about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--lib/licenses.nix15
-rw-r--r--maintainers/maintainer-list.nix18
-rw-r--r--nixos/doc/manual/release-notes/rl-2311.section.md2
-rw-r--r--nixos/modules/services/audio/wyoming/faster-whisper.nix3
-rw-r--r--nixos/modules/services/monitoring/netdata.nix12
-rw-r--r--nixos/modules/services/networking/trust-dns.nix4
-rw-r--r--nixos/modules/services/networking/wireguard.nix1
-rw-r--r--nixos/modules/system/boot/initrd-ssh.nix2
-rw-r--r--nixos/modules/virtualisation/google-compute-image.nix8
-rw-r--r--nixos/tests/castopod.nix2
-rw-r--r--nixos/tests/hadoop/hadoop.nix24
-rw-r--r--nixos/tests/hadoop/hdfs.nix4
-rw-r--r--nixos/tests/iscsi-multipath-root.nix4
-rw-r--r--nixos/tests/vaultwarden.nix2
-rw-r--r--pkgs/applications/audio/zam-plugins/default.nix4
-rw-r--r--pkgs/applications/blockchains/polkadot/default.nix2
-rw-r--r--pkgs/applications/graphics/photoflare/default.nix4
-rw-r--r--pkgs/applications/misc/anytype/default.nix2
-rw-r--r--pkgs/applications/misc/nwg-launchers/default.nix2
-rw-r--r--pkgs/applications/misc/p2pool/default.nix4
-rw-r--r--pkgs/applications/misc/solaar/default.nix7
-rw-r--r--pkgs/applications/networking/cluster/kluctl/default.nix8
-rw-r--r--pkgs/applications/networking/cluster/pachyderm/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json6
-rw-r--r--pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/remote/wayvnc/default.nix4
-rw-r--r--pkgs/applications/office/gnucash/default.nix22
-rw-r--r--pkgs/applications/office/wpsoffice/default.nix6
-rw-r--r--pkgs/applications/science/astronomy/stellarium/default.nix4
-rw-r--r--pkgs/applications/version-management/guilt/darwin-fix.patch20
-rw-r--r--pkgs/applications/version-management/guilt/default.nix92
-rw-r--r--pkgs/applications/version-management/guilt/guilt-help-mandir.patch15
-rw-r--r--pkgs/applications/version-management/meld/default.nix2
-rw-r--r--pkgs/applications/video/mpv/scripts/acompressor.nix22
-rw-r--r--pkgs/applications/video/mpv/scripts/buildLua.nix22
-rw-r--r--pkgs/applications/video/mpv/scripts/chapterskip.nix19
-rw-r--r--pkgs/applications/video/mpv/scripts/default.nix9
-rw-r--r--pkgs/applications/video/mpv/scripts/occivink.nix36
-rw-r--r--pkgs/applications/video/vlc/default.nix10
-rw-r--r--pkgs/applications/window-managers/hyprwm/hyprland/default.nix4
-rw-r--r--pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix4
-rw-r--r--pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix4
-rw-r--r--pkgs/by-name/ge/gerrit-queue/package.nix25
-rw-r--r--pkgs/by-name/ja/jasper/package.nix8
-rw-r--r--pkgs/by-name/mc/mcuboot-imgtool/package.nix38
-rw-r--r--pkgs/by-name/me/memtree/package.nix50
-rw-r--r--pkgs/by-name/nu/numbat/package.nix7
-rw-r--r--pkgs/by-name/op/open-english-wordnet/package.nix73
-rw-r--r--pkgs/by-name/po/polybar/package.nix (renamed from pkgs/applications/misc/polybar/default.nix)14
-rw-r--r--pkgs/by-name/po/polybar/remove-hardcoded-etc.diff (renamed from pkgs/applications/misc/polybar/remove-hardcoded-etc.diff)0
-rw-r--r--pkgs/by-name/si/simde/package.nix30
-rw-r--r--pkgs/by-name/su/supersonic/package.nix6
-rw-r--r--pkgs/by-name/yg/yggdrasil/package.nix2
-rw-r--r--pkgs/data/fonts/sketchybar-app-font/default.nix4
-rw-r--r--pkgs/data/themes/tokyo-night-gtk/default.nix56
-rw-r--r--pkgs/data/themes/tokyo-night-gtk/generic.nix77
-rw-r--r--pkgs/data/themes/tokyo-night-gtk/variants.json18
-rw-r--r--pkgs/development/compilers/cudatoolkit/common.nix2
-rw-r--r--pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix12
-rw-r--r--pkgs/development/compilers/gcc/all.nix3
-rw-r--r--pkgs/development/compilers/gcc/default.nix8
-rw-r--r--pkgs/development/compilers/gcc/patches/11/libgcc-aarch64-darwin-detection.patch21
-rw-r--r--pkgs/development/compilers/gcc/patches/4.9/darwin-clang-as.patch16
-rw-r--r--pkgs/development/compilers/gcc/patches/8/gcc8-darwin-as-gstabs.patch96
-rw-r--r--pkgs/development/compilers/gcc/patches/9/gcc9-darwin-as-gstabs.patch99
-rw-r--r--pkgs/development/compilers/gcc/patches/clang-genconditions.patch34
-rw-r--r--pkgs/development/compilers/gcc/patches/default.nix20
-rw-r--r--pkgs/development/compilers/go/1.20.nix4
-rw-r--r--pkgs/development/compilers/odin/default.nix4
-rw-r--r--pkgs/development/interpreters/php/generic.nix23
-rw-r--r--pkgs/development/interpreters/php/install-pear-nozlib-phar.nix8
-rw-r--r--pkgs/development/libraries/gtk4-layer-shell/default.nix4
-rw-r--r--pkgs/development/libraries/libsolv/default.nix4
-rw-r--r--pkgs/development/libraries/neatvnc/default.nix4
-rw-r--r--pkgs/development/libraries/science/math/cudnn/generic.nix10
-rw-r--r--pkgs/development/php-packages/memprof/default.nix33
-rw-r--r--pkgs/development/python-modules/ailment/default.nix4
-rw-r--r--pkgs/development/python-modules/angr/default.nix4
-rw-r--r--pkgs/development/python-modules/archinfo/default.nix4
-rw-r--r--pkgs/development/python-modules/awkward/default.nix13
-rw-r--r--pkgs/development/python-modules/bork/default.nix48
-rw-r--r--pkgs/development/python-modules/claripy/default.nix4
-rw-r--r--pkgs/development/python-modules/cle/default.nix6
-rw-r--r--pkgs/development/python-modules/dalle-mini/default.nix2
-rw-r--r--pkgs/development/python-modules/dash/default.nix110
-rw-r--r--pkgs/development/python-modules/dask-awkward/default.nix4
-rw-r--r--pkgs/development/python-modules/dask/default.nix6
-rw-r--r--pkgs/development/python-modules/dbus-fast/default.nix4
-rw-r--r--pkgs/development/python-modules/dinghy/default.nix17
-rw-r--r--pkgs/development/python-modules/ducc0/default.nix6
-rw-r--r--pkgs/development/python-modules/farm-haystack/default.nix290
-rw-r--r--pkgs/development/python-modules/flax/default.nix59
-rw-r--r--pkgs/development/python-modules/folium/default.nix4
-rw-r--r--pkgs/development/python-modules/formencode/default.nix4
-rw-r--r--pkgs/development/python-modules/insightface/default.nix3
-rw-r--r--pkgs/development/python-modules/mypy-boto3-builder/default.nix4
-rw-r--r--pkgs/development/python-modules/nilearn/default.nix4
-rw-r--r--pkgs/development/python-modules/nvidia-ml-py/default.nix4
-rw-r--r--pkgs/development/python-modules/optimum/default.nix4
-rw-r--r--pkgs/development/python-modules/orange-canvas-core/default.nix4
-rw-r--r--pkgs/development/python-modules/orange3/default.nix4
-rw-r--r--pkgs/development/python-modules/paddle2onnx/default.nix4
-rw-r--r--pkgs/development/python-modules/pydrawise/default.nix4
-rw-r--r--pkgs/development/python-modules/pyparted/default.nix21
-rw-r--r--pkgs/development/python-modules/pyparted/fix-test-pythonpath.patch26
-rw-r--r--pkgs/development/python-modules/pyvex/default.nix4
-rw-r--r--pkgs/development/python-modules/rank-bm25/default.nix (renamed from pkgs/development/python-modules/rank_bm25/default.nix)2
-rw-r--r--pkgs/development/python-modules/scikit-survival/default.nix18
-rw-r--r--pkgs/development/python-modules/simpful/default.nix11
-rw-r--r--pkgs/development/python-modules/spyder/default.nix6
-rw-r--r--pkgs/development/python-modules/tensorflow-probability/default.nix15
-rw-r--r--pkgs/development/python-modules/tlds/default.nix4
-rw-r--r--pkgs/development/python-modules/wikitextparser/default.nix4
-rw-r--r--pkgs/development/python-modules/zcbor/default.nix42
-rw-r--r--pkgs/development/tools/build-managers/alire/default.nix1
-rw-r--r--pkgs/development/tools/godot/4/default.nix6
-rw-r--r--pkgs/development/tools/kafka-delta-ingest/default.nix2
-rw-r--r--pkgs/development/tools/language-servers/csharp-ls/default.nix4
-rw-r--r--pkgs/development/tools/misc/opengrok/default.nix4
-rw-r--r--pkgs/development/tools/nest-cli/default.nix7
-rw-r--r--pkgs/development/tools/oh-my-posh/default.nix6
-rw-r--r--pkgs/development/tools/ols/default.nix6
-rw-r--r--pkgs/development/tools/pandoc/default.nix9
-rw-r--r--pkgs/development/tools/rust/cargo-readme/default.nix23
-rw-r--r--pkgs/development/tools/squawk/default.nix6
-rw-r--r--pkgs/development/tools/teller/default.nix1
-rw-r--r--pkgs/development/tools/turso-cli/default.nix6
-rw-r--r--pkgs/games/heroic/default.nix16
-rw-r--r--pkgs/games/heroic/fhsenv.nix1
-rw-r--r--pkgs/games/heroic/fix-infinite-loop.patch23
-rw-r--r--pkgs/games/heroic/remove-drm-support.patch24
-rw-r--r--pkgs/games/legendary-gl/default.nix6
-rw-r--r--pkgs/games/nile/default.nix6
-rw-r--r--pkgs/games/prismlauncher/0001-launcher-translations-explicitly-convert-QVector-ite.patch36
-rw-r--r--pkgs/games/prismlauncher/default.nix44
-rw-r--r--pkgs/games/shattered-pixel-dungeon/disable-git-version.patch2
-rw-r--r--pkgs/games/shattered-pixel-dungeon/summoning-pixel-dungeon.nix6
-rw-r--r--pkgs/os-specific/linux/evdi/default.nix8
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json30
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json24
-rw-r--r--pkgs/os-specific/linux/kernel/zen-kernels.nix8
-rw-r--r--pkgs/servers/dns/trust-dns/default.nix11
-rw-r--r--pkgs/servers/nfs-ganesha/default.nix4
-rw-r--r--pkgs/servers/nosql/mongodb/5.0.nix4
-rw-r--r--pkgs/servers/nosql/mongodb/6.0.nix4
-rw-r--r--pkgs/servers/onlyoffice-documentserver/default.nix4
-rw-r--r--pkgs/tools/admin/pulumi-packages/pulumi-azure-native.nix6
-rw-r--r--pkgs/tools/backup/sigtop/default.nix8
-rw-r--r--pkgs/tools/llm/heygpt/default.nix2
-rw-r--r--pkgs/tools/misc/envchain/default.nix2
-rw-r--r--pkgs/tools/misc/fastfetch/default.nix4
-rw-r--r--pkgs/tools/misc/pazi/default.nix2
-rw-r--r--pkgs/tools/misc/starship/default.nix2
-rw-r--r--pkgs/tools/misc/tab-rs/default.nix2
-rw-r--r--pkgs/tools/misc/zellij/default.nix8
-rw-r--r--pkgs/tools/networking/dogdns/default.nix2
-rw-r--r--pkgs/tools/networking/gping/default.nix6
-rw-r--r--pkgs/tools/networking/picosnitch/default.nix4
-rw-r--r--pkgs/tools/security/age/default.nix5
-rw-r--r--pkgs/tools/security/cosign/default.nix7
-rw-r--r--pkgs/tools/security/vaultwarden/default.nix4
-rw-r--r--pkgs/tools/system/netdata/default.nix14
-rw-r--r--pkgs/tools/system/netdata/go.d.plugin.nix6
-rw-r--r--pkgs/tools/system/zenith/default.nix2
-rw-r--r--pkgs/tools/typesetting/tex/texlive/build-tex-env.nix7
-rw-r--r--pkgs/top-level/all-packages.nix16
-rw-r--r--pkgs/top-level/php-packages.nix2
-rw-r--r--pkgs/top-level/python-packages.nix8
169 files changed, 1895 insertions, 605 deletions
diff --git a/lib/licenses.nix b/lib/licenses.nix
index d9555ca66cb96..a90bab0b15dd3 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -877,6 +877,21 @@ in mkLicense lset) ({
     fullName = "Non-Profit Open Software License 3.0";
   };
 
+  nvidiaCuda = {
+    shortName = "CUDA EULA";
+    fullName = "CUDA Toolkit End User License Agreement (EULA)";
+    url = "https://docs.nvidia.com/cuda/eula/index.html#cuda-toolkit-supplement-license-agreement";
+    free = false;
+  };
+
+  nvidiaCudaRedist = {
+    shortName = "CUDA EULA";
+    fullName = "CUDA Toolkit End User License Agreement (EULA)";
+    url = "https://docs.nvidia.com/cuda/eula/index.html#cuda-toolkit-supplement-license-agreement";
+    free = false;
+    redistributable = true;
+  };
+
   obsidian = {
     fullName = "Obsidian End User Agreement";
     url = "https://obsidian.md/eula";
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 85a1d4c523649..0c326c9bbf7a0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7998,6 +7998,12 @@
     githubId = 488556;
     name = "Javier Aguirre";
   };
+  javimerino = {
+    email = "merino.jav@gmail.com";
+    name = "Javi Merino";
+    github = "JaviMerino";
+    githubId = 44926;
+  };
   jayesh-bhoot = {
     name = "Jayesh Bhoot";
     email = "jb@jayeshbhoot.com";
@@ -14623,7 +14629,7 @@
   };
   quantenzitrone = {
     email = "quantenzitrone@protonmail.com";
-    github = "Quantenzitrone";
+    github = "quantenzitrone";
     githubId = 74491719;
     matrix = "@quantenzitrone:matrix.org";
     name = "quantenzitrone";
@@ -19078,6 +19084,12 @@
       fingerprint = "640B EDDE 9734 310A BFA3  B257 52ED AE6A 3995 AFAB";
     }];
   };
+  whiteley = {
+    email = "mattwhiteley@gmail.com";
+    github = "whiteley";
+    githubId = 2215;
+    name = "Matt Whiteley";
+  };
   WhittlesJr = {
     email = "alex.joseph.whitt@gmail.com";
     github = "WhittlesJr";
@@ -19381,11 +19393,11 @@
     name = "Uli Baum";
   };
   xfix = {
-    email = "konrad@borowski.pw";
+    email = "kamila@borowska.pw";
     matrix = "@xfix:matrix.org";
     github = "xfix";
     githubId = 1297598;
-    name = "Konrad Borowski";
+    name = "Kamila Borowska";
   };
   xfnw = {
     email = "xfnw+nixos@riseup.net";
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 22bc4c31618e6..2b45bbac8766d 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -485,6 +485,8 @@ The module update takes care of the new config syntax and the data itself (user
   - `keepTerminfo` controls whether `TERMINFO` and `TERMINFO_DIRS` are preserved
     for `root` and the `wheel` group.
 
+- `virtualisation.googleComputeImage` now provides `efi` option to support UEFI booting.
+
 - CoreDNS can now be built with external plugins by overriding `externalPlugins` and `vendorHash` arguments like this:
 
   ```
diff --git a/nixos/modules/services/audio/wyoming/faster-whisper.nix b/nixos/modules/services/audio/wyoming/faster-whisper.nix
index f156e8314a95f..2d56acdc1b4cd 100644
--- a/nixos/modules/services/audio/wyoming/faster-whisper.nix
+++ b/nixos/modules/services/audio/wyoming/faster-whisper.nix
@@ -146,6 +146,8 @@ in
           CapabilityBoundingSet = "";
           DeviceAllow = if builtins.elem options.device [ "cuda" "auto" ] then [
             # https://docs.nvidia.com/dgx/pdf/dgx-os-5-user-guide.pdf
+            # CUDA not working? Check DeviceAllow and PrivateDevices first!
+            "/dev/nvidia0"
             "/dev/nvidia1"
             "/dev/nvidia2"
             "/dev/nvidia3"
@@ -160,7 +162,6 @@ in
           DevicePolicy = "closed";
           LockPersonality = true;
           MemoryDenyWriteExecute = true;
-          PrivateDevices = true;
           PrivateUsers = true;
           ProtectHome = true;
           ProtectHostname = true;
diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index 3833418b5addd..de0e044453eec 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -12,6 +12,7 @@ let
     ln -s /run/wrappers/bin/perf.plugin $out/libexec/netdata/plugins.d/perf.plugin
     ln -s /run/wrappers/bin/slabinfo.plugin $out/libexec/netdata/plugins.d/slabinfo.plugin
     ln -s /run/wrappers/bin/freeipmi.plugin $out/libexec/netdata/plugins.d/freeipmi.plugin
+    ln -s /run/wrappers/bin/systemd-journal.plugin $out/libexec/netdata/plugins.d/systemd-journal.plugin
   '';
 
   plugins = [
@@ -254,7 +255,7 @@ in {
         # Capabilities
         CapabilityBoundingSet = [
           "CAP_DAC_OVERRIDE"      # is required for freeipmi and slabinfo plugins
-          "CAP_DAC_READ_SEARCH"   # is required for apps plugin
+          "CAP_DAC_READ_SEARCH"   # is required for apps and systemd-journal plugin
           "CAP_FOWNER"            # is required for freeipmi plugin
           "CAP_SETPCAP"           # is required for apps, perf and slabinfo plugins
           "CAP_SYS_ADMIN"         # is required for perf plugin
@@ -263,6 +264,7 @@ in {
           "CAP_NET_RAW"           # is required for fping app
           "CAP_SYS_CHROOT"        # is required for cgroups plugin
           "CAP_SETUID"            # is required for cgroups and cgroups-network plugins
+          "CAP_SYSLOG"            # is required for systemd-journal plugin
         ];
         # Sandboxing
         ProtectSystem = "full";
@@ -318,6 +320,14 @@ in {
         permissions = "u+rx,g+x,o-rwx";
       };
 
+      "systemd-journal.plugin" = {
+        source = "${cfg.package}/libexec/netdata/plugins.d/systemd-journal.plugin.org";
+        capabilities = "cap_dac_read_search,cap_syslog+ep";
+        owner = cfg.user;
+        group = cfg.group;
+        permissions = "u+rx,g+x,o-rwx";
+      };
+
       "slabinfo.plugin" = {
         source = "${cfg.package}/libexec/netdata/plugins.d/slabinfo.plugin.org";
         capabilities = "cap_dac_override+ep";
diff --git a/nixos/modules/services/networking/trust-dns.nix b/nixos/modules/services/networking/trust-dns.nix
index 4196d124a2ab2..758e33f16d388 100644
--- a/nixos/modules/services/networking/trust-dns.nix
+++ b/nixos/modules/services/networking/trust-dns.nix
@@ -54,7 +54,7 @@ in
         defaultText = "pkgs.trust-dns";
         description = mdDoc ''
           Trust-dns package to use.
-          Only `bin/trust-dns` need be provided: the other trust-dns utilities (client and resolver) are not needed.
+          The package must provide `meta.mainProgram` which names the server binary; any other utilities (client, resolver) are not needed.
         '';
       };
       quiet = mkOption {
@@ -135,7 +135,7 @@ in
           flags =  (lib.optional cfg.debug "--debug") ++ (lib.optional cfg.quiet "--quiet");
           flagsStr = builtins.concatStringsSep " " flags;
         in ''
-          ${cfg.package}/bin/trust-dns --config ${configFile} ${flagsStr}
+          ${cfg.package}/bin/${cfg.package.meta.mainProgram} --config ${configFile} ${flagsStr}
         '';
         Type = "simple";
         Restart = "on-failure";
diff --git a/nixos/modules/services/networking/wireguard.nix b/nixos/modules/services/networking/wireguard.nix
index d4099be12a278..d36be87daf60f 100644
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@@ -586,6 +586,7 @@ in
         }) all_peers;
 
     boot.extraModulePackages = optional (versionOlder kernel.kernel.version "5.6") kernel.wireguard;
+    boot.kernelModules = [ "wireguard" ];
     environment.systemPackages = [ pkgs.wireguard-tools ];
 
     systemd.services =
diff --git a/nixos/modules/system/boot/initrd-ssh.nix b/nixos/modules/system/boot/initrd-ssh.nix
index 3df14030ab687..a8cd2e8f05fcc 100644
--- a/nixos/modules/system/boot/initrd-ssh.nix
+++ b/nixos/modules/system/boot/initrd-ssh.nix
@@ -166,7 +166,7 @@ in
       }
     ];
 
-    warnings = lib.optional (config.boot.initrd.systemd.enable -> cfg.shell != null) ''
+    warnings = lib.optional (config.boot.initrd.systemd.enable && cfg.shell != null) ''
       Please set 'boot.initrd.systemd.users.root.shell' instead of 'boot.initrd.network.ssh.shell'
     '';
 
diff --git a/nixos/modules/virtualisation/google-compute-image.nix b/nixos/modules/virtualisation/google-compute-image.nix
index 197ebb18b9ad2..dcdd1b59eef53 100644
--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@@ -44,10 +44,17 @@ in
         GZIP compression level of the resulting disk image (1-9).
