Merge master into staging-next

36 files changed, 161 insertions, 99 deletions

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 78441bad22c02..3cfdea617d19a 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10673,6 +10673,15 @@
     githubId = 1769386;
     name = "Liam Diprose";
   };
+  liassica = {
+    email = "git-commit.jingle869@aleeas.com";
+    github = "Liassica";
+    githubId = 115422798;
+    name = "Liassica";
+    keys = [{
+      fingerprint = "83BE 3033 6164 B971 FA82  7036 0D34 0E59 4980 7BDD";
+    }];
+  };
   liberatys = {
     email = "liberatys@hey.com";
     name = "Nick Anthony Flueckiger";
diff --git a/pkgs/applications/graphics/komikku/default.nix b/pkgs/applications/graphics/komikku/default.nix
index a98300e1f9e5e..91c70aa02782a 100644
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@@ -19,7 +19,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "komikku";
-  version = "1.36.0";
+  version = "1.37.1";
 
   format = "other";
 
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "valos";
     repo = "Komikku";
     rev = "v${version}";
-    hash = "sha256-sX/4Sez6gKSgaUJC7iW2BeVp0y9h64YqQi7FL5fzZ4o=";
+    hash = "sha256-pGOut63+ST1Yqe1Fj0c4cI0du1q4JW7WVA4h+muWGJQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/ff2mpv/default.nix b/pkgs/applications/misc/ff2mpv/default.nix
index b26e09012cf53..a5f7cf9207208 100644
--- a/pkgs/applications/misc/ff2mpv/default.nix
+++ b/pkgs/applications/misc/ff2mpv/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ff2mpv";
-  version = "4.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitHub {
     owner = "woodruffw";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-sxUp/JlmnYW2sPDpIO2/q40cVJBVDveJvbQMT70yjP4=";
+    hash = "sha256-unSnySEhaaLIW/6R+vmNONb5xMSgQLtSsOLGcfuW0RY=";
   };
 
   buildInputs = [ python3 mpv ];
diff --git a/pkgs/applications/version-management/gitkraken/default.nix b/pkgs/applications/version-management/gitkraken/default.nix
index 6b9ed9f25ccf4..538f0cc75c92b 100644
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@@ -109,6 +109,9 @@ let
     nativeBuildInputs = [ copyDesktopItems makeWrapper wrapGAppsHook ];
     buildInputs = [ gtk3 gnome.adwaita-icon-theme ];
 
+    # avoid double-wrapping
+    dontWrapGApps = true;
+
     installPhase = ''
       runHook preInstall
 
@@ -145,7 +148,9 @@ let
 
       # GitKraken expects the CA bundle to be located in the bundled git directory. Since we replace it with
       # the one from nixpkgs, which doesn't provide a CA bundle, we need to explicitly set its location at runtime
-      makeWrapper $out/share/${pname}/gitkraken $out/bin/gitkraken --set GIT_SSL_CAINFO "${cacert}/etc/ssl/certs/ca-bundle.crt"
+      makeWrapper $out/share/${pname}/gitkraken $out/bin/gitkraken \
+        --set GIT_SSL_CAINFO "${cacert}/etc/ssl/certs/ca-bundle.crt" \
+        "''${gappsWrapperArgs[@]}"
     '';
   };
 
diff --git a/pkgs/by-name/bn/bngblaster/package.nix b/pkgs/by-name/bn/bngblaster/package.nix
index f70182e110c49..4f4030bdd70d3 100644
--- a/pkgs/by-name/bn/bngblaster/package.nix
+++ b/pkgs/by-name/bn/bngblaster/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bngblaster";
-  version = "0.8.34";
+  version = "0.8.35";
 
