about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--lib/licenses.nix5
-rw-r--r--maintainers/maintainer-list.nix18
-rw-r--r--maintainers/team-list.nix2
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md2
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/misc/gitlab.nix46
-rw-r--r--nixos/modules/services/networking/clatd.nix82
-rw-r--r--nixos/modules/system/boot/loader/grub/grub.nix5
-rw-r--r--nixos/modules/virtualisation/podman/default.nix10
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/clatd.nix189
-rw-r--r--pkgs/applications/blockchains/bitcoin-abc/default.nix4
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix2
-rw-r--r--pkgs/applications/emulators/craftos-pc/default.nix10
-rw-r--r--pkgs/applications/misc/urlscan/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/opentofu/default.nix8
-rw-r--r--pkgs/applications/office/clockify/default.nix45
-rw-r--r--pkgs/applications/radio/gnuradio/wrapper.nix4
-rw-r--r--pkgs/applications/radio/uhd/default.nix145
-rw-r--r--pkgs/applications/science/electronics/digital/default.nix21
-rw-r--r--pkgs/applications/terminal-emulators/tym/default.nix4
-rw-r--r--pkgs/applications/version-management/git-vanity-hash/default.nix15
-rw-r--r--pkgs/applications/window-managers/jay/default.nix29
-rw-r--r--pkgs/by-name/br/broom/package.nix28
-rw-r--r--pkgs/by-name/bu/butt/package.nix4
-rw-r--r--pkgs/by-name/cl/clatd/package.nix3
-rw-r--r--pkgs/by-name/dp/dps8m/package.nix47
-rw-r--r--pkgs/by-name/gp/gptscript/package.nix13
-rw-r--r--pkgs/by-name/hu/hugo/package.nix4
-rw-r--r--pkgs/by-name/ji/jikken/package.nix43
-rw-r--r--pkgs/by-name/jt/jtdx/package.nix16
-rw-r--r--pkgs/by-name/kc/kcl-cli/package.nix6
-rw-r--r--pkgs/by-name/mo/movim/package.nix14
-rw-r--r--pkgs/by-name/nx/nxengine-evo/assets.nix37
-rw-r--r--pkgs/by-name/nx/nxengine-evo/package.nix92
-rw-r--r--pkgs/by-name/pa/paper-age/package.nix6
-rw-r--r--pkgs/by-name/sa/sabnzbd/package.nix (renamed from pkgs/servers/sabnzbd/default.nix)5
-rw-r--r--pkgs/by-name/ti/tinymist/Cargo.lock8
-rw-r--r--pkgs/by-name/ti/tinymist/package.nix4
-rw-r--r--pkgs/by-name/tr/trak/package.nix34
-rw-r--r--pkgs/by-name/uc/ucblogo/package.nix44
-rw-r--r--pkgs/by-name/xh/xhosts/Cargo.lock67
-rw-r--r--pkgs/by-name/xh/xhosts/package.nix34
-rw-r--r--pkgs/development/libraries/libdatachannel/default.nix4
-rw-r--r--pkgs/development/libraries/libmcfp/default.nix4
-rw-r--r--pkgs/development/libraries/quarto/default.nix4
-rw-r--r--pkgs/development/python-modules/ailment/default.nix4
-rw-r--r--pkgs/development/python-modules/aiomysensors/default.nix43
-rw-r--r--pkgs/development/python-modules/aiowinreg/default.nix30
-rw-r--r--pkgs/development/python-modules/angr/default.nix4
-rw-r--r--pkgs/development/python-modules/archinfo/default.nix4
-rw-r--r--pkgs/development/python-modules/boto3-stubs/default.nix4
-rw-r--r--pkgs/development/python-modules/chromadb/default.nix113
-rw-r--r--pkgs/development/python-modules/claripy/default.nix4
-rw-r--r--pkgs/development/python-modules/cle/default.nix6
-rw-r--r--pkgs/development/python-modules/elkm1-lib/default.nix41
-rw-r--r--pkgs/development/python-modules/fastpair/default.nix42
-rw-r--r--pkgs/development/python-modules/ldfparser/default.nix37
-rw-r--r--pkgs/development/python-modules/linknlink/default.nix29
-rw-r--r--pkgs/development/python-modules/llama-index-core/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-llms-ollama/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-vector-stores-chroma/default.nix4
-rw-r--r--pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix4
-rw-r--r--pkgs/development/python-modules/mplhep/default.nix4
-rw-r--r--pkgs/development/python-modules/msoffcrypto-tool/default.nix43
-rw-r--r--pkgs/development/python-modules/nebula3-python/default.nix4
-rw-r--r--pkgs/development/python-modules/polyswarm-api/default.nix47
-rw-r--r--pkgs/development/python-modules/psd-tools/default.nix4
-rw-r--r--pkgs/development/python-modules/python-motionmount/default.nix4
-rw-r--r--pkgs/development/python-modules/pyvex/default.nix4
-rw-r--r--pkgs/development/python-modules/safetensors/default.nix6
-rw-r--r--pkgs/development/tools/analysis/cargo-tarpaulin/default.nix6
-rw-r--r--pkgs/development/tools/dive/default.nix14
-rw-r--r--pkgs/development/tools/language-servers/zls/default.nix13
-rw-r--r--pkgs/development/tools/language-servers/zls/deps.nix19
-rw-r--r--pkgs/development/tools/misc/terser/default.nix6
-rw-r--r--pkgs/development/tools/spring-boot-cli/default.nix4
-rw-r--r--pkgs/development/tools/typos/default.nix6
-rw-r--r--pkgs/games/nxengine-evo/default.nix68
-rw-r--r--pkgs/os-specific/darwin/rectangle/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json32
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--pkgs/servers/monitoring/mackerel-agent/default.nix6
-rw-r--r--pkgs/servers/tailscale/default.nix10
-rw-r--r--pkgs/tools/admin/clair/default.nix6
-rw-r--r--pkgs/tools/misc/tbls/default.nix6
-rw-r--r--pkgs/tools/misc/tlp/default.nix1
-rw-r--r--pkgs/tools/misc/upterm/default.nix6
-rw-r--r--pkgs/tools/system/consul-template/default.nix6
-rw-r--r--pkgs/top-level/all-packages.nix8
-rw-r--r--pkgs/top-level/perl-packages.nix64
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix2
93 files changed, 1324 insertions, 634 deletions
diff --git a/lib/licenses.nix b/lib/licenses.nix
index 49c7a4a353ecb..7d2a22bc25a47 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -632,6 +632,11 @@ in mkLicense lset) ({
     url = "https://old.calculate-linux.org/packages/licenses/iASL";
   };
 
+  icu = {
+    spdxId = "ICU";
+    fullName = "ICU";
+  };
+
   ijg = {
     spdxId = "IJG";
     fullName = "Independent JPEG Group License";
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b3fa7d35bd4fc..50736f0f27801 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -429,6 +429,12 @@
     githubId = 1517066;
     name = "Aiken Cairncross";
   };
+  a-camarillo = {
+    name = "Anthony Camarillo";
+    email = "anthony.camarillo.96@gmail.com";
+    github = "a-camarillo";
+    githubId = 58638902;
+  };
   aciceri = {
     name = "Andrea Ciceri";
     email = "andrea.ciceri@autistici.org";
@@ -2943,6 +2949,12 @@
       fingerprint = "BF4FCB85C69989B4ED95BF938AE74787A4B7C07E";
     }];
   };
+  b-rodrigues = {
+    email = "bruno@brodrigues.co";
+    github = "b-rodrigues";
+    githubId = 2998834;
+    name = "Bruno Rodrigues";
+  };
   broke = {
     email = "broke@in-fucking.space";
     github = "broke";
@@ -3018,6 +3030,12 @@
     githubId = 37375448;
     name = "Buildit";
   };
+  buurro = {
+    email = "marcoburro98@gmail.com";
+    github = "buurro";
+    githubId = 9320677;
+    name = "Marco Burro";
+  };
   bwc9876 = {
     email = "bwc9876@gmail.com";
     github = "Bwc9876";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 08aa297a7c109..96ab9d94a1696 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -854,8 +854,10 @@ with lib.maintainers; {
 
   r = {
     members = [
+      b-rodrigues
       bcdarwin
       jbedo
+      kupac
     ];
     scope = "Maintain the R programming language and related packages.";
     shortName = "R";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index bc814ad305055..e3880d3deec53 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -92,6 +92,8 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 
 - [PhotonVision](https://photonvision.org/), a free, fast, and easy-to-use computer vision solution for the FIRST® Robotics Competition.
 
+- [clatd](https://github.com/toreanderson/clatd), a a CLAT / SIIT-DC Edge Relay implementation for Linux.
+
 - [pyLoad](https://pyload.net/), a FOSS download manager written in Python. Available as [services.pyload](#opt-services.pyload.enable)
 
 - [maubot](https://github.com/maubot/maubot), a plugin-based Matrix bot framework. Available as [services.maubot](#opt-services.maubot.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 90a2170349e93..111b5c129cb3c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -946,6 +946,7 @@
   ./services/networking/charybdis.nix
   ./services/networking/chisel-server.nix
   ./services/networking/cjdns.nix
+  ./services/networking/clatd.nix
   ./services/networking/cloudflare-dyndns.nix
   ./services/networking/cloudflared.nix
   ./services/networking/cntlm.nix
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 43568f29dd376..7b96a182f0d94 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -18,6 +18,8 @@ let
   gitalySocket = "${cfg.statePath}/tmp/sockets/gitaly.socket";
   pathUrlQuote = url: replaceStrings ["/"] ["%2F"] url;
 
+  gitlabVersionAtLeast = version: lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) version;
+
   databaseConfig = let
     val = {
       adapter = "postgresql";
@@ -27,10 +29,16 @@ let
       encoding = "utf8";
       pool = cfg.databasePool;
     } // cfg.extraDatabaseConfig;
-  in if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.0" then {
-    production.main = val;
-  } else {
-    production = val;
+  in {
+    production = (
+      if (gitlabVersionAtLeast "15.0")
+      then { main = val; }
+      else val
+    ) // lib.optionalAttrs (gitlabVersionAtLeast "15.9") {
+      ci = val // {
+        database_tasks = false;
+      };
+    };
   };
 
   # We only want to create a database if we're actually going to connect to it.
@@ -1168,7 +1176,7 @@ in {
         set -eu
 
         PSQL() {
-            psql --port=${toString pgsql.port} "$@"
+            psql --port=${toString pgsql.settings.port} "$@"
         }
 
         PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
@@ -1348,7 +1356,7 @@ in {
 
             rm -f '${cfg.statePath}/config/database.yml'
 
-            ${if cfg.databasePasswordFile != null then ''
+            ${lib.optionalString (cfg.databasePasswordFile != null) ''
                 db_password="$(<'${cfg.databasePasswordFile}')"
                 export db_password
 
@@ -1356,16 +1364,24 @@ in {
                   >&2 echo "Database password was an empty string!"
                   exit 1
                 fi
+            ''}
 
-                jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
-                   '.${if lib.versionAtLeast (lib.getVersion cfg.packages.gitlab) "15.0" then "production.main" else "production"}.password = $ENV.db_password' \
-                   >'${cfg.statePath}/config/database.yml'
-              ''
-              else ''
-                jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
-                   >'${cfg.statePath}/config/database.yml'
-              ''
-            }
+            # GitLab expects the `production.main` section to be the first entry in the file.
+            jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} '{
+              production: [
+                ${lib.optionalString (cfg.databasePasswordFile != null) (
+                  builtins.concatStringsSep "\n      " (
+                    [ ".production${lib.optionalString (gitlabVersionAtLeast "15.0") ".main"}.password = $ENV.db_password" ]
+                    ++ lib.optional (gitlabVersionAtLeast "15.9") "| .production.ci.password = $ENV.db_password"
+                    ++ [ "|" ]
+                  )
+                )} .production
+                | to_entries[]
+              ]
+              | sort_by(.key)
+              | reverse
+              | from_entries
+            }' >'${cfg.statePath}/config/database.yml'
 
             ${utils.genJqSecretsReplacementSnippet
                 gitlabConfig
diff --git a/nixos/modules/services/networking/clatd.nix b/nixos/modules/services/networking/clatd.nix
new file mode 100644
index 0000000000000..76e0c130ca466
--- /dev/null
+++ b/nixos/modules/services/networking/clatd.nix
@@ -0,0 +1,82 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.services.clatd;
+
+  settingsFormat = pkgs.formats.keyValue {};
+
+  configFile = settingsFormat.generate "clatd.conf" cfg.settings;
+in
+{
+  options = {
+    services.clatd = {
+      enable = mkEnableOption "clatd";
+
+      package = mkPackageOption pkgs "clatd" { };
+
+      settings = mkOption {
+        type = types.submodule ({ name, ... }: {
+          freeformType = settingsFormat.type;
+        });
+        default = { };
+        example = literalExpression ''
+          {
+            plat-prefix = "64:ff9b::/96";
+          }
+        '';
+        description = ''
+          Configuration of clatd. See [clatd Documentation](https://github.com/toreanderson/clatd/blob/master/README.pod#configuration).
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.clatd = {
+      description = "464XLAT CLAT daemon";
+      documentation = [ "man:clatd(8)" ];
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      startLimitIntervalSec = 0;
+
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/clatd -c ${configFile}";
+        startLimitIntervalSec = 0;
+
+        # Hardening
+        CapabilityBoundingSet = [
+          "CAP_NET_ADMIN"
+        ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectProc = "invisible";
+        ProtectSystem = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@network-io"
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+      };
+    };
+  };
+}
diff --git a/nixos/modules/system/boot/loader/grub/grub.nix b/nixos/modules/system/boot/loader/grub/grub.nix
index fe340cfaedb67..9c36651d68747 100644
--- a/nixos/modules/system/boot/loader/grub/grub.nix
+++ b/nixos/modules/system/boot/loader/grub/grub.nix
@@ -6,7 +6,6 @@ let
     concatMap
     concatMapStrings
     concatStrings
-    concatStringsSep
     escapeShellArg
     flip
     foldr
@@ -491,10 +490,10 @@ in
 
       theme = mkOption {
         type = types.nullOr types.path;
-        example = literalExpression "pkgs.nixos-grub2-theme";
+        example = literalExpression ''"''${pkgs.libsForQt5.breeze-grub}/grub/themes/breeze"'';
         default = null;
         description = ''
-          Grub theme to be used.
+          Path to the grub theme to be used.
         '';
       };
 
diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
index 4b1b67ac9444e..deb0b4d2c5bd7 100644
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -219,6 +219,11 @@ in
       systemd.services.podman.environment = config.networking.proxy.envVars;
       systemd.sockets.podman.wantedBy = [ "sockets.target" ];
       systemd.sockets.podman.socketConfig.SocketGroup = "podman";
+      # Podman does not support multiple sockets, as of podman 5.0.2, so we use
+      # a symlink. Unfortunately this does not let us use an alternate group,
+      # such as `docker`.
+      systemd.sockets.podman.socketConfig.Symlinks =
+        lib.mkIf cfg.dockerSocket.enable [ "/run/docker.sock" ];
 
       systemd.user.services.podman.environment = config.networking.proxy.envVars;
       systemd.user.sockets.podman.wantedBy = [ "sockets.target" ];
@@ -239,11 +244,6 @@ in
         '')
       ];
 
