Merge master into staging-next

39 files changed, 185 insertions, 113 deletions

diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index d467c3c0471cf..6b69d559748c5 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -293,6 +293,7 @@ in
       kexAlgorithms = mkOption {
         type = types.listOf types.str;
         default = [
+          "sntrup761x25519-sha512@openssh.com"
           "curve25519-sha256"
           "curve25519-sha256@libssh.org"
           "diffie-hellman-group-exchange-sha256"
@@ -301,7 +302,7 @@ in
           Allowed key exchange algorithms
           </para>
           <para>
-          Defaults to recommended settings from both
+          Uses the lower bound recommended in both
           <link xlink:href="https://stribika.github.io/2015/01/04/secure-secure-shell.html" />
           and
           <link xlink:href="https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67" />
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix
index 7cd44b2f8a0a8..a3c3c245f1d7f 100644
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@@ -301,8 +301,9 @@ let
       {
         description = "WireGuard Peer - ${interfaceName} - ${peer.publicKey}";
         requires = [ "wireguard-${interfaceName}.service" ];
-        after = [ "wireguard-${interfaceName}.service" ];
-        wantedBy = [ "multi-user.target" "wireguard-${interfaceName}.service" ];
+        wants = [ "network-online.target" ];
+        after = [ "wireguard-${interfaceName}.service" "network-online.target" ];
+        wantedBy = [ "wireguard-${interfaceName}.service" ];
         environment.DEVICE = interfaceName;
         environment.WG_ENDPOINT_RESOLUTION_RETRIES = "infinity";
         path = with pkgs; [ iproute2 wireguard-tools ];
@@ -379,8 +380,9 @@ let
     nameValuePair "wireguard-${name}"
       {
         description = "WireGuard Tunnel - ${name}";
-        requires = [ "network-online.target" ];
-        after = [ "network.target" "network-online.target" ];
+        after = [ "network-pre.target" ];
+        wants = [ "network.target" ];
+        before = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
         environment.DEVICE = name;
         path = with pkgs; [ kmod iproute2 wireguard-tools ];
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 87270776f5a69..52287a834c912 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -153,11 +153,11 @@ in {
     package = mkOption {
       type = types.package;
       description = "Which package to use for the Nextcloud instance.";
-      relatedPackages = [ "nextcloud22" "nextcloud23" ];
+      relatedPackages = [ "nextcloud22" "nextcloud23" "nextcloud24" ];
     };
     phpPackage = mkOption {
       type = types.package;
-      relatedPackages = [ "php74" "php80" ];
+      relatedPackages = [ "php74" "php80" "php81" ];
       defaultText = "pkgs.php";
       description = ''
         PHP package to use for Nextcloud.
@@ -568,7 +568,7 @@ in {
 
   config = mkIf cfg.enable (mkMerge [
     { warnings = let
-        latest = 23;
+        latest = 24;
         upgradeWarning = major: nixos:
           ''
             A legacy Nextcloud install (from before NixOS ${nixos}) may be installed.
@@ -604,6 +604,7 @@ in {
         ++ (optional (versionOlder cfg.package.version "21") (upgradeWarning 20 "21.05"))
         ++ (optional (versionOlder cfg.package.version "22") (upgradeWarning 21 "21.11"))
         ++ (optional (versionOlder cfg.package.version "23") (upgradeWarning 22 "22.05"))
+        ++ (optional (versionOlder cfg.package.version "24") (upgradeWarning 23 "22.05"))
         ++ (optional isUnsupportedMariadb ''
             You seem to be using MariaDB at an unsupported version (i.e. at least 10.6)!
             Please note that this isn't supported officially by Nextcloud. You can either
@@ -626,14 +627,15 @@ in {
             ''
           else if versionOlder stateVersion "21.11" then nextcloud21
           else if versionOlder stateVersion "22.05" then nextcloud22
-          else nextcloud23
+          else nextcloud24
         );
 
       services.nextcloud.datadir = mkOptionDefault config.services.nextcloud.home;
 
       services.nextcloud.phpPackage =
         if versionOlder cfg.package.version "21" then pkgs.php74
-        else pkgs.php80;
+        else if versionOlder cfg.package.version "24" then pkgs.php80
+        else pkgs.php81;
     }
 
