about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--nixos/doc/manual/release-notes/rl-2311.section.md2
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/monitoring/goss.md44
-rw-r--r--nixos/modules/services/monitoring/goss.nix86
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/goss.nix53
-rw-r--r--pkgs/applications/audio/snd/default.nix4
-rw-r--r--pkgs/applications/editors/ne/default.nix4
-rw-r--r--pkgs/applications/editors/notepad-next/default.nix4
-rw-r--r--pkgs/applications/editors/standardnotes/src.json10
-rw-r--r--pkgs/applications/emulators/retroarch/cores.nix10
-rw-r--r--pkgs/applications/emulators/retroarch/hashes.json6
-rwxr-xr-xpkgs/applications/emulators/retroarch/update_cores.py3
-rw-r--r--pkgs/applications/graphics/drawio/default.nix23
-rw-r--r--pkgs/applications/graphics/mozjpeg/default.nix4
-rw-r--r--pkgs/applications/graphics/pizarra/default.nix6
-rw-r--r--pkgs/applications/misc/fluidd/default.nix4
-rw-r--r--pkgs/applications/misc/jetbrains-toolbox/default.nix4
-rw-r--r--pkgs/applications/misc/k40-whisperer/default.nix4
-rw-r--r--pkgs/applications/misc/system76-keyboard-configurator/default.nix6
-rw-r--r--pkgs/applications/misc/ulauncher/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/polypane/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/vivaldi/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/kubefirst/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/pinniped/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terranix/default.nix4
-rw-r--r--pkgs/applications/networking/feedreaders/rssguard/default.nix4
-rw-r--r--pkgs/applications/networking/ids/suricata/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix4
-rw-r--r--pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/gnunet/gtk.nix4
-rw-r--r--pkgs/applications/office/timeular/default.nix4
-rw-r--r--pkgs/applications/radio/flrig/default.nix4
-rw-r--r--pkgs/applications/science/biology/dssp/default.nix13
-rw-r--r--pkgs/applications/science/biology/raxml/default.nix4
-rw-r--r--pkgs/applications/version-management/ghr/default.nix6
-rw-r--r--pkgs/applications/version-management/gql/default.nix6
-rw-r--r--pkgs/applications/virtualization/nixpacks/default.nix6
-rw-r--r--pkgs/by-name/ne/netclient/package.nix6
-rw-r--r--pkgs/data/fonts/lxgw-neoxihei/default.nix4
-rw-r--r--pkgs/data/fonts/sarasa-gothic/default.nix4
-rw-r--r--pkgs/data/fonts/sudo/default.nix4
-rw-r--r--pkgs/data/icons/tau-hydrogen/default.nix4
-rw-r--r--pkgs/development/interpreters/rune/default.nix9
-rw-r--r--pkgs/development/libraries/libcifpp/default.nix13
-rw-r--r--pkgs/development/libraries/libcmis/default.nix4
-rw-r--r--pkgs/development/libraries/libdatachannel/default.nix4
-rw-r--r--pkgs/development/libraries/libnats-c/default.nix4
-rw-r--r--pkgs/development/libraries/openturns/default.nix4
-rw-r--r--pkgs/development/libraries/qtpbfimageplugin/default.nix4
-rw-r--r--pkgs/development/libraries/science/astronomy/libxisf/default.nix4
-rw-r--r--pkgs/development/libraries/sdbus-cpp/default.nix4
-rw-r--r--pkgs/development/libraries/vc/default.nix4
-rw-r--r--pkgs/development/mobile/genymotion/default.nix4
-rw-r--r--pkgs/development/python-modules/a2wsgi/default.nix6
-rw-r--r--pkgs/development/python-modules/anytree/default.nix4
-rw-r--r--pkgs/development/python-modules/asyncssh/default.nix4
-rw-r--r--pkgs/development/python-modules/azure-mgmt-cdn/default.nix24
-rw-r--r--pkgs/development/python-modules/bincopy/default.nix4
-rw-r--r--pkgs/development/python-modules/django-allauth-2fa/default.nix49
-rw-r--r--pkgs/development/python-modules/django-pwa/default.nix49
-rw-r--r--pkgs/development/python-modules/localstack-ext/default.nix4
-rw-r--r--pkgs/development/python-modules/pyjnius/default.nix4
-rw-r--r--pkgs/development/python-modules/pyocr/default.nix16
-rw-r--r--pkgs/development/python-modules/pyocr/paths.patch74
-rw-r--r--pkgs/development/python-modules/pyqt/pyqt6-sip.nix4
-rw-r--r--pkgs/development/python-modules/pyside2/default.nix4
-rw-r--r--pkgs/development/python-modules/pytapo/default.nix4
-rw-r--r--pkgs/development/python-modules/pytesseract/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-flask/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest-pylint/default.nix4
-rw-r--r--pkgs/development/python-modules/pytorch-lightning/default.nix4
-rw-r--r--pkgs/development/python-modules/s3fs/default.nix4
-rw-r--r--pkgs/development/python-modules/sshfs/default.nix4
-rw-r--r--pkgs/development/python-modules/traits/default.nix4
-rw-r--r--pkgs/development/python-modules/transmission-rpc/default.nix4
-rw-r--r--pkgs/development/python-modules/trytond/default.nix4
-rw-r--r--pkgs/development/python-modules/yark/default.nix4
-rw-r--r--pkgs/development/tools/abuild/default.nix4
-rw-r--r--pkgs/development/tools/confluent-cli/default.nix2
-rw-r--r--pkgs/development/tools/darklua/default.nix6
-rw-r--r--pkgs/development/tools/devbox/default.nix6
-rw-r--r--pkgs/development/tools/dyff/default.nix6
-rw-r--r--pkgs/development/tools/eclint/default.nix6
-rw-r--r--pkgs/development/tools/go-junit-report/default.nix4
-rw-r--r--pkgs/development/tools/karate/default.nix4
-rw-r--r--pkgs/development/tools/parsing/re-flex/default.nix4
-rw-r--r--pkgs/development/tools/pulumictl/default.nix4
-rw-r--r--pkgs/development/tools/regclient/default.nix6
-rw-r--r--pkgs/development/tools/roswell/default.nix4
-rw-r--r--pkgs/development/tools/sqldef/default.nix6
-rw-r--r--pkgs/games/vassal/default.nix4
-rw-r--r--pkgs/os-specific/linux/akvcam/default.nix4
-rw-r--r--pkgs/os-specific/linux/r8125/default.nix4
-rw-r--r--pkgs/servers/amqp/rabbitmq-server/default.nix4
-rw-r--r--pkgs/servers/confluent-platform/default.nix6
-rw-r--r--pkgs/servers/memcached/default.nix4
-rw-r--r--pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix6
-rw-r--r--pkgs/servers/nosql/janusgraph/default.nix4
-rw-r--r--pkgs/servers/nosql/questdb/default.nix4
-rw-r--r--pkgs/servers/pulseaudio/default.nix64
-rw-r--r--pkgs/servers/readarr/default.nix8
-rw-r--r--pkgs/servers/search/qdrant/Cargo.lock104
-rw-r--r--pkgs/servers/search/qdrant/default.nix4
-rw-r--r--pkgs/servers/snappymail/default.nix4
-rw-r--r--pkgs/servers/spicedb/zed.nix4
-rw-r--r--pkgs/servers/ttyd/default.nix4
-rw-r--r--pkgs/shells/loksh/default.nix4
-rw-r--r--pkgs/tools/backup/kopia/default.nix6
-rw-r--r--pkgs/tools/filesystems/ssdfs-utils/default.nix6
-rw-r--r--pkgs/tools/graphics/gromit-mpx/default.nix4
-rw-r--r--pkgs/tools/inputmethods/libinput-gestures/default.nix4
-rw-r--r--pkgs/tools/misc/ddccontrol/default.nix4
-rw-r--r--pkgs/tools/misc/goss/default.nix34
-rw-r--r--pkgs/tools/misc/gwe/default.nix4
-rw-r--r--pkgs/tools/misc/panicparse/default.nix6
-rw-r--r--pkgs/tools/misc/profile-sync-daemon/default.nix4
-rw-r--r--pkgs/tools/misc/rtx/default.nix6
-rw-r--r--pkgs/tools/misc/usbimager/default.nix4
-rw-r--r--pkgs/tools/misc/viddy/default.nix6
-rw-r--r--pkgs/tools/networking/offlineimap/default.nix9
-rw-r--r--pkgs/tools/networking/q/default.nix6
-rw-r--r--pkgs/tools/networking/stunnel/default.nix4
-rw-r--r--pkgs/tools/networking/swagger-codegen/default.nix4
-rw-r--r--pkgs/tools/security/keybase/default.nix4
-rw-r--r--pkgs/tools/security/spire/default.nix6
-rw-r--r--pkgs/tools/system/fio/default.nix4
-rw-r--r--pkgs/tools/system/rsyslog/default.nix4
-rw-r--r--pkgs/tools/text/platinum-searcher/default.nix4
-rw-r--r--pkgs/tools/text/poedit/default.nix4
-rw-r--r--pkgs/tools/virtualization/mkosi/default.nix10
-rw-r--r--pkgs/tools/wayland/swayrbar/default.nix6
-rw-r--r--pkgs/top-level/python-packages.nix4
133 files changed, 784 insertions, 413 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 9a405a91f37da..ee5e6d45a76a4 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -86,6 +86,8 @@
 
 - [pgBouncer](https://www.pgbouncer.org), a PostgreSQL connection pooler. Available as [services.pgbouncer](#opt-services.pgbouncer.enable).
 
+- [Goss](https://goss.rocks/), a YAML based serverspec alternative tool for validating a server's configuration. Available as [services.goss](#opt-services.goss.enable).
+
 - [trust-dns](https://trust-dns.org/), a Rust based DNS server built to be safe and secure from the ground up. Available as [services.trust-dns](#opt-services.trust-dns.enable).
 
 - [osquery](https://www.osquery.io/), a SQL powered operating system instrumentation, monitoring, and analytics.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 4d8fa8159a890..95b1dce70f94a 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -773,6 +773,7 @@
   ./services/monitoring/datadog-agent.nix
   ./services/monitoring/do-agent.nix
   ./services/monitoring/fusion-inventory.nix
+  ./services/monitoring/goss.nix
   ./services/monitoring/grafana-agent.nix
   ./services/monitoring/grafana-image-renderer.nix
   ./services/monitoring/grafana-reporter.nix
diff --git a/nixos/modules/services/monitoring/goss.md b/nixos/modules/services/monitoring/goss.md
new file mode 100644
index 0000000000000..1e636aa3bdf33
--- /dev/null
+++ b/nixos/modules/services/monitoring/goss.md
@@ -0,0 +1,44 @@
+# Goss {#module-services-goss}
+
+[goss](https://goss.rocks/) is a YAML based serverspec alternative tool
+for validating a server's configuration.
+
+## Basic Usage {#module-services-goss-basic-usage}
+
+A minimal configuration looks like this:
+
+```
+{
+  services.goss = {
+    enable = true;
+
+    environment = {
+      GOSS_FMT = "json";
+      GOSS_LOGLEVEL = "TRACE";
+    };
+
+    settings = {
+      addr."tcp://localhost:8080" = {
+        reachable = true;
+        local-address = "127.0.0.1";
+      };
+      command."check-goss-version" = {
+        exec = "${lib.getExe pkgs.goss} --version";
+        exit-status = 0;
+      };
+      dns.localhost.resolvable = true;
+      file."/nix" = {
+        filetype = "directory";
+        exists = true;
+      };
+      group.root.exists = true;
+      kernel-param."kernel.ostype".value = "Linux";
+      service.goss = {
+        enabled = true;
+        running = true;
+      };
+      user.root.exists = true;
+    };
+  };
+}
+```
diff --git a/nixos/modules/services/monitoring/goss.nix b/nixos/modules/services/monitoring/goss.nix
new file mode 100644
index 0000000000000..64a8dad0703e8
--- /dev/null
+++ b/nixos/modules/services/monitoring/goss.nix
@@ -0,0 +1,86 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.goss;
+
+  settingsFormat = pkgs.formats.yaml { };
+  configFile = settingsFormat.generate "goss.yaml" cfg.settings;
+
+in {
+  meta = {
+    doc = ./goss.md;
+    maintainers = [ lib.maintainers.anthonyroussel ];
+  };
+
+  options = {
+    services.goss = {
+      enable = lib.mkEnableOption (lib.mdDoc "Goss daemon");
+
+      package = lib.mkPackageOptionMD pkgs "goss" { };
+
+      environment = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        example = {
+          GOSS_FMT = "json";
+          GOSS_LOGLEVEL = "FATAL";
+          GOSS_LISTEN = ":8080";
+        };
+        description = lib.mdDoc ''
+          Environment variables to set for the goss service.
+
+          See <https://github.com/goss-org/goss/blob/master/docs/manual.md>
+        '';
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule { freeformType = settingsFormat.type; };
+        default = { };
+        example = {
+          addr."tcp://localhost:8080" = {
+            reachable = true;
+            local-address = "127.0.0.1";
+          };
+          service.goss = {
+            enabled = true;
+            running = true;
+          };
+        };
+        description = lib.mdDoc ''
+          The global options in `config` file in yaml format.
+
+          Refer to <https://github.com/goss-org/goss/blob/master/docs/goss-json-schema.yaml> for schema.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.goss = {
+      description = "Goss - Quick and Easy server validation";
+      unitConfig.Documentation = "https://github.com/goss-org/goss/blob/master/docs/manual.md";
+
+      after = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+
+      environment = {
+        GOSS_FILE = configFile;
+      } // cfg.environment;
+
+      reloadTriggers = [ configFile ];
+
+      serviceConfig = {
+        DynamicUser = true;
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        ExecStart = "${cfg.package}/bin/goss serve";
+        Group = "goss";
+        Restart = "on-failure";
+        RestartSec = 5;
+        User = "goss";
+      };
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 4a3f4a331ca80..7a599c74c9f94 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -329,6 +329,7 @@ in {
   gollum = handleTest ./gollum.nix {};
   gonic = handleTest ./gonic.nix {};
   google-oslogin = handleTest ./google-oslogin {};
+  goss = handleTest ./goss.nix {};
   gotify-server = handleTest ./gotify-server.nix {};
   gotosocial = runTest ./web-apps/gotosocial.nix;
   grafana = handleTest ./grafana {};
diff --git a/nixos/tests/goss.nix b/nixos/tests/goss.nix
new file mode 100644
index 0000000000000..6b772d19215e3
--- /dev/null
+++ b/nixos/tests/goss.nix
@@ -0,0 +1,53 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "goss";
+  meta.maintainers = [ lib.maintainers.anthonyroussel ];
+
+  nodes.machine = {
+    environment.systemPackages = [ pkgs.jq ];
+
+    services.goss = {
+      enable = true;
+
+      environment = {
+        GOSS_FMT = "json";
+      };
+
+      settings = {
+        addr."tcp://localhost:8080" = {
+          reachable = true;
+          local-address = "127.0.0.1";
+        };
+        command."check-goss-version" = {
+          exec = "${lib.getExe pkgs.goss} --version";
+          exit-status = 0;
+        };
+        dns.localhost.resolvable = true;
+        file."/nix" = {
+          filetype = "directory";
+          exists = true;
+        };
+        group.root.exists = true;
+        kernel-param."kernel.ostype".value = "Linux";
+        service.goss = {
+          enabled = true;
+          running = true;
+        };
+        user.root.exists = true;
+      };
+    };
+  };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("goss.service")
+    machine.wait_for_open_port(8080)
+
+    with subtest("returns health status"):
+      result = json.loads(machine.succeed("curl -sS http://localhost:8080/healthz"))
+
+      assert len(result["results"]) == 10, f".results should be an array of 10 items, was {result['results']!r}"
+      assert result["summary"]["failed-count"] == 0, f".summary.failed-count should be zero, was {result['summary']['failed-count']}"
+      assert result["summary"]["test-count"] == 10, f".summary.test-count should be 10, was {result['summary']['test-count']}"
+    '';
+})
diff --git a/pkgs/applications/audio/snd/default.nix b/pkgs/applications/audio/snd/default.nix
index 8cf233c37f70d..f82043c8dc5b3 100644
--- a/pkgs/applications/audio/snd/default.nix
+++ b/pkgs/applications/audio/snd/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "snd";
-  version = "23.6";
+  version = "23.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/snd/snd-${version}.tar.gz";
-    sha256 = "sha256-3oh2kFhCYe1sl4MN336Z6pEmpluiUnlcC5aAZxn0zIE=";
+    sha256 = "sha256-g2+7i1+TgX17TpW1mHSdAzHKC/Gtm4NYZCmuVoPo2rg=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/editors/ne/default.nix b/pkgs/applications/editors/ne/default.nix
index f783dfea81c23..e8cb1a572f70c 100644
--- a/pkgs/applications/editors/ne/default.nix
+++ b/pkgs/applications/editors/ne/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ne";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchFromGitHub {
     owner = "vigna";
     repo = pname;
     rev = version;
-    sha256 = "sha256-mRMACfWcUW6/R43riRGNce4Ac5IRo4YEML8H0oGSH5o=";
+    sha256 = "sha256-lbXb/ZY0+vkOB8mXkHDaehXZMzrpx3A0jWnLpCjhMDE=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/editors/notepad-next/default.nix b/pkgs/applications/editors/notepad-next/default.nix
index 1c57658026c47..c2085bcf0455d 100644
--- a/pkgs/applications/editors/notepad-next/default.nix
+++ b/pkgs/applications/editors/notepad-next/default.nix
@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "notepad-next";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchFromGitHub {
     owner = "dail8859";
     repo = "NotepadNext";
     rev = "v${version}";
-    sha256 = "sha256-1ci1g+qBDsw9IkqjI3tRvMsLBvnPU+nn7heYuid/e5M=";
+    sha256 = "sha256-m8+kM9uz3gJ3kvpgZdoonSvYlh/f1WiGZlB8JKMTXh4=";
     # External dependencies - https://github.com/dail8859/NotepadNext/issues/135
     fetchSubmodules = true;
   };
diff --git a/pkgs/applications/editors/standardnotes/src.json b/pkgs/applications/editors/standardnotes/src.json
index 59c79721a6ef5..16598d02485c3 100644
--- a/pkgs/applications/editors/standardnotes/src.json
+++ b/pkgs/applications/editors/standardnotes/src.json
@@ -1,13 +1,13 @@
 {
-  "version": "3.173.4",
+  "version": "3.178.4",
   "deb": {
     "x86_64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.173.4/standard-notes-3.173.4-linux-amd64.deb",
-      "hash": "sha512-8GDzj7Xm61rF5xybLE74D4yMbT2HgEG0ez1gQio/qWtWSqY72+GSKWlCA+3wz8Mz2jThRDlka9s2fHBBUvG+fg=="
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.178.4/standard-notes-3.178.4-linux-amd64.deb",
+      "hash": "sha512-6er/a9PqhKU4aagAxsbVdoXbRBNUr3Fa8BPWfuQ74Q4ai+iYlPjd4q50cTJQ4wJ5ucGyopgBEJq4/xYNunw6Ig=="
     },
     "aarch64-linux": {
-      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.173.4/standard-notes-3.173.4-linux-arm64.deb",
-      "hash": "sha512-yJ8yZK+RkPUzkjbscCXT5yv9BxeHGQsZsCrKwOJRdd/XbcVPnKWQm00JVZmMuz17d8rhm8Km/EW81JufZByM0Q=="
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.178.4/standard-notes-3.178.4-linux-arm64.deb",
+      "hash": "sha512-lvvXCK3XOIH9HS1EU5eVBo4W8VoE4iM1Ve1XkZ/CysYBYLaXojXyybeN5Iw1Rmuk3trq/7RebjkNx/rxhsU0LQ=="
     }
   }
 }
diff --git a/pkgs/applications/emulators/retroarch/cores.nix b/pkgs/applications/emulators/retroarch/cores.nix
index 525682c603d25..e1805df07c2e0 100644
--- a/pkgs/applications/emulators/retroarch/cores.nix
+++ b/pkgs/applications/emulators/retroarch/cores.nix
@@ -164,16 +164,6 @@ in
     };
   };
 