-      systemd.tmpfiles.rules =
-        lib.optionals cfg.dockerSocket.enable [
-          "L! /run/docker.sock - - - - /run/podman/podman.sock"
-        ];
-
       users.groups.podman = { };
 
       assertions = [
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 8de741a7c9c98..d4da32c44990f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -193,6 +193,7 @@ in {
   cinnamon = handleTest ./cinnamon.nix {};
   cinnamon-wayland = handleTest ./cinnamon-wayland.nix {};
   cjdns = handleTest ./cjdns.nix {};
+  clatd = handleTest ./clatd.nix {};
   clickhouse = handleTest ./clickhouse.nix {};
   cloud-init = handleTest ./cloud-init.nix {};
   cloud-init-hostname = handleTest ./cloud-init-hostname.nix {};
diff --git a/nixos/tests/clatd.nix b/nixos/tests/clatd.nix
new file mode 100644
index 0000000000000..00021d87ba5f4
--- /dev/null
+++ b/nixos/tests/clatd.nix
@@ -0,0 +1,189 @@
+# This test verifies that we can ping an IPv4-only server from an IPv6-only
+# client via a NAT64 router using CLAT on the client. The hosts and networks
+# are configured as follows:
+#
+#        +------
+# Client | clat    Address: 192.0.0.1/32  (configured via clatd)
+#        |         Route:   default
+#        |
+#        | eth1    Address: 2001:db8::2/64
+#        |  |      Route:   default via 2001:db8::1
+#        +--|---
+#           | VLAN 3
+#        +--|---
+#        | eth2    Address: 2001:db8::1/64
+# Router |
+#        | nat64   Address: 64:ff9b::1/128
+#        |         Route:   64:ff9b::/96
+#        |         Address: 192.0.2.0/32
+#        |         Route:   192.0.2.0/24
+#        |
+#        | eth1    Address: 100.64.0.1/24
+#        +--|---
+#           | VLAN 2
+#        +--|---
+# Server | eth1    Address: 100.64.0.2/24
+#        |         Route:   192.0.2.0/24 via 100.64.0.1
+#        +------
+
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+
+{
+  name = "clatd";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ hax404 ];
+  };
+
+  nodes = {
+    # The server is configured with static IPv4 addresses. RFC 6052 Section 3.1
+    # disallows the mapping of non-global IPv4 addresses like RFC 1918 into the
+    # Well-Known Prefix 64:ff9b::/96. TAYGA also does not allow the mapping of
+    # documentation space (RFC 5737). To circumvent this, 100.64.0.2/24 from
+    # RFC 6589 (Carrier Grade NAT) is used here.
+    # To reach the IPv4 address pool of the NAT64 gateway, there is a static
+    # route configured. In normal cases, where the router would also source NAT
+    # the pool addresses to one IPv4 addresses, this would not be needed.
+    server = {
+      virtualisation.vlans = [
+        2 # towards router
+      ];
+      networking = {
+        useDHCP = false;
+        interfaces.eth1 = lib.mkForce {};
+      };
+      systemd.network = {
+        enable = true;
+        networks."vlan1" = {
+          matchConfig.Name = "eth1";
+          address = [
+            "100.64.0.2/24"
+          ];
+          routes = [
+            { routeConfig = { Destination = "192.0.2.0/24"; Gateway = "100.64.0.1"; }; }
+          ];
+        };
+      };
+    };
+
+    # The router is configured with static IPv4 addresses towards the server
+    # and IPv6 addresses towards the client. For NAT64, the Well-Known prefix
+    # 64:ff9b::/96 is used. NAT64 is done with TAYGA which provides the
+    # tun-interface nat64 and does the translation over it. The IPv6 packets
+    # are sent to this interfaces and received as IPv4 packets and vice versa.
+    # As TAYGA only translates IPv6 addresses to dedicated IPv4 addresses, it
+    # needs a pool of IPv4 addresses which must be at least as big as the
+    # expected amount of clients. In this test, the packets from the pool are
+    # directly routed towards the client. In normal cases, there would be a
+    # second source NAT44 to map all clients behind one IPv4 address.
+    router = {
+      boot.kernel.sysctl = {
+        "net.ipv4.ip_forward" = 1;
+        "net.ipv6.conf.all.forwarding" = 1;
+      };
+
+      virtualisation.vlans = [
+        2 # towards server
+        3 # towards client
+      ];
+
+      networking = {
+        useDHCP = false;
+        useNetworkd = true;
+        firewall.enable = false;
+        interfaces.eth1 = lib.mkForce {
+          ipv4 = {
+            addresses = [ { address = "100.64.0.1"; prefixLength = 24; } ];
+          };
+        };
+        interfaces.eth2 = lib.mkForce {
+          ipv6 = {
+            addresses = [ { address = "2001:db8::1"; prefixLength = 64; } ];
+          };
+        };
+      };
+
+      services.tayga = {
+        enable = true;
+        ipv4 = {
+          address = "192.0.2.0";
+          router = {
+            address = "192.0.2.1";
+          };
+          pool = {
+            address = "192.0.2.0";
+            prefixLength = 24;
+          };
+        };
+        ipv6 = {
+          address = "2001:db8::1";
+          router = {
+            address = "64:ff9b::1";
+          };
+          pool = {
+            address = "64:ff9b::";
+            prefixLength = 96;
+          };
+        };
+      };
+    };
+
+    # The client is configured with static IPv6 addresses. It has also a static
+    # default route towards the router. To reach the IPv4-only server, the
+    # client starts the clat daemon which starts and configures the local
+    # IPv4 -> IPv6 translation via Tayga.
+    client = {
+      virtualisation.vlans = [
+        3 # towards router
+      ];
+
+      networking = {
+        useDHCP = false;
+        interfaces.eth1 = lib.mkForce {};
+      };
+
+      systemd.network = {
+        enable = true;
+        networks."vlan1" = {
+          matchConfig.Name = "eth1";
+          address = [
+            "2001:db8::2/64"
+          ];
+          routes = [
+            { routeConfig = { Destination = "::/0"; Gateway = "2001:db8::1"; }; }
+          ];
+        };
+      };
+
+      services.clatd = {
+        enable = true;
+        settings.plat-prefix = "64:ff9b::/96";
+      };
+
+      environment.systemPackages = [ pkgs.mtr ];
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    # wait for all machines to start up
+    for machine in client, router, server:
+      machine.wait_for_unit("network-online.target")
+
+    with subtest("Wait for tayga and clatd"):
+      router.wait_for_unit("tayga.service")
+      client.wait_for_unit("clatd.service")
+      # clatd checks if this system has IPv4 connectivity for 10 seconds
+      client.wait_until_succeeds(
+        'journalctl -u clatd -e | grep -q "Starting up TAYGA, using config file"'
+      )
+
+    with subtest("Test ICMP"):
+      client.wait_until_succeeds("ping -c 3 100.64.0.2 >&2")
+
+    with subtest("Test ICMP and show a traceroute"):
+      client.wait_until_succeeds("mtr --show-ips --report-wide 100.64.0.2 >&2")
+
+    client.log(client.execute("systemd-analyze security clatd.service")[1])
+  '';
+})
diff --git a/pkgs/applications/blockchains/bitcoin-abc/default.nix b/pkgs/applications/blockchains/bitcoin-abc/default.nix
index 1cc43a059e204..948645d60006b 100644
--- a/pkgs/applications/blockchains/bitcoin-abc/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-abc/default.nix
@@ -25,13 +25,13 @@
 
 mkDerivation rec {
   pname = "bitcoin" + lib.optionalString (!withGui) "d" + "-abc";
-  version = "0.29.2";
+  version = "0.29.3";
 
   src = fetchFromGitHub {
     owner = "bitcoin-ABC";
     repo = "bitcoin-abc";
     rev = "v${version}";
-    hash = "sha256-og9hMQdDXGdUQN+A+z0064E6svF+qPd9CWtDQsdvNYQ=";
+    hash = "sha256-hYA0O7nDT8J1EnpW4i1+eBzkNw77JC6M7GwO3BdBh3U=";
   };
 
   nativeBuildInputs = [ pkg-config cmake ];
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index cfb14bd2cfe73..260711bd4880b 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -970,7 +970,7 @@ let
             version = "0.8.25";
           }
           // sources.${stdenv.system};
-        nativeBuildInputs = [ autoPatchelfHook ];
+        nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
         buildInputs = [ stdenv.cc.cc.lib ];
         meta = {
           description = "Open-source autopilot for software development - bring the power of ChatGPT to your IDE";
diff --git a/pkgs/applications/emulators/craftos-pc/default.nix b/pkgs/applications/emulators/craftos-pc/default.nix
index 12c86c3680f83..9ad54f00d4e8e 100644
--- a/pkgs/applications/emulators/craftos-pc/default.nix
+++ b/pkgs/applications/emulators/craftos-pc/default.nix
@@ -1,10 +1,8 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , callPackage
 , patchelf
-, unzip
 , poco
 , openssl
 , SDL2
@@ -16,18 +14,18 @@
 }:
 
 let
-  version = "2.8.1";
+  version = "2.8.2";
   craftos2-lua = fetchFromGitHub {
     owner = "MCJack123";
     repo = "craftos2-lua";
     rev = "v${version}";
-    hash = "sha256-8bl83AOIWtUQ06F2unYEF08VT13o9EGo9YDZpdNxd8w=";
+    hash = "sha256-Kv0supnYKWLaVqOeZAzQNd3tQRP2KJugZqytyoj8QtY=";
   };
   craftos2-rom = fetchFromGitHub {
     owner = "McJack123";
     repo = "craftos2-rom";
     rev = "v${version}";
-    hash = "sha256-aCRJ3idSrRM8ydt8hP8nA1RR0etPnWpQKphXcOGgTfk=";
+    hash = "sha256-5ZsLsqrkO02NLJCzsgf0k/ifsqNybTi4DcB9GLmWDHw=";
   };
 in
 
@@ -39,7 +37,7 @@ stdenv.mkDerivation rec {
     owner = "MCJack123";
     repo = "craftos2";
     rev = "v${version}";
-    hash = "sha256-iQCv4EDdqmnU0fYxMwpCZ2Z5p43P0MGBNIG/dZrWndg=";
+    hash = "sha256-ozebHgUgwdqYtWAyL+EdwpjEvZC+PkWcLYCPWz2FjSw=";
   };
 
   buildInputs = [ patchelf poco openssl SDL2 SDL2_mixer ncurses libpng pngpp libwebp ];
diff --git a/pkgs/applications/misc/urlscan/default.nix b/pkgs/applications/misc/urlscan/default.nix
index 3715ef27524e9..2247344ba765a 100644
--- a/pkgs/applications/misc/urlscan/default.nix
+++ b/pkgs/applications/misc/urlscan/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "urlscan";
-  version = "1.0.1";
+  version = "1.0.2";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "firecat53";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-OzcoOIgEiadWrsUPIxBJTuZQYjScJBYKyqCu1or6fz8=";
+    hash = "sha256-nyq4BrpfbZwK/nOnB8ZEN1wlM8CssYVRvV7ytpX7k40=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/applications/networking/cluster/opentofu/default.nix b/pkgs/applications/networking/cluster/opentofu/default.nix
index a378a7486b713..2d9b07a3f88dc 100644
--- a/pkgs/applications/networking/cluster/opentofu/default.nix
+++ b/pkgs/applications/networking/cluster/opentofu/default.nix
@@ -14,22 +14,22 @@
 let
   package =  buildGoModule rec {
     pname = "opentofu";
-    version = "1.6.2";
+    version = "1.7.0";
 
     src = fetchFromGitHub {
       owner = "opentofu";
       repo = "opentofu";
       rev = "v${version}";
-      hash = "sha256-CYiwn2NDIAx30J8tmbrV45dbCIGoA3U+yBdMj4RX5Ho=";
+      hash = "sha256-e0u8aFua3oMsBafwRPYuWQ9M6DtC7f9LlCDGJ5vdAWE=";
     };
 
-    vendorHash = "sha256-kSm5RZqQRgbmPaKt5IWmuMhHwAu+oJKTX1q1lbE7hWk=";
+    vendorHash = "sha256-cML742FfWFNIwGyIdRd3JWcfDlOXnJVgUXz4j5fa74Q=";
     ldflags = [ "-s" "-w" "-X" "github.com/opentofu/opentofu/version.dev=no" ];
 
     postConfigure = ''
       # speakeasy hardcodes /bin/stty https://github.com/bgentry/speakeasy/issues/22
       substituteInPlace vendor/github.com/bgentry/speakeasy/speakeasy_unix.go \
-        --replace "/bin/stty" "${coreutils}/bin/stty"
+        --replace-fail "/bin/stty" "${coreutils}/bin/stty"
     '';
 
     nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/applications/office/clockify/default.nix b/pkgs/applications/office/clockify/default.nix
index efd20632a2a31..7b2faa6b7d203 100644
--- a/pkgs/applications/office/clockify/default.nix
+++ b/pkgs/applications/office/clockify/default.nix
@@ -1,40 +1,27 @@
-{ stdenv, lib, fetchurl, dpkg, makeWrapper, electron }:
+{ lib
+, appimageTools
+, fetchurl }:
 
-stdenv.mkDerivation rec {
+appimageTools.wrapType2 rec {
   pname = "clockify";
-  version = "2.1.6";
+  version = "2.1.17.1354";
 
   src = fetchurl {
-    url = "https://web.archive.org/web/20231110130133/https://clockify.me/downloads/Clockify_Setup_x64.deb";
-    hash = "sha256-jndoMk3vqk8a5jMzKVo6ThovSISmcu+hef9IJcg3reQ=";
+    url = "https://web.archive.org/web/20240406052908/https://clockify.me/downloads/Clockify_Setup.AppImage";
+    hash = "sha256-G5VOAf6PrjHUsnk7IlXdqJ2D941cnggjuHkkgrOaVaA=";
   };
 
-  nativeBuildInputs = [
-    dpkg
-    makeWrapper
-  ];
+  extraInstallCommands =
+    let appimageContents = appimageTools.extract { inherit pname version src; };
+    in ''
+      mv $out/bin/${pname}-${version} $out/bin/${pname}
 
-  dontBuild = true;
-  dontConfigure = true;
+      install -Dm 444 ${appimageContents}/clockify.desktop -t $out/share/applications
+      install -Dm 444 ${appimageContents}/clockify.png -t $out/share/pixmaps
 
-  unpackPhase = ''
-    dpkg-deb -x ${src} ./
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mv usr $out
-    mv opt $out
-
-    substituteInPlace $out/share/applications/clockify.desktop \
-      --replace "/opt/Clockify/" ""
-
-    makeWrapper ${electron}/bin/electron $out/bin/clockify \
-      --add-flags $out/opt/Clockify/resources/app.asar
-
-    runHook postInstall
-  '';
+      substituteInPlace $out/share/applications/clockify.desktop \
+        --replace 'Exec=AppRun' 'Exec=${pname}'
+    '';
 
   meta = with lib; {
     description = "Free time tracker and timesheet app that lets you track work hours across projects";
diff --git a/pkgs/applications/radio/gnuradio/wrapper.nix b/pkgs/applications/radio/gnuradio/wrapper.nix
index ac08d17397fa7..fdaa76f6f7e8e 100644
--- a/pkgs/applications/radio/gnuradio/wrapper.nix
+++ b/pkgs/applications/radio/gnuradio/wrapper.nix
@@ -58,6 +58,10 @@ let
   # may wish to wrap GR without python support.
   pythonPkgs = extraPythonPackages
     ++ [ (unwrapped.python.pkgs.toPythonModule unwrapped) ]
+    ++ unwrapped.passthru.uhd.pythonPath
+    ++ lib.optionals (unwrapped.passthru.uhd.pythonPath != []) [
+      (unwrapped.python.pkgs.toPythonModule unwrapped.passthru.uhd)
+    ]
     # Add the extraPackages as python modules as well
     ++ (builtins.map unwrapped.python.pkgs.toPythonModule extraPackages)
     ++ lib.flatten (lib.mapAttrsToList (
diff --git a/pkgs/applications/radio/uhd/default.nix b/pkgs/applications/radio/uhd/default.nix
index c3f7b58fa1ba6..947d7d48108d2 100644
--- a/pkgs/applications/radio/uhd/default.nix
+++ b/pkgs/applications/radio/uhd/default.nix
@@ -8,15 +8,8 @@
 , boost
 , ncurses
 , enableCApi ? true
-# Although we handle the Python API's dependencies in pythonEnvArg, this
-# feature is currently disabled as upstream attempts to run `python setup.py
-# install` by itself, and it fails because the Python's environment's prefix is
-# not a writable directly. Adding support for this feature would require using
-# python's pypa/build nad pypa/install hooks directly, and currently it is hard
-# to do that because it all happens after a long buildPhase of the C API.
-, enablePythonApi ? false
+, enablePythonApi ? true
 , python3
-, buildPackages
 , enableExamples ? false
 , enableUtils ? true
 , libusb1
@@ -38,13 +31,7 @@
 }:
 
 let
-  onOffBool = b: if b then "ON" else "OFF";
-  inherit (lib) optionals;
-  # Later used in pythonEnv generation. Python + mako are always required for the build itself but not necessary for runtime.
-  pythonEnvArg = (ps: with ps; [ mako ]
-    ++ optionals (enablePythonApi) [ numpy setuptools ]
-    ++ optionals (enableUtils) [ requests six ]
-  );
+  inherit (lib) optionals cmakeBool;
 in
 