   src = fetchFromGitHub {
     owner = "rtbrick";
     repo = "bngblaster";
     rev = finalAttrs.version;
-    hash = "sha256-oxmDg3en7mgTmhnvpkBtBJ6o/iF+GZ3Td3V6jlWMBZc=";
+    hash = "sha256-zljpApecUKtdU1HqLmeREeL+rmDUMhBWnycgmENlt1o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ek/eksctl/package.nix b/pkgs/by-name/ek/eksctl/package.nix
index bef986b3e04e4..784d50ed51285 100644
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.169.0";
+  version = "0.170.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-WVYEjmuSTIe6LVeXJD7fu1TCrZfH4Cs1T/jfqKNJhM4=";
+    hash = "sha256-aYkydocr5PDpxUYO4Cee2AbNQzBgjJRdRo3lonQRPy8=";
   };
 
   vendorHash = "sha256-cuLzn0OZ5VC+RWGsJ8DCdJN8wm0DrsjH55K/cnyuqB8=";
diff --git a/pkgs/by-name/fr/freefilesync/package.nix b/pkgs/by-name/fr/freefilesync/package.nix
index 6458fc58dcdc3..e6865aedf2ac4 100644
--- a/pkgs/by-name/fr/freefilesync/package.nix
+++ b/pkgs/by-name/fr/freefilesync/package.nix
@@ -56,6 +56,14 @@ stdenv.mkDerivation (finalAttrs: {
       patch = "Disable_wxWidgets_uncaught_exception_handling.patch";
       hash = "sha256-Fem7eDDKSqPFU/t12Jco8OmYC8FM9JgB4/QVy/ouvbI=";
     })
+    # Fix gui freeze
+    (fetchDebianPatch {
+      pname = "freefilesync";
+      version = "13.3";
+      debianRevision = "1";
+      patch = "revert_buggy_gtk3_change_in_12.1.patch";
+      hash = "sha256-eqush3zXxypQUxtO5110GoOJ30F5LZcF8XIC/Y8/fgM=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pi/pio/package.nix b/pkgs/by-name/pi/pio/package.nix
new file mode 100644
index 0000000000000..01aa886c3002a
--- /dev/null
+++ b/pkgs/by-name/pi/pio/package.nix
@@ -0,0 +1,28 @@
+{ lib, rustPlatform, fetchFromGitHub, stdenv, darwin }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "pio";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "siiptuo";
+    repo = "pio";
+    rev = version;
+    hash = "sha256-iR6G+G1UOT1ThLI3yhz3na1HmN6z2qUiI6NSKT0krtY=";
+  };
+
+  cargoHash = "sha256-jVOpk+Z3yEEoDexvxT9I0aVHJKVq47y8km/9ltoqrDA=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Accelerate
+  ];
+
+  meta = with lib; {
+    description = "Utility to compress image files while maintaining quality";
+    homepage = "https://github.com/siiptuo/pio";
+    changelog = "https://github.com/siiptuo/pio/blob/${version}/CHANGELOG.md";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ liassica ];
+    mainProgram = "pio";
+  };
+}
diff --git a/pkgs/development/interpreters/luau/default.nix b/pkgs/development/interpreters/luau/default.nix
index 4c387c8fc9de5..1457c065a9712 100644
--- a/pkgs/development/interpreters/luau/default.nix
+++ b/pkgs/development/interpreters/luau/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luau";
-  version = "0.610";
+  version = "0.611";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     rev = version;
-    hash = "sha256-5jgEoQk1UfzHHzj+QpaIjMNTSoDZpMkNl+YzJEoV9fc=";
+    hash = "sha256-gtY/dv+9+1OcxPaU/r01vgMDyfxdB36wgQ7WEGKW17c=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/botorch/default.nix b/pkgs/development/python-modules/botorch/default.nix
index c62fef2478aec..d4503c85c9883 100644
--- a/pkgs/development/python-modules/botorch/default.nix
+++ b/pkgs/development/python-modules/botorch/default.nix
@@ -11,6 +11,7 @@
 , torch
 , scipy
 , pytestCheckHook
+, pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
@@ -26,6 +27,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
+    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     wheel
@@ -40,6 +42,10 @@ buildPythonPackage rec {
     torch
   ];
 