     { assertions = [
@@ -884,7 +886,7 @@ in {
         # FIXME(@Ma27) Nextcloud isn't compatible with mariadb 10.6,
         # this is a workaround.
         # See https://help.nextcloud.com/t/update-to-next-cloud-21-0-2-has-get-an-error/117028/22
-        settings = {
+        settings = mkIf (versionOlder cfg.package.version "24") {
           mysqld = {
             innodb_read_only_compressed = 0;
           };
diff --git a/nixos/modules/services/web-apps/nextcloud.xml b/nixos/modules/services/web-apps/nextcloud.xml
index 8f55086a2bd1f..b46f34420a703 100644
--- a/nixos/modules/services/web-apps/nextcloud.xml
+++ b/nixos/modules/services/web-apps/nextcloud.xml
@@ -11,7 +11,7 @@
   desktop client is packaged at <literal>pkgs.nextcloud-client</literal>.
  </para>
  <para>
-  The current default by NixOS is <package>nextcloud23</package> which is also the latest
+  The current default by NixOS is <package>nextcloud24</package> which is also the latest
   major version available.
  </para>
  <section xml:id="module-services-nextcloud-basic-usage">
diff --git a/nixos/tests/nextcloud/default.nix b/nixos/tests/nextcloud/default.nix
index b7b1c5c66002e..76feac314d5ba 100644
--- a/nixos/tests/nextcloud/default.nix
+++ b/nixos/tests/nextcloud/default.nix
@@ -18,4 +18,4 @@ foldl
     };
   })
 { }
-  [ 22 23 ]
+  [ 22 23 24 ]
diff --git a/pkgs/applications/blockchains/wasabibackend/default.nix b/pkgs/applications/blockchains/wasabibackend/default.nix
index 784b01192f706..df30302bc6c50 100644
--- a/pkgs/applications/blockchains/wasabibackend/default.nix
+++ b/pkgs/applications/blockchains/wasabibackend/default.nix
@@ -10,13 +10,13 @@
 
 buildDotnetModule rec {
   pname = "wasabibackend";
-  version = "1.1.13.0";
+  version = "1.1.13.1";
 
   src = fetchFromGitHub {
     owner = "zkSNACKs";
     repo = "WalletWasabi";
     rev = "v${version}";
-    sha256 = "sha256-zDOk8MurT5NXOr4kvm5mnsphY+eDFWuVBcpeTZpcHOo=";
+    sha256 = "sha256-Hwav7moG6XKAcR7L0Q7CtifP3zCNRfHIihlaFw+dzbk=";
   };
 
   projectFile = "WalletWasabi.Backend/WalletWasabi.Backend.csproj";
diff --git a/pkgs/applications/networking/cluster/temporal/default.nix b/pkgs/applications/networking/cluster/temporal/default.nix
index 2475dd0f1d940..db423d619b526 100644
--- a/pkgs/applications/networking/cluster/temporal/default.nix
+++ b/pkgs/applications/networking/cluster/temporal/default.nix
@@ -1,38 +1,37 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib, fetchFromGitHub, buildGoModule, testers, temporal }:
 
 buildGoModule rec {
   pname = "temporal";
-  version = "1.15.0";
+  version = "1.16.2";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "temporal";
     rev = "v${version}";
-    sha256 = "sha256-5Tu838086qgIa2fqda2xi7vn4JbkENVJH4XU3NwW7Ic=";
+    sha256 = "sha256-MPfyjRpjfnuVbj+Pd7yIlaEJCiX1IEy/Lwwkv23kugw=";
   };
 
-  vendorSha256 = "sha256-caRBgkuHQ38r6OsKQCJ2pxAe8s6mc4g/QCIsCEXvY3M=";
+  vendorSha256 = "sha256-82W1nHhHvvU6poh5szuH9lDkq6YHgyfsJSubxotV270=";
 
-  # Errors:
-  #  > === RUN   TestNamespaceHandlerGlobalNamespaceDisabledSuite
-  # gocql: unable to dial control conn 127.0.0.1:9042: dial tcp 127.0.0.1:9042: connect: connection refused
-  doCheck = false;
+  CGO_ENABLED = 0;
+
+  ldflags = [ "-s" "-w" ];
+
+  checkFlags = [ "-short" ];
 
   installPhase = ''
     runHook preInstall
-    mkdir -p $out/bin
-    install -Dm755 "$GOPATH/bin/cli" -T $out/bin/tctl
-    install -Dm755 "$GOPATH/bin/authorization" -T $out/bin/tctl-authorization-plugin
+
     install -Dm755 "$GOPATH/bin/server" -T $out/bin/temporal-server
     install -Dm755 "$GOPATH/bin/cassandra" -T $out/bin/temporal-cassandra-tool
     install -Dm755 "$GOPATH/bin/sql" -T $out/bin/temporal-sql-tool
+
     runHook postInstall
   '';
 
