
+  version = "2.1.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "kraanzu";
     repo = "dooit";
     rev = "v${version}";
-    hash = "sha256-iQAGD6zrBBd4fJONaB7to1OJpAJUO0zeA1xhVQZBkMc=";
+    hash = "sha256-ZCEBpaQHaFb09MUlN6acYB3LrfX456uRbhVh9YPz7NU=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/networking/xrootd/default.nix b/pkgs/tools/networking/xrootd/default.nix
index e5aad1b4ee9bf..47496173642c6 100644
--- a/pkgs/tools/networking/xrootd/default.nix
+++ b/pkgs/tools/networking/xrootd/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , cmake
 , cppunit
+, makeWrapper
 , pkg-config
 , curl
 , fuse
@@ -24,6 +25,9 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
+
+  __structuredAttrs = true;
+
   pname = "xrootd";
   version = "5.5.5";
 
@@ -55,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    makeWrapper
     pkg-config
   ];
 
@@ -101,7 +106,18 @@ stdenv.mkDerivation (finalAttrs: {
     "-DENABLE_TESTS=TRUE"
   ];
 
-  postFixup = lib.optionalString (externalEtc != null) ''
+  makeWrapperArgs = [
+    # Workaround the library-not-found issue
+    # happening to binaries compiled with xrootd libraries.
+    # See #169677
+    "--prefix" "${lib.optionalString stdenv.hostPlatform.isDarwin "DY"}LD_LIBRARY_PATH" ":" "${placeholder "out"}/lib"
+  ];
+
+  postFixup = ''
+    while IFS= read -r FILE; do
+      wrapProgram "$FILE" "''${makeWrapperArgs[@]}"
+    done < <(find "$bin/bin" -mindepth 1 -maxdepth 1 -type f,l -perm -a+x)
+  '' + lib.optionalString (externalEtc != null) ''
     mv "$out"/etc{,.orig}
     ln -s ${lib.escapeShellArg externalEtc} "$out/etc"
   '';
diff --git a/pkgs/tools/networking/xrootd/fetchxrd.nix b/pkgs/tools/networking/xrootd/fetchxrd.nix
index 2d197f8504fec..21d7a2a0386dd 100644
--- a/pkgs/tools/networking/xrootd/fetchxrd.nix
+++ b/pkgs/tools/networking/xrootd/fetchxrd.nix
@@ -21,11 +21,9 @@
     inherit url;
     urls = if urls == [ ] then lib.singleton url else urls;
   }
-  # Set [DY]LD_LIBRARY_PATH to workaround #169677
-  # TODO: Remove the library path after #200830 get merged
   ''
     for u in $urls; do
-      ${lib.optionalString buildPlatform.isDarwin "DY"}LD_LIBRARY_PATH=${lib.makeLibraryPath [ xrootd ]} xrdcp --force "$u" "$out"
+      xrdcp --verbose --force "$u" "$out"
       ret=$?
       (( ret != 0 )) || break
     done
diff --git a/pkgs/tools/security/aws-iam-authenticator/default.nix b/pkgs/tools/security/aws-iam-authenticator/default.nix
index 4f1dcf318282b..f186c43721f4f 100644
--- a/pkgs/tools/security/aws-iam-authenticator/default.nix
+++ b/pkgs/tools/security/aws-iam-authenticator/default.nix
@@ -1,23 +1,27 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
 buildGoModule rec {
   pname = "aws-iam-authenticator";
-  version = "0.6.11";
+  version = "0.6.12";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-4bZnGgf/H2/uLhh8ip8rrA+U0vA+1SO5uhjLK40j3wE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-IIlAsxxEYjR7+wdWExdsQAH0x4yOXZ+bVQWwn7mrhRw=";
   };
 
   vendorHash = "sha256-RcZqnyZtonE4qeu+llL1OPGPG93/Rx8ESWM5wapZ1BM=";
 