-  beetle-snes = mkLibretroCore {
-    core = "mednafen-snes";
-    src = getCoreSrc "beetle-snes";
-    makefile = "Makefile";
-    meta = {
-      description = "Port of Mednafen's SNES core to libretro";
-      license = lib.licenses.gpl2Only;
-    };
-  };
-
   beetle-supafaust = mkLibretroCore {
     core = "mednafen-supafaust";
     src = getCoreSrc "beetle-supafaust";
diff --git a/pkgs/applications/emulators/retroarch/hashes.json b/pkgs/applications/emulators/retroarch/hashes.json
index f1099967fe789..78cb11c7d98dd 100644
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@@ -59,12 +59,6 @@
         "rev": "cd395e9e3ee407608450ebc565e871b24e7ffed6",
         "hash": "sha256-EIZRv1EydfLWFoBb8TzvAY3kkL9Qr2OrwrljOnnM92A="
     },
-    "beetle-snes": {
-        "owner": "libretro",
-        "repo": "beetle-bsnes-libretro",
-        "rev": "d770563fc3c4bd9abb522952cefb4aa923ba0b91",
-        "hash": "sha256-zHPtfgp9hc8Q4gXJ5VgfJLWLeYjCsQhkfU1T5RM7AL0="
-    },
     "beetle-supafaust": {
         "owner": "libretro",
         "repo": "supafaust",
diff --git a/pkgs/applications/emulators/retroarch/update_cores.py b/pkgs/applications/emulators/retroarch/update_cores.py
index 5348092c52473..e9536d8318dca 100755
--- a/pkgs/applications/emulators/retroarch/update_cores.py
+++ b/pkgs/applications/emulators/retroarch/update_cores.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=../../../../ -i python3 -p "python3.withPackages (ps: with ps; [ requests nix-prefetch-github ])" -p "git"
+#!nix-shell -I nixpkgs=../../../../ -i python3 -p "python3.withPackages (ps: with ps; [ nix-prefetch-github ])" -p "git"
 
 import json
 import os
@@ -22,7 +22,6 @@ CORES = {
     "beetle-pcfx": {"repo": "beetle-pcfx-libretro"},
     "beetle-psx": {"repo": "beetle-psx-libretro"},
     "beetle-saturn": {"repo": "beetle-saturn-libretro"},
-    "beetle-snes": {"repo": "beetle-bsnes-libretro"},
     "beetle-supafaust": {"repo": "supafaust"},
     "beetle-supergrafx": {"repo": "beetle-supergrafx-libretro"},
     "beetle-vb": {"repo": "beetle-vb-libretro"},
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 92414531522e8..d0fb1280c3428 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -4,7 +4,6 @@
 , fetchYarnDeps
 , makeDesktopItem
 , copyDesktopItems
-, desktopToDarwinBundle
 , fixup_yarn_lock
 , makeWrapper
 , nodejs
@@ -30,12 +29,13 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    copyDesktopItems
     fixup_yarn_lock
     makeWrapper
     nodejs
     yarn
-  ] ++ lib.optional stdenv.isDarwin desktopToDarwinBundle;
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    copyDesktopItems
+  ];
 
   ELECTRON_SKIP_BINARY_DOWNLOAD = true;
 
@@ -54,9 +54,15 @@ stdenv.mkDerivation rec {
   buildPhase = ''
     runHook preBuild
 
+  '' + lib.optionalString stdenv.isDarwin ''
+    cp -R ${electron}/Applications/Electron.app Electron.app
+    chmod -R u+w Electron.app
+    export CSC_IDENTITY_AUTO_DISCOVERY=false
+    sed -i "/afterSign/d" electron-builder-linux-mac.json
+  '' + ''
     yarn --offline run electron-builder --dir \
       --config electron-builder-linux-mac.json \
-      -c.electronDist=${electron}/libexec/electron \
+      -c.electronDist=${if stdenv.isDarwin then "." else "${electron}/libexec/electron"} \
       -c.electronVersion=${electron.version}
 
     runHook postBuild
@@ -65,6 +71,13 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
+  '' + lib.optionalString stdenv.isDarwin ''
+    mkdir -p $out/{Applications,bin}
+    mv dist/mac*/draw.io.app $out/Applications
+
+    # Symlinking `draw.io` doesn't work; seems to look for files in the wrong place.
+    makeWrapper $out/Applications/draw.io.app/Contents/MacOS/draw.io $out/bin/drawio
+  '' + lib.optionalString (!stdenv.isDarwin) ''
     mkdir -p "$out/share/lib/drawio"
     cp -r dist/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/drawio"
 
@@ -74,6 +87,7 @@ stdenv.mkDerivation rec {
       --add-flags "$out/share/lib/drawio/resources/app.asar" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
       --inherit-argv0
+  '' + ''
 
     runHook postInstall
   '';
@@ -98,6 +112,5 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/jgraph/drawio-desktop/releases/tag/v${version}";
     maintainers = with maintainers; [ qyliss darkonion0 ];
     platforms = platforms.darwin ++ platforms.linux;
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/applications/graphics/mozjpeg/default.nix b/pkgs/applications/graphics/mozjpeg/default.nix
index 3cb4b001124f2..b693626fae644 100644
--- a/pkgs/applications/graphics/mozjpeg/default.nix
+++ b/pkgs/applications/graphics/mozjpeg/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, libpng, zlib, nasm }:
 
 stdenv.mkDerivation rec {
-  version = "4.1.4";
+  version = "4.1.5";
   pname = "mozjpeg";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "mozjpeg";
     rev = "v${version}";
-    sha256 = "sha256-F9W7tWfcNP2UNuwMbYiSvS8BnFq4ob//b8AXXrRjVuA=";
+    sha256 = "sha256-k8qWtU4j3ipIHvY60ae7kdNnPvWnUa0qgacqlSIJijo=";
   };
 
   cmakeFlags = [ "-DENABLE_STATIC=NO" "-DPNG_SUPPORTED=TRUE" ]; # See https://github.com/mozilla/mozjpeg/issues/351
diff --git a/pkgs/applications/graphics/pizarra/default.nix b/pkgs/applications/graphics/pizarra/default.nix
index e428d02d9dcdc..ccf21d630e649 100644
--- a/pkgs/applications/graphics/pizarra/default.nix
+++ b/pkgs/applications/graphics/pizarra/default.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pizarra";
-  version = "1.7.4";
+  version = "1.7.5";
 
   src = fetchFromGitLab {
     owner = "categulario";
     repo = "pizarra-gtk";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-fWwAmzF3ppCvJZ0K4EDrmP8SVPVRayEQTtbhNscZIF0=";
+    sha256 = "sha256-vnjhveX3EVIfJLiHWhlvhoPcRx1a8Nnjj7hIaPgU3Zw=";
   };
 
-  cargoSha256 = "sha256-pxRJXUeFGdVj6iCFZ4Y8b9z5hw83g8YywpKztTZ0g+4=";
+  cargoHash = "sha256-btvMUKADGHlXLmeKF1K9Js44SljZ0MejGId8aDwPhVU=";
 
   nativeBuildInputs = [ wrapGAppsHook pkg-config gdk-pixbuf ];
 
diff --git a/pkgs/applications/misc/fluidd/default.nix b/pkgs/applications/misc/fluidd/default.nix
index ff1630dc3504d..bb47e1a251adf 100644
--- a/pkgs/applications/misc/fluidd/default.nix
+++ b/pkgs/applications/misc/fluidd/default.nix
@@ -2,12 +2,12 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "fluidd";
-  version = "1.25.3";
+  version = "1.26.0";
 
   src = fetchurl {
     name = "fluidd-v${version}.zip";
     url = "https://github.com/cadriel/fluidd/releases/download/v${version}/fluidd.zip";
-    sha256 = "sha256-raslLhVbeUL6Zoz5cw+fKtqdUvAkd7frAncd+q1AVxs=";
+    sha256 = "sha256-Y0d3TgSLrxA2kPWlHrNC8GlEcD7s4VZR2YZlderZ3gI=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/misc/jetbrains-toolbox/default.nix b/pkgs/applications/misc/jetbrains-toolbox/default.nix
index 1a2304d340447..569492d296e86 100644
--- a/pkgs/applications/misc/jetbrains-toolbox/default.nix
+++ b/pkgs/applications/misc/jetbrains-toolbox/default.nix
@@ -10,11 +10,11 @@
 }:
 let
   pname = "jetbrains-toolbox";
-  version = "2.0.4.17212";
+  version = "2.0.5.17700";
 
   src = fetchzip {
     url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${version}.tar.gz";
-    sha256 = "sha256-lnTYLZJBiM8nnUvMqtcp/i/VNek/9zlxYyZFa+hew5g=";
+    sha256 = "sha256-BO9W9miQUltsg1tCyTl9j5xRCJUCsO02hUKDCYt7hd8=";
     stripRoot = false;
   };
 
diff --git a/pkgs/applications/misc/k40-whisperer/default.nix b/pkgs/applications/misc/k40-whisperer/default.nix
index 720536b18e517..a6059ae44f88f 100644
--- a/pkgs/applications/misc/k40-whisperer/default.nix
+++ b/pkgs/applications/misc/k40-whisperer/default.nix
@@ -23,12 +23,12 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "k40-whisperer";
-  version = "0.62";
+  version = "0.67";
 
   src = fetchzip {
     url = "https://www.scorchworks.com/K40whisperer/K40_Whisperer-${version}_src.zip";
     stripRoot = true;
-    sha256 = "sha256-3O+lCpmsCCu61REuxhrV8Uy01AgEGq/1DlMhjo45URM=";
+    sha256 = "sha256-jyny5uNZ5eL4AV47uAgOhBe4Zqg8GK3e86Z9gZbC68s=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/misc/system76-keyboard-configurator/default.nix b/pkgs/applications/misc/system76-keyboard-configurator/default.nix
index 0d1b78ca918b7..21cec72c5f808 100644
--- a/pkgs/applications/misc/system76-keyboard-configurator/default.nix
+++ b/pkgs/applications/misc/system76-keyboard-configurator/default.nix
@@ -6,13 +6,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "system76-keyboard-configurator";
-  version = "1.3.9";
+  version = "1.3.10";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "keyboard-configurator";
     rev = "v${version}";
-    sha256 = "sha256-06qiJ3NZZSvDBH7r6K1qnz0q4ngB45wBoaG6eTFiRtk=";
+    sha256 = "sha256-5U9LWFaCwszvT1reu6NflPKQUrsQkP/NdSO4LBHWm2g=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
     udev
   ];
 
-  cargoHash = "sha256-tcyLoXOrC+lrFVRzxWfWpvHpfA6tbEBXFj9mSeTLcbc=";
+  cargoHash = "sha256-S4+cS4m69nqDN2h0vwyO35fFFBEa0Rcxx0XDBfSNLp0=";
 
   meta = with lib; {
     description = "Keyboard configuration application for System76 keyboards and laptops";
diff --git a/pkgs/applications/misc/ulauncher/default.nix b/pkgs/applications/misc/ulauncher/default.nix
index 23e348aad010e..96f033744e6b2 100644
--- a/pkgs/applications/misc/ulauncher/default.nix
+++ b/pkgs/applications/misc/ulauncher/default.nix
@@ -21,11 +21,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ulauncher";
-  version = "5.15.3";
+  version = "5.15.4";
 
   src = fetchurl {
     url = "https://github.com/Ulauncher/Ulauncher/releases/download/${version}/ulauncher_${version}.tar.gz";
-    sha256 = "sha256-unAic6GTgvZFFJwPERh164vfDiFE0zLEUjgADR94w5w=";
+    sha256 = "sha256-5pEpYnJFHQKEfTve07ngFVDAOM9+kwrx6hc30gEwsko=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/networking/browsers/polypane/default.nix b/pkgs/applications/networking/browsers/polypane/default.nix
index 21dde7700b222..d9c9ed6165899 100644
--- a/pkgs/applications/networking/browsers/polypane/default.nix
+++ b/pkgs/applications/networking/browsers/polypane/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "polypane";
-  version = "15.0.0";
+  version = "15.0.1";
 
   src = fetchurl {
     url = "https://github.com/firstversionist/${pname}/releases/download/v${version}/${pname}-${version}.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-O0VWgx6FKulELZuJgMwFgGSo+EaCqb9dgneF2XFnq7U=";
+    sha256 = "sha256-CU5PI+9iBcxZdhhs2QjfZTViU2xQ3i+T+4Wzp+yeKEE=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
index a956dee90d1a6..2ce73facf61eb 100644
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -24,7 +24,7 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "6.2.3105.54";
+  version = "6.2.3105.58";
 
   suffix = {
     aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
     hash = {
-      aarch64-linux = "sha256-QqdCnwSrqJAEj++xcr3cOkKSbZIFkyvMutxsLNR/Moc=";
-      x86_64-linux = "sha256-z5/l94MFhpHRLvbUdSwFSSt3n21mPZJzanYugXecLFk=";
+      aarch64-linux = "sha256-PDy+cenU1D9UKlICgZgj/KKZFq5x8iSDpbtCr06ks70=";
+      x86_64-linux = "sha256-uWv4odg/nEuY6B8Jzt5Br4pUFMlG0vGEt968PajxMUA=";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
diff --git a/pkgs/applications/networking/cluster/kubefirst/default.nix b/pkgs/applications/networking/cluster/kubefirst/default.nix
index d7eb948109512..8c15855576b88 100644
--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubefirst";
-  version = "2.2.17";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "kubefirst";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cqKnoGRW+IquuZ7wvCRipRJ6mO18w/yhf5nS094vs7c=";
+    hash = "sha256-5znZMr0Dj6kpKJbypICN5+Fv/+3FgTLBok3YMrWaHdo=";
   };
 
-  vendorHash = "sha256-0J27JSewc0DCcc3xvl2DBZE/b0qKuozuP7tFdbrRX7I=";
+  vendorHash = "sha256-/iAGUnIMH2+IrvvXig56SpZ0eTfVwaCgGMUDp5/MtEo=";
 
   ldflags = [ "-s" "-w" "-X github.com/kubefirst/runtime/configs.K1Version=v${version}"];
 
diff --git a/pkgs/applications/networking/cluster/pinniped/default.nix b/pkgs/applications/networking/cluster/pinniped/default.nix
index 823fdfb434d72..bf028f30f7493 100644
--- a/pkgs/applications/networking/cluster/pinniped/default.nix
+++ b/pkgs/applications/networking/cluster/pinniped/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec{
   pname = "pinniped";
-  version = "0.26.0";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "pinniped";
     rev = "v${version}";
-    sha256 = "sha256-z+JwtrP3WGMK11RRYrDig5SrX6YCj7U3AwuLg/J8dgs=";
+    sha256 = "sha256-Nhm2dLEFI+fAJ2lLE9z+3Qug3bbsoiRjex89Pa9oAVQ=";
   };
 
   subPackages = "cmd/pinniped";
 