+  pythonRelaxDeps = [
+    "linear-operator"
+  ];
+
   checkInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/dvc/default.nix b/pkgs/development/python-modules/dvc/default.nix
index b4cad5f2b206b..c469ffcb9754c 100644
--- a/pkgs/development/python-modules/dvc/default.nix
+++ b/pkgs/development/python-modules/dvc/default.nix
@@ -17,7 +17,6 @@
 , dvc-studio-client
 , dvc-task
 , fetchFromGitHub
-, fetchpatch
 , flatten-dict
 , flufl_lock
 , funcy
@@ -67,7 +66,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvc";
     rev = "refs/tags/${version}";
-    hash = "sha256-i9hIsn5rybDaWSzAFKazwB5wgpL0DAyUrqnxqCGLiR0=";
+    hash = "sha256-9JS8N4BWikmXoo5TtpUD5El2vHST80NEOBdxkHfK4ME=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
index 06dc4c7272e35..6901c9dc3107a 100644
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-secret-manager";
-  version = "2.17.0";
+  version = "2.18.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-glTilgwGqNyRrqw8iUr7oIk6Z0WC8ODs/CL4lOYXPC8=";
+    hash = "sha256-Tkmb0z/3rv8nG9Z0h+IdVAQpeobcSHPuhh1jewGzC04=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-speech/default.nix b/pkgs/development/python-modules/google-cloud-speech/default.nix
index 8fa7bc16d6ce7..a4f2ab9ae4b33 100644
--- a/pkgs/development/python-modules/google-cloud-speech/default.nix
+++ b/pkgs/development/python-modules/google-cloud-speech/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-speech";
-  version = "2.23.0";
+  version = "2.24.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-H4aDIHCF3cpsXgZIly+KBik30w5zqlVSDwgPSVMse/8=";
+    hash = "sha256-Z7x4xfCbeRPoCbinCrTwIAp9JIvfavFvA1c4/a5UbHQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index a0ab0eefe58e2..72e8595ddb5cb 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2024.2.0";
+  version = "2024.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = "hahomematic";
     rev = "refs/tags/${version}";
-    hash = "sha256-/cs1wyz3v9dLMAAgd0ipC7Z56ZzFQEBq8oqvousgr+U=";
+    hash = "sha256-Q9cuazn07LCzCMkhnNl/h6QxrFBv4fybMaDi8zN7jy0=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/jsonargparse/default.nix b/pkgs/development/python-modules/jsonargparse/default.nix
index 999811b7eee71..f52b6412a6173 100644
--- a/pkgs/development/python-modules/jsonargparse/default.nix
+++ b/pkgs/development/python-modules/jsonargparse/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "jsonargparse";
-  version = "4.27.3";
+  version = "4.27.4";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     owner = "omni-us";
     repo = "jsonargparse";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZhNop6Zo1uWJhX5XEkjTq3XcRw1WzFd6jrk5CpBGCwo=";
+    hash = "sha256-MzcFsH1PyDAnPBEELHLRKfD3TR01INDFIvHc1y3dbng=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/librosa/default.nix b/pkgs/development/python-modules/librosa/default.nix
index a93b6b0d99cb7..48eae549523fc 100644
--- a/pkgs/development/python-modules/librosa/default.nix
+++ b/pkgs/development/python-modules/librosa/default.nix
@@ -106,6 +106,8 @@ buildPythonPackage rec {
     "test_example"
     "test_example_info"
     "test_load_resample"
+    # does not converge
+    "test_nnls_vector"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/linear-operator/default.nix b/pkgs/development/python-modules/linear-operator/default.nix
index 907cb9c44d735..8ebe174d199be 100644
--- a/pkgs/development/python-modules/linear-operator/default.nix
+++ b/pkgs/development/python-modules/linear-operator/default.nix
@@ -3,10 +3,12 @@
 , fetchFromGitHub
 , jaxtyping
 , pytestCheckHook
+, pythonRelaxDepsHook
 , scipy
 , setuptools
 , setuptools-scm
 , torch
+, typeguard
 , wheel
 }:
 