 stdenv.mkDerivation (finalAttrs: {
@@ -72,7 +59,30 @@ stdenv.mkDerivation (finalAttrs: {
     # hash.
     sha256 = "17g503mhndaabrdl7qai3rdbafr8xx8awsyr7h2bdzwzprzmh4m3";
   };
+  # This are the minimum required Python dependencies, this attribute might
+  # be useful if you want to build a development environment with a python
+  # interpreter able to import the uhd module.
+  pythonPath = optionals (enablePythonApi || enableUtils) [
+    python3.pkgs.numpy
+    python3.pkgs.setuptools
+  ] ++ optionals (enableUtils) [
+    python3.pkgs.requests
+    python3.pkgs.six
+
+    /* These deps are needed for the usrp_hwd.py utility, however even if they
+    would have been added here, the utility wouldn't have worked because it
+    depends on an old python library mprpc that is not supported for Python >
+    3.8. See also report upstream:
+    https://github.com/EttusResearch/uhd/issues/744
+
+    python3.pkgs.gevent
+    python3.pkgs.pyudev
+    python3.pkgs.pyroute2
+
+    */
+  ];
   passthru = {
+    runtimePython = python3.withPackages (ps: finalAttrs.pythonPath);
     updateScript = [
       ./update.sh
       # Pass it this file name as argument
@@ -83,66 +93,91 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     "-DENABLE_LIBUHD=ON"
     "-DENABLE_USB=ON"
-    "-DENABLE_TESTS=ON" # This installs tests as well so we delete them via postPhases
-    "-DENABLE_EXAMPLES=${onOffBool enableExamples}"
-    "-DENABLE_UTILS=${onOffBool enableUtils}"
-    "-DENABLE_C_API=${onOffBool enableCApi}"
-    "-DENABLE_PYTHON_API=${onOffBool enablePythonApi}"
-    "-DENABLE_DPDK=${onOffBool enableDpdk}"
+    # Regardless of doCheck, we want to build the tests to help us gain
+    # confident that the package is OK.
+    "-DENABLE_TESTS=ON"
+    (cmakeBool "ENABLE_EXAMPLES" enableExamples)
+    (cmakeBool "ENABLE_UTILS" enableUtils)
+    (cmakeBool "ENABLE_C_API" enableCApi)
+    (cmakeBool "ENABLE_PYTHON_API" enablePythonApi)
+    /*
+
+    Otherwise python tests fail. Using a dedicated pythonEnv for either or both
+    nativeBuildInputs and buildInputs makes upstream's cmake scripts fail to
+    install the Python API as reported on our end at [1] (we don't want
+    upstream to think we are in a virtual environment because we use
+    python3.withPackages...).
+
+    Putting simply the python dependencies in the nativeBuildInputs and
+    buildInputs as they are now from some reason makes the `python` in the
+    checkPhase fail to find the python dependencies, as reported at [2]. Even
+    using nativeCheckInputs with the python dependencies, or using a
+    `python3.withPackages` wrapper in nativeCheckInputs, doesn't help, as the
+    `python` found in $PATH first is the one from nativeBuildInputs.
+
+    [1]: https://github.com/NixOS/nixpkgs/pull/307435
+    [2]: https://discourse.nixos.org/t/missing-python-package-in-checkphase/9168/
+
+    Hence we use upstream's provided cmake flag to control which python
+    interpreter they will use to run the the python tests.
+
+    */
+    "-DRUNTIME_PYTHON_EXECUTABLE=${lib.getExe finalAttrs.passthru.runtimePython}"
+    (cmakeBool "ENABLE_DPDK" enableDpdk)
     # Devices
-    "-DENABLE_OCTOCLOCK=${onOffBool enableOctoClock}"
-    "-DENABLE_MPMD=${onOffBool enableMpmd}"
-    "-DENABLE_B100=${onOffBool enableB100}"
-    "-DENABLE_B200=${onOffBool enableB200}"
-    "-DENABLE_USRP1=${onOffBool enableUsrp1}"
-    "-DENABLE_USRP2=${onOffBool enableUsrp2}"
-    "-DENABLE_X300=${onOffBool enableX300}"
-    "-DENABLE_N300=${onOffBool enableN300}"
-    "-DENABLE_N320=${onOffBool enableN320}"
-    "-DENABLE_E300=${onOffBool enableE300}"
-    "-DENABLE_E320=${onOffBool enableE320}"
-  ]
+    (cmakeBool "ENABLE_OCTOCLOCK" enableOctoClock)
+    (cmakeBool "ENABLE_MPMD" enableMpmd)
+    (cmakeBool "ENABLE_B100" enableB100)
+    (cmakeBool "ENABLE_B200" enableB200)
+    (cmakeBool "ENABLE_USRP1" enableUsrp1)
+    (cmakeBool "ENABLE_USRP2" enableUsrp2)
+    (cmakeBool "ENABLE_X300" enableX300)
+    (cmakeBool "ENABLE_N300" enableN300)
+    (cmakeBool "ENABLE_N320" enableN320)
+    (cmakeBool "ENABLE_E300" enableE300)
+    (cmakeBool "ENABLE_E320" enableE320)
     # TODO: Check if this still needed
     # ABI differences GCC 7.1
     # /nix/store/wd6r25miqbk9ia53pp669gn4wrg9n9cj-gcc-7.3.0/include/c++/7.3.0/bits/vector.tcc:394:7: note: parameter passing for argument of type 'std::vector<uhd::range_t>::iterator {aka __gnu_cxx::__normal_iterator<uhd::range_t*, std::vector<uhd::range_t> >}' changed in GCC 7.1
-    ++ [ (lib.optionalString stdenv.isAarch32 "-DCMAKE_CXX_FLAGS=-Wno-psabi") ]
-  ;
-
-  pythonEnv = python3.withPackages pythonEnvArg;
+  ] ++ optionals stdenv.isAarch32 [
+    "-DCMAKE_CXX_FLAGS=-Wno-psabi"
+  ];
 
   nativeBuildInputs = [
     cmake
     pkg-config
     # Present both here and in buildInputs for cross compilation.
-    (buildPackages.python3.withPackages pythonEnvArg)
+    python3
+    python3.pkgs.mako
+    # We add this unconditionally, but actually run wrapPythonPrograms only if
+    # python utilities are enabled
+    python3.pkgs.wrapPython
   ];
-  buildInputs = [
+  buildInputs = finalAttrs.pythonPath ++ [
     boost
     libusb1
-  ]
-    # However, if enableLibuhd_Python_api *or* enableUtils is on, we need
-    # pythonEnv for runtime as well. The utilities' runtime dependencies are
-    # handled at the environment
-    ++ optionals (enableExamples) [ ncurses ncurses.dev ]
-    ++ optionals (enablePythonApi || enableUtils) [ finalAttrs.pythonEnv ]
-    ++ optionals (enableDpdk) [ dpdk ]
-  ;
+  ] ++ optionals (enableExamples) [
+    ncurses ncurses.dev
+  ] ++ optionals (enableDpdk) [
+    dpdk
+  ];
 
   # many tests fails on darwin, according to ofborg
   doCheck = !stdenv.isDarwin;
 
   # Build only the host software
   preConfigure = "cd host";
-  # TODO: Check if this still needed, perhaps relevant:
-  # https://files.ettus.com/manual_archive/v3.15.0.0/html/page_build_guide.html#build_instructions_unix_arm
   patches = [
-    # Disable tests that fail in the sandbox
+    # Disable tests that fail in the sandbox, last checked at version 4.6.0.0
     ./no-adapter-tests.patch
   ];
 
-  postPhases = [ "installFirmware" "removeInstalledTests" ]
-    ++ optionals (enableUtils && stdenv.hostPlatform.isLinux) [ "moveUdevRules" ]
-  ;
+  postPhases = [
+    "installFirmware"
+    "removeInstalledTests"
+  ] ++ optionals (enableUtils && stdenv.hostPlatform.isLinux) [
+    "moveUdevRules"
+  ];
 
   # UHD expects images in `$CMAKE_INSTALL_PREFIX/share/uhd/images`
   installFirmware = ''
@@ -162,6 +197,10 @@ stdenv.mkDerivation (finalAttrs: {
     mv $out/lib/uhd/utils/uhd-usrp.rules $out/lib/udev/rules.d/
   '';
 
+  # Wrap the python utilities with our pythonPath definition
+  postFixup = lib.optionalString (enablePythonApi && enableUtils) ''
+    wrapPythonPrograms
+  '';
   disallowedReferences = optionals (!enablePythonApi && !enableUtils) [
     python3
   ];
diff --git a/pkgs/applications/science/electronics/digital/default.nix b/pkgs/applications/science/electronics/digital/default.nix
index 41deecbb62247..7619e43e80332 100644
--- a/pkgs/applications/science/electronics/digital/default.nix
+++ b/pkgs/applications/science/electronics/digital/default.nix
@@ -3,17 +3,18 @@
 }:
 
 let
+  pname = "digital";
   pkgDescription = "A digital logic designer and circuit simulator.";
   version = "0.30";
   buildDate = "2023-02-03T08:00:56+01:00"; # v0.30 commit date
 
   desktopItem = makeDesktopItem {
     type = "Application";
-    name = "Digital";
-    desktopName = pkgDescription;
+    name = pname;
+    desktopName = "Digital";
     comment = "Easy-to-use digital logic designer and circuit simulator";
-    exec = "digital";
-    icon = "digital";
+    exec = pname;
+    icon = pname;
     categories = [ "Education" "Electronics" ];
     mimeTypes = [ "text/x-digital" ];
     terminal = false;
@@ -28,8 +29,7 @@ let
   mvnParameters = "-Pno-git-rev -Dgit.commit.id.describe=${version} -Dproject.build.outputTimestamp=${buildDate} -DbuildTimestamp=${buildDate}";
 in
 maven.buildMavenPackage rec {
-  pname = "digital";
-  inherit version jre;
+  inherit pname version jre;
 
   src = fetchFromGitHub {
     owner = "hneemann";
@@ -44,6 +44,8 @@ maven.buildMavenPackage rec {
   nativeBuildInputs = [ copyDesktopItems makeWrapper ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin
     mkdir -p $out/share/java
 
@@ -53,6 +55,13 @@ maven.buildMavenPackage rec {
     makeWrapper ${jre}/bin/java $out/bin/${pname} \
       --add-flags "-classpath $out/share/java/${pname}-${version}.jar:''${classpath#:}" \
       --add-flags "-jar $out/share/java/Digital.jar"
+
+    install -Dm644 src/main/svg/icon.svg $out/share/icons/hicolor/scalable/apps/${pname}.svg
+    for size in 16 32 48 64 128; do
+      install -Dm644 src/main/resources/icons/icon"$size".png $out/share/icons/hicolor/"$size"x"$size"/apps/${pname}.png
+    done
+
+    runHook postInstall
   '';
 
   desktopItems = [ desktopItem ];
diff --git a/pkgs/applications/terminal-emulators/tym/default.nix b/pkgs/applications/terminal-emulators/tym/default.nix
index acfbbb48943d0..562e06176130c 100644
--- a/pkgs/applications/terminal-emulators/tym/default.nix
+++ b/pkgs/applications/terminal-emulators/tym/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tym";
-  version = "3.5.0";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "endaaman";
     repo = "${pname}";
     rev = version;
-    sha256 = "sha256-aXV3TNjHxg/9Lb2o+ci5/cCAPbkWhxqOka3wv21ajSA=";
+    sha256 = "sha256-53XAHyDiFPUTmw/rgoEoSoh+c/t4rS12gxwH1yKHqvw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/version-management/git-vanity-hash/default.nix b/pkgs/applications/version-management/git-vanity-hash/default.nix
index 915ef38307b2f..55332c6c7287b 100644
--- a/pkgs/applications/version-management/git-vanity-hash/default.nix
+++ b/pkgs/applications/version-management/git-vanity-hash/default.nix
@@ -1,17 +1,22 @@
-{ lib, fetchFromGitHub, rustPlatform }:
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "git-vanity-hash";
   version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "prasmussen";
     repo = "git-vanity-hash";
-    rev = "v${version}";
-    hash = "sha256-jD8cSFXf9UNBZ9d8JTnuwhs6nPHY/xGd5RyqF+mQOlo=";
+    # v1.0.0 + build fix
+    rev = "a80e7725ac6d0b7e6807cd7315cfdc7eaf0584f6";
+    hash = "sha256-1z4jbtzUB3SH79dDXAITf7Vup1YZdTLHBieSrhrvSXc=";
   };
 
-  cargoHash = "sha256-8oW6gRtdQdmSmdwKlcU2EhHsyhk9hFhKl7RtsYwC7Ps=";
+  cargoHash = "sha256-+SQ0HpURBjnnwH1Ue7IUReOtI4LxVPK9AGSAihs0qsc=";
 
   postInstall = ''
     mkdir -p $out/share/doc/git-vanity-hash
diff --git a/pkgs/applications/window-managers/jay/default.nix b/pkgs/applications/window-managers/jay/default.nix
index 6718caf1ada23..6b7951c14c374 100644
--- a/pkgs/applications/window-managers/jay/default.nix
+++ b/pkgs/applications/window-managers/jay/default.nix
@@ -7,20 +7,30 @@
 , mesa
 , pango
 , udev
+, shaderc
+, libglvnd
+, vulkan-loader
+, autoPatchelfHook
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "jay";
-  version = "unstable-2022-11-20";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "mahkoh";
     repo = pname;
-    rev = "09b4668a5363a6e93dfb8ba35b244835f4edb0f2";
-    sha256 = "sha256-0IIzXY7AFTGEe0TzJVKOtTPUZee0Wz40yKgEWLeIYJw=";
+    rev = "v${version}";
+    sha256 = "sha256-9fWwVUqeYADt33HGaJRRFmM20WM7qRWbNGpt3rk9xQM=";
   };
 
-  cargoSha256 = "sha256-zSq6YBlm6gJXGlF9xZ8gWSTMewdNqrJzwP58a0x8QIU=";
+  cargoSha256 = "sha256-oPGY/rVx94BkWgKkwwyDjfASMyGGU32R5IZuNjOv+EM=";
+
+  SHADERC_LIB_DIR = "${lib.getLib shaderc}/lib";
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
 
   buildInputs = [
     libGL
@@ -29,9 +39,18 @@ rustPlatform.buildRustPackage rec {
     pango
     udev
     libinput
+    shaderc
+  ];
+
+  runtimeDependencies = [
+    libglvnd
+    vulkan-loader
   ];
 
-  RUSTC_BOOTSTRAP = 1;
+  postInstall = ''
+    install -D etc/jay.portal $out/usr/share/xdg-desktop-portal/portals/jay.portal
+    install -D etc/jay-portals.conf $out/usr/share/xdg-desktop-portal/jay-portals.conf
+  '';
 
   meta = with lib; {
     description = "A Wayland compositor written in Rust";
diff --git a/pkgs/by-name/br/broom/package.nix b/pkgs/by-name/br/broom/package.nix
new file mode 100644
index 0000000000000..69aa9ae684225
--- /dev/null
+++ b/pkgs/by-name/br/broom/package.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "broom";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "a-camarillo";
+    repo = "broom";
+    rev = "v${version}";
+    hash = "sha256-a2hUgYpiKm/dZWLRuCZKuGStmZ/7jDtLRAjd/B57Vxw=";
+  };
+
+  vendorHash = "sha256-zNklqGjMt89b+JOZfKjTO6c75SXO10e7YtQOqqQZpnA=";
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    description = "An interactive CLI tool for managing local git branches";
+    homepage = "https://github.com/a-camarillo/broom";
+    license = licenses.mit;
+    maintainers = with maintainers; [ a-camarillo ];
+    mainProgram = "broom";
+  };
+}
diff --git a/pkgs/by-name/bu/butt/package.nix b/pkgs/by-name/bu/butt/package.nix
index 86ca8145d12da..08f4b2401fee7 100644
--- a/pkgs/by-name/bu/butt/package.nix
+++ b/pkgs/by-name/bu/butt/package.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "butt";
-  version = "0.1.41";
+  version = "1.41.1";
 
   src = fetchurl {
     url = "https://danielnoethen.de/butt/release/${finalAttrs.version}/butt-${finalAttrs.version}.tar.gz";
-    hash = "sha256-wTypjqd2PpmDSA8vScMLkAL44xE/WAccm747PS9ClVA=";
+    hash = "sha256-y/XIcFm1TWVd5SL+kDCJc21CtMwipMQgRE4gPra5+98=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/cl/clatd/package.nix b/pkgs/by-name/cl/clatd/package.nix
index dff8ce4261a93..f18ab3b036cea 100644
--- a/pkgs/by-name/cl/clatd/package.nix
+++ b/pkgs/by-name/cl/clatd/package.nix
@@ -7,6 +7,7 @@
 , tayga
 , iproute2
 , iptables
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
@@ -52,6 +53,8 @@ stdenv.mkDerivation rec {
       }
   '';
 
