Merge staging-next into staging

96 files changed, 757 insertions, 299 deletions

diff --git a/pkgs/applications/audio/lsp-plugins/default.nix b/pkgs/applications/audio/lsp-plugins/default.nix
index e6db737c4016f..c3df2ecd30d4e 100644
--- a/pkgs/applications/audio/lsp-plugins/default.nix
+++ b/pkgs/applications/audio/lsp-plugins/default.nix
@@ -5,20 +5,12 @@
 
 stdenv.mkDerivation rec {
   pname = "lsp-plugins";
-  version = "1.2.13";
+  version = "1.2.14";
 
   src = fetchurl {
     url = "https://github.com/sadko4u/${pname}/releases/download/${version}/${pname}-src-${version}.tar.gz";
-    sha256 = "sha256-eJO+1fCNzqjTdGrPlhIrHc3UimkJOydRqTq49IN+Iwo=";
+    sha256 = "sha256-GjNZ7ouKgpcb1+nuq+Q/WM5rSkeT2F+xb5exAOTt7po=";
   };
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/lsp-plugins/lsp-dsp-lib/commit/58c3f985f009c84347fa91236f164a9e47aafa93.patch";
-      stripLen = 1;
-      extraPrefix = "modules/lsp-dsp-lib/";
-      hash = "sha256-pCLucLijXOgp69xNjSRCRxgVoQziT0YiHLnQGbkefqE=";
-    })
-  ];
 
   outputs = [ "out" "dev" "doc" ];
 
diff --git a/pkgs/applications/blockchains/bitcoin/default.nix b/pkgs/applications/blockchains/bitcoin/default.nix
index 83c1f35c5fbdc..f31fea1527105 100644
--- a/pkgs/applications/blockchains/bitcoin/default.nix
+++ b/pkgs/applications/blockchains/bitcoin/default.nix
@@ -33,14 +33,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = if withGui then "bitcoin" else "bitcoind";
-  version = "25.1";
+  version = "26.0";
 
   src = fetchurl {
     urls = [
       "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
     ];
     # hash retrieved from signed SHA256SUMS
-    sha256 = "bec2a598d8dfa8c2365b77f13012a733ec84b8c30386343b7ac1996e901198c9";
+    sha256 = "ab1d99276e28db62d1d9f3901e85ac358d7f1ebcb942d348a9c4e46f0fcdc0a1";
   };
 
   nativeBuildInputs =
@@ -55,9 +55,9 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withGui [ qrencode qtbase qttools ];
 
   postInstall = ''
-    installShellCompletion --cmd bitcoin-cli --bash contrib/completions/bash/bitcoin-cli.bash-completion
-    installShellCompletion --cmd bitcoind --bash contrib/completions/bash/bitcoind.bash-completion
-    installShellCompletion --cmd bitcoin-tx --bash contrib/completions/bash/bitcoin-tx.bash-completion
+    installShellCompletion --bash contrib/completions/bash/bitcoin-cli.bash
+    installShellCompletion --bash contrib/completions/bash/bitcoind.bash
+    installShellCompletion --bash contrib/completions/bash/bitcoin-tx.bash
 
     installShellCompletion --fish contrib/completions/fish/bitcoin-cli.fish
     installShellCompletion --fish contrib/completions/fish/bitcoind.fish
diff --git a/pkgs/applications/editors/neovim/neovide/default.nix b/pkgs/applications/editors/neovim/neovide/default.nix
index ccd7d754e44c7..6840ac60919c1 100644
--- a/pkgs/applications/editors/neovim/neovide/default.nix
+++ b/pkgs/applications/editors/neovim/neovide/default.nix
@@ -25,16 +25,16 @@
 
 rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
   pname = "neovide";
-  version = "0.11.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "neovide";
     repo = "neovide";
     rev = version;
-    sha256 = "sha256-JCSFG7W4I1uXsVM7J059tHYq/DB16AZfGjsG0UvfctE=";
+    sha256 = "sha256-m3ZdzdmkW69j1sZ9h7M1m5fDNnJ7BM7nwYPx7QhsIso=";
   };
 
-  cargoSha256 = "sha256-rH4jjbd0C1MKu3RE0bLvLo4iqyUXr0DvCudvFs1F+AA=";
+  cargoSha256 = "sha256-AAHMx4xxbC/JdmAPE2bub7qdF5sFNWjqXI1nuCUxsZA=";
 
   SKIA_SOURCE_DIR =
     let
@@ -42,8 +42,8 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
         owner = "rust-skia";
         repo = "skia";
         # see rust-skia:skia-bindings/Cargo.toml#package.metadata skia
-        rev = "m113-0.61.8";
-        sha256 = "sha256-xGfkc1JLBGQW4WcblFyluZ2paEuisCVPNDU4Rfkv3BE=";
+        rev = "m119-0.67.3";
+        sha256 = "sha256-U75NuJnQa5+SNlOrsBmdlvflGdjo3el63EeIsbnE7ms=";
       };
       # The externals for skia are taken from skia/DEPS
       externals = linkFarm "skia-externals" (lib.mapAttrsToList
@@ -116,5 +116,7 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
     changelog = "https://github.com/neovide/neovide/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ ck3d multisn8 ];
+    platforms = platforms.all;
+    badPlatforms = platforms.darwin;
   };
 }
diff --git a/pkgs/applications/editors/neovim/neovide/skia-externals.json b/pkgs/applications/editors/neovim/neovide/skia-externals.json
index 82730f5458a3c..e57814e2a2d87 100644
--- a/pkgs/applications/editors/neovim/neovide/skia-externals.json
+++ b/pkgs/applications/editors/neovim/neovide/skia-externals.json
@@ -6,8 +6,8 @@
   },
   "libjpeg-turbo": {
     "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git",
-    "rev": "22f1a22c99e9dde8cd3c72ead333f425c5a7aa77",
-    "sha256": "sha256-5MaYvyrhADFGKBxcS3kbKcn9tj0FNXAN/rAXXYW6ljs="
+    "rev": "ed683925e4897a84b3bffc5c1414c85b97a129a3",
+    "sha256": "sha256-DYJP3phe4OzCtRN2pMc07ITTWR8MuIlOWWg9PBsQAVw="
   },
   "icu": {
     "url": "https://chromium.googlesource.com/chromium/deps/icu.git",
@@ -21,13 +21,13 @@
   },
   "harfbuzz": {
     "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-    "rev": "09a266236147497bd8149240062c31c16fbc81e3",
-    "sha256": "sha256-NLydUJI15zRBFFDc7VRDXjgc0AwS3l6GMt2usMWOSG4="
+    "rev": "4cfc6d8e173e800df086d7be078da2e8c5cfca19",
+    "sha256": "sha256-rrstyAz7Eb8ZgFJZKUASY8nU4YFZAptd5VS9B2cs2Yg="
   },
   "wuffs": {
     "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
-    "rev": "a0041ac0310b3156b963e2f2bea09245f25ec073",
-    "sha256": "sha256-obRMrrKY3rPdFwQNa5IplpuKqiodHvRC8jbIOjp7R2w="
+    "rev": "e3f919ccfe3ef542cfc983a82146070258fb57f8",
+    "sha256": "sha256-373d2F/STcgCHEq+PO+SCHrKVOo6uO1rqqwRN5eeBCw="
   },
   "libpng": {
     "url": "https://skia.googlesource.com/third_party/libpng.git",
diff --git a/pkgs/applications/emulators/sameboy/default.nix b/pkgs/applications/emulators/sameboy/default.nix
index 0353518855684..9d0eb1570287f 100644
--- a/pkgs/applications/emulators/sameboy/default.nix
+++ b/pkgs/applications/emulators/sameboy/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sameboy";
-  version = "0.15.8";
+  version = "0.16";
 
   src = fetchFromGitHub {
     owner = "LIJI32";
     repo = "SameBoy";
     rev = "v${version}";
-    sha256 = "sha256-SBK+aYekEJreD0XBvYaU12eIKmm9JNYIpPt1XhUtH4c=";
+    sha256 = "sha256-sQVTCHOSc2N+Qs/rl0DfsUzg7P5Egws2UuNBQ9fpkoQ=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/emulators/xemu/default.nix b/pkgs/applications/emulators/xemu/default.nix
index e0e022ebb4023..3fc8adde9b675 100644
--- a/pkgs/applications/emulators/xemu/default.nix
+++ b/pkgs/applications/emulators/xemu/default.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xemu";
-  version = "0.7.117";
+  version = "0.7.118";
 
   src = fetchFromGitHub {
     owner = "xemu-project";
     repo = "xemu";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-R6BPDBMrVhxUkjMWK8Jz9vqEz5P3v62PIyulHp6Q+KM=";
+    hash = "sha256-IGzPxwNxuqMsZhQ63VUyDzPSBpAgc0U0oUjM/blEd7g=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index 4c727ce140480..c10bd88f4d767 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.270";
+  version = "1.2.275";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    hash = "sha256-8AF+D/kbRkalUOQmpGamyhq5LEu1Uyxj6NuzWviDKRM=";
+    hash = "sha256-8WMkarh/5ylCz1IqyLefivjvCBAl15TvT6TLqBmG7Hs=";
   };
 
-  vendorHash = "sha256-20bPsBRya7Gg7p/hSSnnYLoSHf/fRwk1UrA/KlMT3Jk=";
+  vendorHash = "sha256-LXjGqI9cowou5ZHVRldwCD1vOzwCyU269TkTflIkdAc=";
 
   proxyVendor = true;
 
diff --git a/pkgs/applications/networking/cluster/yor/default.nix b/pkgs/applications/networking/cluster/yor/default.nix
index 9177ed8110dae..ea89d83f6bf76 100644
--- a/pkgs/applications/networking/cluster/yor/default.nix
+++ b/pkgs/applications/networking/cluster/yor/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "yor";
-  version = "0.1.185";
+  version = "0.1.187";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-5CBOLbqsEVzYyU67c7QTGTe471XQlEC/826wYCPHzEo=";
+    hash = "sha256-w82kJhMnupVv4eq3SUDFaWSvkVrxOSPsN+OXl8aIKog=";
   };
 
   vendorHash = "sha256-ZeTjGmlu8LndD2DKNncPzlpECdvkOjfwaVvV6S3sL9E=";
diff --git a/pkgs/applications/networking/instant-messengers/abaddon/default.nix b/pkgs/applications/networking/instant-messengers/abaddon/default.nix
index 7e47b6fe698b5..3dbab9211dfa8 100644
--- a/pkgs/applications/networking/instant-messengers/abaddon/default.nix
+++ b/pkgs/applications/networking/instant-messengers/abaddon/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "abaddon";
-  version = "0.1.13";
+  version = "0.1.14";
 
   src = fetchFromGitHub {
     owner = "uowuo";
     repo = "abaddon";
     rev = "v${version}";
-    hash = "sha256-2iozeRuY/+JDnaHfAYiXNS1VgSrHAxXPuI8BevEEKTc=";
+    hash = "sha256-Amp6PkQWd4PnwUL29fzGETLuQXVEaARr+jIRlfrxTKc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/wgcf/default.nix b/pkgs/applications/networking/wgcf/default.nix
index a975f1c26cefc..a6f728c1bf37c 100644
--- a/pkgs/applications/networking/wgcf/default.nix
+++ b/pkgs/applications/networking/wgcf/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "wgcf";
-  version = "2.2.19";
+  version = "2.2.20";
 
   src = fetchFromGitHub {
     owner = "ViRb3";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-wEBPaqqpiQdFohlzpVDVMwYq8+NjSQrh58yWl/W+n8M=";
+    hash = "sha256-k4oOejJiVZk9s4niG/r0mSoI363uuQh3C9OWVweELWc=";
   };
 
   subPackages = ".";
 