@@ -23,6 +25,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
+    pythonRelaxDepsHook
     setuptools
     setuptools-scm
     wheel
@@ -32,6 +35,11 @@ buildPythonPackage rec {
     jaxtyping
     scipy
     torch
+    typeguard
+  ];
+
+  pythonRelaxDeps = [
+    "typeguard"
   ];
 
   pythonImportsCheck = [ "linear_operator" ];
@@ -42,6 +50,7 @@ buildPythonPackage rec {
 
   disabledTests = [
     # flaky numerical tests
+    "test_matmul_matrix_broadcast"
     "test_svd"
   ];
 
diff --git a/pkgs/development/python-modules/mmengine/default.nix b/pkgs/development/python-modules/mmengine/default.nix
index a73d1fff7d358..dd4e9095325fa 100644
--- a/pkgs/development/python-modules/mmengine/default.nix
+++ b/pkgs/development/python-modules/mmengine/default.nix
@@ -20,16 +20,16 @@
 
 buildPythonPackage rec {
   pname = "mmengine";
-  version = "0.10.1";
-  format = "setuptools";
+  version = "0.10.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "open-mmlab";
-    repo = pname;
+    repo = "mmengine";
     rev = "refs/tags/v${version}";
-    hash = "sha256-PG6KSoM5VUyU84z66eZknQfMhS4YWAmyWCIIpRwUOpU=";
+    hash = "sha256-fKtPDdeKB3vX2mD+Tsicq8KOkPDSACzKK1XLyugdPQ4=";
   };
 
   propagatedBuildInputs = [
@@ -54,6 +54,12 @@ buildPythonPackage rec {
 
   preCheck = ''
     export HOME=$TMPDIR
+  ''
+  # Otherwise, the backprop hangs forever. More precisely, this exact line:
+  # https://github.com/open-mmlab/mmengine/blob/02f80e8bdd38f6713e04a872304861b02157905a/tests/test_runner/test_activation_checkpointing.py#L46
+  # Solution suggested in https://github.com/pytorch/pytorch/issues/91547#issuecomment-1370011188
+  + ''
+    export MKL_NUM_THREADS=1
   '';
 
   pythonImportsCheck = [
@@ -77,6 +83,14 @@ buildPythonPackage rec {
     "test_lazy_import"
     # AssertionError
     "test_lazy_module"
+
+    # Require unpackaged aim
+    "test_experiment"
+    "test_add_config"
+    "test_add_image"
+    "test_add_scalar"
+    "test_add_scalars"
+    "test_close"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index c646e355cc0dd..eb3e76a5e518a 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "oelint-parser";
-  version = "3.0.2";
+  version = "3.1.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "oelint_parser";
-    hash = "sha256-8Gagk3ijAlmIp0MQwuJ2REIUcoTlvdNcCK9k2RY8DOA=";
+    hash = "sha256-uR90Af/3E8YVZ2ALSVFOkTr59iVw5NkLOnQBm4Us1vk=";
   };
 
   buildInputs = [ pip ];
diff --git a/pkgs/development/python-modules/pycaption/default.nix b/pkgs/development/python-modules/pycaption/default.nix
index cfe2838db9ff4..ea873940e4162 100644
--- a/pkgs/development/python-modules/pycaption/default.nix
+++ b/pkgs/development/python-modules/pycaption/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pycaption";
-  version = "2.2.2";
+  version = "2.2.3";
 