       '';
     };
+    virtualisation.googleComputeImage.efi = mkEnableOption "EFI booting";
   };
 
   #### implementation
   config = {
+    boot.initrd.availableKernelModules = [ "nvme" ];
+    boot.loader.grub = mkIf cfg.efi {
+      device = mkForce "nodev";
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+    };
 
     system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
       name = "google-compute-image";
@@ -62,6 +69,7 @@ in
       '';
       format = "raw";
       configFile = if cfg.configFile == null then defaultConfigFile else cfg.configFile;
+      partitionTableType = if cfg.efi then "efi" else "legacy";
       inherit (cfg) diskSize;
       inherit config lib pkgs;
     };
diff --git a/nixos/tests/castopod.nix b/nixos/tests/castopod.nix
index 1d53c3e9a3e61..4435ec617d4e6 100644
--- a/nixos/tests/castopod.nix
+++ b/nixos/tests/castopod.nix
@@ -82,6 +82,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
     castopod.succeed("curl -s http://localhost/cp-install | grep 'Create your Super Admin account' > /dev/null")
 
     with subtest("Create superadmin and log in"):
-        castopod.succeed("PYTHONUNBUFFERED=1 test-runner | systemd-cat -t test-runner")
+        castopod.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner")
   '';
 })
diff --git a/nixos/tests/hadoop/hadoop.nix b/nixos/tests/hadoop/hadoop.nix
index 0de2366b1864c..6162ccfd33d47 100644
--- a/nixos/tests/hadoop/hadoop.nix
+++ b/nixos/tests/hadoop/hadoop.nix
@@ -176,22 +176,22 @@ import ../make-test-python.nix ({ package, ... }: {
     nn2.succeed("systemctl stop hdfs-zkfc")
 
     # Initialize zookeeper for failover controller
-    nn1.succeed("sudo -u hdfs hdfs zkfc -formatZK 2>&1 | systemd-cat")
+    nn1.succeed("sudo -u hdfs systemd-cat hdfs zkfc -formatZK")
 
     # Format NN1 and start it
-    nn1.succeed("sudo -u hdfs hadoop namenode -format 2>&1 | systemd-cat")
+    nn1.succeed("sudo -u hdfs systemd-cat hadoop namenode -format")
     nn1.succeed("systemctl start hdfs-namenode")
     nn1.wait_for_open_port(9870)
     nn1.wait_for_open_port(8022)
     nn1.wait_for_open_port(8020)
 
     # Bootstrap NN2 from NN1 and start it
-    nn2.succeed("sudo -u hdfs hdfs namenode -bootstrapStandby 2>&1 | systemd-cat")
+    nn2.succeed("sudo -u hdfs systemd-cat hdfs namenode -bootstrapStandby")
     nn2.succeed("systemctl start hdfs-namenode")
     nn2.wait_for_open_port(9870)
     nn2.wait_for_open_port(8022)
     nn2.wait_for_open_port(8020)
-    nn1.succeed("netstat -tulpne | systemd-cat")
+    nn1.succeed("systemd-cat netstat -tulpne")
 
     # Start failover controllers
     nn1.succeed("systemctl start hdfs-zkfc")
@@ -200,10 +200,10 @@ import ../make-test-python.nix ({ package, ... }: {
     # DN should have started by now, but confirm anyway
     dn1.wait_for_unit("hdfs-datanode")
     # Print states of namenodes
-    client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u hdfs systemd-cat hdfs haadmin -getAllServiceState")
     # Wait for cluster to exit safemode
     client.succeed("sudo -u hdfs hdfs dfsadmin -safemode wait")
-    client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u hdfs systemd-cat hdfs haadmin -getAllServiceState")
     # test R/W
     client.succeed("echo testfilecontents | sudo -u hdfs hdfs dfs -put - /testfile")
     assert "testfilecontents" in client.succeed("sudo -u hdfs hdfs dfs -cat /testfile")
@@ -211,7 +211,7 @@ import ../make-test-python.nix ({ package, ... }: {
     # Test NN failover
     nn1.succeed("systemctl stop hdfs-namenode")
     assert "active" in client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState")
-    client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u hdfs systemd-cat hdfs haadmin -getAllServiceState")
     assert "testfilecontents" in client.succeed("sudo -u hdfs hdfs dfs -cat /testfile")
 
     nn1.succeed("systemctl start hdfs-namenode")
@@ -219,7 +219,7 @@ import ../make-test-python.nix ({ package, ... }: {
     nn1.wait_for_open_port(8022)
     nn1.wait_for_open_port(8020)
     assert "standby" in client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState")
-    client.succeed("sudo -u hdfs hdfs haadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u hdfs systemd-cat hdfs haadmin -getAllServiceState")
 
     #### YARN tests ####
 
@@ -236,18 +236,18 @@ import ../make-test-python.nix ({ package, ... }: {
     nm1.wait_for_open_port(8042)
     nm1.wait_for_open_port(8040)
     client.wait_until_succeeds("yarn node -list | grep Nodes:1")
-    client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState | systemd-cat")
-    client.succeed("sudo -u yarn yarn node -list | systemd-cat")
+    client.succeed("sudo -u yarn systemd-cat yarn rmadmin -getAllServiceState")
+    client.succeed("sudo -u yarn systemd-cat yarn node -list")
 
     # Test RM failover
     rm1.succeed("systemctl stop yarn-resourcemanager")
     assert "standby" not in client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState")
-    client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u yarn systemd-cat yarn rmadmin -getAllServiceState")
     rm1.succeed("systemctl start yarn-resourcemanager")
     rm1.wait_for_unit("yarn-resourcemanager")
     rm1.wait_for_open_port(8088)
     assert "standby" in client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState")
-    client.succeed("sudo -u yarn yarn rmadmin -getAllServiceState | systemd-cat")
+    client.succeed("sudo -u yarn systemd-cat yarn rmadmin -getAllServiceState")
 
     assert "Estimated value of Pi is" in client.succeed("HADOOP_USER_NAME=hdfs yarn jar $(readlink $(which yarn) | sed -r 's~bin/yarn~share/hadoop/mapreduce/hadoop-mapreduce-examples-*.jar~g') pi 2 10")
     assert "SUCCEEDED" in client.succeed("yarn application -list -appStates FINISHED")
diff --git a/nixos/tests/hadoop/hdfs.nix b/nixos/tests/hadoop/hdfs.nix
index 429d4bf6b5389..65686b3715598 100644
--- a/nixos/tests/hadoop/hdfs.nix
+++ b/nixos/tests/hadoop/hdfs.nix
@@ -50,8 +50,8 @@ import ../make-test-python.nix ({ package, lib, ... }:
     namenode.wait_for_unit("hdfs-namenode")
     namenode.wait_for_unit("network.target")
     namenode.wait_for_open_port(8020)
-    namenode.succeed("ss -tulpne | systemd-cat")
-    namenode.succeed("cat /etc/hadoop*/hdfs-site.xml | systemd-cat")
+    namenode.succeed("systemd-cat ss -tulpne")
+    namenode.succeed("systemd-cat cat /etc/hadoop*/hdfs-site.xml")
     namenode.wait_for_open_port(9870)
 
     datanode.wait_for_unit("hdfs-datanode")
diff --git a/nixos/tests/iscsi-multipath-root.nix b/nixos/tests/iscsi-multipath-root.nix
index 92ae9990c9477..494a539b57e00 100644
--- a/nixos/tests/iscsi-multipath-root.nix
+++ b/nixos/tests/iscsi-multipath-root.nix
@@ -202,7 +202,7 @@ import ./make-test-python.nix (
       initiatorAuto.succeed("umount /mnt")
 
       initiatorAuto.succeed("systemctl restart multipathd")
-      initiatorAuto.succeed("multipath -ll | systemd-cat")
+      initiatorAuto.succeed("systemd-cat multipath -ll")
 
       # Install our RootDisk machine to 123456, the alias to the device that multipath is now managing
       initiatorAuto.succeed("mount /dev/mapper/123456 /mnt")
@@ -223,7 +223,7 @@ import ./make-test-python.nix (
       initiatorRootDisk.fail("iscsiadm -m discovery -o update -t sendtargets -p 192.168.1.3 --login")
       initiatorRootDisk.fail("iscsiadm -m discovery -o update -t sendtargets -p 192.168.2.3 --login")
       initiatorRootDisk.succeed("systemctl restart multipathd")
-      initiatorRootDisk.succeed("multipath -ll | systemd-cat")
+      initiatorRootDisk.succeed("systemd-cat multipath -ll")
 
       # Verify we can write and sync the root disk
       initiatorRootDisk.succeed("mkdir /scratch")
diff --git a/nixos/tests/vaultwarden.nix b/nixos/tests/vaultwarden.nix
index 5dcd3ab39dcff..9d2f0e6ab060e 100644
--- a/nixos/tests/vaultwarden.nix
+++ b/nixos/tests/vaultwarden.nix
@@ -173,7 +173,7 @@ let
           )
 
       with subtest("use the web interface to sign up, log in, and save a password"):
-          server.succeed("PYTHONUNBUFFERED=1 test-runner | systemd-cat -t test-runner")
+          server.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner")
 
       with subtest("log in with the cli"):
           key = client.succeed(
diff --git a/pkgs/applications/audio/zam-plugins/default.nix b/pkgs/applications/audio/zam-plugins/default.nix
index c676e6a774b53..7d499ff1664e8 100644
--- a/pkgs/applications/audio/zam-plugins/default.nix
+++ b/pkgs/applications/audio/zam-plugins/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zam-plugins";
-  version = "4.1";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "zamaudio";
     repo = pname;
     rev = version;
-    sha256 = "sha256-NKa6lOP3fpAFMYwzZAMFgW0tBSM/F89oB/nDbEUeflw=";
+    sha256 = "sha256-6TPZMDhGHqXjY8UYEqlr4hweF+W19IpIfSa9Bo9Ta1A=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index 5947a3112e9be..86b01481839e0 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -75,7 +75,7 @@ rustPlatform.buildRustPackage rec {
     description = "Polkadot Node Implementation";
     homepage = "https://polkadot.network";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ akru andresilva asymmetric FlorianFranzen RaghavSood ];
+    maintainers = with maintainers; [ akru andresilva FlorianFranzen RaghavSood ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/graphics/photoflare/default.nix b/pkgs/applications/graphics/photoflare/default.nix
index 4e9f33621ffd2..6c6ea1059c73a 100644
--- a/pkgs/applications/graphics/photoflare/default.nix
+++ b/pkgs/applications/graphics/photoflare/default.nix
@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "photoflare";
-  version = "1.6.12";
+  version = "1.6.13";
 
   src = fetchFromGitHub {
     owner = "PhotoFlare";
     repo = "photoflare";
     rev = "v${version}";
-    sha256 = "sha256-UIEHQil7NsdIKQlrNPpf7rxj6O6P1xlz0E7FNYTcdT4=";
+    sha256 = "sha256-0eAuof/FBro2IKxkJ6JHauW6C96VTPxy7QtfPVzPFi4=";
   };
 
   nativeBuildInputs = [ qmake qttools ];
diff --git a/pkgs/applications/misc/anytype/default.nix b/pkgs/applications/misc/anytype/default.nix
index b8f8d09bdfd7c..f17a939b53cfc 100644
--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@@ -34,7 +34,7 @@ appimageTools.wrapType2 {
     description = "P2P note-taking tool";
     homepage = "https://anytype.io/";
     license = licenses.unfree;
-    maintainers = with maintainers; [ bbigras ];
+    maintainers = with maintainers; [ ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/misc/nwg-launchers/default.nix b/pkgs/applications/misc/nwg-launchers/default.nix
index 34600bb351eca..d3e11493fad80 100644
--- a/pkgs/applications/misc/nwg-launchers/default.nix
+++ b/pkgs/applications/misc/nwg-launchers/default.nix
@@ -46,6 +46,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/nwg-piotr/nwg-launchers";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ bbigras ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/misc/p2pool/default.nix b/pkgs/applications/misc/p2pool/default.nix
index 7f09f3b616196..a7b9041a34e2f 100644
--- a/pkgs/applications/misc/p2pool/default.nix
+++ b/pkgs/applications/misc/p2pool/default.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "p2pool";
-  version = "3.7";
+  version = "3.8";
 
   src = fetchFromGitHub {
     owner = "SChernykh";
     repo = "p2pool";
     rev = "v${version}";
-    sha256 = "sha256-WGavhxCGM10LXKvrXT3A2SOMSJRuoA/wAlEj7NFs8Ok=";
+    sha256 = "sha256-e/QXwRVtgl9+BaKbkeztCPfXORhef1HaKBPzKvVPVpM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/solaar/default.nix b/pkgs/applications/misc/solaar/default.nix
index be0d29ee507d0..93a6c069f6693 100644
--- a/pkgs/applications/misc/solaar/default.nix
+++ b/pkgs/applications/misc/solaar/default.nix
@@ -14,13 +14,13 @@
 # instead of adding this to `services.udev.packages` on NixOS,
 python3Packages.buildPythonApplication rec {
   pname = "solaar";
-  version = "1.1.9";
+  version = "1.1.10";
 
   src = fetchFromGitHub {
     owner = "pwr-Solaar";
     repo = "Solaar";
     rev = "refs/tags/${version}";
-    hash = "sha256-MdPZ9uLQYwgZ6xXWinzFg5A2gJ3ihTS9CbEmXnaNEkI=";
+    hash = "sha256-cs1kj/spZtMUL9aUtBHINAH7uyjMSn9jRDF/hRPzIbo=";
   };
 
   outputs = [ "out" "udev" ];
@@ -38,13 +38,14 @@ python3Packages.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3Packages; [
     evdev
+    dbus-python
     gtk3
+    hid-parser
     psutil
     pygobject3
     pyudev
     pyyaml
     xlib
-    hid-parser
   ];
 
   # the -cli symlink is just to maintain compabilility with older versions where
diff --git a/pkgs/applications/networking/cluster/kluctl/default.nix b/pkgs/applications/networking/cluster/kluctl/default.nix
index 0dff89cad4b05..2f6939347729b 100644
--- a/pkgs/applications/networking/cluster/kluctl/default.nix
+++ b/pkgs/applications/networking/cluster/kluctl/default.nix
@@ -2,16 +2,18 @@
 
 buildGoModule rec {
   pname = "kluctl";
-  version = "2.20.8";
+  version = "2.22.1";
 
   src = fetchFromGitHub {
     owner = "kluctl";
     repo = "kluctl";
     rev = "v${version}";
-    hash = "sha256-F4vEHzN44+d0EtfJukEq5WVm8aLVWqmT5Xcpa/DBPng=";
+    hash = "sha256-s7ADEWy3wx2hGeJzfXPVSBv+bAOoOQPsF75Sq02T/AI=";
   };
 
-  vendorHash = "sha256-x5Zy8H7DzxU+uBCUL6edv8x2LwiIjXl5UrRUMDtUEk8=";
+  subPackages = [ "cmd" ];
+
+  vendorHash = "sha256-EEOVd15f1SK8InSIG+TuVwWibkf+ePJ5AGZpiMD+RaQ=";
 
   ldflags = [ "-s" "-w" "-X main.version=v${version}" ];
 
diff --git a/pkgs/applications/networking/cluster/pachyderm/default.nix b/pkgs/applications/networking/cluster/pachyderm/default.nix
index f8ff802ede828..71fd37a3cefd6 100644
--- a/pkgs/applications/networking/cluster/pachyderm/default.nix
+++ b/pkgs/applications/networking/cluster/pachyderm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pachyderm";
-  version = "2.7.2";
+  version = "2.7.6";
 
   src = fetchFromGitHub {
     owner = "pachyderm";
     repo = "pachyderm";
     rev = "v${version}";
-    hash = "sha256-+DqkYzRS1H6PGthljAqsmLAnGtKkX4g0drZiRh8b1v4=";
+    hash = "sha256-h0xr94DNmqjpRcas0F+UxQEnCHt5VGU2CRtv+GzJl00=";
   };
 
-  vendorHash = "sha256-q8Cx+J5BjMvO5wuvH5Tc5Oa9rjW7vXvS4DhSVv/E3E4=";
+  vendorHash = "sha256-UBuCAIwx1UOh9bsk3eNlTOozB55RIvuKQ0P1WRkJNaI=";
 
   subPackages = [ "src/server/cmd/pachctl" ];
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 589754a397bc3..bd7012619b660 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -772,13 +772,13 @@
     "vendorHash": "sha256-cufN4QYXE+bqDKLUV+Rdslr5CgbI0DvoFVWVQiBVomw="
   },
   "mongodbatlas": {
-    "hash": "sha256-aS5TU9xnevgjK9TH0J4nzSr6ct2Cqw2Wa+d+jIjA9Qg=",
+    "hash": "sha256-SMIc78haJiH0XdTr9OBGWOcvXfYQW9thcNkCOxmNxDw=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.12.2",
+    "rev": "v1.12.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-on7kyb/AGdQK++5AOCEmkrRlbuW09u2653mda9gmvKE="
+    "vendorHash": "sha256-B1trhV2/H5gP7EnUU7G45gIh95S2wYbANHsRM76CDWE="
   },
   "namecheap": {
     "hash": "sha256-cms8YUL+SjTeYyIOQibksi8ZHEBYq2JlgTEpOO1uMZE=",
diff --git a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
index 23afcc13e414d..9d639817c39f9 100644
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@@ -2,13 +2,13 @@
 
 (if stdenv.isDarwin then darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv).mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20231106-1";
+  version = "20231107-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-alQOYh1I4t1OppHbjsbDK6wc599Z0uDAyQjCtKM72ak=";
+    hash = "sha256-5JF/cU2yz1TDKUSAiZJ5LQfvsGSQtuww543O03gkZ+Y=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
index b8de2d5ed590d..f37363dc71737 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@@ -103,14 +103,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "4.11.3";
+  version = "4.11.5";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-Xjb8um3TA2yIPrCdEV1BJ10keyAqTnlU20ZZ0T3P3ls=";
+    hash = "sha256-NkUm05bR5y5TAI5SL0en029n9903PzarQ6HC2vot27o=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/remote/wayvnc/default.nix b/pkgs/applications/networking/remote/wayvnc/default.nix
index 77d72060c1e22..19d19310591d5 100644
--- a/pkgs/applications/networking/remote/wayvnc/default.nix
+++ b/pkgs/applications/networking/remote/wayvnc/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wayvnc";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "any1";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hmlzv1WaT+KucR7RGPC3bKcIdTxPOvK2s17nDucdu7c=";
+    sha256 = "sha256-6at0p1Xc25K5l6sq2uMWpaLVvZMNlWC0ybyZyrIw41I=";
   };
 
   strictDeps = true;
diff --git a/pkgs/applications/office/gnucash/default.nix b/pkgs/applications/office/gnucash/default.nix
index eacda570cc0c1..7c378bc52a90d 100644
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, fetchFromGitHub
 , fetchurl
 , fetchpatch
 , aqbanking
@@ -32,7 +33,7 @@ stdenv.mkDerivation rec {
   # raw source code doesn't work out of box; fetchFromGitHub not usable
   src = fetchurl {
     # Upstream uploaded a -1 tarball on the same release, remove on next release
-    url = "https://github.com/Gnucash/gnucash/releases/download/${version}/${pname}-${version}-1.tar.bz2";
+    url = "https://github.com/Gnucash/gnucash/releases/download/${version}/gnucash-${version}-1.tar.bz2";
     hash = "sha256-d0EWXW1lLqe0oehJjPQ5pWuBpcyLZTKRpZBU8jYqv8w=";
   };
 
@@ -97,12 +98,29 @@ stdenv.mkDerivation rec {
   enableParallelChecking = true;
   checkTarget = "check";
 
+  passthru.docs = stdenv.mkDerivation {
+    pname = "gnucash-docs";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "Gnucash";
+      repo = "gnucash-docs";
+      rev = version;
+      hash = "sha256-aPxQEcpo8SPv8lPQbxMl1wg8ijH9Rz0oo4K5lp3C/bw=";
+    };
+
+    nativeBuildInputs = [ cmake ];
+    buildInputs = [ libxml2 libxslt ];
+  };
+
   preFixup = ''
     gappsWrapperArgs+=(
+      # documentation
+      --prefix XDG_DATA_DIRS : ${passthru.docs}/share
       # db drivers location
       --set GNC_DBD_DIR ${libdbiDrivers}/lib/dbd
       # gsettings schema location on Nix
-      --set GSETTINGS_SCHEMA_DIR ${glib.makeSchemaPath "$out" "${pname}-${version}"}
+      --set GSETTINGS_SCHEMA_DIR ${glib.makeSchemaPath "$out" "gnucash-${version}"}
     )
   '';
 
diff --git a/pkgs/applications/office/wpsoffice/default.nix b/pkgs/applications/office/wpsoffice/default.nix
index 67fa25115fb01..8376b49b81976 100644
--- a/pkgs/applications/office/wpsoffice/default.nix
+++ b/pkgs/applications/office/wpsoffice/default.nix
@@ -21,14 +21,14 @@
 
 stdenv.mkDerivation rec {
   pname = "wpsoffice";
-  version = "11.1.0.11704";
+  version = "11.1.0.11708";
 
   src = if useChineseVersion then fetchurl {
     url = "https://wps-linux-personal.wpscdn.cn/wps/download/ep/Linux2019/${lib.last (lib.splitString "." version)}/wps-office_${version}_amd64.deb";
-    hash = "sha256-ffLSon9FpQZDQ1uapchBUkVaHOXs+H/6kHJLNiWqwiE=";
+    hash = "sha256-GcWRrJ0I1Q6D2VK6YsPmd5Uir5LcIBFJa1amV2sUurk=";
   } else fetchurl {
     url = "https://wdl1.pcfg.cache.wpscdn.com/wpsdl/wpsoffice/download/linux/${lib.last (lib.splitString "." version)}/wps-office_${version}.XA_amd64.deb";
-    hash = "sha256-nxpMEWKiNjjEUoVJkhpvjnCuWBCCGjPk+sUlKz+KjMI=";
+    hash = "sha256-J40/wrmMz/r4eb2X/rbxWn04UcSsag7SO3aSqBLFSN4=";
   };
 
   unpackCmd = "dpkg -x $src .";
diff --git a/pkgs/applications/science/astronomy/stellarium/default.nix b/pkgs/applications/science/astronomy/stellarium/default.nix
index d656c39d0bc06..3b61c8dac2b89 100644
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@@ -70,7 +70,9 @@ stdenv.mkDerivation rec {
     qtwayland
   ];
 
-  preConfigure = lib.optionalString stdenv.isDarwin ''
+  preConfigure = ''
+    export SOURCE_DATE_EPOCH=$(date -d 20${lib.versions.major version}0101 +%s)
+  '' + lib.optionalString stdenv.isDarwin ''
     export LC_ALL=en_US.UTF-8
   '';
 
diff --git a/pkgs/applications/version-management/guilt/darwin-fix.patch b/pkgs/applications/version-management/guilt/darwin-fix.patch
new file mode 100644
index 0000000000000..54c11059be64c
--- /dev/null
+++ b/pkgs/applications/version-management/guilt/darwin-fix.patch
@@ -0,0 +1,20 @@
+uname -s is used to determine the differences between the command line
+utilities like stat or awk in linux and darwin. However, in nix, guilt
+will be using the nix versions of this programs, not the ones
+installed in the system.  Therefore, guilt should use the command-line
+parameters that the linux forms of these commands expect, even if it
+is being run on Darwin.
+
+diff --git a/guilt b/guilt
+index bf50343..cfc9332 100755
+--- a/guilt
++++ b/guilt
+@@ -986,7 +986,7 @@ guards_file="$GUILT_DIR/$branch/guards"
+ pager="more"
+ [ ! -z "$PAGER" ] && pager="$PAGER"
+ 
+-UNAME_S=`uname -s`
++UNAME_S="Linux"
+ 
+ if [ -r "$GUILT_PATH/os.$UNAME_S" ]; then
+ 	. "$GUILT_PATH/os.$UNAME_S"
diff --git a/pkgs/applications/version-management/guilt/default.nix b/pkgs/applications/version-management/guilt/default.nix
new file mode 100644
index 0000000000000..664db771e93f2
--- /dev/null
+++ b/pkgs/applications/version-management/guilt/default.nix
@@ -0,0 +1,92 @@
+{ asciidoc
+, docbook_xml_dtd_45
+, docbook_xsl
+, fetchFromGitHub
+, gawk
+, git
+, gnused
+, lib
+, makeWrapper
+, openssl
+, perl
+, stdenv
+, xmlto
+}:
+
+stdenv.mkDerivation rec {
+  pname = "guilt";
+  version = "0.37-rc1";
+
+  src = fetchFromGitHub {
+    owner = "jeffpc";
+    repo = "guilt";
+    rev = "v${version}";
+    sha256 = "sha256-7OgRbMGYWtGvrZxKfJe0CkpmU3AUkPebF5NyTsfXeGA=";
+  };
+
+  doCheck = true;
+
+  patches = [
+    ./guilt-help-mandir.patch
+    ./darwin-fix.patch
+  ];
+  nativeBuildInputs = [
+    asciidoc
+    docbook_xml_dtd_45
+    docbook_xsl
+    makeWrapper
+    perl
+    xmlto
+  ];
+  buildInputs = [
+    gawk
+    git
+    gnused
+  ] ++ lib.optionals stdenv.isDarwin [ openssl ];
+  makeFlags = [
+    "PREFIX=$(out)"
+  ];
+
+  postBuild = ''
+    make -j $NIX_BUILD_CORES doc
+  '';
+
+  preCheck = ''
+    patchShebangs regression/run-tests regression/*.sh
+  '';
+
+  postInstall = ''
+    make PREFIX=$out install-doc
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/guilt --prefix PATH : ${lib.makeBinPath buildInputs}
+  '';
+
+  meta = with lib; {
+    description = "Manage patches like quilt, on top of a git repository";
+    longDescription = ''
+      Andrew Morton originally developed a set of scripts for
+      maintaining kernel patches outside of any SCM tool. Others
+      extended these into a suite called quilt]. The basic idea behind
+      quilt is to maintain patches instead of maintaining source
+      files. Patches can be added, removed or reordered, and they can
+      be refreshed as you fix bugs or update to a new base
+      revision. quilt is very powerful, but it is not integrated with
+      the underlying SCM tools. This makes it difficult to visualize
+      your changes.
+
+      Guilt allows one to use quilt functionality on top of a Git
+      repository. Changes are maintained as patches which are
+      committed into Git. Commits can be removed or reordered, and the
+      underlying patch can be refreshed based on changes made in the
+      working directory. The patch directory can also be placed under
+      revision control, so you can have a separate history of changes
+      made to your patches.
+    '';
+    homepage = "https://github.com/jeffpc/guilt";
+    maintainers = with lib.maintainers; [ javimerino ];
+    license = [ licenses.gpl2 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/version-management/guilt/guilt-help-mandir.patch b/pkgs/applications/version-management/guilt/guilt-help-mandir.patch
new file mode 100644
index 0000000000000..54f1149f291e9
--- /dev/null
+++ b/pkgs/applications/version-management/guilt/guilt-help-mandir.patch
@@ -0,0 +1,15 @@
+nixpkgs' post-installation fixup moves the pages to share/man.  Tell guilt-help so that it can find them.