-  vendorHash = "sha256-i1CM0rG2DmgYMa+Na0In4fVJSGZlMTRajjLEZUvrmE8=";
+  vendorHash = "sha256-U1VHbD2l5C5ws7Mt5a7PmtHQkZJ6hzDU1TyiEFqMYEM=";
 
   meta = with lib; {
     description = "Cross-platform, unofficial CLI for Cloudflare Warp";
diff --git a/pkgs/applications/science/chemistry/gwyddion/default.nix b/pkgs/applications/science/chemistry/gwyddion/default.nix
index 59ff285c15370..5794d7077af96 100644
--- a/pkgs/applications/science/chemistry/gwyddion/default.nix
+++ b/pkgs/applications/science/chemistry/gwyddion/default.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2;
     platforms = with lib.platforms; linux ++ darwin;
     maintainers = [ lib.maintainers.cge ];
-    broken = true; # Build error: h5py-3.9.0 not supported for interpreter python2.7
+    # never built on aarch64-darwin since first introduction in nixpkgs
+    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }
diff --git a/pkgs/applications/science/molecular-dynamics/lammps/default.nix b/pkgs/applications/science/molecular-dynamics/lammps/default.nix
index feb7a98bd59db..a6dc8592ae3cc 100644
--- a/pkgs/applications/science/molecular-dynamics/lammps/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/lammps/default.nix
@@ -108,8 +108,8 @@ stdenv.mkDerivation (finalAttrs: {
       funding from the DOE. It is an open-source code, distributed freely
       under the terms of the GNU Public License (GPL).
       '';
-    homepage = "https://lammps.sandia.gov";
-    license = licenses.gpl2Plus;
+    homepage = "https://www.lammps.org";
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
     # compiling lammps with 64 bit support blas and lapack might cause runtime
     # segfaults. In anycase both blas and lapack should have the same #bits
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/plugins.nix b/pkgs/applications/window-managers/hyprwm/hyprland/plugins.nix
new file mode 100644
index 0000000000000..f8742673f3d70
--- /dev/null
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/plugins.nix
@@ -0,0 +1,51 @@
+{ lib
+, callPackage
+, pkg-config
+, gcc13Stdenv
+, hyprland
+}:
+let
+  mkHyprlandPlugin =
+    args@{ pluginName, ... }:
+    gcc13Stdenv.mkDerivation (args // {
+      pname = "${pluginName}";
+      nativeBuildInputs = [ pkg-config ] ++ args.nativeBuildInputs or [ ];
+      buildInputs = [ hyprland ]
+        ++ hyprland.buildInputs
+        ++ (args.buildInputs or [ ]);
+      meta = args.meta // {
+        description = (args.meta.description or "");
+        longDescription = (args.meta.lonqDescription or "") +
+          "\n\nPlugins can be installed via a plugin entry in the Hyprland NixOS or Home Manager options.";
+      };
+    });
+
+  plugins = {
+    hy3 = { fetchFromGitHub, cmake, hyprland }:
+      mkHyprlandPlugin rec {
+        pluginName = "hy3";
+        version = "0.32.0";
+
+        src = fetchFromGitHub {
+          owner = "outfoxxed";
+          repo = "hy3";
+          rev = "hl${version}";
+          hash = "sha256-j49bEOLjBa1CH2gTwM+A2Edrw/GspE2m8q1teAn6SuQ=";
+        };
+
+        nativeBuildInputs = [ cmake ];
+
+        dontStrip = true;
+
+        meta = with lib; {
+          homepage = "https://github.com/outfoxxed/hy3";
+          description = "Hyprland plugin for an i3 / sway like manual tiling layout";
+          license = licenses.gpl3;
+          platforms = platforms.linux;
+          maintainers = [ maintainers.aacebedo ];
+        };
+      };
+  };
+in
+lib.mapAttrs (name: plugin: callPackage plugin { }) plugins
+
diff --git a/pkgs/build-support/dart/fetch-dart-deps/default.nix b/pkgs/build-support/dart/fetch-dart-deps/default.nix
index e6e5cf76a60f8..29e5209a2877b 100644
--- a/pkgs/build-support/dart/fetch-dart-deps/default.nix
+++ b/pkgs/build-support/dart/fetch-dart-deps/default.nix
@@ -178,7 +178,11 @@ let
 
     buildPhase = ''
       runHook preBuild
-      dart pub deps --json | jq .packages > $out
+      if [ -e ${dart}/bin/flutter ]; then
+        flutter pub deps --json | jq .packages > $out
+      else
+        dart pub deps --json | jq .packages > $out
+      fi
       runHook postBuild
     '';
 
diff --git a/pkgs/by-name/c2/c2fmzq/package.nix b/pkgs/by-name/c2/c2fmzq/package.nix
index 414564f65e0cb..36cc9518514dc 100644
--- a/pkgs/by-name/c2/c2fmzq/package.nix
+++ b/pkgs/by-name/c2/c2fmzq/package.nix
@@ -6,20 +6,20 @@
 
 buildGoModule rec {
   pname = "c2FmZQ";
-  version = "0.4.15";
+  version = "0.4.16";
 
   src = fetchFromGitHub {
     owner = "c2FmZQ";
     repo = "c2FmZQ";
     rev = "v${version}";
-    hash = "sha256-xQOzuJfGmnmOJqHCm5xUNuLHQO4UVRMu1vABsuUbv60=";
+    hash = "sha256-DJvcWUPIEu3zCVIVB/mUBqbOzHwUI+01gMQUdYk4qm4=";
   };
 
   ldflags = [ "-s" "-w" ];
 
   sourceRoot = "source/c2FmZQ";
 
-  vendorHash = "sha256-aG1YPg8jeBJShICujUgrcvgAlb7ySdwjc+x6jEUYHXA=";
+  vendorHash = "sha256-lnoEh6etfVLx+GYWNCvra40qOYtzTIH3SC28T6mXC2U=";
 
   subPackages = [ "c2FmZQ-client" "c2FmZQ-server" ];
 
diff --git a/pkgs/by-name/ca/cargo-xwin/package.nix b/pkgs/by-name/ca/cargo-xwin/package.nix
index 6052d780ced3b..274ab5ef77ecd 100644
--- a/pkgs/by-name/ca/cargo-xwin/package.nix
+++ b/pkgs/by-name/ca/cargo-xwin/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-xwin";
-  version = "0.16.2";
+  version = "0.16.3";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-xwin";
     rev = "v${version}";
-    hash = "sha256-EZM1TeWUnoRcsF6m6mDNCoUR2WWe7ohqT3wNWnq0kQY=";
+    hash = "sha256-3i/XlCuHjVBSH4XZR5M457H+kheKZoJXlwqRwPhSnCM=";
   };
 
-  cargoHash = "sha256-MEBMXP7a/w2aN6RuWrm16PsnIPw6+8k5jI2yRnwBy0s=";
+  cargoHash = "sha256-yKoUcrAZy66qahDvRgOnbJmXuUXDjDBTGt2p5gXjVyI=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/by-name/hu/hugo/package.nix
index a593ecdb1ad08..3c2cce32fb2c3 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@@ -14,7 +14,7 @@ buildGoModule rec {
 
   src = fetchFromGitHub {
     owner = "gohugoio";
-    repo = pname;
+    repo = "hugo";
     rev = "refs/tags/v${version}";
     hash = "sha256-XNOp0k2t5Tv4HKKz3ZqL/sAdiYedOACaZ/1T7t7/Q1A=";
   };
@@ -48,10 +48,12 @@ buildGoModule rec {
     version = "v${version}";
   };
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/gohugoio/hugo/releases/tag/v${version}";
     description = "A fast and modern static website engine";
     homepage = "https://gohugo.io";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ schneefux Br1ght0ne Frostman ];
+    license = lib.licenses.asl20;
+    mainProgram = "hugo";
+    maintainers = with lib.maintainers; [ schneefux Br1ght0ne Frostman ];
   };
 }
diff --git a/pkgs/by-name/in/incus-unwrapped/package.nix b/pkgs/by-name/in/incus-unwrapped/package.nix
index 907b8ce291973..43bf65bef83e7 100644
--- a/pkgs/by-name/in/incus-unwrapped/package.nix
+++ b/pkgs/by-name/in/incus-unwrapped/package.nix
@@ -16,16 +16,16 @@
 
 buildGoModule rec {
   pname = "incus-unwrapped";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "incus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-oPBrIN4XUc9GnBszEWAAnEcNahV4hfB48XSKvkpq5Kk=";
+    hash = "sha256-crWepf5j3Gd1lhya2DGIh/to7l+AnjKJPR+qUd9WOzw=";
   };
 
-  vendorHash = "sha256-TwrHWjBd6Hn7CQMxFhHobopeefCvYeDz8fAPYmTKV9M=";
+  vendorHash = "sha256-YfUvkN1qUS3FFKb1wysg40WcJA8fT9SGDChSdT+xnkc=";
 
   postPatch = ''
     substituteInPlace internal/usbid/load.go \
diff --git a/pkgs/by-name/ja/jazz2/package.nix b/pkgs/by-name/ja/jazz2/package.nix
index c90365bac287d..44a039e400299 100644
--- a/pkgs/by-name/ja/jazz2/package.nix
+++ b/pkgs/by-name/ja/jazz2/package.nix
@@ -16,13 +16,13 @@
 assert lib.assertOneOf "graphicsLibrary" graphicsLibrary [ "SDL2" "GLFW" ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "jazz2";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "deathkiller";
     repo = "jazz2-native";
     rev = finalAttrs.version;
-    hash = "sha256-oBDBq2SToab94mK0kIB0H53jJMFZrHvsdPmfAd5ZjCY=";
+    hash = "sha256-Rv+fU2SGxdmxfDANX+HpZDZBm9HYzSvAQDqPSQ8WJps=";
   };
 
   patches = [ ./nocontent.patch ];
diff --git a/pkgs/by-name/le/legba/package.nix b/pkgs/by-name/le/legba/package.nix
index fcb3bea4a7b30..c4f52fcc0902c 100644
--- a/pkgs/by-name/le/legba/package.nix
+++ b/pkgs/by-name/le/legba/package.nix
@@ -4,23 +4,24 @@
 , cmake
 , pkg-config
 , openssl
+, samba
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "legba";
-  version = "0.6.1";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "evilsocket";
     repo = "legba";
     rev = "v${version}";
-    hash = "sha256-/ASjvlsPQAPNZpzdTTyZYrcYImV2GS+SSfhSQP0K2n0=";
+    hash = "sha256-7HDW5M0lsKbcQw3p/CYmUeX2xE4BZXUSNqa9Ab/ZP0I=";
   };
 
-  cargoHash = "sha256-QgnJ/oUpW4o2Hi2+xKfprxjCw4sho8kIyW+AUJ9pwuU=";
+  cargoHash = "sha256-rkqwc8BILW/OIHa95skkG4IDlBfH3qX1ROJgcn8f2W0=";
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ openssl.dev ];
+  buildInputs = [ openssl.dev samba ];
 
   # Paho C test fails due to permission issue
   doCheck = false;
diff --git a/pkgs/by-name/lx/lxd-to-incus/package.nix b/pkgs/by-name/lx/lxd-to-incus/package.nix
index c08dda5a4d861..b9c15347d3ba3 100644
--- a/pkgs/by-name/lx/lxd-to-incus/package.nix
+++ b/pkgs/by-name/lx/lxd-to-incus/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "lxd-to-incus";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "incus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-oPBrIN4XUc9GnBszEWAAnEcNahV4hfB48XSKvkpq5Kk=";
+    hash = "sha256-crWepf5j3Gd1lhya2DGIh/to7l+AnjKJPR+qUd9WOzw=";
   };
 
   modRoot = "cmd/lxd-to-incus";
 
-  vendorHash = "sha256-/ONflpW1HGvXooPF+Xui8q4xFu/Zq5br+Vjm9d2gm5U=";
+  vendorHash = "sha256-cBAqJz3Y4CqyxTt7u/4mXoQPKmKgQ3gYJV1NiC/H+TA=";
 
   CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/py/pyprland/package.nix b/pkgs/by-name/py/pyprland/package.nix
index 51bf396095902..fd0b5583b36ed 100644
--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyprland";
-  version = "1.6.0";
+  version = "1.6.9";
   format = "pyproject";
 
   disabled = python3Packages.pythonOlder "3.10";
@@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
     owner = "hyprland-community";
     repo = "pyprland";
     rev = version;
-    hash = "sha256-QbbBpaBIlU4IoU/NM7igDap8TxOKePQ8JI3ZlH944Bs=";
+    hash = "sha256-qmITBg9csfCIcyTADUOfEo/Nrou01bXHORQ66+Jvodo=";
   };
 
   nativeBuildInputs = with python3Packages; [ poetry-core ];
diff --git a/pkgs/by-name/vi/vieb/package.nix b/pkgs/by-name/vi/vieb/package.nix
index 8d3b3de6a124f..0c8afad3fb005 100644
--- a/pkgs/by-name/vi/vieb/package.nix
+++ b/pkgs/by-name/vi/vieb/package.nix
@@ -2,20 +2,20 @@
 
 buildNpmPackage rec {
   pname = "vieb";
-  version = "10.6.0";
+  version = "11.0.0";
 
   src = fetchFromGitHub {
     owner = "Jelmerro";
     repo = pname;
     rev = version;
-    hash = "sha256-WVG30wkyGiqd3uEhk2h2MHu4L0yE6DRP6NAKMExjuOs=";
+    hash = "sha256-OBOxT2leZYD3td1+PJdLv7Nph/gY6U9tVC7b/fUmUJw=";
   };
 
   postPatch = ''
     sed -i '/"electron"/d' package.json
   '';
 