   disabled = pythonOlder "3.8";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "pbs";
     repo = "pycaption";
     rev = "refs/tags/${version}";
-    hash = "sha256-6c16S77K1UC7+rz8tF0tLlBspienhDbgSXhdJzkQZII=";
+    hash = "sha256-uPzeMuYoNgluXnwSMQE5lSkduBzwi8mP8K5cAKdTZUw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sense-energy/default.nix b/pkgs/development/python-modules/sense-energy/default.nix
index 35c0b4b6f4f86..cc91f276c0e7e 100644
--- a/pkgs/development/python-modules/sense-energy/default.nix
+++ b/pkgs/development/python-modules/sense-energy/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, setuptools
 , aiohttp
 , ciso8601
 , async-timeout
@@ -14,8 +15,8 @@
 
 buildPythonPackage rec {
   pname = "sense-energy";
-  version = "0.12.2";
-  format = "setuptools";
+  version = "0.12.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -23,14 +24,18 @@ buildPythonPackage rec {
     owner = "scottbonline";
     repo = "sense";
     rev = "refs/tags/${version}";
-    hash = "sha256-OVFRM31LwHNeJUx+s/TN/1o4wvjMQEKaZEPI+y+S64s=";
+    hash = "sha256-aAPDYg5ttOAkKF5c1ft2apIQoReh4t22+78PtmLZNlI=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "{{VERSION_PLACEHOLDER}}" "${version}"
+      --replace-fail "{{VERSION_PLACEHOLDER}}" "${version}"
   '';
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     aiohttp
     async-timeout
diff --git a/pkgs/development/python-modules/tesla-fleet-api/default.nix b/pkgs/development/python-modules/tesla-fleet-api/default.nix
index 508e4f6659752..e74f5b0c0edb2 100644
--- a/pkgs/development/python-modules/tesla-fleet-api/default.nix
+++ b/pkgs/development/python-modules/tesla-fleet-api/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "tesla-fleet-api";
-  version = "0.2.3";
+  version = "0.2.5";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Teslemetry";
     repo = "python-tesla-fleet-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-sijFbwHRgTQXurg0bl5vH8NIGb2pR9XIQod7PJ6/rvY=";
+    hash = "sha256-zQPaOmSGqOeJ5E+m60g4ftXWI9woTxblJjRIocphR5E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/types-aiobotocore/default.nix b/pkgs/development/python-modules/types-aiobotocore/default.nix
index 8ead0699cd773..e69d9ab8e5dff 100644
--- a/pkgs/development/python-modules/types-aiobotocore/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore/default.nix
@@ -364,12 +364,12 @@
 
 buildPythonPackage rec {
   pname = "types-aiobotocore";
-  version = "2.11.1";
+  version = "2.11.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LsG7jHSIEk//iAiBD6SwL6JjlQSezBFGEzrxeYtPrkQ=";
+    hash = "sha256-bnYg/u2BvG3/iBJ5xKQwiMG/n8vREpnOGHYaSlwlnRs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/buildpack/default.nix b/pkgs/development/tools/buildpack/default.nix
index 2d39fd93559d2..57d10c8f1865a 100644
--- a/pkgs/development/tools/buildpack/default.nix
+++ b/pkgs/development/tools/buildpack/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pack";
-  version = "0.32.1";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "buildpacks";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-U3dSGTn9dV0Iiu0DtLCWF/BFHYhRGxirA5T067riA0w=";
+    hash = "sha256-c/8pKuFO4lii/Z32mYbTHiEedxDzB3wb6lQGOrLQfYM=";
   };
 
-  vendorHash = "sha256-42CrWLwBcv2GE+hEgJJOd7hFQu7rjYrXkPhhUykqIQw=";
+  vendorHash = "sha256-UCNpKBsdwWmllgIi/3Dr6lWJLOh6okYwOHmRfRW0iAQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/espup/default.nix b/pkgs/development/tools/espup/default.nix
index 0e47b8e55658d..145f681f1cbc1 100644
--- a/pkgs/development/tools/espup/default.nix
+++ b/pkgs/development/tools/espup/default.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "espup";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "esp-rs";
     repo = "espup";
     rev = "v${version}";
-    hash = "sha256-MLr6Fh1KAvGry/fToJuLYOf36MKW2i5W4XiMIEeb52M=";
+    hash = "sha256-BW71yFX4jfx90KHdynkGSqWD4diyjEBQfdBNquVdDDI=";
   };
 