+
+diff --git a/guilt-help b/guilt-help
+index 93442a3..b29e059 100755
+--- a/guilt-help
++++ b/guilt-help
+@@ -34,7 +34,7 @@ case $# in
+ 		;;
+ esac
+ 
+-MANDIR=`dirname $0`/../man
++MANDIR=`dirname $0`/../share/man
+ MANDIR=`(cd "$MANDIR"; pwd)`
+ exec man -M "$MANDIR" "$page"
+ 
diff --git a/pkgs/applications/version-management/meld/default.nix b/pkgs/applications/version-management/meld/default.nix
index 224efe8c1ac23..fc8ec7b55d1fe 100644
--- a/pkgs/applications/version-management/meld/default.nix
+++ b/pkgs/applications/version-management/meld/default.nix
@@ -47,7 +47,7 @@ python3.pkgs.buildPythonApplication rec {
     gnome.adwaita-icon-theme
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  pythonPath = with python3.pkgs; [
     pygobject3
     pycairo
   ];
diff --git a/pkgs/applications/video/mpv/scripts/acompressor.nix b/pkgs/applications/video/mpv/scripts/acompressor.nix
index d10ef5f9df755..d82d12f163e7f 100644
--- a/pkgs/applications/video/mpv/scripts/acompressor.nix
+++ b/pkgs/applications/video/mpv/scripts/acompressor.nix
@@ -1,27 +1,17 @@
-{ stdenvNoCC
+{ lib
+, buildLua
 , mpv-unwrapped
-, lib
 }:
 
-stdenvNoCC.mkDerivation rec {
+buildLua {
+  inherit (mpv-unwrapped) src version;
   pname = "mpv-acompressor";
-  version = mpv-unwrapped.version;
-
-  src = "${mpv-unwrapped.src.outPath}/TOOLS/lua/acompressor.lua";
-
-  dontBuild = true;
-  dontUnpack = true;
-
-  installPhase = ''
-    install -Dm644 ${src} $out/share/mpv/scripts/acompressor.lua
-  '';
-
-  passthru.scriptName = "acompressor.lua";
+  scriptPath = "TOOLS/lua/acompressor.lua";
 
   meta = with lib; {
+    inherit (mpv-unwrapped.meta) license;
     description = "Script to toggle and control ffmpeg's dynamic range compression filter.";
     homepage = "https://github.com/mpv-player/mpv/blob/master/TOOLS/lua/acompressor.lua";
-    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ nicoo ];
   };
 }
diff --git a/pkgs/applications/video/mpv/scripts/buildLua.nix b/pkgs/applications/video/mpv/scripts/buildLua.nix
new file mode 100644
index 0000000000000..b86642305fc60
--- /dev/null
+++ b/pkgs/applications/video/mpv/scripts/buildLua.nix
@@ -0,0 +1,22 @@
+{ lib
+, stdenvNoCC }:
+
+let fileName = pathStr: lib.last (lib.splitString "/" pathStr);
+in
+lib.makeOverridable (
+  { pname, scriptPath ? "${pname}.lua", ... }@args:
+  stdenvNoCC.mkDerivation (lib.attrsets.recursiveUpdate {
+    dontBuild = true;
+    preferLocalBuild = true;
+
+    outputHashMode = "recursive";
+    installPhase = ''
+      runHook preInstall
+      install -m644 -Dt $out/share/mpv/scripts ${scriptPath}
+      runHook postInstall
+    '';
+
+    passthru.scriptName = fileName scriptPath;
+    meta.platforms = lib.platforms.all;
+  } args)
+)
diff --git a/pkgs/applications/video/mpv/scripts/chapterskip.nix b/pkgs/applications/video/mpv/scripts/chapterskip.nix
index c147da8d45984..bffc27bd1eacc 100644
--- a/pkgs/applications/video/mpv/scripts/chapterskip.nix
+++ b/pkgs/applications/video/mpv/scripts/chapterskip.nix
@@ -1,11 +1,9 @@
 { lib
 , fetchFromGitHub
-, nix-update-script
-, stdenvNoCC }:
+, buildLua }:
 
-stdenvNoCC.mkDerivation {
+buildLua {
   pname = "chapterskip";
-  passthru.scriptName = "chapterskip.lua";
 
   version = "unstable-2022-09-08";
   src = fetchFromGitHub {
@@ -15,17 +13,8 @@ stdenvNoCC.mkDerivation {
     hash  = "sha256-OTrLQE3rYvPQamEX23D6HttNjx3vafWdTMxTiWpDy90=";
   };
 
-  dontBuild = true;
-  preferLocalBuild = true;
-  installPhase = "install -Dt $out/share/mpv/scripts chapterskip.lua";
-
-  passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version=branch" ];
-  };
-
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/po5/chapterskip";
-    platforms = platforms.all;
-    maintainers = with maintainers; [ nicoo ];
+    maintainers = with lib.maintainers; [ nicoo ];
   };
 }
diff --git a/pkgs/applications/video/mpv/scripts/default.nix b/pkgs/applications/video/mpv/scripts/default.nix
index 2866f80f5652e..562e3de1645bc 100644
--- a/pkgs/applications/video/mpv/scripts/default.nix
+++ b/pkgs/applications/video/mpv/scripts/default.nix
@@ -3,13 +3,14 @@
 , config
 }:
 
-lib.recurseIntoAttrs
+let buildLua = callPackage ./buildLua.nix { };
+in lib.recurseIntoAttrs
   ({
-    acompressor = callPackage ./acompressor.nix { };
+    acompressor = callPackage ./acompressor.nix { inherit buildLua; };
     autocrop = callPackage ./autocrop.nix { };
     autodeint = callPackage ./autodeint.nix { };
     autoload = callPackage ./autoload.nix { };
-    chapterskip = callPackage ./chapterskip.nix { };
+    chapterskip = callPackage ./chapterskip.nix { inherit buildLua; };
     convert = callPackage ./convert.nix { };
     inhibit-gnome = callPackage ./inhibit-gnome.nix { };
     mpris = callPackage ./mpris.nix { };
@@ -27,7 +28,7 @@ lib.recurseIntoAttrs
     webtorrent-mpv-hook = callPackage ./webtorrent-mpv-hook.nix { };
     cutter = callPackage ./cutter.nix { };
   }
-  // (callPackage ./occivink.nix { }))
+  // (callPackage ./occivink.nix { inherit buildLua; }))
   // lib.optionalAttrs config.allowAliases {
   youtube-quality = throw "'youtube-quality' is no longer maintained, use 'quality-menu' instead"; # added 2023-07-14
 }
diff --git a/pkgs/applications/video/mpv/scripts/occivink.nix b/pkgs/applications/video/mpv/scripts/occivink.nix
index da723fd9102e6..167e2fef6ac09 100644
--- a/pkgs/applications/video/mpv/scripts/occivink.nix
+++ b/pkgs/applications/video/mpv/scripts/occivink.nix
@@ -1,14 +1,17 @@
 { lib
-, stdenvNoCC
 , fetchFromGitHub
+, buildLua
 }:
 
 let
-  script = { n, ... }@p:
-    stdenvNoCC.mkDerivation (lib.attrsets.recursiveUpdate {
-      pname = "mpv_${n}";
-      passthru.scriptName = "${n}.lua";
-
+  camelToKebab = let
+    inherit (lib.strings) match stringAsChars toLower;
+    isUpper = match "[A-Z]";
+  in stringAsChars (c: if isUpper c != null then "-${toLower c}" else c);
+
+  mkScript = name: args:
+    buildLua (lib.attrsets.recursiveUpdate rec {
+      pname = camelToKebab name;
       src = fetchFromGitHub {
         owner = "occivink";
         repo = "mpv-scripts";
@@ -17,37 +20,26 @@ let
       };
       version = "unstable-2022-10-02";
 
-      dontBuild = true;
-      installPhase = ''
-        mkdir -p $out/share/mpv/scripts
-        cp -r scripts/${n}.lua $out/share/mpv/scripts/
-      '';
+      scriptPath = "scripts/${pname}.lua";
 
       meta = with lib; {
         homepage = "https://github.com/occivink/mpv-scripts";
         license = licenses.unlicense;
-        platforms = platforms.all;
         maintainers = with maintainers; [ nicoo ];
       };
-
-      outputHashAlgo = "sha256";
-      outputHashMode = "recursive";
-    } p);
+    } args);
 
 in
-{
+lib.mapAttrs (name: lib.makeOverridable (mkScript name)) {
 
   # Usage: `pkgs.mpv.override { scripts = [ pkgs.mpvScripts.seekTo ]; }`
-  seekTo = script {
-    n = "seek-to";
+  seekTo = {
     meta.description = "Mpv script for seeking to a specific position";
     outputHash = "sha256-3RlbtUivmeoR9TZ6rABiZSd5jd2lFv/8p/4irHMLshs=";
   };
 
-  blacklistExtensions = script {
-    n = "blacklist-extensions";
+  blacklistExtensions = {
     meta.description = "Automatically remove playlist entries based on their extension.";
     outputHash = "sha256-qw9lz8ofmvvh23F9aWLxiU4YofY+YflRETu+nxMhvVE=";
   };
-
 }
diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
index 13f8f40ed6358..8f2358fdd6abb 100644
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -102,11 +102,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "${optionalString onlyLibVLC "lib"}vlc";
-  version = "3.0.18";
+  version = "3.0.20";
 
   src = fetchurl {
     url = "http://get.videolan.org/vlc/${finalAttrs.version}/vlc-${finalAttrs.version}.tar.xz";
-    hash = "sha256-VwlEOcNl2KqLm0H6MIDMDu8r7+YCW7XO9yKszGJa7ew=";
+    hash = "sha256-rccoW00nIc3fQOtScMraKqoQozTLVG/VWgY1NEe6KbU=";
   };
 
   nativeBuildInputs = [
@@ -220,12 +220,6 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://code.videolan.org/videolan/vlc/uploads/eb1c313d2d499b8a777314f789794f9d/0001-Add-lssl-and-lcrypto-to-liblive555_plugin_la_LIBADD.patch";
       sha256 = "0kyi8q2zn2ww148ngbia9c7qjgdrijf4jlvxyxgrj29cb5iy1kda";
     })
-    # patch to build with recent libplacebo
-    # https://code.videolan.org/videolan/vlc/-/merge_requests/3027
-    (fetchpatch {
-      url = "https://code.videolan.org/videolan/vlc/-/commit/65ea8d19d91ac1599a29e8411485a72fe89c45e2.patch";
-      hash = "sha256-Zz+g75V6X9OZI3sn614K9Uenxl3WtRHKSdLkWP3b17w=";
-    })
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
index 47ec249ea11ee..09577f37b2d63 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
@@ -40,13 +40,13 @@ assert lib.assertMsg (!nvidiaPatches) "The option `nvidiaPatches` has been renam
 assert lib.assertMsg (!hidpiXWayland) "The option `hidpiXWayland` has been removed. Please refer https://wiki.hyprland.org/Configuring/XWayland";
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + lib.optionalString debug "-debug";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = finalAttrs.pname;
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8n67P8wvtFgjOufTj4y1sRpBcbMrlhSlH7d8dOhUKns=";
+    hash = "sha256-HrnlCdZBqqE37gFORapfSGEGcqhCyhX2aSMRnDEmR0k=";
   };
 
   patches = [
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix b/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
index c102b6dfb416f..484cda3328d22 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/wlroots.nix
@@ -42,8 +42,8 @@ wlroots.overrideAttrs
       domain = "gitlab.freedesktop.org";
       owner = "wlroots";
       repo = "wlroots";
-      rev = "3406c1b17a4a7e6d4e2a7d9c1176affa72bce1bc";
-      hash = "sha256-ecDhdYLXWHsxMv+EWG36mCNDvzRbu9qfjH7dLxL7aGM=";
+      rev = "47bf87ade2bd32395615a385ebde1fefbcdf79a2";
+      hash = "sha256-jU0I6FoCKnj4zIBL4daosFWh81U1fM719Z6cae8PxSY=";
     };
 
     pname =
diff --git a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
index 9960824e642ed..4657ab2464c77 100644
--- a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (self: {
   pname = "xdg-desktop-portal-hyprland";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "xdg-desktop-portal-hyprland";
     rev = "v${self.version}";
-    hash = "sha256-y8q4XUwx+gVK7i2eLjfR32lVo7TYvEslyzrmzYEaPZU=";
+    hash = "sha256-IKcRTKzlcDsbD5xydRNc9s4c4KjcQHaZgOc5kWPOAtU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ge/gerrit-queue/package.nix b/pkgs/by-name/ge/gerrit-queue/package.nix
new file mode 100644
index 0000000000000..e9369e8f0232f
--- /dev/null
+++ b/pkgs/by-name/ge/gerrit-queue/package.nix
@@ -0,0 +1,25 @@
+{ buildGoModule
+, lib
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "gerrit-queue";
+  version = "0.0.1";
+
+  src = fetchFromGitHub {
+    owner = "flokli";
+    repo = "gerrit-queue";
+    rev = "v${version}";
+    hash = "sha256-JkAYqqet6y89RTBU9FuxkMwJiGM6opL0reXbojSal3Y=";
+  };
+  vendorHash = "sha256-+Ig4D46NphzpWKXO23Haea9EqVtpda8v9zLPJkbe3bQ=";
+
+  meta = with lib; {
+    description = "Merge bot for Gerrit";
+    homepage = "https://github.com/flokli/gerrit-queue";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ flokli ];
+    mainProgram = "gerrit-queue";
+  };
+}
diff --git a/pkgs/by-name/ja/jasper/package.nix b/pkgs/by-name/ja/jasper/package.nix
index 23171c71fbecb..fbd8b9f1657de 100644
--- a/pkgs/by-name/ja/jasper/package.nix
+++ b/pkgs/by-name/ja/jasper/package.nix
@@ -7,20 +7,24 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jasper";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "jasper-software";
     repo = "jasper";
     rev = "version-${finalAttrs.version}";
-    hash = "sha256-v/AFx40JWdbTCa008tDz/n9cXgpAkKv4rSiGJ8yx1YQ=";
+    hash = "sha256-IQBszOKou5Q1lgDy2LICHFmOKYJ3/djmuHGNalVHeBQ=";
   };
 
+  outputs = [ "out" "doc" "man" ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
   ];
 
+  # Since "build" already exists and is populated, cmake tries to use it,
+  # throwing uncomprehensible error messages...
   cmakeBuildDir = "build-directory";
 
   strictDeps = true;
diff --git a/pkgs/by-name/mc/mcuboot-imgtool/package.nix b/pkgs/by-name/mc/mcuboot-imgtool/package.nix
new file mode 100644
index 0000000000000..3e618c47c486b
--- /dev/null
+++ b/pkgs/by-name/mc/mcuboot-imgtool/package.nix
@@ -0,0 +1,38 @@
+{ lib
+, fetchPypi
+, python3Packages
+, nix-update-script
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "mfgtool-imgtool";
+  version = "1.10.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit version;
+    pname = "imgtool";
+    hash = "sha256-A7NOdZNKw9lufEK2vK8Rzq9PRT98bybBfXJr0YMQS0A=";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  nativeBuildInputs = with python3Packages; [
+    setuptools
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    cbor2
+    click
+    cryptography
+    intelhex
+  ];
+
+  meta = with lib; {
+    description = "MCUboot's image signing and key management";
+    homepage = "https://github.com/mcu-tools/mcuboot/tree/main/scripts";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ otavio ];
+    mainProgram = "imgtool";
+  };
+}
diff --git a/pkgs/by-name/me/memtree/package.nix b/pkgs/by-name/me/memtree/package.nix
new file mode 100644
index 0000000000000..2165b46e2b486
--- /dev/null
+++ b/pkgs/by-name/me/memtree/package.nix
@@ -0,0 +1,50 @@
+{ lib
+, fetchFromGitHub
+, nix-update-script
+, python3Packages
+}:
+
+python3Packages.buildPythonApplication {
+  pname = "memtree";
+  version = "unstable-2023-11-04";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "nbraud";
+    repo = "memtree";
+    rev = "093caeef26ee944b5bf4408710f63494e442b5ff";
+    hash = "sha256-j4LqWy7DxeV7pjwnCfpkHwug4p48kux6BM6oDJmvuUo=";
+  };
+
+  nativeBuildInputs = with python3Packages; [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    rich
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    hypothesis
+    pytest
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    python -m pytest -v
+    runHook postCheck
+  '';
+
+  pythonImportChecks = [ "memtree" ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = with lib; {
+    description = "Render cgroups tree annotated by memory usage";
+    homepage = "https://github.com/nbraud/memtree";
+    maintainers = with maintainers; [ nicoo ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/nu/numbat/package.nix b/pkgs/by-name/nu/numbat/package.nix
index 3543115eda493..5da88e6af8ede 100644
--- a/pkgs/by-name/nu/numbat/package.nix
+++ b/pkgs/by-name/nu/numbat/package.nix
@@ -24,6 +24,13 @@ rustPlatform.buildRustPackage rec {
     darwin.apple_sdk.frameworks.Security
   ];
 
+  env.NUMBAT_SYSTEM_MODULE_PATH = "${placeholder "out"}/share/${pname}/modules";
+
+  postInstall = ''
+    mkdir -p $out/share/${pname}
+    cp -r $src/${pname}/modules $out/share/${pname}/
+  '';
+
   passthru.tests.version = testers.testVersion {
     package = numbat;
   };
diff --git a/pkgs/by-name/op/open-english-wordnet/package.nix b/pkgs/by-name/op/open-english-wordnet/package.nix
new file mode 100644
index 0000000000000..ccd661753c059
--- /dev/null
+++ b/pkgs/by-name/op/open-english-wordnet/package.nix
@@ -0,0 +1,73 @@
+{ lib
+, fetchFromGitHub
+, fetchpatch
+, gzip
+, python3
+, stdenvNoCC
+}:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "open-english-wordnet";
+  version = "2022";
+
+  src = fetchFromGitHub {
+    owner = "globalwordnet";
+    repo = "english-wordnet";
+    rev = "${self.version}-edition";
+    hash = "sha256-a1fWIp39uuJZL1aFX/r+ttLB1+kwh/XPHwphgENTQ5M=";
+  };
+
+  patches = lib.mapAttrsToList (rev: hash: fetchpatch {
+    url = "https://github.com/globalwordnet/english-wordnet/commit/${rev}.patch";
+    inherit hash;
+  }) {
+    # Upstream commit bumping the version number, accidentally ommited from the tagged release
+    "bc07902f8995b62c70f01a282b23f40f30630540" = "sha256-1e4MG/k86g3OFUhiShCCbNXnvDKrYFr1KlGVsGl++KI=";
+    # PR #982, “merge.py: Make result independent of filesystem order”
+    "6da46a48dd76a48ad9ff563e6c807b8271fc83cd" = "sha256-QkkJH7NVGy/IbeSWkotU80IGF4esz0b8mIL9soHdQtQ=";
+  };
+
+  # TODO(nicoo): make compression optional?
+  nativeBuildInputs = [
+    gzip
+    (python3.withPackages (p: with p; [ pyyaml ]))
+  ];
+
+  # TODO(nicoo): generate LMF and WNDB versions with separate outputs
+  buildPhase = ''
+    runHook preBuild
+
+    echo Generating wn.xml
+    python scripts/from-yaml.py
+    python scripts/merge.py
+
+    echo Compressing
+    gzip --best --no-name --stdout ./wn.xml > 'oewn:${self.version}.xml.gz'
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt $out/share/wordnet 'oewn:${self.version}.xml.gz'
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Lexical network of the English language";
+    longDescription = ''
+      Open English WordNet is a lexical network of the English language grouping
+      words into synsets and linking them according to relationships such as
+      hypernymy, antonymy and meronymy. It is intended to be used in natural
+      language processing applications and provides deep lexical information
+      about the English language as a graph.
+
+      Open English WordNet is a fork of the Princeton Wordnet developed under an
+      open source methodology.
+    '';
+    homepage = "https://en-word.net/";
+    license = licenses.cc-by-40;
+    maintainers = with maintainers; [ nicoo ];
+    platforms = platforms.all;
+  };
+})
diff --git a/pkgs/applications/misc/polybar/default.nix b/pkgs/by-name/po/polybar/package.nix
index 9ecced78440b2..67b05b8f4b674 100644
--- a/pkgs/applications/misc/polybar/default.nix
+++ b/pkgs/by-name/po/polybar/package.nix
@@ -40,15 +40,15 @@
 , i3Support ? false
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "polybar";
-  version = "3.6.3";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = version;
-    hash = "sha256-FKkPSAEMzptnjJq3xTk+fpD8XjASQ3smX5imstDyLNE=";
+    owner = "polybar";
+    repo = "polybar";
+    rev = finalAttrs.version;
+    hash = "sha256-Z1rL9WvEZHr5M03s9KCJ6O6rNuaK7PpwUDaatYuCocI=";
     fetchSubmodules = true;
   };
 
@@ -113,4 +113,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ afldcr Br1ght0ne fortuneteller2k ckie ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/applications/misc/polybar/remove-hardcoded-etc.diff b/pkgs/by-name/po/polybar/remove-hardcoded-etc.diff
index d0c6db8b6b0ac..d0c6db8b6b0ac 100644
--- a/pkgs/applications/misc/polybar/remove-hardcoded-etc.diff
+++ b/pkgs/by-name/po/polybar/remove-hardcoded-etc.diff
diff --git a/pkgs/by-name/si/simde/package.nix b/pkgs/by-name/si/simde/package.nix
new file mode 100644
index 0000000000000..c79cbf38f7cd1
--- /dev/null
+++ b/pkgs/by-name/si/simde/package.nix
@@ -0,0 +1,30 @@
+{ stdenv, lib, fetchFromGitHub, meson, ninja }:
+
+stdenv.mkDerivation rec {
+  pname = "simde";
+  version = "0.7.6";
+
+  src = fetchFromGitHub {
+    owner = "simd-everywhere";
+    repo = "simde";
+    rev = "v${version}";
+    hash = "sha256-pj+zaD5o9XYkTavezcQFzM6ao0IdQP1zjP9L4vcCyEY=";
+  };
+
+  nativeBuildInputs = [ meson ninja ];
+
+  meta = with lib; {
+    homepage = "https://simd-everywhere.github.io";
+    description = "Implementations of SIMD instruction sets for systems which don't natively support them";
+    license = with licenses; [mit];
+    maintainers = with maintainers; [ whiteley ];
+    platforms = flatten (with platforms; [
+      arm
+      armv7
+      aarch64
+      x86
+      power
+      mips
+    ]);
+  };
+}
diff --git a/pkgs/by-name/su/supersonic/package.nix b/pkgs/by-name/su/supersonic/package.nix
index db635f073a630..f329dcfa794c7 100644
--- a/pkgs/by-name/su/supersonic/package.nix
+++ b/pkgs/by-name/su/supersonic/package.nix
@@ -20,16 +20,16 @@ assert waylandSupport -> stdenv.isLinux;
 
 buildGoModule rec {
   pname = "supersonic" + lib.optionalString waylandSupport "-wayland";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "dweymouth";
     repo = "supersonic";
     rev = "v${version}";
-    hash = "sha256-elDVkhRW1mTez56OKQJJ0m0VxP8/Bq+HcXf5iokeY5I=";
+    hash = "sha256-DVduZ1qPbcDlH+B5hibC2HUjwEUV+CpDDpMI8GdPwro";
   };
 
-  vendorHash = "sha256-z1sDlyc7HW+tYfG0Z4EjUCEM3Su4JjmWIKxU2MV6GOA=";
+  vendorHash = "sha256-Dj6I+gt0gB5HWTWdFXCV5UpLuvg+HhuygRJAdvV/Yp8";
 
   nativeBuildInputs = [
     copyDesktopItems
diff --git a/pkgs/by-name/yg/yggdrasil/package.nix b/pkgs/by-name/yg/yggdrasil/package.nix
index 858e8400d0049..3845e65fecc5d 100644
--- a/pkgs/by-name/yg/yggdrasil/package.nix
+++ b/pkgs/by-name/yg/yggdrasil/package.nix
@@ -30,6 +30,6 @@ buildGoModule rec {
       "An experiment in scalable routing as an encrypted IPv6 overlay network";
     homepage = "https://yggdrasil-network.github.io/";
     license = licenses.lgpl3;
-    maintainers = with maintainers; [ bbigras ehmry gazally lassulus ];
+    maintainers = with maintainers; [ ehmry gazally lassulus ];
   };
 }
diff --git a/pkgs/data/fonts/sketchybar-app-font/default.nix b/pkgs/data/fonts/sketchybar-app-font/default.nix
index df68dbb844c5b..8364c84f1ffc8 100644
--- a/pkgs/data/fonts/sketchybar-app-font/default.nix
+++ b/pkgs/data/fonts/sketchybar-app-font/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sketchybar-app-font";
-  version = "1.0.17";
+  version = "1.0.20";
 
   src = fetchurl {
     url = "https://github.com/kvndrsslr/sketchybar-app-font/releases/download/v${finalAttrs.version}/sketchybar-app-font.ttf";
-    hash = "sha256-sDMasHVcITTSUP9B87w4I7IZ44tYmabNNWl+kE3dUoE=";
+    hash = "sha256-pf3SSxzlNIdbXXHfRauFCnrVUMOd5J9sSUE9MsfWrwo=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/data/themes/tokyo-night-gtk/default.nix b/pkgs/data/themes/tokyo-night-gtk/default.nix
index a117562174e5b..dc3273e695b1e 100644
--- a/pkgs/data/themes/tokyo-night-gtk/default.nix
+++ b/pkgs/data/themes/tokyo-night-gtk/default.nix
@@ -1,38 +1,38 @@
 { lib
-, stdenvNoCC
-, fetchFromGitHub
+, callPackage
+, runCommand
 , gtk-engine-murrine
+, gnome-themes-extra
 }:
 
-stdenvNoCC.mkDerivation {
-  pname = "tokyo-night-gtk";
-  version = "2023.01.17";
+let
+  prefix = "tokyo-night-gtk";
 
-  src = fetchFromGitHub {
-    owner = "Fausto-Korpsvart";
-    repo = "Tokyo-Night-GTK-Theme";
-    rev = "f7ae3421ac0d415ca57fb6224e093e12b8a980bb";
-    sha256 = "sha256-90V55pRfgiaP1huhD+3456ziJ2EU24iNQHt5Ro+g+M0=";
-  };
+  packages = lib.mapAttrs' (type: content: {
+    name = type;
 
-  propagatedUserEnvPkgs = [
-    gtk-engine-murrine
-  ];
+    value = lib.mapAttrs' (variantName: variant: {
+      name = variantName;
+      value = callPackage ./generic.nix { inherit prefix type variantName variant; };
+    }) content;
+  }) (lib.importJSON ./variants.json);
+in packages // {
+  # Not using `symlinkJoin` because it's massively inefficient in this case
+  full = runCommand "${prefix}_full" {
+    preferLocalBuild = true;
 
-  dontBuild = true;
+    propagatedUserEnvPkgs = [
+      gtk-engine-murrine
+      gnome-themes-extra
+    ];
+  } ''
+    mkdir -p $out/share/{icons,themes,${prefix}}
 
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/share/themes
-    cp -a themes/* $out/share/themes
-    runHook postInstall
+    ${lib.concatStrings (lib.forEach (lib.attrValues (lib.attrsets.mergeAttrsList (lib.attrValues packages))) (variant:
+      ''
+        ln -s ${variant}/share/${variant.ptype}/Tokyonight-${variant.pvariant} $out/share/${variant.ptype}/Tokyonight-${variant.pvariant}
+        ln -s ${variant}/share/${prefix}/LICENSE $out/share/${prefix}/LICENSE 2>/dev/null || true
+      ''
+    ))}
   '';
-
-  meta = with lib; {
-    description = "A GTK theme based on the Tokyo Night colour palette.";
-    homepage = "www.pling.com/p/1681315/";
-    license = licenses.gpl3Only;
-    platforms = platforms.unix;
-    maintainers = with lib.maintainers; [ garaiza-93 ];
-  };
 }
diff --git a/pkgs/data/themes/tokyo-night-gtk/generic.nix b/pkgs/data/themes/tokyo-night-gtk/generic.nix
new file mode 100644
index 0000000000000..35bf498666da9
--- /dev/null
+++ b/pkgs/data/themes/tokyo-night-gtk/generic.nix
@@ -0,0 +1,77 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, writeScript
+, gtk-engine-murrine
+, gnome-themes-extra
+, prefix ? ""
+, type ? ""
+, variantName ? ""
+, variant ? ""
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "${prefix}_${type}-${variantName}";
+  version = "unstable-2023-05-30";
+
+  src = fetchFromGitHub {
+    owner = "Fausto-Korpsvart";
+    repo = "Tokyo-Night-GTK-Theme";
+    rev = "e9790345a6231cd6001f1356d578883fac52233a";
+    hash = "sha256-Q9UnvmX+GpvqSmTwdjU4hsEsYhA887wPqs5pyqbIhmc=";
+  };
+
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+    gnome-themes-extra
+  ];
+
+  dontPatch = true;
+  dontConfigure = true;
+  dontBuild = true;
+  dontFixup = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/{${type},${prefix}}
+    cp -a ${type}/Tokyonight-${variant} $out/share/${type}
+    cp -a LICENSE $out/share/${prefix}
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = writeScript "update.sh" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl common-updater-scripts tree jq
+      res="$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
+        -sL "https://api.github.com/repos/${finalAttrs.src.owner}/${finalAttrs.src.repo}/commits/HEAD")"
+
+      rev="$(echo $res | jq '.sha' --raw-output)"
+      version="unstable-$(echo $res | jq '.commit | .author | .date' --raw-output | sed 's/T.*$//')"
+      update-source-version ${prefix}-variants.${type}.${variantName} "$version" "$rev" --ignore-same-hash
+
+      commonjq1='.[] .contents .[] | {(.name): .name} | walk(if type=="object" then with_entries(.key|=ascii_downcase) else . end)'
+      commonjq2='reduce inputs as $in (.; . + $in)'
+      commontree="-dJ -L 1 --noreport ${finalAttrs.src}"
+
+      echo $(tree $commontree/icons | jq "$commonjq1" | jq "$commonjq2" | jq '{icons: .}') \
+        $(tree $commontree/themes | jq "$commonjq1" | jq "$commonjq2" | jq '{themes: .}') | \
+        jq 'reduce inputs as $in (.; . + $in)' | sed "s/[tT]okyonight-//g" > \
+        "$(git rev-parse --show-toplevel)/pkgs/data/themes/${prefix}/variants.json"
+    '';
+
+    # For "full" in default.nix
+    ptype = type;
+    pvariant = variant;
+  };
+
+  meta = with lib; {
+    description = "A GTK theme based on the Tokyo Night colour palette";
+    homepage = "https://www.pling.com/p/1681315";
+    license = licenses.gpl3Only;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ garaiza-93 Madouura ];
+  };
+})
diff --git a/pkgs/data/themes/tokyo-night-gtk/variants.json b/pkgs/data/themes/tokyo-night-gtk/variants.json
new file mode 100644
index 0000000000000..6489d9c649dee
--- /dev/null
+++ b/pkgs/data/themes/tokyo-night-gtk/variants.json
@@ -0,0 +1,18 @@
+{
+  "icons": {
+    "dark": "Dark",
+    "dark-cyan": "Dark-Cyan",
+    "light": "Light",
+    "moon": "Moon"
+  },
+  "themes": {
+    "dark-b": "Dark-B",
+    "dark-bl": "Dark-BL",
+    "dark-b-lb": "Dark-B-LB",
+    "dark-bl-lb": "Dark-BL-LB",
+    "storm-b": "Storm-B",
+    "storm-bl": "Storm-BL",
+    "storm-b-lb": "Storm-B-LB",
+    "storm-bl-lb": "Storm-BL-LB"
+  }
+}
diff --git a/pkgs/development/compilers/cudatoolkit/common.nix b/pkgs/development/compilers/cudatoolkit/common.nix
index 1f934ef5d4607..681549fa62dbe 100644
--- a/pkgs/development/compilers/cudatoolkit/common.nix
+++ b/pkgs/development/compilers/cudatoolkit/common.nix
@@ -361,7 +361,7 @@ backendStdenv.mkDerivation rec {
     description = "A compiler for NVIDIA GPUs, math libraries, and tools";
     homepage = "https://developer.nvidia.com/cuda-toolkit";
     platforms = [ "x86_64-linux" ];
-    license = licenses.unfree;
+    license = licenses.nvidiaCuda;
     maintainers = teams.cuda.members;
   };
 }
diff --git a/pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix b/pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix
index 038841a7097d0..1e4a3ab178559 100644
--- a/pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix
+++ b/pkgs/development/compilers/cudatoolkit/redist/build-cuda-redist-package.nix
@@ -39,7 +39,7 @@ let
   inherit (lib.meta) getExe;
   inherit (lib.strings) optionalString;
 in
-backendStdenv.mkDerivation {
+backendStdenv.mkDerivation (finalAttrs: {
   # NOTE: Even though there's no actual buildPhase going on here, the derivations of the
   # redistributables are sensitive to the compiler flags provided to stdenv. The patchelf package
   # is sensitive to the compiler flags provided to stdenv, and we depend on it. As such, we are
@@ -164,11 +164,15 @@ backendStdenv.mkDerivation {
   outputSpecified = true;
 
   meta = {
-    inherit description platforms;
-    license = lib.licenses.unfree;
+    inherit platforms;
+    description = "${description}. By downloading and using the packages you accept the terms and conditions of the ${finalAttrs.meta.license.shortName}";
+    license = lib.licenses.nvidiaCudaRedist // {
+      url = "https://developer.download.nvidia.com/compute/cuda/redist/${releaseAttrs.license_path or "${pname}/LICENSE.txt"}";
+    };
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
     maintainers = lib.teams.cuda.members;