-  npmDepsHash = "sha256-kvC1+odojkSFWqcyNUg2SbeEn1EkA+EdfaVWY9QmPz4=";
+  npmDepsHash = "sha256-vgp20qVT4JZ7U24uu9ZPkveXchMNcdbljodALAMAu9s=";
   makeCacheWritable = true;
   dontNpmBuild = true;
 
diff --git a/pkgs/data/themes/where-is-my-sddm-theme/default.nix b/pkgs/data/themes/where-is-my-sddm-theme/default.nix
index 13ea576b3fbf8..64fc67b300268 100644
--- a/pkgs/data/themes/where-is-my-sddm-theme/default.nix
+++ b/pkgs/data/themes/where-is-my-sddm-theme/default.nix
@@ -23,13 +23,13 @@ in
 
 stdenvNoCC.mkDerivation rec {
   pname = "where-is-my-sddm-theme";
-  version = "1.5.1";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "stepanzubkov";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-T6b+rxjlxZCQ/KDaxBM8ZryA3n6a+3jo+J2nETBYslM=";
+    hash = "sha256-EK0bB2dRXNtDKFiyf+nMoDq9XK2f3PFwoNbQDZamB3Y=";
   };
 
   propagatedUserEnvPkgs = [ qtgraphicaleffects ];
diff --git a/pkgs/desktops/cinnamon/cinnamon-session/0002-Use-login-shell-for-wayland-session.patch b/pkgs/desktops/cinnamon/cinnamon-session/0002-Use-login-shell-for-wayland-session.patch
new file mode 100644
index 0000000000000..6c44f93d8f3c2
--- /dev/null
+++ b/pkgs/desktops/cinnamon/cinnamon-session/0002-Use-login-shell-for-wayland-session.patch
@@ -0,0 +1,76 @@
+From 174d14edcbb401aa2bfb77932b214512befb486c Mon Sep 17 00:00:00 2001
+From: Bobby Rong <rjl931189261@126.com>
+Date: Sat, 23 Dec 2023 23:24:59 +0800
+Subject: [PATCH] cinnamon-session: make sure wayland sessions get a login
+ shell
+
+Users expect their shell profiles to get sourced at startup, which
+doesn't happen with wayland sessions.
+
+This commit brings back that feature, by making the cinnamon-session
+wrapper script run a login shell.
+
+ref: https://gitlab.gnome.org/GNOME/gnome-session/-/commit/7e307f8ddb91db5d4051c4c792519a660ba67f35
+---
+ cinnamon-session/cinnamon-session.in | 16 ++++++++++++++++
+ cinnamon-session/meson.build         | 14 +++++++++++++-
+ 2 files changed, 29 insertions(+), 1 deletion(-)
+ create mode 100755 cinnamon-session/cinnamon-session.in
+
+diff --git a/cinnamon-session/cinnamon-session.in b/cinnamon-session/cinnamon-session.in
+new file mode 100755
+index 0000000..d9d7cb2
+--- /dev/null
++++ b/cinnamon-session/cinnamon-session.in
+@@ -0,0 +1,16 @@
++#!/bin/sh
++
++if [ "x$XDG_SESSION_TYPE" = "xwayland" ] &&
++   [ "x$XDG_SESSION_CLASS" != "xgreeter" ] &&
++   [  -n "$SHELL" ] &&
++   grep -q "$SHELL" /etc/shells &&
++   ! (echo "$SHELL" | grep -q "false") &&
++   ! (echo "$SHELL" | grep -q "nologin"); then
++  if [ "$1" != '-l' ]; then
++    exec bash -c "exec -l '$SHELL' -c '$0 -l $*'"
++  else
++    shift
++  fi
++fi
++
++exec @libexecdir@/cinnamon-session-binary "$@"
+diff --git a/cinnamon-session/meson.build b/cinnamon-session/meson.build
+index 10092ee..3d32fdc 100644
+--- a/cinnamon-session/meson.build
++++ b/cinnamon-session/meson.build
+@@ -54,7 +54,7 @@ cinnamon_session_sources = [
+ ]
+ 
+ dbus_glib = dependency('dbus-glib-1')
+-executable('cinnamon-session',
++executable('cinnamon-session-binary',
+   cinnamon_session_sources,
+   dependencies: [
+     cinnamon_desktop,
+@@ -76,6 +76,18 @@ executable('cinnamon-session',
+   ],
+   include_directories: [ rootInclude ],
+   install: true,
++  install_dir: get_option('libexecdir'),
++)
++
++script_conf = configuration_data()
++script_conf.set('libexecdir', get_option('prefix') / get_option('libexecdir'))
++
++configure_file(
++  input: 'cinnamon-session.in',
++  output: 'cinnamon-session',
++  install: true,
++  install_dir: get_option('bindir'),
++  configuration: script_conf
+ )
+ 
+ units = [
+-- 
+2.42.0
+
diff --git a/pkgs/desktops/cinnamon/cinnamon-session/default.nix b/pkgs/desktops/cinnamon/cinnamon-session/default.nix
index a6800f94737d5..a0dfab6503c2b 100644
--- a/pkgs/desktops/cinnamon/cinnamon-session/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-session/default.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./0001-Use-dbus_glib-instead-of-elogind.patch
+    ./0002-Use-login-shell-for-wayland-session.patch
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/gnome/core/gdm/default.nix b/pkgs/desktops/gnome/core/gdm/default.nix
index f44278f896c3c..25f9fe8c63401 100644
--- a/pkgs/desktops/gnome/core/gdm/default.nix
+++ b/pkgs/desktops/gnome/core/gdm/default.nix
@@ -5,7 +5,6 @@
 , substituteAll
 , meson
 , ninja
-, rsync
 , pkg-config
 , glib
 , itstool
@@ -70,7 +69,6 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    rsync
     gobject-introspection
   ];
 
@@ -131,33 +129,36 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   preInstall = ''
-    install -D ${override} $DESTDIR/$out/share/glib-2.0/schemas/org.gnome.login-screen.gschema.override
+    install -D ${override} "$DESTDIR/$out/share/glib-2.0/schemas/org.gnome.login-screen.gschema.override"
   '';
 
   postInstall = ''
     # Move stuff from DESTDIR to proper location.
-    # We use rsync to merge the directories.
-    rsync --archive "$DESTDIR/etc" "$out"
-    rm --recursive "$DESTDIR/etc"
     for o in $(getAllOutputNames); do
+        # debug is created later by _separateDebugInfo hook.
         if [[ "$o" = "debug" ]]; then continue; fi
-        rsync --archive "$DESTDIR/''${!o}" "$(dirname "''${!o}")"
-        rm --recursive "$DESTDIR/''${!o}"
+        mv "$DESTDIR''${!o}" "$(dirname "''${!o}")"
     done
-    # Ensure the DESTDIR is removed.
-    rmdir "$DESTDIR/nix/store" "$DESTDIR/nix" "$DESTDIR"
+
+    mv "$DESTDIR/etc" "$out"
+
+    # Ensure we did not forget to install anything.
+    rmdir --parents --ignore-fail-on-non-empty "$DESTDIR${builtins.storeDir}"
+    ! test -e "$DESTDIR"
 
     # We are setting DESTDIR so the post-install script does not compile the schemas.
     glib-compile-schemas "$out/share/glib-2.0/schemas"
   '';
 
-  # HACK: We want to install configuration files to $out/etc
-  # but GDM should read them from /etc on a NixOS system.
-  # With autotools, it was possible to override Make variables
-  # at install time but Meson does not support this
-  # so we need to convince it to install all files to a temporary
-  # location using DESTDIR and then move it to proper one in postInstall.
-  DESTDIR = "${placeholder "out"}/dest";
+  env = {
+    # HACK: We want to install configuration files to $out/etc
+    # but GDM should read them from /etc on a NixOS system.
+    # With autotools, it was possible to override Make variables
+    # at install time but Meson does not support this
+    # so we need to convince it to install all files to a temporary
+    # location using DESTDIR and then move it to proper one in postInstall.
+    DESTDIR = "dest";
+  };
 
   separateDebugInfo = true;
 
diff --git a/pkgs/development/cuda-modules/cuda/overrides.nix b/pkgs/development/cuda-modules/cuda/overrides.nix
index 12e14ef9965b4..225dada7c16be 100644
--- a/pkgs/development/cuda-modules/cuda/overrides.nix
+++ b/pkgs/development/cuda-modules/cuda/overrides.nix
@@ -1,4 +1,4 @@
-{cudaVersion, lib}:
+{cudaVersion, lib, addDriverRunpath}:
 let
   inherit (lib) attrsets lists strings;
   # cudaVersionOlder : Version -> Boolean
@@ -42,6 +42,21 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
     lists.optionals (cudaVersionAtLeast "12.0") [final.libnvjitlink.lib]
   );
 
+  cuda_cudart = prev.cuda_cudart.overrideAttrs (
+    prevAttrs: {
+      allowFHSReferences = false;
+
+      # The libcuda stub's pkg-config doesn't follow the general pattern:
+      postPatch = prevAttrs.postPatch or "" + ''
+        while IFS= read -r -d $'\0' path ; do
+          sed -i \
+            -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib/stubs|" \
+            -e "s|^Libs\s*:\(.*\)\$|Libs: \1 -Wl,-rpath,${addDriverRunpath.driverLink}/lib|" \
+            "$path"
+        done < <(find -iname 'cuda-*.pc' -print0)
+      '';
+    });
+
   cuda_compat = prev.cuda_compat.overrideAttrs (
     prevAttrs: {
       env.autoPatchelfIgnoreMissingDeps =
@@ -115,7 +130,10 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {
           moveToOutput "nvvm" "''${!outputBin}"
         '';
 
-      meta = (oldAttrs.meta or {}) // {
+      # The nvcc and cicc binaries contain hard-coded references to /usr
+      allowFHSReferences = true;
+
+      meta = (oldAttrs.meta or { }) // {
         mainProgram = "nvcc";
       };
     }
diff --git a/pkgs/development/cuda-modules/generic-builders/manifest.nix b/pkgs/development/cuda-modules/generic-builders/manifest.nix
index 71c914c8c8f24..67f6e93559c4f 100644
--- a/pkgs/development/cuda-modules/generic-builders/manifest.nix
+++ b/pkgs/development/cuda-modules/generic-builders/manifest.nix
@@ -94,7 +94,12 @@ backendStdenv.mkDerivation (
     # Traversed in the order of the outputs speficied in outputs;
     # entries are skipped if they don't exist in outputs.
     outputToPatterns = {
-      bin = ["bin"];
+      bin = [ "bin" ];
+      dev = [
+        "share/pkg-config"
+        "**/*.pc"
+        "**/*.cmake"
+      ];
       lib = [
         "lib"
         "lib64"
@@ -116,6 +121,22 @@ backendStdenv.mkDerivation (
       inherit (redistribRelease.${redistArch}) sha256;
     };
 
+    postPatch = ''
+      if [[ -d pkg-config ]] ; then
+        mkdir -p share/pkg-config
+        mv pkg-config/* share/pkg-config/
+        rmdir pkg-config
+      fi
+
+      for pc in share/pkg-config/*.pc ; do
+        sed -i \
+          -e "s|^cudaroot\s*=.*\$|cudaroot=''${!outputDev}|" \
+          -e "s|^libdir\s*=.*/lib\$|libdir=''${!outputLib}/lib|" \
+          -e "s|^includedir\s*=.*/include\$|includedir=''${!outputDev}/include|" \
+          "$pc"
+      done
+    '';
+
     # We do need some other phases, like configurePhase, so the multiple-output setup hook works.
     dontBuild = true;
 
@@ -197,6 +218,20 @@ backendStdenv.mkDerivation (
         runHook postInstall
       '';
 
+    doInstallCheck = true;
+    allowFHSReferences = true; # TODO: Default to `false`
+    postInstallCheck = ''
+      echo "Executing postInstallCheck"
+
+      if [[ -z "''${allowFHSReferences-}" ]] ; then
+        mapfile -t outputPaths < <(for o in $(getAllOutputNames); do echo "''${!o}"; done)
+        if grep --max-count=5 --recursive --exclude=LICENSE /usr/ "''${outputPaths[@]}" ; then
+          echo "Detected references to /usr" >&2
+          exit 1
+        fi
+      fi
+    '';
+
     # libcuda needs to be resolved during runtime
     # NOTE: Due to the use of __structuredAttrs, we can't use a list for autoPatchelfIgnoreMissingDeps, since it
     # will take only the first value. Instead, we produce a string with the values separated by spaces.
diff --git a/pkgs/development/embedded/svdtools/default.nix b/pkgs/development/embedded/svdtools/default.nix
index 4a57b0ace2903..ad270e0ba6515 100644
--- a/pkgs/development/embedded/svdtools/default.nix
+++ b/pkgs/development/embedded/svdtools/default.nix
@@ -5,14 +5,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svdtools";
-  version = "0.3.6";
+  version = "0.3.8";
 
   src = fetchCrate {
     inherit version pname;
-    hash = "sha256-bk6kv13HMDSRBjShWnRZJzb0YX0zKljPoEC6tebkVKI=";
+    hash = "sha256-daATz1bd5fwfYnfVbweJd/I6SsQyg2CC+MEZ5WLyZBw=";
   };
 
-  cargoHash = "sha256-MdYzYmbI7ZNLeLZdnLIVo9y2rvmGevEGy7t+2FFu5yo=";
+  cargoHash = "sha256-TSLUBkPRab6cwlXJw8tHpqYjhLtVa+QJZq13Qj/0UzU=";
 
   meta = with lib; {
     description = "Tools to handle vendor-supplied, often buggy SVD files";
diff --git a/pkgs/development/interpreters/rakudo/zef.nix b/pkgs/development/interpreters/rakudo/zef.nix
index 2ce4a164f7e6e..60c14d9d4641b 100644
--- a/pkgs/development/interpreters/rakudo/zef.nix
+++ b/pkgs/development/interpreters/rakudo/zef.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zef";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "ugexe";
     repo = "zef";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ji+KTxAOPZhuGryK0+svsVkU+HC1egKZWOboSBUON+s=";
+    hash = "sha256-7mqKcioMal4OR/xlzQ/EgGICau7Ijc13j4pSfu4/74E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index d390a52b75434..fee6e103cc8ed 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -332,8 +332,8 @@ in {
   };
 
   ruby_3_3 = generic {
-    version = rubyVersion "3" "3" "0" "rc1";
-    hash = "sha256-xP+COVqQ73bH+Qa3aHAm4KuWsJTc86Uy2auXeEoHMiI=";
+    version = rubyVersion "3" "3" "0" "";
+    hash = "sha256-llGIFNmDK+zpKoVBWoGdSJOzB9tZIa4fD3Uamomla30=";
     cargoHash = "sha256-GeelTMRFIyvz1QS2L+Q3KAnyQy7jc0ejhx3TdEFVEbk=";
   };
 
diff --git a/pkgs/development/libraries/amf-headers/default.nix b/pkgs/development/libraries/amf-headers/default.nix
index 2d908e043f29a..b1b93d38cedc0 100644
--- a/pkgs/development/libraries/amf-headers/default.nix
+++ b/pkgs/development/libraries/amf-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "amf-headers";
-  version = "1.4.30";
+  version = "1.4.32";
 
   src = fetchFromGitHub {
     owner = "GPUOpen-LibrariesAndSDKs";
     repo = "AMF";
     rev = "v${version}";
-    sha256 = "sha256-eShqo5EBbhl2Us4feFjiX+NfEl1OQ2jPQUC+Hlm+yFs=";
+    sha256 = "sha256-3CdC/9o6ur2CeVLImz2QfaZAH2+KtDdxs5zRF7W5/oo=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/libraries/cwiid/default.nix b/pkgs/development/libraries/cwiid/default.nix
index e640b6cbbbabf..d8c472870c434 100644
--- a/pkgs/development/libraries/cwiid/default.nix
+++ b/pkgs/development/libraries/cwiid/default.nix
@@ -1,13 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, bison, flex, bluez, pkg-config, gtk2 }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, bison
+, flex
+, bluez
+, pkg-config
+, gtk2
+}:
 
 stdenv.mkDerivation rec {
   pname = "cwiid";
   version = "unstable-2010-02-21";
 
   src = fetchFromGitHub {
-    owner  = "abstrakraft";
-    repo   = "cwiid";
-    rev    = "fadf11e89b579bcc0336a0692ac15c93785f3f82";
+    owner = "abstrakraft";
+    repo = "cwiid";
+    rev = "fadf11e89b579bcc0336a0692ac15c93785f3f82";
     sha256 = "0qdb0x757k76nfj32xc2nrrdqd9jlwgg63vfn02l2iznnzahxp0h";
   };
 