-  cargoHash = "sha256-AIM08tvt1w+TJgjxCxU+zN9eDBvgCv15WM+vQGbTF18=";
+  cargoHash = "sha256-iUVOU1P996hLC1rR/wWtsDBkKSB0rD7PPh6ZsQkHq3I=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/language-servers/verible/default.nix b/pkgs/development/tools/language-servers/verible/default.nix
index e607713f49f8e..4809b85e2e5be 100644
--- a/pkgs/development/tools/language-servers/verible/default.nix
+++ b/pkgs/development/tools/language-servers/verible/default.nix
@@ -18,8 +18,8 @@ buildBazelPackage rec {
   # These environment variables are read in bazel/build-version.py to create
   # a build string shown in the tools --version output.
   # If env variables not set, it would attempt to extract it from .git/.
-  GIT_DATE = "2023-12-23";
-  GIT_VERSION = "v0.0-3471-g9cb45092";
+  GIT_DATE = "2024-02-01";
+  GIT_VERSION = "v0.0-3515-g2d841599";
 
   # Derive nix package version from GIT_VERSION: "v1.2-345-abcde" -> "1.2.345"
   version = builtins.concatStringsSep "." (lib.take 3 (lib.drop 1 (builtins.splitVersion GIT_VERSION)));
@@ -28,16 +28,9 @@ buildBazelPackage rec {
     owner = "chipsalliance";
     repo  = "verible";
     rev   = "${GIT_VERSION}";
-    hash  = "sha256-nFt5TeFv63Igx8Zer2s/ZLj5DsHeZj5V/+3burnEm9g=";
+    hash  = "sha256-D/blcex/St1nLKvjzuKnmAJE8HVlGy8ampmXIxKK11M=";
   };
 
-  patches = [
-    # Patch WORKSPACE file to not include windows-related dependencies,
-    # as they are removed by bazel, breaking the fixed output derivation
-    # TODO: fix upstream
-    ./remove-unused-deps.patch
-  ];
-
   bazel = bazel_5;
   bazelFlags = [
     "--//bazel:use_local_flex_bison"
@@ -46,7 +39,7 @@ buildBazelPackage rec {
   ];
 
   fetchAttrs = {
-    sha256 = "sha256-gZzrgZsHQ9zMoIDooVo9nRQbkJ41igme8wcNFj5EzWc=";
+    sha256 = "sha256-2YruKvU7OZQ7mKNrqYITat+cmf/DEytDElYw7CvkxJk=";
   };
 
   nativeBuildInputs = [
@@ -98,6 +91,7 @@ buildBazelPackage rec {
     homepage = "https://github.com/chipsalliance/verible";
     license = licenses.asl20;
     maintainers = with maintainers; [ hzeller newam ];
+    # Platforms linux only currently; some LIBTOOL issue on Darwin w/ bazel
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/tools/language-servers/verible/remove-unused-deps.patch b/pkgs/development/tools/language-servers/verible/remove-unused-deps.patch
deleted file mode 100644
index 57b152d9db319..0000000000000
--- a/pkgs/development/tools/language-servers/verible/remove-unused-deps.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/WORKSPACE b/WORKSPACE
-index ad16b3a1..52b66703 100644
---- a/WORKSPACE
-+++ b/WORKSPACE
-@@ -81,17 +81,6 @@ load("@com_github_google_rules_install//:setup.bzl", "install_rules_setup")
- 
- install_rules_setup()
- 
--# Need to load before rules_flex/rules_bison to make sure
--# win_flex_bison is the chosen toolchain on Windows
--load("//bazel:win_flex_bison.bzl", "win_flex_configure")
--
--win_flex_configure(
--    name = "win_flex_bison",
--    sha256 = "8d324b62be33604b2c45ad1dd34ab93d722534448f55a16ca7292de32b6ac135",
--    # bison 3.8.2, flex 2.6.4
--    url = "https://github.com/lexxmark/winflexbison/releases/download/v2.5.25/win_flex_bison-2.5.25.zip",
--)
--
- http_archive(
-     name = "rules_m4",
-     sha256 = "b0309baacfd1b736ed82dc2bb27b0ec38455a31a3d5d20f8d05e831ebeef1a8e",
diff --git a/pkgs/development/tools/rust/cargo-make/default.nix b/pkgs/development/tools/rust/cargo-make/default.nix
index f3bd8a89c99b2..1971c81f46093 100644
--- a/pkgs/development/tools/rust/cargo-make/default.nix
+++ b/pkgs/development/tools/rust/cargo-make/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-make";
-  version = "0.37.8";
+  version = "0.37.9";
 