-  vendorHash = "sha256-QywpqgQj76x0zmn4eC74fy7UECK4K81WO+nxOYKZqq0=";
+  vendorHash = "sha256-4y513BkV3EYgqlim2eXw02m36wtUVQeegmQiMZ3HyWg=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/networking/cluster/terranix/default.nix b/pkgs/applications/networking/cluster/terranix/default.nix
index f1781cca3950d..2c42ac08d0591 100644
--- a/pkgs/applications/networking/cluster/terranix/default.nix
+++ b/pkgs/applications/networking/cluster/terranix/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "terranix";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "mrVanDalo";
     repo = "terranix";
     rev = version;
-    sha256 = "sha256-pNuJxmVMGbBHw7pa+Bx0HY0orXIXoyyAXOKuQ1zpfus=";
+    sha256 = "sha256-xiUfVD6rtsVWFotVtUW3Q1nQh4obKzgvpN1wqZuGXvM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/networking/feedreaders/rssguard/default.nix b/pkgs/applications/networking/feedreaders/rssguard/default.nix
index 95c274ab88ad1..da654a6bdd392 100644
--- a/pkgs/applications/networking/feedreaders/rssguard/default.nix
+++ b/pkgs/applications/networking/feedreaders/rssguard/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rssguard";
-  version = "4.5.0";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "martinrotter";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-R3fw5GLQUYZUX1kH6e0IRQ/I/IsFTOK6aP5h5QVU0Ps=";
+    sha256 = "sha256-tgXBsby9ML+m4b2hvLXHIb552o5x6l3kO8YTeZRCExI=";
   };
 
   buildInputs =  [ qtwebengine qttools ];
diff --git a/pkgs/applications/networking/ids/suricata/default.nix b/pkgs/applications/networking/ids/suricata/default.nix
index 9c0a5ea086f8f..c8db9d33a2ce8 100644
--- a/pkgs/applications/networking/ids/suricata/default.nix
+++ b/pkgs/applications/networking/ids/suricata/default.nix
@@ -33,11 +33,11 @@
 in
 stdenv.mkDerivation rec {
   pname = "suricata";
-  version = "7.0.0";
+  version = "7.0.1";
 
   src = fetchurl {
     url = "https://www.openinfosecfoundation.org/download/${pname}-${version}.tar.gz";
-    hash = "sha256-e80TExGDZkUUZdw/g4Wj9qrdCE/+RN0lfdqBBYY7t2k=";
+    hash = "sha256-YEfHX555qbDMbWx2MgJKQSaBK8IS9SrPXTyBPMfJ+ws=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
index d4a8045d79c50..266c843931b64 100644
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@@ -7,7 +7,7 @@ let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.105.0.208";
+  version = "8.106.0.212";
 
   rpath = lib.makeLibraryPath [
     alsa-lib
@@ -68,7 +68,7 @@ let
           "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
           "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
         ];
-        sha256 = "sha256-P1H9BSXHDmrE8x2kq4Mw5A7r2jVZGSHJh84Hn5EX2lk=";
+        sha256 = "sha256-TlqhCj5nyL8SEo3M6ahPLYOTDrEjHvxtu1qFSR8LtkM=";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
index d7ee8754c91c6..44eba5bc021e7 100644
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@@ -3,12 +3,12 @@ electron, libsecret }:
 
 stdenv.mkDerivation rec {
   pname = "tutanota-desktop";
-  version = "3.118.8";
+  version = "3.118.13";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/${pname}-${version}-unpacked-linux.tar.gz";
     name = "tutanota-desktop-${version}.tar.gz";
-    hash = "sha256-12R8g5U8p2lXNaSeJiCvEb6AgCC40jDXDKO8kyEvM6w=";
+    hash = "sha256-3kpfF/XG7w6qUooS5UsntMKnggG1LhmV9f+R35kkmb0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/p2p/gnunet/gtk.nix b/pkgs/applications/networking/p2p/gnunet/gtk.nix
index 739c3013e5261..a915e3fed8e06 100644
--- a/pkgs/applications/networking/p2p/gnunet/gtk.nix
+++ b/pkgs/applications/networking/p2p/gnunet/gtk.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnunet-gtk";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchurl {
     url = "mirror://gnu/gnunet/${pname}-${version}.tar.gz";
-    sha256 = "sha256-MwAWs1rHXYlRUcAWX8LnCLTwEOSI68aA0s7uZGgYR3w=";
+    sha256 = "sha256-6ZHlDIKrTmr/aRz4k5FtRVxZ7B9Hlh2w42QT4YRsVi0=";
   };
 
   nativeBuildInputs= [
diff --git a/pkgs/applications/office/timeular/default.nix b/pkgs/applications/office/timeular/default.nix
index 2d9148b482139..c576319643f5b 100644
--- a/pkgs/applications/office/timeular/default.nix
+++ b/pkgs/applications/office/timeular/default.nix
@@ -5,12 +5,12 @@
 }:
 
 let
-  version = "6.3.0";
+  version = "6.5.0";
   pname = "timeular";
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/timeular-desktop-packages/linux/production/Timeular-${version}.AppImage";
-    sha256 = "sha256-axdkoqCLg0z1kLa/S0kS4d8yGFuKJRDPRte9c8PYniU=";
+    sha256 = "sha256-RO8PhEjvDye6p6vgqNexIJ1ymTlVtF8yWQAUbJGaZYk=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/radio/flrig/default.nix b/pkgs/applications/radio/flrig/default.nix
index c2aa051e70f19..e660f0c9da7ba 100644
--- a/pkgs/applications/radio/flrig/default.nix
+++ b/pkgs/applications/radio/flrig/default.nix
@@ -8,12 +8,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.0.03";
+  version = "2.0.04";
   pname = "flrig";
 
   src = fetchurl {
     url = "mirror://sourceforge/fldigi/${pname}-${version}.tar.gz";
-    sha256 = "sha256-/5hOryoupl7MYWekx2hL3q+2GMXA6rohjvYy2XTkJBI=";
+    sha256 = "sha256-+AcQ7l1RXFDVVraYySBUE/+ZCyCOMiM2L4LyRXFquUc=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/science/biology/dssp/default.nix b/pkgs/applications/science/biology/dssp/default.nix
index 78f226350f604..febfde548fd7a 100644
--- a/pkgs/applications/science/biology/dssp/default.nix
+++ b/pkgs/applications/science/biology/dssp/default.nix
@@ -3,6 +3,7 @@
 , cmake
 , eigen
 , fetchFromGitHub
+, fetchpatch
 , libcifpp
 , libmcfp
 , zlib
@@ -15,18 +16,26 @@ let
       inherit (oldAttrs.src) owner repo rev;
       hash = "sha256-Sj10j6HxUoUvQ66cd2B8CO7CVBRd7w9CTovxkwPDOvs=";
     };
+    patches = [
+      (fetchpatch {
+        # https://github.com/PDB-REDO/libcifpp/issues/51
+        name = "fix-build-on-darwin.patch";
+        url = "https://github.com/PDB-REDO/libcifpp/commit/641f06a7e7c0dc54af242b373820f2398f59e7ac.patch";
+        hash = "sha256-eWNfp9nA/+2J6xjZR6Tj+5OM3L5MxdfRi0nBzyaqvS0=";
+      })
+    ];
   });
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dssp";
-  version = "4.4.3";
+  version = "4.4.4.1";
 
   src = fetchFromGitHub {
     owner = "PDB-REDO";
     repo = "dssp";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-zPmRR7sxVNErwabLqA5CNMO4K1qHdmC9FBPjcx91KuM=";
+    hash = "sha256-sy6GBCnTGRD1YP00dKIolkr1RMboLGcd0f4kU8gCOnA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/biology/raxml/default.nix b/pkgs/applications/science/biology/raxml/default.nix
index d02d472662976..0cc20b0635036 100644
--- a/pkgs/applications/science/biology/raxml/default.nix
+++ b/pkgs/applications/science/biology/raxml/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "RAxML${lib.optionalString useMpi "-mpi"}";
-  version = "8.2.12";
+  version = "8.2.13";
 
   src = fetchFromGitHub {
     owner = "stamatak";
     repo = "standard-RAxML";
     rev = "v${version}";
-    sha256 = "1jqjzhch0rips0vp04prvb8vmc20c5pdmsqn8knadcf91yy859fh";
+    sha256 = "sha256-w+Eqi0GhVira1H6ZnMNeZGBMzDjiGT7JSFpQEVXONyk=";
   };
 
   buildInputs = lib.optionals useMpi [ mpi ];
diff --git a/pkgs/applications/version-management/ghr/default.nix b/pkgs/applications/version-management/ghr/default.nix
index 0b460b14a9b3f..a2abe04fea9ae 100644
--- a/pkgs/applications/version-management/ghr/default.nix
+++ b/pkgs/applications/version-management/ghr/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "ghr";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "tcnksm";
     repo = "ghr";
     rev = "v${version}";
-    sha256 = "sha256-aD1HEdoAPFFpJL++fLZIk+pIs+qDNYbTGDMlcRjV6M4=";
+    sha256 = "sha256-swu+hj8fL/xIC3KdhGQ2Ezdt7aj9L8sU/7q/AXM2i98=";
   };
 
-  vendorHash = "sha256-pqwJPo3ZhsXU1RF4BKPOWQS71+9EitSSTE1+sKlc9+s=";
+  vendorHash = "sha256-Wzzg66yJaHJUCfC2aH3Pk+B0d5l/+L7/bcNhQxo8ro0=";
 
   # Tests require a Github API token, and networking
   doCheck = false;
diff --git a/pkgs/applications/version-management/gql/default.nix b/pkgs/applications/version-management/gql/default.nix
index 0c20b51fbc558..40b8a9b207c79 100644
--- a/pkgs/applications/version-management/gql/default.nix
+++ b/pkgs/applications/version-management/gql/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gql";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "AmrDeveloper";
     repo = "GQL";
     rev = version;
-    hash = "sha256-qNLVbhVXITbMRI2x/0q5enJgjL3EAcXBwqWeH6MPfZs=";
+    hash = "sha256-XqS2oG3/dPHBC/sWN9B7BliSv4IJ1iskrQRTh8vQNd4=";
   };
 
-  cargoHash = "sha256-UrzJGEASGaDqKUrPiNcjldevCqCPaNXJXNYecbHodOc=";
+  cargoHash = "sha256-0mUkXez+5Z8UGKMrUUjt+aF4zv3EJKgnFoQ068gTlX0=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index 5b27bb933dd84..9c19818b2f660 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.17.0";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ulzSxS5yukkLCykdsxl9nNRnakQ1UitJAHlB9CwLhsM=";
+    sha256 = "sha256-GmIrz23z/vV6Ut31pajUmPfT9V37Ajs5JaIMD1Ociu8=";
   };
 
-  cargoHash = "sha256-nNnFbvHsew7jtTBpD3eKXgjkc1arzjWMZWwj96Qmgcw=";
+  cargoHash = "sha256-AwDaIHuD/0H/SkhxT/V0/4K/5yp+s5DI34e8JQgajgc=";
 
   # skip test due FHS dependency
   doCheck = false;
diff --git a/pkgs/by-name/ne/netclient/package.nix b/pkgs/by-name/ne/netclient/package.nix
index 33d72747be66d..029fd53cdc077 100644
--- a/pkgs/by-name/ne/netclient/package.nix
+++ b/pkgs/by-name/ne/netclient/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "netclient";
-  version = "0.21.0";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "gravitl";
     repo = "netclient";
     rev = "v${version}";
-    hash = "sha256-68/BmVoAFaIg4vgjzhedSBqm6H9VDu3M7JemfPEcpjQ=";
+    hash = "sha256-r5Du9Gwt+deeUe6AJDN85o4snybvzZIIsyt+cfgMq2Q=";
   };
 
-  vendorHash = "sha256-CsW4tW6+INw93A7uXtHeVnxRrE5unHXhm2SOmQkJwYA=";
+  vendorHash = "sha256-/RNteV+Ys7TVTJtQsWcGK/1C6mf/sQUahIeEzefBe3A=";
 
   buildInputs = lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Cocoa
     ++ lib.optional stdenv.isLinux libX11;
diff --git a/pkgs/data/fonts/lxgw-neoxihei/default.nix b/pkgs/data/fonts/lxgw-neoxihei/default.nix
index 5bc4b86c8ad1b..2fc6731b850a8 100644
--- a/pkgs/data/fonts/lxgw-neoxihei/default.nix
+++ b/pkgs/data/fonts/lxgw-neoxihei/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.105";
+  version = "1.106";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-rufBz5u6dV91oD211JuCUP2Km3RoFwkZ1OhRxyoGxpQ=";
+    hash = "sha256-AXEOoU9gvml1bqjPTYV+mmhVGLG4R6mH8e/h3wQgySo=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/data/fonts/sarasa-gothic/default.nix b/pkgs/data/fonts/sarasa-gothic/default.nix
index 631904942b3cc..14dc6514e8161 100644
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sarasa-gothic";
-  version = "0.42.1";
+  version = "0.42.2";
 
   src = fetchurl {
     # Use the 'ttc' files here for a smaller closure size.
     # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
     url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
-    hash = "sha256-e6ig+boWzYiOzENkIsj/z9FFt2pZc+T0dYoFoeONMFM=";
+    hash = "sha256-RkPHlOPXQiAswtekrOCmYcPNlNSvcqyaM4juSHJxEeY=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/data/fonts/sudo/default.nix b/pkgs/data/fonts/sudo/default.nix
index 961f846a6c334..68b8eae40e2a0 100644
--- a/pkgs/data/fonts/sudo/default.nix
+++ b/pkgs/data/fonts/sudo/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sudo-font";
-  version = "0.74";
+  version = "0.77";
 
   src = fetchzip {
     url = "https://github.com/jenskutilek/sudo-font/releases/download/v${version}/sudo.zip";
-    hash = "sha256-WPoqWhCKk2gZ/cdIjvmiNZ95xZ9sqnGzZuw4OEHxtrI=";
+    hash = "sha256-xnIDCuCUP8ErUsWTJedWpy4lo77Ji+FO2vO9BRDAmV0=";
   };
 
   installPhase = ''
diff --git a/pkgs/data/icons/tau-hydrogen/default.nix b/pkgs/data/icons/tau-hydrogen/default.nix
index 3f7aa63526dd1..bff4bb703a4ec 100644
--- a/pkgs/data/icons/tau-hydrogen/default.nix
+++ b/pkgs/data/icons/tau-hydrogen/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tau-hydrogen";
-  version = "1.0.11";
+  version = "1.0.13";
 
   src = fetchFromGitHub {
     owner = "tau-OS";
     repo = "tau-hydrogen";
     rev = finalAttrs.version;
-    hash = "sha256-ECrRWWS/Am0lfCIJw/BVZg53oLw79Im8d8KgAYxE+pw=";
+    hash = "sha256-rfgSNytPCVCkAJ9N3kRw9mfcXr+JEqy1jyyDgXqxtsM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/interpreters/rune/default.nix b/pkgs/development/interpreters/rune/default.nix
index 944741a21b10d..510ab71bdc68a 100644
--- a/pkgs/development/interpreters/rune/default.nix
+++ b/pkgs/development/interpreters/rune/default.nix
@@ -7,18 +7,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rune";
-  version = "0.12.4";
+  version = "0.13.1";
 
   src = fetchCrate {
     pname = "rune-cli";
     inherit version;
-    hash = "sha256-Fw6vCy6EMLzNbhwOUwCCsGSueDxfh7KMjLhhbvTzclc=";
+    hash = "sha256-7GScETlQ/rl9vOB9zSfsCM1ay1F5YV6OAxKe82lMU1I=";
   };
 
-  cargoHash = "sha256-F1FI7ZVNXIFzxIzimq0KXtGNWw26x1eQyqv+hVYaS1E=";
+  cargoHash = "sha256-T6uYe+ZgXgsGN1714Ka+fxeVDoXgjVdfrrw5Rj/95cE=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.SystemConfiguration
   ];
 
   env = {
diff --git a/pkgs/development/libraries/libcifpp/default.nix b/pkgs/development/libraries/libcifpp/default.nix
index e45cbcecf2753..33f174dfc7191 100644
--- a/pkgs/development/libraries/libcifpp/default.nix
+++ b/pkgs/development/libraries/libcifpp/default.nix
@@ -10,24 +10,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcifpp";
-  version = "5.2.1";
+  version = "5.2.2";
 
   src = fetchFromGitHub {
     owner = "PDB-REDO";
     repo = "libcifpp";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-9je4oj5XvclknD14Nh0LnBONHMeO40nY0+mZ9ACQYmY=";
+    hash = "sha256-+OVfMXkBALT8v/30JU8v2gTsw12FM5n1I2COV/b5vGY=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://github.com/PDB-REDO/libcifpp/issues/51
-      name = "fix-build-on-darwin.patch";
-      url = "https://github.com/PDB-REDO/libcifpp/commit/641f06a7e7c0dc54af242b373820f2398f59e7ac.patch";
-      hash = "sha256-eWNfp9nA/+2J6xjZR6Tj+5OM3L5MxdfRi0nBzyaqvS0=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/development/libraries/libcmis/default.nix b/pkgs/development/libraries/libcmis/default.nix
index f5a9974f3bcfa..142e329fd09e5 100644
--- a/pkgs/development/libraries/libcmis/default.nix
+++ b/pkgs/development/libraries/libcmis/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcmis";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "tdf";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0s6prfh55hn11vrs72ph1gs01v0vngly81pvyjm5v1sgwymdxx57";
+    sha256 = "sha256-E2A4uJUayqMMxVifzeAeYKLL+FiV2vShNNdXe5ZLXZ4=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config docbook2x ];
diff --git a/pkgs/development/libraries/libdatachannel/default.nix b/pkgs/development/libraries/libdatachannel/default.nix
index 00fe35202101b..4561f04ba06b5 100644
--- a/pkgs/development/libraries/libdatachannel/default.nix
+++ b/pkgs/development/libraries/libdatachannel/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdatachannel";
-  version = "0.19.1";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "paullouisageneau";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-jsJTECSR3ptiByfYQ00laeKMKJCv5IDkZmilY3jpRrU=";
+    hash = "sha256-x7/jgoaFVfx5j+CP8S/uIwkzjGskEqsY2Jxsd/Mj4VM=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libnats-c/default.nix b/pkgs/development/libraries/libnats-c/default.nix
index 5569fdf9025ea..e0ee93c162869 100644
--- a/pkgs/development/libraries/libnats-c/default.nix
+++ b/pkgs/development/libraries/libnats-c/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname   = "libnats";
-  version = "3.6.1";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner  = "nats-io";
     repo   = "nats.c";
     rev    = "v${version}";
-    sha256 = "sha256-zqtPBxjTJ+/XxVpfVpyFIwvlj5xCcnTrUv2RGzP8UQc=";
+    sha256 = "sha256-BIEe3DhPqyK+vAAk/6x8Ui+4t+IUyvtHf5Lk2AZVuC8=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/openturns/default.nix b/pkgs/development/libraries/openturns/default.nix
index d6735e77d4607..e20499b9206c0 100644
--- a/pkgs/development/libraries/openturns/default.nix
+++ b/pkgs/development/libraries/openturns/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openturns";
-  version = "1.21";
+  version = "1.21.1";
 
   src = fetchFromGitHub {
     owner = "openturns";
     repo = "openturns";
     rev = "v${version}";
-    sha256 = "sha256-zWCwuxJEiyhnllVCsfm3zNz2Xorvuj2Vl2fufS3qixY=";
+    sha256 = "sha256-Lg42QqsHYFxeUjZjYFVJFxeJv2MzOpjoShfbIg/095A=";
   };
 
   nativeBuildInputs = [ cmake ] ++ lib.optional enablePython python3Packages.sphinx;
diff --git a/pkgs/development/libraries/qtpbfimageplugin/default.nix b/pkgs/development/libraries/qtpbfimageplugin/default.nix
index 9df86514edec0..8259d05a36537 100644
--- a/pkgs/development/libraries/qtpbfimageplugin/default.nix
+++ b/pkgs/development/libraries/qtpbfimageplugin/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtpbfimageplugin";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "QtPBFImagePlugin";
     rev = version;
-    sha256 = "sha256-Ju22lCpwbNxiFeQoaUh3LmtI6RlTO3hOw2Z4/O8PQ6E=";
+    sha256 = "sha256-3tKXqYICuLSrJzWnp0ClXcz61XO5gXLTOLFeTk0g3mo=";
   };
 
   nativeBuildInputs = [ qmake ];
diff --git a/pkgs/development/libraries/science/astronomy/libxisf/default.nix b/pkgs/development/libraries/science/astronomy/libxisf/default.nix
index 17e454e13e217..8f2adb85424b2 100644
--- a/pkgs/development/libraries/science/astronomy/libxisf/default.nix
+++ b/pkgs/development/libraries/science/astronomy/libxisf/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxisf";
-  version = "0.2.9";
+  version = "0.2.10";
 