     # Force the use of the default, fat output by default (even though `dev` exists, which
     # causes Nix to prefer that output over the others if outputSpecified isn't set).
     outputsToInstall = [ "out" ];
   };
-}
+})
diff --git a/pkgs/development/compilers/gcc/all.nix b/pkgs/development/compilers/gcc/all.nix
index 82a64f48c37e3..70b4b75369a7d 100644
--- a/pkgs/development/compilers/gcc/all.nix
+++ b/pkgs/development/compilers/gcc/all.nix
@@ -34,9 +34,6 @@ let
               else            /* "4.8" */   isl_0_14;
       } // lib.optionalAttrs (majorMinorVersion == "4.8") {
         texinfo = texinfo5; # doesn't validate since 6.1 -> 6.3 bump
-      } // lib.optionalAttrs (majorMinorVersion == "4.9") {
-        # Build fails on Darwin with clang
-        stdenv = if stdenv.isDarwin then gccStdenv else stdenv;
       } // lib.optionalAttrs (!(atLeast "6")) {
         cloog = if stdenv.isDarwin
                 then null
diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix
index 0980944dfc294..0fe23000cc900 100644
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@@ -33,6 +33,7 @@
 , nukeReferences
 , callPackage
 , majorMinorVersion
+, darwin
 
 # only for gcc<=6.x
 , langJava ? false
@@ -408,10 +409,15 @@ lib.pipe ((callFile ./common/builder.nix {}) ({
       maintainers
     ;
   } // lib.optionalAttrs (!atLeast11) {
-    badPlatforms = if !is49 then [ "aarch64-darwin" ] else lib.platforms.darwin;
+    badPlatforms = if !(is48 || is49) then [ "aarch64-darwin" ] else lib.platforms.darwin;
   };
 } // optionalAttrs is7 {
   env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
+} // lib.optionalAttrs (!atLeast10 && stdenv.hostPlatform.isDarwin) {
+  # GCC <10 requires default cctools `strip` instead of `llvm-strip` used by Darwin bintools.
+  preBuild = ''
+    makeFlagsArray+=('STRIP=${lib.getBin darwin.cctools-port}/bin/${stdenv.cc.targetPrefix}strip')
+  '';
 } // optionalAttrs (!atLeast7) {
   env.langJava = langJava;
 } // optionalAttrs atLeast6 {
diff --git a/pkgs/development/compilers/gcc/patches/11/libgcc-aarch64-darwin-detection.patch b/pkgs/development/compilers/gcc/patches/11/libgcc-aarch64-darwin-detection.patch
new file mode 100644
index 0000000000000..08dbfec6b249e
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/11/libgcc-aarch64-darwin-detection.patch
@@ -0,0 +1,21 @@
+diff -u a/libgcc/config.host b/libgcc/config.host
+--- a/libgcc/config.host	2023-11-05 11:01:55.778638446 -0500
++++ b/libgcc/config.host	2023-11-05 11:07:29.405103979 -0500
+@@ -227,7 +227,7 @@
+   tmake_file="$tmake_file t-slibgcc-darwin"
+   # newer toolsets produce warnings when building for unsupported versions.
+   case ${host} in
+-    *-*-darwin1[89]* | *-*-darwin2* )
++    *-*-darwin1[89]* | *-*-darwin2* | aarch64*-*-darwin*)
+       tmake_file="t-darwin-min-8 $tmake_file"
+       ;;
+     *-*-darwin9* | *-*-darwin1[0-7]*)
+diff -ur a/libgcc/config/t-darwin-rpath b/libgcc/config/t-darwin-rpath
+--- a/libgcc/config/t-darwin-rpath	2023-11-05 11:34:18.691150009 -0500
++++ b/libgcc/config/t-darwin-rpath	2023-11-05 11:50:36.968920904 -0500
+@@ -2,4 +2,4 @@
+ SHLIB_RPATH = @rpath
+
+ # Which does not work for Darwin < 9
+-HOST_LIBGCC2_CFLAGS += -mmacosx-version-min=10.5
++SHLIB_LOADER_PATH = -Wl,-rpath,@loader_path
diff --git a/pkgs/development/compilers/gcc/patches/4.9/darwin-clang-as.patch b/pkgs/development/compilers/gcc/patches/4.9/darwin-clang-as.patch
new file mode 100644
index 0000000000000..095713eb6c8c7
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/4.9/darwin-clang-as.patch
@@ -0,0 +1,16 @@
+diff -ur a/libgcc/config/t-darwin b/libgcc/config/t-darwin
+--- a/libgcc/config/t-darwin	2012-07-14 09:50:59.000000000 -0400
++++ b/libgcc/config/t-darwin	2023-11-05 21:26:11.696825584 -0500
+@@ -7,12 +7,6 @@
+ crttme.o: $(srcdir)/config/darwin-crt-tm.c
+ 	$(crt_compile) $(DARWIN_EXTRA_CRT_BUILD_CFLAGS) -DEND -c $<
+ 
+-# -pipe because there's an assembler bug, 4077127, which causes
+-# it to not properly process the first # directive, causing temporary
+-# file names to appear in stabs, causing the bootstrap to fail.  Using -pipe
+-# works around this by not having any temporary file names.
+-HOST_LIBGCC2_CFLAGS += -pipe
+-
+ # Use unwind-dw2-fde-darwin
+ LIB2ADDEH = $(srcdir)/unwind-dw2.c $(srcdir)/config/unwind-dw2-fde-darwin.c \
+   $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
diff --git a/pkgs/development/compilers/gcc/patches/8/gcc8-darwin-as-gstabs.patch b/pkgs/development/compilers/gcc/patches/8/gcc8-darwin-as-gstabs.patch
new file mode 100644
index 0000000000000..1ac870e572982
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/8/gcc8-darwin-as-gstabs.patch
@@ -0,0 +1,96 @@
+Backported from https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=b2cee5e1e89c8f939bc36fe9756befcb93d96982
+
+diff -ur a/gcc/config/darwin.h b/gcc/config/darwin.h
+--- a/gcc/config/darwin.h	2021-05-14 04:42:08.000000000 -0400
++++ b/gcc/config/darwin.h	2023-11-06 08:53:27.629155053 -0500
+@@ -233,12 +233,18 @@
+ 
+ #define DSYMUTIL "\ndsymutil"
+ 
++/* Spec that controls whether the debug linker is run automatically for
++   a link step.  This needs to be done if there is a source file on the
++   command line which will result in a temporary object (and debug is
++   enabled).  */
++
+ #define DSYMUTIL_SPEC \
+    "%{!fdump=*:%{!fsyntax-only:%{!c:%{!M:%{!MM:%{!E:%{!S:\
+     %{v} \
+-    %{gdwarf-2:%{!gstabs*:%{%:debug-level-gt(0): -idsym}}}\
+-    %{.c|.cc|.C|.cpp|.cp|.c++|.cxx|.CPP|.m|.mm: \
+-    %{gdwarf-2:%{!gstabs*:%{%:debug-level-gt(0): -dsym}}}}}}}}}}}"
++    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -idsym}}}\
++    %{.c|.cc|.C|.cpp|.cp|.c++|.cxx|.CPP|.m|.mm|.s|.f|.f90|\
++      .f95|.f03|.f77|.for|.F|.F90|.F95|.F03: \
++    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -dsym}}}}}}}}}}}"
+ 
+ #define LINK_COMMAND_SPEC LINK_COMMAND_SPEC_A DSYMUTIL_SPEC
+ 
+@@ -469,18 +475,31 @@
+ /* Default ASM_DEBUG_SPEC.  Darwin's as cannot currently produce dwarf
+    debugging data.  */
+ 
++#ifdef HAS_AS_STABS_DIRECTIVE
++/* We only pass a debug option to the assembler if that supports stabs, since
++   dwarf is not uniformly supported in the assemblers.  */
+ #define ASM_DEBUG_SPEC  "%{g*:%{%:debug-level-gt(0):%{!gdwarf*:--gstabs}}}"
++#else
++#define ASM_DEBUG_SPEC ""
++#endif
++
++#undef  ASM_DEBUG_OPTION_SPEC
++#define ASM_DEBUG_OPTION_SPEC  ""
++
+ #define ASM_FINAL_SPEC \
+   "%{gsplit-dwarf:%ngsplit-dwarf is not supported on this platform } %<gsplit-dwarf"
+ 
+-/* We still allow output of STABS if the assembler supports it.  */
++/* We now require C++11 to bootstrap and newer tools than those based on
++   stabs, so require DWARF-2, even if stabs is supported by the assembler.  */
++
++#define PREFERRED_DEBUGGING_TYPE DWARF2_DEBUG
++#define DARWIN_PREFER_DWARF
++#define DWARF2_DEBUGGING_INFO 1
++
+ #ifdef HAVE_AS_STABS_DIRECTIVE
+ #define DBX_DEBUGGING_INFO 1
+-#define PREFERRED_DEBUGGING_TYPE DBX_DEBUG
+ #endif
+ 
+-#define DWARF2_DEBUGGING_INFO 1
+-
+ #define DEBUG_FRAME_SECTION	  "__DWARF,__debug_frame,regular,debug"
+ #define DEBUG_INFO_SECTION	  "__DWARF,__debug_info,regular,debug"
+ #define DEBUG_ABBREV_SECTION	  "__DWARF,__debug_abbrev,regular,debug"
+diff -ur a/gcc/config/darwin9.h b/gcc/config/darwin9.h
+--- a/gcc/config/darwin9.h	2021-05-14 04:42:08.000000000 -0400
++++ b/gcc/config/darwin9.h	2023-11-06 08:54:02.663945206 -0500
+@@ -18,29 +18,6 @@
+ along with GCC; see the file COPYING3.  If not see
+ <http://www.gnu.org/licenses/>.  */
+ 
+-/* Prefer DWARF2.  */
+-#undef PREFERRED_DEBUGGING_TYPE
+-#define PREFERRED_DEBUGGING_TYPE DWARF2_DEBUG
+-#define DARWIN_PREFER_DWARF
+-
+-/* Since DWARF2 is default, conditions for running dsymutil are different.  */
+-#undef DSYMUTIL_SPEC
+-#define DSYMUTIL_SPEC \
+-   "%{!fdump=*:%{!fsyntax-only:%{!c:%{!M:%{!MM:%{!E:%{!S:\
+-    %{v} \
+-    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -idsym}}}\
+-    %{.c|.cc|.C|.cpp|.cp|.c++|.cxx|.CPP|.m|.mm|.s|.f|.f90|.f95|.f03|.f77|.for|.F|.F90|.F95|.F03: \
+-    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -dsym}}}}}}}}}}}"
+-
+-/* Tell collect2 to run dsymutil for us as necessary.  */
+-#define COLLECT_RUN_DSYMUTIL 1
+-
+-/* Only ask as for debug data if the debug style is stabs (since as doesn't
+-   yet generate dwarf.)  */
+-
+-#undef  ASM_DEBUG_SPEC
+-#define ASM_DEBUG_SPEC  "%{g*:%{%:debug-level-gt(0):%{gstabs:--gstabs}}}"
+-
+ #undef  ASM_OUTPUT_ALIGNED_COMMON
+ #define ASM_OUTPUT_ALIGNED_COMMON(FILE, NAME, SIZE, ALIGN)		\
+   do {									\
diff --git a/pkgs/development/compilers/gcc/patches/9/gcc9-darwin-as-gstabs.patch b/pkgs/development/compilers/gcc/patches/9/gcc9-darwin-as-gstabs.patch
new file mode 100644
index 0000000000000..454139c5396c5
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/9/gcc9-darwin-as-gstabs.patch
@@ -0,0 +1,99 @@
+Backported from https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=b2cee5e1e89c8f939bc36fe9756befcb93d96982
+
+diff -ur a/gcc/config/darwin.h b/gcc/config/darwin.h
+--- a/gcc/config/darwin.h	2022-05-27 03:21:10.947379000 -0400
++++ b/gcc/config/darwin.h	2023-11-06 12:18:27.209236423 -0500
+@@ -230,12 +230,18 @@
+ 
+ #define DSYMUTIL "\ndsymutil"
+ 
++/* Spec that controls whether the debug linker is run automatically for
++   a link step.  This needs to be done if there is a source file on the
++   command line which will result in a temporary object (and debug is
++   enabled).  */
++
+ #define DSYMUTIL_SPEC \
+    "%{!fdump=*:%{!fsyntax-only:%{!c:%{!M:%{!MM:%{!E:%{!S:\
+     %{v} \
+-    %{gdwarf-2:%{!gstabs*:%{%:debug-level-gt(0): -idsym}}}\
+-    %{.c|.cc|.C|.cpp|.cp|.c++|.cxx|.CPP|.m|.mm: \
+-    %{gdwarf-2:%{!gstabs*:%{%:debug-level-gt(0): -dsym}}}}}}}}}}}"
++    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -idsym}}}\
++    %{.c|.cc|.C|.cpp|.cp|.c++|.cxx|.CPP|.m|.mm|.s|.f|.f90|\
++      .f95|.f03|.f77|.for|.F|.F90|.F95|.F03: \
++    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -dsym}}}}}}}}}}}"
+ 
+ #define LINK_COMMAND_SPEC LINK_COMMAND_SPEC_A DSYMUTIL_SPEC
+ 
+@@ -463,21 +469,31 @@
+   %{Zforce_cpusubtype_ALL:-force_cpusubtype_ALL} \
+   %{static}" ASM_MMACOSX_VERSION_MIN_SPEC
+ 
+-/* Default ASM_DEBUG_SPEC.  Darwin's as cannot currently produce dwarf
+-   debugging data.  */
+-
++#ifdef HAS_AS_STABS_DIRECTIVE
++/* We only pass a debug option to the assembler if that supports stabs, since
++   dwarf is not uniformly supported in the assemblers.  */
+ #define ASM_DEBUG_SPEC  "%{g*:%{%:debug-level-gt(0):%{!gdwarf*:--gstabs}}}"
++#else
++#define ASM_DEBUG_SPEC ""
++#endif
++
++#undef  ASM_DEBUG_OPTION_SPEC
++#define ASM_DEBUG_OPTION_SPEC  ""
++
+ #define ASM_FINAL_SPEC \
+   "%{gsplit-dwarf:%ngsplit-dwarf is not supported on this platform} %<gsplit-dwarf"
+ 
+-/* We still allow output of STABS if the assembler supports it.  */
++/* We now require C++11 to bootstrap and newer tools than those based on
++   stabs, so require DWARF-2, even if stabs is supported by the assembler.  */
++
++#define PREFERRED_DEBUGGING_TYPE DWARF2_DEBUG
++#define DARWIN_PREFER_DWARF
++#define DWARF2_DEBUGGING_INFO 1
++
+ #ifdef HAVE_AS_STABS_DIRECTIVE
+ #define DBX_DEBUGGING_INFO 1
+-#define PREFERRED_DEBUGGING_TYPE DBX_DEBUG
+ #endif
+ 
+-#define DWARF2_DEBUGGING_INFO 1
+-
+ #define DEBUG_FRAME_SECTION	  "__DWARF,__debug_frame,regular,debug"
+ #define DEBUG_INFO_SECTION	  "__DWARF,__debug_info,regular,debug"
+ #define DEBUG_ABBREV_SECTION	  "__DWARF,__debug_abbrev,regular,debug"
+diff -ur a/gcc/config/darwin9.h b/gcc/config/darwin9.h
+--- a/gcc/config/darwin9.h	2022-05-27 03:21:10.947379000 -0400
++++ b/gcc/config/darwin9.h	2023-11-06 12:18:48.325260590 -0500
+@@ -18,29 +18,6 @@
+ along with GCC; see the file COPYING3.  If not see
+ <http://www.gnu.org/licenses/>.  */
+ 
+-/* Prefer DWARF2.  */
+-#undef PREFERRED_DEBUGGING_TYPE
+-#define PREFERRED_DEBUGGING_TYPE DWARF2_DEBUG
+-#define DARWIN_PREFER_DWARF
+-
+-/* Since DWARF2 is default, conditions for running dsymutil are different.  */
+-#undef DSYMUTIL_SPEC
+-#define DSYMUTIL_SPEC \
+-   "%{!fdump=*:%{!fsyntax-only:%{!c:%{!M:%{!MM:%{!E:%{!S:\
+-    %{v} \
+-    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -idsym}}}\
+-    %{.c|.cc|.C|.cpp|.cp|.c++|.cxx|.CPP|.m|.mm|.s|.f|.f90|.f95|.f03|.f77|.for|.F|.F90|.F95|.F03: \
+-    %{g*:%{!gstabs*:%{%:debug-level-gt(0): -dsym}}}}}}}}}}}"
+-
+-/* Tell collect2 to run dsymutil for us as necessary.  */
+-#define COLLECT_RUN_DSYMUTIL 1
+-
+-/* Only ask as for debug data if the debug style is stabs (since as doesn't
+-   yet generate dwarf.)  */
+-
+-#undef  ASM_DEBUG_SPEC
+-#define ASM_DEBUG_SPEC  "%{g*:%{%:debug-level-gt(0):%{gstabs:--gstabs}}}"
+-
+ #undef  ASM_OUTPUT_ALIGNED_COMMON
+ #define ASM_OUTPUT_ALIGNED_COMMON(FILE, NAME, SIZE, ALIGN)		\
+   do {									\
diff --git a/pkgs/development/compilers/gcc/patches/clang-genconditions.patch b/pkgs/development/compilers/gcc/patches/clang-genconditions.patch
new file mode 100644
index 0000000000000..655afd2abbc2c
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/clang-genconditions.patch
@@ -0,0 +1,34 @@
+From https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92061#c5
+
+--- a/gcc/genconditions.c	2019-01-01 12:37:19.064943662 +0100
++++ b/gcc/genconditions.c	2019-10-11 10:57:11.464595789 +0200
+@@ -57,8 +57,9 @@ write_header (void)
+ \n\
+ /* It is necessary, but not entirely safe, to include the headers below\n\
+    in a generator program.  As a defensive measure, don't do so when the\n\
+-   table isn't going to have anything in it.  */\n\
+-#if GCC_VERSION >= 3001\n\
++   table isn't going to have anything in it.\n\
++   Clang 9 is buggy and doesn't handle __builtin_constant_p correctly.  */\n\
++#if GCC_VERSION >= 3001 && __clang_major__ < 9\n\
+ \n\
+ /* Do not allow checking to confuse the issue.  */\n\
+ #undef CHECKING_P\n\
+@@ -170,7 +171,7 @@ struct c_test\n\
+    vary at run time.  It works in 3.0.1 and later; 3.0 only when not\n\
+    optimizing.  */\n\
+ \n\
+-#if GCC_VERSION >= 3001\n\
++#if GCC_VERSION >= 3001 && __clang_major__ < 9\n\
+ static const struct c_test insn_conditions[] = {\n");
+ 
+   traverse_c_tests (write_one_condition, 0);
+@@ -191,7 +192,7 @@ write_writer (void)
+ 	"  unsigned int i;\n"
+         "  const char *p;\n"
+         "  puts (\"(define_conditions [\");\n"
+-	"#if GCC_VERSION >= 3001\n"
++	"#if GCC_VERSION >= 3001 && __clang_major__ < 9\n"
+ 	"  for (i = 0; i < ARRAY_SIZE (insn_conditions); i++)\n"
+ 	"    {\n"
+ 	"      printf (\"  (%d \\\"\", insn_conditions[i].value);\n"
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 0afc6586511a6..15880913bde1a 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -178,6 +178,9 @@ in
 # https://github.com/osx-cross/homebrew-avr/issues/280#issuecomment-1272381808
 ++ optional (is11 && stdenv.isDarwin && targetPlatform.isAvr) ./avr-gcc-11.3-darwin.patch
 
+# libgcc’s `configure` script misdetects aarch64-darwin, resulting in an invalid deployment target.
+++ optional (is11 && stdenv.isDarwin && stdenv.isAarch64) ./11/libgcc-aarch64-darwin-detection.patch
+
 # openjdk build fails without this on -march=opteron; is upstream in gcc12
 ++ optionals (is11) [ ./11/gcc-issue-103910.patch ]
 
@@ -191,12 +194,19 @@ in
   sha256 = "sha256-XtykrPd5h/tsnjY1wGjzSOJ+AyyNLsfnjuOZ5Ryq9vA=";
 })
 
+# Fix undefined symbol errors when building older versions with clang
+++ optional (!atLeast11 && stdenv.cc.isClang && stdenv.hostPlatform.isDarwin) ./clang-genconditions.patch
+
 
 ## gcc 9.0 and older ##############################################################################
 
 ++ optional (majorVersion == "9") ./9/fix-struct-redefinition-on-glibc-2.36.patch
 ++ optional (atLeast7 && !atLeast10 && targetPlatform.isNetBSD) ./libstdc++-netbsd-ctypes.patch
 
+# Make Darwin bootstrap respect whether the assembler supports `--gstabs`,
+# which is not supported by the clang integrated assembler used by default on Darwin.
+++ optional (is9 && hostPlatform.isDarwin) ./9/gcc9-darwin-as-gstabs.patch
+
 
 ## gcc 8.0 and older ##############################################################################
 
@@ -204,6 +214,10 @@ in
 ++ optional (atLeast49 && !is49 && !atLeast9) ./libsanitizer-no-cyclades-9.patch
 ++ optional (is7 || is8) ./9/fix-struct-redefinition-on-glibc-2.36.patch
 
+# Make Darwin bootstrap respect whether the assembler supports `--gstabs`,
+# which is not supported by the clang integrated assembler used by default on Darwin.
+++ optional (is8 && hostPlatform.isDarwin) ./8/gcc8-darwin-as-gstabs.patch
+
 
 ## gcc 7.0 and older ##############################################################################
 
@@ -240,6 +254,12 @@ in
   ./6/gnat-glibc234.patch
 ]
 
+# The clang-based assembler used in darwin.cctools-llvm (LLVM >11) does not support piping input.
+# Fortunately, it does not exhibit the problem GCC has with the cctools assembler.
+# This patch can be dropped should darwin.cctools-llvm ever implement support.