+  passthru.tests.clatd = nixosTests.clatd;
+
   meta = with lib; {
     description = "A 464XLAT CLAT implementation for Linux";
     homepage = "https://github.com/toreanderson/clatd";
diff --git a/pkgs/by-name/dp/dps8m/package.nix b/pkgs/by-name/dp/dps8m/package.nix
new file mode 100644
index 0000000000000..939bb17c85063
--- /dev/null
+++ b/pkgs/by-name/dp/dps8m/package.nix
@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, libuv
+, coreutils-full
+, pkg-config
+, gnugrep
+, gnused
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dps8m";
+  version = "3.0.1";
+
+  src = fetchFromGitLab {
+    owner = "dps8m";
+    repo = "dps8m";
+    rev = "R${version}";
+    hash = "sha256-YCDeHryxXZXOXqUXkbWwH7Vna+ljzydFXPeo2et87x8=";
+    fetchSubmodules = true;
+  };
+
+  env = {
+    ENV = "${coreutils-full}/bin/env";
+    GREP = "${gnugrep}/bin/grep";
+    SED = "${gnused}/bin/sed";
+    PREFIX = placeholder "out";
+  };
+
+  nativeBuildInputs = [
+    coreutils-full
+    pkg-config
+  ];
+
+  buildInputs = [
+    libuv
+  ];
+
+  meta = with lib; {
+    description = "DPS8M: GE / Honeywell / Bull DPS‑8/M mainframe simulator";
+    homepage = "https://gitlab.com/dps8m/dps8m";
+    license = licenses.icu;
+    maintainers = with maintainers; [ matthewcroughan sarcasticadmin ];
+    mainProgram = "dps8m";
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/gp/gptscript/package.nix b/pkgs/by-name/gp/gptscript/package.nix
index 0cd7af6cb2217..f76c765987425 100644
--- a/pkgs/by-name/gp/gptscript/package.nix
+++ b/pkgs/by-name/gp/gptscript/package.nix
@@ -5,22 +5,21 @@
 }:
 buildGo122Module rec {
   pname = "gptscript";
-  version = "0.1.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "gptscript-ai";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-zG75L10WvfkmjwW3ifBHaTkHNXqXvNO0PaXejCc2tls=";
+    hash = "sha256-teZQhGYKJ5Ma5by3Wug5B1hAV1tox94MF586ZeEXp6o=";
   };
 
-  vendorHash = "sha256-LV9uLLwdtLJTIxaBB1Jew92S0QjQsceyLEfSrDeDnR4=";
+  vendorHash = "sha256-0irUcEomQzo9+vFJEk28apLNuJdsX1RHEqB7T88X7Ks=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X main.Version=${version}"
-    "-X main.Commit=${version}"
+    "-X github.com/gptscript-ai/gptscript/pkg/version.Tag=v${version}"
   ];
 
   # Requires network access
@@ -30,8 +29,8 @@ buildGo122Module rec {
     homepage = "https://gptscript.ai";
     changelog = "https://github.com/gptscript-ai/gptscript/releases/tag/v{version}";
     description = "Natural Language Programming";
-    license = with licenses; [asl20];
-    maintainers = with maintainers; [jamiemagee];
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ jamiemagee ];
     mainProgram = "gptscript";
   };
 }
diff --git a/pkgs/by-name/hu/hugo/package.nix b/pkgs/by-name/hu/hugo/package.nix
index 9d5e94fa25543..98abe2a65b210 100644
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.125.4";
+  version = "0.125.5";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = "hugo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-oeOP9UoiAGwYR2Vzr5IZrLfYA3EQJ9j6Bzh7C12pA+c=";
+    hash = "sha256-vvADd4S4AURkIODGvDf4J9omZjKcZeQKQ6ZSKDu1gog=";
   };
 
   vendorHash = "sha256-L8+e6rZvFaNV9gyWJtXv9NnzoigVDSyNKTuxGrRwb44=";
diff --git a/pkgs/by-name/ji/jikken/package.nix b/pkgs/by-name/ji/jikken/package.nix
new file mode 100644
index 0000000000000..1001ed711ad8e
--- /dev/null
+++ b/pkgs/by-name/ji/jikken/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  pkg-config,
+  openssl,
+  stdenv,
+  darwin,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "jikken";
+  version = "0.7.1";
+
+  src = fetchFromGitHub {
+    owner = "jikkenio";
+    repo = "jikken";
+    rev = "v${version}";
+    hash = "sha256-A6+sezhob7GqAzuJsJGH7ZDLTJhCD+f0t3zx/IMdPsI=";
+  };
+
+  cargoHash = "sha256-FxsI2ku52MlSGUph3/ovmn6HIwW+cUwVXuwzcd/1DV4=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs =
+    [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.IOKit
+      darwin.apple_sdk.frameworks.Security
+    ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "A powerful, source control friendly REST API testing toolkit";
+    homepage = "https://jikken.io/";
+    changelog = "https://github.com/jikkenio/jikken/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ vinnymeller ];
+    mainProgram = "jk";
+  };
+}
diff --git a/pkgs/by-name/jt/jtdx/package.nix b/pkgs/by-name/jt/jtdx/package.nix
new file mode 100644
index 0000000000000..a058c52c15446
--- /dev/null
+++ b/pkgs/by-name/jt/jtdx/package.nix
@@ -0,0 +1,16 @@
+{ wsjtx, fetchgit, qt5, lib }:
+wsjtx.overrideAttrs (old: {
+  name = "jtdx";
+  version = "unstable-2022-03-01";
+  src = fetchgit {
+    url = "https://github.com/jtdx-project/jtdx.git";
+    rev = "2a0e2bea8c66c9ca94d2ea8034cf83a68cfa40eb";
+    hash = "sha256-5KlFBlzG3hKFFGO37c+VN+FvZKSnTQXvSorB+Grns8w=";
+  };
+  buildInputs = old.buildInputs ++ [ qt5.qtwebsockets ];
+  meta = {
+    description = "wsjtx fork with some extra features";
+    maintainers = with lib.maintainers; [ matthewcroughan sarcasticadmin pkharvey ];
+    homepage = "https://github.com/jtdx-project/jtdx";
+  };
+})
diff --git a/pkgs/by-name/kc/kcl-cli/package.nix b/pkgs/by-name/kc/kcl-cli/package.nix
index 5a8dfc9e4d02b..ea0b5536b5289 100644
--- a/pkgs/by-name/kc/kcl-cli/package.nix
+++ b/pkgs/by-name/kc/kcl-cli/package.nix
@@ -5,14 +5,14 @@
 
 buildGoModule rec {
   pname = "kcl-cli";
-  version = "0.8.6";
+  version = "0.8.7";
   src = fetchFromGitHub {
     owner = "kcl-lang";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-A98Y5ktXFwn1XrFTwL8l04VW5zPNcMLtZCUf+niXx6c=";
+    hash = "sha256-OKRMgxynKmHnO+5tcKlispFkpQehHINzB6qphH+lwHQ=";
   };
-  vendorHash = "sha256-zFTcwyK5HT1cwfHJB3n5Eh2JE3xuXqAluU3McA+FurQ=";
+  vendorHash = "sha256-dF0n1/SmQVd2BUVOPmvZWWUJYTn2mMnbgZC92luSY2s=";
   ldflags = [
     "-X=kcl-lang.io/cli/pkg/version.version=${version}"
   ];
diff --git a/pkgs/by-name/mo/movim/package.nix b/pkgs/by-name/mo/movim/package.nix
index 20dd5165d26e5..ed00000634587 100644
--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@@ -1,5 +1,4 @@
 { lib
-, fetchpatch
 , fetchFromGitHub
 , writeShellScript
 , dash
@@ -39,22 +38,15 @@ let
 in
 php.buildComposerProject (finalAttrs: {
   pname = "movim";
-  version = "0.24";
+  version = "0.24.1";
 
   src = fetchFromGitHub {
     owner = "movim";
     repo = "movim";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-t63POjywZLk5ulppuCedFhhEhOsnB90vy3k/HhM3MGc=";
+    hash = "sha256-Ai82d1VwtAlKmM8N/hazMWsn5F6HS4I1do3VkpLPlBo=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/movim/movim/commit/4dd2842f4617f3baaa166157892a532ad07df80d.patch";
-      hash = "sha256-32MLS5g60Rhm8HQDBPnUo9k+aB7L8dNMcnSjPIlooks=";
-    })
-  ];
-
   php = php.buildEnv ({
     extensions = ({ all, enabled }:
       enabled
@@ -75,7 +67,7 @@ php.buildComposerProject (finalAttrs: {
   # pinned commonmark
   composerStrictValidation = false;
 
-  vendorHash = "sha256-SinS5ocf4kLMBR2HF3tcdmEomw9ICUqTg2IXPJFoujU=";
+  vendorHash = "sha256-1sQm+eRrs9m52CepPXahsOJhyLZ68+FIDNHyY33IoD4=";
 
   postPatch = ''
     # Our modules are already wrapped, removes missing *.so warnings;
diff --git a/pkgs/by-name/nx/nxengine-evo/assets.nix b/pkgs/by-name/nx/nxengine-evo/assets.nix
new file mode 100644
index 0000000000000..96c2e5f1e70b4
--- /dev/null
+++ b/pkgs/by-name/nx/nxengine-evo/assets.nix
@@ -0,0 +1,37 @@
+{ lib
+, stdenvNoCC
+, fetchzip
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "nxengine-assets";
+  version = "2.6.5-1";
+
+  src = fetchzip {
+    url = "https://github.com/nxengine/nxengine-evo/releases/download/v${finalAttrs.version}/NXEngine-Evo-v${finalAttrs.version}-Win64.zip";
+    hash = "sha256-+PjjhJYL1yk67QJ7ixfpCRg1coQnSPpXDUIwsqp9aIM=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/nxengine/
+    cp -r data/ $out/share/nxengine/data
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/nxengine/nxengine-evo";
+    description = "Assets for nxengine-evo";
+    license = with lib.licenses; [
+      unfreeRedistributable
+    ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.all;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/nx/nxengine-evo/package.nix b/pkgs/by-name/nx/nxengine-evo/package.nix
new file mode 100644
index 0000000000000..4503c0ec9b2c7
--- /dev/null
+++ b/pkgs/by-name/nx/nxengine-evo/package.nix
@@ -0,0 +1,92 @@
+{
+  lib,
+  SDL2,
+  SDL2_mixer,
+  callPackage,
+  cmake,
+  pkg-config,
+  ninja,
+  fetchFromGitHub,
+  fetchpatch,
+  fetchurl,
+  libpng,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nxengine-evo";
+  version = "2.6.4";
+
+  src = fetchFromGitHub {
+    owner = "nxengine";
+    repo = "nxengine-evo";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-krK2b1E5JUMxRoEWmb3HZMNSIHfUUGXSpyb4/Zdp+5A=";
+  };
+
+  patches = [
+    # Fix building by adding SDL_MIXER to include path
+    (fetchpatch {
+      url = "https://github.com/nxengine/nxengine-evo/commit/1890127ec4b4b5f8d6cb0fb30a41868e95659840.patch";
+      hash = "sha256-wlsIdN2RugOo94V3qj/AzYgrs2kf0i1Iw5zNOP8WQqI=";
+    })
+    # Fix buffer overflow
+    (fetchpatch {
+      url = "https://github.com/nxengine/nxengine-evo/commit/75b8b8e3b067fd354baa903332f2a3254d1cc017.patch";
+      hash = "sha256-fZVaZAOHgFoNakOR2MfsvRJjuLhbx+5id/bcN8w/WWo=";
+    })
+    # Add missing include
+    (fetchpatch {
+      url = "https://github.com/nxengine/nxengine-evo/commit/0076ebb11bcfec5dc5e2e923a50425f1a33a4133.patch";
+      hash = "sha256-8j3fFFw8DMljV7aAFXE+eA+vkbz1HdFTMAJmk3BRU04=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    SDL2
+    cmake
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    SDL2
+    SDL2_mixer
+    libpng
+  ];
+
+  strictDeps = true;
+
+  # Allow finding game assets.
+  postPatch = ''
+    sed -i -e "s,/usr/share/,$out/share/," src/ResourceManager.cpp
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cd ..
+    mkdir -p $out/bin/ $out/share/nxengine/
+    install bin/* $out/bin/
+  '' + ''
+    cp -r ${finalAttrs.finalPackage.assets}/share/nxengine/data $out/share/nxengine/data
+    chmod -R a=r,a+X $out/share/nxengine/data
+  '' + ''
+    runHook postInstall
+  '';
+
+  passthru = {
+    assets = callPackage ./assets.nix { };
+  };
+
+  meta = {
+    homepage = "https://github.com/nxengine/nxengine-evo";
+    description = "A complete open-source clone/rewrite of the masterpiece jump-and-run platformer Doukutsu Monogatari (also known as Cave Story)";
+    license = with lib.licenses; [
+      gpl3Plus
+    ];
+    mainProgram = "nx";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/pa/paper-age/package.nix b/pkgs/by-name/pa/paper-age/package.nix
index cb8c0e3bdeec4..3a2c20f95bb43 100644
--- a/pkgs/by-name/pa/paper-age/package.nix
+++ b/pkgs/by-name/pa/paper-age/package.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "paper-age";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "matiaskorhonen";
     repo = "paper-age";
     rev = "v${version}";
-    hash = "sha256-JlmiHnST/UnN4WsiDqSva+01odoc5h/J/mlGN3K0OfI=";
+    hash = "sha256-hrqjnZmcGUgFWn8Z85oJEbeUBaF2SccytMr1AG0GGos=";
   };
 
-  cargoHash = "sha256-zdq036ag7+mvWg4OJHtbltPlF9j49dCPNJjgVQcQ+u4=";
+  cargoHash = "sha256-sFofS+POvJwGo/+tiF6dawKgQci/54tUKkQQalqT+K0=";
 
   meta = with lib; {
     description = "Easy and secure paper backups of secrets";
diff --git a/pkgs/servers/sabnzbd/default.nix b/pkgs/by-name/sa/sabnzbd/package.nix
index 4b95a1841e476..9bcfe9b0ec4f5 100644
--- a/pkgs/servers/sabnzbd/default.nix
+++ b/pkgs/by-name/sa/sabnzbd/package.nix
@@ -13,6 +13,7 @@
 
 let
   pythonEnv = python3.withPackages(ps: with ps; [
+    apprise
     babelfish
     cffi
     chardet
@@ -47,14 +48,14 @@ let
   ]);
   path = lib.makeBinPath [ coreutils par2cmdline-turbo unrar unzip p7zip util-linux ];
 in stdenv.mkDerivation rec {
-  version = "4.2.3";
+  version = "4.3.0";
   pname = "sabnzbd";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "sha256-DM+sgrb7Zvtvp0th8GlOloSBcD8mG1RYyM91+uvCOgU=";
+    sha256 = "sha256-2zRhDFKbWq4JA7XE5/VFbfkN2ZQcqcuqGD5kjHmeXUA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ti/tinymist/Cargo.lock b/pkgs/by-name/ti/tinymist/Cargo.lock
index 9d42baf5a617f..b561b67c1088d 100644
--- a/pkgs/by-name/ti/tinymist/Cargo.lock
+++ b/pkgs/by-name/ti/tinymist/Cargo.lock
@@ -3681,7 +3681,7 @@ dependencies = [
 
 [[package]]
 name = "tests"
-version = "0.11.5"
+version = "0.11.6"
 dependencies = [
  "insta",
  "lsp-server",
@@ -3778,7 +3778,7 @@ dependencies = [
 
 [[package]]
 name = "tinymist"
-version = "0.11.5"
+version = "0.11.6"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3829,7 +3829,7 @@ dependencies = [
 
 [[package]]
 name = "tinymist-query"
-version = "0.11.5"
+version = "0.11.6"
 dependencies = [
  "anyhow",
  "comemo 0.4.0",
@@ -3867,7 +3867,7 @@ dependencies = [
 