-  doInstallCheck = true;
-  installCheckPhase = ''
-    $out/bin/tctl --version | grep ${version} > /dev/null
-  '';
+  passthru.tests.version = testers.testVersion {
+    package = temporal;
+  };
 
   meta = with lib; {
     description = "A microservice orchestration platform which enables developers to build scalable applications without sacrificing productivity or reliability";
@@ -40,5 +39,6 @@ buildGoModule rec {
     changelog = "https://github.com/temporalio/temporal/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ titanous ];
+    mainProgram = "temporal-server";
   };
 }
diff --git a/pkgs/applications/networking/cluster/tilt/default.nix b/pkgs/applications/networking/cluster/tilt/default.nix
index 5532c644c2c82..7aaf5b8bc75fa 100644
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ stdenv, lib, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "tilt";
@@ -24,5 +24,13 @@ buildGoModule rec {
     homepage = "https://tilt.dev/";
     license = licenses.asl20;
     maintainers = with maintainers; [ anton-dessiatov ];
+
+    # TODO: Remove once nixpkgs uses macOS SDK 10.14+ for x86_64-darwin
+    # Undefined symbols for architecture x86_64:
+    # "_SecTrustEvaluateWithError", referenced from:
+    #     _crypto/x509/internal/macos.x509_SecTrustEvaluateWithError_trampoline.abi0 in go.o
+    # "_utimensat", referenced from:
+    #     _syscall.libc_utimensat_trampoline.abi0 in go.o
+    broken = stdenv.isDarwin && stdenv.isx86_64;
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index db38a2d0e8629..1b15c2aa0cca9 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -7,18 +7,27 @@
   # Dynamic libraries
 , alsa-lib
 , atk
+, at-spi2-atk
+, at-spi2-core
 , cairo
+, cups
 , dbus
+, expat
+, libdrm
 , libGL
 , fontconfig
 , freetype
 , gtk3
 , gdk-pixbuf
 , glib
+, mesa
+, nspr
+, nss
 , pango
 , wayland
 , xorg
 , libxkbcommon
+, udev
 , zlib
   # Runtime
 , coreutils
@@ -33,13 +42,11 @@ let
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "Unsupported system: ${system}";
 
-  # Zoom versions are released at different times for each platform and linux
-  # is stuck on 5.9.6 until https://github.com/NixOS/nixpkgs/pull/166085 is
-  # resolved
+  # Zoom versions are released at different times for each platform
   version = {
     aarch64-darwin = "5.10.4.6592";
     x86_64-darwin = "5.10.4.6592";
-    x86_64-linux = "5.9.6.2225";
+    x86_64-linux = "5.10.4.2845";
    }.${system} or throwSystem;
 
   srcs = {
@@ -53,7 +60,7 @@ let
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${version}/zoom_x86_64.pkg.tar.xz";
-      sha256 = "0rynpw2fjn9j75f34rk0rgqn9wzyzgzmwh1a3xcx7hqingv45k53";
+      sha256 = "9gspydrGaEjzAM0nK1u0XNm07HTupJ2wnPxCFWy+Nts=";
     };
   };
 
@@ -61,28 +68,40 @@ let
     # $ LD_LIBRARY_PATH=$NIX_LD_LIBRARY_PATH:$PWD ldd zoom | grep 'not found'
     alsa-lib
     atk
+    at-spi2-atk
+    at-spi2-core
     cairo
+    cups
     dbus
+    expat
+    libdrm
     libGL
     fontconfig
     freetype
     gtk3
     gdk-pixbuf
     glib
+    mesa
+    nspr
+    nss
     pango
     stdenv.cc.cc
     wayland
     xorg.libX11
     xorg.libxcb
     xorg.libXcomposite
+    xorg.libXdamage
     xorg.libXext
     libxkbcommon
+    xorg.libXrandr
     xorg.libXrender
-    zlib
+    xorg.libxshmfence
     xorg.xcbutilimage
     xorg.xcbutilkeysyms
     xorg.libXfixes
     xorg.libXtst
+    udev
+    zlib
   ] ++ lib.optional (pulseaudioSupport) libpulseaudio);
 
 in
@@ -134,7 +153,9 @@ stdenv.mkDerivation rec {
     done
 
     # ZoomLauncher sets LD_LIBRARY_PATH before execing zoom
-    wrapProgram $out/opt/zoom/zoom \
+    # IPC breaks if the executable name does not end in 'zoom'
+    mv $out/opt/zoom/zoom $out/opt/zoom/.zoom
+    makeWrapper $out/opt/zoom/.zoom $out/opt/zoom/zoom \
       --prefix LD_LIBRARY_PATH ":" ${libs}
 