+++ optional (!atLeast7 && hostPlatform.isDarwin && lib.versionAtLeast (lib.getVersion stdenv.cc) "12") ./4.9/darwin-clang-as.patch
+
+
 ## gcc 4.9 and older ##############################################################################
 
 ++ optional (!atLeast6) ./parallel-bconfig.patch
diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
index 1124c2ea98a4b..06002f4930ef0 100644
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.20.10";
+  version = "1.20.11";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-ctL1GAXEcVAGbBA3VMdf3bLBnUjJIZ+jPR5GaWyEHbs=";
+    hash = "sha256-01XFrjqPd2PJ7J3CUVOq43OVjLy2DdCekai1bHYhsvw=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/odin/default.nix b/pkgs/development/compilers/odin/default.nix
index 81a7faf739050..58f5fba4c81d8 100644
--- a/pkgs/development/compilers/odin/default.nix
+++ b/pkgs/development/compilers/odin/default.nix
@@ -12,13 +12,13 @@ let
   inherit (llvmPackages) stdenv;
 in stdenv.mkDerivation rec {
   pname = "odin";
-  version = "dev-2023-08";
+  version = "dev-2023-11";
 
   src = fetchFromGitHub {
     owner = "odin-lang";
     repo = "Odin";
     rev = version;
-    hash = "sha256-pmgrauhB5/JWBkwrAm7tCml9IYQhXyGXsNVDKTntA0M=";
+    hash = "sha256-5plcr+j9aFSaLfLQXbG4WD1GH6rE7D3uhlUbPaDEYf8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/interpreters/php/generic.nix b/pkgs/development/interpreters/php/generic.nix
index 38ac50081423a..ba5ce5537bbbc 100644
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -33,10 +33,12 @@ let
     , jq
 
     , version
-    , hash
+    , phpSrc ? null
+    , hash ? null
     , extraPatches ? [ ]
     , packageOverrides ? (final: prev: { })
     , phpAttrsOverrides ? (attrs: { })
+    , pearInstallPhar ? (callPackage ./install-pear-nozlib-phar.nix { })
 
       # Sapi flags
     , cgiSupport ? true
@@ -192,6 +194,11 @@ let
 
       mkWithExtensions = prevArgs: prevExtensionFunctions: extensions:
         mkBuildEnv prevArgs prevExtensionFunctions { inherit extensions; };
+
+      defaultPhpSrc = fetchurl {
+        url = "https://www.php.net/distributions/php-${version}.tar.bz2";
+        inherit hash;
+      };
     in
     stdenv.mkDerivation (
       let
@@ -278,6 +285,15 @@ let
               substituteInPlace configure --replace "-lstdc++" "-lc++"
             '';
 
+          # When compiling PHP sources from Github, this file is missing and we
+          # need to install it ourselves.
+          # On the other hand, a distribution includes this file by default.
+          preInstall = ''
+            if [[ ! -f ./pear/install-pear-nozlib.phar ]]; then
+              cp ${pearInstallPhar} ./pear/install-pear-nozlib.phar
+            fi
+          '';
+
           postInstall = ''
             test -d $out/etc || mkdir $out/etc
             cp php.ini-production $out/etc/php.ini
@@ -291,10 +307,7 @@ let
                $dev/share/man/man1/
           '';
 
-          src = fetchurl {
-            url = "https://www.php.net/distributions/php-${version}.tar.bz2";
-            inherit hash;
-          };
+          src = if phpSrc == null then defaultPhpSrc else phpSrc;
 
           patches = [ ./fix-paths-php7.patch ] ++ extraPatches;
 
diff --git a/pkgs/development/interpreters/php/install-pear-nozlib-phar.nix b/pkgs/development/interpreters/php/install-pear-nozlib-phar.nix
new file mode 100644
index 0000000000000..d359a7ed82aeb
--- /dev/null
+++ b/pkgs/development/interpreters/php/install-pear-nozlib-phar.nix
@@ -0,0 +1,8 @@
+{
+  fetchurl
+}:
+
+fetchurl {
+  url = "https://pear.php.net/install-pear-nozlib.phar";
+  hash = "sha256-UblKVcsm030tNSA6mdeab+h7ZhANNz7MkFf4Z1iigjs=";
+}
diff --git a/pkgs/development/libraries/gtk4-layer-shell/default.nix b/pkgs/development/libraries/gtk4-layer-shell/default.nix
index ec1f00cdc3683..d699701930809 100644
--- a/pkgs/development/libraries/gtk4-layer-shell/default.nix
+++ b/pkgs/development/libraries/gtk4-layer-shell/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtk4-layer-shell";
-  version = "1.0.1";
+  version = "1.0.2";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "devdoc";
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "wmww";
     repo = "gtk4-layer-shell";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-MG/YW4AhC2joUX93Y/pzV4s8TrCo5Z/I3hAT70jW8dw=";
+    hash = "sha256-decjPkFkYy7kIjyozsB7BEmw33wzq1EQyIBrxO36984=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/libsolv/default.nix b/pkgs/development/libraries/libsolv/default.nix
index 76931b12fc005..4b40eacaa0312 100644
--- a/pkgs/development/libraries/libsolv/default.nix
+++ b/pkgs/development/libraries/libsolv/default.nix
@@ -16,14 +16,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.25";
+  version = "0.7.26";
   pname = "libsolv";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "libsolv";
     rev = version;
-    sha256 = "sha256-OSYfv8dTyoa2f1T/zCEruKczickP5jS05xjYLQQiFaY=";
+    sha256 = "sha256-NGybpl/Fd46pmSYMNGocStQQCXr5pX34PCmN/hFKeyk=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/neatvnc/default.nix b/pkgs/development/libraries/neatvnc/default.nix
index 4eba7cbbd8e28..f5efbdcc082ef 100644
--- a/pkgs/development/libraries/neatvnc/default.nix
+++ b/pkgs/development/libraries/neatvnc/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "neatvnc";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "any1";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-R+PvD7E/z+Gc7h2y0pUYaCkzfgpxzwToOr4pKSrOnxU=";
+    sha256 = "sha256-bRlz5RW+NUSTgzjRM9alZjSrzmF8/7p4IIXqK/HEcJo=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/science/math/cudnn/generic.nix b/pkgs/development/libraries/science/math/cudnn/generic.nix
index b1e03e35df12c..b9f101d80fa30 100644
--- a/pkgs/development/libraries/science/math/cudnn/generic.nix
+++ b/pkgs/development/libraries/science/math/cudnn/generic.nix
@@ -153,8 +153,14 @@ in
       description = "NVIDIA CUDA Deep Neural Network library (cuDNN)";
       homepage = "https://developer.nvidia.com/cudnn";
       sourceProvenance = with sourceTypes; [binaryNativeCode];
-      # TODO: consider marking unfreRedistributable when not using runfile
-      license = licenses.unfree;
+      license = {
+        shortName = "cuDNN EULA";
+        fullName = "NVIDIA cuDNN Software License Agreement (EULA)";
+        url = "https://docs.nvidia.com/deeplearning/sdk/cudnn-sla/index.html#supplement";
+        free = false;
+      } // lib.optionalAttrs (!useCudatoolkitRunfile) {
+        redistributable = true;
+      };
       platforms = ["x86_64-linux"];
       maintainers = with maintainers; [mdaiter samuela];
       # Force the use of the default, fat output by default (even though `dev` exists, which
diff --git a/pkgs/development/php-packages/memprof/default.nix b/pkgs/development/php-packages/memprof/default.nix
new file mode 100644
index 0000000000000..04ef8e6be590b
--- /dev/null
+++ b/pkgs/development/php-packages/memprof/default.nix
@@ -0,0 +1,33 @@
+{ buildPecl
+, lib
+, fetchFromGitHub
+, judy
+}:
+
+let
+  version = "3.0.2";
+in buildPecl {
+  inherit version;
+  pname = "memprof";
+
+  src = fetchFromGitHub {
+    owner = "arnaud-lb";
+    repo = "php-memory-profiler";
+    rev = version;
+    hash = "sha256-K8YcvCobErBkaWFTkVGLXXguQPOLIgQuRGWJF+HAIRA=";
+  };
+
+  configureFlags = [
+    "--with-judy-dir=${judy}"
+  ];
+
+  doCheck = true;
+
+  meta = {
+    changelog = "https://github.com/arnaud-lb/php-memory-profiler/releases/tag/${version}";
+    description = "Memory profiler for PHP. Helps finding memory leaks in PHP scripts";
+    homepage = "https://github.com/arnaud-lb/php-memory-profiler";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ gaelreyrol ];
+  };
+}
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 4b301548b43c0..e433aa425994a 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.75";
+  version = "9.2.76";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-k3CX0ntqbKBL9xLTPifwjTqwYEDLlNdEHlIPiokkkPA=";
+    hash = "sha256-RIYGWPvQ2n+NgZHw2pGEvgWAtbpb/rdyb6/K4JClRxM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index 5b142f2be1eaa..e3d0f02711427 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.75";
+  version = "9.2.76";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "angr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-tDOO0wn5gYxK1CuMWhu/i4Xk3CfcuhPvxsG0LI7BlA4=";
+    hash = "sha256-B3oYh0okbIeEvBjBHvY29QTqPyR2TTzLmz6fMsIRcs0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 14fea5e4835a7..2e5ebe9e8e035 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.75";
+  version = "9.2.76";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-t8kxGwLEVVp1WMFA+yFLMAPJBT46m0ZFG2lhWMxoolw=";
+    hash = "sha256-g1qlcaSByXhF+6ffxwbV/0tXFdmLySH3TcDuok4y6xw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/awkward/default.nix b/pkgs/development/python-modules/awkward/default.nix
index 48218451a5ab1..b14730c05f5a6 100644
--- a/pkgs/development/python-modules/awkward/default.nix
+++ b/pkgs/development/python-modules/awkward/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , pythonOlder
-, fetchPypi
+, fetchFromGitHub
 , hatch-fancy-pypi-readme
 , hatchling
 , awkward-cpp
@@ -23,14 +23,16 @@
 
 buildPythonPackage rec {
   pname = "awkward";
-  version = "2.4.6";
+  version = "2.4.9";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-MRnrPChX3a26JELh4oH5nefwoQurpvpprZXeNnz1Cwo=";
+  src = fetchFromGitHub {
+    owner = "scikit-hep";
+    repo = "awkward";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-8MllMKf/xp5SdtF9P1Sa6Ytml4nQ5OX7vs7ITU8mCRU=";
   };
 
   nativeBuildInputs = [
@@ -69,7 +71,6 @@ buildPythonPackage rec {
   # The following tests have been disabled because they need to be run on a GPU platform.
   disabledTestPaths = [
     "tests-cuda"
-    "tests-cuda-kernels"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/bork/default.nix b/pkgs/development/python-modules/bork/default.nix
new file mode 100644
index 0000000000000..5cd247cf28724
--- /dev/null
+++ b/pkgs/development/python-modules/bork/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+
+, build
+, coloredlogs
+, packaging
+, toml
+, twine
+, wheel
+}:
+
+buildPythonPackage rec {
+  pname = "bork";
+  version = "7.0.0";
+  pyproject = true;
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "duckinator";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-frwkU2YesYK0RJNz9yqiXj1XeTZ8jg5oClri4hEYokg=";
+  };
+
+  propagatedBuildInputs = [
+    build
+    coloredlogs
+    packaging
+    toml
+    twine
+    wheel
+  ];
+
+  pythonImportsCheck = [
+    "bork"
+    "bork.api"
+    "bork.cli"
+  ];
+
+  meta = with lib; {
+    description = "Python build and release management tool";
+    homepage = "https://github.com/duckinator/bork";
+    maintainers = with maintainers; [ nicoo ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index 8907b8b8ac26f..c185d1148bdb3 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.75";
+  version = "9.2.76";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "claripy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ErPk93hDKV1QyGOjxYNaLzNuq6Od374G8qOxWiJwpuo=";
+    hash = "sha256-BwhM5J+20ZvP0d+9TAqy0AgRuPU6XoLKgM88WJdf3Qg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index 3f4e7addb7780..efc5c6168195d 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,14 +16,14 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.75";
+  version = "9.2.76";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
     owner = "angr";
     repo = "binaries";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xiYkXC3/JPgXJ23ISl0LVrdm368hDPCG5NqQM6lDXf4=";
+    hash = "sha256-01Y4UKTkaO6bYtVTvv4KFzkEdj4qKiWKaC80/iKa/Eg=";
   };
 
 in
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "cle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-F2kgEffFWK7i1BgU5ulsNJitGcGcEziYRU+y86wKgXU=";
+    hash = "sha256-uMT9LvDkXl3SueR80pgGJRkWbymDRmGEn8HV93K/VNc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/dalle-mini/default.nix b/pkgs/development/python-modules/dalle-mini/default.nix
index f20b693d38707..e50249dc7dd9a 100644
--- a/pkgs/development/python-modules/dalle-mini/default.nix
+++ b/pkgs/development/python-modules/dalle-mini/default.nix
@@ -49,5 +49,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/borisdayma/dalle-mini";
     license = licenses.asl20;
     maintainers = with maintainers; [ r-burns ];
+    # incompatible with recent versions of JAX
+    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/dash/default.nix b/pkgs/development/python-modules/dash/default.nix
index 5d99a40c004b6..59e28a31daf41 100644
--- a/pkgs/development/python-modules/dash/default.nix
+++ b/pkgs/development/python-modules/dash/default.nix
@@ -1,27 +1,43 @@
 { lib
 , buildPythonPackage
-, celery
-, dash-core-components
+, pythonOlder
+, fetchFromGitHub
+
+, nodejs
+, yarn
+, fixup_yarn_lock
+, fetchYarnDeps
+
+, setuptools
+, flask
+, werkzeug
+, plotly
 , dash-html-components
+, dash-core-components
 , dash-table
+, importlib-metadata
+, typing-extensions
+, requests
+, retrying
+, ansi2html
+, nest-asyncio
+
+, celery
+, redis
 , diskcache
-, fetchFromGitHub
-, flask
-, flask-compress
-, mock
 , multiprocess
-, plotly
 , psutil
-, pytest-mock
+, flask-compress
+
 , pytestCheckHook
-, pythonOlder
+, pytest-mock
+, mock
 , pyyaml
-, redis
 }:
 
 buildPythonPackage rec {
   pname = "dash";
-  version = "2.13.0";
+  version = "2.14.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -30,16 +46,52 @@ buildPythonPackage rec {
     owner = "plotly";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+pTxEPuXtcu+ZekphqXD/k2tQ5werH/1ueGJOxA8pZw=";
+    hash = "sha256-vQOfX9RCIbr5lfUyT2knwrO374/vm7jH+/1+BeqmRjI=";
   };
 
+  nativeBuildInputs = [
+    nodejs
+    yarn
+    fixup_yarn_lock
+  ];
+
+  yarnDeps = fetchYarnDeps {
+    yarnLock = src + "/@plotly/dash-jupyterlab/yarn.lock";
+    hash = "sha256-mkiyrA0jGiP0zbabSjgHFLEUX3f+LZdJ8eARI5QA8CU=";
+  };
+
+  preBuild = ''
+    pushd @plotly/dash-jupyterlab
+
+    export HOME=$(mktemp -d)
+
+    yarn config --offline set yarn-offline-mirror ${yarnDeps}
+    fixup_yarn_lock yarn.lock
+
+    substituteInPlace package.json --replace jlpm yarn
+    yarn install --offline --frozen-lockfile --ignore-engines --ignore-scripts
+    patchShebangs .
+
+    # Generates the jupyterlab extension files
+    yarn run build:pack
+
+    popd
+  '';
+
   propagatedBuildInputs = [
-    dash-core-components
-    dash-html-components
-    dash-table
+    setuptools # for importing pkg_resources
     flask
-    flask-compress
+    werkzeug
     plotly
+    dash-html-components
+    dash-core-components
+    dash-table
+    importlib-metadata
+    typing-extensions
+    requests
+    retrying
+    ansi2html
+    nest-asyncio
   ];
 
   passthru.optional-dependencies = {
@@ -52,35 +104,31 @@ buildPythonPackage rec {
       multiprocess
       psutil
     ];
+    compress = [
+      flask-compress
+    ];
   };
 
   nativeCheckInputs = [
-    mock
-    pytest-mock
     pytestCheckHook
+    pytest-mock
+    mock
     pyyaml
   ];
 
   disabledTestPaths = [
     "tests/unit/test_browser.py"
-    "tests/unit/test_app_runners.py" # Use selenium
+    "tests/unit/test_app_runners.py" # Uses selenium
     "tests/integration"
   ];
 
-  disabledTests = [
-    # Failed: DID NOT RAISE <class 'ImportError'>
-    "test_missing_flask_compress_raises"
-  ];
-
-  pythonImportsCheck = [
-    "dash"
-  ];
+  pythonImportsCheck = [ "dash" ];
 
-  meta = with lib; {
+  meta = {
     description = "Python framework for building analytical web applications";
     homepage = "https://dash.plot.ly/";
-    changelog = "https://github.com/plotly/dash/blob/v${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ antoinerg ];
+    changelog = "https://github.com/plotly/dash/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ antoinerg tomasajt ];
   };
 }
diff --git a/pkgs/development/python-modules/dask-awkward/default.nix b/pkgs/development/python-modules/dask-awkward/default.nix
index bcc274b7771c3..706bad8714692 100644
--- a/pkgs/development/python-modules/dask-awkward/default.nix
+++ b/pkgs/development/python-modules/dask-awkward/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dask-awkward";
-  version = "2023.10.1";
+  version = "2023.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "dask-contrib";
     repo = "dask-awkward";
     rev = "refs/tags/${version}";
-    hash = "sha256-ov5vE9O+dq0ByfSMluQl7NN0vZAcvvBX27iwoYSruSs=";
+    hash = "sha256-oOIXqKwKjF6wCgRNRJ2EZn4F7sMqUKDSNQuGUpvL7sA=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index 706dd76a1da33..fcf2e03ad5962 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -38,7 +38,7 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2023.10.0";
+  version = "2023.10.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -47,7 +47,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = "dask";
     rev = "refs/tags/${version}";
-    hash = "sha256-u7KuZT0uH833zqLNBfqRLU7EcMrUmXgszevYA3Z7G1Y=";
+    hash = "sha256-asD5oLd7XcZ8ZFSrsSCAKgZ3Gsqs6T77nb1qesamgUI=";
   };
 
   nativeBuildInputs = [
@@ -114,7 +114,7 @@ buildPythonPackage rec {
       --replace "cmdclass=versioneer.get_cmdclass()," ""
 
     substituteInPlace pyproject.toml \
-      --replace ', "versioneer[toml]==0.28"' "" \
+      --replace ', "versioneer[toml]==0.29"' "" \
       --replace " --durations=10" "" \
       --replace " --cov-config=pyproject.toml" "" \
       --replace "\"-v" "\" "
diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index 4394271f7ebd2..c6d705337d742 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "2.12.0";
+  version = "2.13.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZeDQn+/b6WBCodZ7Ow5IlC9XlWieAifCMJtM1yse5P8=";
+    hash = "sha256-ay/NaJ/u/XG9XQ7C2dzmJKs/j1s/vDHUnaE/qDhho9Q=";
   };
 
   # The project can build both an optimized cython version and an unoptimized
diff --git a/pkgs/development/python-modules/dinghy/default.nix b/pkgs/development/python-modules/dinghy/default.nix
index cae8c8abcc665..20d855bf0d262 100644
--- a/pkgs/development/python-modules/dinghy/default.nix
+++ b/pkgs/development/python-modules/dinghy/default.nix
@@ -5,17 +5,21 @@
 , pythonOlder
 , aiofiles
 , aiohttp
+, backports-datetime-fromisoformat
+, click
 , click-log
 , emoji
 , glom
 , jinja2
 , pyyaml
+, freezegun
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "dinghy";
-  version = "1.3.0";
-  format = "setuptools";
+  version = "1.3.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -23,12 +27,18 @@ buildPythonPackage rec {
     owner = "nedbat";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-a1CHbPSoiR3JbuAXYPJc1EsSq13DbrOttk9zLFF9+cM=";
+    hash = "sha256-0U08QHQuNm7qaxhU8sNxeN0fZ4S8N0RYRsWjFUqhZSU=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     aiofiles
     aiohttp
+    backports-datetime-fromisoformat
+    click
     click-log
     emoji
     glom
@@ -37,6 +47,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
+    freezegun
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/ducc0/default.nix b/pkgs/development/python-modules/ducc0/default.nix
index 14289caae4669..f75d326887389 100644
--- a/pkgs/development/python-modules/ducc0/default.nix
+++ b/pkgs/development/python-modules/ducc0/default.nix
@@ -2,16 +2,16 @@
 
 buildPythonPackage rec {
   pname = "ducc0";
-  version = "0.31.0";
+  version = "0.32.0";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitLab {
     domain = "gitlab.mpcdf.mpg.de";
     owner = "mtr";
     repo = "ducc";
     rev = "ducc0_${lib.replaceStrings ["."] ["_"] version}";
-    hash = "sha256-4aNIq5RNo1Qqiqr2wjYB/FXKyvbARsRF1yW1ZzZlAOo=";
+    hash = "sha256-D+Gt5RrzljZQHBijaPuCuNsK08VxxJoWhqxSDu4bjH0=";
   };
 
   buildInputs = [ pybind11 ];
diff --git a/pkgs/development/python-modules/farm-haystack/default.nix b/pkgs/development/python-modules/farm-haystack/default.nix
new file mode 100644
index 0000000000000..de87016f36fc5
--- /dev/null
+++ b/pkgs/development/python-modules/farm-haystack/default.nix
@@ -0,0 +1,290 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonRelaxDepsHook
+, hatchling
+, boilerpy3
+, events
+, httpx
+, jsonschema
+, lazy-imports
+, more-itertools
+, networkx
+, pandas
+, pillow
+, platformdirs
+, posthog
+, prompthub-py
+, pydantic
+, quantulum3
+, rank-bm25
+, requests
+, requests-cache
+, scikit-learn
+, sseclient-py
+, tenacity
+, tiktoken
+, tqdm
+, transformers
+, openai-whisper
+, boto3
+, botocore
+# , beir
+, selenium
+, coverage
+, dulwich
+# , jupytercontrib
+, mkdocs
+, mypy
+, pre-commit
+, psutil
+# , pydoc-markdown
+, pylint
+, pytest
+, pytest-asyncio
+, pytest-cov
+# , pytest-custom-exit-code
+, python-multipart
+, reno
+, responses
+, toml
+, tox
+, watchdog
+, elastic-transport
+, elasticsearch
+# , azure-ai-formrecognizer
+, beautifulsoup4
+, markdown
+, python-docx
+, python-frontmatter
+, python-magic
+, tika
+, black
+, huggingface-hub
+, sentence-transformers
+, mlflow
+, rapidfuzz
+, scipy
+, seqeval
+, pdf2image
+, pytesseract
+, faiss
+# , faiss-gpu
+, pinecone-client
+, onnxruntime
+, onnxruntime-tools
+# , onnxruntime-gpu
+, opensearch-py
+, pymupdf
+, langdetect
+, nltk
+, canals
+, jinja2
+, openai
+, aiorwlock
+, ray
+, psycopg2
+, sqlalchemy
+, sqlalchemy-utils
+, weaviate-client
+}:
+
+buildPythonPackage rec {
+  pname = "farm-haystack";
+  version = "1.21.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "deepset-ai";
+    repo = "haystack";
+    rev = "v${version}";
+    hash = "sha256-h+8F1e6fFoxT4Cu0DxtXTyDd+OFXpX1+uk21/k9qcxw=";
+  };
+
+  nativeBuildInputs = [
+    hatchling
+    pythonRelaxDepsHook
+  ];
+
+  pythonRemoveDeps = [
+    # We call it faiss, not faiss-cpu.
+    "faiss-cpu"
+  ];
+
+  propagatedBuildInputs = [
+    boilerpy3
+    events
+    httpx
+    jsonschema
+    lazy-imports
+    more-itertools
+    networkx
+    pandas
+    pillow
+    platformdirs
+    posthog
+    prompthub-py
+    pydantic
+    quantulum3
+    rank-bm25
+    requests
+    requests-cache
+    scikit-learn
+    sseclient-py
+    tenacity
+    tiktoken
+    tqdm
+    transformers
+  ];
+
+  env.HOME = "$(mktemp -d)";
+
+  passthru.optional-dependencies = {
+    # all = [
+    #   farm-haystack
+    # ];
+    # all-gpu = [
+    #   farm-haystack
+    # ];
+    audio = [
+      openai-whisper
+    ];
+    aws = [
+      boto3
+      botocore
+    ];
+    # beir = [
+    #   beir
+    # ];
+    colab = [
+      pillow
+    ];
+    crawler = [
+      selenium
+    ];
+    dev = [
+      coverage
+      dulwich
+      # jupytercontrib
+      mkdocs
+      mypy
+      pre-commit
+      psutil
+      # pydoc-markdown
+      pylint
+      pytest
+      pytest-asyncio
+      pytest-cov
+      # pytest-custom-exit-code
+      python-multipart
+      reno
+      responses
+      toml
+      tox
+      watchdog
+    ];
+    elasticsearch7 = [
+      elastic-transport
+      elasticsearch
+    ];
+    elasticsearch8 = [
+      elastic-transport
+      elasticsearch
+    ];
+    file-conversion = [
+      # azure-ai-formrecognizer
+      beautifulsoup4
+      markdown
+      python-docx
+      python-frontmatter
+      python-magic
+      # python-magic-bin
+      tika
+    ];
+    formatting = [
+      black
+    ];
+    inference = [
+      huggingface-hub
+      sentence-transformers
+      transformers
+    ];
+    metrics = [
+      mlflow
+      rapidfuzz
+      scipy
+      seqeval
+    ];
+    ocr = [
+      pdf2image
+      pytesseract
+    ];
+    only-faiss = [
+      faiss
+    ];
+    # only-faiss-gpu = [
+    #   faiss-gpu
+    # ];
+    only-pinecone = [
+      pinecone-client
+    ];
+    onnx = [
+      onnxruntime
+      onnxruntime-tools
+    ];
+    # onnx-gpu = [
+    #   onnxruntime-gpu
+    #   onnxruntime-tools
+    # ];
+    opensearch = [
+      opensearch-py
+    ];
+    pdf = [
+      pymupdf
+    ];
+    preprocessing = [
+      langdetect
+      nltk
+    ];
+    preview = [
+      canals
+      jinja2
+      lazy-imports
+      openai
+      pandas
+      rank-bm25
+      requests
+      tenacity
+      tqdm
+    ];
+    ray = [
+      aiorwlock
+      ray
+    ];
+    sql = [
+      psycopg2
+      sqlalchemy
+      sqlalchemy-utils
+    ];
+    weaviate = [
+      weaviate-client
+    ];
+  };
+
+  # the setup for test is intensive, hopefully can be done at some point
+  doCheck = false;
+
+
+  pythonImportsCheck = [ "haystack" ];
+
+  meta = with lib; {
+    description = "LLM orchestration framework to build customizable, production-ready LLM applications";
+    longDescription = ''
+    LLM orchestration framework to build customizable, production-ready LLM applications. Connect components (models, vector DBs, file converters) to pipelines or agents that can interact with your data. With advanced retrieval methods, it's best suited for building RAG, question answering, semantic search or conversational agent chatbots
+    '';
+    changelog = "https://github.com/deepset-ai/haystack/releases/tag/${src.rev}";
+    homepage = "https://github.com/deepset-ai/haystack";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ happysalada ];
+  };
+}
diff --git a/pkgs/development/python-modules/flax/default.nix b/pkgs/development/python-modules/flax/default.nix
index 0a6b086fe516e..fa0f053f86de1 100644
--- a/pkgs/development/python-modules/flax/default.nix
+++ b/pkgs/development/python-modules/flax/default.nix
@@ -1,53 +1,66 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
 , fetchFromGitHub
 , jaxlib
+, pythonRelaxDepsHook
+, setuptools-scm
 , jax
-, keras
-, lib
-, matplotlib
 , msgpack
 , numpy
 , optax
+, pyyaml
+, rich
+, tensorstore
+, typing-extensions
+, matplotlib
+, cloudpickle
+, einops
+, keras
 , pytest-xdist
 , pytestCheckHook
-, pythonRelaxDepsHook
 , tensorflow
-, tensorstore
-, fetchpatch
-, rich
 }:
 
 buildPythonPackage rec {
   pname = "flax";
-  version = "0.7.4";
+  version = "0.7.5";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
-    repo = pname;
+    repo = "flax";
     rev = "refs/tags/v${version}";
-    hash = "sha256-i48omag/1Si3mCCGfsUD9qeejyeCLWzvvwKJqH8vm8k=";
+    hash = "sha256-NDah0ayQbiO1/sTU1DDf/crPq5oLTnSuosV7cFHlTM8=";
   };
 
-  nativeBuildInputs = [ jaxlib pythonRelaxDepsHook ];
+  nativeBuildInputs = [
+    jaxlib
+    pythonRelaxDepsHook
+    setuptools-scm
+  ];
 
   propagatedBuildInputs = [
     jax
-    matplotlib
     msgpack
     numpy
     optax
+    pyyaml
     rich
     tensorstore
+    typing-extensions
   ];
 
-  # See https://github.com/google/flax/pull/2882.