 [[package]]
 name = "tinymist-render"
-version = "0.11.5"
+version = "0.11.6"
 dependencies = [
  "base64 0.22.0",
  "log",
diff --git a/pkgs/by-name/ti/tinymist/package.nix b/pkgs/by-name/ti/tinymist/package.nix
index cc0d0c6451f2b..da21891455818 100644
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -13,13 +13,13 @@ rustPlatform.buildRustPackage rec {
   pname = "tinymist";
   # Please update the corresponding vscode extension when updating
   # this derivation.
-  version = "0.11.5";
+  version = "0.11.6";
 
   src = fetchFromGitHub {
     owner = "Myriad-Dreamin";
     repo = "tinymist";
     rev = "v${version}";
-    hash = "sha256-VwyuK0Ct0ifx1R5tqeucqQNrkzqzhgxPqYeuETr8SkY=";
+    hash = "sha256-7YG15kt+pIxAK22QYiTApu5lBV6Afe3Jss6L5dTGsGI=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/tr/trak/package.nix b/pkgs/by-name/tr/trak/package.nix
new file mode 100644
index 0000000000000..2129850159bd3
--- /dev/null
+++ b/pkgs/by-name/tr/trak/package.nix
@@ -0,0 +1,34 @@
+{ lib
+, fetchFromGitHub
+, python3Packages
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "trak";
+  version = "0.0.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "lcfd";
+    repo = "trak";
+    rev = "v${version}";
+    hash = "sha256-YJMX7pNRWdNPyWNZ1HfpdYsKSStRWLcianLz6nScMa8=";
+  };
+
+  sourceRoot = "${src.name}/cli";
+
+  dependencies = with python3Packages; [
+    questionary
+    typer
+  ] ++ typer.optional-dependencies.all;
+
+  build-system = [ python3Packages.poetry-core ];
+
+  meta = {
+    description = "Keep a record of the time you dedicate to your projects";
+    homepage = "https://github.com/lcfd/trak";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ buurro ];
+    mainProgram = "trak";
+  };
+}
diff --git a/pkgs/by-name/uc/ucblogo/package.nix b/pkgs/by-name/uc/ucblogo/package.nix
new file mode 100644
index 0000000000000..40ccdecf6c68f
--- /dev/null
+++ b/pkgs/by-name/uc/ucblogo/package.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, wxGTK32
+, texinfo
+, tetex
+, wrapGAppsHook
+, autoconf-archive
+, autoreconfHook
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ucblogo-code";
+  version = "6.2.4";
+
+  src = fetchFromGitHub {
+    owner = "jrincayc";
+    repo = "ucblogo-code";
+    rev = "ca23b30a62eaaf03ea203ae71d00dc45a046514e";
+    hash = "sha256-BVNKkT0YUqI/z5W6Y/u3WbrHmaw7Z165vFt/mlzjd+8=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    autoconf-archive
+    texinfo
+    tetex
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    wxGTK32
+  ];
+
+  meta = with lib; {
+    description = "Berkeley Logo interpreter";
+    homepage = "https://github.com/jrincayc/ucblogo-code";
+    changelog = "https://github.com/jrincayc/ucblogo-code/blob/${finalAttrs.src.rev}/changes.txt";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ matthewcroughan ];
+    mainProgram = "ucblogo-code";
+    platforms = platforms.all;
+  };
+})
diff --git a/pkgs/by-name/xh/xhosts/Cargo.lock b/pkgs/by-name/xh/xhosts/Cargo.lock
new file mode 100644
index 0000000000000..3b686a7cac57b
--- /dev/null
+++ b/pkgs/by-name/xh/xhosts/Cargo.lock
@@ -0,0 +1,67 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "302d7ab3130588088d277783b1e2d2e10c9e9e4a16dd9050e6ec93fb3e7048f4"
+
+[[package]]
+name = "libnss"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48b67ef5ebef2a035ac8106c9b71176b6246be2a580ff4ee94bb80919e55b34c"
+dependencies = [
+ "lazy_static",
+ "libc",
+ "paste 0.1.18",
+]
+
+[[package]]
+name = "paste"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45ca20c77d80be666aef2b45486da86238fabe33e38306bd3118fe4af33fa880"
+dependencies = [
+ "paste-impl",
+ "proc-macro-hack",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
+
+[[package]]
+name = "paste-impl"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d95a7db200b97ef370c8e6de0088252f7e0dfff7d047a28528e47456c0fc98b6"
+dependencies = [
+ "proc-macro-hack",
+]
+
+[[package]]
+name = "proc-macro-hack"
+version = "0.5.20+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
+
+[[package]]
+name = "xhosts"
+version = "0.1.0"
+dependencies = [
+ "lazy_static",
+ "libc",
+ "libnss",
+ "paste 1.0.14",
+]
diff --git a/pkgs/by-name/xh/xhosts/package.nix b/pkgs/by-name/xh/xhosts/package.nix
new file mode 100644
index 0000000000000..ba6b5a184d3f7
--- /dev/null
+++ b/pkgs/by-name/xh/xhosts/package.nix
@@ -0,0 +1,34 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "nss-xhosts";
+  version = "unstable-2023-12-30";
+
+  src = fetchFromGitHub {
+    owner = "dvob";
+    repo = "nss-xhosts";
+    rev = "78658cc24abb2546936f2b298a27d4abdf629186";
+    hash = "sha256-saK9CxN4Ek1QBlPOydzEFei1217gPe5MZrUaUHh80hI=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+
+  postFixup = "mv $out/lib/*.so $out/lib/libnss_xhosts.so.2";
+
+  meta = with lib; {
+    description = "NSS Module which supports wildcards";
+    homepage = "https://github.com/dvob/nss-xhosts";
+    license = licenses.mit;
+    maintainers = with maintainers; [ matthewcroughan ];
+    mainProgram = "nss-xhosts";
+  };
+}
diff --git a/pkgs/development/libraries/libdatachannel/default.nix b/pkgs/development/libraries/libdatachannel/default.nix
index 6179bdac6d10f..62fdba7ba66aa 100644
--- a/pkgs/development/libraries/libdatachannel/default.nix
+++ b/pkgs/development/libraries/libdatachannel/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdatachannel";
-  version = "0.20.3";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "paullouisageneau";
     repo = "libdatachannel";
     rev = "v${version}";
-    hash = "sha256-QVyHDeT5gh+e3jOx9PjubIVq1xQ9eA7CxbP91X/xxT8=";
+    hash = "sha256-hxXDovJAmuh15jFaxY9aESoTVVJ3u2twsX31U3txans=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libmcfp/default.nix b/pkgs/development/libraries/libmcfp/default.nix
index 7a76fabaa4336..37d667ffee9a4 100644
--- a/pkgs/development/libraries/libmcfp/default.nix
+++ b/pkgs/development/libraries/libmcfp/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmcfp";
-  version = "1.2.4";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "mhekkel";
     repo = "libmcfp";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-Xz7M3TmUHGqiYZbFGSDxsVvg4VhgoVvr9TW03UxdFBw=";
+    hash = "sha256-hAY560uFrrM3gH3r4ArprWEsK/1w/XXDeyTMIYUv+qY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/quarto/default.nix b/pkgs/development/libraries/quarto/default.nix
index b021b1d930f03..78dc32fbbf550 100644
--- a/pkgs/development/libraries/quarto/default.nix
+++ b/pkgs/development/libraries/quarto/default.nix
@@ -19,10 +19,10 @@
 
 stdenv.mkDerivation (final: {
   pname = "quarto";
-  version = "1.4.553";
+  version = "1.4.554";
   src = fetchurl {
     url = "https://github.com/quarto-dev/quarto-cli/releases/download/v${final.version}/quarto-${final.version}-linux-amd64.tar.gz";
-    sha256 = "sha256-IrdUGx4b6XRmV6RHODeWukIObwy8XnsxyCKd3rwljJA=";
+    sha256 = "sha256-/RID+nqjMAEg2jzTBYc/8hz/t+k4TJlks7oCJ5YrjIY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 3c77719d57af5..5b496bf9c45d0 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.100";
+  version = "9.2.101";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "ailment";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qjEQ+pk/5Zp1HRrT/MlpmExB86JCF4kW3UHn3/anND4=";
+    hash = "sha256-3JPoO9GpnVEc4UQhhXxpj53PwK5eRsy6Ikt4qw5jGa8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiomysensors/default.nix b/pkgs/development/python-modules/aiomysensors/default.nix
index 006f108da390e..5e3ca5a6089ec 100644
--- a/pkgs/development/python-modules/aiomysensors/default.nix
+++ b/pkgs/development/python-modules/aiomysensors/default.nix
@@ -1,21 +1,22 @@
-{ lib
-, aiofiles
-, asyncio-mqtt
-, awesomeversion
-, buildPythonPackage
-, click
-, fetchFromGitHub
-, marshmallow
-, poetry-core
-, pyserial-asyncio
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  aiofiles,
+  asyncio-mqtt,
+  awesomeversion,
+  buildPythonPackage,
+  click,
+  fetchFromGitHub,
+  marshmallow,
+  poetry-core,
+  pyserial-asyncio,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "aiomysensors";
-  version = "0.3.14";
+  version = "0.3.15";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +25,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiomysensors";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7Y7JE/GAX5gQrIGcErZTGQXyaf3QwsTFgviiHLWgGeI=";
+    hash = "sha256-kgfz8VUTtOFN1hPkNJhPdRUKQn01BJn+92Ez6lgVGbc=";
   };
 
   postPatch = ''
@@ -32,11 +33,9 @@ buildPythonPackage rec {
       --replace-fail " --cov=src --cov-report=term-missing:skip-covered" ""
   '';
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiofiles
     asyncio-mqtt
     awesomeversion
@@ -50,16 +49,14 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [
-    "aiomysensors"
-  ];
+  pythonImportsCheck = [ "aiomysensors" ];
 
   meta = with lib; {
     description = "Library to connect to MySensors gateways";
-    mainProgram = "aiomysensors";
     homepage = "https://github.com/MartinHjelmare/aiomysensors";
     changelog = "https://github.com/MartinHjelmare/aiomysensors/releases/tag/v${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "aiomysensors";
   };
 }
diff --git a/pkgs/development/python-modules/aiowinreg/default.nix b/pkgs/development/python-modules/aiowinreg/default.nix
index a24384e3c51e8..bb6837c3f06f1 100644
--- a/pkgs/development/python-modules/aiowinreg/default.nix
+++ b/pkgs/development/python-modules/aiowinreg/default.nix
@@ -1,25 +1,29 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, prompt-toolkit
-, pythonOlder
-, winacl
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  prompt-toolkit,
+  pythonOlder,
+  setuptools,
+  winacl,
 }:
 
 buildPythonPackage rec {
   pname = "aiowinreg";
-  version = "0.0.10";
-  format = "setuptools";
+  version = "0.0.12";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "skelsec";
-    repo = pname;
+    repo = "aiowinreg";
     rev = "refs/tags/${version}";
-    hash = "sha256-PkrBjH+yeSLpwL9kH242xQKBsjv6a11k2c26qBwR6Fw=";
+    hash = "sha256-XQDBvBfocz5loUg9eZQz4FKGiCGCaczwhYE/vhy7mC0=";
   };
 
+  nativeBuildInputs = [ setuptools ];
+
   propagatedBuildInputs = [
     prompt-toolkit
     winacl
@@ -28,16 +32,14 @@ buildPythonPackage rec {
   # Project doesn't have tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "aiowinreg"
-  ];
+  pythonImportsCheck = [ "aiowinreg" ];
 
   meta = with lib; {
     description = "Python module to parse the registry hive";
-    mainProgram = "awinreg";
     homepage = "https://github.com/skelsec/aiowinreg";
     changelog = "https://github.com/skelsec/aiowinreg/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "awinreg";
   };
 }
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index 7deff467c306f..b47510fcc4b1b 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -37,7 +37,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.100";
+  version = "9.2.101";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -46,7 +46,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "angr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HTyxLr1qJYnQLapxZVvM4+qByiZQe3/LsVThyYnHC8k=";
+    hash = "sha256-btj1bGpS/t1uQxmMiZ+PTBqiIb7eigg1vGTPjzr4/p4=";
   };
 
   pythonRelaxDeps = [ "capstone" ];
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 99bd3af5cca81..fe6ca55ad91ba 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.100";
+  version = "9.2.101";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "archinfo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-HSADeA9zwkr8yP9sZQBNeC48L0rM+2UHNKZzFRRt4pk=";
+    hash = "sha256-58iijDVs4OqZytHDjhGqYRMSIVGPCWTUNRy74OQZcPw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 06bbc1752fb47..1d7e839665c9a 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -366,7 +366,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.34.95";
+  version = "1.34.96";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -374,7 +374,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-QSAGsn7nB+m1GghLAqySsUOvijtWcnWCr+wqds6Tw7Y=";
+    hash = "sha256-gkpimXGE45wP34h7JCxEodaauH4hVMKzHVDGSvqKT8U=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 6b1ad4dc6976f..2042758efd8af 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -1,55 +1,56 @@
-{ lib
-, stdenv
-, bcrypt
-, build
-, buildPythonPackage
-, cargo
-, chroma-hnswlib
-, darwin
-, fastapi
-, fetchFromGitHub
-, grpcio
-, hypothesis
-, importlib-resources
-, kubernetes
-, mmh3
-, numpy
-, onnxruntime
-, openssl
-, opentelemetry-api
-, opentelemetry-exporter-otlp-proto-grpc
-, opentelemetry-instrumentation-fastapi
-, opentelemetry-sdk
-, orjson
-, overrides
-, pkg-config
-, posthog
-, protobuf
-, pulsar-client
-, pydantic
-, pypika
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
-, pythonRelaxDepsHook
-, pyyaml
-, requests
-, rustc
-, rustPlatform
-, setuptools
-, setuptools-scm
-, tenacity
-, tokenizers
-, tqdm
-, typer
-, typing-extensions
-, uvicorn
-, zstd
+{
+  lib,
+  stdenv,
+  bcrypt,
+  build,
+  buildPythonPackage,
+  cargo,
+  chroma-hnswlib,
+  darwin,
+  fastapi,
+  fetchFromGitHub,
+  grpcio,
+  hypothesis,
+  importlib-resources,
+  kubernetes,
+  mmh3,
+  numpy,
+  onnxruntime,
+  openssl,
+  opentelemetry-api,
+  opentelemetry-exporter-otlp-proto-grpc,
+  opentelemetry-instrumentation-fastapi,
+  opentelemetry-sdk,
+  orjson,
+  overrides,
+  pkg-config,
+  posthog,
+  protobuf,
+  pulsar-client,
+  pydantic,
+  pypika,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  pythonRelaxDepsHook,
+  pyyaml,
+  requests,
+  rustc,
+  rustPlatform,
+  setuptools,
+  setuptools-scm,
+  tenacity,
+  tokenizers,
+  tqdm,
+  typer,
+  typing-extensions,
+  uvicorn,
+  zstd,
 }:
 
 buildPythonPackage rec {
   pname = "chromadb";
-  version = "0.4.23";
+  version = "0.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -58,18 +59,16 @@ buildPythonPackage rec {
     owner = "chroma-core";
     repo = "chroma";
     rev = "refs/tags/${version}";
-    hash = "sha256-5gI+FE2jx4G/qahATLcYsONfPZZkk1RFFYK5nrpE0Ug=";
+    hash = "sha256-gM+fexjwifF3evR8jZvMbIDz655RFKPUizrsB2q5tbw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-glItbT8gg5SAySnfx3A9TaPyFmd1R46JpAB1JnjBE5M=";
+    hash = "sha256-zyiFv/gswGupm7Y8BhviklqJzM914v0QyUsRwbGKZ48=";
   };
 