     rm $out/bin/zoom
diff --git a/pkgs/applications/networking/p2p/tixati/default.nix b/pkgs/applications/networking/p2p/tixati/default.nix
index 0d44f084086e9..9a0cc70c1999e 100644
--- a/pkgs/applications/networking/p2p/tixati/default.nix
+++ b/pkgs/applications/networking/p2p/tixati/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tixati";
-  version = "2.88";
+  version = "2.89";
 
   src = fetchurl {
     url = "https://download2.tixati.com/download/tixati-${version}-1.x86_64.manualinstall.tar.gz";
-    sha256 = "sha256-9d9Z+3Uyxy4Bj8STtzHWwyyhWeMv3wo0IH6uxGTaA0I=";
+    sha256 = "sha256-fd7DMKoRxNmNjCxl2ViINjnCEXJrhJU4aaRT+NoB1vI=";
   };
 
   installPhase = ''
diff --git a/pkgs/applications/version-management/git-and-tools/cgit/common.nix b/pkgs/applications/version-management/git-and-tools/cgit/common.nix
index d6b787315b8de..0cbc04b7bcc23 100644
--- a/pkgs/applications/version-management/git-and-tools/cgit/common.nix
+++ b/pkgs/applications/version-management/git-and-tools/cgit/common.nix
@@ -68,6 +68,8 @@ stdenv.mkDerivation {
 
   stripDebugList = [ "cgit" ];
 
+  enableParallelBuilding = true;
+
   meta = {
     inherit homepage description;
     license = lib.licenses.gpl2;
diff --git a/pkgs/build-support/go/garble.nix b/pkgs/build-support/go/garble.nix
index c9bcf2cec153d..502aba4e64a79 100644
--- a/pkgs/build-support/go/garble.nix
+++ b/pkgs/build-support/go/garble.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "garble";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "burrowers";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-F8O/33o//yGnum9sZo1dzcvf3ifRalva6SDC36iPbDA==";
+    sha256 = "sha256-VeqF1MB8knM+NtG9Y+x1g2OF7LFZRC8/c8jicGP3vpo=";
   };
 
-  vendorSha256 = "sha256-iNH/iBEOTkIhVlDGfI66ZYyVjyH6WrLbUSMyONPjUc4=";
+  vendorSha256 = "sha256-FQMeA6VUDQa6wpvMoYsigkzukQ0dArAkysiksJWq+iY=";
 
   # Used for some of the tests.
   checkInputs = [git];
diff --git a/pkgs/development/libraries/dlib/default.nix b/pkgs/development/libraries/dlib/default.nix
index ea6d45e5dffc2..11a80987dcabc 100644
--- a/pkgs/development/libraries/dlib/default.nix
+++ b/pkgs/development/libraries/dlib/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dlib";
-  version = "19.23";
+  version = "19.24";
 
   src = fetchFromGitHub {
     owner = "davisking";
     repo = "dlib";
     rev ="v${version}";
-    sha256 = "sha256-88vusoLEkjh3WRh/PxPtsVIFk85serRq2VxVcEus3IE=";
+    sha256 = "sha256-YhIjP9TIIyQF6lBj85gyVRIAAwgIodzh0ViQL8v2ACA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/node-packages/main-programs.nix b/pkgs/development/node-packages/main-programs.nix
index bb9498a4cc96e..8a4b390d65bca 100644
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@@ -2,7 +2,13 @@
 # executable that matches that packages name, so that they'll work with `nix run`.
 {
   # Packages that provide multiple executables where one is clearly the `mainProgram`.
+  "@antfu/ni" = "ni";
+  "@electron-forge/cli" = "electron-forge";
+  "@squoosh/cli" = "squoosh-cli";
+  "@webassemblyjs/cli" = "wasm2wast";
+  coffee-script = "coffee";
   typescript = "tsc";
+  vue-cli = "vue";
 
   # Packages that provide a single executable whose name differs from the package's `name`.
   "@angular/cli" = "ng";
diff --git a/pkgs/development/ocaml-modules/graphql_ppx/default.nix b/pkgs/development/ocaml-modules/graphql_ppx/default.nix
index aa149d60e4d83..5c38602e8df00 100644
--- a/pkgs/development/ocaml-modules/graphql_ppx/default.nix
+++ b/pkgs/development/ocaml-modules/graphql_ppx/default.nix
@@ -4,7 +4,7 @@
 
 buildDunePackage rec {
   pname = "graphql_ppx";
-  version = "1.2.0";
+  version = "1.2.2";
 
   minimalOCamlVersion = "4.08";
 