-  pythonRemoveDeps = [ "orbax" ];
+  passthru.optional-dependencies = {
+    all = [ matplotlib ];
+  };
 
   pythonImportsCheck = [
     "flax"
   ];
 
   nativeCheckInputs = [
+    cloudpickle
+    einops
     keras
     pytest-xdist
     pytestCheckHook
@@ -78,22 +91,6 @@ buildPythonPackage rec {
     "tests/checkpoints_test.py"
   ];
 
-  disabledTests = [
-    # See https://github.com/google/flax/issues/2554.
-    "test_async_save_checkpoints"
-    "test_jax_array0"
-    "test_jax_array1"
-    "test_keep0"
-    "test_keep1"
-    "test_optimized_lstm_cell_matches_regular"
-    "test_overwrite_checkpoints"
-    "test_save_restore_checkpoints_target_empty"
-    "test_save_restore_checkpoints_target_none"
-    "test_save_restore_checkpoints_target_singular"
-    "test_save_restore_checkpoints_w_float_steps"
-    "test_save_restore_checkpoints"
-  ];
-
   meta = with lib; {
     description = "Neural network library for JAX";
     homepage = "https://github.com/google/flax";
diff --git a/pkgs/development/python-modules/folium/default.nix b/pkgs/development/python-modules/folium/default.nix
index 09c2137872d29..8b29b61fe6984 100644
--- a/pkgs/development/python-modules/folium/default.nix
+++ b/pkgs/development/python-modules/folium/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "folium";
-  version = "0.14.0";
+  version = "0.15.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "python-visualization";
     repo = "folium";
     rev = "refs/tags/v${version}";
-    hash = "sha256-zxLFj5AeTVAxE0En7ZlbBdJEm3WrcPv23MgOhyfNi14=";
+    hash = "sha256-xaz9oelkyS8lWECCmKs8P3mHB3Usv0KMUoh/K7rBnAs=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/formencode/default.nix b/pkgs/development/python-modules/formencode/default.nix
index 1323f2902cfc9..1b7dd1fc2ef05 100644
--- a/pkgs/development/python-modules/formencode/default.nix
+++ b/pkgs/development/python-modules/formencode/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "formencode";
-  version = "2.0.1";
+  version = "2.1.0";
 
   disabled = isPy27;
 
   src = fetchPypi {
     pname = "FormEncode";
     inherit version;
-    sha256 = "8f2974112c2557839d5bae8b76490104c03830785d923abbdef148bf3f710035";
+    sha256 = "sha256-63TSIweKKM8BX6iJZsbjTy0Y11EnMY1lwUS+2a/EJj8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/insightface/default.nix b/pkgs/development/python-modules/insightface/default.nix
index e06b86f918021..6d5c4a66239cc 100644
--- a/pkgs/development/python-modules/insightface/default.nix
+++ b/pkgs/development/python-modules/insightface/default.nix
@@ -69,9 +69,6 @@ buildPythonPackage rec {
   doCheck = false; # Upstream has no tests
 
   meta = with lib; {
-    # Both protobuf3 and protobuf4 in the build closure.
-    # related: https://github.com/onnx/onnx/issues/5563
-    broken = true;
     description = "State-of-the-art 2D and 3D Face Analysis Project";
     homepage = "https://github.com/deepinsight/insightface";
     license = licenses.mit;
diff --git a/pkgs/development/python-modules/mypy-boto3-builder/default.nix b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
index 37564eeb21373..f3c06701eb65c 100644
--- a/pkgs/development/python-modules/mypy-boto3-builder/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3-builder/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "mypy-boto3-builder";
-  version = "7.19.0";
+  version = "7.19.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "youtype";
     repo = "mypy_boto3_builder";
     rev = "refs/tags/${version}";
-    hash = "sha256-Wczk1DNoOpvd7efnZFUf4FSjYqHdkMKMNwNVeQOPeEg=";
+    hash = "sha256-Gz6OJ2ER60R14aTmhPfodX22FlbicUClBtlqNglTjC4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/nilearn/default.nix b/pkgs/development/python-modules/nilearn/default.nix
index f8273e30ae7bd..3c21b0b62e518 100644
--- a/pkgs/development/python-modules/nilearn/default.nix
+++ b/pkgs/development/python-modules/nilearn/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "nilearn";
-  version = "0.10.1";
+  version = "0.10.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-koo2Tn7XfRXQK38icZfqfHj0Ty/ngP61VdbXz5Iy+EY=";
+    hash = "sha256-A+9Npy0a6HsuPyi3cdx+BUZKoXliblfDAFlWJahlQnM=";
   };
 
   nativeBuildInputs = [ hatch-vcs ];
diff --git a/pkgs/development/python-modules/nvidia-ml-py/default.nix b/pkgs/development/python-modules/nvidia-ml-py/default.nix
index caf4028df5775..a8c327a080764 100644
--- a/pkgs/development/python-modules/nvidia-ml-py/default.nix
+++ b/pkgs/development/python-modules/nvidia-ml-py/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "nvidia-ml-py";
-  version = "12.535.108";
+  version = "12.535.133";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     extension = "tar.gz";
-    hash = "sha256-FB/oGHcaFl+5P3Xb5/Afdnw7r6fBP2h29TWDURsHjuE=";
+    hash = "sha256-sVWa8NV90glVv1jQWv/3sWbd1ElH6zBRyZBWOHmesdw=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/optimum/default.nix b/pkgs/development/python-modules/optimum/default.nix
index 5b22a878c77f4..3b38fcc2c8649 100644
--- a/pkgs/development/python-modules/optimum/default.nix
+++ b/pkgs/development/python-modules/optimum/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "optimum";
-  version = "1.13.3";
+  version = "1.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "optimum";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4bKQcltUr7q8wHfiRXQcK5dw0TrnMr9/bTNXeOyg7oA=";
+    hash = "sha256-fCLMDbWfEAG7pTFKWv67fpr6lNTxRTCBkppgDZR51eY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/orange-canvas-core/default.nix b/pkgs/development/python-modules/orange-canvas-core/default.nix
index 814c90a698dc2..e40a9a03e7641 100644
--- a/pkgs/development/python-modules/orange-canvas-core/default.nix
+++ b/pkgs/development/python-modules/orange-canvas-core/default.nix
@@ -18,11 +18,11 @@
 
 buildPythonPackage rec {
   pname = "orange-canvas-core";
-  version = "0.1.33";
+  version = "0.1.35";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-w3krij7+CtJl1XoJz3RRAAp2aKqMCQg/PBh5erf/Phs=";
+    hash = "sha256-xLCwjeNDx9RqxlNkIWMo0Pcrg7akGuu4Rv9oRDgOK18=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/orange3/default.nix b/pkgs/development/python-modules/orange3/default.nix
index c8939f01e9394..1100ae7f6dc6e 100644
--- a/pkgs/development/python-modules/orange3/default.nix
+++ b/pkgs/development/python-modules/orange3/default.nix
@@ -44,7 +44,7 @@
 let
   self = buildPythonPackage rec {
     pname = "orange3";
-    version = "3.36.1";
+    version = "3.36.2";
 
     disabled = pythonOlder "3.7";
 
@@ -52,7 +52,7 @@ let
       owner = "biolab";
       repo = "orange3";
       rev = "refs/tags/${version}";
-      hash = "sha256-O5ZN5O1vMkqiv83Q5UoaDefGnqVnDLPmYLLG20cdajk=";
+      hash = "sha256-v9lk5vGhBaR2PHZ+Jq0hy1WaCsbeLe+vZlTaHBkfacU=";
     };
 
     postPatch = ''
diff --git a/pkgs/development/python-modules/paddle2onnx/default.nix b/pkgs/development/python-modules/paddle2onnx/default.nix
index a3853022f0a6a..e358c2ec49861 100644
--- a/pkgs/development/python-modules/paddle2onnx/default.nix
+++ b/pkgs/development/python-modules/paddle2onnx/default.nix
@@ -9,7 +9,7 @@
 }:
 let
   pname = "paddle2onnx";
-  version = "1.0.9";
+  version = "1.1.0";
   format = "wheel";
   pyShortVersion = "cp${builtins.replaceStrings ["."] [""] python.pythonVersion}";
   src = fetchPypi {
@@ -18,7 +18,7 @@ let
     python = pyShortVersion;
     abi = pyShortVersion;
     platform = "manylinux_2_12_x86_64.manylinux2010_x86_64";
-    hash = "sha256-QnXfcbfzRt1sSagnDLP3ZRLH3KNqK76L+KvifTU6MJQ=";
+    hash = "sha256-HI/lIj9ezdCry5fYDi5Pia6hvOjN6/Slm9BMfLeq8AU=";
   };
 in
 buildPythonPackage {
diff --git a/pkgs/development/python-modules/pydrawise/default.nix b/pkgs/development/python-modules/pydrawise/default.nix
index 22c281dce3e6b..dc36f149a9b1c 100644
--- a/pkgs/development/python-modules/pydrawise/default.nix
+++ b/pkgs/development/python-modules/pydrawise/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pydrawise";
-  version = "2023.10.0";
+  version = "2023.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "dknowles2";
     repo = "pydrawise";
     rev = "refs/tags/${version}";
-    hash = "sha256-CSjYLiOvnm1kFp4DL3w/YmAsDcbaCfLfGT0xUZy+GZ0=";
+    hash = "sha256-gKOyTvdETGzKlpU67UKaHYTIvnAX9znHIynP3BiVbt4=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/pyparted/default.nix b/pkgs/development/python-modules/pyparted/default.nix
index 4d473ae094d8c..84d8439a5360b 100644
--- a/pkgs/development/python-modules/pyparted/default.nix
+++ b/pkgs/development/python-modules/pyparted/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv
 , fetchFromGitHub
-, fetchpatch
 , buildPythonPackage
 , isPyPy
 , pkgs
 , python
 , six
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
@@ -31,31 +31,14 @@ buildPythonPackage rec {
       tests/test__ped_ped.py
   '';
 
-  patches = [
-    ./fix-test-pythonpath.patch
-    (fetchpatch {
-      url = "https://github.com/dcantrell/pyparted/commit/07ba882d04fa2099b53d41370416b97957d2abcb.patch";
-      hash = "sha256-yYfLdy+TOKfN3gtTMgOWPebPTRYyaOYh/yFTowCbdjg=";
-    })
-    (fetchpatch {
-      url = "https://github.com/dcantrell/pyparted/commit/a01b4eeecf63b0580c192c7c2db7a5c406a7ad6d.patch";
-      hash = "sha256-M/8hYiKUBzaTOxPYDFK5BAvCm6WJGx+693qwj3HzdRA=";
-    })
-  ];
-
   preConfigure = ''
     PATH="${pkgs.parted}/sbin:$PATH"
   '';
 
   nativeBuildInputs = [ pkgs.pkg-config ];
-  nativeCheckInputs = [ six ];
+  nativeCheckInputs = [ six pytestCheckHook ];
   propagatedBuildInputs = [ pkgs.parted ];
 
-  checkPhase = ''
-    patchShebangs Makefile
-    make test PYTHON=${python.executable}
-  '';
-
   meta = with lib; {
     homepage = "https://github.com/dcantrell/pyparted/";
     description = "Python interface for libparted";
diff --git a/pkgs/development/python-modules/pyparted/fix-test-pythonpath.patch b/pkgs/development/python-modules/pyparted/fix-test-pythonpath.patch
deleted file mode 100644
index 740bffbef6d8d..0000000000000
--- a/pkgs/development/python-modules/pyparted/fix-test-pythonpath.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff -ur a/Makefile b/Makefile
---- a/Makefile	1980-01-02 00:00:00.000000000 +0100
-+++ b/Makefile	2020-02-18 20:04:14.068243263 +0100
-@@ -39,19 +39,19 @@
- 	@$(PYTHON) setup.py build
- 
- test: all
--	@env PYTHONPATH=$$(find $$(pwd) -name "*.so" | head -n 1 | xargs dirname):src/parted:src \
-+	@env PYTHONPATH=$$(find $$(pwd) -name "*.so" | head -n 1 | xargs dirname):src/parted:src:$$PYTHONPATH \
- 	$(PYTHON) -m unittest discover -v
- 
- coverage: all
- 	@echo "*** Running unittests with $(COVERAGE) for $(PYTHON) ***"
--	@env PYTHONPATH=$$(find $$(pwd) -name "*.so" | head -n 1 | xargs dirname):src/parted:src \
-+	@env PYTHONPATH=$$(find $$(pwd) -name "*.so" | head -n 1 | xargs dirname):src/parted:src:$$PYTHONPATH \
- 	$(COVERAGE) run --branch -m unittest discover -v
- 	$(COVERAGE) report --include="build/lib.*/parted/*" --show-missing
- 	$(COVERAGE) report --include="build/lib.*/parted/*" > coverage-report.log
- 
- check: clean
- 	env PYTHON=python3 $(MAKE) ; \
--	env PYTHON=python3 PYTHONPATH=$$(find $$(pwd) -name "*.so" | head -n 1 | xargs dirname):src/parted:src \
-+	env PYTHON=python3 PYTHONPATH=$$(find $$(pwd) -name "*.so" | head -n 1 | xargs dirname):src/parted:src:$$PYTHONPATH \
- 	tests/pylint/runpylint.py
- 
- dist:
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index c19e16cae96ee..c2af4be8df86b 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.75";
+  version = "9.2.76";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-8P8xOb4P1JsbPZya8s1Bl16VsYtHQdAD05sc8EAcEpM=";
+    hash = "sha256-JlwqxKJaJ3sk2mROUOaF0N5d4V7LM43VqEXnuSO45BY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/rank_bm25/default.nix b/pkgs/development/python-modules/rank-bm25/default.nix
index 4019864f27d6b..9b0c5080449d1 100644
--- a/pkgs/development/python-modules/rank_bm25/default.nix
+++ b/pkgs/development/python-modules/rank-bm25/default.nix
@@ -5,7 +5,7 @@
 , numpy
 }:
 let
-  pname = "rank_bm25";
+  pname = "rank-bm25";
   version = "0.2.2";
 in
 buildPythonPackage {
diff --git a/pkgs/development/python-modules/scikit-survival/default.nix b/pkgs/development/python-modules/scikit-survival/default.nix
index b2c4218e5f33a..9a766cedece31 100644
--- a/pkgs/development/python-modules/scikit-survival/default.nix
+++ b/pkgs/development/python-modules/scikit-survival/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "scikit-survival";
-  version = "0.21.0";
-  format = "setuptools";
+  version = "0.22.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rcdEtlmD3O2BQuwxRlOJ/HOEBdWJBRJR5UR6rZoeArw=";
+    hash = "sha256-Ft0Hg5iF9Sb9VSOsFMgfAvc4Nsam216kzt5Xv2iykv8=";
   };
 
   nativeBuildInputs = [
@@ -45,6 +45,11 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  # treat numpy versions as lower bounds, same as setuptools build
+  postPatch = ''
+    sed -i 's/numpy==/numpy>=/' pyproject.toml
+  '';
+
   # Hack needed to make pytest + cython work
   # https://github.com/NixOS/nixpkgs/pull/82410#issuecomment-827186298
   preCheck = ''
@@ -63,10 +68,13 @@ buildPythonPackage rec {
     "test_pandas_inputs"
     "test_survival_svm"
     "test_tree"
-  ];
+  ] ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64)
+    # floating point mismatch on aarch64
+    # 27079905.88052468 to far from 27079905.880496684
+    "test_coxnet"
+  ;
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64);
     description = "Survival analysis built on top of scikit-learn";
     homepage = "https://github.com/sebp/scikit-survival";
     license = licenses.gpl3Only;
diff --git a/pkgs/development/python-modules/simpful/default.nix b/pkgs/development/python-modules/simpful/default.nix
index ab075702dae0a..bb535e7c10f59 100644
--- a/pkgs/development/python-modules/simpful/default.nix
+++ b/pkgs/development/python-modules/simpful/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
 , matplotlib
@@ -24,6 +25,15 @@ buildPythonPackage rec {
     hash = "sha256-1CU/Iz83CKRx7dsOTGfdJm98TUfc2kxCHKIEUXP36HQ=";
   };
 
+  # patch dated use of private matplotlib interface
+  # https://github.com/aresio/simpful/issues/22
+  postPatch = ''
+    substituteInPlace simpful/simpful.py \
+      --replace \
+        "next(ax._get_lines.prop_cycler)['color']" \
+        "ax._get_lines.get_next_color()"
+  '';
+
   propagatedBuildInputs = [
     numpy
     scipy
@@ -46,6 +56,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
+    broken = stdenv.isDarwin;
     description = "Library for fuzzy logic";
     homepage = "https://github.com/aresio/simpful";
     changelog = "https://github.com/aresio/simpful/releases/tag/${version}";
diff --git a/pkgs/development/python-modules/spyder/default.nix b/pkgs/development/python-modules/spyder/default.nix
index 9722222905a08..a70ef94409f74 100644
--- a/pkgs/development/python-modules/spyder/default.nix
+++ b/pkgs/development/python-modules/spyder/default.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "spyder";
-  version = "5.4.5";
+  version = "5.5.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-/9p/8avjy1c3Dwos9Byx03kfVrRofVQus+Ae5beFnmo=";
+    hash = "sha256-zjQmUmkqwtXNnZKssNpl24p4FQscZKGiiJj5iwYl2UM=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/tensorflow-probability/default.nix b/pkgs/development/python-modules/tensorflow-probability/default.nix
index 8e017cc55b0f2..e81e9736c26cb 100644
--- a/pkgs/development/python-modules/tensorflow-probability/default.nix
+++ b/pkgs/development/python-modules/tensorflow-probability/default.nix
@@ -27,17 +27,17 @@
 }:
 
 let
-  version = "0.19.0";
-  pname = "tensorflow_probability";
+  version = "0.21.0";
+  pname = "tensorflow-probability";
 
   # first build all binaries and generate setup.py using bazel
   bazel-wheel = buildBazelPackage {
-    name = "${pname}-${version}-py2.py3-none-any.whl";
+    name = "tensorflow_probability-${version}-py2.py3-none-any.whl";
     src = fetchFromGitHub {
       owner = "tensorflow";
       repo = "probability";
-      rev = "v" + version;
-      hash = "sha256-ZkQ20Qt/RF/leVP6Kc38tGgPz+C6lEuHvoL+s97oksE=";
+      rev = "refs/tags/v${version}";
+      hash = "sha256-DsJd1E5n86xNS7Ci0DXxoUxQ9jH8OwTZq2UuLlQtMUU=";
     };
     nativeBuildInputs = [
       # needed to create the output wheel in installPhase
@@ -54,8 +54,7 @@ let
     LIBTOOL = lib.optionalString stdenv.isDarwin "${cctools}/bin/libtool";
 
     fetchAttrs = {
-      # FIXME: tensorflow is currently marked as broken, update the hash once it's fixed
-      sha256 = "sha256-0ChXujA2XpnkybrraN3FIJA/QkxLCfX97id2jMFzFJk=";
+      sha256 = "sha256-1iO/eXz1wvSIRTmGuGZDF9VeDVTiWYnjw0Cby4n/6HM=";
     };
 
     buildAttrs = {
@@ -117,6 +116,6 @@ in buildPythonPackage {
     description = "Library for probabilistic reasoning and statistical analysis";
     homepage = "https://www.tensorflow.org/probability/";
     license = licenses.asl20;
-    maintainers = with maintainers; [];  # This package is maintainerless.