@@ -19,9 +28,21 @@ stdenv.mkDerivation rec {
     sed -i -e '/$(LDCONFIG)/d' common/include/lib.mak.in
   '';
 
-  buildInputs = [ bison flex bluez gtk2 ];
+  patches = [
+    ./fix-ar.diff
+  ];
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [
+    bluez
+    gtk2
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    bison
+    flex
+  ];
 
   NIX_LDFLAGS = "-lbluetooth";
 
@@ -32,9 +53,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Linux Nintendo Wiimote interface";
-    homepage    = "http://cwiid.org";
-    license     = licenses.gpl2Plus;
+    homepage = "http://cwiid.org";
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ bennofs ];
-    platforms   = platforms.linux;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/cwiid/fix-ar.diff b/pkgs/development/libraries/cwiid/fix-ar.diff
new file mode 100644
index 0000000000000..8ca4b885a0a37
--- /dev/null
+++ b/pkgs/development/libraries/cwiid/fix-ar.diff
@@ -0,0 +1,26 @@
+diff --git a/common/include/lib.mak.in b/common/include/lib.mak.in
+index 3afbb14..b8df9d9 100644
+--- a/common/include/lib.mak.in
++++ b/common/include/lib.mak.in
+@@ -22,7 +22,7 @@ static: $(STATIC_LIB)
+ shared: $(SHARED_LIB)
+ 
+ $(STATIC_LIB): $(OBJECTS)
+-	ar rcs $(STATIC_LIB) $(OBJECTS)
++	$(AR) rcs $(STATIC_LIB) $(OBJECTS)
+ 
+ $(SHARED_LIB): $(OBJECTS)
+ 	$(CC) -shared -Wl,-soname,$(SO_NAME) $(LDFLAGS) -o $(SHARED_LIB) \
+diff --git a/configure.ac b/configure.ac
+index 82ca3e1..0a78283 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -15,6 +15,8 @@ if test "$YACC" != "bison -y"; then
+ 	AC_MSG_ERROR([bison not found])
+ fi
+ 
++AC_CHECK_TOOL([AR], [ar], [:])
++
+ AC_ARG_WITH(
+ 	[python],
+ 	[AS_HELP_STRING([--without-python],[compile without python support])],
diff --git a/pkgs/development/libraries/libcec/default.nix b/pkgs/development/libraries/libcec/default.nix
index 1d6fd44acb69e..90ffcb01cf91f 100644
--- a/pkgs/development/libraries/libcec/default.nix
+++ b/pkgs/development/libraries/libcec/default.nix
@@ -29,7 +29,11 @@ stdenv.mkDerivation rec {
   buildInputs = [ udev libcec_platform ] ++
     lib.optional withLibraspberrypi libraspberrypi;
 
-  cmakeFlags = [ "-DBUILD_SHARED_LIBS=1" ];
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=1"
+  ] ++ lib.optionals stdenv.isLinux [
+    "-DHAVE_LINUX_API=1"
+  ];
 
   meta = with lib; {
     description = "Allows you (with the right hardware) to control your device with your TV remote control using existing HDMI cabling";
diff --git a/pkgs/development/libraries/libei/default.nix b/pkgs/development/libraries/libei/default.nix
index b216cd231c22e..3b687fcd8edcb 100644
--- a/pkgs/development/libraries/libei/default.nix
+++ b/pkgs/development/libraries/libei/default.nix
@@ -11,7 +11,6 @@
 , protobuf
 , protobufc
 , python3
-, python3Packages
 , systemd
 }:
 let
@@ -42,19 +41,18 @@ stdenv.mkDerivation rec {
     systemd
   ];
   nativeBuildInputs = [
-    attr
     meson
     ninja
     pkg-config
-    python3
-  ] ++
-  (with python3Packages; [
-    jinja2
-    pytest
-    python-dbusmock
-    strenum
-    structlog
-  ]);
+    (python3.withPackages(ps: with ps; [
+      attrs
+      jinja2
+      pytest
+      python-dbusmock
+      strenum
+      structlog
+    ]))
+  ];
 
   postPatch = ''
     ln -s "${munit}" ./subprojects/munit
diff --git a/pkgs/development/libraries/toml-f/default.nix b/pkgs/development/libraries/toml-f/default.nix
index 696e41ac71cc4..ed6fc26ee2056 100644
--- a/pkgs/development/libraries/toml-f/default.nix
+++ b/pkgs/development/libraries/toml-f/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "toml-f";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-sCU0uMdcXIA5O964hlK37cOrLTlk1CJeTcWD9FhevOs=";
+    hash = "sha256-+cac4rUNpd2w3yBdH1XoCKdJ9IgOHZioZg8AhzGY0FE=";
   };
 
   nativeBuildInputs = [ gfortran cmake ];
diff --git a/pkgs/development/libraries/zint/default.nix b/pkgs/development/libraries/zint/default.nix
index 69ec64ada9d20..8ba4a68e4b82d 100644
--- a/pkgs/development/libraries/zint/default.nix
+++ b/pkgs/development/libraries/zint/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zint";
-  version = "2.12.0";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "zint";
     repo = "zint";
     rev = version;
-    hash = "sha256-Ay6smir6zUpadmw1WpU+F7e9t7Gk3JNVtf2VVu92bDk=";
+    hash = "sha256-/ILq/7A8Lffe2NuiABiV3KeYXapuL1SO55Qk3wXfC/8=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/python-modules/aiohttp-zlib-ng/default.nix b/pkgs/development/python-modules/aiohttp-zlib-ng/default.nix
index 65e996535a6fe..b912224b0037e 100644
--- a/pkgs/development/python-modules/aiohttp-zlib-ng/default.nix
+++ b/pkgs/development/python-modules/aiohttp-zlib-ng/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , aiohttp
 , buildPythonPackage
 , cpufeature
@@ -34,9 +35,8 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
-    cpufeature
     zlib-ng
-  ];
+  ] ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform cpufeature) cpufeature;
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 088782775d615..4a6eb3aa99501 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.34.2";
+  version = "1.34.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-+2DKdWGyqdHdq9xe65YRKy+Xjd+mopS74x0r/1pOZYo=";
+    hash = "sha256-iPbp3F0ZeZ9KWBO/aTMezo8ze6zziLO5YV+lfAXtJDs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cpufeature/default.nix b/pkgs/development/python-modules/cpufeature/default.nix
index f65cf04fa4cb7..cade32a1955bd 100644
--- a/pkgs/development/python-modules/cpufeature/default.nix
+++ b/pkgs/development/python-modules/cpufeature/default.nix
@@ -46,5 +46,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/robbmcleod/cpufeature";
     license = licenses.cc0;
     maintainers = with maintainers; [ fab ];
+    platforms = [ "x86_64-linux" "x86_64-windows" ];
   };
 }
diff --git a/pkgs/development/python-modules/django-mdeditor/default.nix b/pkgs/development/python-modules/django-mdeditor/default.nix
new file mode 100644
index 0000000000000..dc58e3cd665d0
--- /dev/null
+++ b/pkgs/development/python-modules/django-mdeditor/default.nix
@@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, django
+}:
+let
+  version = "0.1.20";
+in
+buildPythonPackage {
+  pname = "django-mdeditor";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "pylixm";
+    repo = "django-mdeditor";
+    rev = "v${version}";
+    hash = "sha256-t57j1HhjNQtBwlbqe4mAHQ9WiNcIhMKYmrZkiqh+k5k=";
+  };
+
+  propagatedBuildInputs = [ django ];
+
+  # no tests
+  doCheck = false;
+  pythonImportsCheck = [ "mdeditor" ];
+
+  meta = with lib; {
+    description = "Markdown Editor plugin application for django based on Editor.md";
+    homepage = "https://github.com/pylixm/django-mdeditor";
+    changelog = "https://github.com/pylixm/django-mdeditor/releases";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ augustebaum ];
+  };
+}
diff --git a/pkgs/development/python-modules/flet-core/default.nix b/pkgs/development/python-modules/flet-core/default.nix
index c8a8d678717cc..da635578e0dd6 100644
--- a/pkgs/development/python-modules/flet-core/default.nix
+++ b/pkgs/development/python-modules/flet-core/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "flet-core";
-  version = "0.15.0";
+  version = "0.17.0";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "flet_core";
     inherit version;
-    hash = "sha256-nmQHWyLlyo6CVzn+dlTSnA10XRoSFBLEeYdcWpfoGBo=";
+    hash = "sha256-LYCbZKxHXrUUs3f3M2pGxz51R2dMet7/fYr9MZ10cgI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flet-runtime/default.nix b/pkgs/development/python-modules/flet-runtime/default.nix
index b4754b911b4ca..57466f1d33f78 100644
--- a/pkgs/development/python-modules/flet-runtime/default.nix
+++ b/pkgs/development/python-modules/flet-runtime/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "flet-runtime";
-  version = "0.15.0";
+  version = "0.17.0";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "flet_runtime";
     inherit version;
-    hash = "sha256-CRrAz1V6bISgL2MU7ibhhNEB5IdiQKjRdIt2dmZh0h4=";
+    hash = "sha256-BhVle4Mpx+0YcAaTWk1AvYGuyPFPju1iuF6SLs2uAzU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flet/default.nix b/pkgs/development/python-modules/flet/default.nix
index 8608e77bb5e23..9259bb26b1f6b 100644
--- a/pkgs/development/python-modules/flet/default.nix
+++ b/pkgs/development/python-modules/flet/default.nix
@@ -21,12 +21,12 @@
 
 buildPythonPackage rec {
   pname = "flet";
-  version = "0.15.0";
+  version = "0.17.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NnozZX8i5QsnVRW5cyIvKxYuHf9EoR6owWSQw6Y4dwQ=";
+    hash = "sha256-YNa1JDoGqtpzjx+3E1Ycz2E5yZ5MVzooPo9PgHFll9s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/hachoir/default.nix b/pkgs/development/python-modules/hachoir/default.nix
index 0de262ab7b43d..4480dd8932758 100644
--- a/pkgs/development/python-modules/hachoir/default.nix
+++ b/pkgs/development/python-modules/hachoir/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "hachoir";
-  version = "3.2.0";
+  version = "3.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "vstinner";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-BRrb6bnPSDVjZF1cOA9NlUYd2HrtqZEAVhHgkjmE0Xg=";
+    hash = "sha256-sTUJx8Xyhw4Z6juRtREw/okuVjSTSVWpSLKeZ7T8IR8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hahomematic/default.nix b/pkgs/development/python-modules/hahomematic/default.nix
index 9d27417a6f6f5..bbaa5347dff7b 100644
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2023.12.1";
+  version = "2023.12.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.11";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-FqorpdGpm9uAzvEuX6F2Guvq795ix1A8RfX4KUi9jk8=";
+    hash = "sha256-IsRHJyFgoS7vfr/QcfzplsmFHMRRtLXVqU7bhL/fFto=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index f6016ae3a9ed6..a23ce93d778af 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -8,16 +8,22 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "4.9.3-3";
+  version = "4.9.4";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/lxml-${version}";
-    hash = "sha256-Vrizi+6jUUEx7qODU4PAH5ZmvBIyT9H18+QpYB0m1f4=";
+    hash = "sha256-qS20wb83eFapiPZe25BViHpYkjgvnCIZpiYkPNIPHZg=";
   };
 