   src = fetchFromGitea {
     domain = "gitea.nouspiro.space";
     owner = "nou";
     repo = "libXISF";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Jh3NWtQSV0uePDMCDNzdI4qpRGbHTel3neRZAA3anQk=";
+    hash = "sha256-ME0x+1VyfuhJCldwJfjQCtfe9XQk1ptmhv4ghOyNuGA=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/sdbus-cpp/default.nix b/pkgs/development/libraries/sdbus-cpp/default.nix
index 40c00dfea88f0..4d820c0e36dc1 100644
--- a/pkgs/development/libraries/sdbus-cpp/default.nix
+++ b/pkgs/development/libraries/sdbus-cpp/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sdbus-cpp";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "kistler-group";
     repo = "sdbus-cpp";
     rev = "v${version}";
-    hash = "sha256-S/8/I2wmWukpP+RGPxKbuO44wIExzeYZL49IO+KOqg4=";
+    hash = "sha256-AOqwC7CABvQsG9P1PnUg2DIhNmHqYpgbKzm9C2gWNIQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/vc/default.nix b/pkgs/development/libraries/vc/default.nix
index 559ef8d207006..02b202365b9bf 100644
--- a/pkgs/development/libraries/vc/default.nix
+++ b/pkgs/development/libraries/vc/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "Vc";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "VcDevel";
     repo = "Vc";
     rev = version;
-    sha256 = "sha256-fv0FHAl0xvAFybR/jwhX2LkozwEDy1TNcbVAmRRnLVU=";
+    sha256 = "sha256-tbHDGbul68blBAvok17oz7AfhHpEY9Y7RIEsqCQvOJ0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/mobile/genymotion/default.nix b/pkgs/development/mobile/genymotion/default.nix
index 53c1dc13cdc93..f8b5c9f5610c3 100644
--- a/pkgs/development/mobile/genymotion/default.nix
+++ b/pkgs/development/mobile/genymotion/default.nix
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "genymotion";
-  version = "3.5.0";
+  version = "3.5.1";
   src = fetchurl {
     url = "https://dl.genymotion.com/releases/genymotion-${version}/genymotion-${version}-linux_x64.bin";
     name = "genymotion-${version}-linux_x64.bin";
-    sha256 = "sha256-rZyTdVn0mnNLrGPehah62/AvTgUpNEtzn+Di1O3G3Sg=";
+    sha256 = "sha256-Bgp2IB8af5FV2W22GlAkzybLB/5UYnJSC607OZHejjo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/python-modules/a2wsgi/default.nix b/pkgs/development/python-modules/a2wsgi/default.nix
index 9a81321898ccd..7cb150264cf71 100644
--- a/pkgs/development/python-modules/a2wsgi/default.nix
+++ b/pkgs/development/python-modules/a2wsgi/default.nix
@@ -4,24 +4,22 @@
 , asgiref
 , httpx
 , pdm-backend
-, pdm-pep517
 , pytest-asyncio
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "a2wsgi";
-  version = "1.7.0";
+  version = "1.8.0";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qQb2LAJQ6wIBEguTQX3QsSsQW12zWvQxv+hu8NxburI=";
+    hash = "sha256-sgQ2uS8z25/xQ2vmS4boLhhwluu10aUt4nlKcNuYFRA=";
   };
 
   nativeBuildInputs = [
     pdm-backend
-    pdm-pep517
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/anytree/default.nix b/pkgs/development/python-modules/anytree/default.nix
index a83d8748d477e..2565a3475104c 100644
--- a/pkgs/development/python-modules/anytree/default.nix
+++ b/pkgs/development/python-modules/anytree/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "anytree";
-  version = "2.9.0";
+  version = "2.10.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "c0fec0de";
     repo = "anytree";
     rev = "refs/tags/${version}";
-    hash = "sha256-e7mmOOvrZuMCcyUg74YLLXGzkb5nCtuYmhNzAbY65gg=";
+    hash = "sha256-9rxrHZBlQarfpYQvo6bJPGF+cdSROlwq+8TjXI18HDs=";
   };
 
   patches = lib.optionals withGraphviz [
diff --git a/pkgs/development/python-modules/asyncssh/default.nix b/pkgs/development/python-modules/asyncssh/default.nix
index bdc436c8fdc47..663c71b926ea8 100644
--- a/pkgs/development/python-modules/asyncssh/default.nix
+++ b/pkgs/development/python-modules/asyncssh/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "asyncssh";
-  version = "2.13.2";
+  version = "2.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mR5THEu32+xit1SHjZajJGM4qsEaKM48PpkBj7L1gow=";
+    hash = "sha256-4D7y0TH7tDcbQBhxhFLOjHNaSO3+ATnSq9zkwYekWcM=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/azure-mgmt-cdn/default.nix b/pkgs/development/python-modules/azure-mgmt-cdn/default.nix
index 85220841e0417..3b6c5fd88b7bf 100644
--- a/pkgs/development/python-modules/azure-mgmt-cdn/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-cdn/default.nix
@@ -1,31 +1,28 @@
 { lib
-, buildPythonPackage
-, fetchPypi
-, msrest
-, msrestazure
 , azure-common
-, azure-mgmt-nspkg
 , azure-mgmt-core
-, isPy3k
+, buildPythonPackage
+, fetchPypi
+, isodate
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "azure-mgmt-cdn";
-  version = "12.0.0";
+  version = "13.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    extension = "zip";
-    hash = "sha256-t8PuIYkjS0r1Gs4pJJJ8X9cz8950imQtbVBABnyMnd0=";
+    hash = "sha256-yJ8jTeT4Gu23YSHl5GZ0+zdlC3s+GIxS4ir8z/HBkA4=";
   };
 
   propagatedBuildInputs = [
-    msrest
-    msrestazure
+    isodate
     azure-common
     azure-mgmt-core
-  ] ++ lib.optionals (!isPy3k) [
-    azure-mgmt-nspkg
   ];
 
   # has no tests
@@ -34,6 +31,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "This is the Microsoft Azure CDN Management Client Library";
     homepage = "https://github.com/Azure/azure-sdk-for-python";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-mgmt-cdn_${version}/sdk/cdn/azure-mgmt-cdn/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ maxwilson ];
   };
diff --git a/pkgs/development/python-modules/bincopy/default.nix b/pkgs/development/python-modules/bincopy/default.nix
index ee6dcb44d57db..1bb3a5b46eb4b 100644
--- a/pkgs/development/python-modules/bincopy/default.nix
+++ b/pkgs/development/python-modules/bincopy/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "bincopy";
-  version = "17.14.5";
+  version = "19.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-X03nw3o9t63PPtxIM6Ij8zVtm/CL5y7G5DHJ8KzSnxg=";
+    hash = "sha256-aDVkrTBEhrTP1Oc/kiE9ZsJ+8fDGXcb2+FSMQP0X0lY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/django-allauth-2fa/default.nix b/pkgs/development/python-modules/django-allauth-2fa/default.nix
new file mode 100644
index 0000000000000..60a2d61bac275
--- /dev/null
+++ b/pkgs/development/python-modules/django-allauth-2fa/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, django
+, django-allauth
+, django-otp
+, fetchFromGitHub
+, pythonOlder
+, qrcode
+, hatchling
+}:
+
+buildPythonPackage rec {
+  pname = "django-allauth-2fa";
+  version = "0.11.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "valohai";
+    repo = "django-allauth-2fa";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-bm2RwhvX2nfhYs74MM0iZl9U2gHgm0lLlh2tuRRcGso=";
+  };
+
+
+  nativeBuildInputs = [
+    hatchling
+  ];
+
+  propagatedBuildInputs = [
+    django
+    django-allauth
+    django-otp
+    qrcode
+  ];
+
+  pythonImportsCheck = [
+    "allauth_2fa"
+  ];
+
+  meta = with lib; {
+    description = "django-allauth-2fa adds two-factor authentication to django-allauth";
+    homepage = "https://github.com/valohai/django-allauth-2fa";
+    changelog = "https://github.com/valohai/django-allauth-2fa/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ derdennisop ];
+  };
+}
diff --git a/pkgs/development/python-modules/django-pwa/default.nix b/pkgs/development/python-modules/django-pwa/default.nix
new file mode 100644
index 0000000000000..91a216f0ac5cd
--- /dev/null
+++ b/pkgs/development/python-modules/django-pwa/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, django
+, fetchFromGitHub
+, python
+, pythonOlder
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "django-pwa";
+  version = "1.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "silviolleite";
+    repo = "django-pwa";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-tP1+Jm9hdvN/ZliuVHN8tqy24/tOK1LUUiJv1xUqRrY=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    django
+  ];
+
+  pyImportCheck = [
+    "pwa"
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} runtests.py
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "A Django app to include a manifest.json and Service Worker instance to enable progressive web app behavoir";
+    homepage = "https://github.com/silviolleite/django-pwa";
+    changelog = "https://github.com/silviolleite/django-pwa/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ derdennisop ];
+  };
+}
diff --git a/pkgs/development/python-modules/localstack-ext/default.nix b/pkgs/development/python-modules/localstack-ext/default.nix
index 2e19ff0d9b342..f312371afe9d6 100644
--- a/pkgs/development/python-modules/localstack-ext/default.nix
+++ b/pkgs/development/python-modules/localstack-ext/default.nix
@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "localstack-ext";
-  version = "2.2.0";
+  version = "2.3.2";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BLK41TRaYNtpeeDeGZhlvnvkQwWo0uGB19g34waRqFk=";
+    hash = "sha256-Ex5ZPlteDaiyex90QumucVdTTbpp9uWiBrvw1kMr++8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyjnius/default.nix b/pkgs/development/python-modules/pyjnius/default.nix
index 292c5f1c116a8..e4cebb02c66d4 100644
--- a/pkgs/development/python-modules/pyjnius/default.nix
+++ b/pkgs/development/python-modules/pyjnius/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyjnius";
-  version = "1.5.0";
+  version = "1.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZjRuJk8eIghrh8XINonqvP7xRQrGR2/YVr6kmLLhNz4=";
+    hash = "sha256-C32+PY9Yu7e+wwyFjz+nibzBwexJMZWOn3uH9F6hQDM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyocr/default.nix b/pkgs/development/python-modules/pyocr/default.nix
index fb82fc05300f4..8dc1ee0f8780a 100644
--- a/pkgs/development/python-modules/pyocr/default.nix
+++ b/pkgs/development/python-modules/pyocr/default.nix
@@ -7,12 +7,15 @@
 , isPy3k
 , substituteAll
 , pytestCheckHook
+, setuptools
+, setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "pyocr";
-  version = "0.8.3";
+  version = "0.8.5";
   disabled = !isPy3k;
+  format = "pyproject";
 
   # Don't fetch from PYPI because it doesn't contain tests.
   src = fetchFromGitLab {
@@ -21,7 +24,7 @@ buildPythonPackage rec {
     owner = "OpenPaperwork";
     repo = "pyocr";
     rev = version;
-    hash = "sha256-gIn50H9liQcTb7SzoWnBwm5LTvkr+R+5OPvITls1B/w=";
+    hash = "sha256-gE0+qbHCwpDdxXFY+4rjVU2FbUSfSVrvrVMcWUk+9FU=";
   };
 
   patches = [
@@ -31,18 +34,17 @@ buildPythonPackage rec {
     })
   ];
 
-  # see the logic in setup.py
-  ENABLE_SETUPTOOLS_SCM = "0";
-  preConfigure = ''
-    echo 'version = "${version}"' > src/pyocr/_version.py
-  '';
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
   propagatedBuildInputs = [ pillow ];
 
+  nativeBuildInputs = [ setuptools setuptools-scm ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = with lib; {
     inherit (src.meta) homepage;
+    changelog = "https://gitlab.gnome.org/World/OpenPaperwork/pyocr/-/blob/${version}/ChangeLog";
     description = "A Python wrapper for Tesseract and Cuneiform";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ symphorien ];
diff --git a/pkgs/development/python-modules/pyocr/paths.patch b/pkgs/development/python-modules/pyocr/paths.patch
index d49060739737f..c3c802c20649f 100644
--- a/pkgs/development/python-modules/pyocr/paths.patch
+++ b/pkgs/development/python-modules/pyocr/paths.patch
@@ -1,4 +1,4 @@
-commit c4bac00441363fcaeb074682d8226ca523614ea2
+commit cfc05af26b571e9ca09e9c709c0fb8934e9e46dd
 Author: Guillaume Girol <symphorien+git@xlumurb.eu>
 Date:   Sat Aug 20 17:48:01 2022 +0200
 
@@ -25,7 +25,7 @@ index 2e5b717..35647e2 100644
  LANGUAGES_LINE_PREFIX = "Supported languages: "
  LANGUAGES_SPLIT_RE = re.compile("[^a-z]")
 diff --git a/src/pyocr/libtesseract/tesseract_raw.py b/src/pyocr/libtesseract/tesseract_raw.py
-index 2002614..9ebea5c 100644
+index 1edec8c..434a336 100644
 --- a/src/pyocr/libtesseract/tesseract_raw.py
 +++ b/src/pyocr/libtesseract/tesseract_raw.py
 @@ -2,7 +2,6 @@ import ctypes
@@ -51,7 +51,7 @@ index 2002614..9ebea5c 100644
  DPI_DEFAULT = 70
  
 -
--if getattr(sys, 'frozen', False):  # pragma: no cover
+-if getattr(sys, 'frozen', False) and hasattr(sys, '_MEIPASS'):
 -    # Pyinstaller integration
 -    libnames += [os.path.join(sys._MEIPASS, "libtesseract-4.dll")]
 -    libnames += [os.path.join(sys._MEIPASS, "libtesseract-3.dll")]
@@ -125,10 +125,10 @@ index 0fe0d20..c1fdd27 100644
  
  TESSDATA_EXTENSION = ".traineddata"
  
-diff --git a/tests/tests_cuneiform.py b/tests/tests_cuneiform.py
-index 45b7f6a..95f55c6 100644
---- a/tests/tests_cuneiform.py
-+++ b/tests/tests_cuneiform.py
+diff --git a/tests/test_cuneiform.py b/tests/test_cuneiform.py
+index b76e93c..266f6b2 100644
+--- a/tests/test_cuneiform.py
++++ b/tests/test_cuneiform.py
 @@ -21,7 +21,7 @@ class TestCuneiform(BaseTest):
          # XXX is it useful?
          which.return_value = True
@@ -147,7 +147,7 @@ index 45b7f6a..95f55c6 100644
              stdout=subprocess.PIPE, stderr=subprocess.STDOUT
          )
  
-@@ -109,7 +109,7 @@ class TestCuneiformTxt(BaseTest):
+@@ -110,7 +110,7 @@ class TestCuneiformTxt(BaseTest):
          output = cuneiform.image_to_string(self.image)
          self.assertEqual(output, self._get_file_content("text").strip())
          popen.assert_called_once_with(
@@ -156,7 +156,7 @@ index 45b7f6a..95f55c6 100644
              stdin=subprocess.PIPE, stdout=subprocess.PIPE,
              stderr=subprocess.STDOUT
          )
-@@ -125,7 +125,7 @@ class TestCuneiformTxt(BaseTest):
+@@ -126,7 +126,7 @@ class TestCuneiformTxt(BaseTest):
                                             builder=self.builder)
          self.assertEqual(output, self._get_file_content("text").strip())
          popen.assert_called_once_with(
@@ -165,7 +165,7 @@ index 45b7f6a..95f55c6 100644
               "-"],
              stdin=subprocess.PIPE, stdout=subprocess.PIPE,
              stderr=subprocess.STDOUT
-@@ -142,7 +142,7 @@ class TestCuneiformTxt(BaseTest):
+@@ -143,7 +143,7 @@ class TestCuneiformTxt(BaseTest):
                                             builder=self.builder)
          self.assertEqual(output, self._get_file_content("text").strip())
          popen.assert_called_once_with(
@@ -174,7 +174,7 @@ index 45b7f6a..95f55c6 100644
              stdin=subprocess.PIPE, stdout=subprocess.PIPE,
              stderr=subprocess.STDOUT
          )
-@@ -173,7 +173,7 @@ class TestCuneiformTxt(BaseTest):
+@@ -174,7 +174,7 @@ class TestCuneiformTxt(BaseTest):
          output = cuneiform.image_to_string(image, builder=self.builder)
          self.assertEqual(output, self._get_file_content("text").strip())
          popen.assert_called_once_with(
@@ -183,7 +183,7 @@ index 45b7f6a..95f55c6 100644
              stdin=subprocess.PIPE, stdout=subprocess.PIPE,
              stderr=subprocess.STDOUT
          )
-@@ -227,7 +227,7 @@ class TestCuneiformWordBox(BaseTest):
+@@ -230,7 +230,7 @@ class TestCuneiformWordBox(BaseTest):
          output = cuneiform.image_to_string(self.image,
                                             builder=self.builder)
          popen.assert_called_once_with(
@@ -192,7 +192,7 @@ index 45b7f6a..95f55c6 100644
              stdin=subprocess.PIPE, stdout=subprocess.PIPE,
              stderr=subprocess.STDOUT
          )
-@@ -280,7 +280,7 @@ class TestCuneiformLineBox(BaseTest):
+@@ -284,7 +284,7 @@ class TestCuneiformLineBox(BaseTest):
          output = cuneiform.image_to_string(self.image,
                                             builder=self.builder)
          popen.assert_called_once_with(
@@ -201,11 +201,11 @@ index 45b7f6a..95f55c6 100644
              stdin=subprocess.PIPE, stdout=subprocess.PIPE,
              stderr=subprocess.STDOUT
          )
-diff --git a/tests/tests_libtesseract.py b/tests/tests_libtesseract.py
-index a5d46d8..8b9e315 100644
---- a/tests/tests_libtesseract.py
-+++ b/tests/tests_libtesseract.py
-@@ -165,7 +165,8 @@ class TestLibTesseractRaw(BaseTest):
+diff --git a/tests/test_libtesseract.py b/tests/test_libtesseract.py
+index cc31a50..890c02c 100644
+--- a/tests/test_libtesseract.py
++++ b/tests/test_libtesseract.py
+@@ -167,7 +167,8 @@ class TestLibTesseractRaw(BaseTest):
              args = libtess.TessBaseAPIInit3.call_args[0]
              self.assertEqual(len(args), 3)
              self.assertEqual(args[0].value, self.handle)
@@ -215,7 +215,7 @@ index a5d46d8..8b9e315 100644
              self.assertEqual(args[2].value, lang.encode() if lang else None)
  
              self.assertEqual(
-@@ -201,7 +202,8 @@ class TestLibTesseractRaw(BaseTest):
+@@ -203,7 +204,8 @@ class TestLibTesseractRaw(BaseTest):
              args = libtess.TessBaseAPIInit3.call_args[0]
              self.assertEqual(len(args), 3)
              self.assertEqual(args[0].value, self.handle)
@@ -225,11 +225,11 @@ index a5d46d8..8b9e315 100644
              self.assertEqual(args[2].value, lang.encode() if lang else None)
  
              self.assertEqual(
-diff --git a/tests/tests_tesseract.py b/tests/tests_tesseract.py
-index 18d01ef..593cf94 100644
---- a/tests/tests_tesseract.py
-+++ b/tests/tests_tesseract.py
-@@ -36,7 +36,7 @@ class TestTesseract(BaseTest):
+diff --git a/tests/test_tesseract.py b/tests/test_tesseract.py
+index 823818f..2ee5fb4 100644
+--- a/tests/test_tesseract.py
++++ b/tests/test_tesseract.py
+@@ -37,7 +37,7 @@ class TestTesseract(BaseTest):
      def test_available(self, which):
          which.return_value = True
          self.assertTrue(tesseract.is_available())
@@ -238,7 +238,7 @@ index 18d01ef..593cf94 100644
  