+    maintainers = with maintainers; [ GaetanLepage ];
   };
 }
diff --git a/pkgs/development/python-modules/tlds/default.nix b/pkgs/development/python-modules/tlds/default.nix
index 207b605070ae7..3967781bb0f8f 100644
--- a/pkgs/development/python-modules/tlds/default.nix
+++ b/pkgs/development/python-modules/tlds/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "tlds";
-  version = "2023102600";
+  version = "2023110300";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kichik";
     repo = "tlds";
     rev = "refs/tags/${version}";
-    hash = "sha256-ncbgR/syMChIL0/FGLOHxHJMUzH0G+rZX9aCXun7yc4=";
+    hash = "sha256-rmKqY7Z4bBR4r+w4gH04g0Xm9N7QeMVcuFR3pB/pOQY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wikitextparser/default.nix b/pkgs/development/python-modules/wikitextparser/default.nix
index b65f18b6c6ec0..b7af5aeeb652e 100644
--- a/pkgs/development/python-modules/wikitextparser/default.nix
+++ b/pkgs/development/python-modules/wikitextparser/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "wikitextparser";
-  version = "0.54.0";
+  version = "0.55.5";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "5j9";
     repo = "wikitextparser";
     rev = "v${version}";
-    hash = "sha256-AGQfjUNxeleuTS200QMdZS8CSD2t4ah5NMm9TIYjVHk=";
+    hash = "sha256-cmzyRbq4tCbuyrNnT0UYxoxuwXrFkIcWdrogSTfxSys=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/zcbor/default.nix b/pkgs/development/python-modules/zcbor/default.nix
new file mode 100644
index 0000000000000..21d6e7e790ed6
--- /dev/null
+++ b/pkgs/development/python-modules/zcbor/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+
+# build dependencies
+, setuptools
+
+# dependencies
+, cbor2
+, pyyaml
+, regex
+}:
+
+buildPythonPackage rec {
+  pname = "zcbor";
+  version = "0.7.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-0mGp7Hnq8ZNEUx/9eQ6UD9/cOuLl6S5Aif1qNh1+jYA=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    cbor2
+    pyyaml
+    regex
+  ];
+
+  pythonImportsCheck = [ "zcbor" ];
+
+  meta = with lib; {
+    description = "A low footprint CBOR library in the C language (C++ compatible), tailored for use in microcontrollers";
+    homepage = "https://pypi.org/project/zcbor/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ otavio ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/alire/default.nix b/pkgs/development/tools/build-managers/alire/default.nix
index 39124514d042d..eaa87d573f8c9 100644
--- a/pkgs/development/tools/build-managers/alire/default.nix
+++ b/pkgs/development/tools/build-managers/alire/default.nix
@@ -46,5 +46,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ atalii ];
     platforms = lib.platforms.unix;
+    mainProgram = "alr";
   };
 })
diff --git a/pkgs/development/tools/godot/4/default.nix b/pkgs/development/tools/godot/4/default.nix
index 986d2d7745f39..b7dc3b04ac5a1 100644
--- a/pkgs/development/tools/godot/4/default.nix
+++ b/pkgs/development/tools/godot/4/default.nix
@@ -43,14 +43,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "godot";
-  version = "4.1.1";
-  commitHash = "bd6af8e0ea69167dd0627f3bd54f9105bda0f8b5";
+  version = "4.1.3-stable";
+  commitHash = "fc79201851a16215f9554884aa242ed957801b10";
 
   src = fetchFromGitHub {
     owner = "godotengine";
     repo = "godot";
     rev = commitHash;
-    hash = "sha256-0CErsMTrBC/zYcabAtjYn8BWAZ1HxgozKdgiqdsn3q8=";
+    hash = "sha256-z5JRPhdEO20AodS12MApgur0BMHGToUjo2r2eI77nNc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/kafka-delta-ingest/default.nix b/pkgs/development/tools/kafka-delta-ingest/default.nix
index d06f603dfa15b..9f8983305f7cf 100644
--- a/pkgs/development/tools/kafka-delta-ingest/default.nix
+++ b/pkgs/development/tools/kafka-delta-ingest/default.nix
@@ -46,6 +46,6 @@ rustPlatform.buildRustPackage rec {
     description = "A highly efficient daemon for streaming data from Kafka into Delta Lake";
     homepage = "https://github.com/delta-io/kafka-delta-ingest";
     license = licenses.asl20;
-    maintainers = with maintainers; [ bbigras ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/tools/language-servers/csharp-ls/default.nix b/pkgs/development/tools/language-servers/csharp-ls/default.nix
index efc6307f1a6c7..cefb7a969a40c 100644
--- a/pkgs/development/tools/language-servers/csharp-ls/default.nix
+++ b/pkgs/development/tools/language-servers/csharp-ls/default.nix
@@ -8,9 +8,9 @@ in
 
 buildDotnetGlobalTool rec {
   pname = "csharp-ls";
-  version = "0.8.0";
+  version = "0.10.0";
 
-  nugetSha256 = "sha256-F3N6ESE/VmQA5sOMm3eqSkhSNVCCsnAXTCC+McsAnQw=";
+  nugetSha256 = "sha256-1t8U2Q4lIlj2QwbnevAMMGcqtpPh5zk0Bd7EHa7qvCI=";
 
   dotnet-sdk = sdk_7_0;
   dotnet-runtime = sdk_7_0;
diff --git a/pkgs/development/tools/misc/opengrok/default.nix b/pkgs/development/tools/misc/opengrok/default.nix
index 5c9589920a600..37593e0090cad 100644
--- a/pkgs/development/tools/misc/opengrok/default.nix
+++ b/pkgs/development/tools/misc/opengrok/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "opengrok";
-  version = "1.12.15";
+  version = "1.12.21";
 
   # binary distribution
   src = fetchurl {
     url = "https://github.com/oracle/opengrok/releases/download/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-AEKzhNSNJOOyK/fiAepqios7xoexAi4M4zbMTPdyyeA=";
+    hash = "sha256-SjA5J9fILU/FBNXRS/cvGZVWAK2qqOyMsd6wC/CJYaE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/nest-cli/default.nix b/pkgs/development/tools/nest-cli/default.nix
index 9fdb579b54262..7fa9595e18286 100644
--- a/pkgs/development/tools/nest-cli/default.nix
+++ b/pkgs/development/tools/nest-cli/default.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "nest-cli";
-  version = "10.1.17";
+  version = "10.2.1";
 
   src = fetchFromGitHub {
     owner = "nestjs";
     repo = pname;
     rev = version;
-    hash = "sha256-03GDrKjlvl3O3kJlbbyDYxtlfwLkZbvxC9gvP534zSY=";
+    hash = "sha256-vnF+ES6RK4iiIJsWUV57DqoLischh+1MlmlK46Z6USY=";
   };
 
-  npmDepsHash = "sha256-nZ9ant2c+15bRBikFcKZW8aiFqI3WC6hktSiBfnma/I=";
+  npmDepsHash = "sha256-9yd+k+HpARM63/esW+av0zfcuAVsp9Lkfp6hmUQO5Yg=";
 
   env = {
     npm_config_build_from_source = true;
@@ -37,6 +37,5 @@ buildNpmPackage rec {
     license = licenses.mit;
     mainProgram = "nest";
     maintainers = [ maintainers.ehllie ];
-    broken = stdenv.isDarwin; # https://github.com/nestjs/nest-cli/pull/2281
   };
 }
diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index 1ef8ff9d35fdd..aeff229f832db 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "18.11.0";
+  version = "18.22.0";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-sUP2xBrh7JpAaHhiMm6AilgEUNIfK1U2hbloUJYHn6c=";
+    hash = "sha256-lQqDXiT+DRLmU+4DBvj2Gnd1RjaRgMorhXo1BmJLQqU=";
   };
 
-  vendorHash = "sha256-i5K7f70MevNJcRsP2P9rsMZRpKPVWsTx9M4t2AoEJew=";
+  vendorHash = "sha256-/SVS0Vd6GvKEAzRobxaTwJ+uy8dwCINBOYzQN65ppAs=";
 
   sourceRoot = "${src.name}/src";
 
diff --git a/pkgs/development/tools/ols/default.nix b/pkgs/development/tools/ols/default.nix
index a9e7b25603f1c..4b8dcd447c439 100644
--- a/pkgs/development/tools/ols/default.nix
+++ b/pkgs/development/tools/ols/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "ols";
-  version = "nightly-2023-07-09";
+  version = "nightly-2023-11-04";
 
   src = fetchFromGitHub {
     owner = "DanielGavin";
     repo = "ols";
-    rev = "255ad5958026dc3a3116f621eaebd501b8b26a22";
-    hash = "sha256-XtlIZToNvmU4GhUJAxuVmKvKwnPebaxjv7jp/AgE/uM=";
+    rev = "b19c24eb17e7c16bcfb3144665fd405fd5e580f3";
+    hash = "sha256-c8mHVdXbn7aRKI/QBIZvBvl4sCNK49q+crQmTCjptwM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/pandoc/default.nix b/pkgs/development/tools/pandoc/default.nix
index 7df96859a7480..c8c553afad6ed 100644
--- a/pkgs/development/tools/pandoc/default.nix
+++ b/pkgs/development/tools/pandoc/default.nix
@@ -6,6 +6,15 @@ let
 
 in
   (haskell.lib.compose.overrideCabal (drv: {
+    # pandoc-cli's pandoc executable report the libraries version via --version, match that,
+    inherit (static.scope.pandoc) version;
+    # but prevent haskellPackages.mkDerivation from recomputing the src tarball based on that.
+    inherit (static) src;
+    # Make it possible to recover the cli version if necessary.
+    passthru = drv.passthru or {} // {
+      cliVersion = static.version;
+    };
+
     configureFlags = drv.configureFlags or [] ++ ["-fembed_data_files"];
     buildDepends = drv.buildDepends or [] ++ [haskellPackages.file-embed];
     buildTools = (drv.buildTools or []) ++ [ removeReferencesTo ];
diff --git a/pkgs/development/tools/rust/cargo-readme/default.nix b/pkgs/development/tools/rust/cargo-readme/default.nix
index 35d3fb133e851..15c5ad5145245 100644
--- a/pkgs/development/tools/rust/cargo-readme/default.nix
+++ b/pkgs/development/tools/rust/cargo-readme/default.nix
@@ -2,27 +2,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-readme";
-  version = "3.2.0";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
-    owner = "livioribeiro";
+    owner = "webern";
     repo = pname;
-    # Git tag is missing, see upstream issue:
-    # https://github.com/livioribeiro/cargo-readme/issues/61
-    rev = "cf66017c0120ae198210ebaf58a0be6a78372974";
-    sha256 = "sha256-/ufHHM13L83M3UYi6mjdhIjgXx7bZgzvR/X02Zsx7Fw=";
+    rev = "v${version}";
+    sha256 = "sha256-FFWHADATEfvZvxGwdkj+eTVoq7pnPuoUAhMGTokUkMs=";
   };
 
-  cargoSha256 = "sha256-Isd05qOuVBNfXOI5qsaDOhjF7QIKAG5xrZsBFK2PpQQ=";
+  cargoSha256 = "sha256-OEArMqOiT+PZ+zMRt9h0EzeP7ikFuOYR8mFGtm+xCkQ=";
 
-  patches = [
-    (fetchpatch {
-      # Fixup warning thrown at build when running test-suite
-      # unused return, see upstream PR:
-      # https://github.com/livioribeiro/cargo-readme/pull/62
-      url = "https://github.com/livioribeiro/cargo-readme/commit/060f2daaa2b2cf981bf490dc36bcc6527545ea03.patch";
-      sha256 = "sha256-wlAIgTI9OqtA/Jnswoqp7iOj+1zjrUZA7JpHUiF/n+s=";
-    })
+  # disable doc tests
+  cargoTestFlags = [
+    "--bins" "--lib"
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/squawk/default.nix b/pkgs/development/tools/squawk/default.nix
index 8e7dc13393f07..417c66ea3a6f2 100644
--- a/pkgs/development/tools/squawk/default.nix
+++ b/pkgs/development/tools/squawk/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "squawk";
-  version = "0.24.1";
+  version = "0.24.2";
 
   src = fetchFromGitHub {
     owner = "sbdchd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-XQU/1uAas1bT7FSgBzJSPRe4ET9ysjpFGhV+qi23AAY=";
+    hash = "sha256-gFJaW7Mb3HKN6D/qnpfNQVxBOKbxIBZOVWJ63wiGoeU=";
   };
 
-  cargoHash = "sha256-Qg2VcsAqXpYamO35t/lvlXUPTdjAqZ4z3Nm0hYdhjEM=";
+  cargoHash = "sha256-a1kAVIyGnVF3IWkDQbmV3L9cfY+1564RW6eWfBHbTZ8=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/teller/default.nix b/pkgs/development/tools/teller/default.nix
index 8930777229309..a906e6c1f5e57 100644
--- a/pkgs/development/tools/teller/default.nix
+++ b/pkgs/development/tools/teller/default.nix
@@ -19,6 +19,7 @@ buildGoModule {
   # use make instead of default checks because e2e does not work with `buildGoDir`
   checkPhase = ''
     runHook preCheck
+    HOME="$(mktemp -d)"
     # We do not set trimpath for tests, in case they reference test assets
     export GOFLAGS=''${GOFLAGS//-trimpath/}
 
diff --git a/pkgs/development/tools/turso-cli/default.nix b/pkgs/development/tools/turso-cli/default.nix
index ed1655cbd793b..2a72686cf96a1 100644
--- a/pkgs/development/tools/turso-cli/default.nix
+++ b/pkgs/development/tools/turso-cli/default.nix
@@ -8,16 +8,16 @@
 }:
 buildGo121Module rec {
   pname = "turso-cli";
-  version = "0.86.3";
+  version = "0.87.1";
 
   src = fetchFromGitHub {
     owner = "tursodatabase";
     repo = "turso-cli";
     rev = "v${version}";
-    hash = "sha256-hTqjNQSScQzCUBs4pYgxRnRvUSoQXXeZIceSZAR1Oa0=";
+    hash = "sha256-wPL4fYFkk1rtHIYIVOGk5GG6S/pmOpg6WcbnpleDkUA=";
   };
 
-  vendorHash = "sha256-EqND/W+NNatoBUMXWrsjNPfxAtX0oUASUxN6Rmhp7SQ=";
+  vendorHash = "sha256-Jf2ZLzODPnvNrED8ST0u7rHGWivPwcyptkJbu8mdnoA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/games/heroic/default.nix b/pkgs/games/heroic/default.nix
index eca0860207096..65ff3b90403fc 100644
--- a/pkgs/games/heroic/default.nix
+++ b/pkgs/games/heroic/default.nix
@@ -17,18 +17,18 @@
 let appName = "heroic";
 in stdenv.mkDerivation rec {
   pname = "heroic-unwrapped";
-  version = "2.9.2";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     owner = "Heroic-Games-Launcher";
     repo = "HeroicGamesLauncher";
     rev = "v${version}";
-    hash = "sha256-kCvMUhN1kjGb5rV+lkKm1FFYBJUSQGOKTY1DQdiAWLU=";
+    hash = "sha256-umPQIxwIahjbO4QbkKEoeSSeYT2UatsTGRPrLgw5KW8=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-kHZL7TENVK58dvr8PBFtWYZ2PSKEYESX4e1xYmMA5+Y=";
+    hash = "sha256-o5ztk4okH21Op1jqHZfranR12M8B1Y/K95aWb10tf5o=";
   };
 
   nativeBuildInputs = [
@@ -45,8 +45,18 @@ in stdenv.mkDerivation rec {
     ./remove-drm-support.patch
     # Make Heroic create Steam shortcuts (to non-steam games) with the correct path to heroic.
     ./fix-non-steam-shortcuts.patch
+    # Fix reg add infinite loop
+    # Submitted upstream: https://github.com/Heroic-Games-Launcher/HeroicGamesLauncher/pull/3210
+    ./fix-infinite-loop.patch
   ];
 
+  postPatch = ''
+    # We are not packaging this as an Electron application bundle, so Electron
+    # reports to the application that is is not "packaged", which causes Heroic
+    # to take some incorrect codepaths meant for development environments.
+    substituteInPlace src/**/*.ts --replace 'app.isPackaged' 'true'
+  '';
+
   configurePhase = ''
     runHook preConfigure
 
diff --git a/pkgs/games/heroic/fhsenv.nix b/pkgs/games/heroic/fhsenv.nix
index f406cf187b43a..24f7c96bc9f91 100644
--- a/pkgs/games/heroic/fhsenv.nix
+++ b/pkgs/games/heroic/fhsenv.nix
@@ -29,6 +29,7 @@ buildFHSEnv {
     perl
     psmisc
     python3
+    unzip
     which
     xorg.xrandr
     zstd
diff --git a/pkgs/games/heroic/fix-infinite-loop.patch b/pkgs/games/heroic/fix-infinite-loop.patch
new file mode 100644
index 0000000000000..99aae02c3a1a4
--- /dev/null
+++ b/pkgs/games/heroic/fix-infinite-loop.patch
@@ -0,0 +1,23 @@
+From b698779053b7ba31bd8e69b230e86515e3019bf6 Mon Sep 17 00:00:00 2001
+From: K900 <me@0upti.me>
+Date: Sun, 5 Nov 2023 22:04:32 +0300
+Subject: [PATCH] Force add the registry entry
+
+Otherwise, newer Wine versions will prompt to overwrite it and loop there forever.
+---
+ src/backend/storeManagers/legendary/setup.ts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/backend/storeManagers/legendary/setup.ts b/src/backend/storeManagers/legendary/setup.ts
+index 1837106621..b5c2432435 100644
+--- a/src/backend/storeManagers/legendary/setup.ts
++++ b/src/backend/storeManagers/legendary/setup.ts
+@@ -20,7 +20,7 @@ export const legendarySetup = async (appName: string) => {
+ 
+   // Fixes games like Fallout New Vegas and Dishonored: Death of the Outsider
+   await runWineCommandOnGame(appName, {
+-    commandParts: ['reg', 'add', 'HKEY_CLASSES_ROOT\\com.epicgames.launcher'],
++    commandParts: ['reg', 'add', 'HKEY_CLASSES_ROOT\\com.epicgames.launcher', '/f'],
+     wait: true,
+     protonVerb: 'waitforexitandrun'
+   })
diff --git a/pkgs/games/heroic/remove-drm-support.patch b/pkgs/games/heroic/remove-drm-support.patch
index f3cd80f003f3c..44045bef2bf6a 100644
--- a/pkgs/games/heroic/remove-drm-support.patch
+++ b/pkgs/games/heroic/remove-drm-support.patch
@@ -1,22 +1,26 @@
 diff --git a/src/backend/main.ts b/src/backend/main.ts
-index 2cd1a28f..a60e04d0 100644
+index 83b58bb2..f61656fa 100644
 --- a/src/backend/main.ts
 +++ b/src/backend/main.ts
-@@ -19,8 +19,7 @@ import {
-   powerSaveBlocker,
+@@ -19,7 +19,6 @@ import {
    protocol,
    screen,
--  clipboard,
--  components
-+  clipboard
+   clipboard,
+-  components,
+   session
  } from 'electron'
  import 'backend/updater'
- import { autoUpdater } from 'electron-updater'
-@@ -286,8 +285,7 @@ if (!gotTheLock) {
-     initImagesCache()
+@@ -310,14 +309,7 @@ if (!gotTheLock) {
+     }
  
      if (!process.env.CI) {
--      await components.whenReady()
+-      await components.whenReady().catch((e) => {
+-        logError([
+-          'Failed to download / update DRM components.',
+-          'Make sure you do not block update.googleapis.com domain if you want to use WideVine in Browser sideloaded apps',
+-          e
+-        ])
+-      })
 -      logInfo(['DRM module staus', components.status()])
 +      logInfo('DRM modules disabled for nixpkgs')
      }
diff --git a/pkgs/games/legendary-gl/default.nix b/pkgs/games/legendary-gl/default.nix
index 569148f2cf505..5fce31eaa837e 100644
--- a/pkgs/games/legendary-gl/default.nix
+++ b/pkgs/games/legendary-gl/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonApplication rec {
   pname = "legendary-gl"; # Name in pypi
-  version = "0.20.33";
+  version = "unstable-2023-10-14";
 
   src = fetchFromGitHub {
     owner = "derrod";
     repo = "legendary";
-    rev = "refs/tags/${version}";
-    sha256 = "sha256-fEQUChkxrKV2IkFGORUolZE2qTzA10Xxogjl5Va4TcE=";
+    rev = "450784283dd49152dda6322db2fb2ef33e7c382e";
+    sha256 = "sha256-iwIaxD35tkOX6NX1SVNmN2OQACwaX/C4xnfgT5YcUvg=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/games/nile/default.nix b/pkgs/games/nile/default.nix
index beb444ae11ec9..e3bf056fc3cf1 100644
--- a/pkgs/games/nile/default.nix
+++ b/pkgs/games/nile/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonApplication rec {
   pname = "nile";
-  version = "1.0.0";
+  version = "unstable-2023-10-03";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "imLinguin";
     repo = "nile";
-    rev = "f5f3b96f6483c59cfc646afbda6e97cb0bd94778";
-    hash = "sha256-HibY3U9/MibEDwHY+YiErW/pz6qwtps8wwjhznTISgA=";
+    rev = "8f7ab2650fc730efc8960b5fcd71421d724a4108";
+    hash = "sha256-Vhjp9JX8VX0PWsvEh5eOhz7vsIEaiCyPNPOjibE8GXo=";
   };
 
   disabled = pythonOlder "3.8";
diff --git a/pkgs/games/prismlauncher/0001-launcher-translations-explicitly-convert-QVector-ite.patch b/pkgs/games/prismlauncher/0001-launcher-translations-explicitly-convert-QVector-ite.patch
deleted file mode 100644
index c1e4731d01486..0000000000000
--- a/pkgs/games/prismlauncher/0001-launcher-translations-explicitly-convert-QVector-ite.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From c39637720109dd5d97750907c51e9c0fb8f43f0b Mon Sep 17 00:00:00 2001
-From: Nick Cao <nickcao@nichi.co>
-Date: Wed, 11 Oct 2023 22:51:23 -0400
-Subject: [PATCH] launcher/translations: explicitly convert QVector iterators
- to pointers
-
----
- launcher/translations/TranslationsModel.cpp | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/launcher/translations/TranslationsModel.cpp b/launcher/translations/TranslationsModel.cpp
-index 2763cca2..64c21dbd 100644
---- a/launcher/translations/TranslationsModel.cpp
-+++ b/launcher/translations/TranslationsModel.cpp
-@@ -524,7 +524,7 @@ Language * TranslationsModel::findLanguage(const QString& key)
-     }
-     else
-     {
--        return found;
-+        return &(*found);
-     }
- }
- 
-@@ -655,8 +655,7 @@ QModelIndex TranslationsModel::selectedIndex()
-     auto found = findLanguage(d->m_selectedLanguage);
-     if(found)
-     {
--        // QVector iterator freely converts to pointer to contained type
--        return index(found - d->m_languages.begin(), 0, QModelIndex());
-+        return index(found - &(*d->m_languages.begin()), 0, QModelIndex());
-     }
-     return QModelIndex();
- }
--- 
-2.42.0
-
diff --git a/pkgs/games/prismlauncher/default.nix b/pkgs/games/prismlauncher/default.nix
index 2347c8b53ee71..2409794cdfdcb 100644
--- a/pkgs/games/prismlauncher/default.nix
+++ b/pkgs/games/prismlauncher/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , canonicalize-jars-hook
 , cmake
 , cmark
@@ -23,53 +22,24 @@ let
   libnbtplusplus = fetchFromGitHub {
     owner = "PrismLauncher";
     repo = "libnbtplusplus";
-    rev = "2203af7eeb48c45398139b583615134efd8d407f";
-    sha256 = "sha256-TvVOjkUobYJD9itQYueELJX3wmecvEdCbJ0FinW2mL4=";
+    rev = "a5e8fd52b8bf4ab5d5bcc042b2a247867589985f";
+    hash = "sha256-A5kTgICnx+Qdq3Fir/bKTfdTt/T1NQP2SC+nhN1ENug=";
   };
 in
 
 assert lib.assertMsg (stdenv.isLinux || !gamemodeSupport) "gamemodeSupport is only available on Linux";
 
-stdenv.mkDerivation
-rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "prismlauncher-unwrapped";
-  version = "7.2";
+  version = "8.0";
 
   src = fetchFromGitHub {
     owner = "PrismLauncher";
     repo = "PrismLauncher";
-    rev = version;
-    sha256 = "sha256-RArg60S91YKp1Mt97a5JNfBEOf2cmuX4pK3VAx2WfqM=";
+    rev = finalAttrs.version;
+    hash = "sha256-WBajtfj3qAMq8zd2S53CQyHiyqtvffLOHOjmOpdALAA=";
   };
 
-  patches = [
-    ./0001-launcher-translations-explicitly-convert-QVector-ite.patch
-  ] ++ lib.optionals stdenv.isDarwin [
-    # https://github.com/PrismLauncher/PrismLauncher/pull/1452
-    # These patches allow us to disable the Sparkle updater and cmake bundling
-    # TODO: remove these when updating to 8.0
-    (fetchpatch {
-      name = "disable-sparkle-when-url-is-empty.patch";
-      url = "https://github.com/PrismLauncher/PrismLauncher/commit/48e50401968a72846350c6fbd76cc957b64a6b5a.patch";
-      hash = "sha256-IFxp6Sj87ogQcMooV4Ql5/4B+C7oTzEk+4tlMud2OLo=";
-    })
-    (fetchpatch {
-      name = "make-install_bundle-cached.patch";
-      url = "https://github.com/PrismLauncher/PrismLauncher/commit/a8498b0dab94d0ab6c9e5cf395e5003db541b749.patch";
-      hash = "sha256-ji5GGUnzVut9xFXkynqf9aVR9FO/zsqIbt3P9dexJ2I=";
-    })
-    (fetchpatch {
-      name = "dont-include-sparkle-when-not-enabled.patch";
-      url = "https://github.com/PrismLauncher/PrismLauncher/commit/51bfda937d47837ed426150ed6f43a60b4ca0ce1.patch";
-      hash = "sha256-7hMgANOg4zRIf3F2AfLXGR3dAEBqVmKm/J5SH0G5oCk=";
-    })
-    (fetchpatch {
-      name = "introduce-internal-updater-variable.patch";
-      url = "https://github.com/PrismLauncher/PrismLauncher/commit/b1aa9e584624a0732dd55fc6c459524a8abfe6ba.patch";
-      hash = "sha256-mm++EfnBxz7NVtKLMb889mMq8F/OdQmzob8OmlvNlRA=";
-    })
-  ];
-
   nativeBuildInputs = [ extra-cmake-modules cmake jdk17 ninja canonicalize-jars-hook ];
   buildInputs =
     [
@@ -113,4 +83,4 @@ rec {
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ minion3665 Scrumplex getchoo ];
   };
-}
+})
diff --git a/pkgs/games/shattered-pixel-dungeon/disable-git-version.patch b/pkgs/games/shattered-pixel-dungeon/disable-git-version.patch
index b7d051541d177..fb905939f66d5 100644
--- a/pkgs/games/shattered-pixel-dungeon/disable-git-version.patch
+++ b/pkgs/games/shattered-pixel-dungeon/disable-git-version.patch
@@ -21,7 +21,7 @@ diff --git a/build.gradle b/build.gradle
          appName = 'Summoning Pixel Dungeon'
          appPackageName = 'com.trashboxbobylev.summoningpixeldungeon'
  
-         appVersionCode = 430
+         appVersionCode = 432
 -        appVersionName = '@version@-' + details.gitHash.substring(0, 7)
 +        appVersionName = '@version@'
  
diff --git a/pkgs/games/shattered-pixel-dungeon/summoning-pixel-dungeon.nix b/pkgs/games/shattered-pixel-dungeon/summoning-pixel-dungeon.nix
index beec48b746cc8..488110684c096 100644