@@ -12,7 +12,7 @@ buildDunePackage rec {
     owner = "reasonml-community";
     repo = "graphql-ppx";
     rev = "v${version}";
-    sha256 = "1fymmvk616wv5xkwfdmqibdgfl47ry6idc5wfh20a3mz9mpaa13s";
+    sha256 = "sha256-+WJhA2ixZHiSZBoX14dnQKk7JfVAIME4JooNSnhRp44=";
   };
 
   buildInputs = [ ppxlib ];
diff --git a/pkgs/development/python-modules/ansible-later/default.nix b/pkgs/development/python-modules/ansible-later/default.nix
index 8ad96e78bcfbf..c35cfcb6e458c 100644
--- a/pkgs/development/python-modules/ansible-later/default.nix
+++ b/pkgs/development/python-modules/ansible-later/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "ansible-later";
-  version = "2.0.12";
+  version = "2.0.13";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "thegeeklab";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-0N/BER7tV8Hv1pvHaf/46BKnzZfHBGuEaPPex/CDQe0=";
+    hash = "sha256-9xVFvXCHjgF+7asO1ialGIofJwsRRRiydo/Ui2C+Wig=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
index c8a2eefed246d..9e32b3e4fea9f 100644
--- a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
+++ b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "cyclonedx-python-lib";
-  version = "2.3.0";
+  version = "2.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "CycloneDX";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-eZy+m6AkSlZM/i64FyFL+ZgeW86MOSM6sDYPT4ckaHE=";
+    hash = "sha256-IrMXHWeksEmON3LxJvQ3WSKwQTY0aRZ8XItWMr3p4gw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/doc8/default.nix b/pkgs/development/python-modules/doc8/default.nix
index c02100e379ec5..97066662397b4 100644
--- a/pkgs/development/python-modules/doc8/default.nix
+++ b/pkgs/development/python-modules/doc8/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "doc8";
-  version = "0.11.1";
+  version = "0.11.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-bby1Ry79Mydj/7KGK0/e7EDIpv3Gu2fmhxOtdJylgIw=";
+    sha256 = "sha256-w1ojH4jxXCBGWRVO09SZ+k1ALX5j1By6e1TPXmRhI6s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dulwich/default.nix b/pkgs/development/python-modules/dulwich/default.nix
index 479af3a676fd4..b10d29a594345 100644
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@@ -17,7 +17,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.20.36";
+  version = "0.20.38";
   pname = "dulwich";
   format = "setuptools";
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2s7xVJwSdffS1v7NLyz6O6ozB9AJpRTAwjIDP2uqXSE=";
+    hash = "sha256-c0Z5DYc1yG+7xbcLZ08O+UCWweUJm6cnNJFigjmBf8g=";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/python-modules/elementpath/default.nix b/pkgs/development/python-modules/elementpath/default.nix
index e3104d8d882e5..7f855242ebbf9 100644
--- a/pkgs/development/python-modules/elementpath/default.nix
+++ b/pkgs/development/python-modules/elementpath/default.nix
@@ -6,7 +6,7 @@
 
 buildPythonPackage rec {
   pname = "elementpath";
-  version = "2.5.1";
+  version = "2.5.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "sissaschool";
     repo = "elementpath";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tejsQ6m9XyMGDIEDzWYwSav5Iqa9S/DIYShOpoSlTWo=";
+    hash = "sha256-JmNG6SXig24X34nQXrpMN9ir9+l8o23ddzw2uyR3qb0=";
   };
 
   # avoid circular dependency with xmlschema which directly depends on this
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 27c1a673eee96..5b205523f25c0 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "1.3.1";
+  version = "1.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-RgjsaGtji5vSQcv+npOYcXJNYUhx9Snz56BXnfoc2QY=";
+    sha256 = "sha256-1JYakfs+lLCfB2Ann1QfNw+MBrB9PiixOUqdA7UgbWE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/humanize/default.nix b/pkgs/development/python-modules/humanize/default.nix
index fa13cdab0c23a..299bd9685940c 100644
--- a/pkgs/development/python-modules/humanize/default.nix
+++ b/pkgs/development/python-modules/humanize/default.nix
@@ -1,25 +1,26 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, freezegun
+, importlib-metadata
+, pytestCheckHook
 , pythonOlder
-, setuptools-scm
 , setuptools
-, pytestCheckHook
-, freezegun
+, setuptools-scm
 }:
 
 buildPythonPackage rec {
-  version = "4.0.0";
+  version = "4.1.0";
   pname = "humanize";
   format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
-    owner = "jmoiron";
+    owner = "python-humanize";
     repo = pname;
     rev = version;
-    sha256 = "sha256-v4OdZmUI2LCick4qCSGOHJ7jtWybwKTeTeIcly+QQQQ=";
+    hash = "sha256-5xL3gfEohDjnF085Pgx/PBXWWM76X4FU2KR+8OGshMw=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -30,6 +31,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     setuptools
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
   ];
 