      @patch("subprocess.Popen")
      def test_version_error(self, popen):
-@@ -162,7 +162,7 @@ class TestTesseract(BaseTest):
+@@ -163,7 +163,7 @@ class TestTesseract(BaseTest):
          for lang in ("eng", "fra", "jpn", "osd"):
              self.assertIn(lang, langs)
          popen.assert_called_once_with(
@@ -247,7 +247,7 @@ index 18d01ef..593cf94 100644
              startupinfo=None, creationflags=0,
              stdout=subprocess.PIPE, stderr=subprocess.STDOUT
          )
-@@ -177,7 +177,7 @@ class TestTesseract(BaseTest):
+@@ -178,7 +178,7 @@ class TestTesseract(BaseTest):
          self.assertEqual(te.exception.status, 1)
          self.assertEqual("unable to get languages", te.exception.message)
          popen.assert_called_once_with(
@@ -256,7 +256,7 @@ index 18d01ef..593cf94 100644
              startupinfo=None, creationflags=0,
              stdout=subprocess.PIPE, stderr=subprocess.STDOUT
          )
-@@ -254,7 +254,7 @@ class TestTesseract(BaseTest):
+@@ -255,7 +255,7 @@ class TestTesseract(BaseTest):
          self.assertEqual(status, 0)
          self.assertEqual(error, message)
          popen.assert_called_once_with(
@@ -265,7 +265,7 @@ index 18d01ef..593cf94 100644
              cwd=tmpdir,
              startupinfo=None,
              creationflags=0,
-@@ -277,7 +277,7 @@ class TestTesseract(BaseTest):
+@@ -278,7 +278,7 @@ class TestTesseract(BaseTest):
          self.assertEqual(status, 0)
          self.assertEqual(error, message)
          popen.assert_called_with(
@@ -274,7 +274,7 @@ index 18d01ef..593cf94 100644
              cwd=tmpdir,
              startupinfo=None,
              creationflags=0,
-@@ -308,7 +308,7 @@ class TestTesseract(BaseTest):
+@@ -309,7 +309,7 @@ class TestTesseract(BaseTest):
              self.assertEqual(result["angle"], 90)
              self.assertEqual(result["confidence"], 9.30)
              popen.assert_called_once_with(
@@ -283,7 +283,7 @@ index 18d01ef..593cf94 100644
                  stdin=subprocess.PIPE,
                  shell=False,
                  startupinfo=None,
-@@ -344,7 +344,7 @@ class TestTesseract(BaseTest):
+@@ -345,7 +345,7 @@ class TestTesseract(BaseTest):
              self.assertEqual(result["angle"], 90)
              self.assertEqual(result["confidence"], 9.30)
              popen.assert_called_once_with(
@@ -292,7 +292,7 @@ index 18d01ef..593cf94 100644
                  stdin=subprocess.PIPE,
                  shell=False,
                  startupinfo=None,
-@@ -377,7 +377,7 @@ class TestTesseract(BaseTest):
+@@ -378,7 +378,7 @@ class TestTesseract(BaseTest):
              self.assertEqual(result["angle"], 90)
              self.assertEqual(result["confidence"], 9.30)
              popen.assert_called_once_with(
@@ -301,7 +301,7 @@ index 18d01ef..593cf94 100644
                   "--psm", "0", "-l", "osd"],
                  stdin=subprocess.PIPE,
                  shell=False,
-@@ -405,7 +405,7 @@ class TestTesseract(BaseTest):
+@@ -406,7 +406,7 @@ class TestTesseract(BaseTest):
              with self.assertRaises(tesseract.TesseractError) as te:
                  tesseract.detect_orientation(self.image)
              popen.assert_called_once_with(
@@ -310,7 +310,7 @@ index 18d01ef..593cf94 100644
                  stdin=subprocess.PIPE,
                  shell=False,
                  startupinfo=None,
-@@ -439,7 +439,7 @@ class TestTesseract(BaseTest):
+@@ -440,7 +440,7 @@ class TestTesseract(BaseTest):
              with self.assertRaises(tesseract.TesseractError) as te:
                  tesseract.detect_orientation(self.image)
              popen.assert_called_once_with(
@@ -319,7 +319,7 @@ index 18d01ef..593cf94 100644
                  stdin=subprocess.PIPE,
                  shell=False,
                  startupinfo=None,
-@@ -473,7 +473,7 @@ class TestTesseract(BaseTest):
+@@ -474,7 +474,7 @@ class TestTesseract(BaseTest):
              self.assertEqual(result["angle"], 90)
              self.assertEqual(result["confidence"], 9.30)
              popen.assert_called_once_with(
@@ -328,7 +328,7 @@ index 18d01ef..593cf94 100644
                  stdin=subprocess.PIPE,
                  shell=False,
                  startupinfo=None,
-@@ -506,7 +506,7 @@ class TestTesseract(BaseTest):
+@@ -507,7 +507,7 @@ class TestTesseract(BaseTest):
              self.assertEqual(result["angle"], 90)
              self.assertEqual(result["confidence"], 9.30)
              popen.assert_called_once_with(
@@ -337,7 +337,7 @@ index 18d01ef..593cf94 100644
                  stdin=subprocess.PIPE,
                  shell=False,
                  startupinfo=None,
-@@ -533,7 +533,7 @@ class TestTesseract(BaseTest):
+@@ -534,7 +534,7 @@ class TestTesseract(BaseTest):
              with self.assertRaises(tesseract.TesseractError) as te:
                  tesseract.detect_orientation(self.image)
              popen.assert_called_once_with(
@@ -346,7 +346,7 @@ index 18d01ef..593cf94 100644
                  stdin=subprocess.PIPE,
                  shell=False,
                  startupinfo=None,
-@@ -567,7 +567,7 @@ class TestTesseract(BaseTest):
+@@ -568,7 +568,7 @@ class TestTesseract(BaseTest):
              with self.assertRaises(tesseract.TesseractError) as te:
                  tesseract.detect_orientation(self.image)
              popen.assert_called_once_with(
diff --git a/pkgs/development/python-modules/pyqt/pyqt6-sip.nix b/pkgs/development/python-modules/pyqt/pyqt6-sip.nix
index 106a439fbb57a..f9b9bc308c804 100644
--- a/pkgs/development/python-modules/pyqt/pyqt6-sip.nix
+++ b/pkgs/development/python-modules/pyqt/pyqt6-sip.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "pyqt6-sip";
-  version = "13.5.2";
+  version = "13.6.0";
 
   src = fetchPypi {
     pname = "PyQt6_sip";
     inherit version;
-    hash = "sha256-6/YmS2/toBujfTtgpLuHSTvbh75w97KlOEp6zUkC2I0=";
+    hash = "sha256-JIbhWIBxlD1PZle6CQltyf/9IyKtLDAEHnjqPwN7V3g=";
   };
 
   # There is no test code and the check phase fails with:
diff --git a/pkgs/development/python-modules/pyside2/default.nix b/pkgs/development/python-modules/pyside2/default.nix
index 151efb65895e6..7670b443318b4 100644
--- a/pkgs/development/python-modules/pyside2/default.nix
+++ b/pkgs/development/python-modules/pyside2/default.nix
@@ -17,11 +17,11 @@
 disabledIf (pythonAtLeast "3.11") (
 stdenv.mkDerivation rec {
   pname = "pyside2";
-  version = "5.15.10";
+  version = "5.15.11";
 
   src = fetchurl {
     url = "https://download.qt.io/official_releases/QtForPython/pyside2/PySide2-${version}-src/pyside-setup-opensource-src-${version}.tar.xz";
-    sha256 = "sha256-KvaR02E6Qfg6YEObRlaPwsaW2/rkL3zXsHFS0RXq0zo=";
+    sha256 = "sha256-2lZ807eFTSegtK/j6J3osvmLem1XOTvlbx/BP3cPryk=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pytapo/default.nix b/pkgs/development/python-modules/pytapo/default.nix
index f27757b4784ed..b0893b5d204e1 100644
--- a/pkgs/development/python-modules/pytapo/default.nix
+++ b/pkgs/development/python-modules/pytapo/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pytapo";
-  version = "3.2.14";
+  version = "3.2.18";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-V/D+eE6y1kCMZmp9rIcvS/wdcSyW3mYWEJqpCb74NtY=";
+    hash = "sha256-z3HD7sjDg8dMNpd93PiN+nSzKTVCw+OJnfKX07e1+sg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytesseract/default.nix b/pkgs/development/python-modules/pytesseract/default.nix
index 1d77af888020f..77dd73e30155b 100644
--- a/pkgs/development/python-modules/pytesseract/default.nix
+++ b/pkgs/development/python-modules/pytesseract/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pytesseract";
-  version = "0.3.12";
+  version = "0.3.13";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "madmaze";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-19eLgcvmEFGiyu6v/EzLG8w+jFQL/5rbfDaiQqAGq5g=";
+    hash = "sha256-gQMeck6ojlIwyiOCBBhzHHrjQfBMelVksVGd+fyxWZk=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pytest-flask/default.nix b/pkgs/development/python-modules/pytest-flask/default.nix
index f972070f53f2e..428e0c5c3e01b 100644
--- a/pkgs/development/python-modules/pytest-flask/default.nix
+++ b/pkgs/development/python-modules/pytest-flask/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-flask";
-  version = "1.2.0";
+  version = "1.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Rv3mUvd3d78C3JEgWuxM4gzfKsu71mqRirkfXBRpPT0=";
+    hash = "sha256-WL4cl7Ibo8TUfgp2ketBAHdIUGw2v1EAT3jfEGkfqV4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-pylint/default.nix b/pkgs/development/python-modules/pytest-pylint/default.nix
index 5bb9224ac421c..c989948afd8c1 100644
--- a/pkgs/development/python-modules/pytest-pylint/default.nix
+++ b/pkgs/development/python-modules/pytest-pylint/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-pylint";
-  version = "0.19.0";
+  version = "0.21.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2I6DwQI8ZBVIqew1Z3B87udhZjKphq8TNCbUp00GaTI=";
+    hash = "sha256-iHZLjh1c+hiAkkjgzML8BQNfCMNfCwIi3c/qHDxOVT4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytorch-lightning/default.nix b/pkgs/development/python-modules/pytorch-lightning/default.nix
index 9e0a7a2018dbf..15804b2c5b354 100644
--- a/pkgs/development/python-modules/pytorch-lightning/default.nix
+++ b/pkgs/development/python-modules/pytorch-lightning/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "pytorch-lightning";
-  version = "2.0.9";
+  version = "2.1.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "pytorch-lightning";
     rev = "refs/tags/${version}";
-    hash = "sha256-2HjdqC7JU28nVAJdaEkwmJOTfWBCqHcM1a1sHIfF3ME=";
+    hash = "sha256-gpY5pfvgciiQF5kDUui5UbxLlZ6X3mSNBNZWfpYD5Sc=";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/s3fs/default.nix b/pkgs/development/python-modules/s3fs/default.nix
index 1594d9296f3df..bc4ea00f055c3 100644
--- a/pkgs/development/python-modules/s3fs/default.nix
+++ b/pkgs/development/python-modules/s3fs/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "s3fs";
-  version = "2023.9.2";
+  version = "2023.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZMzOrTKoFkIt2a4daTxdY1TZn2SuJsVjiPHY4ceFgyE=";
+    hash = "sha256-xA8jjMyf7/8/bQnUtXYqvWyRO6QuGjKJdrVNA4kBuDU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sshfs/default.nix b/pkgs/development/python-modules/sshfs/default.nix
index f1b47d75b8c50..17378c8611a08 100644
--- a/pkgs/development/python-modules/sshfs/default.nix
+++ b/pkgs/development/python-modules/sshfs/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "sshfs";
-  version = "2023.7.0";
+  version = "2023.10.0";
 
   src = fetchFromGitHub {
     owner = "fsspec";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-XKBpB3ackquVKsdF8b/45Kaz5Y2ussOl0o0HkD+k9tM=";
+    hash = "sha256-6MueDHR+jZFDZg4zufEVhBtSwcgDd7KnW9gJp2hDu0A=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/traits/default.nix b/pkgs/development/python-modules/traits/default.nix
index eeb04ba234776..47b5eef29cede 100644
--- a/pkgs/development/python-modules/traits/default.nix
+++ b/pkgs/development/python-modules/traits/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "traits";
-  version = "6.4.2";
+  version = "6.4.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-W+fMX7epnLp+kBR4Y3PjrS9177RF7s7QlGVLuvOw+oI=";
+    hash = "sha256-qbv9ngwIt94H6G72TmnLlqKcIQWkO/gyzYsWL6HiL0Q=";
   };
 
   # Circular dependency
diff --git a/pkgs/development/python-modules/transmission-rpc/default.nix b/pkgs/development/python-modules/transmission-rpc/default.nix
index 24345b5f63d5b..32427487934a0 100644
--- a/pkgs/development/python-modules/transmission-rpc/default.nix
+++ b/pkgs/development/python-modules/transmission-rpc/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "transmission-rpc";
-  version = "7.0.1";
+  version = "7.0.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Trim21";
     repo = "transmission-rpc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wBTx4gy6c6TMtc2m+xibEzCgYJJiMMZ16+pq3H06hgs=";
+    hash = "sha256-HthWeFInolNEs7RNA773DJjhGvl1rfDhvhO8WwRwuuY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/trytond/default.nix b/pkgs/development/python-modules/trytond/default.nix
index e0b14f2fc453a..790a9e4f1a07d 100644
--- a/pkgs/development/python-modules/trytond/default.nix
+++ b/pkgs/development/python-modules/trytond/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "trytond";
-  version = "6.8.4";
+  version = "6.8.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-jZTc9Cc5XC1KScpniVtbBPdfwo3LodVNOo/zQSDBWY4=";
+    hash = "sha256-o/U8bmCAotgDYY81eX+vXOxJC3f4aQvOF6ohMOHLuLY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/yark/default.nix b/pkgs/development/python-modules/yark/default.nix
index 9012efc8a81d2..f7b9f696d6cff 100644
--- a/pkgs/development/python-modules/yark/default.nix
+++ b/pkgs/development/python-modules/yark/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "yark";
-  version = "1.2.8";
+  version = "1.2.9";
 
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FXgJ/y8qN7FkR7nhpNgPvUH/EQgw8cgRFqUA9KiJKKM=";
+    hash = "sha256-g9JwFnB4tFuvRvQGEURbIB2gaXQgCQJkL1sNmYMFvck=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/tools/abuild/default.nix b/pkgs/development/tools/abuild/default.nix
index c3c3fbcafcd7d..dce24f0ad80d4 100644
--- a/pkgs/development/tools/abuild/default.nix
+++ b/pkgs/development/tools/abuild/default.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "abuild";
-  version = "3.11.21";
+  version = "3.12.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.alpinelinux.org";
     owner = "alpine";
     repo = pname;
     rev = version;
-    sha256 = "sha256-M88JPQKBkixAsWfGUirFsjFwB7m8/x63dpnoEHZpQTE=";
+    sha256 = "sha256-p4TohsZZTi4HxtJsyuoE5HDfkGa0pv53saGj3X9bmrI=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/tools/confluent-cli/default.nix b/pkgs/development/tools/confluent-cli/default.nix
index e1447a857d0af..102ec3d996fd5 100644
--- a/pkgs/development/tools/confluent-cli/default.nix
+++ b/pkgs/development/tools/confluent-cli/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     homepage = "https://docs.confluent.io/confluent-cli/current/overview.html";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
-    maintainers = with maintainers; [ rguevara84 ];
+    maintainers = with maintainers; [ rguevara84 autophagy ];
 
     # TODO: There's support for i686 systems but I do not have any such system
     # to build it locally on, it's also unfree so I cannot rely on ofborg to
diff --git a/pkgs/development/tools/darklua/default.nix b/pkgs/development/tools/darklua/default.nix
index d10ef137a378f..3703cc757c691 100644
--- a/pkgs/development/tools/darklua/default.nix
+++ b/pkgs/development/tools/darklua/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "darklua";
-  version = "0.10.3";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "seaofvoices";
     repo = "darklua";
     rev = "v${version}";
-    hash = "sha256-OgQOsc6upMJveUUJSGqvopsyoKs7ALd6pVYxCi5fmS8=";
+    hash = "sha256-lBnEMQqAUkr377aYNRvpbIyZMmB6NIY/bmB1Oe8QPIM=";
   };
 
-  cargoHash = "sha256-qq42K4cPrWu/92P4dpegZ/0Wv2ndCb5d5+DgEKzdhbw=";
+  cargoHash = "sha256-YmtOVS58I8YdNpWBXBuwSFUVKQsVSuGlql70SPFkamM=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
diff --git a/pkgs/development/tools/devbox/default.nix b/pkgs/development/tools/devbox/default.nix
index b2ea100a48e2a..c373b18108a2a 100644
--- a/pkgs/development/tools/devbox/default.nix
+++ b/pkgs/development/tools/devbox/default.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "devbox";
-  version = "0.6.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "jetpack-io";
     repo = pname;
     rev = version;
-    hash = "sha256-XZf8xJcWUY+OqT4Sjwes9o09//ToG7oMIhhyLSHDctM=";
+    hash = "sha256-xjmxikIcR3v5lpxq7w2p0bukPunUTYH/HTQhy9fAOz8=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule rec {
   # integration tests want file system access
   doCheck = false;
 
-  vendorHash = "sha256-IwAZA0/i9I/Ylz7M5SZ/nJ6nMkiT6aEM9dAGPnCzyAk=";
+  vendorHash = "sha256-fDh+6aBrHUqioNbgufFiD5c4i8SGAYrUuFXgTVmhrRE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/dyff/default.nix b/pkgs/development/tools/dyff/default.nix
index 3a5802a187b4f..a549563aabbe2 100644
--- a/pkgs/development/tools/dyff/default.nix
+++ b/pkgs/development/tools/dyff/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dyff";
-  version = "1.5.8";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "homeport";
     repo = "dyff";
     rev = "v${version}";
-    sha256 = "sha256-CnSccws3loqfbtjGKe3tkXNVOmNtQX/0+szODMErgxE=";
+    sha256 = "sha256-MyQVTAfKHog6BiqqT8eaIPlUMctHz+Oe4eZqfpgiHNs=";
   };
 