+  patches = [
+    # fix compile error with libxml 2.12
+    # backport of: https://github.com/lxml/lxml/commit/b0861bea17769584a85f57eb00235ce0ca9811af
+    ./libxml-2.12.patch
+  ];
+
   # setuptoolsBuildPhase needs dependencies to be passed through nativeBuildInputs
   nativeBuildInputs = [ libxml2.dev libxslt.dev cython ] ++ lib.optionals stdenv.isDarwin [ xcodebuild ];
   buildInputs = [ libxml2 libxslt zlib ];
diff --git a/pkgs/development/python-modules/lxml/libxml-2.12.patch b/pkgs/development/python-modules/lxml/libxml-2.12.patch
new file mode 100644
index 0000000000000..d0d211c9fe38b
--- /dev/null
+++ b/pkgs/development/python-modules/lxml/libxml-2.12.patch
@@ -0,0 +1,94 @@
+From 3b8807306d79d2ae2e9fa28c5ecd3b40b32ee65b Mon Sep 17 00:00:00 2001
+From: Stefan Behnel <stefan_ml@behnel.de>
+Date: Wed, 29 Nov 2023 10:28:47 +0100
+Subject: [PATCH] Follow changes in libxml2 2.12 and make xmlError usages
+ 'const'. This mostly impacts the error callback functions.
+
+---
+ src/lxml/extensions.pxi | 4 ++--
+ src/lxml/parser.pxi     | 4 ++--
+ src/lxml/xmlerror.pxi   | 8 ++++----
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/src/lxml/extensions.pxi b/src/lxml/extensions.pxi
+index 35a321b7..42b4c4f6 100644
+--- a/src/lxml/extensions.pxi
++++ b/src/lxml/extensions.pxi
+@@ -393,7 +393,7 @@ cdef tuple LIBXML2_XPATH_ERROR_MESSAGES = (
+     b"?? Unknown error ??\n",
+ )
+ 
+-cdef void _forwardXPathError(void* c_ctxt, xmlerror.xmlError* c_error) with gil:
++cdef void _forwardXPathError(void* c_ctxt, const xmlerror.xmlError* c_error) with gil:
+     cdef xmlerror.xmlError error
+     cdef int xpath_code
+     if c_error.message is not NULL:
+@@ -414,7 +414,7 @@ cdef void _forwardXPathError(void* c_ctxt, xmlerror.xmlError* c_error) with gil:
+ 
+     (<_BaseContext>c_ctxt)._error_log._receive(&error)
+ 
+-cdef void _receiveXPathError(void* c_context, xmlerror.xmlError* error) nogil:
++cdef void _receiveXPathError(void* c_context, const xmlerror.xmlError* error) nogil:
+     if not __DEBUG:
+         return
+     if c_context is NULL:
+diff --git a/src/lxml/parser.pxi b/src/lxml/parser.pxi
+index 22463c7d..1566b6df 100644
+--- a/src/lxml/parser.pxi
++++ b/src/lxml/parser.pxi
+@@ -626,10 +626,10 @@ cdef _initParserContext(_ParserContext context,
+     if c_ctxt is not NULL:
+         context._initParserContext(c_ctxt)
+ 
+-cdef void _forwardParserError(xmlparser.xmlParserCtxt* _parser_context, xmlerror.xmlError* error) with gil:
++cdef void _forwardParserError(xmlparser.xmlParserCtxt* _parser_context, const xmlerror.xmlError* error) with gil:
+     (<_ParserContext>_parser_context._private)._error_log._receive(error)
+ 
+-cdef void _receiveParserError(void* c_context, xmlerror.xmlError* error) nogil:
++cdef void _receiveParserError(void* c_context, const xmlerror.xmlError* error) nogil:
+     if __DEBUG:
+         if c_context is NULL or (<xmlparser.xmlParserCtxt*>c_context)._private is NULL:
+             _forwardError(NULL, error)
+diff --git a/src/lxml/xmlerror.pxi b/src/lxml/xmlerror.pxi
+index 1b50444f..4cd745f9 100644
+--- a/src/lxml/xmlerror.pxi
++++ b/src/lxml/xmlerror.pxi
+@@ -66,7 +66,7 @@ cdef class _LogEntry:
+         tree.xmlFree(self._c_path)
+ 
+     @cython.final
+-    cdef _setError(self, xmlerror.xmlError* error):
++    cdef _setError(self, const xmlerror.xmlError* error):
+         self.domain   = error.domain
+         self.type     = error.code
+         self.level    = <int>error.level
+@@ -198,7 +198,7 @@ cdef class _BaseErrorLog:
+         pass
+ 
+     @cython.final
+-    cdef void _receive(self, xmlerror.xmlError* error):
++    cdef void _receive(self, const xmlerror.xmlError* error):
+         cdef bint is_error
+         cdef _LogEntry entry
+         cdef _BaseErrorLog global_log
+@@ -634,7 +634,7 @@ def use_global_python_log(PyErrorLog log not None):
+ 
+ 
+ # local log functions: forward error to logger object
+-cdef void _forwardError(void* c_log_handler, xmlerror.xmlError* error) with gil:
++cdef void _forwardError(void* c_log_handler, const xmlerror.xmlError* error) with gil:
+     cdef _BaseErrorLog log_handler
+     if c_log_handler is not NULL:
+         log_handler = <_BaseErrorLog>c_log_handler
+@@ -645,7 +645,7 @@ cdef void _forwardError(void* c_log_handler, xmlerror.xmlError* error) with gil:
+     log_handler._receive(error)
+ 
+ 
+-cdef void _receiveError(void* c_log_handler, xmlerror.xmlError* error) nogil:
++cdef void _receiveError(void* c_log_handler, const xmlerror.xmlError* error) nogil:
+     # no Python objects here, may be called without thread context !
+     if __DEBUG:
+         _forwardError(c_log_handler, error)
+-- 
+2.42.0
+
diff --git a/pkgs/development/python-modules/pyoutbreaksnearme/default.nix b/pkgs/development/python-modules/pyoutbreaksnearme/default.nix
index 0c07a12fc1f33..5aa9352f7a4cc 100644
--- a/pkgs/development/python-modules/pyoutbreaksnearme/default.nix
+++ b/pkgs/development/python-modules/pyoutbreaksnearme/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pyoutbreaksnearme";
-  version = "2023.10.0";
+  version = "2023.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = "pyoutbreaksnearme";
     rev = "refs/tags/${version}";
-    hash = "sha256-G+/ooNhiYOaV0kjfr8Z1d31XxRYFArQnt1oIuMQfXdY=";
+    hash = "sha256-oR/DApOxNSSczrBeH4sytd/vasbD4rA1poW4zNoeAnU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pysml/default.nix b/pkgs/development/python-modules/pysml/default.nix
index 0f16f4503d192..cfdfc1b476297 100644
--- a/pkgs/development/python-modules/pysml/default.nix
+++ b/pkgs/development/python-modules/pysml/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pysml";
-  version = "0.1.1";
+  version = "0.1.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "mtdcr";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-BtOx/kqPuvaaIyh/2/X5pW5BRvpsnMUMr1u6iZzbkt4=";
+    hash = "sha256-TLIpc0bVx1As2oLyYD+BBMalwJiKdvBCcrd1tUNyh6Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/regenmaschine/default.nix b/pkgs/development/python-modules/regenmaschine/default.nix
index b71d2e45d5e0e..e3fb2889470e4 100644
--- a/pkgs/development/python-modules/regenmaschine/default.nix
+++ b/pkgs/development/python-modules/regenmaschine/default.nix
@@ -15,16 +15,16 @@
 
 buildPythonPackage rec {
   pname = "regenmaschine";
-  version = "2023.11.0";
+  version = "2023.12.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "bachya";
     repo = "regenmaschine";
     rev = "refs/tags/${version}";
-    hash = "sha256-FRfw3B2zHEspKf1LENrB3Ayu6/t3hyS8sjuwoBC5Lfk=";
+    hash = "sha256-9VBqLmbWJCrfDw9T1qmE9KkdlS+MDnvoG8O9dPCuJDs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/temperusb/default.nix b/pkgs/development/python-modules/temperusb/default.nix
index 929560167e76e..79363508ecbf4 100644
--- a/pkgs/development/python-modules/temperusb/default.nix
+++ b/pkgs/development/python-modules/temperusb/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "temperusb";
-  version = "1.6.0";
+  version = "1.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-enYhqtJnORKhBoZkZPISLCt9Ec5SN6txD3z0SXuPrQo=";
+    hash = "sha256-PwKHT1zzVn+nmxO/R+aK+029WaaHBo7FyVV4eQtHhbM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/tools/algolia-cli/default.nix b/pkgs/development/tools/algolia-cli/default.nix
index 64ad473c3b75c..75f69e021e1f5 100644
--- a/pkgs/development/tools/algolia-cli/default.nix
+++ b/pkgs/development/tools/algolia-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "algolia-cli";
-  version = "1.4.3";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "algolia";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-tKLFJSlViiryH9j4ZaOtj6gA69fp//cG/ftBe2J2R+I=";
+    hash = "sha256-iaqr8/jPYEnOhGoiUC5lmd7l+AAOFh3iYVW+mbBV/V8=";
   };
 
   vendorHash = "sha256-cNuBTH7L2K4TgD0H9FZ9CjhE5AGXADaniGLD9Lhrtrk=";
diff --git a/pkgs/development/tools/api-linter/default.nix b/pkgs/development/tools/api-linter/default.nix
index 0320b499b1458..940338ece2018 100644
--- a/pkgs/development/tools/api-linter/default.nix
+++ b/pkgs/development/tools/api-linter/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "api-linter";
-  version = "1.59.2";
+  version = "1.60.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     rev = "v${version}";
-    hash = "sha256-tgDrzYaomB0Pj7JQmvp+8G25CBDxGiMYCUnbm8vRkDU=";
+    hash = "sha256-3uxPHSmIFrkAm82sqQxWKzJwU3cFhTDVsJYp8cENaRg=";
   };
 
   vendorHash = "sha256-egAZ4CeSSStfkN2mGgzGHTBojHKHoVEf3o0oi+OpMkw=";
@@ -23,7 +23,7 @@ buildGoModule rec {
     "-w"
   ];
 
-  # reference: https://github.com/googleapis/api-linter/blob/v1.59.2/.github/workflows/release.yaml#L76
+  # reference: https://github.com/googleapis/api-linter/blob/v1.60.0/.github/workflows/release.yaml#L76
   preBuild = ''
     cat > cmd/api-linter/version.go <<EOF
     package main
diff --git a/pkgs/development/tools/azcopy/default.nix b/pkgs/development/tools/azcopy/default.nix
index c35309daca88e..a6c719611ca9d 100644
--- a/pkgs/development/tools/azcopy/default.nix
+++ b/pkgs/development/tools/azcopy/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "azure-storage-azcopy";
-  version = "10.22.0";
+  version = "10.22.1";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-storage-azcopy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-njDC1KxxWaeCxALF5MRE/6+z6bcEQt/PTjN29hEg4Hw=";
+    hash = "sha256-WS8h4WRiCTthZOT3NQE8h7BihpaHFfCe39XoGvnDZ1k=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-vHHUbXpO4Z2VKSyA8itywx5oei9bFuSmvW1d7KENeUM=";
+  vendorHash = "sha256-afqDnrmbTR6yZHT7NysysORci4b0Oh0sjpftgAXJ5Uk=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/bearer/default.nix b/pkgs/development/tools/bearer/default.nix
index e1f56a56fbc62..78534868d39ba 100644
--- a/pkgs/development/tools/bearer/default.nix
+++ b/pkgs/development/tools/bearer/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "bearer";
-  version = "1.33.0";
+  version = "1.33.1";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-sdtZOj3jksXDVVYi+Uy/zXgZoqlhGlPKjokXNErBe9k=";
+    hash = "sha256-cdD4LYQZwkS5dRhmvyHkio7TXPDgfDo7kutVAGJCitc=";
   };
 
-  vendorHash = "sha256-u3pqG74o8xRxxepS5u3lTo4rPgbFABDC/dLWD1JAyxA=";
+  vendorHash = "sha256-nh2hkwscb4EYEfumBXPFrLgxIxRlkVqBCnQZ4eMZbgg=";
 
   subPackages = [
     "cmd/bearer"
diff --git a/pkgs/development/tools/changie/default.nix b/pkgs/development/tools/changie/default.nix
index 7679541e41748..7b155d4c40bad 100644
--- a/pkgs/development/tools/changie/default.nix
+++ b/pkgs/development/tools/changie/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "changie";
-  version = "1.16.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "miniscruff";
     repo = "changie";
     rev = "v${version}";
-    hash = "sha256-NN/ohZPwgvl1ZUqFI06vKfUYs4KG9dtBKSz76+FR6pM=";
+    hash = "sha256-IS4KKvAi4VutJADSpst56ZdeqoqVkSMQ1TyQR12pqNg=";
   };
 
   vendorHash = "sha256-JmK7bcS8UYCOUvJGs0PAYPNc8iwvCSFzjLlkBEVUa40=";
diff --git a/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix b/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
index f32c5b138aba5..dc5ad3708a0ef 100644
--- a/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/forgejo-actions-runner/default.nix
@@ -7,17 +7,17 @@
 
 buildGoModule rec {
   pname = "forgejo-actions-runner";
-  version = "3.0.1";
+  version = "3.3.0";
 
   src = fetchFromGitea {
-    domain = "codeberg.org";
+    domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-idA74R6kbI7Bk0XvT7BOyctT0IKymsJoFCWgYrtZstU=";
+    hash = "sha256-ZpsHytsIp+ZW4DI7X9MmI7nZRnXVHvx905YdZGS6WMY=";
   };
 