   src = fetchFromGitHub {
     owner = "sagiegurari";
     repo = "cargo-make";
     rev = version;
-    hash = "sha256-hjrR5hCyR+s1/d9LvxRfklmLhReAU98NsEjyRrjD8sI=";
+    hash = "sha256-pfLK9QGDS4KPIdXq/LI++/r1OxqmgF0qqVJNDSVrZFI=";
   };
 
-  cargoHash = "sha256-KaBpq9ykTvSdGpziV15V7S5zMsEyVHJdLLMZydNYyF8=";
+  cargoHash = "sha256-x8cx64B+skusk0LDRQT/1g57NBQMchy2HvvryoY0R/I=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/upbound/default.nix b/pkgs/development/tools/upbound/default.nix
index c4b2a421b4310..cfb667d55842e 100644
--- a/pkgs/development/tools/upbound/default.nix
+++ b/pkgs/development/tools/upbound/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "upbound";
-  version = "0.21.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = "up";
     rev = "v${version}";
-    sha256 = "sha256-SvnmdpsdXbPSC+4inoMvu55az33Zucqf4c3yQ0g6EMw=";
+    sha256 = "sha256-AtaO4O9UbA44OnZl5ARQkyPHoBYnuwdFd91DEZPN+Co=";
   };
 
-  vendorHash = "sha256-ai+Mro/ooUElJJq8BbnCo9PupIAwlanDeh+oe5otJJ4=";
+  vendorHash = "sha256-jHVwI5fQbS/FhRptRXtNezG1djaZKHJgpPJfuEH/zO0=";
 
   subPackages = [ "cmd/docker-credential-up" "cmd/up" ];
 
diff --git a/pkgs/games/ddnet/default.nix b/pkgs/games/ddnet/default.nix
index 8e078e13f6837..aabbc49ea51f3 100644
--- a/pkgs/games/ddnet/default.nix
+++ b/pkgs/games/ddnet/default.nix
@@ -35,19 +35,19 @@
 
 stdenv.mkDerivation rec {
   pname = "ddnet";
-  version = "18.0.2";
+  version = "18.0.3";
 
   src = fetchFromGitHub {
     owner = "ddnet";
     repo = pname;
     rev = version;
-    hash = "sha256-ywHPs1bRLxx8nd1D5LgMKkSxVPEuqWxaLzF+1nqNkto=";
+    hash = "sha256-XirN16XywTtF+gLQT3G3HjqStkNk+NVO7j+FEecq54E=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     name = "${pname}-${version}";
     inherit src;
-    hash = "sha256-UPe1EMFwS1We2I9Ba8Ku2DTnnUFEl2wapfbDNiWMb1w";
+    hash = "sha256-dFYrvnVxOelRIuqtTiSwBIFher/b/dCdyZvqIne3Lng=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/audio/asap/default.nix b/pkgs/tools/audio/asap/default.nix
index ccdb5ed930393..3eb2e8ea7ca9b 100644
--- a/pkgs/tools/audio/asap/default.nix
+++ b/pkgs/tools/audio/asap/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "asap";
-  version = "6.0.1";
+  version = "6.0.2";
 