   ldflags = let PKG = "sigs.k8s.io/aws-iam-authenticator"; in [
-    "-s" "-w"
-    "-X ${PKG}/pkg.Version=${version}"
-    "-X ${PKG}/pkg.BuildDate=1970-01-01T01:01:01Z"
-    "-X ${PKG}/pkg.CommitID=${version}"
+    "-s"
+    "-w"
+    "-X=${PKG}/pkg.Version=${version}"
+    "-X=${PKG}/pkg.BuildDate=1970-01-01T01:01:01Z"
+    "-X ?${PKG}/pkg.CommitID=${version}"
   ];
 
   subPackages = [ "cmd/aws-iam-authenticator" ];
@@ -25,7 +29,8 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "https://github.com/kubernetes-sigs/aws-iam-authenticator";
     description = "AWS IAM credentials for Kubernetes authentication";
+    changelog = "https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = [ maintainers.srhb ];
+    maintainers = with maintainers; [ srhb ];
   };
 }
diff --git a/pkgs/tools/security/evil-winrm/default.nix b/pkgs/tools/security/evil-winrm/default.nix
index fe10bfaefec0e..30420c7aad685 100644
--- a/pkgs/tools/security/evil-winrm/default.nix
+++ b/pkgs/tools/security/evil-winrm/default.nix
@@ -1,14 +1,19 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, bundlerEnv }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, bundlerEnv
+}:
 
 stdenv.mkDerivation rec {
   pname = "evil-winrm";
-  version = "3.3";
+  version = "3.5";
 
   src = fetchFromGitHub {
     owner = "Hackplayers";
     repo = "evil-winrm";
-    rev = "v${version}";
-    sha256 = "sha256-uWhRkq7I/XRWSUpR8lWRhDImE6x0pX9/B3gKhRIhkf8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-8Lyo7BgypzrHMEcbYlxo/XWwOtBqs2tczYnc3+XEbeA=";
   };
 
   env = bundlerEnv {
@@ -18,8 +23,13 @@ stdenv.mkDerivation rec {
     gemset = ./gemset.nix;
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ env.wrappedRuby ];
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  buildInputs = [
+    env.wrappedRuby
+  ];
 
   installPhase = ''
     mkdir -p $out/bin
@@ -27,9 +37,9 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://github.com/Hackplayers/evil-winrm";
-    changelog = "https://github.com/Hackplayers/evil-winrm/releases/tag/v${version}";
     description = "WinRM shell for hacking/pentesting";
+    homepage = "https://github.com/Hackplayers/evil-winrm";
+    changelog = "https://github.com/Hackplayers/evil-winrm/blob/v${version}/CHANGELOG.md";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ elohmeier ];
   };
diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index 780f1b4dfb0c0..d26429b813de6 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -43,7 +43,7 @@ python3.pkgs.buildPythonApplication rec {
     substituteInPlace setup.py --replace /usr/share/doc/ share/doc/
 
     # see https://github.com/NixOS/nixpkgs/issues/4968
-    ${python3.interpreter} setup.py install_data --install-dir=$out --root=$out
+    ${python3.pythonForBuild.interpreter} setup.py install_data --install-dir=$out --root=$out
   '';
 
   postInstall =
@@ -61,6 +61,11 @@ python3.pkgs.buildPythonApplication rec {
       rm -r "${sitePackages}/etc"
 
       installManPage man/*.[1-9]
+
+      # This is a symlink to the build python version created by `updatePyExec`, seemingly to assure the same python version is used?
+      rm $out/bin/fail2ban-python
+      ln -s ${python3.interpreter} $out/bin/fail2ban-python
+
     '' + lib.optionalString stdenv.isLinux ''
       # see https://github.com/NixOS/nixpkgs/issues/4968
       rm -r "${sitePackages}/usr"
diff --git a/pkgs/tools/security/sshocker/default.nix b/pkgs/tools/security/sshocker/default.nix
index b42c0a7580c39..bb8177ea38780 100644
--- a/pkgs/tools/security/sshocker/default.nix
+++ b/pkgs/tools/security/sshocker/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "sshocker";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "lima-vm";
     repo = "sshocker";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Z1Dg+AeyfFmUDc3jV8/tOcUrxuyInfwubzo0cLpfFl8=";
+    hash = "sha256-IDbGRQSLQlT4lt2bextGYB4fJfbpLhPx3JF1eYDJ6gw=";
   };
 