   checkInputs = [
@@ -37,11 +40,14 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  pythonImportsCheck = [
+    "humanize"
+  ];
+
   meta = with lib; {
     description = "Python humanize utilities";
-    homepage = "https://github.com/jmoiron/humanize";
+    homepage = "https://github.com/python-humanize/humanize";
     license = licenses.mit;
     maintainers = with maintainers; [ rmcgibbo ];
   };
-
 }
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 7bbfbdb27d3b2..ef88131bea6a3 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.18.3";
+  version = "0.18.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-aNlPOgUChLFkPPZtb3o4A49uoSBjxKaq3WtuupHlmi8=";
+    sha256 = "sha256-a4mbkwjdLOnoxe4Cj43IXGALqbTKqinoJAiPWfc79/8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index fde916994a41e..26126e92b97e9 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.3.5";
+  version = "0.3.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,8 +17,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "Reticulum";
-    rev = version;
-    hash = "sha256-LzrI5pJ3mLaxikqS1eWFvdgneoCnsRTYWbshVX7U8lg=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-awVUE5sViaGBne82oAxGeabZSnLn/dzBQTwP7xRdYKE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/urlextract/default.nix b/pkgs/development/python-modules/urlextract/default.nix
index 8d2c62de4e83a..ce520ba1cca3c 100644
--- a/pkgs/development/python-modules/urlextract/default.nix
+++ b/pkgs/development/python-modules/urlextract/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "urlextract";
-  version = "1.5.0";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-QKXIQ9HXJTdY9W8NZ0jF6iekoUVl46kvJakW3cTB5B8=";
+    hash = "sha256-V08NjFYtN3M2pRVIQMfk7s9UwQKlOJcciX9zEwdaiIc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/xknx/default.nix b/pkgs/development/python-modules/xknx/default.nix
index 315ba9416d540..87a0fd54d2d90 100644
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "xknx";
-  version = "0.21.2";
+  version = "0.21.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "XKNX";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-GEjrqqmlGA6wG5x89AZXd8FLvrKEzCLmVhhZ7FxDB+w=";
+    sha256 = "sha256-AGKozbVdXfRPvaU1Et8GFu3vdNRLA8ZiV8Xc6T7BhOQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/web/nodejs/v14.nix b/pkgs/development/web/nodejs/v14.nix
index d2f6349894708..7cae7dd557a21 100644
--- a/pkgs/development/web/nodejs/v14.nix
+++ b/pkgs/development/web/nodejs/v14.nix
@@ -7,7 +7,7 @@ let
 in
   buildNodejs {
     inherit enableNpm;
-    version = "14.19.2";
-    sha256 = "sha256-70N1qRUv9p8oI9eyCjtTdnoEYWS7rHgkQpyyFtFojPA=";
+    version = "14.19.3";
+    sha256 = "sha256-XPRbHxrKd1I6zzYkDB1TqZknkHCncR6r8jNG+IsMyZQ=";
     patches = lib.optional stdenv.isDarwin ./bypass-xcodebuild.diff;
   }
diff --git a/pkgs/development/web/nodejs/v17.nix b/pkgs/development/web/nodejs/v17.nix
deleted file mode 100644
index 3fbaf223f303f..0000000000000
--- a/pkgs/development/web/nodejs/v17.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ callPackage, python3, enableNpm ? true }:
-
-let
-  buildNodejs = callPackage ./nodejs.nix {
-    python = python3;
-  };
-in
-buildNodejs {
-  inherit enableNpm;
-  version = "17.9.0";
-  sha256 = "1q1rr9kvlk9rd35x3x206iy894hq2ywyhqxbb6grak6wcvdgcnan";
-  patches = [
-    ./disable-darwin-v8-system-instrumentation.patch
-  ];
-}
diff --git a/pkgs/development/web/nodejs/v18.nix b/pkgs/development/web/nodejs/v18.nix
index 6a55c20b195bc..b0a9924cd82f6 100644
--- a/pkgs/development/web/nodejs/v18.nix
+++ b/pkgs/development/web/nodejs/v18.nix
@@ -7,8 +7,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "18.1.0";
-  sha256 = "0zhb61ihzslmpl1g3dd6vcxjccc8gwj1v4hfphk7f3cy10hcrc78";
+  version = "18.2.0";
+  sha256 = "sha256-IwWxXr9VR0dOkFtQAvm6mcfu7wHXOU3+bzhGzGvK1m0=";
   patches = [
     ./disable-darwin-v8-system-instrumentation.patch
   ];
diff --git a/pkgs/servers/computing/storm/default.nix b/pkgs/servers/computing/storm/default.nix
index cf6427c860cf9..53644d62e65b5 100644
--- a/pkgs/servers/computing/storm/default.nix
+++ b/pkgs/servers/computing/storm/default.nix
@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-storm";
-  version = "2.3.0";
+  version = "2.4.0";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://apache/storm/${name}/${name}.tar.gz";
-    sha256 = "sha256-ScIlWyZjPG/ZY5nFIDOeRZ/NopoOfm0Mh3XO/P9sNjY=";
+    sha256 = "sha256-VFNcaISPBRMGR5l/P6/pGnK7lHClDW2AmXJ00gzxwMY=";
   };
 