-  vendorHash = "sha256-HE//SD/doMf42y2KF10JAuUe86hpFhCUM61da2NC5CE=";
+  vendorHash = "sha256-5GnGXpMy1D7KpVAVroX07Vw5QKYYtwdIhQsk23WCLgc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/continuous-integration/woodpecker-plugin-git/default.nix b/pkgs/development/tools/continuous-integration/woodpecker-plugin-git/default.nix
index 899fdc7d82ef6..a3f27e533e7da 100644
--- a/pkgs/development/tools/continuous-integration/woodpecker-plugin-git/default.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker-plugin-git/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "woodpecker-plugin-git";
-  version = "2.2.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "woodpecker-ci";
     repo = "plugin-git";
     rev = "refs/tags/${version}";
-    hash = "sha256-BQG1+icfV21qZCwgNvLQm8+1f5WF8owKnQKTIF7O80A=";
+    hash = "sha256-9aK6c2uUBhTzBni6S4XwevdVRxswiMYGJKwmKOGHIbg=";
   };
 
   vendorHash = "sha256-ol5k37gGFsyeEnGOVcJaerkIejShHyNCBu4RZ8WyHvU=";
diff --git a/pkgs/development/tools/just/default.nix b/pkgs/development/tools/just/default.nix
index 4dea1df997007..213a411b6b6b1 100644
--- a/pkgs/development/tools/just/default.nix
+++ b/pkgs/development/tools/just/default.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "1.17.0";
+  version = "1.18.1";
   outputs = [ "out" "man" "doc" ];
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-tT8WNenYTLL5dGrRbhfASRMEcyuoHS7RNXpMX/GG+wE=";
+    hash = "sha256-jmTSTx2WSLOtxy0gPCTonjcoy4o9FKA5aiQW3+wPrZQ=";
   };
 
-  cargoHash = "sha256-1R2kl5E5OU3U38LfcBzlvth4bBpVVnbXiet2N5LNNZk=";
+  cargoHash = "sha256-4kbvtmXkU5bhuC079K5NOGKVdqYvTileVNXSNLIV0ok=";
 
   nativeBuildInputs = [ installShellFiles mdbook ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
diff --git a/pkgs/development/tools/language-servers/vhdl-ls/default.nix b/pkgs/development/tools/language-servers/vhdl-ls/default.nix
index 1c71adecebd20..1ca6f8930709e 100644
--- a/pkgs/development/tools/language-servers/vhdl-ls/default.nix
+++ b/pkgs/development/tools/language-servers/vhdl-ls/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "vhdl-ls";
-  version = "0.67.0";
+  version = "0.77.0";
 
   src = fetchFromGitHub {
     owner = "VHDL-LS";
     repo = "rust_hdl";
     rev = "v${version}";
-    hash = "sha256-3ixU1OWRgDNG4aFAZTqqTSt1Hw41mB+mScVsozA01gM=";
+    hash = "sha256-IAe4m/GC6ubCcZZESC6fToWVQT73XrhjJOiGCGzNxnQ=";
   };
 
-  cargoHash = "sha256-SDXWFb0SDMqAmKrPOUryiMgPxv0yffcrqFVvFt4VPS4=";
+  cargoHash = "sha256-p7BL8WuQiB1KihwAl5aeO6Fa9INYRTQgoQPHcSMnaiQ=";
 
   postPatch = ''
     substituteInPlace vhdl_lang/src/config.rs \
diff --git a/pkgs/development/tools/rust/cargo-mutants/default.nix b/pkgs/development/tools/rust/cargo-mutants/default.nix
index f06e741f8a708..62a73b5360376 100644
--- a/pkgs/development/tools/rust/cargo-mutants/default.nix
+++ b/pkgs/development/tools/rust/cargo-mutants/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-mutants";
-  version = "23.12.0";
+  version = "23.12.2";
 
   src = fetchFromGitHub {
     owner = "sourcefrog";
     repo = "cargo-mutants";
     rev = "v${version}";
-    hash = "sha256-6p+ri6An0rQTPSFUSE4MBNP5dFiVFsS0UDXUoWJoY20=";
+    hash = "sha256-TFVk8uq+wBfCmwU5klqapxp6IeJNnvoH6pDKC8NJuao=";
   };
 
-  cargoHash = "sha256-4ej0Pl8n1Z001IdiM1u+/Z7ZTi9hwuoJLA4gHheQOsA=";
+  cargoHash = "sha256-cN7mgyKzuYZT+g8j04Ncqb4s2mwyTsNib5RssrEa2F8=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/pkgs/development/tools/rust/cargo-run-bin/default.nix b/pkgs/development/tools/rust/cargo-run-bin/default.nix
index facc1566a9906..2022a887457a0 100644
--- a/pkgs/development/tools/rust/cargo-run-bin/default.nix
+++ b/pkgs/development/tools/rust/cargo-run-bin/default.nix
@@ -5,14 +5,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-run-bin";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-PB44m39TDH1z8N3DrxAlZ/FKOdZmpe+U84tbmBBP9VQ=";
+    hash = "sha256-B4tkP2QuL3MFQn3iAPg4TMJfFbn1D8w/C1OX+TbpgSE=";
   };
 
-  cargoHash = "sha256-FMlirUr3c8QhnTmTHvfNPff7PYlWSl83vCGLOLbyaR4=";
+  cargoHash = "sha256-tn+NqugSK5R/lIQVF1URWoDbdsSCvi5tjdjOlT293tg=";
 
   # multiple impurities in tests
   doCheck = false;
diff --git a/pkgs/development/tools/vendir/default.nix b/pkgs/development/tools/vendir/default.nix
index 02e5102c9e257..bc0edbccf9ac4 100644
--- a/pkgs/development/tools/vendir/default.nix
+++ b/pkgs/development/tools/vendir/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "vendir";
-  version = "0.37.0";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-vendir";
     rev = "v${version}";
-    sha256 = "sha256-AxHVr6XryTXqm+iL54eqxIRE2MfxLbwFz7+aCauP0x8=";
+    sha256 = "sha256-H5SeDZzl2KdVp3KsRpsmp6/ZOxLq+3y9Coe1NIEi5YQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/web-ext/default.nix b/pkgs/development/tools/web-ext/default.nix
index 494eee2e6a963..f75f8a66142e0 100644
--- a/pkgs/development/tools/web-ext/default.nix
+++ b/pkgs/development/tools/web-ext/default.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "web-ext";
-  version = "7.6.2";
+  version = "7.9.0";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "web-ext";
     rev = version;
-    hash = "sha256-tFMngcoHFA3QmR0AK68elUVpli37PsVlcL978o7DQCs=";
+    hash = "sha256-7fBUWQFUsIGQnyNhZISvdtAQMAMZ38mbzGuC+6Cwu1Y=";
   };
 
-  npmDepsHash = "sha256-KPBKUjCxva11w/E+Qhlx+1vikpCL7Hr9MiKenYHEVSU=";
+  npmDepsHash = "sha256-3Dq4sNPZm9fDxPxOZL+rDxFA/FEs2/+zdz8sF3JFJ3s=";
 
   npmBuildFlags = [ "--production" ];
 
diff --git a/pkgs/development/tools/wiiload/default.nix b/pkgs/development/tools/wiiload/default.nix
index 2f2fe174d14e6..3d7f1b7986339 100644
--- a/pkgs/development/tools/wiiload/default.nix
+++ b/pkgs/development/tools/wiiload/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, autoconf, automake, zlib }:
 stdenv.mkDerivation rec {
-  version = "0.5.1";
+  version = "0.5.3";
   pname = "wiiload";
 
   nativeBuildInputs = [ autoconf automake ];
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "devkitPro";
     repo  = "wiiload";
     rev = "v${version}";
-    sha256 = "0dffy603zggkqv7g1a2jninmi64vy519gpgkdfhjnijhdm9gs5m3";
+    sha256 = "sha256-pZdZzCAPfAVucuiV/q/ROY3cz/wxQWep6dCTGNn2fSo=";
   };
 
   preConfigure = "./autogen.sh";
diff --git a/pkgs/development/tools/ytt/default.nix b/pkgs/development/tools/ytt/default.nix
index 668fc47fe72d2..1df8887afe68f 100644
--- a/pkgs/development/tools/ytt/default.nix
+++ b/pkgs/development/tools/ytt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ytt";
-  version = "0.46.2";
+  version = "0.46.3";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-ytt";
     rev = "v${version}";
-    sha256 = "sha256-r9LQMQffnc/g1WFJU8m+Oy0hD+DudCNiVAcbAAPy1vI=";
+    sha256 = "sha256-K2+5NplyQuvc78NnNDiQhfrewqn84jDbiAyN8J9iTm0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/web/flyctl/default.nix b/pkgs/development/web/flyctl/default.nix
index 1bac4b232ceca..1aa253775294a 100644
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@@ -57,7 +57,7 @@ buildGoModule rec {
     downloadPage = "https://github.com/superfly/flyctl";
     homepage = "https://fly.io/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ aaronjanse adtya jsierles techknowlogick viraptor ];
+    maintainers = with maintainers; [ adtya jsierles techknowlogick viraptor ];
     mainProgram = "flyctl";
   };
 }
diff --git a/pkgs/games/vcmi/default.nix b/pkgs/games/vcmi/default.nix
index 2dd27400961dc..2cbbaa25ae5af 100644
--- a/pkgs/games/vcmi/default.nix
+++ b/pkgs/games/vcmi/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vcmi";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "vcmi";
     repo = "vcmi";
     rev = version;
-    hash = "sha256-MhY3tpKlrIgq6QXZwAkMnObYYpUxsPcysTR5CZH1rhE=";
+    hash = "sha256-5G6qmn2b1/0h7aGNNx4t38Akzg2bZFKubOp3FLqSi+I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/lxcfs/default.nix b/pkgs/os-specific/linux/lxcfs/default.nix
index 28777d36e6beb..ee923786c2952 100644
--- a/pkgs/os-specific/linux/lxcfs/default.nix
+++ b/pkgs/os-specific/linux/lxcfs/default.nix
@@ -1,41 +1,58 @@
-{ config, lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, help2man, fuse
-, util-linux, makeWrapper
-, enableDebugBuild ? config.lxcfs.enableDebugBuild or false }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fuse3,
+  help2man,
+  makeWrapper,
+  meson,
+  ninja,
+  nixosTests,
+  pkg-config,
+  python3,
+  util-linux,
+}:
 
 stdenv.mkDerivation rec {
   pname = "lxcfs";
-  version = "4.0.12";
+  version = "5.0.4";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "lxcfs";
     rev = "lxcfs-${version}";
-    sha256 = "sha256-+wp29GD+toXGfQbPGYbDJ7/P+FY1uQY4uK3OQxTE9GM=";
+    sha256 = "sha256-vusxbFV7cnQVBOOo7E+fSyaE63f5QiE2xZhYavc8jJU=";
   };
 
-  postPatch = ''
-    sed -i -e '1i #include <sys/pidfd.h>' src/bindings.c
-  '';
+  patches = [
+    # skip RPM spec generation
+    ./no-spec.patch
 
-  nativeBuildInputs = [ pkg-config help2man autoreconfHook makeWrapper ];
-  buildInputs = [ fuse ];
+    # skip installing systemd files
+    ./skip-init.patch
+
+    # fix pidfd checks and include
+    ./pidfd.patch
+  ];
 
-  preConfigure = lib.optionalString enableDebugBuild ''
-    sed -i 's,#AM_CFLAGS += -DDEBUG,AM_CFLAGS += -DDEBUG,' Makefile.am
-  '';
 
-  configureFlags = [
-    "--with-init-script=systemd"
-    "--sysconfdir=/etc"
-    "--localstatedir=/var"
+  nativeBuildInputs = [
+    meson
+    help2man
+    makeWrapper
+    ninja
+    (python3.withPackages (p: [ p.jinja2 ]))
+    pkg-config
   ];
+  buildInputs = [ fuse3 ];
 
-  installFlags = [ "SYSTEMD_UNIT_DIR=\${out}/lib/systemd" ];
+  preConfigure = ''
+    patchShebangs tools/
+  '';
 
   postInstall = ''
     # `mount` hook requires access to the `mount` command from `util-linux`:
-    wrapProgram "$out/share/lxcfs/lxc.mount.hook" \
-      --prefix PATH : "${util-linux}/bin"
+    wrapProgram "$out/share/lxcfs/lxc.mount.hook" --prefix PATH : "${util-linux}/bin"
   '';
 
   postFixup = ''
@@ -43,6 +60,10 @@ stdenv.mkDerivation rec {
     patchelf --set-rpath "$(patchelf --print-rpath "$out/bin/lxcfs"):$out/lib" "$out/bin/lxcfs"
   '';
 