-  vendorHash = "sha256-PgQvckmqewzE2QXlP9xtzP5s2S6DDl2o8KWrNXFhEO4=";
+  vendorHash = "sha256-VAPJqa1930Vmjjj9rSjVTk6e4HD3JbOk6VC8v37kijQ=";
 
   subPackages = [
     "cmd/dyff"
diff --git a/pkgs/development/tools/eclint/default.nix b/pkgs/development/tools/eclint/default.nix
index 4c957011d8670..933a19fc12c16 100644
--- a/pkgs/development/tools/eclint/default.nix
+++ b/pkgs/development/tools/eclint/default.nix
@@ -6,16 +6,16 @@
 buildGoModule
 rec {
   pname = "eclint";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitLab {
     owner = "greut";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/WSxhdPekCNgeWf+ObIOblCUj3PyJvykGyCXrFmCXLA=";
+    sha256 = "sha256-x0dBiRHaDxKrTCR2RfP2/bpBo6xewu8FX7Bv4ugaUAY=";
   };
 
-  vendorHash = "sha256-hdMBd0QI2uWktBV+rH73rCnnkIlw2zDT9OabUuWIGks=";
+  vendorHash = "sha256-aNQuALDe37lsmTGpClIBOQJlL0NFSAZCgcmTjx0kP+U=";
 
   ldflags = [ "-X main.version=${version}" ];
 
diff --git a/pkgs/development/tools/go-junit-report/default.nix b/pkgs/development/tools/go-junit-report/default.nix
index d024281205ba5..2a7379db08474 100644
--- a/pkgs/development/tools/go-junit-report/default.nix
+++ b/pkgs/development/tools/go-junit-report/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-junit-report";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "jstemmer";
     repo = "go-junit-report";
     rev = "v${version}";
-    sha256 = "sha256-Xz2tJtacsd6PqqA0ZT2eRgTACZonhdDtRWfBGcHW3A4=";
+    sha256 = "sha256-s4XVjACmpd10C5k+P3vtcS/aWxI6UkSUPyxzLhD2vRI=";
   };
 
   vendorHash = "sha256-+KmC7m6xdkWTT/8MkGaW9gqkzeZ6LWL0DXbt+12iTHY=";
diff --git a/pkgs/development/tools/karate/default.nix b/pkgs/development/tools/karate/default.nix
index ac3ba5ffdb9d4..bd99903e984f2 100644
--- a/pkgs/development/tools/karate/default.nix
+++ b/pkgs/development/tools/karate/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "karate";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchurl {
     url = "https://github.com/karatelabs/karate/releases/download/v${version}/karate-${version}.jar";
-    sha256 = "sha256-LTGxS5dsp+UrDzI+eoJJSodShe34KWHWW1QgqnhJawM=";
+    sha256 = "sha256-3gNoXUchrfGkZC6UAfw2TXorzSlqnOZCe0gnuUHIIb4=";
   };
   dontUnpack = true;
 
diff --git a/pkgs/development/tools/parsing/re-flex/default.nix b/pkgs/development/tools/parsing/re-flex/default.nix
index 3ef4e6db47516..6e224c7178a90 100644
--- a/pkgs/development/tools/parsing/re-flex/default.nix
+++ b/pkgs/development/tools/parsing/re-flex/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re-flex";
-  version = "3.4.1";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = "RE-flex";
     rev = "v${version}";
-    sha256 = "sha256-U25W/hNPol6WtBDrKsft00vr/GoRjaNEr36fq2L9FlY=";
+    sha256 = "sha256-gk+VVfjVPopuzhrEuWNxQxKYjOFbqOGD9YS1npN71Bg=";
   };
 
   nativeBuildInputs = [ boost autoconf automake ];
diff --git a/pkgs/development/tools/pulumictl/default.nix b/pkgs/development/tools/pulumictl/default.nix
index 3528d689df2f6..6a611503ff18e 100644
--- a/pkgs/development/tools/pulumictl/default.nix
+++ b/pkgs/development/tools/pulumictl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pulumictl";
-  version = "0.0.44";
+  version = "0.0.45";
 
   src = fetchFromGitHub {
     owner = "pulumi";
     repo = "pulumictl";
     rev = "v${version}";
-    sha256 = "sha256-7Q+1shNZ18BZ6W6CslwUZhX0LtxPdTXOSNH5VhBHFxE=";
+    sha256 = "sha256-DDuzJcYfa0zHqLdyoZ/Vi14+0C6ucgkmb5ndrhTlOik=";
   };
 
   vendorHash = "sha256-XOgHvOaHExazQfsu1brYDq1o2fUh6dZeJlpVhCQX9ns=";
diff --git a/pkgs/development/tools/regclient/default.nix b/pkgs/development/tools/regclient/default.nix
index 81969db7771a5..8a0bbe36ab3ce 100644
--- a/pkgs/development/tools/regclient/default.nix
+++ b/pkgs/development/tools/regclient/default.nix
@@ -4,16 +4,16 @@ let bins = [ "regbot" "regctl" "regsync" ]; in
 
 buildGoModule rec {
   pname = "regclient";
-  version = "0.5.2";
+  version = "0.5.3";
   tag = "v${version}";
 
   src = fetchFromGitHub {
     owner = "regclient";
     repo = "regclient";
     rev = tag;
-    sha256 = "sha256-PC3eHTmhjNjf3ENeP3ODrR2Ynlzg4FqJL6L8cKvD67A=";
+    sha256 = "sha256-cYfQ27QPdx3TA7zUZ7x0+kIr//EXL+a2APK5pnlupJM=";
   };
-  vendorHash = "sha256-OPB/xGdaq1yv4ATrKbLcqqJj84s0cYrJdmKFHZ3EkHY=";
+  vendorHash = "sha256-UbzMkHpmIfJoCToAT1vOYJvqkhxSGogohT2aemegZ94=";
 
   outputs = [ "out" ] ++ bins;
 
diff --git a/pkgs/development/tools/roswell/default.nix b/pkgs/development/tools/roswell/default.nix
index 2d1b2ffa0810d..0ec1dc8fe574c 100644
--- a/pkgs/development/tools/roswell/default.nix
+++ b/pkgs/development/tools/roswell/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "roswell";
-  version = "22.12.14.113";
+  version = "23.10.14.114";
 
   src = fetchFromGitHub {
     owner = "roswell";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tNOkZcdjwvrsleWMtcQ76KMBnssnuYQU3gqXnBVPN6w=";
+    hash = "sha256-70BSwRKj1WPvWxQzWPrs8ECkcVosAUaX5cK7FaDUhRc=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/sqldef/default.nix b/pkgs/development/tools/sqldef/default.nix
index 8fac2f9aa0c4b..f5fcdd7623636 100644
--- a/pkgs/development/tools/sqldef/default.nix
+++ b/pkgs/development/tools/sqldef/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "sqldef";
-  version = "0.16.7";
+  version = "0.16.9";
 
   src = fetchFromGitHub {
     owner = "k0kubun";
     repo = "sqldef";
     rev = "v${version}";
-    hash = "sha256-y28dn/LhqQxbszKwOjpiU93oP1tq/H0NL9vonhERLzw=";
+    hash = "sha256-Y4H8tPUHaRMMZaZt1VjkZT5JJgEIY/dhocNccvoHf1Y=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-ugLjaKCVgVl2jhH/blQ44y/c8hxQpbdlxUC4u+FgMGM=";
+  vendorHash = "sha256-Qn10+uTAo68OTQp592H/T7D99LNIvG76aG/ye+xx2sk=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/games/vassal/default.nix b/pkgs/games/vassal/default.nix
index a3e7516c6f812..0d0ebded72381 100644
--- a/pkgs/games/vassal/default.nix
+++ b/pkgs/games/vassal/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "VASSAL";
-  version = "3.7.0";
+  version = "3.7.4";
 
   src = fetchzip {
     url = "https://github.com/vassalengine/vassal/releases/download/${version}/${pname}-${version}-linux.tar.bz2";
-    sha256 = "sha256-GmqPnay/K36cJgP622ht18csaohcUYZpvMD8LaOH4eM=";
+    sha256 = "sha256-G9h5U5jlLOFCAKXdwzK+J8er3pUL4AUq5FLcvbUN93A=";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/akvcam/default.nix b/pkgs/os-specific/linux/akvcam/default.nix
index f2ea933bd5c52..d2b24855b0b28 100644
--- a/pkgs/os-specific/linux/akvcam/default.nix
+++ b/pkgs/os-specific/linux/akvcam/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "akvcam";
-  version = "1.2.2";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "webcamoid";
     repo = "akvcam";
     rev = version;
-    sha256 = "1f0vjia2d7zj3y5c63lx1r537bdjx6821yxy29ilbrvsbjq2szj8";
+    sha256 = "sha256-zvMPwgItp1bTq64DZcUbYls60XhgufOeEKaAoAFf64M=";
   };
   sourceRoot = "${src.name}/src";
 
diff --git a/pkgs/os-specific/linux/r8125/default.nix b/pkgs/os-specific/linux/r8125/default.nix
index 30f8da7d5f4c5..4517cb29e75ae 100644
--- a/pkgs/os-specific/linux/r8125/default.nix
+++ b/pkgs/os-specific/linux/r8125/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "r8125";
   # On update please verify (using `diff -r`) that the source matches the
   # realtek version.
-  version = "9.004.01";
+  version = "9.011.01";
 
   # This is a mirror. The original website[1] doesn't allow non-interactive
   # downloads, instead emailing you a download link.
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     owner = "louistakepillz";
     repo = "r8125";
     rev = version;
-    sha256 = "0h2y4mzydhc7var5281bk2jj1knig6i64k11ii4b94az3g9dbq24";
+    sha256 = "sha256-QV1DKkWVtqcnuqgAdJnPpj6Z6ch+lw61zpouXKlyfqQ=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/servers/amqp/rabbitmq-server/default.nix b/pkgs/servers/amqp/rabbitmq-server/default.nix
index d3dd96cc23a63..a8bd3ba5a7a1b 100644
--- a/pkgs/servers/amqp/rabbitmq-server/default.nix
+++ b/pkgs/servers/amqp/rabbitmq-server/default.nix
@@ -38,12 +38,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "rabbitmq-server";
-  version = "3.12.6";
+  version = "3.12.7";
 
   # when updating, consider bumping elixir version in all-packages.nix
   src = fetchurl {
     url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-QBDgRpYlOaROIbgmpOHW2wzULgXrIW1IxJ14jvy/YR4=";
+    hash = "sha256-EX7+f6R1dfU2hYt2ftEjpevmaUtAJ1wHcr+X30z5Bb8=";
   };
 
   nativeBuildInputs = [ unzip xmlto docbook_xml_dtd_45 docbook_xsl zip rsync python3 ];
diff --git a/pkgs/servers/confluent-platform/default.nix b/pkgs/servers/confluent-platform/default.nix
index 3f77c88b19c34..2c4e1c5d4f474 100644
--- a/pkgs/servers/confluent-platform/default.nix
+++ b/pkgs/servers/confluent-platform/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "confluent-platform";
-  version = "7.4.1";
+  version = "7.5.0";
 
   src = fetchurl {
     url = "https://packages.confluent.io/archive/${lib.versions.majorMinor finalAttrs.version}/confluent-${finalAttrs.version}.tar.gz";
-    hash = "sha256-dJwG+QRplXX7etxG/e1kzcRMJppF6TYofio8FO1p+aI=";
+    hash = "sha256-HaK3Do6oRGm6ovvNNGvZE34rYNRQnrmt1GKglTSZ9ls=";
   };
 
   nativeBuildInputs = [
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Confluent event streaming platform based on Apache Kafka";
     homepage = "https://www.confluent.io/";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ zoedsoupe ];
+    maintainers = with lib.maintainers; [ zoedsoupe autophagy ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/servers/memcached/default.nix b/pkgs/servers/memcached/default.nix
index 3baacb2fc8d5e..95f95cda68e70 100644
--- a/pkgs/servers/memcached/default.nix
+++ b/pkgs/servers/memcached/default.nix
@@ -1,12 +1,12 @@
 {lib, stdenv, fetchurl, cyrus_sasl, libevent, nixosTests }:
 
 stdenv.mkDerivation rec {
-  version = "1.6.21";
+  version = "1.6.22";
   pname = "memcached";
 
   src = fetchurl {
     url = "https://memcached.org/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-x4iYDvxBfdXZPEQrHIuHafsgGIlsKd44h9IqLxQ9ou4=";
+    sha256 = "sha256-NHg6kKTM90xBBwhf2Stoh0nSOyds/a2fBOT3JaBdHKc=";
   };
 
   configureFlags = [
diff --git a/pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix b/pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix
index b5c8d994bd0f2..2b50c7850702a 100644
--- a/pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/junos-czerwonk-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "junos-czerwonk-exporter";
-  version = "0.12.0";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "czerwonk";
     repo = "junos_exporter";
     rev = version;
-    sha256 = "sha256-9Oh1GsqoIml/SKCmLHuJSnz0k2szEYkb6ArEsU5p198=";
+    sha256 = "sha256-KdVyRddAr2gqiFyIGBfWbi4DHAaiey4p4OBFND/2u7U=";
   };
 
-  vendorHash = "sha256-cQChRpjhL3plUk/J+8z2cg3u9IhMo6aTAbY8M/qlXSQ=";
+  vendorHash = "sha256-fytDr56ZhhO5u6u9CRIEKXGqgnzntSVqEVItibpLyPM=";
 
   meta = with lib; {
     description = "Exporter for metrics from devices running JunOS";
diff --git a/pkgs/servers/nosql/janusgraph/default.nix b/pkgs/servers/nosql/janusgraph/default.nix
index 16b2ca404246d..36385fd46cca4 100644
--- a/pkgs/servers/nosql/janusgraph/default.nix
+++ b/pkgs/servers/nosql/janusgraph/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "janusgraph";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchzip {
     url = "https://github.com/JanusGraph/janusgraph/releases/download/v${version}/janusgraph-${version}.zip";
-    sha256 = "sha256-KpGvDfQExU6pHheqmcOFoAhHdF4P+GBQu779h+/L5mE=";
+    sha256 = "sha256-rfqZE7HYgudVjrz+Ij+ggltaBXvYbczgRwCqsNTojTg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/servers/nosql/questdb/default.nix b/pkgs/servers/nosql/questdb/default.nix
index f2bbf4b9a2501..d989d125b2fb2 100644
--- a/pkgs/servers/nosql/questdb/default.nix
+++ b/pkgs/servers/nosql/questdb/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "questdb";
-  version = "7.3.2";
+  version = "7.3.3";
 
   src = fetchurl {
     url = "https://github.com/questdb/questdb/releases/download/${finalAttrs.version}/questdb-${finalAttrs.version}-no-jre-bin.tar.gz";
-    hash = "sha256-JiMY4TICsf7OQPXYCOqlQ+av0InR10EptXHm/QXEpGI=";
+    hash = "sha256-THQGgvSxij1xpAsOj3oCYYDfhoe/ji3jZ6PMT+5UThc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index 686b68c6c6744..6b62f066211d4 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config
+{ lib, stdenv, fetchurl, pkg-config
 , libsndfile, libtool, makeWrapper, perlPackages
 , xorg, libcap, alsa-lib, glib, dconf
 , avahi, libjack2, libasyncns, lirc, dbus
@@ -88,45 +88,47 @@ stdenv.mkDerivation rec {
   );
 
   mesonFlags = [
-    "-Dalsa=${if !libOnly && alsaSupport then "enabled" else "disabled"}"
-    "-Dasyncns=${if !libOnly then "enabled" else "disabled"}"
-    "-Davahi=${if zeroconfSupport then "enabled" else "disabled"}"
-    "-Dbluez5=${if !libOnly && bluetoothSupport then "enabled" else "disabled"}"
+    (lib.mesonEnable "alsa" (!libOnly && alsaSupport))
+    (lib.mesonEnable "asyncns" (!libOnly))
+    (lib.mesonEnable "avahi" zeroconfSupport)
+    (lib.mesonEnable "bluez5" (!libOnly && bluetoothSupport))
     # advanced bluetooth audio codecs are provided by gstreamer
-    "-Dbluez5-gstreamer=${if (!libOnly && bluetoothSupport && advancedBluetoothCodecs) then "enabled" else "disabled"}"
-    "-Ddatabase=simple"
-    "-Ddoxygen=false"
-    "-Delogind=disabled"
+    (lib.mesonEnable "bluez5-gstreamer" (!libOnly && bluetoothSupport && advancedBluetoothCodecs))
+    (lib.mesonOption "database" "simple")
+    (lib.mesonBool "doxygen" false)
+    (lib.mesonEnable "elogind" false)
     # gsettings does not support cross-compilation
-    "-Dgsettings=${if stdenv.isLinux && (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}"
-    "-Dgstreamer=disabled"
-    "-Dgtk=disabled"
-    "-Djack=${if jackaudioSupport && !libOnly then "enabled" else "disabled"}"
-    "-Dlirc=${if remoteControlSupport then "enabled" else "disabled"}"
-    "-Dopenssl=${if airtunesSupport then "enabled" else "disabled"}"
-    "-Dorc=disabled"
-    "-Dsystemd=${if useSystemd && !libOnly then "enabled" else "disabled"}"
-    "-Dtcpwrap=disabled"
-    "-Dudev=${if !libOnly && udevSupport then "enabled" else "disabled"}"
-    "-Dvalgrind=disabled"
-    "-Dwebrtc-aec=${if !libOnly then "enabled" else "disabled"}"
-    "-Dx11=${if x11Support then "enabled" else "disabled"}"
-
-    "-Dlocalstatedir=/var"
-    "-Dsysconfdir=/etc"
-    "-Dsysconfdir_install=${placeholder "out"}/etc"
-    "-Dudevrulesdir=${placeholder "out"}/lib/udev/rules.d"
+    (lib.mesonEnable "gsettings" (stdenv.isLinux && (stdenv.buildPlatform == stdenv.hostPlatform)))
+    (lib.mesonEnable "gstreamer" false)
+    (lib.mesonEnable "gtk" false)
+    (lib.mesonEnable "jack" (jackaudioSupport && !libOnly))
+    (lib.mesonEnable "lirc" remoteControlSupport)
+    (lib.mesonEnable "openssl" airtunesSupport)
+    (lib.mesonEnable "orc" false)
+    (lib.mesonEnable "systemd" (useSystemd && !libOnly))
+    (lib.mesonEnable "tcpwrap" false)
+    (lib.mesonEnable "udev" (!libOnly && udevSupport))
+    (lib.mesonEnable "valgrind" false)
+    (lib.mesonEnable "webrtc-aec" (!libOnly))
+    (lib.mesonEnable "x11" x11Support)
+
+    (lib.mesonOption "localstatedir" "/var")
+    (lib.mesonOption "sysconfdir" "/etc")
+    (lib.mesonOption "sysconfdir_install" "${placeholder "out"}/etc")
+    (lib.mesonOption "udevrulesdir" "${placeholder "out"}/lib/udev/rules.d")
 