-  pythonRelaxDeps = [
-    "orjson"
-  ];
+  pythonRelaxDeps = [ "orjson" ];
 
   nativeBuildInputs = [
     cargo
@@ -85,9 +84,7 @@ buildPythonPackage rec {
   buildInputs = [
     openssl
     zstd
-  ] ++ lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
   propagatedBuildInputs = [
     bcrypt
@@ -126,9 +123,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [
-    "chromadb"
-  ];
+  pythonImportsCheck = [ "chromadb" ];
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index af832c7b3eba0..c10d32e6b189c 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.100";
+  version = "9.2.101";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "claripy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jkPXYlV89BsW4lHvpR+1jiFP92QsPPG0BMe1SVoQOfw=";
+    hash = "sha256-ecYyoFtCIsrlzcraqL8X4cZgqc243E9WXZix/70eksY=";
   };
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 61b1331ce666e..4457c6586796c 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -18,14 +18,14 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.100";
+  version = "9.2.101";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
     owner = "angr";
     repo = "binaries";
     rev = "refs/tags/v${version}";
-    hash = "sha256-U6RX+7kkb7+eYLYrE6SdJfYyDnBdGm+P3Xa3EfQv6Fk=";
+    hash = "sha256-8uvhjxZOgMjE2csOxS+kUPeo/pswovBDOLp5w8d4JSk=";
   };
 in
 buildPythonPackage rec {
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "cle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-++4GakniGH6JrRfOZsrSb+JpEKa6q7MXCSe9nIoae2g=";
+    hash = "sha256-cG9j3cMDwjm2DGvvgJgYfigf5e/61HKWFudgezE2zz8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/elkm1-lib/default.nix b/pkgs/development/python-modules/elkm1-lib/default.nix
index f64cbda4885b6..cf8c39c308dd9 100644
--- a/pkgs/development/python-modules/elkm1-lib/default.nix
+++ b/pkgs/development/python-modules/elkm1-lib/default.nix
@@ -1,36 +1,35 @@
-{ lib
-, async-timeout
-, buildPythonPackage
-, fetchFromGitHub
-, fetchpatch
-, poetry-core
-, pyserial-asyncio
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  async-timeout,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch,
+  poetry-core,
+  pyserial-asyncio-fast,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "elkm1-lib";
-  version = "2.2.6";
-  format = "pyproject";
+  version = "2.2.7";
+  pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "gwww";
     repo = "elkm1";
     rev = "refs/tags/${version}";
-    hash = "sha256-5Jmn/ywyg6fmp0ZxPf79ET+JWPF4VjDJMwj/qU6ckS0=";
+    hash = "sha256-5YdmZO/8HimQ9Ft/K/I6xu0Av2SjUBp3+poBe7aVUpM=";
   };
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     async-timeout
-    pyserial-asyncio
+    pyserial-asyncio-fast
   ];
 
   nativeCheckInputs = [
@@ -38,9 +37,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [
-    "elkm1_lib"
-  ];
+  pythonImportsCheck = [ "elkm1_lib" ];
 
   meta = with lib; {
     description = "Python module for interacting with ElkM1 alarm/automation panel";
diff --git a/pkgs/development/python-modules/fastpair/default.nix b/pkgs/development/python-modules/fastpair/default.nix
deleted file mode 100644
index 57be00cb91bfc..0000000000000
--- a/pkgs/development/python-modules/fastpair/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pytestCheckHook
-, scipy
-, pythonOlder
-}:
-
-buildPythonPackage {
-  pname = "fastpair";
-  version = "unstable-2021-05-19";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
-
-  src = fetchFromGitHub {
-    owner = "carsonfarmer";
-    repo = "fastpair";
-    rev = "d3170fd7e4d6e95312e7e1cb02e84077a3f06379";
-    hash = "sha256-vSb6o0XvHlzev2+uQKUI66wM39ZNqDsppEc8rlB+H9E=";
-  };
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace '"pytest-runner",' ""
-  '';
-
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
-
-  propagatedBuildInputs = [
-    scipy
-  ];
-
-  meta = with lib; {
-    description = "Data-structure for the dynamic closest-pair problem";
-    homepage = "https://github.com/carsonfarmer/fastpair";
-    license = licenses.mit;
-    maintainers = with maintainers; [ cmcdragonkai rakesh4g ];
-  };
-}
diff --git a/pkgs/development/python-modules/ldfparser/default.nix b/pkgs/development/python-modules/ldfparser/default.nix
index d012e32da0f09..c6c83aa64ba60 100644
--- a/pkgs/development/python-modules/ldfparser/default.nix
+++ b/pkgs/development/python-modules/ldfparser/default.nix
@@ -1,18 +1,19 @@
-{ lib
-, bitstruct
-, buildPythonPackage
-, fetchFromGitHub
-, jinja2
-, jsonschema
-, lark
-, pytestCheckHook
-, pythonOlder
-, setuptools
+{
+  lib,
+  bitstruct,
+  buildPythonPackage,
+  fetchFromGitHub,
+  jinja2,
+  jsonschema,
+  lark,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "ldfparser";
-  version = "0.24.0";
+  version = "0.25.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,14 +22,12 @@ buildPythonPackage rec {
     owner = "c4deszes";
     repo = "ldfparser";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+7L2WCQEDpWPDBPVt4ddoz0U4YkJ9GqQqp0cKj2fAXM=";
+    hash = "sha256-SZ9mWV5PjkQ2OiScPSMrunkKQWmuYW2lB2JvpTGNbY4=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     bitstruct
     jinja2
     lark
@@ -39,9 +38,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [
-    "ldfparser"
-  ];
+  pythonImportsCheck = [ "ldfparser" ];
 
   disabledTestPaths = [
     # We don't care about benchmarks
@@ -50,10 +47,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "LIN Description File parser written in Python";
-    mainProgram = "ldfparser";
     homepage = "https://github.com/c4deszes/ldfparser";
     changelog = "https://github.com/c4deszes/ldfparser/blob/${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "ldfparser";
   };
 }
diff --git a/pkgs/development/python-modules/linknlink/default.nix b/pkgs/development/python-modules/linknlink/default.nix
index 44a2a15a8f819..ea158b5cb2a1a 100644
--- a/pkgs/development/python-modules/linknlink/default.nix
+++ b/pkgs/development/python-modules/linknlink/default.nix
@@ -1,14 +1,15 @@
-{ lib
-, buildPythonPackage
-, cryptography
-, fetchFromGitHub
-, pythonOlder
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  cryptography,
+  fetchFromGitHub,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "linknlink";
-  version = "0.2.1";
+  version = "0.2.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,20 +18,14 @@ buildPythonPackage rec {
     owner = "xuanxuan000";
     repo = "python-linknlink";
     rev = "refs/tags/${version}";
-    hash = "sha256-MOZw+7oFHeH7Vaj6pylR7wqe3ZyHcsiG+n8jnRAQ8PA=";
+    hash = "sha256-G0URNUHIh/td+A8MhIC0mePx2SmhEXhIzOpbVft33+w=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
-    cryptography
-  ];
+  dependencies = [ cryptography ];
 
-  pythonImportsCheck = [
-    "linknlink"
-  ];
+  pythonImportsCheck = [ "linknlink" ];
 
   # Module has no test
   doCheck = false;
diff --git a/pkgs/development/python-modules/llama-index-core/default.nix b/pkgs/development/python-modules/llama-index-core/default.nix
index 1b301ffb1452e..d49c0f042f54a 100644
--- a/pkgs/development/python-modules/llama-index-core/default.nix
+++ b/pkgs/development/python-modules/llama-index-core/default.nix
@@ -44,7 +44,7 @@ in
 
 buildPythonPackage rec {
   pname = "llama-index-core";
-  version = "0.10.32";
+  version = "0.10.33";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     owner = "run-llama";
     repo = "llama_index";
     rev = "refs/tags/v${version}";
-    hash = "sha256-p+ye8o+paA6L8f1DiiiFJufyEqRn+ERNBWuhkoWfZb8=";
+    hash = "sha256-UlKZX7qWb8/XeqxNTW9PawKauwZRsMjsFP+xXI1CyeE=";
   };
 
   sourceRoot = "${src.name}/${pname}";
diff --git a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
index dd1ccf563b779..a96b2f57c8037 100644
--- a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-llms-ollama";
-  version = "0.1.2";
+  version = "0.1.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_llms_ollama";
     inherit version;
-    hash = "sha256-GexyfQSMhzkV1bA32aL+lWUgwBmxHXq4w8QG3RHzTks=";
+    hash = "sha256-x5ZlS3PRA/kyTtTFXHbEm3NzirxuUNAllu1eKxxm3sU=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-chroma/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-chroma/default.nix
index 8c546307434a1..73c20444860c5 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-chroma/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-chroma/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-chroma";
-  version = "0.1.6";
+  version = "0.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_vector_stores_chroma";
     inherit version;
-    hash = "sha256-bf89ydecQDn6Rs1Sjl5Lbe1kc+XvYyQkE0SRAH2k69s=";
+    hash = "sha256-E7DXWubBvMhru31XmNva6iPm2adJKmmt5pFqKZ8fquk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
index e81dd0ab4d243..15fcab2b3123c 100644
--- a/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-postgres/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-vector-stores-postgres";
-  version = "0.1.5";
+  version = "0.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_vector_stores_postgres";
     inherit version;
-    hash = "sha256-9jE+1Gbx2y/CSqkpSfuYqgyX49yZwhwmJbiG/EHwTLw=";
+    hash = "sha256-00ccEfjYY8qrNYymHQ5w43w8zAHUAntO6oiwYUwaOVw=";
   };
 
   pythonRemoveDeps = [ "psycopg2-binary" ];
diff --git a/pkgs/development/python-modules/mplhep/default.nix b/pkgs/development/python-modules/mplhep/default.nix
index 3988db9a8d28c..cbf4e46b499ee 100644
--- a/pkgs/development/python-modules/mplhep/default.nix
+++ b/pkgs/development/python-modules/mplhep/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "mplhep";
-  version = "0.3.46";
+  version = "0.3.47";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MEYIvKwQLbQPgaEEpSXs6v1MUQ/txzU8D0Ivd/6TlMw=";
+    hash = "sha256-GDLI/Y6tWiI5JcmQJ7BnwvKPGwdAwJDN4yGOgINcdB8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/msoffcrypto-tool/default.nix b/pkgs/development/python-modules/msoffcrypto-tool/default.nix
index fd297474eb706..830a37164a5e0 100644
--- a/pkgs/development/python-modules/msoffcrypto-tool/default.nix
+++ b/pkgs/development/python-modules/msoffcrypto-tool/default.nix
@@ -1,57 +1,52 @@
-{ lib
-, olefile
-, buildPythonPackage
-, fetchFromGitHub
-, poetry-core
-, cryptography
-, pytestCheckHook
-, pythonOlder
-, setuptools
+{
+  lib,
+  olefile,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  cryptography,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "msoffcrypto-tool";
-  version = "5.3.1";
-  format = "pyproject";
+  version = "5.4.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "nolze";
-    repo = pname;
+    repo = "msoffcrypto-tool";
     rev = "refs/tags/v${version}";
-    hash = "sha256-aQtEJyG0JGe4eSIRI4OUjJZNDBni6FFyJXXkbeiotSY=";
+    hash = "sha256-1LTFwXTIvFdrYyI1pDUPzQHw3/043+FGHDnKYWaomY0=";
   };
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     cryptography
     olefile
     setuptools
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTests = [
     # Test fails with AssertionError
     "test_cli"
   ];
 
-  pythonImportsCheck = [
-    "msoffcrypto"
-  ];
+  pythonImportsCheck = [ "msoffcrypto" ];
 
   meta = with lib; {
     description = "Python tool and library for decrypting MS Office files with passwords or other keys";
-    mainProgram = "msoffcrypto-tool";
     homepage = "https://github.com/nolze/msoffcrypto-tool";
     changelog = "https://github.com/nolze/msoffcrypto-tool/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
+    mainProgram = "msoffcrypto-tool";
   };
 }
diff --git a/pkgs/development/python-modules/nebula3-python/default.nix b/pkgs/development/python-modules/nebula3-python/default.nix
index 6d4f6f43a8ee1..fbc52dd1fe2ed 100644
--- a/pkgs/development/python-modules/nebula3-python/default.nix
+++ b/pkgs/development/python-modules/nebula3-python/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "nebula3-python";
-  version = "3.5.1";
+  version = "3.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "vesoft-inc";
     repo = "nebula-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-9JpdCR8ewOJcvJ3fAg/AcMKtSz7NBIqWAuG9cofv0Ak=";
+    hash = "sha256-tpMm13iixtg3ZF4g7YgRLyd/VqJba51QPGPmFRpy0wA=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/polyswarm-api/default.nix b/pkgs/development/python-modules/polyswarm-api/default.nix
index c9d851f49a6da..cde3bcc8ca347 100644
--- a/pkgs/development/python-modules/polyswarm-api/default.nix
+++ b/pkgs/development/python-modules/polyswarm-api/default.nix
@@ -1,21 +1,22 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, future
-, jsonschema
-, pytestCheckHook
-, python-dateutil
-, pythonOlder
-, pythonRelaxDepsHook
-, requests
-, responses
-, setuptools
-, vcrpy
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  future,
+  jsonschema,
+  pytestCheckHook,
+  python-dateutil,
+  pythonOlder,
+  pythonRelaxDepsHook,
+  requests,
+  responses,
+  setuptools,
+  vcrpy,
 }:
 
 buildPythonPackage rec {
   pname = "polyswarm-api";
-  version = "3.5.2";
+  version = "3.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,20 +25,14 @@ buildPythonPackage rec {
     owner = "polyswarm";
     repo = "polyswarm-api";
     rev = "refs/tags/${version}";
-    hash = "sha256-GMLgph6mjDSDn2CCfeqcqFY2gjtziH4xVHJhYTGRYw8=";
+    hash = "sha256-iY0I5z+aDLQekjgHT5v/ZprCkCgNPkyImmmaCQgnoYc=";
   };
 
-  pythonRelaxDeps = [
-    "future"
-  ];
+  pythonRelaxDeps = [ "future" ];
 
-  nativeBuildInputs = [
-    pythonRelaxDepsHook
-  ];
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     future
@@ -52,9 +47,7 @@ buildPythonPackage rec {
     vcrpy
   ];
 
-  pythonImportsCheck = [
-    "polyswarm_api"
-  ];
+  pythonImportsCheck = [ "polyswarm_api" ];
 
   meta = with lib; {
     description = "Library to interface with the PolySwarm consumer APIs";
diff --git a/pkgs/development/python-modules/psd-tools/default.nix b/pkgs/development/python-modules/psd-tools/default.nix
index 74ca3b2e0874f..d732d0ce84a40 100644
--- a/pkgs/development/python-modules/psd-tools/default.nix
+++ b/pkgs/development/python-modules/psd-tools/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "psd-tools";
-  version = "1.9.31";
+  version = "1.9.32";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "psd-tools";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-HUFJ2FP9WGcG9pkukS2LHIgPYFRAXAneiVK6VfYQ+zU=";
+    hash = "sha256-H235bZOzTxmmLEFje8hhYxrN4l1S34tD1LMhsymRy9w=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/python-motionmount/default.nix b/pkgs/development/python-modules/python-motionmount/default.nix
index be3a439c36074..8e1ba0bb644ec 100644
--- a/pkgs/development/python-modules/python-motionmount/default.nix
+++ b/pkgs/development/python-modules/python-motionmount/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "python-motionmount";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "vogelsproducts";
     repo = "python-MotionMount";
     rev = "refs/tags/${version}";
-    hash = "sha256-GXgshCARH4VPYHIIeWXwOCRmKgCyel4ydj/oKUWuyUM=";
+    hash = "sha256-F/nFo/PivnIogVwEh6MsQZQWg95kQMr6pZuf0SZa3n4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index e29bc2d7abe85..a3d62043d901e 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.100";
+  version = "9.2.101";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5CjpL6uxJjZN4GwYATVnX071XYRwCuEe7P/O4szAo3Y=";
+    hash = "sha256-zI86NYe0b9ppm9Zv6+zfB3UclhIm1TTqcC9vrBn3NR8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/safetensors/default.nix b/pkgs/development/python-modules/safetensors/default.nix
index 4005a620d8a6e..2b6d9ba0ab19f 100644
--- a/pkgs/development/python-modules/safetensors/default.nix
+++ b/pkgs/development/python-modules/safetensors/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "safetensors";
-  version = "0.4.2";
+  version = "0.4.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -25,13 +25,13 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "safetensors";
     rev = "refs/tags/v${version}";
-    hash = "sha256-hdPUI8k7CCQwt2C/AsjUHRmAL6ob+yCN97KkWtqOQL8=";
+    hash = "sha256-Rc+o7epQJ8qEvdgbFnGvXxBr/U4eULZwkKNEaPlJkyU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${src.name}/bindings/python";
-    hash = "sha256-7n9aYlha6IaPsZ2zMfD5EIkrk8ENwMBwj41s6QU7ml0=";
+    hash = "sha256-tzNEUvWgolSwX0t/JLgYcTEIv3/FiKxoTJ4VjFQs8AY=";
   };
 
   sourceRoot = "${src.name}/bindings/python";
diff --git a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
index 5daedfa2ebb86..accb456f11920 100644
--- a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
+++ b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tarpaulin";
-  version = "0.28.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "xd009642";
     repo = "tarpaulin";
     rev = version;
-    hash = "sha256-45jQt5VK7h02Frz5urB6dXap796OTfHsPx/Q1xumM00=";
+    hash = "sha256-eLLnSfuFnvlarpFBkhq3eumIyXOuuYU9ZJHpsKt0WQE=";
   };
 