   src = fetchzip {
     url = "mirror://sourceforge/project/asap/asap/${version}/asap-${version}.tar.gz";
-    sha256 = "sha256-nTnnRDYOkTmXfXPS1XIHaC2LHFfZz+gVInQ3satuyDM=";
+    sha256 = "sha256-hVZODnm2GxSUKglOyQ8uObeKkAKrupPTftEP0dck9a8=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/security/cloudfox/default.nix b/pkgs/tools/security/cloudfox/default.nix
index ab5f395f27c80..07b6a546dc2f4 100644
--- a/pkgs/tools/security/cloudfox/default.nix
+++ b/pkgs/tools/security/cloudfox/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "cloudfox";
-  version = "1.13.1";
+  version = "1.13.2";
 
   src = fetchFromGitHub {
     owner = "BishopFox";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-zP6jrueL3CXl6+fCmx4u0FzFy8mj6WkmECPHRZyqX8A=";
+    hash = "sha256-kklFn8HDMwsOjS0KDrWznGazE7RZtk0crxYEE3RuH8s=";
   };
 
   vendorHash = "sha256-qPIMmyKTmZEmxlLLftRMnBXvo22WFROYlCAAsAb7jDg=";
diff --git a/pkgs/tools/security/cnquery/default.nix b/pkgs/tools/security/cnquery/default.nix
index 9f16add25dffc..bc008a877e567 100644
--- a/pkgs/tools/security/cnquery/default.nix
+++ b/pkgs/tools/security/cnquery/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "10.0.3";
+  version = "10.1.4";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     rev = "v${version}";
-    hash = "sha256-LiW9P0q4VstzkNQQUdI5xG1TmpdwQMi3EZk0gsAA5LU=";
+    hash = "sha256-JQg1tQs+WojtSweA+tP37LqKH8l+CkTEwvoTjKwg3S0=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-/SUdyzCbIuVCM2/K0shlJTXbCJ8FSkXtOPaJvRDt2Zk=";
+  vendorHash = "sha256-+tKz2Zy+tmqOVj9NoYe5lfqmzgBxVkNJOh4/9o9XfmY=";
 
   meta = with lib; {
     description = "cloud-native, graph-based asset inventory";
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 27d6ce498439e..a1385f4b1e78b 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2024-02-01";
+  version = "2024-02-03";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Ypl2OdyOLKGISQZ0A6jM3uwUBGGzHjuwOL7RHQynTow=";
+    hash = "sha256-TS7VyKw3hGT06ARLfyw6P/KnApPkl8+oHv15k5Imi6U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 56db6fb78b955..1fb47c7762cbd 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "3.1.9";
+  version = "3.1.10";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0GQoX4S4k3d7/BJ1KDTKH9UceLL12IHlEAt1E4JRPLA=";
+    hash = "sha256-11ORN9h2VsXJKZw5HUljq6Tk0XC81tC7sCPbFgcTd+k=";
   };
 
   vendorHash = "sha256-0ERUvPUAxj0H62YcRvsfYX8h0Hp/mA6NdE8E/BjPGzw=";
diff --git a/pkgs/tools/security/volatility3/default.nix b/pkgs/tools/security/volatility3/default.nix
index 221ed6ae639db..7f6307687323a 100644
--- a/pkgs/tools/security/volatility3/default.nix
+++ b/pkgs/tools/security/volatility3/default.nix
@@ -5,15 +5,20 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "volatility3";
-  version = "2.5.0";
+  version = "2.5.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "volatilityfoundation";
-    repo = pname;
+    repo = "volatility3";
     rev = "refs/tags/v${version}";
-    hash = "sha256-yutQbrWmJGDsTccQcR+HtC8JvgmsXfCxbxxcMLDx5vk=";
+    hash = "sha256-tghwDDfy8TohqTn9WQvmEal3qK0OKKq7GvGnPGTble0=";
   };
 
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     capstone
     jsonschema