     # pulseaudio complains if its binary is moved after installation;
     # this is needed so that wrapGApp can operate *without*
     # renaming the unwrapped binaries (see below)
     "--bindir=${placeholder "out"}/.bin-unwrapped"
   ]
-  ++ lib.optional (stdenv.isLinux && useSystemd) "-Dsystemduserunitdir=${placeholder "out"}/lib/systemd/user"
+  ++ lib.optionals (stdenv.isLinux && useSystemd) [
+    (lib.mesonOption "systemduserunitdir" "${placeholder "out"}/lib/systemd/user")
+  ]
   ++ lib.optionals stdenv.isDarwin [
-    "-Ddbus=disabled"
-    "-Dglib=disabled"
-    "-Doss-output=disabled"
+    (lib.mesonEnable "dbus" false)
+    (lib.mesonEnable "glib" false)
+    (lib.mesonEnable "oss-output" false)
   ];
 
   # tests fail on Darwin because of timeouts
diff --git a/pkgs/servers/readarr/default.nix b/pkgs/servers/readarr/default.nix
index 74dc9acfc9825..a2efdb1e1be7e 100644
--- a/pkgs/servers/readarr/default.nix
+++ b/pkgs/servers/readarr/default.nix
@@ -8,13 +8,13 @@ let
     x86_64-darwin = "x64";
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   hash = {
-    x64-linux_hash = "sha256-H48WjqRAG7I+IPhCANuJ137IwCXkTa5vrfh5Wm4tOyE=";
-    arm64-linux_hash = "sha256-lBclZfdYuI/ICgEpnekxNdMB6lvsJfK6Wzf/mMmtafU=";
-    x64-osx_hash = "sha256-1UUK0xU0WdLMjkbIEWVqpwa74tir9CkTSq63uqq9ygY=";
+    x64-linux_hash = "sha256-1EdDMSlC6hh1iNmra63DTLG6TAkmpZ/lIjvdfLJuC74=";
+    arm64-linux_hash = "sha256-CZj/zg6SkHmpiIbEIpxYMtlSLsDTFLBJYqr2pUpSu94=";
+    x64-osx_hash = "sha256-NRMbHLffx093gEb24I/fdp2fYioDehQ5gBMpZciX+ts=";
   }."${arch}-${os}_hash";
 in stdenv.mkDerivation rec {
   pname = "readarr";
-  version = "0.3.6.2232";
+  version = "0.3.8.2267";
 
   src = fetchurl {
     url = "https://github.com/Readarr/Readarr/releases/download/v${version}/Readarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/search/qdrant/Cargo.lock b/pkgs/servers/search/qdrant/Cargo.lock
index 2fc31649d2f4d..ddb34d1095bea 100644
--- a/pkgs/servers/search/qdrant/Cargo.lock
+++ b/pkgs/servers/search/qdrant/Cargo.lock
@@ -457,7 +457,7 @@ checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
 
 [[package]]
 name = "api"
-version = "1.5.1"
+version = "1.6.1"
 dependencies = [
  "chrono",
  "common",
@@ -842,11 +842,12 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.0.78"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a20104e2335ce8a659d6dd92a51a767a0c062599c73b343fd152cb401e828c3d"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
 dependencies = [
  "jobserver",
+ "libc",
 ]
 
 [[package]]
@@ -913,9 +914,9 @@ dependencies = [
 
 [[package]]
 name = "chrono"
-version = "0.4.30"
+version = "0.4.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "defd4e7873dbddba6c7c91e199c7fcb946abc4a6a4ac3195400bcfb01b5de877"
+checksum = "7f2c685bad3eb3d45a01354cedb7d5faa66194d1d58ba6e267a8de788f79db38"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -985,9 +986,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.4.2"
+version = "4.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a13b88d2c62ff462f88e4a121f17a82c1af05693a2f192b5c38d14de73c19f6"
+checksum = "b1d7b8d5ec32af0fadc644bf1fd509a688c2103b185644bb1e29d164e0703136"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -995,9 +996,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.4.2"
+version = "4.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bb9faaa7c2ef94b2743a21f5a29e6f0010dff4caa69ac8e9d6cf8b6fa74da08"
+checksum = "5179bb514e4d7c2051749d8fcefa2ed6d06a9f4e6d69faf3805f5d80b8cf8d56"
 dependencies = [
  "anstream",
  "anstyle",
@@ -1050,6 +1051,7 @@ dependencies = [
  "futures",
  "hashring",
  "indicatif",
+ "io",
  "itertools 0.11.0",
  "log",
  "merge",
@@ -1099,13 +1101,18 @@ dependencies = [
 
 [[package]]
 name = "common"
-version = "0.1.0"
+version = "0.0.0"
 dependencies = [
+ "ordered-float 3.9.1",
  "serde",
  "validator",
 ]
 
 [[package]]
+name = "common-workspace-stub"
+version = "0.0.0"
+
+[[package]]
 name = "config"
 version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2113,7 +2120,7 @@ dependencies = [
  "atomic-polyfill",
  "hash32",
  "rustc_version",
- "spin 0.9.4",
+ "spin 0.9.8",
  "stable_deref_trait",
 ]
 
@@ -2361,6 +2368,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "io"
+version = "0.0.0"
+dependencies = [
+ "atomicwrites",
+ "bincode",
+ "serde",
+ "serde_json",
+ "thiserror",
+]
+
+[[package]]
 name = "io-lifetimes"
 version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2379,9 +2397,9 @@ dependencies = [
 
 [[package]]
 name = "io-uring"
-version = "0.6.1"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "141a0f4546a50b2ed637c7a6df0d7dff45c9f41523254996764461c8ae0d9424"
+checksum = "460648e47a07a43110fbfa2e0b14afb2be920093c31e5dccc50e49568e099762"
 dependencies = [
  "bitflags 1.3.2",
  "libc",
@@ -2894,6 +2912,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "memory"
+version = "0.0.0"
+dependencies = [
+ "log",
+ "memmap2 0.7.1",
+ "parking_lot",
+ "serde",
+]
+
+[[package]]
 name = "merge"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -3681,7 +3709,7 @@ dependencies = [
 
 [[package]]
 name = "qdrant"
-version = "1.5.1"
+version = "1.6.1"
 dependencies = [
  "actix-cors",
  "actix-files",
@@ -3690,7 +3718,6 @@ dependencies = [
  "actix-web-validator",
  "anyhow",
  "api",
- "atty",
  "chrono",
  "clap",
  "collection",
@@ -3703,6 +3730,7 @@ dependencies = [
  "futures-util",
  "itertools 0.11.0",
  "log",
+ "memory",
  "num-traits",
  "num_cpus",
  "parking_lot",
@@ -4349,9 +4377,9 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "0.8.13"
+version = "0.8.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "763f8cd0d4c71ed8389c90cb8100cba87e763bd01a8e614d4f0af97bcd50a161"
+checksum = "1f7b0ce13155372a76ee2e1c5ffba1fe61ede73fbea5630d61eee6fac4929c0c"
 dependencies = [
  "chrono",
  "dyn-clone",
@@ -4365,9 +4393,9 @@ dependencies = [
 
 [[package]]
 name = "schemars_derive"
-version = "0.8.13"
+version = "0.8.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0f696e21e10fa546b7ffb1c9672c6de8fbc7a81acf59524386d8639bf12737"
+checksum = "e85e2a16b12bdb763244c69ab79363d71db2b4b918a2def53f80b02e0574b13c"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4448,10 +4476,12 @@ dependencies = [
  "futures",
  "geo",
  "geohash",
+ "io",
  "io-uring",
  "itertools 0.11.0",
  "log",
  "memmap2 0.7.1",
+ "memory",
  "num-derive",
  "num-traits",
  "num_cpus",
@@ -4474,6 +4504,7 @@ dependencies = [
  "serde_cbor",
  "serde_json",
  "smol_str",
+ "sparse",
  "sysinfo",
  "tar",
  "tempfile",
@@ -4544,9 +4575,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.106"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cc66a619ed80bf7a0f6b17dd063a84b88f6dea1813737cf469aef1d081142c2"
+checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
 dependencies = [
  "itoa",
  "ryu",
@@ -4718,6 +4749,19 @@ dependencies = [
 ]
 
 [[package]]
+name = "sparse"
+version = "0.1.0"
+dependencies = [
+ "common",
+ "io",
+ "memmap2 0.7.1",
+ "memory",
+ "serde",
+ "serde_json",
+ "tempfile",
+]
+
+[[package]]
 name = "spin"
 version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -4725,9 +4769,9 @@ checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
 
 [[package]]
 name = "spin"
-version = "0.9.4"
+version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f6002a767bff9e83f8eeecf883ecb8011875a21ae8da43bffb817a57e78cc09"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 dependencies = [
  "lock_api",
 ]
@@ -4757,8 +4801,10 @@ dependencies = [
  "env_logger",
  "futures",
  "http",
+ "io",
  "itertools 0.11.0",
  "log",
+ "memory",
  "num_cpus",
  "parking_lot",
  "proptest",
@@ -5281,9 +5327,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-tracy"
-version = "0.10.3"
+version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3edd27f53bc0e55aefa9223f68eb44354060103d3e34635f6e27627fe0227f"
+checksum = "fc6c7bf057d67aa107e076129a4f331aaac47ec379952d9f0775c6b1d838ee97"
 dependencies = [
  "tracing-core",
  "tracing-subscriber",
@@ -5292,9 +5338,9 @@ dependencies = [
 
 [[package]]
 name = "tracy-client"
-version = "0.16.1"
+version = "0.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c78458aa3759647e0399e959a06f9f6dc61450a1caaa4f1632a3df8e8c55af7"
+checksum = "546e6c86bca7bd67b86437eade85e98b327de24cdb8429c701a98af755034572"
 dependencies = [
  "loom",
  "once_cell",
@@ -5303,9 +5349,9 @@ dependencies = [
 
 [[package]]
 name = "tracy-client-sys"
-version = "0.21.0"
+version = "0.21.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d99f5fc382239d08b6bf05bb6206a585bfdb988c878f2499081d0f285ef7819"
+checksum = "2cb915ea3af048554640d76dd6f1492589a6401a41a30d789b983c1ec280455a"
 dependencies = [
  "cc",
 ]
diff --git a/pkgs/servers/search/qdrant/default.nix b/pkgs/servers/search/qdrant/default.nix
index 6d70b5e4b3dac..a3aee4fc59360 100644
--- a/pkgs/servers/search/qdrant/default.nix
+++ b/pkgs/servers/search/qdrant/default.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "qdrant";
-  version = "1.5.1";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "qdrant";
     repo = "qdrant";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-CWE3tCeLJjtuFcvnGLdODtx0mvVSl2ULIcxgf3X3SPU=";
+    sha256 = "sha256-G9nA0F3KKl6mLgcpuMW1uikOyBcBsJ1qd2IlMhW4vhg=";
   };
 
   cargoLock = {
diff --git a/pkgs/servers/snappymail/default.nix b/pkgs/servers/snappymail/default.nix
index ae37dab2e945d..197e9b48d18b8 100644
--- a/pkgs/servers/snappymail/default.nix
+++ b/pkgs/servers/snappymail/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "snappymail";
-  version = "2.28.4";
+  version = "2.29.1";
 
   src = fetchurl {
     url = "https://github.com/the-djmaze/snappymail/releases/download/v${version}/snappymail-${version}.tar.gz";
-    sha256 = "sha256-tXP7jxpqBASNShNe9rHiewSgdW/KgkH80V24VgJlXZE=";
+    sha256 = "sha256-ZE17VCrpHlZ4GMc7+DaUyuehKtYWMr7NJFV1hGQ+UsA=";
   };
 
   sourceRoot = "snappymail";
diff --git a/pkgs/servers/spicedb/zed.nix b/pkgs/servers/spicedb/zed.nix
index cc3853624706a..d0d4aba42a929 100644
--- a/pkgs/servers/spicedb/zed.nix
+++ b/pkgs/servers/spicedb/zed.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "zed";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "zed";
     rev = "v${version}";
-    hash = "sha256-+u8qrF/P8a19Bc085upT65xVPGIVR3My/k/enhdUJmQ=";
+    hash = "sha256-+YgGxqnHkdPbRbQj5o1+Hx259Ih07x0sdt6AHoD1UvI=";
   };
 
   vendorHash = "sha256-f0UNUOi0WXm06dko+7O00C0dla/JlfGlXaZ00TMX0WU=";
diff --git a/pkgs/servers/ttyd/default.nix b/pkgs/servers/ttyd/default.nix
index d11f51a8d8e64..435e872d332fe 100644
--- a/pkgs/servers/ttyd/default.nix
+++ b/pkgs/servers/ttyd/default.nix
@@ -7,12 +7,12 @@ with builtins;
 
 stdenv.mkDerivation rec {
   pname = "ttyd";
-  version = "1.7.3";
+  version = "1.7.4";
   src = fetchFromGitHub {
     owner = "tsl0922";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-zwKK8TPEATAgJwHh04hurzU3NrhyHA70qkf5kXW1yQc=";
+    sha256 = "sha256-BNvJkDOSlcNXt5W9/3/4I+MhQYn0W37zrJRYpAoZWaA=";
   };
 
   nativeBuildInputs = [ pkg-config cmake xxd ];
diff --git a/pkgs/shells/loksh/default.nix b/pkgs/shells/loksh/default.nix
index d646e91e286b0..39231e6e14423 100644
--- a/pkgs/shells/loksh/default.nix
+++ b/pkgs/shells/loksh/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "loksh";
-  version = "7.3";
+  version = "7.4";
 
   src = fetchFromGitHub {
     owner = "dimkr";
     repo = finalAttrs.pname;
     rev = finalAttrs.version;
     fetchSubmodules = true;
-    sha256 = "sha256-djjJH+mknmOfleVJhSkCLqCIaELh2gjZZE/xdNZuPtY=";
+    sha256 = "sha256-gQK9gq6MsKVyOikOW0sW/SbIM1K/3I8pn58P/SqzKys=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/backup/kopia/default.nix b/pkgs/tools/backup/kopia/default.nix
index 020902c1a0c60..3709040490b05 100644
--- a/pkgs/tools/backup/kopia/default.nix
+++ b/pkgs/tools/backup/kopia/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kopia";
-  version = "0.14.1";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ELnop8/f7/4E5FnWwGrPJt3n9YhSG1jei1tAt3zr1KI=";
+    hash = "sha256-N6mntK1cHkdnIZhU67DOvlwv8XXWx602oD/Pj+NJo9Y=";
   };
 
-  vendorHash = "sha256-8NTAnkIJkFKyjQL7KBoCqtSBog9Hz1vPBo81u8YcA1A=";
+  vendorHash = "sha256-eP/T4UzXBLOuK/f3BTz7dGqsSj7r/uTKKQ4H4lCvPC8=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/filesystems/ssdfs-utils/default.nix b/pkgs/tools/filesystems/ssdfs-utils/default.nix
index 467e24724ff1f..7ed8173d38fc8 100644
--- a/pkgs/tools/filesystems/ssdfs-utils/default.nix
+++ b/pkgs/tools/filesystems/ssdfs-utils/default.nix
@@ -12,13 +12,13 @@ stdenv.mkDerivation {
   # as ssdfs-utils, not ssdfs-tools.
   pname = "ssdfs-utils";
   # The version is taken from `configure.ac`, there are no tags.
-  version = "4.27";
+  version = "4.35";
 
   src = fetchFromGitHub {
     owner = "dubeyko";
     repo = "ssdfs-tools";
-    rev = "9b647d73b34dc2e18ed04bfcf5e260ffb8242dd5";
-    hash = "sha256-7I7h6Szb/oXtkypd7Nk4AFrTEsn9Y/1/u+IaL63zRVI=";
+    rev = "fe18072c9b1a670c06d1819205ad12e08312838f";
+    hash = "sha256-eVduJa4ewkVDHkxZkj2GO2uNMcMubyGo+4RkhXb9KFA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/graphics/gromit-mpx/default.nix b/pkgs/tools/graphics/gromit-mpx/default.nix
index 09050275fe47f..b131b4d0fb1e1 100644
--- a/pkgs/tools/graphics/gromit-mpx/default.nix
+++ b/pkgs/tools/graphics/gromit-mpx/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gromit-mpx";
-  version = "1.4.3";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "bk138";
     repo = "gromit-mpx";
     rev = version;
-    sha256 = "sha256-nbSyWcccu07FZbvOESFhlnuxgTNgJ+/6ujVQvEyQGGo=";
+    sha256 = "sha256-I2/9zRKpMkiB0IhnYuOrJHp4nNyG6pfful5D7OqCILQ=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapGAppsHook ];
diff --git a/pkgs/tools/inputmethods/libinput-gestures/default.nix b/pkgs/tools/inputmethods/libinput-gestures/default.nix
index dde07fc971770..b9384469e9630 100644
--- a/pkgs/tools/inputmethods/libinput-gestures/default.nix
+++ b/pkgs/tools/inputmethods/libinput-gestures/default.nix
@@ -5,13 +5,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "libinput-gestures";
-  version = "2.74";
+  version = "2.76";
 
   src = fetchFromGitHub {
     owner = "bulletmark";
     repo = "libinput-gestures";
     rev = version;
-    sha256 = "sha256-uBABs2FPvF+HO+VSNvz2F0Bc9Ja8ek1ULiu89/wvTv4=";
+    sha256 = "sha256-Tb/gQ/2Ul4JzEiLEUPJBj9T6ZAqzMSPdgiofdnDj73Q=";
   };
   patches = [
     ./0001-hardcode-name.patch
diff --git a/pkgs/tools/misc/ddccontrol/default.nix b/pkgs/tools/misc/ddccontrol/default.nix
index 0b7f78936ed91..498ad0f095196 100644
--- a/pkgs/tools/misc/ddccontrol/default.nix
+++ b/pkgs/tools/misc/ddccontrol/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ddccontrol";
-  version = "0.6.3";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "ddccontrol";
     repo = "ddccontrol";
     rev = version;
-    sha256 = "sha256-0mvkIW0Xsi7co/INmlNeTclBxGoqoJliFanA/RFMaLM=";
+    sha256 = "sha256-100SITpGbui/gRhFjVZxn6lZRB0najtGHd18oUpByJo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/goss/default.nix b/pkgs/tools/misc/goss/default.nix
index 55fafb1059be2..e0a4369eb4779 100644
--- a/pkgs/tools/misc/goss/default.nix
+++ b/pkgs/tools/misc/goss/default.nix
@@ -1,8 +1,14 @@
-{ buildGoModule
+{ bash
+, buildGoModule
 , fetchFromGitHub
+, getent
 , goss
-, nix-update-script
 , lib
+, makeWrapper
+, nix-update-script
+, nixosTests
+, stdenv
+, systemd
 , testers
 }:
 
@@ -26,17 +32,30 @@ buildGoModule rec {
     "-s" "-w" "-X main.version=v${version}"
   ];
 