   nativeBuildInputs = [ zip unzip ];
diff --git a/pkgs/servers/monitoring/prometheus/default.nix b/pkgs/servers/monitoring/prometheus/default.nix
index 62cb43abefaf2..4b79103d7d503 100644
--- a/pkgs/servers/monitoring/prometheus/default.nix
+++ b/pkgs/servers/monitoring/prometheus/default.nix
@@ -55,6 +55,7 @@ buildGoModule rec {
 
     # Enable only select service discovery to shrink binaries.
     (
+      true  # prevent bash syntax error when all plugins are disabled
     ${lib.optionalString (enableAWS)
       "echo - github.com/prometheus/prometheus/discovery/aws"}
     ${lib.optionalString (enableAzure)
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index e71fb9db115ed..5b88481d1d292 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -54,6 +54,12 @@ in {
     version = "23.0.4";
     sha256 = "67191c2b8b41591ae42accfb32216313fde0e107201682cb39029f890712bc6a";
   };
+
+  nextcloud24 = generic {
+    version = "24.0.0";
+    sha256 = "176cb5620f20465fb4759bdf3caaebeb7acff39d6c8630351af9f8738c173780";
+  };
+
   # tip: get she sha with:
   # curl 'https://download.nextcloud.com/server/releases/nextcloud-${version}.tar.bz2.sha256'
 }
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index 66b99c79453d8..f769850224b8a 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -1,23 +1,28 @@
 { lib
+, stdenv
 , buildGoModule
 , fetchFromGitHub
+, CoreFoundation
+, Security
 }:
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.27.1";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-eyvxBpGuOXicuqINYhl4/fUgN/j+Awe5vgMaMxtAMr0=";
+    sha256 = "sha256-zyTUGAxUAfrigRNiw03ZXFK+UkpuxwuU2xviZmAPuR8=";
   };
-
-  vendorSha256 = "sha256-91tq4ipi3JobVgffASn8KRd3JQkgbOx/7PsjKq5vJdE=";
+  vendorSha256 = "sha256-dgiKWHSm49/CB4dWrNWIzkkmj6Aw4l+9iLa6xe/umq0=";
 
   excludedPackages = "misc";
 
+  buildInputs = lib.optionals (stdenv.isDarwin && stdenv.isx86_64)
+    [ CoreFoundation Security ];
+
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index f9e5340802eda..9d68d4fa272c1 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -23,9 +23,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ acl attr e2fsprogs libuuid lzo python3 zlib zstd ] ++ lib.optionals stdenv.hostPlatform.isGnu [ udev ];
 
-  # for python cross-compiling
-  _PYTHON_HOST_PLATFORM = stdenv.hostPlatform.config;
-
   # gcc bug with -O1 on ARM with gcc 4.8
   # This should be fine on all platforms so apply universally
   postPatch = "sed -i s/-O1/-O2/ configure";
@@ -38,6 +35,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = lib.optionals stdenv.hostPlatform.isGnu [ "udevruledir=$(out)/lib/udev/rules.d" ];
 
+  installFlags = [ "install_python" ];
+
   enableParallelBuilding = true;
 
   passthru.tests = {
diff --git a/pkgs/tools/networking/argus-clients/default.nix b/pkgs/tools/networking/argus-clients/default.nix
index cd935a5f5d7d7..30367eb14e454 100644
--- a/pkgs/tools/networking/argus-clients/default.nix
+++ b/pkgs/tools/networking/argus-clients/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "argus-clients";
-  version = "3.0.8.2";
+  version = "3.0.8.3";
 
   src = fetchurl {
     url = "http://qosient.com/argus/src/${pname}-${version}.tar.gz";
-    sha256 = "1c9vj6ma00gqq9h92fg71sxcsjzz912166sdg90ahvnmvmh3l1rj";
+    sha256 = "sha256-uNTvi6zbrYHAivQMPkhlNCoqRW9GOkgKvCf3mInds80=";
   };
 
   NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
diff --git a/pkgs/tools/networking/proxychains-ng/default.nix b/pkgs/tools/networking/proxychains-ng/default.nix
index 35a6c7d7f8753..12b3932b8f990 100644
--- a/pkgs/tools/networking/proxychains-ng/default.nix
+++ b/pkgs/tools/networking/proxychains-ng/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
@@ -14,6 +15,28 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-uu/zN6W0ue526/3a9QeYg6J4HLaovZJVOYXksjouYok=";
   };
 
+  patches = [
+    # zsh completion
+    (fetchpatch {
+      url = "https://github.com/rofl0r/proxychains-ng/commit/04023d3811d8ee34b498b429bac7a871045de59c.patch";
+      sha256 = "sha256-Xcg2kmAhj/OJn/RKJAxb9MOJNJQY7FXmxEIzQ5dvabo=";
+    })
+    (fetchpatch {
+      url = "https://github.com/rofl0r/proxychains-ng/commit/9b42da71f4df7b783cf07a58ffa095e293c43380.patch";
+      sha256 = "sha256-tYv9XP51WtsjaoklwQk3D/MQceoOvtdMwBraECt6AXQ=";
+    })
+  ];
+
+  installFlags = [
+    "install-config"
+    # TODO: check on next update if that works and remove postInstall
+    # "install-zsh-completion"
+  ];
+
+  postInstall = ''
+    ./tools/install.sh -D -m 644 completions/_proxychains $out/share/zsh/site_functions/_proxychains4
+  '';
+
   meta = with lib; {
     description = "A preloader which hooks calls to sockets in dynamically linked programs and redirects it through one or more socks/http proxies";
     homepage = "https://github.com/rofl0r/proxychains-ng";
diff --git a/pkgs/tools/networking/proxychains/default.nix b/pkgs/tools/networking/proxychains/default.nix
index b93c6ae12cfbc..df692f372c87a 100644
--- a/pkgs/tools/networking/proxychains/default.nix
+++ b/pkgs/tools/networking/proxychains/default.nix
@@ -19,6 +19,10 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace "-Werror" "-Werror -Wno-stringop-truncation"
   '';
 
+  installFlags = [
+    "install-config"
+  ];
+
   meta = with lib; {
     description = "Proxifier for SOCKS proxies";
     homepage = "http://proxychains.sourceforge.net";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3248f770f330f..152cb37f282ef 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5438,6 +5438,7 @@ with pkgs;
 
   trivy = callPackage ../tools/admin/trivy {
     buildGoModule = buildGo118Module;
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
 
   trompeloeil = callPackage ../development/libraries/trompeloeil { };
@@ -7822,10 +7823,6 @@ with pkgs;
   nodejs-slim-16_x = callPackage ../development/web/nodejs/v16.nix {
     enableNpm = false;
   };
-  nodejs-17_x = callPackage ../development/web/nodejs/v17.nix { };
-  nodejs-slim-17_x = callPackage ../development/web/nodejs/v17.nix {
-    enableNpm = false;
-  };
   nodejs-18_x = callPackage ../development/web/nodejs/v18.nix { };
   nodejs-slim-18_x = callPackage ../development/web/nodejs/v18.nix {
     enableNpm = false;
@@ -8588,7 +8585,7 @@ with pkgs;
   grocy = callPackage ../servers/grocy { };
 
   inherit (callPackage ../servers/nextcloud {})
-    nextcloud21 nextcloud22 nextcloud23;
+    nextcloud21 nextcloud22 nextcloud23 nextcloud24;
 
   nextcloud-client = libsForQt5.callPackage ../applications/networking/nextcloud-client { };
 
@@ -29856,7 +29853,9 @@ with pkgs;
 
   tempo = callPackage ../servers/tracing/tempo {};
 
-  temporal = callPackage ../applications/networking/cluster/temporal { };
+  temporal = callPackage ../applications/networking/cluster/temporal {
+    buildGoModule = buildGo118Module;
+  };
 
   tenacity = callPackage ../applications/audio/tenacity { wxGTK = wxGTK31-gtk3; };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3f538812767dc..0ed03be8d5e1f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1405,6 +1405,8 @@ in {
 
   btrfs = callPackage ../development/python-modules/btrfs { };
 
+  btrfsutil = toPythonModule (pkgs.btrfs-progs.override { python3 = self.python; });
+
   bugsnag = callPackage ../development/python-modules/bugsnag { };
 
   bugwarrior = callPackage ../development/python-modules/bugwarrior { };