-  cargoHash = "sha256-+AKgEyKer9S2lTUF3VA4UXnbR0nUBErp2OdqFC84W00=";
+  cargoHash = "sha256-bTflBJ5Rz2Xdip2ptUyGi+CpR0ZN0ggVutSk1S9nW1c=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/dive/default.nix b/pkgs/development/tools/dive/default.nix
index 76c338e8a579f..299be547ce275 100644
--- a/pkgs/development/tools/dive/default.nix
+++ b/pkgs/development/tools/dive/default.nix
@@ -26,6 +26,20 @@ buildGoModule rec {
 
   buildInputs = lib.optionals stdenv.isLinux [ btrfs-progs gpgme lvm2 ];
 
+  patches = [
+    (fetchpatch {
+      name = "add-scrolling-layers.patch";
+      url = "https://github.com/wagoodman/dive/pull/478/commits/b7da0f90880ce5e9d3bc2d0f269aadac6ee63c49.patch";
+      hash = "sha256-dYqg5JpWKOzy3hVjIVCHA2vmKCtCgc8W+oHEzuGpyxc=";
+    })
+    (fetchpatch {
+      name = "fix-render-update.patch";
+      url = "https://github.com/wagoodman/dive/pull/478/commits/326fb0d8c9094ac068a29fecd4f103783199392c.patch";
+      hash = "sha256-NC74MqHVChv/Z5hHX8ds3FI+tC+yyBpXvZKSFG3RyC0=";
+    })
+  ];
+
+
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/language-servers/zls/default.nix b/pkgs/development/tools/language-servers/zls/default.nix
index b8ef6ec8988d8..71a9a53a3fee5 100644
--- a/pkgs/development/tools/language-servers/zls/default.nix
+++ b/pkgs/development/tools/language-servers/zls/default.nix
@@ -1,24 +1,29 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, zig_0_11
+, fetchurl
+, zig_0_12
 , callPackage
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zls";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "zigtools";
     repo = "zls";
     rev = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-WrbjJyc4pj7R4qExdzd0DOQ9Tz3TFensAfHdecBA8UI=";
+    hash = "sha256-2iVDPUj9ExgTooDQmCCtZs3wxBe2be9xjzAk9HedPNY=";
   };
 
+  zigBuildFlags = [
+    "-Dversion_data_path=${zig_0_12.src}/doc/langref.html.in"
+  ];
+
   nativeBuildInputs = [
-    zig_0_11.hook
+    zig_0_12.hook
   ];
 
   postPatch = ''
diff --git a/pkgs/development/tools/language-servers/zls/deps.nix b/pkgs/development/tools/language-servers/zls/deps.nix
index 5c1b2ce89d3c6..4de50620ef9c7 100644
--- a/pkgs/development/tools/language-servers/zls/deps.nix
+++ b/pkgs/development/tools/language-servers/zls/deps.nix
@@ -4,24 +4,17 @@
 
 linkFarm "zig-packages" [
   {
-    name = "1220363c7e27b2d3f39de6ff6e90f9537a0634199860fea237a55ddb1e1717f5d6a5";
+    name = "12201314cffeb40c5e4e3da166217d2c74628c74486414aaf97422bcd2279915b9fd";
     path = fetchzip {
-      url = "https://gist.github.com/antlilja/8372900fcc09e38d7b0b6bbaddad3904/archive/6c3321e0969ff2463f8335da5601986cf2108690.tar.gz";
-      hash = "sha256-m/kr4kmkG2rLkAj5YwvM0HmXTd+chAiQHzYK6ozpWlw=";
+      url = "https://github.com/ziglibs/known-folders/archive/bf79988adcfce166f848e4b11e718c1966365329.tar.gz";
+      hash = "sha256-Q7eMdyScqj8qEiAHg1BnGRTsWSQOKWWTc6hUYHNlgGg=";
     };
   }
   {
-    name = "122048992ca58a78318b6eba4f65c692564be5af3b30fbef50cd4abeda981b2e7fa5";
+    name = "12200d71e4b7029ea56a429e24260c6c0e85a3069b0d4ba85eace21a0fd75910aa64";
     path = fetchzip {
-      url = "https://github.com/ziglibs/known-folders/archive/fa75e1bc672952efa0cf06160bbd942b47f6d59b.tar.gz";
-      hash = "sha256-U/h4bVarq8CFKbFyNXKl3vBRPubYooLxA1xUz3qMGPE=";
-    };
-  }
-  {
-    name = "122089a8247a693cad53beb161bde6c30f71376cd4298798d45b32740c3581405864";
-    path = fetchzip {
-      url = "https://github.com/ziglibs/diffz/archive/90353d401c59e2ca5ed0abe5444c29ad3d7489aa.tar.gz";
-      hash = "sha256-3CdYo6WevT0alRwKmbABahjhFKz7V9rdkDUZ43VtDeU=";
+      url = "https://github.com/ziglibs/diffz/archive/e10bf15962e45affb3fcd7d9a950977a69c901b3.tar.gz";
+      hash = "sha256-yVFPVn4jGfcoE2V4xdTqdThYPutshL6U4feDzetWgFw=";
     };
   }
 ]
diff --git a/pkgs/development/tools/misc/terser/default.nix b/pkgs/development/tools/misc/terser/default.nix
index ba30c6a4ffcd0..faffc0c0533ef 100644
--- a/pkgs/development/tools/misc/terser/default.nix
+++ b/pkgs/development/tools/misc/terser/default.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "terser";
-  version = "5.30.0";
+  version = "5.30.4";
 
   src = fetchFromGitHub {
     owner = "terser";
     repo = "terser";
     rev = "v${version}";
-    hash = "sha256-d3vnCEb9HzydpxsuoX66KqUtgYYt/+L2AcpZNFDleoY=";
+    hash = "sha256-d0zxwUvXa+Nm9p8QkhBhXl73XfJ+dxxt+GHkFtI8Zuk=";
   };
 
-  npmDepsHash = "sha256-wrxa6/TKYb/pqT4zjTVbfONSYqko12pVzBQ9Ojm7H2o=";
+  npmDepsHash = "sha256-7j3hMDVktQxolCMM27SH7y5ZtexnwF//ccilVZ0w5l8=";
 
   meta = with lib; {
     description = "JavaScript parser, mangler and compressor toolkit for ES6+";
diff --git a/pkgs/development/tools/spring-boot-cli/default.nix b/pkgs/development/tools/spring-boot-cli/default.nix
index 1b7d679559066..ed67db03e5c84 100644
--- a/pkgs/development/tools/spring-boot-cli/default.nix
+++ b/pkgs/development/tools/spring-boot-cli/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spring-boot-cli";
-  version = "3.2.4";
+  version = "3.2.5";
 
   src = fetchzip {
     url = "mirror://maven/org/springframework/boot/${finalAttrs.pname}/${finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}-bin.zip";
-    hash = "sha256-rOXQyIdyDT/YRuWgbbObFWnCOI+XEZ4+vGvIxJJ8CC4=";
+    hash = "sha256-NRJ5vL/tcm/CrNIEUh7gntLsLwWD9bL048Ycx1pRlQU=";
   };
 
   nativeBuildInputs = [ makeWrapper installShellFiles ];
diff --git a/pkgs/development/tools/typos/default.nix b/pkgs/development/tools/typos/default.nix
index dee47ffab1223..37a096c0d758c 100644
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.20.10";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-1ZZhGEz3Em5snDBDnjACfh9mmZNDyS8PFpixQwYXQ+M=";
+    hash = "sha256-PvMa2hQYDu42ZzwBZrMQZy48RxUzHMvlLYEzPN3sh1w=";
   };
 
-  cargoHash = "sha256-V/jyA+DB5QvwNLRwf+GAGCMuMbZkby2Hx7R927XGfH4=";
+  cargoHash = "sha256-P7pzyfv+0ckzVjC95a+YW6Ni3sLnqgjoZ4JlnfKO17M=";
 
   meta = with lib; {
     description = "Source code spell checker";
diff --git a/pkgs/games/nxengine-evo/default.nix b/pkgs/games/nxengine-evo/default.nix
deleted file mode 100644
index ca57d11910aa6..0000000000000
--- a/pkgs/games/nxengine-evo/default.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{ lib, stdenv
-, fetchpatch
-, fetchurl
-, fetchFromGitHub
-, cmake
-, libpng
-, SDL2
-, SDL2_mixer
-}:
-
-stdenv.mkDerivation rec {
-  pname = "nxengine-evo";
-  version = "2.6.4";
-  src = fetchFromGitHub {
-    owner = "nxengine";
-    repo = "nxengine-evo";
-    rev = "v${version}";
-    sha256 = "sha256-krK2b1E5JUMxRoEWmb3HZMNSIHfUUGXSpyb4/Zdp+5A=";
-  };
-  assets = fetchurl {
-    url = "https://github.com/nxengine/nxengine-evo/releases/download/v${version}/NXEngine-v${version}-Linux.tar.xz";
-    sha256 = "1b5hkmsrrhnjjf825ri6n62kb3fldwl7v5f1cqvqyv47zv15g5gy";
-  };
-
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/nxengine/nxengine-evo/commit/1890127ec4b4b5f8d6cb0fb30a41868e95659840.patch";
-      sha256 = "18j22vzkikcwqd42vlhzd6rjp26dq0zslxw5yyl07flivms0hny2";
-    })
-    (fetchpatch {
-      url = "https://github.com/nxengine/nxengine-evo/commit/75b8b8e3b067fd354baa903332f2a3254d1cc017.patch";
-      sha256 = "0sjr7z63gp7nfxifxisvp2w664mxxk3xi4a3d86mm0470dj5m5bx";
-    })
-  ];
-
-  nativeBuildInputs = [ cmake ];
-
-  buildInputs = [
-    libpng
-    SDL2
-    SDL2_mixer
-  ];
-
-  # Allow finding game assets.
-  postPatch = ''
-    sed -i -e "s,/usr/share/,$out/share/," src/ResourceManager.cpp
-  '';
-
-  installPhase = ''
-    cd ..
-    unpackFile ${assets}
-    mkdir -p $out/bin/ $out/share/nxengine/
-    install bin/* $out/bin/
-    cp -r NXEngine-evo-${version}-Linux/data/ $out/share/nxengine/data
-    chmod -R a=r,a+X $out/share/nxengine/data
-  '';
-
-  meta = {
-    description = "A complete open-source clone/rewrite of the masterpiece jump-and-run platformer Doukutsu Monogatari (also known as Cave Story)";
-    license = with lib.licenses; [
-      gpl3                   # Game engine
-      unfreeRedistributable  # Game assets, freeware
-    ];
-    maintainers = [ ];
-    homepage = "https://github.com/nxengine/nxengine-evo";
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/darwin/rectangle/default.nix b/pkgs/os-specific/darwin/rectangle/default.nix
index 0ada82d0e7580..ca83bb7db4c00 100644
--- a/pkgs/os-specific/darwin/rectangle/default.nix
+++ b/pkgs/os-specific/darwin/rectangle/default.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "rectangle";
-  version = "0.76";
+  version = "0.77";
 
   src = fetchurl {
     url = "https://github.com/rxhanson/Rectangle/releases/download/v${version}/Rectangle${version}.dmg";
-    hash = "sha256-oHq5mLMWloi6Tf81rjcmUFGwIggtMdyLPqbD/gOzNHU=";
+    hash = "sha256-wViFngw6iwlOG7KsW+zqxjm9ZRJahscX0TYz7/7T5nw=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 19109c4efea8f..b69c0f9c6003d 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,34 +1,34 @@
 {
     "testing": {
-        "version": "6.9-rc5",
-        "hash": "sha256:1rk369sz6a4m1bm7zzxj8bpdma7rgybmx8frd54kp2l5mjp7brrp"
+        "version": "6.9-rc6",
+        "hash": "sha256:075l5vhk8zmwln4jks7gr5n5k67s65qvs07l2rpbc7a75fdp6c14"
     },
     "6.1": {
-        "version": "6.1.88",
-        "hash": "sha256:1lgqclvcxfs5c4my6fh041gxzgzz8i64cw43cf5ichy58pyh4sb9"
+        "version": "6.1.90",
+        "hash": "sha256:07cfg0chssvpc4mqls3aln6s4lqjp6k4x2n63wndmkjgfqpdg8w3"
     },
     "5.15": {
-        "version": "5.15.157",
-        "hash": "sha256:0554qxnai66mpm3p5dln9dfsb392zr8zvwfwc9ks2sadsd8j7wmg"
+        "version": "5.15.158",
+        "hash": "sha256:1inmdpif3qf1blmvjj4i7y42bylvhv0wyj3b0apq12zxlj1iq1zr"
     },
     "5.10": {
-        "version": "5.10.215",
-        "hash": "sha256:1af6h86flx96pszg006agpak2f9dkk2jqaazfykd7aafqdcs3747"
+        "version": "5.10.216",
+        "hash": "sha256:0lg1zfb9y4ps86q85mlnyalb3s90zix003z62jb9bw139f65h473"
     },
     "5.4": {
-        "version": "5.4.274",
-        "hash": "sha256:1m4yyyv48mfkzhqms88dv1jf39zsfp88az5zpqynmm1wlhhv9iza"
+        "version": "5.4.275",
+        "hash": "sha256:0k1hyknx854k8z27j4rq1gcp8l0xc0bspmrhc41a033gjilb1lns"
     },
     "4.19": {
-        "version": "4.19.312",
-        "hash": "sha256:0jppa4p73pssd7m3jpc7i6rgnj9gawjcgk4wmqyy87ijzrgzm553"
+        "version": "4.19.313",
+        "hash": "sha256:1j1r4mrdh1ray468jr5i8d2afiswb653bhq0ck8bcdw4rwp5w558"
     },
     "6.6": {
-        "version": "6.6.29",
-        "hash": "sha256:1l6bcz0pwiby6q79va063767d0jxkkaf8rpqvaqqcb08116gf9kz"
+        "version": "6.6.30",
+        "hash": "sha256:1ilwmgpgvddwkd9nx5999cb6z18scjyq7jklid26k1hg7f35nsmn"
     },
     "6.8": {
-        "version": "6.8.8",
-        "hash": "sha256:1fiiyvwi6frn83z730w4mng2z4nwpspvhb6vjpxx3yk0snwxqk0w"
+        "version": "6.8.9",
+        "hash": "sha256:1dn9bgmf03bdfbmgq98d043702g808rjikxs2i9yia57iqiz21gr"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 92f71e6496ab7..3344808ca2789 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19536";
-    sha256 = "1lwg4340nga0sn5jcsqrmqskf2cf4vvjhkbdl0h54bj3lcnbxaw4";
+    rev = "19546";
+    sha256 = "1yyj7pbfs02fki1rdxfj9gcrxdrl26igisy4fji7czcc9xbw03qm";
   }
 , ...
 }:
diff --git a/pkgs/servers/monitoring/mackerel-agent/default.nix b/pkgs/servers/monitoring/mackerel-agent/default.nix
index a240c1aee990e..19a822fc6173d 100644
--- a/pkgs/servers/monitoring/mackerel-agent/default.nix
+++ b/pkgs/servers/monitoring/mackerel-agent/default.nix
@@ -2,20 +2,20 @@
 
 buildGoModule rec {
   pname = "mackerel-agent";
-  version = "0.80.0";
+  version = "0.81.0";
 
   src = fetchFromGitHub {
     owner = "mackerelio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ETM7OTJEdySej9wrV9sth1JCJAtfBVdsPH8ndOBV118=";
+    sha256 = "sha256-C0/l5dt5HpSgpTw1rlQXWOh4CfCI8D/tKPTGNt67M08=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
   nativeCheckInputs = lib.optionals (!stdenv.isDarwin) [ nettools ];
   buildInputs = lib.optionals (!stdenv.isDarwin) [ iproute2 ];
 