-  vendorHash = "sha256-ceQzYByJNXr02IDBKhYuqnKfaTbnX5T03p2US4HRu6I=";
+  vendorHash = "sha256-kee5D80RjCVosts/Jd6WuvtiK/J5+79HsM5ITHs15xc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/ov/default.nix b/pkgs/tools/text/ov/default.nix
index e988f1c2f204d..2a70d7cdaa54d 100644
--- a/pkgs/tools/text/ov/default.nix
+++ b/pkgs/tools/text/ov/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "ov";
-  version = "0.32.0";
+  version = "0.32.1";
 
   src = fetchFromGitHub {
     owner = "noborus";
     repo = "ov";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mQ1KwElD8RizOT2trHWo4T1QiZ974xwhQCCa5snpnZM=";
+    hash = "sha256-S84CMC02KJ5eevLxVkapCdjZh4PH95u/0AK4tpkOx2k=";
   };
 
-  vendorHash = "sha256-XACdtJdACMKQ5gSJcjGAPNGPFL1Tbt6QOovl15mvFGI=";
+  vendorHash = "sha256-1NdvUdPPr0Twx0hyve4/vvDR2cU+mGyws3UIf8jHfbw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/rsbkb/default.nix b/pkgs/tools/text/rsbkb/default.nix
index fd02babac0b02..1510a63b050f6 100644
--- a/pkgs/tools/text/rsbkb/default.nix
+++ b/pkgs/tools/text/rsbkb/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rsbkb";
-  version = "1.2";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "trou";
     repo = "rsbkb";
     rev = "release-${version}";
-    hash = "sha256-Y6YTjEbefNUPcl6rNYWVZLGZYTUPr5pvfLabS+zDWqA=";
+    hash = "sha256-+plf7BoYpEFPRsGKNrvLF8TAU3Z7nyx6Td6uRBoNGiE=";
   };
 
-  cargoHash = "sha256-RMX+ZdPaqtqRJvhHFJJrPZnBGwQwZSCXNg1oNo+v2+8=";
+  cargoHash = "sha256-HyosR/5tZCRU2CNnnGITEuESW30Zq3s33UFNcLmEWIA=";
 
   # Setup symlinks for all the utilities,
   # busybox style
diff --git a/pkgs/tools/typesetting/sile/default.nix b/pkgs/tools/typesetting/sile/default.nix
index 7c436ac419b2f..6b5498656b0eb 100644
--- a/pkgs/tools/typesetting/sile/default.nix
+++ b/pkgs/tools/typesetting/sile/default.nix
@@ -46,11 +46,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sile";
-  version = "0.14.11";
+  version = "0.14.12";
 
   src = fetchurl {
     url = "https://github.com/sile-typesetter/sile/releases/download/v${finalAttrs.version}/sile-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-JXlgiK1XyZZSe5QXz06zwEAnVYhiIZhhIaBmfxAgRS4=";
+    sha256 = "sha256-iyxNi4Y2zaeR6HUf/IVW1M7mB0WhM2yxOqDkb1oAkHg=";
   };
 
   configureFlags = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ba694d92b3fdc..77a613acb37f0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2112,7 +2112,10 @@ with pkgs;
 
   xpaste = callPackage ../tools/text/xpaste { };
 
-  xrootd = callPackage ../tools/networking/xrootd { };
+  xrootd = callPackage ../tools/networking/xrootd {
+    # Workaround systemd static build breakage
+    systemd = if systemd.meta.broken then null else systemd;
+  };
 
   yabridge = callPackage ../tools/audio/yabridge {
     wine = wineWowPackages.staging;
@@ -27568,6 +27571,8 @@ with pkgs;
 