+  nativeBuildInputs = [ makeWrapper ];
+
   checkFlags = [
     # Prometheus tests are skipped upstream
     # See https://github.com/goss-org/goss/blob/master/ci/go-test.sh
     "-skip" "^TestPrometheus"
   ];
 
+  postInstall = let
+    runtimeDependencies = [ bash getent ]
+      ++ lib.optionals stdenv.isLinux [ systemd ];
+  in ''
+    wrapProgram $out/bin/goss \
+      --prefix PATH : "${lib.makeBinPath runtimeDependencies}"
+  '';
+
   passthru = {
-    tests.version = testers.testVersion {
-      command = "goss --version";
-      package = goss;
-      version = "v${version}";
+    tests = {
+      inherit (nixosTests) goss;
+      version = testers.testVersion {
+        command = "goss --version";
+        package = goss;
+        version = "v${version}";
+      };
     };
     updateScript = nix-update-script { };
   };
@@ -51,7 +70,8 @@ buildGoModule rec {
       Once the test suite is written they can be executed, waited-on, or served as a health endpoint.
     '';
     license = licenses.asl20;
-    platforms = platforms.linux ++ platforms.darwin;
+    mainProgram = "goss";
     maintainers = with maintainers; [ hyzual jk anthonyroussel ];
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/tools/misc/gwe/default.nix b/pkgs/tools/misc/gwe/default.nix
index 7e68790b2dc9c..4a4b02b537061 100644
--- a/pkgs/tools/misc/gwe/default.nix
+++ b/pkgs/tools/misc/gwe/default.nix
@@ -31,13 +31,13 @@ let
  ]);
 in stdenv.mkDerivation rec {
   pname = "gwe";
-  version = "0.15.5";
+  version = "0.15.6";
 
   src = fetchFromGitLab {
     owner = "leinardi";
     repo = pname;
     rev = version;
-    sha256 = "sha256-bey/G+muDZsMMU3lVdNS6E/BnAJr29zLPE0MMT4sh1c=";
+    sha256 = "sha256-xlAz67sThXZ5o2kABb+aQI/7N7jmRpWU/5m24u8TkII=";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/misc/panicparse/default.nix b/pkgs/tools/misc/panicparse/default.nix
index 9c87e1fb87c74..2736758343631 100644
--- a/pkgs/tools/misc/panicparse/default.nix
+++ b/pkgs/tools/misc/panicparse/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "panicparse";
-  version = "2.2.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "maruel";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Bwvxj9Ifcq2WpicUBK+03fbGuoVAVF2Zmtpy/utUxoo=";
+    sha256 = "sha256-KjWUubrHPJUJWvoa13EGEwTd5uNC0nrHAF8hzdnxEmY=";
   };
 
-  vendorHash = "sha256-ZHUxzGqsGX1c4mBA4TBO2+WnGDhwAOGi0uYQx+3OgL8=";
+  vendorHash = "sha256-udkh/6Bu+7djxugMIuVsZvZ3JN2JooihsmcS2wJT0Wo=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/misc/profile-sync-daemon/default.nix b/pkgs/tools/misc/profile-sync-daemon/default.nix
index b2e6deea725f5..20b6c1aed3665 100644
--- a/pkgs/tools/misc/profile-sync-daemon/default.nix
+++ b/pkgs/tools/misc/profile-sync-daemon/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "profile-sync-daemon";
-  version = "6.48";
+  version = "6.50";
 
   src = fetchFromGitHub {
     owner = "graysky2";
     repo = "profile-sync-daemon";
     rev = "v${version}";
-    hash = "sha256-EHzRuE24Bj+lqRiPTCAPEAV4zVMK8iW2cF6OgO1izZw=";
+    hash = "sha256-Wb9YLxuu9i9s/Y6trz5NZDU9WRywe3138cp5Q2gWbxM=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/misc/rtx/default.nix b/pkgs/tools/misc/rtx/default.nix
index 6e70b3b046a8c..6ceaa4508d8fc 100644
--- a/pkgs/tools/misc/rtx/default.nix
+++ b/pkgs/tools/misc/rtx/default.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rtx";
-  version = "2023.10.1";
+  version = "2023.10.2";
 
   src = fetchFromGitHub {
     owner = "jdxcode";
     repo = "rtx";
     rev = "v${version}";
-    hash = "sha256-E0jBTnfp8asLC2V8TtYSCh6fTxqkFwCMZjsjjBKEN0s=";
+    hash = "sha256-wp5+n8dSnCExxgnCHl0GhcWTu8J6nGBJnjzWmc7XJ3E=";
   };
 
-  cargoHash = "sha256-n/GxC5wDfhPboynFu8S1f9+kNDVmcKoSHaT96khyi2Q=";
+  cargoHash = "sha256-Y/AUdg001/ezYHgOEt32go7DiIMLym9GyB88hG4NdKs=";
 
   nativeBuildInputs = [ installShellFiles pkg-config ];
   buildInputs = [ openssl  ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
diff --git a/pkgs/tools/misc/usbimager/default.nix b/pkgs/tools/misc/usbimager/default.nix
index a3660d71da4cb..ff4dea4a8c9e4 100644
--- a/pkgs/tools/misc/usbimager/default.nix
+++ b/pkgs/tools/misc/usbimager/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "usbimager";
-  version = "1.0.9";
+  version = "1.0.10";
 
   src = fetchFromGitLab {
     owner = "bztsrc";
     repo = pname;
     rev = version;
-    sha256 = "sha256-CEGUXJXqXmD8uT93T9dg49Lf5vTpAzQjdnhYmbR5zTI=";
+    sha256 = "sha256-HTFopc2xrhp0XYubQtOwMKWTQ+3JSKAyL4mMyQ82kAs=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/tools/misc/viddy/default.nix b/pkgs/tools/misc/viddy/default.nix
index 385663f40c856..37aa2acff0361 100644
--- a/pkgs/tools/misc/viddy/default.nix
+++ b/pkgs/tools/misc/viddy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "viddy";
-  version = "0.3.7";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "sachaos";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-82q73L0641d5qNmB+WLkUmDP5OHMoj2SNFc+FhknhwU=";
+    hash = "sha256-iF5b5e3HPT3GJLRDxz9wN1U5rO9Ey51Cpw4p2zjffTI=";
   };
 
-  vendorHash = "sha256-FMSgLI1W5keRnSYVyY0XuarMzLWvm9D1ufUYmZttfxk=";
+  vendorHash = "sha256-/lx2D2FIByRnK/097M4SQKRlmqtPTvbFo1dwbThJ5Fs=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/networking/offlineimap/default.nix b/pkgs/tools/networking/offlineimap/default.nix
index d3607a63210bd..33fe31b91d6e6 100644
--- a/pkgs/tools/networking/offlineimap/default.nix
+++ b/pkgs/tools/networking/offlineimap/default.nix
@@ -9,6 +9,7 @@
 , libxslt
 , testers
 , offlineimap
+, fetchpatch
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -22,6 +23,14 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "0y3giaz9i8vvczlxkbwymfkn3vi9fv599dy4pc2pn2afxsl4mg2w";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "sqlite-version-aware-threadsafety-check.patch";
+      url = "https://github.com/OfflineIMAP/offlineimap3/pull/139/commits/7cd32cf834b34a3d4675b29bebcd32dc1e5ef128.patch";
+      hash = "sha256-xNq4jFHMf9XZaa9BFF1lOzZrEGa5BEU8Dr+gMOBkJE4=";
+    })
+  ];
+
   nativeBuildInputs = [
     asciidoc
     docbook_xsl
diff --git a/pkgs/tools/networking/q/default.nix b/pkgs/tools/networking/q/default.nix
index bbcaf765d0fd7..40d61afd65d8f 100644
--- a/pkgs/tools/networking/q/default.nix
+++ b/pkgs/tools/networking/q/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "q";
-  version = "0.12.0";
+  version = "0.13.5";
 
   src = fetchFromGitHub {
     owner = "natesales";
     repo = "q";
     rev = "v${version}";
-    sha256 = "sha256-Z62xxmbzouuP0ol0sJxlh3bQr/sysFSqo7Y5b26IJ1g=";
+    sha256 = "sha256-3T72841HoZTjyzebSL7oWWwbvxBMKSX98usCrkZ4QuI=";
   };
 
-  vendorHash = "sha256-uWPvUz8H9e/deZ3JmpRBNEG6UXAQa1068fZwQoeiKkc=";
+  vendorHash = "sha256-VjwlNCmq5yAYlQRg+rKsN6EPDeb0FcnK5Y4MzBNO0Kg=";
 
   doCheck = false; # tries to resolve DNS
 
diff --git a/pkgs/tools/networking/stunnel/default.nix b/pkgs/tools/networking/stunnel/default.nix
index 958c784c74a68..af9fec255370b 100644
--- a/pkgs/tools/networking/stunnel/default.nix
+++ b/pkgs/tools/networking/stunnel/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "stunnel";
-  version = "5.70";
+  version = "5.71";
 
   outputs = [ "out" "doc" "man" ];
 
   src = fetchurl {
     url = "https://www.stunnel.org/archive/${lib.versions.major finalAttrs.version}.x/stunnel-${finalAttrs.version}.tar.gz";
-    hash = "sha256-e7x7npqYjXYwEyXbTBEOw2Cpj/uKIhx6zL/5wKi64vM=";
+    hash = "sha256-8COq6DfC0y3rkggxpe4QgeEceKXVc0D45vCCnwMQF/U=";
     # please use the contents of "https://www.stunnel.org/downloads/stunnel-${version}.tar.gz.sha256",
     # not the output of `nix-prefetch-url`
   };
diff --git a/pkgs/tools/networking/swagger-codegen/default.nix b/pkgs/tools/networking/swagger-codegen/default.nix
index 545f21a796a26..b89ffdd2862c3 100644
--- a/pkgs/tools/networking/swagger-codegen/default.nix
+++ b/pkgs/tools/networking/swagger-codegen/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, jre, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  version = "2.4.31";
+  version = "2.4.34";
   pname = "swagger-codegen";
 
   jarfilename = "${pname}-cli-${version}.jar";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://maven/io/swagger/${pname}-cli/${version}/${jarfilename}";
-    sha256 = "sha256-WEjvyHHKR2w0P0LuDdCtW9GbOLZnCa7oXzLAad9KWN8=";
+    sha256 = "sha256-OgaKWX9nUqhpgpdMlTiNk0AyBb2glnlYX5Ua03hDWBQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index 28665e618d04d..22737117a92b1 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -5,7 +5,7 @@
 
 buildGoModule rec {
   pname = "keybase";
-  version = "6.2.2";
+  version = "6.2.3";
 
   modRoot = "go";
   subPackages = [ "kbnm" "keybase" ];
@@ -16,7 +16,7 @@ buildGoModule rec {
     owner = "keybase";
     repo = "client";
     rev = "v${version}";
-    hash = "sha256-1vJCuAkJmehFcVYLwp3UIlQiGji7mHVczCBtXq9Fl68=";
+    hash = "sha256-TZBpqpCXtieQpJiAUP+SlldcQparbXqT8CuIMA4E++Y=";
   };
   vendorHash = "sha256-tXEEVEfjoKub2A4m7F3hDc5ABJ+R+axwX1+1j7e3BAM=";
 
diff --git a/pkgs/tools/security/spire/default.nix b/pkgs/tools/security/spire/default.nix
index 13e42efa78881..d91172ec26e67 100644
--- a/pkgs/tools/security/spire/default.nix
+++ b/pkgs/tools/security/spire/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "spire";
-  version = "1.7.2";
+  version = "1.8.2";
 
   outputs = [ "out" "agent" "server" ];
 
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "spiffe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3D7TlL4SulLAqpVIMJ4Yl2OWnNsMYMLVJqgGhOYMiio=";
+    sha256 = "sha256-+xHsNp/Zk+0D1iwGJNjgCvSjepGQEJXWnkWHa6Et9jA=";
   };
 
-  vendorHash = "sha256-Vct++sjkkosBOY0Uho58MHSQoL5121kYbQTf1j+HFUk=";
+  vendorHash = "sha256-mh3LIwUKIyH75AvWX+YgGi5VAU/EzZw5OSpAFIG6ueo=";
 
   subPackages = [ "cmd/spire-agent" "cmd/spire-server" ];
 
diff --git a/pkgs/tools/system/fio/default.nix b/pkgs/tools/system/fio/default.nix
index 441e359e13db4..45aed59dee8fa 100644
--- a/pkgs/tools/system/fio/default.nix
+++ b/pkgs/tools/system/fio/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fio";
-  version = "3.35";
+  version = "3.36";
 
   src = fetchFromGitHub {
     owner  = "axboe";
     repo   = "fio";
     rev    = "fio-${version}";
-    sha256 = "sha256-8LMpgayxBebHb0MXYmjlqqtndSiL42/yEQpgamxt9kI=";
+    sha256 = "sha256-w1k1DGgGYL2K/fZ30HMQE2vMcT6ZaaweM+KTcHKVEq4=";
   };
 
   buildInputs = [ python3 zlib ]
diff --git a/pkgs/tools/system/rsyslog/default.nix b/pkgs/tools/system/rsyslog/default.nix
index b406c5b4a3124..b8de3110306c0 100644
--- a/pkgs/tools/system/rsyslog/default.nix
+++ b/pkgs/tools/system/rsyslog/default.nix
@@ -61,11 +61,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rsyslog";
-  version = "8.2308.0";
+  version = "8.2310.0";
 
   src = fetchurl {
     url = "https://www.rsyslog.com/files/download/rsyslog/${pname}-${version}.tar.gz";
-    hash = "sha256-AghrkSHocs6mnl0PbI4tjr/zMjSzytVQNmU3jTry48k=";
+    hash = "sha256-INnOeSvwp+0HA9vwlBSQ+L5lX0i1W0vr3Agnu7DdvxE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/text/platinum-searcher/default.nix b/pkgs/tools/text/platinum-searcher/default.nix
index cbca59bdc6e58..4271fe131dac9 100644
--- a/pkgs/tools/text/platinum-searcher/default.nix
+++ b/pkgs/tools/text/platinum-searcher/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "the_platinum_searcher";
-  version = "2.1.5";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "monochromegane";
     repo = "the_platinum_searcher";
     rev = "v${version}";
-    hash = "sha256-AJsFLleZf5yhLY5UZnaQUBQYntzBLXFh6jU2UtKg8/g=";
+    hash = "sha256-FNHlALFwMbajaHWOehdSFeQmvZSuCZLdqGqLZ7DF+pI=";
   };
 
   vendorHash = "sha256-GIjPgu0e+duN5MeWcRaF5xUFCkqe2aZJCwGbLUMko08=";
diff --git a/pkgs/tools/text/poedit/default.nix b/pkgs/tools/text/poedit/default.nix
index 2a01b58c3a6c3..e9889c45e0299 100644
--- a/pkgs/tools/text/poedit/default.nix
+++ b/pkgs/tools/text/poedit/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "poedit";
-  version = "3.3.2";
+  version = "3.4";
 
   src = fetchFromGitHub {
     owner = "vslavik";
     repo = "poedit";
     rev = "v${version}-oss";
-    hash = "sha256-4WImcTr2nWIdsYJ9ADztvjKEzHK4F8qpJ0QGMOfB3ng=";
+    hash = "sha256-Z2DT+RO35EcJFOnrjmJ8v2tsINQnsPkbFhZW9OZqob4=";
   };
 
   nativeBuildInputs = [ autoconf automake asciidoc wrapGAppsHook
diff --git a/pkgs/tools/virtualization/mkosi/default.nix b/pkgs/tools/virtualization/mkosi/default.nix
index 1c99d63741a79..3b1a4988f47d4 100644
--- a/pkgs/tools/virtualization/mkosi/default.nix
+++ b/pkgs/tools/virtualization/mkosi/default.nix
@@ -34,6 +34,16 @@ let
         url = "https://github.com/systemd/systemd/commit/4947de275a5553399854cc748f4f13e4ae2ba069.patch";
         hash = "sha256-YIZZyc3f8pQO9fMAxiNhDdV8TtL4pXoh+hwHBzRWtfo=";
       })
+      # repart: make sure rewinddir() is called before readdir() when performing rm -rf. Remove when upgrading to systemd 255.
+      (fetchpatch {
+        url = "https://github.com/systemd/systemd/commit/6bbb893b90e2dcb05fb310ba4608f9c9dc587845.patch";
+        hash = "sha256-A6cF2QAeYHGc0u0V1JMxIcV5shzf5x3Q6K+blZOWSn4=";
+      })
+      # Set timezone to UTC when invoking mcopy. Remove when upgrading to systemd 255.
+      (fetchpatch {
+        url = "https://github.com/systemd/systemd/commit/b2942c76adc5bb6a3e073aa5cee57834ee3a9813.patch";
+        hash = "sha256-phGln3Gs9p8CsEe+1laGrm9xcUJWVbNBW0W8oR9/7YU=";
+      })
     ];
   })).override {
     withRepart = true;
diff --git a/pkgs/tools/wayland/swayrbar/default.nix b/pkgs/tools/wayland/swayrbar/default.nix
index 79cc1635a9cd9..bd4ef671de461 100644
--- a/pkgs/tools/wayland/swayrbar/default.nix
+++ b/pkgs/tools/wayland/swayrbar/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swayrbar";
-  version = "0.3.6";
+  version = "0.3.7";
 
   src = fetchFromSourcehut {
     owner = "~tsdh";
     repo = "swayr";
     rev = "swayrbar-${version}";
-    sha256 = "sha256-Vv+Hw+iJAi2GnfkiYitDyH3H58tydUDa6GcWITok7Oc=";
+    sha256 = "sha256-41zlVT060Fu90N4oiZ6lWSZdJJSZjyk3GEA/u+bVNCI=";
   };
 
-  cargoHash = "sha256-5alzkHzwuymo6bXFgabYQ3LWJDib0+ESQCSIPmINViY=";
+  cargoHash = "sha256-/MUolnEdYlBTfmUB/j9vHaVpU63upeMoScjHl38cGjo=";
 
   # don't build swayr
   buildAndTestSubdir = pname;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5ed0fa146e238..fbab930fd393e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2898,6 +2898,8 @@ self: super: with self; {
 
   django-allauth = callPackage ../development/python-modules/django-allauth { };
 
+  django-allauth-2fa = callPackage ../development/python-modules/django-allauth-2fa { };
+
   django-anymail = callPackage ../development/python-modules/django-anymail { };
 
   django-annoying = callPackage ../development/python-modules/django-annoying { };
@@ -3056,6 +3058,8 @@ self: super: with self; {
 
   django-prometheus = callPackage ../development/python-modules/django-prometheus { };
 
+  django-pwa = callPackage ../development/python-modules/django-pwa { };
+
   django-q = callPackage ../development/python-modules/django-q { };
 
   django-scheduler = callPackage ../development/python-modules/django-scheduler { };