-  vendorHash = "sha256-pCUHDHKNaSoIPB3fS+Jf953YMI5cXcUOLF+YP62iPMo=";
+  vendorHash = "sha256-JIqQXS2iw3opeotpfqC16w7hdu+7XjxhIyVj2M+98ec=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 20637c70129f0..40d832620c3fa 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -9,6 +9,7 @@
 , shadow
 , procps
 , nixosTests
+, fetchpatch
 }:
 
 let
@@ -26,6 +27,15 @@ buildGoModule {
   };
   vendorHash = "sha256-pYeHqYd2cCOVQlD1r2lh//KC+732H0lj1fPDBr+W8qA=";
 
+  patches = [
+    # Reverts "cmd/tailscaled/tailscaled.service: revert recent hardening"
+    (fetchpatch {
+      url = "https://github.com/tailscale/tailscale/commit/2889fabaefc50040507ead652d6d2b212f476c2b.patch";
+      hash = "sha256-DPBrv7kjSVXhmptUGGzOkaP4iXi/Bym3lvqy4otL9HE=";
+      revert = true;
+    })
+  ];
+
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
 
   CGO_ENABLED = 0;
diff --git a/pkgs/tools/admin/clair/default.nix b/pkgs/tools/admin/clair/default.nix
index 4a6dd2ef4baee..df3bba816f0de 100644
--- a/pkgs/tools/admin/clair/default.nix
+++ b/pkgs/tools/admin/clair/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "clair";
-  version = "4.7.3";
+  version = "4.7.4";
 
   src = fetchFromGitHub {
     owner = "quay";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-LRjlchhEXLTZDH3v2lkY3XN4tvXOHpedZBjkQ6rgeVc=";
+    hash = "sha256-NEivDkcMB6Upc8UJFFnCs4yjsENXP/qOK3X582VVbmY=";
   };
 
-  vendorHash = "sha256-cAeEBJz4k2liivRsNF4FT4JPKsDVy2fLAYDg8NuJ81U=";
+  vendorHash = "sha256-12nrMAGS7CRTq2Dr8Lnm9B/HTZAzJOaJ8TqTOHknCRE=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/tools/misc/tbls/default.nix b/pkgs/tools/misc/tbls/default.nix
index 067c40aab8db8..c930d2038149a 100644
--- a/pkgs/tools/misc/tbls/default.nix
+++ b/pkgs/tools/misc/tbls/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "tbls";
-  version = "1.74.0";
+  version = "1.74.1";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     rev = "v${version}";
-    hash = "sha256-diMg47aZvMpVtvSbg1nA2Sva7JnEBfh8ZU9AHcz+xno=";
+    hash = "sha256-QuusOxXcTp7c6zkj6L//jOXWwLUgrsUFtsUtrNZrkOk=";
   };
 
-  vendorHash = "sha256-UbMR3yTabGSUqT30T81R/fGnWI4Mz7/utCjZ5Fq0MWU=";
+  vendorHash = "sha256-mDZOBwm3k3L4QqQA+1C3jRz46R7+4wwJg9BVNWB0F0A=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/tlp/default.nix b/pkgs/tools/misc/tlp/default.nix
index 51f10640ccbb7..436e5ba480eed 100644
--- a/pkgs/tools/misc/tlp/default.nix
+++ b/pkgs/tools/misc/tlp/default.nix
@@ -129,6 +129,7 @@
       "https://linrunner.de/en/tlp/docs/tlp-linux-advanced-power-management.html";
     changelog = "https://github.com/linrunner/TLP/releases/tag/${version}";
     platforms = platforms.linux;
+    mainProgram = "tlp";
     maintainers = with maintainers; [ abbradar lovesegfault ];
     license = licenses.gpl2Plus;
   };
diff --git a/pkgs/tools/misc/upterm/default.nix b/pkgs/tools/misc/upterm/default.nix
index 1cd4d1d606bf4..384e315bb8720 100644
--- a/pkgs/tools/misc/upterm/default.nix
+++ b/pkgs/tools/misc/upterm/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "upterm";
-  version = "0.13.3";
+  version = "0.13.5";
 
   src = fetchFromGitHub {
     owner = "owenthereal";
     repo = "upterm";
     rev = "v${version}";
-    hash = "sha256-VGLQ0NtXHIBKyTjW+7rPbmRdhcY9CMUYAnUu3qbqv9A=";
+    hash = "sha256-uwWP/F8rCc1vJ7Y+84cazAnsJ30zoyxqkbT2E+FzYr8=";
   };
 
-  vendorHash = "sha256-rbdYXRxnkl0v+bICSusGiyxb5TIGREiKuylycV3dcx4=";
+  vendorHash = "sha256-AYntKxSRO0FSKmOojIS1i9bdUA5Kp3WoI7ThUNw3RNw=";
 
   subPackages = [ "cmd/upterm" "cmd/uptermd" ];
 
diff --git a/pkgs/tools/system/consul-template/default.nix b/pkgs/tools/system/consul-template/default.nix
index d74b114a10fcf..5494b699ed4a4 100644
--- a/pkgs/tools/system/consul-template/default.nix
+++ b/pkgs/tools/system/consul-template/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "consul-template";
-  version = "0.37.4";
+  version = "0.37.5";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "consul-template";
     rev = "v${version}";
-    hash = "sha256-uu/w3D2pLC7fYwDbi/6qgM7kPCWH3WMDz/6ySLFkzEs=";
+    hash = "sha256-vUNOk0lvlI2K8tIgQVWDDkTwvO5gh9xnkdkx//vP1/U=";
   };
 
-  vendorHash = "sha256-oVauzk6vZJSeub55s1cTc+brDoUYwauiMSgFuN0xCw4=";
+  vendorHash = "sha256-3Z8EiO48+OAg/TnoKUuokLBSXnUUrxe8ZgE1nrILFSg=";
 
   # consul-template tests depend on vault and consul services running to
   # execute tests so we skip them here
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 942fbad6d2e9e..8824b55e1991f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4790,9 +4790,7 @@ with pkgs;
 
   clipster = callPackage ../tools/misc/clipster { };
 
-  clockify = callPackage ../applications/office/clockify {
-    electron = electron_24;
-  };
+  clockify = callPackage ../applications/office/clockify { };
 
   contrast = callPackage ../applications/accessibility/contrast { };
 
@@ -25632,8 +25630,6 @@ with pkgs;
 
   asterisk-ldap = lowPrio (asterisk.override { ldapSupport = true; });
 
-  sabnzbd = callPackage ../servers/sabnzbd { };
-
   baserow = callPackage ../servers/baserow { };
 
   bftpd = callPackage ../servers/ftp/bftpd { };
@@ -37187,8 +37183,6 @@ with pkgs;
 
   nudoku = callPackage ../games/nudoku { };
 
-  nxengine-evo = callPackage ../games/nxengine-evo { };
-
   oilrush = callPackage ../games/oilrush { };
 
   onscripter-en = callPackage ../games/onscripter-en { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 42226374159fc..a247be4c7d330 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1253,7 +1253,7 @@ with self; {
     };
   };
 
-  AstroFITSHeader = buildPerlModule rec {
+  AstroFITSHeader = buildPerlModule {
     pname = "Astro-FITS-Header";
     version = "3.09";
     src = fetchurl {
@@ -1358,7 +1358,7 @@ with self; {
     };
   };
 
-  AuthenKrb5Admin = buildPerlPackage rec {
+  AuthenKrb5Admin = buildPerlPackage {
     pname = "Authen-Krb5-Admin";
     version = "0.17";
     src = fetchurl {
@@ -1836,7 +1836,7 @@ with self; {
     };
   };
 
-  BKeywords = buildPerlPackage rec {
+  BKeywords = buildPerlPackage {
     pname = "B-Keywords";
     version = "1.26";
     src = fetchurl {
@@ -3627,7 +3627,7 @@ with self; {
     };
   };
 
-  ClassLoader = buildPerlPackage rec {
+  ClassLoader = buildPerlPackage {
     pname = "Class-Loader";
     version = "2.03";
     src = fetchurl {
@@ -4529,7 +4529,7 @@ with self; {
     };
   };
 
-  ConvertBencode = buildPerlPackage rec {
+  ConvertBencode = buildPerlPackage {
     pname = "Convert-Bencode";
     version = "1.03";
     src = fetchurl {
@@ -4557,7 +4557,7 @@ with self; {
     };
   };
 
-  ConvertUU = buildPerlPackage rec {
+  ConvertUU = buildPerlPackage {
     pname = "Convert-UU";
     version = "0.5201";
     src = fetchurl {
@@ -5241,7 +5241,7 @@ with self; {
     };
   };
 
-  CryptRandom = buildPerlPackage rec {
+  CryptRandom = buildPerlPackage {
     pname = "Crypt-Random";
     version = "1.54";
     src = fetchurl {
@@ -5552,7 +5552,7 @@ with self; {
     };
   };
 
-  CryptOpenSSLX509 = buildPerlPackage rec {
+  CryptOpenSSLX509 = buildPerlPackage {
     pname = "Crypt-OpenSSL-X509";
     version = "1.915";
     src = fetchurl {
@@ -6961,7 +6961,7 @@ with self; {
     };
   };
 
-  DevelLeak = buildPerlPackage rec {
+  DevelLeak = buildPerlPackage {
     pname = "Devel-Leak";
     version = "0.03";
     src = fetchurl {
@@ -9166,7 +9166,7 @@ with self; {
     };
   };
 
-  ExtUtilsF77 = buildPerlPackage rec {
+  ExtUtilsF77 = buildPerlPackage {
     pname = "ExtUtils-F77";
     version = "1.26";
     src = fetchurl {
@@ -10538,7 +10538,7 @@ with self; {
     };
   };
 
-  FutureAsyncAwait = buildPerlModule rec {
+  FutureAsyncAwait = buildPerlModule {
     pname = "Future-AsyncAwait";
     version = "0.66";
     src = fetchurl {
@@ -10772,7 +10772,7 @@ with self; {
     };
   };
 
-  GitAutofixup = buildPerlPackage rec {
+  GitAutofixup = buildPerlPackage {
     pname = "App-Git-Autofixup";
     version = "0.004001";
     src = fetchurl {
@@ -11383,7 +11383,7 @@ with self; {
     propagatedBuildInputs = [ DateCalc ];
     meta = {
       description = "Finnish APRS Parser (Fabulous APRS Parser)";
-      maintainers = with maintainers; [ ];
+      maintainers = [ ];
       license = with lib.licenses; [ artistic1 gpl1Plus ];
     };
   };
@@ -14610,7 +14610,7 @@ with self; {
     };
   };
 
-  LogJournald = buildPerlModule rec {
+  LogJournald = buildPerlModule {
     pname = "Log-Journald";
     version = "0.30";
     src = fetchurl {
@@ -15727,7 +15727,7 @@ with self; {
   };
 
   # TODO: use CPAN version
-  MHonArc = buildPerlPackage rec {
+  MHonArc = buildPerlPackage {
     pname = "MHonArc";
     version = "2.6.24";
 
@@ -16142,7 +16142,7 @@ with self; {
     };
   };
 
-  ModuleCompile = buildPerlPackage rec {
+  ModuleCompile = buildPerlPackage {
     pname = "Module-Compile";
     version = "0.38";
     src = fetchurl {
@@ -16598,16 +16598,16 @@ with self; {
 
   Mojolicious = buildPerlPackage {
     pname = "Mojolicious";
-    version = "9.35";
+    version = "9.36";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.35.tar.gz";
-      hash = "sha256-akpEbuB/ynxtty9dgXVA1oMwCcuN58zkxvskoV7n1Gs=";
+      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.36.tar.gz";
+      hash = "sha256-UX7Pb9hqC3xhadVRAiOL+YUWGNt2L7ANTPDZTGJSAV8=";
     };
     meta = {
       description = "Real-time web framework";
       homepage = "https://mojolicious.org";
       license = with lib.licenses; [ artistic2 ];
-      maintainers = with maintainers; [ thoughtpolice sgo ];
+      maintainers = with maintainers; [ marcusramberg sgo thoughtpolice ];
       mainProgram = "mojo";
     };
   };
@@ -16836,7 +16836,7 @@ with self; {
     };
   };
 
-  Mojomysql = buildPerlPackage rec {
+  Mojomysql = buildPerlPackage {
     pname = "Mojo-mysql";
     version = "1.26";
     src = fetchurl {
@@ -18218,7 +18218,7 @@ with self; {
     };
   };
 
-  MySQLDiff = buildPerlPackage rec {
+  MySQLDiff = buildPerlPackage {
     pname = "MySQL-Diff";
     version = "0.60";
     src = fetchurl {
@@ -19168,7 +19168,7 @@ with self; {
     };
   };
 
-  NetSNPP = buildPerlPackage rec {
+  NetSNPP = buildPerlPackage {
     pname = "Net-SNPP";
     version = "1.17";
     src = fetchurl {
@@ -19548,7 +19548,7 @@ with self; {
     };
   };
 
-  OpenAPIClient = buildPerlPackage rec {
+  OpenAPIClient = buildPerlPackage {
     pname = "OpenAPI-Client";
     version = "1.07";
     src = fetchurl {
@@ -20259,7 +20259,7 @@ with self; {
     };
   };
 
-  PDL = buildPerlPackage rec {
+  PDL = buildPerlPackage {
     pname = "PDL";
     version = "2.025";
     src = fetchurl {
@@ -20604,7 +20604,7 @@ with self; {
     };
   };
 
-  PerlTidy = buildPerlPackage rec {
+  PerlTidy = buildPerlPackage {
     pname = "Perl-Tidy";
     version = "20230912";
     src = fetchurl {
@@ -22313,7 +22313,7 @@ with self; {
     };
   };
 
-  SearchXapian = buildPerlPackage rec {
+  SearchXapian = buildPerlPackage {
     pname = "Search-Xapian";
     version = "1.2.25.5";
     src = fetchurl {
@@ -22377,7 +22377,7 @@ with self; {
     };
   };
 
-  DeviceSerialPort = buildPerlPackage rec {
+  DeviceSerialPort = buildPerlPackage {
     pname = "Device-SerialPort";
     version = "1.04";
     src = fetchurl {
@@ -22408,7 +22408,7 @@ with self; {
     };
   };
 
-  SessionToken = buildPerlPackage rec {
+  SessionToken = buildPerlPackage {
     pname = "Session-Token";
     version = "1.503";
     src = fetchurl {
@@ -22483,7 +22483,7 @@ with self; {
     };
   };
 
-  SmartComments = buildPerlPackage rec {
+  SmartComments = buildPerlPackage {
     pname = "Smart-Comments";
     version = "1.06";
     src = fetchurl {
@@ -22977,7 +22977,7 @@ with self; {
     };
   };
 
-  StatisticsChiSquare = buildPerlPackage rec {
+  StatisticsChiSquare = buildPerlPackage {
     pname = "Statistics-ChiSquare";
     version = "1.0000";
     src = fetchurl {
@@ -25602,7 +25602,7 @@ with self; {
     };
   };
 
-  TestPerlTidy = buildPerlModule rec {
+  TestPerlTidy = buildPerlModule {
     pname = "Test-PerlTidy";
     version = "20230226";
     src = fetchurl {
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 4f0c0d4219cf0..e75f863bbcbce 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -150,6 +150,7 @@ mapAliases ({
   factory_boy = factory-boy; # added 2023-10-08
   fake_factory = throw "fake_factory has been removed because it is unused and deprecated by upstream since 2016."; # added 2022-05-30
   fastnlo_toolkit = fastnlo-toolkit; # added 2024-01-03
+  fastpair = throw "fastpair is unmaintained upstream and has therefore been removed"; # added 2024-05-01
   faulthandler = throw "faulthandler is built into ${python.executable}"; # added 2021-07-12
   inherit (super.pkgs) fetchPypi; # added 2023-05-25
   filebrowser_safe = filebrowser-safe; # added 2024-01-03
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d679aa003f5eb..754a18310412c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4115,8 +4115,6 @@ self: super: with self; {
 
   fastnumbers = callPackage ../development/python-modules/fastnumbers { };
 
-  fastpair = callPackage ../development/python-modules/fastpair { };
-
   fastparquet = callPackage ../development/python-modules/fastparquet { };
 
   fastpbkdf2 = callPackage ../development/python-modules/fastpbkdf2 { };