   ### SERVERS / GEOSPATIAL
 
+  fit-trackee = callPackage ../servers/geospatial/fit-trackee { };
+
   geoserver = callPackage ../servers/geospatial/geoserver { };
 
   mapcache = callPackage ../servers/geospatial/mapcache { };
@@ -36500,7 +36505,7 @@ with pkgs;
 
   windowlab = callPackage ../applications/window-managers/windowlab { };
 
-  dockapps = callPackage ../by-name/wi/windowmaker/dockapps { };
+  inherit (windowmaker) dockapps;
 
   wily = callPackage ../applications/editors/wily { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 67f2c91beabd0..fbca28335a01a 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4758,6 +4758,19 @@ with self; {
     };
   };
 
+  CryptBcrypt = buildPerlPackage {
+    pname = "Crypt-Bcrypt";
+    version = "0.011";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Bcrypt-0.011.tar.gz";
+      hash = "sha256-Z/ymiwUm5zTi2VvGsyutAcMZ5Yer9j5M80Itpmu+o6A=";
+    };
+    meta = {
+      description = "modern bcrypt implementation";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   CryptBlowfish = buildPerlPackage {
     pname = "Crypt-Blowfish";
     version = "2.14";
@@ -4934,6 +4947,26 @@ with self; {
     };
   };
 
+  CryptHSXKPasswd = buildPerlPackage {
+    pname = "Crypt-HSXKPasswd";
+    version = "3.6";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/B/BA/BARTB/Crypt-HSXKPasswd-v3.6.tar.gz";
+      hash = "sha256-lZ3MX58BG/ALha0i31ZrerK/XqHTYrDeD7WuKfvEWLM=";
+    };
+    buildInputs = [ Clone DateTime FileHomeDir FileShare FileShareDir GetoptLong JSON ListMoreUtils MathRound Readonly TextUnidecode TypeTiny ];
+    meta = {
+      description = "A secure memorable password generator";
+      homepage = "http://www.bartb.ie/hsxkpasswd";
+      license = with lib.licenses; [ bsd2 ];
+      maintainers = [ maintainers.dannixon ];
+      mainProgram = "hsxkpasswd";
+    };
+    # Two tests fail as a result of https://github.com/bbusschots/hsxkpasswd/issues/42
+    # (also see https://github.com/bbusschots/hsxkpasswd/issues/43)
+    doCheck = false;
+  };
+
   CryptIDEA = buildPerlPackage {
     pname = "Crypt-IDEA";
     version = "1.10";
@@ -9715,10 +9748,10 @@ with self; {
 
   FileReadBackwards = buildPerlPackage {
     pname = "File-ReadBackwards";
-    version = "1.05";
+    version = "1.06";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/U/UR/URI/File-ReadBackwards-1.05.tar.gz";
-      hash = "sha256-grJhr4dQfMPn5miZxFcQTryNHAn7hcU/Z8H5D3DxjW4=";
+      url = "mirror://cpan/authors/id/P/PL/PLICEASE/File-ReadBackwards-1.06.tar.gz";
+      hash = "sha256-MrKgVJOJqviIde8D1+u//y1ZeeyoW3yBL2tLsQ0QL2I=";
     };
     meta = {
       description = "Read a file backwards by lines";
@@ -10115,12 +10148,12 @@ with self; {
 
   Future = buildPerlModule {
     pname = "Future";
-    version = "0.48";
+    version = "0.50";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-0.48.tar.gz";
-      hash = "sha256-D+ixXBQvKjBKMXGKIKEFA6m0TMASw69eN7i34koHUqM=";
+      url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-0.50.tar.gz";
+      hash = "sha256-wDXj2eaaOvFEszrINN7p5lrTYPKlHbnxWNw0Ls3dX0Q=";
     };
-    buildInputs = [ TestFatal TestIdentity TestRefcount ];
+    buildInputs = [ Test2Suite ];
     meta = {
       description = "Represent an operation awaiting completion";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
@@ -10129,12 +10162,12 @@ with self; {
 