+  passthru.tests = {
+    incus-container = nixosTests.incus.container;
+  };
+
   meta = {
     description = "FUSE filesystem for LXC";
     homepage = "https://linuxcontainers.org/lxcfs";
diff --git a/pkgs/os-specific/linux/lxcfs/no-spec.patch b/pkgs/os-specific/linux/lxcfs/no-spec.patch
new file mode 100644
index 0000000000000..ead4bfcf80f75
--- /dev/null
+++ b/pkgs/os-specific/linux/lxcfs/no-spec.patch
@@ -0,0 +1,24 @@
+diff --git a/meson.build b/meson.build
+index a0289ad..93fc61a 100644
+--- a/meson.build
++++ b/meson.build
+@@ -253,19 +253,6 @@ if want_tests == true
+         c_args: '-DRELOADTEST -DDEBUG')
+ endif
+ 
+-# RPM spec.
+-lxcfs_spec = custom_target(
+-    'lxcfs.spec',
+-    build_by_default: true,
+-    input: 'lxcfs.spec.in',
+-    output: 'lxcfs.spec',
+-    command: [
+-        meson_render_jinja2,
+-        config_h,
+-        '@INPUT@',
+-        '@OUTPUT@',
+-    ])
+-
+ # Man pages
+ if want_docs == true
+     help2man = find_program('help2man')
diff --git a/pkgs/os-specific/linux/lxcfs/pidfd.patch b/pkgs/os-specific/linux/lxcfs/pidfd.patch
new file mode 100644
index 0000000000000..3d9b6faa57f9e
--- /dev/null
+++ b/pkgs/os-specific/linux/lxcfs/pidfd.patch
@@ -0,0 +1,29 @@
+diff --git a/meson.build b/meson.build
+index a0289ad..211b01b 100644
+--- a/meson.build
++++ b/meson.build
+@@ -134,11 +134,13 @@ foreach ident: [
+      '''#include <stdlib.h>
+         #include <unistd.h>
+         #include <signal.h>
++        #include <sys/pidfd.h>
+         #include <sys/wait.h>'''],
+     ['pidfd_open',
+      '''#include <stdlib.h>
+         #include <unistd.h>
+         #include <signal.h>
++        #include <sys/pidfd.h>
+         #include <sys/wait.h>'''],
+ ]
+     have = cc.has_function(ident[0], prefix: ident[1], args: '-D_GNU_SOURCE')
+diff --git a/src/bindings.c b/src/bindings.c
+index 13259c1..e760330 100644
+--- a/src/bindings.c
++++ b/src/bindings.c
+@@ -1,5 +1,6 @@
+ /* SPDX-License-Identifier: LGPL-2.1+ */
+ 
++#include <sys/pidfd.h>
+ #include "config.h"
+ 
+ #include <dirent.h>
diff --git a/pkgs/os-specific/linux/lxcfs/skip-init.patch b/pkgs/os-specific/linux/lxcfs/skip-init.patch
new file mode 100644
index 0000000000000..6e7cdc90d706f
--- /dev/null
+++ b/pkgs/os-specific/linux/lxcfs/skip-init.patch
@@ -0,0 +1,12 @@
+diff --git a/meson.build b/meson.build
+index a0289ad..10c0a28 100644
+--- a/meson.build
++++ b/meson.build
+@@ -285,7 +285,6 @@ endif
+ 
+ 
+ # Include sub-directories.
+-subdir('config/init')
+ subdir('share')
+ subdir('tests')
+ 
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index 36d8a3b9c45f8..b0b7b4f6776c0 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -3,7 +3,6 @@
 , fetchFromGitLab
 , makeWrapper
 , pkg-config
-, rsync
 , libxslt
 , meson
 , ninja
@@ -69,7 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
     libxslt
     makeWrapper
     pkg-config
-    rsync
     glib
   ] ++ lib.optionals withIntrospection [
     gobject-introspection
@@ -138,7 +136,6 @@ stdenv.mkDerivation (finalAttrs: {
     # Our gobject-introspection patches make the shared library paths absolute
     # in the GIR files. When running tests, the library is not yet installed,
     # though, so we need to replace the absolute path with a local one during build.
-    # We are using a symlink that will be overwitten during installation.
     mkdir -p "$out/lib"
     ln -s "$PWD/libupower-glib/libupower-glib.so" "$out/lib/libupower-glib.so.3"
   '';
@@ -159,21 +156,28 @@ stdenv.mkDerivation (finalAttrs: {
     # meson rebuild during install and it is not used at runtime anyway.
     sed -Ei 's~#!.+/bin/python3~#!/usr/bin/python3~' \
       ../src/linux/integration-test.py
+
+    # Undo preCheck installation since DESTDIR hack expects outputs to not exist.
+    rm "$out/lib/libupower-glib.so.3"
+    rmdir "$out/lib" "$out"
   '';
 
   postInstall = ''
     # Move stuff from DESTDIR to proper location.
-    # We use rsync to merge the directories.
-    for dir in etc var; do
-        rsync --archive "$DESTDIR/$dir" "$out"
-        rm --recursive "$DESTDIR/$dir"
-    done
-    for o in out dev installedTests; do
-        rsync --archive "$DESTDIR/''${!o}" "$(dirname "''${!o}")"
-        rm --recursive "$DESTDIR/''${!o}"
+    for o in $(getAllOutputNames); do
+        # devdoc is created later by _multioutDocs hook.
+        if [[ "$o" = "devdoc" ]]; then continue; fi
+        mv "$DESTDIR''${!o}" "$(dirname "''${!o}")"
     done
-    # Ensure the DESTDIR is removed.
-    rmdir "$DESTDIR/nix/store" "$DESTDIR/nix" "$DESTDIR"
+
+    mv "$DESTDIR/var" "$out"
+    # The /etc already exist so we need to merge it.
+    cp --recursive "$DESTDIR/etc" "$out"
+    rm --recursive "$DESTDIR/etc"
+
+    # Ensure we did not forget to install anything.
+    rmdir --parents --ignore-fail-on-non-empty "$DESTDIR${builtins.storeDir}"
+    ! test -e "$DESTDIR"
   '';
 
   postFixup = ''
@@ -194,7 +198,7 @@ stdenv.mkDerivation (finalAttrs: {
     # at install time but Meson does not support this
     # so we need to convince it to install all files to a temporary
     # location using DESTDIR and then move it to proper one in postInstall.
-    DESTDIR = "${placeholder "out"}/dest";
+    DESTDIR = "dest";
   };
 
   passthru = {
diff --git a/pkgs/os-specific/linux/waydroid/default.nix b/pkgs/os-specific/linux/waydroid/default.nix
index e8e0727b8dbfa..97818ba9c4d49 100644
--- a/pkgs/os-specific/linux/waydroid/default.nix
+++ b/pkgs/os-specific/linux/waydroid/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , python3Packages
 , dnsmasq
 , gawk
@@ -12,24 +13,28 @@
 , iptables
 , util-linux
 , wrapGAppsHook
-, xclip
+, wl-clipboard
 , runtimeShell
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "waydroid";
-  version = "1.4.1";
+  version = "1.4.2";
   format = "other";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-0AkNzMIumvgnVcLKX72E2+Eg54Y9j7tdIYPsroOTLWA=";
+    sha256 = "sha256-/dFvhiK3nCOOmAtrYkQEB8Ge8Rf1ea5cDO7puTwS5bI=";
   };
 
-  buildInputs = [
-    gtk3
+  patches = [
+    # https://github.com/waydroid/waydroid/pull/1218
+    (fetchpatch {
+      url = "https://github.com/waydroid/waydroid/commit/595e0e5b309a79fedaa07d90b9073ddcb156314c.patch";
+      hash = "sha256-A+rUmJbFFhMZ5WpT+QBCTEcn82wJuvmi8Wbcsio41Nk=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -37,6 +42,10 @@ python3Packages.buildPythonApplication rec {
     wrapGAppsHook
   ];
 
+  buildInputs = [
+    gtk3
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     dbus-python
     gbinder-python
@@ -61,18 +70,15 @@ python3Packages.buildPythonApplication rec {
     wrapProgram $out/lib/waydroid/data/scripts/waydroid-net.sh \
       --prefix PATH ":" ${lib.makeBinPath [ dnsmasq getent iproute2 iptables ]}
 
-    wrapPythonProgramsIn $out/lib/waydroid/ "${lib.concatStringsSep " " [
+    wrapPythonProgramsIn $out/lib/waydroid/ "${lib.concatStringsSep " " ([
       "$out"
-      python3Packages.dbus-python
-      python3Packages.gbinder-python
-      python3Packages.pygobject3
-      python3Packages.pyclip
+    ] ++ propagatedBuildInputs ++ [
       gawk
       kmod
       lxc
       util-linux
-      xclip
-    ]}"
+      wl-clipboard
+    ])}"
 
     substituteInPlace $out/lib/waydroid/tools/helpers/*.py \
       --replace '"sh"' '"${runtimeShell}"'
diff --git a/pkgs/servers/audiobookshelf/default.nix b/pkgs/servers/audiobookshelf/default.nix
index 5ed446b8bbad4..127abe161a64c 100644
--- a/pkgs/servers/audiobookshelf/default.nix
+++ b/pkgs/servers/audiobookshelf/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  pkgs,
   fetchFromGitHub,
   runCommand,
   buildNpmPackage,
@@ -17,13 +16,13 @@ let
   nodejs = nodejs_18;
 
   pname = "audiobookshelf";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "advplyr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lifvfh9dF3Hbgm5NHrzS9zQdv+INSByNkqMWTxTpUMo=";
+    sha256 = "sha256-bRQ/GbUe+vsgYjSVf3jssoxGzgNeKG4BCDIhNJovAN8=";
   };
 
   client = buildNpmPackage {
@@ -37,7 +36,7 @@ let
     NODE_OPTIONS = "--openssl-legacy-provider";
 
     npmBuildScript = "generate";
-    npmDepsHash = "sha256-FxP1Kysx3ngk3napZ5uvKSabeOypBtA0kjhyAKpcdo8=";
+    npmDepsHash = "sha256-2E7Qy3Yew+j+eKKYJMV0SQ/LlJaIfOGm4MpxwP5Dn3Q=";
   };
 
   wrapper = import ./wrapper.nix {
@@ -52,7 +51,7 @@ in buildNpmPackage {
 
   dontNpmBuild = true;
   npmInstallFlags = [ "--only-production" ];
-  npmDepsHash = "sha256-NcurZee1Z8Rvm2UcjvckbdirfgiIkXMx9GKbr4x/HqE=";
+  npmDepsHash = "sha256-BZSRa/27oKm2rJoHFq8TpPzkX2CDO9zk5twtcMeo0cQ=";
 
   installPhase = ''
     mkdir -p $out/opt/client
@@ -69,6 +68,7 @@ in buildNpmPackage {
   meta = with lib; {
     homepage = "https://www.audiobookshelf.org/";
     description = "Self-hosted audiobook and podcast server";
+    changelog = "https://github.com/advplyr/audiobookshelf/releases/tag/v${version}";
     license = licenses.gpl3;
     maintainers = [ maintainers.jvanbruegge ];
     platforms = platforms.linux;
diff --git a/pkgs/servers/monitoring/buildkite-agent-metrics/default.nix b/pkgs/servers/monitoring/buildkite-agent-metrics/default.nix
index 67a1218d1bd16..bf1af9e944d7a 100644
--- a/pkgs/servers/monitoring/buildkite-agent-metrics/default.nix
+++ b/pkgs/servers/monitoring/buildkite-agent-metrics/default.nix
@@ -4,7 +4,7 @@
 }:
 buildGoModule rec {
   pname = "buildkite-agent-metrics";
-  version = "5.9.2";
+  version = "5.9.3";
 
   outputs = [ "out" "lambda" ];
 
@@ -12,10 +12,10 @@ buildGoModule rec {
     owner = "buildkite";
     repo = "buildkite-agent-metrics";
     rev = "v${version}";
-    hash = "sha256-JYpsQUIKTlQz1VUmPfTzvgh++0p3NAoa105mvGoqgt8=";
+    hash = "sha256-DepIptvR4i0+/45stCMErJtDeAFIDiNbhioitQ8gYBs=";
   };
 
-  vendorHash = "sha256-2EbZLLaddR7oWXb9H9E35foevp6gMbWfoymDf2lQuto=";
+  vendorHash = "sha256-YEvVGtfhe/RBeuD87C2BNOFEeK40JDidX4loSLdBwhs=";
 
   postInstall = ''
     mkdir -p $lambda/bin
diff --git a/pkgs/servers/monitoring/munin/default.nix b/pkgs/servers/monitoring/munin/default.nix
index bc99ae1f8f695..ad5c6e36a62e3 100644
--- a/pkgs/servers/monitoring/munin/default.nix
+++ b/pkgs/servers/monitoring/munin/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     perlPackages.Socket6
     perlPackages.URI
     perlPackages.DBFile
-    perlPackages.DateManip
+    perlPackages.TimeDate
     perlPackages.FileCopyRecursive
     perlPackages.FCGI
     perlPackages.NetSNMP
@@ -126,7 +126,7 @@ stdenv.mkDerivation rec {
         esac
         wrapProgram "$file" \
           --set PERL5LIB "$out/${perlPackages.perl.libPrefix}:${with perlPackages; makePerlPath [
-                LogLog4perl IOSocketINET6 Socket6 URI DBFile DateManip
+                LogLog4perl IOSocketINET6 Socket6 URI DBFile TimeDate
                 HTMLTemplate FileCopyRecursive FCGI NetCIDR NetSNMP NetServer
                 ListMoreUtils DBDPg LWP rrdtool
                 ]}"
diff --git a/pkgs/servers/sip/freeswitch/default.nix b/pkgs/servers/sip/freeswitch/default.nix
index 55721a38cd8bd..8174e85c3a439 100644
--- a/pkgs/servers/sip/freeswitch/default.nix
+++ b/pkgs/servers/sip/freeswitch/default.nix
@@ -104,12 +104,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "freeswitch";
-  version = "1.10.10";
+  version = "1.10.11";
   src = fetchFromGitHub {
     owner = "signalwire";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3Mm/hbMwnlwbtiOFlODtKItVyj34O3beZDlV8YoJmts=";
+    hash = "sha256-LzGqrXzPED3PoCDnrwUmmSQsvlAucYo2gTkwFausM7A=";
   };
 