   FutureAsyncAwait = buildPerlModule rec {
     pname = "Future-AsyncAwait";
-    version = "0.58";
+    version = "0.66";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-AsyncAwait-0.58.tar.gz";
-      hash = "sha256-OLtJ9jabBUrAUuaNomR/4i0Io605rgNuJ6KRELtOQi4=";
+      url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-AsyncAwait-0.66.tar.gz";
+      hash = "sha256-xqD03kYr8yS1usoXddGZ7DJGo1jBPbm2Ssv82+bl7CE=";
     };
-    buildInputs = [ TestRefcount TestFatal ];
+    buildInputs = [ Test2Suite ];
     propagatedBuildInputs = [ Future XSParseKeyword XSParseSublike ];
     perlPreHook = lib.optionalString stdenv.isDarwin "export LD=$CC";
     meta = {
@@ -12986,13 +13019,13 @@ with self; {
 
   JSONValidator = buildPerlPackage {
     pname = "JSON-Validator";
-    version = "5.08";
+    version = "5.14";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JH/JHTHORSEN/JSON-Validator-5.08.tar.gz";
-      hash = "sha256-QPaWjtcfxv1Ij6Q1Ityhk5NDhUCSth/eZgHwcWZHeFg=";
+      url = "mirror://cpan/authors/id/J/JH/JHTHORSEN/JSON-Validator-5.14.tar.gz";
+      hash = "sha256-YISl1AdeQhqTj/su6XuFBPqjXoZtD3tbWBETr17ijhs=";
     };
     buildInputs = [ TestDeep ];
-    propagatedBuildInputs = [ DataValidateDomain DataValidateIP Mojolicious NetIDNEncode YAMLLibYAML ];
+    propagatedBuildInputs = [ Mojolicious YAMLLibYAML ];
     meta = {
       description = "Validate data against a JSON schema";
       homepage = "https://github.com/mojolicious/json-validator";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 09d02a4344fb3..3f4c9784bea6b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3271,6 +3271,8 @@ self: super: with self; {
 
   dragonfly = callPackage ../development/python-modules/dragonfly { };
 
+  dramatiq = callPackage ../development/python-modules/dramatiq { };
+
   drawille = callPackage ../development/python-modules/drawille { };
 
   drawilleplot = callPackage ../development/python-modules/drawilleplot { };
@@ -3970,6 +3972,8 @@ self: super: with self; {
 
   flask-cors = callPackage ../development/python-modules/flask-cors { };
 
+  flask-dramatiq = callPackage ../development/python-modules/flask-dramatiq { };
+
   flask-elastic = callPackage ../development/python-modules/flask-elastic { };
 
   flask-expects-json = callPackage ../development/python-modules/flask-expects-json { };
@@ -8854,6 +8858,8 @@ self: super: with self; {
 
   periodictable = callPackage ../development/python-modules/periodictable { };
 
+  periodiq = callPackage ../development/python-modules/periodiq { };
+
   permissionedforms = callPackage ../development/python-modules/permissionedforms { };
 
   persim = callPackage ../development/python-modules/persim { };
@@ -13358,6 +13364,8 @@ self: super: with self; {
 
   static3 = callPackage ../development/python-modules/static3 { };
 
+  staticmap = callPackage ../development/python-modules/staticmap { };
+
   staticjinja = callPackage ../development/python-modules/staticjinja { };
 
   statistics = callPackage ../development/python-modules/statistics { };
@@ -14951,6 +14959,8 @@ self: super: with self; {
 
   types-beautifulsoup4 = callPackage ../development/python-modules/types-beautifulsoup4 { };
 
+  types-click = callPackage ../development/python-modules/types-click { };
+
   types-colorama = callPackage ../development/python-modules/types-colorama { };
 
   types-dateutil = callPackage ../development/python-modules/types-dateutil { };
@@ -15435,6 +15445,8 @@ self: super: with self; {
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
   };
 
+  watchdog-gevent = callPackage ../development/python-modules/watchdog-gevent { };
+
   watchfiles = callPackage ../development/python-modules/watchfiles {
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
   };