   postPatch = ''
@@ -126,20 +126,6 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  ## TODO Validate with the next upstream release
-  patches = [
-    (fetchpatch {
-       name = "CVE-2023-44488.patch";
-       url = "https://github.com/signalwire/freeswitch/commit/f1fb05214e4f427dcf922f531431ab649cf0622b.patch";
-       hash = "sha256-6GMebE6O2EBx60NE2LSRVljaiLm9T4zTrkIpwGvaB08=";
-     })
-    (fetchpatch {
-       name = "CVE-2023-5217.patch";
-       url = "https://github.com/signalwire/freeswitch/commit/6f9e72c585265d8def8a613b36cd4f524c201980.patch";
-       hash = "sha256-l64mBpyq/TzRM78n73kbuD0UNsk5zIH5QNJlMKdPfr4=";
-     })
-  ];
-
   strictDeps = true;
   nativeBuildInputs = [ pkg-config autoreconfHook perl which yasm ];
   buildInputs = [
@@ -181,7 +167,7 @@ stdenv.mkDerivation rec {
     description = "Cross-Platform Scalable FREE Multi-Protocol Soft Switch";
     homepage = "https://freeswitch.org/";
     license = lib.licenses.mpl11;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ mikaelfangel ];
     platforms = with lib.platforms; unix;
     broken = stdenv.isDarwin;
   };
diff --git a/pkgs/servers/sunshine/default.nix b/pkgs/servers/sunshine/default.nix
index 1767b544f21ac..331770a565d5c 100644
--- a/pkgs/servers/sunshine/default.nix
+++ b/pkgs/servers/sunshine/default.nix
@@ -171,6 +171,7 @@ stdenv.mkDerivation rec {
     description = "Sunshine is a Game stream host for Moonlight";
     homepage = "https://github.com/LizardByte/Sunshine";
     license = licenses.gpl3Only;
+    mainProgram = "sunshine";
     maintainers = with maintainers; [ devusb ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/servers/uftp/default.nix b/pkgs/servers/uftp/default.nix
index 0da5257aee983..e2251e1a20c8f 100644
--- a/pkgs/servers/uftp/default.nix
+++ b/pkgs/servers/uftp/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "uftp";
-  version = "5.0.2";
+  version = "5.0.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/uftp-multicast/source-tar/uftp-${version}.tar.gz";
-    sha256 = "sha256-V8EqauWZQlNfteYgOBrt6xfVAAnucfI2QnziN6RsCxQ=";
+    sha256 = "sha256-y4ZowZsfELxjoW/6iT4gXcPshjYQN9R32AAyYOvEAIA=";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/servers/web-apps/changedetection-io/default.nix b/pkgs/servers/web-apps/changedetection-io/default.nix
index be97cf838e703..a162448e637e9 100644
--- a/pkgs/servers/web-apps/changedetection-io/default.nix
+++ b/pkgs/servers/web-apps/changedetection-io/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "changedetection-io";
-  version = "0.45.8.1";
+  version = "0.45.9";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "dgtlmoon";
     repo = "changedetection.io";
     rev = version;
-    hash = "sha256-DRbqWcbk9fwFp/gSCbAqEv8ZhWsOOnBBXCK8jXT5HdY=";
+    hash = "sha256-xiKXp9DBaiSteqZwQLZ4zLwT5MeETJx01rKRrWGYioc=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/admin/balena-cli/default.nix b/pkgs/tools/admin/balena-cli/default.nix
index bb674a83f3221..862fcf7aa0eb8 100644
--- a/pkgs/tools/admin/balena-cli/default.nix
+++ b/pkgs/tools/admin/balena-cli/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , buildNpmPackage
+, overrideSDK
 , fetchFromGitHub
 , testers
 , balena-cli
@@ -10,18 +11,23 @@
 , darwin
 }:
 
-buildNpmPackage rec {
+let
+  # Fix for: https://github.com/NixOS/nixpkgs/issues/272156
+  buildNpmPackage' = buildNpmPackage.override {
+    stdenv = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
+  };
+in buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "17.0.0";
+  version = "17.4.9";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-sNpxjSumiP+4fX6b3j+HEl/lr4pvudrhfTzr2TYastE=";
+    hash = "sha256-0TWG90OB7tovfj4PB0qAiwdOtMss5ZqjSycAb4Vz5+A=";
   };
 
-  npmDepsHash = "sha256-q2Yc6e5dEiP2Q4tFIeqj4mswM1/pX1pdGeoagyiupvs=";
+  npmDepsHash = "sha256-LSw/cNJ6kWYh477NAqLOx5bVZ6/qPoUM0V1Cksn7iDI=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json
diff --git a/pkgs/tools/filesystems/ceph-csi/default.nix b/pkgs/tools/filesystems/ceph-csi/default.nix
index c63eb034dfee1..d6b39ef68e4f0 100644
--- a/pkgs/tools/filesystems/ceph-csi/default.nix
+++ b/pkgs/tools/filesystems/ceph-csi/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "ceph-csi";
-  version = "3.10.0";
+  version = "3.10.1";
 
   nativeBuildInputs = [ go ];
   buildInputs = [ ceph ];
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     owner = "ceph";
     repo = "ceph-csi";
     rev = "v${version}";
-    sha256 = "sha256-k7eipiBcr/a2V62tEtiQrduk5Cj8KGxbmiVo4x6BVwE=";
+    sha256 = "sha256-S5jv9l/Oozv0NrEEf+Bik0jnaK4AYIChFm2pU2/DQow=";
   };
 
   preConfigure = ''
diff --git a/pkgs/tools/misc/mcfly/default.nix b/pkgs/tools/misc/mcfly/default.nix
index 127dd142a9f1a..675639a032941 100644
--- a/pkgs/tools/misc/mcfly/default.nix
+++ b/pkgs/tools/misc/mcfly/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mcfly";
-  version = "0.8.1";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "cantino";
     repo = "mcfly";
     rev = "v${version}";
-    hash = "sha256-9muBKJXsXiSxSmLRygGATEbwpiz6B8oTFQIkVMJMWAk=";
+    hash = "sha256-beoXLTy3XikdZBS0Lh3cugHflNJ51PbqsCE3xtCHpj0=";
   };
 
   postPatch = ''
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
     substituteInPlace mcfly.fish --replace '(command which mcfly)'  '${placeholder "out"}/bin/mcfly'
   '';
 
-  cargoHash = "sha256-LhIAJ3JI7cp+vzEH5vthefgExPORF6Xnjj3cQkIkhSA=";
+  cargoHash = "sha256-wWYpDU6oXT+sDCzX8VWJ6GfNPOi7T02LK0JKcWHFGi8=";
 
   meta = with lib; {
     homepage = "https://github.com/cantino/mcfly";
diff --git a/pkgs/tools/misc/ugs/default.nix b/pkgs/tools/misc/ugs/default.nix
index 395a9e42009c6..58c221ee9e84b 100644
--- a/pkgs/tools/misc/ugs/default.nix
+++ b/pkgs/tools/misc/ugs/default.nix
@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ugs";
-  version = "2.1.0";
+  version = "2.1.4";
 
   src = fetchzip {
     url = "https://github.com/winder/Universal-G-Code-Sender/releases/download/v${version}/UniversalGcodeSender.zip";
-    hash = "sha256-BH4oka2Ht4fGMD6/xy/MLBXNkJRggs4VQVG0UqmYQoI=";
+    hash = "sha256-2WGRHdxmGa2b8ca20xNJoA0NAY9a0pngzdf94ROfirk=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/misc/url-parser/default.nix b/pkgs/tools/misc/url-parser/default.nix
index ae74dc7396f2b..8a4e34c8187a4 100644
--- a/pkgs/tools/misc/url-parser/default.nix
+++ b/pkgs/tools/misc/url-parser/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "url-parser";
-  version = "1.0.6";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "thegeeklab";
     repo = "url-parser";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YZAcu1TDPTE2vLA9vQNWHhGIRQs4hkGAmz/zi27n0H0=";
+    hash = "sha256-g4fpyzDgIf/4kBAfNxLst0KKa+vNSCryljFAW1j8wmc=";
   };
 
-  vendorHash = "sha256-8doDVHyhQKsBeN1H73KV/rxhpumDLIzjahdjtW79Bek=";
+  vendorHash = "sha256-HOlX8oHktbgnbPkRf9iUMCUpGlbcQwusMMcHJJl2nOs=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/networking/snowflake/default.nix b/pkgs/tools/networking/snowflake/default.nix
index 071305f951cf6..137e2f3087c00 100644
--- a/pkgs/tools/networking/snowflake/default.nix
+++ b/pkgs/tools/networking/snowflake/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "snowflake";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "anti-censorship/pluggable-transports";
     repo = "snowflake";
     rev = "v${version}";
-    sha256 = "sha256-/bip6hjYDTcSdtqeHxWcH7Yn4VepGVy3ki/kZWEQaPE=";
+    sha256 = "sha256-DSXzw/7aBfh4uqLV2JrbrLitNgXcgEdcwxyIMolGEsE=";
   };
 
-  vendorHash = "sha256-dpOJE6FHaumL6vapigLTobS1r42DIFV8LHfVNvyZnsU=";
+  vendorHash = "sha256-+f7gxswHCzBT5wqJNYdR1/uDZJNpEyHMWchA4X0aK+M=";
 
   meta = with lib; {
     description = "System to defeat internet censorship";
diff --git a/pkgs/tools/security/aws-iam-authenticator/default.nix b/pkgs/tools/security/aws-iam-authenticator/default.nix
index 046f173ce1000..8ea3c543b4ea1 100644
--- a/pkgs/tools/security/aws-iam-authenticator/default.nix
+++ b/pkgs/tools/security/aws-iam-authenticator/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "aws-iam-authenticator";
-  version = "0.6.14";
+  version = "0.6.16";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-NWYTOHqeCxIgKvslezHAZT1GastWcbavWdfmY6KlbXc=";
+    hash = "sha256-E/DkCDtnzI6yBEYemlLqxc1r8ZEuX+6jDefaZTRFRek=";
   };
 
   vendorHash = "sha256-TDsY05jnutNIKx0z6/8vGvsgYCIKBkTxh9mXqk4IR38=";
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 8f61c00e27b07..ac6577ceed928 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.63.5";
+  version = "3.63.7";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-x/SYiOukZZ5CIUWc8/pgvCQjSpsIQmPFP1x3e4/uJFM=";
+    hash = "sha256-RI2lNlPlc49E2Z88hEAQzvuXzz62ROsFpp1a9YjNd6I=";
   };
 
   vendorHash = "sha256-oZkrRaThXwBORoib1GIW7CUF5RGZJ5d/Jd6YM4z3ZIA=";
diff --git a/pkgs/tools/system/supercronic/default.nix b/pkgs/tools/system/supercronic/default.nix
index 6b2b4ef5c43ab..745202ce15c52 100644
--- a/pkgs/tools/system/supercronic/default.nix
+++ b/pkgs/tools/system/supercronic/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "supercronic";
-  version = "0.2.27";
+  version = "0.2.29";
 
   src = fetchFromGitHub {
     owner = "aptible";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-sgKvE8Ze2qKPgdaAwN1sB0wX7k5VRx8+llkT54xXvrM=";
+    hash = "sha256-cYKVeWZEjWV5j68aTpBOE/z+5QcMBh5ovyXoV/u80o4=";
   };
 
-  vendorHash = "sha256-j1iduvu+dKmhvPN8pe50fGQU5cC9N3gfoMh9gSQDbf8=";
+  vendorHash = "sha256-uQFceysbRdcSaFvdfdFcJX6yzPWE26YYiVzAEISQeCc=";
 
   excludedPackages = [ "cronexpr/cronexpr" ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 44c003f6e6348..1df907e7425d0 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -592,7 +592,7 @@ mapAliases ({
   matrique = spectral; # Added 2020-01-27
   matrix-recorder = throw "matrix-recorder has been removed due to being unmaintained"; # Added 2023-05-21
   maui-nota = libsForQt5.mauiPackages.nota; # added 2022-05-17
-  mbox = throw "'mobx' has been removed, as it was broken and unmaintained"; # Added 2023-12-21
+  mbox = throw "'mbox' has been removed, as it was broken and unmaintained"; # Added 2023-12-21
   mcomix3 = mcomix; # Added 2022-06-05
   meme = meme-image-generator; # Added 2021-04-21
   mess = throw "'mess' has been renamed to/replaced by 'mame'"; # Converted to throw 2023-09-10
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f5dca0f74c0aa..a4b6f26ea8f50 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5748,6 +5748,8 @@ with pkgs;
 
   hyprshade = python311Packages.callPackage ../applications/window-managers/hyprwm/hyprshade { };
 
+  hyprlandPlugins = recurseIntoAttrs (callPackage ../applications/window-managers/hyprwm/hyprland/plugins.nix { });
+
   hysteria = callPackage ../tools/networking/hysteria { };
 
   hyx = callPackage ../tools/text/hyx { };
@@ -32507,8 +32509,6 @@ with pkgs;
 
   huggle = libsForQt5.callPackage ../applications/misc/huggle { };
 
-  hugo = callPackage ../applications/misc/hugo { };
-
   ghosttohugo = callPackage ../applications/misc/ghosttohugo {};
 
   gatekeeper = callPackage ../applications/networking/cluster/gatekeeper { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index de25d7cff684f..059faf960bb22 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3098,6 +3098,8 @@ self: super: with self; {
 
   django-maintenance-mode = callPackage ../development/python-modules/django-maintenance-mode { };
 
+  django-mdeditor = callPackage ../development/python-modules/django-mdeditor { };
+
   django-mptt = callPackage ../development/python-modules/django-mptt { };
 
   django-mysql = callPackage ../development/python-modules/django-mysql { };