--- a/pkgs/games/shattered-pixel-dungeon/summoning-pixel-dungeon.nix
+++ b/pkgs/games/shattered-pixel-dungeon/summoning-pixel-dungeon.nix
@@ -6,14 +6,14 @@
 
 callPackage ./generic.nix rec {
   pname = "summoning-pixel-dungeon";
-  version = "1.2.5";
+  version = "1.2.5a";
 
   src = fetchFromGitHub {
     owner = "TrashboxBobylev";
     repo = "Summoning-Pixel-Dungeon";
     # The GH release is named "$version-$hash", but it's actually a mutable "_latest" tag
-    rev = "fc63a89a0f9bdf9cb86a750dfec65bc56d9fddcb";
-    hash = "sha256-n1YR7jYJ8TQFe654aERgmOHRgaPZ82eXxu0K12/5MGw=";
+    rev = "89ff59e7f42abcc88b7a1f24391f95ddc30f9d29";
+    hash = "sha256-VQcWkbGe/0qyt3M5WWgTxczwC5mE3lRHbYidOwRoukI=";
   };
 
   patches = [(substitute {
diff --git a/pkgs/os-specific/linux/evdi/default.nix b/pkgs/os-specific/linux/evdi/default.nix
index 894ff5652bbb0..bd34ac0db4d31 100644
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@@ -16,7 +16,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-em3Y56saB7K3Wr31Y0boc38xGb57gdveN0Cstgy8y20=";
   };
 
-  env.NIX_CFLAGS_COMPILE = "-Wno-error -Wno-error=sign-compare";
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error"
+    "-Wno-error=discarded-qualifiers" # for Linux 4.19 compatibility
+    "-Wno-error=sign-compare"
+  ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
@@ -43,6 +47,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = with licenses; [ lgpl21Only gpl2Only ];
     homepage = "https://www.displaylink.com/";
-    broken = kernel.kernelOlder "4.19";
+    broken = kernel.kernelOlder "4.19" || kernel.kernelAtLeast "6.6";
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 33b7f88493df9..d8f8bb2fa73f9 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -52,21 +52,31 @@
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.60-hardened1.patch",
-            "sha256": "1k0807jpjljf2fcjxnmvd9rb8y8xqj21x2qn4yd72c58jkii52qq",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.60-hardened1/linux-hardened-6.1.60-hardened1.patch"
+            "name": "linux-hardened-6.1.61-hardened1.patch",
+            "sha256": "0d9zhh32dx1q828q50kmznmsa6yinppbklhgg8ix7b7k23857ha6",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.61-hardened1/linux-hardened-6.1.61-hardened1.patch"
         },
-        "sha256": "02pvymr1dgd36mp7yikxqqv0sfrpwi1grnvxvx6jbbx6wmx0wljq",
-        "version": "6.1.60"
+        "sha256": "1kk4d7ph6pvgdrdmaklg15wf58nw9n7yqgkag7jdvqinzh99sb5d",
+        "version": "6.1.61"
+    },
+    "6.4": {
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-6.4.16-hardened1.patch",
+            "sha256": "10lydnnhhq9ynng1gfaqh1mncsb0dmr27zzcbygs1xigy2bl70n9",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.16-hardened1/linux-hardened-6.4.16-hardened1.patch"
+        },
+        "sha256": "0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln",
+        "version": "6.4.16"
     },
     "6.5": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.5.8-hardened1.patch",
-            "sha256": "09dvz9massj8rwrwvr2n1y2v8k4c3ic8gfrp049p7g0npzag2cwl",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.5.8-hardened1/linux-hardened-6.5.8-hardened1.patch"
+            "name": "linux-hardened-6.5.10-hardened1.patch",
+            "sha256": "0p2lj7ryiizr1sxvm2kgds3l8sg9fns35y2fcyqq61lg7ymzj1fi",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.5.10-hardened1/linux-hardened-6.5.10-hardened1.patch"
         },
-        "sha256": "05zpdh4dxaadq52hlczdmwb7bsqfm3q45v7bdqbsmplhgn4wm719",
-        "version": "6.5.8"
+        "sha256": "12sswml8jvabv6bqx35lg3jj6gq8jjk365rghjngdy5d0j34jpx1",
+        "version": "6.5.10"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 082223924995f..967489745f5e2 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -4,16 +4,16 @@
         "hash": "sha256:1zzd32ya4hldfywicgpnc2cyd412s7q9c31qvxx2nl9nkx11xsxv"
     },
     "6.5": {
-        "version": "6.5.10",
-        "hash": "sha256:12sswml8jvabv6bqx35lg3jj6gq8jjk365rghjngdy5d0j34jpx1"
+        "version": "6.5.11",
+        "hash": "sha256:06dmb4hbwrms0lp4axphwgj8wbnzsym70sx55lxr501b53wlmqif"
     },
     "6.4": {
         "version": "6.4.16",
         "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
     },
     "6.1": {
-        "version": "6.1.61",
-        "hash": "sha256:1kk4d7ph6pvgdrdmaklg15wf58nw9n7yqgkag7jdvqinzh99sb5d"
+        "version": "6.1.62",
+        "hash": "sha256:1v453q4sf0j8708ivs1zmdf645hgimqvxfc8xz7czgnnmipn3zdr"
     },
     "5.15": {
         "version": "5.15.137",
@@ -24,19 +24,19 @@
         "hash": "sha256:1h944syk7n6c4j1djlx19n77alzwbxcdza77c9ykicgfynhpgsm0"
     },
     "5.4": {
-        "version": "5.4.259",
-        "hash": "sha256:195v4fidavzm637glj6580006mrcaygnbj4za874imb62bxf9rpz"
+        "version": "5.4.260",
+        "hash": "sha256:1zpbaipd2j3idj8h9iznlj0ywcq5nkhwj707a1f9ixf82h3q4c4q"
     },
     "4.19": {
-        "version": "4.19.297",
-        "hash": "sha256:0c9xxqgv2i36hrr06dwz7f3idc04xpv0a5pxg08xdh03cnyf12cx"
+        "version": "4.19.298",
+        "hash": "sha256:0mhgq6hdcls1af7nj999x1mds5b37s7vwin8nsb4q0lnx2y1da4x"
     },
     "4.14": {
-        "version": "4.14.328",
-        "hash": "sha256:1igcpvnhwwrczfdsafmszvi0456k7f6j4cgpfw6v6afw09p95d8x"
+        "version": "4.14.329",
+        "hash": "sha256:1dvb4xf0b7snabznl7bg7gga7ffdmywy8vr8q65pzl9yf6fnhdny"
     },
     "6.6": {
-        "version": "6.6",
-        "hash": "sha256:1l2nisx9lf2vdgkq910n5ldbi8z25ky1zvl67zgwg2nxcdna09nr"
+        "version": "6.6.1",
+        "hash": "sha256:0d42b1hbvv9w3y3q4wydr6il0g5a823n54a06p4p5vcpgkadf7ns"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 5b418b6a7cc66..5e949a6f461ec 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.6"; #zen
+    version = "6.6.1"; #zen
     suffix = "zen1"; #zen
-    sha256 = "0rda54h5lg2llbwkj2h4mqfshjyha1dzlcwhx099is7g2lfzksxx"; #zen
+    sha256 = "13m820wggf6pkp351w06mdn2lfcwbn08ydwksyxilqb88vmr0lpq"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.5.10"; #lqx
+    version = "6.5.11"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "10bny5x2a3brfamyajvnl75h7s64vvmymgnvwgaq82q4bmsfcdd1"; #lqx
+    sha256 = "02k4cfiygrfgyp3x6ivr7h6klknjzd5cwpszjnzcy2jc547512pd"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/servers/dns/trust-dns/default.nix b/pkgs/servers/dns/trust-dns/default.nix
index 88280cf518772..03814c365d7eb 100644
--- a/pkgs/servers/dns/trust-dns/default.nix
+++ b/pkgs/servers/dns/trust-dns/default.nix
@@ -7,15 +7,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "trust-dns";
-  version = "0.23.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
-    owner = "bluejekyll";
-    repo = "trust-dns";
+    owner = "hickory-dns";
+    repo = "hickory-dns";
     rev = "v${version}";
-    sha256 = "sha256-CfFEhZEk1Z7VG0n8EvyQwHvZIOEES5GKpm5tMeqhRVY=";
+    hash = "sha256-w87WpuFKSOdObNiqET/pp2sJql1q0+xyns8+nMPj0xE=";
   };
-  cargoHash = "sha256-jmow/jtdbuKFovXWA5xbgM67iJmkwP35hiOivIJ5JdM=";
+  cargoHash = "sha256-sLhhwSsyzdxq7V9rpD42cu76T1mt4uCOx2NAmIf5sF8=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];
@@ -29,5 +29,6 @@ rustPlatform.buildRustPackage rec {
     maintainers = with maintainers; [ colinsane ];
     platforms = platforms.linux;
     license = with licenses; [ asl20 mit ];
+    mainProgram = "hickory-dns";
   };
 }
diff --git a/pkgs/servers/nfs-ganesha/default.nix b/pkgs/servers/nfs-ganesha/default.nix
index f68fe3969b219..7c46ba3461430 100644
--- a/pkgs/servers/nfs-ganesha/default.nix
+++ b/pkgs/servers/nfs-ganesha/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nfs-ganesha";
-  version = "5.6";
+  version = "5.7";
 
   src = fetchFromGitHub {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     rev = "V${version}";
-    sha256 = "sha256-QXs42HY2h/s2cT1pG2QjSV2HVAjpo2WSymXEYGgF8rI=";
+    sha256 = "sha256-4GYte9kPUR4kFHrUzHXtiMGbuRhZ+4iw1hmqi+geljc=";
   };
 
   preConfigure = "cd src";
diff --git a/pkgs/servers/nosql/mongodb/5.0.nix b/pkgs/servers/nosql/mongodb/5.0.nix
index 16a4ccef56081..05fed1ac92043 100644
--- a/pkgs/servers/nosql/mongodb/5.0.nix
+++ b/pkgs/servers/nosql/mongodb/5.0.nix
@@ -6,8 +6,8 @@ let
   };
   variants = if stdenv.isLinux then
     {
-      version = "5.0.21";
-      sha256 = "sha256-knAqb6bT1KpO1Gi4sKhG22OtCPhOR3NMmhRjUgseUPM=";
+      version = "5.0.22";
+      sha256 = "sha256-NIsx6nwXGsuk+ff+LOCwOMpT/HAaNn89t4jtJvKprIA=";
       patches = [ ./fix-build-with-boost-1.79-5_0-linux.patch ];
     }
   else lib.optionalAttrs stdenv.isDarwin
diff --git a/pkgs/servers/nosql/mongodb/6.0.nix b/pkgs/servers/nosql/mongodb/6.0.nix
index 12110393f9bc3..8d7d6fbe78f64 100644
--- a/pkgs/servers/nosql/mongodb/6.0.nix
+++ b/pkgs/servers/nosql/mongodb/6.0.nix
@@ -6,8 +6,8 @@ let
   };
 in
 buildMongoDB {
-  version = "6.0.10";
-  sha256 = "sha256-7YJ0Ndyl635ebDWuIGfC5DFIGUXr518ghC/0Qq42HEM=";
+  version = "6.0.11";
+  sha256 = "sha256-hIbbCDQ0Sqnm6ohtEpbdGWk18nLIlr6T0T9UL6WAFA8=";
   patches = [
     (fetchpatch {
       name = "mongodb-6.1.0-rc-more-specific-cache-alignment-types.patch";
diff --git a/pkgs/servers/onlyoffice-documentserver/default.nix b/pkgs/servers/onlyoffice-documentserver/default.nix
index 2b5b34eb3de9d..ea5a35eeb78ff 100644
--- a/pkgs/servers/onlyoffice-documentserver/default.nix
+++ b/pkgs/servers/onlyoffice-documentserver/default.nix
@@ -15,11 +15,11 @@ let
   # var/www/onlyoffice/documentserver/server/DocService/docservice
   onlyoffice-documentserver = stdenv.mkDerivation rec {
     pname = "onlyoffice-documentserver";
-    version = "7.4.1";
+    version = "7.5.0";
 
     src = fetchurl {
       url = "https://github.com/ONLYOFFICE/DocumentServer/releases/download/v${lib.concatStringsSep "." (lib.take 3 (lib.splitVersion version))}/onlyoffice-documentserver_amd64.deb";
-      sha256 = "sha256-60S8M1Y9BxuMxXGxEaxW82Va5lSnZZPfQnPq2ivTXdU=";
+      sha256 = "sha256-0rtxKSVIyCzYnhRneLOEu1e1qtAO6dGBAUr/oKq95Hw=";
     };
 
     preferLocalBuild = true;
diff --git a/pkgs/tools/admin/pulumi-packages/pulumi-azure-native.nix b/pkgs/tools/admin/pulumi-packages/pulumi-azure-native.nix
index 74d9bb28a5013..76a5eff2973ef 100644
--- a/pkgs/tools/admin/pulumi-packages/pulumi-azure-native.nix
+++ b/pkgs/tools/admin/pulumi-packages/pulumi-azure-native.nix
@@ -4,10 +4,10 @@
 mkPulumiPackage rec {
   owner = "pulumi";
   repo = "pulumi-azure-native";
-  version = "2.11.0";
+  version = "2.13.0";
   rev = "v${version}";
-  hash = "sha256-qz/dCQR4BV+noJj7WPGuzDNMaR7I/D01F7FfvxU8z28=";
-  vendorHash = "sha256-SICms1JJk8Q10XWC69bw/RXsIPL43l1s+Aqy+cLOwRI=";
+  hash = "sha256-YyJxACeXyY7hZkTbLXT/ASNWa1uv9h3cvPoItR183fU=";
+  vendorHash = "sha256-20wHbNE/fenxP9wgTSzAnx6b1UYlw4i1fi6SesTs0sc=";
   cmdGen = "pulumi-gen-azure-native";
   cmdRes = "pulumi-resource-azure-native";
   extraLdflags = [
diff --git a/pkgs/tools/backup/sigtop/default.nix b/pkgs/tools/backup/sigtop/default.nix
index f7aae8165ef52..ab46893b0d212 100644
--- a/pkgs/tools/backup/sigtop/default.nix
+++ b/pkgs/tools/backup/sigtop/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   name = "sigtop";
-  version = "0.3.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "tbvdm";
     repo = "sigtop";
     rev = "v${version}";
-    sha256 = "sha256-U+S+VXRkedq2LkO9Fw/AfNS97GvFEfjD8dq/VMlBOv4=";
+    sha256 = "sha256-goGvgn1QyWqipcrBvO27BjzFbp7cIPFWzWJaOpp2/1Q=";
   };
 
-  vendorHash = "sha256-xrJ/KLM/f/HVPL4MJzRc1xDlO4e+Iu2lcPG4GnjFRBo=";
+  vendorHash = "sha256-K33VZeyOFoLLo64FuYt9bxJvaESSlHEy/2O8kLxxL5U=";
 
   makeFlags = [
     "PREFIX=\${out}"
@@ -20,7 +20,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Utility to export messages, attachments and other data from Signal Desktop";
     license = licenses.isc;
-    platforms = platforms.darwin;
+    platforms = platforms.all;
     maintainers = with maintainers; [ fricklerhandwerk ];
   };
 }
diff --git a/pkgs/tools/llm/heygpt/default.nix b/pkgs/tools/llm/heygpt/default.nix
index 3ec475c764781..db11d391d7a14 100644
--- a/pkgs/tools/llm/heygpt/default.nix
+++ b/pkgs/tools/llm/heygpt/default.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
     owner = "fuyufjh";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-gTyjj7NND5IYtnXhc454cWSzhAE+DwfPRGEWrHH+GNM=";
+    hash = "sha256-oP0yIdYytXSsbZ2pNaZ8Rrak1qJsudTe/oP6dGncGUM=";
   };
 
   cargoHash = "sha256-yKHAZpELuUD7wlM3Mi7XvxbKgdU1QxD9hsvIFcj3twE=";
diff --git a/pkgs/tools/misc/envchain/default.nix b/pkgs/tools/misc/envchain/default.nix
index 938beff335323..4446400c2f75f 100644
--- a/pkgs/tools/misc/envchain/default.nix
+++ b/pkgs/tools/misc/envchain/default.nix
@@ -27,6 +27,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/sorah/envchain";
     license = licenses.mit;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ bbigras ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/misc/fastfetch/default.nix b/pkgs/tools/misc/fastfetch/default.nix
index ced223496bf48..adab3390de1d2 100644
--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@@ -43,13 +43,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.2.1";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-7g2p33j97hu26xwBLrakc7/bIpYHNTC5jqCj/Fs4fKo=";
+    hash = "sha256-JaD0R1vfHoWMhipMtTW0dlggR7RbD2evHfHrjoZJBmk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/pazi/default.nix b/pkgs/tools/misc/pazi/default.nix
index 08adb3c199de2..661029cb61c45 100644
--- a/pkgs/tools/misc/pazi/default.nix
+++ b/pkgs/tools/misc/pazi/default.nix
@@ -19,6 +19,6 @@ rustPlatform.buildRustPackage rec {
     description = "An autojump \"zap to directory\" helper";
     homepage = "https://github.com/euank/pazi";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ bbigras ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/tools/misc/starship/default.nix b/pkgs/tools/misc/starship/default.nix
index 523532904e356..f1e9a0246c5cc 100644
--- a/pkgs/tools/misc/starship/default.nix
+++ b/pkgs/tools/misc/starship/default.nix
@@ -55,7 +55,7 @@ rustPlatform.buildRustPackage rec {
     description = "A minimal, blazing fast, and extremely customizable prompt for any shell";
     homepage = "https://starship.rs";
     license = licenses.isc;
-    maintainers = with maintainers; [ bbigras danth davidtwco Br1ght0ne Frostman marsam ];
+    maintainers = with maintainers; [ danth davidtwco Br1ght0ne Frostman marsam ];
     mainProgram = "starship";
   };
 }
diff --git a/pkgs/tools/misc/tab-rs/default.nix b/pkgs/tools/misc/tab-rs/default.nix
index 3b463f22df078..4478cb4bcb611 100644
--- a/pkgs/tools/misc/tab-rs/default.nix
+++ b/pkgs/tools/misc/tab-rs/default.nix
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
     description = "Intuitive, config-driven terminal multiplexer designed for software & systems engineers";
     homepage = "https://github.com/austinjones/tab-rs";
     license = licenses.mit;
-    maintainers = with maintainers; [ bbigras ];
+    maintainers = with maintainers; [ ];
     mainProgram = "tab";
   };
 }
diff --git a/pkgs/tools/misc/zellij/default.nix b/pkgs/tools/misc/zellij/default.nix
index 670ad866dff87..6274dae69489c 100644
--- a/pkgs/tools/misc/zellij/default.nix
+++ b/pkgs/tools/misc/zellij/default.nix
@@ -3,6 +3,7 @@
 , rustPlatform
 , stdenv
 , installShellFiles
+, perl
 , pkg-config
 , libiconv
 , openssl
@@ -15,20 +16,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zellij";
-  version = "0.38.2";
+  version = "0.39.0";
 
   src = fetchFromGitHub {
     owner = "zellij-org";
     repo = "zellij";
     rev = "v${version}";
-    hash = "sha256-rq7M4g+s44j9jh5GzOjOCBr7VK3m/EQej/Qcnp67NhY=";
+    hash = "sha256-ZKtYXUNuBwQtEHTaPlptiRncFWattkkcAGGzbKalJZE=";
   };
 
-  cargoHash = "sha256-xK7lLgjVFUISo4stF6MgfgI4mT5qHuph70cyYaLYZ30=";
+  cargoHash = "sha256-4XRCXQYJaYvnIfEK2b0VuLy/HIFrafLrK9BvZMnCKpY=";
 
   nativeBuildInputs = [
     mandown
     installShellFiles
+    perl
     pkg-config
   ];
 
diff --git a/pkgs/tools/networking/dogdns/default.nix b/pkgs/tools/networking/dogdns/default.nix
index 0677704b7ad51..e368e10715e62 100644
--- a/pkgs/tools/networking/dogdns/default.nix
+++ b/pkgs/tools/networking/dogdns/default.nix
@@ -63,7 +63,7 @@ rustPlatform.buildRustPackage rec {
     description = "Command-line DNS client";
     homepage = "https://dns.lookup.dog";
     license = licenses.eupl12;
-    maintainers = with maintainers; [ bbigras figsoda ];
+    maintainers = with maintainers; [ figsoda ];
     mainProgram = "dog";
   };
 }
diff --git a/pkgs/tools/networking/gping/default.nix b/pkgs/tools/networking/gping/default.nix
index 6e9e32f361e19..158b2cb275bc1 100644
--- a/pkgs/tools/networking/gping/default.nix
+++ b/pkgs/tools/networking/gping/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gping";
-  version = "1.14.0";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = "gping";
     rev = "gping-v${version}";
-    hash = "sha256-ReP+s2p0X39LVvl3/QF7fsYkU+OvsQyMhyuH8v4HuVU=";
+    hash = "sha256-22Nio6yfkL9HWNrI+kk5dGfojTtB/h0sizCWH9w9so8=";
   };
 
-  cargoHash = "sha256-FTiNxCoEe/iMz68F1CpJHypgrhn4WwwWowuN9I1rl6E=";
+  cargoHash = "sha256-YfvcCnFXDoZXp/Aug0jVQkilsvSzS+JF90U0QvVFksE=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
 
diff --git a/pkgs/tools/networking/picosnitch/default.nix b/pkgs/tools/networking/picosnitch/default.nix
index e23db9cc4e3eb..ddd07d28f292a 100644
--- a/pkgs/tools/networking/picosnitch/default.nix
+++ b/pkgs/tools/networking/picosnitch/default.nix
@@ -6,11 +6,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "picosnitch";
-  version = "0.14.0";
+  version = "1.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b58255a78a0bf652224ee22ca83137d75ea77b7eb1ad2d11159b56b6788f6201";
+    sha256 = "5d427eb46de448e4109f68ed435dd38426df8200aea5bb668639aabe1f0b4580";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/age/default.nix b/pkgs/tools/security/age/default.nix
index 8ad4ff9c904c5..ea8108fde301c 100644
--- a/pkgs/tools/security/age/default.nix
+++ b/pkgs/tools/security/age/default.nix
@@ -53,6 +53,11 @@ buildGoModule rec {
     fi
   '';
 
+  # plugin test is flaky, see https://github.com/FiloSottile/age/issues/517
+  checkFlags = [
+    "-skip" "TestScript/plugin"
+  ];
+
   meta = with lib; {
     homepage = "https://age-encryption.org/";
     description = "Modern encryption tool with small explicit keys";
diff --git a/pkgs/tools/security/cosign/default.nix b/pkgs/tools/security/cosign/default.nix
index c08a8cf1dd171..3e8acc96f29ee 100644
--- a/pkgs/tools/security/cosign/default.nix
+++ b/pkgs/tools/security/cosign/default.nix
@@ -13,13 +13,13 @@
 }:
 buildGoModule rec {
   pname = "cosign";
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-VE/rm85KZs3JWMsidIlUGJ9JrtZ4VBI+Go1yujq7z1s=";
+    hash = "sha256-J/CQonW/ICrNUSQXVZPMR+WACZYJH0eH6bXhdXE27TY=";
   };
 
   buildInputs =
@@ -28,7 +28,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
 
-  vendorHash = "sha256-mpT4/BS/NofMueBbwhh4v6pNEONEpWM9RDKuYZ+9BtA=";
+  vendorHash = "sha256-RPwU6W6a9mnfriyz3ASvamZ3jEG6C2ug/MTp1Pahc/Q=";
 
   subPackages = [
     "cmd/cosign"
@@ -52,6 +52,7 @@ buildGoModule rec {
     rm pkg/cosign/ctlog_test.go # Require network access
     rm pkg/cosign/tlog_test.go # Require network access
     rm cmd/cosign/cli/verify/verify_blob_attestation_test.go # Require network access
+    rm cmd/cosign/cli/verify/verify_blob_test.go # Require network access
   '';
 
   postInstall = ''
diff --git a/pkgs/tools/security/vaultwarden/default.nix b/pkgs/tools/security/vaultwarden/default.nix
index 613073404e7ef..1239b4fd1c6bb 100644
--- a/pkgs/tools/security/vaultwarden/default.nix
+++ b/pkgs/tools/security/vaultwarden/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, callPackage, rustPlatform, fetchFromGitHub, nixosTests
 , pkg-config, openssl
-, libiconv, Security, CoreServices
+, libiconv, Security, CoreServices, SystemConfiguration
 , dbBackend ? "sqlite", libmysqlclient, postgresql }:
 
 let
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = with lib; [ openssl ]
-    ++ optionals stdenv.isDarwin [ libiconv Security CoreServices ]
+    ++ optionals stdenv.isDarwin [ libiconv Security CoreServices SystemConfiguration ]
     ++ optional (dbBackend == "mysql") libmysqlclient
     ++ optional (dbBackend == "postgresql") postgresql;
 
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 3c48c53bf90c5..e6f65a8c0f5e1 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -13,12 +13,13 @@
 , withConnPubSub ? false, google-cloud-cpp, grpc
 , withConnPrometheus ? false, snappy
 , withSsl ? true, openssl
+, withSystemdJournal ? (!stdenv.isDarwin), systemd
 , withDebug ? false
 }:
 
 stdenv.mkDerivation rec {
   # Don't forget to update go.d.plugin.nix as well
-  version = "1.43.0";
+  version = "1.43.2";
   pname = "netdata";
 
   src = fetchFromGitHub {
@@ -26,8 +27,8 @@ stdenv.mkDerivation rec {
     repo = "netdata";
     rev = "v${version}";
     hash = if withCloudUi
-      then "sha256-hrwuJLO9/K5QT3j8d5RYHcpBHChpKvwajaCoUfikw88="
-      else "sha256-+bX6pVpW6N1ms04k63sJg0E9XMOai5K9IjEQPeVCzs8=";
+      then "sha256-ZhSuU2VTJPFJ3ja5eHx5uTuR19LleoID8Efr9FTyg74="
+      else "sha256-t2awo118mYbuoNiKiAxM5xpRmQSha+/NR5G+shsotek=";
     fetchSubmodules = true;
 
     # Remove v2 dashboard distributed under NCUL1. Make sure an empty
@@ -52,6 +53,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withConnPubSub [ google-cloud-cpp grpc ]
     ++ lib.optionals withConnPrometheus [ snappy ]
     ++ lib.optionals (withCloud || withConnPrometheus) [ protobuf ]
+    ++ lib.optionals withSystemdJournal [ systemd ]
     ++ lib.optionals withSsl [ openssl ];
 
   patches = [
@@ -93,6 +95,10 @@ stdenv.mkDerivation rec {
        $out/libexec/netdata/plugins.d/perf.plugin.org
     mv $out/libexec/netdata/plugins.d/slabinfo.plugin \
        $out/libexec/netdata/plugins.d/slabinfo.plugin.org
+    ${lib.optionalString withSystemdJournal ''
+      mv $out/libexec/netdata/plugins.d/systemd-journal.plugin \
+         $out/libexec/netdata/plugins.d/systemd-journal.plugin.org
+    ''}
     ${lib.optionalString withIpmi ''
       mv $out/libexec/netdata/plugins.d/freeipmi.plugin \
          $out/libexec/netdata/plugins.d/freeipmi.plugin.org
@@ -109,6 +115,8 @@ stdenv.mkDerivation rec {
     "--sysconfdir=/etc"
     "--disable-ebpf"
     "--with-jemalloc=${jemalloc}"
+  ] ++ lib.optionals (withSystemdJournal) [
+    "--enable-plugin-systemd-journal"
   ] ++ lib.optionals (!withDBengine) [
     "--disable-dbengine"
   ] ++ lib.optionals (!withCloud) [
diff --git a/pkgs/tools/system/netdata/go.d.plugin.nix b/pkgs/tools/system/netdata/go.d.plugin.nix
index 2114374bc61b9..6e64d33f7fb9e 100644
--- a/pkgs/tools/system/netdata/go.d.plugin.nix
+++ b/pkgs/tools/system/netdata/go.d.plugin.nix
@@ -2,16 +2,16 @@
 
 buildGo121Module rec {
   pname = "netdata-go-plugins";
-  version = "0.56.3";
+  version = "0.56.4";
 
   src = fetchFromGitHub {
     owner = "netdata";
     repo = "go.d.plugin";
     rev = "v${version}";
-    hash = "sha256-T7UB7qrcMTqIFRzBxbXmSqtcEFgZd0/z4EYuH/ydVi4=";
+    hash = "sha256-7dR1TL2Ycb+7yHoFklrKdXXxIG4Tx+fAG5ScAAtbVRw=";
   };
 
-  vendorHash = "sha256-N0p03urHC3d17VQ4TIs7mAemW9ZSpQw20EwwD6lSLLc=";
+  vendorHash = "sha256-Faa+7tT3sPxlT6eQEmFotOJnt9b49ffDPEHt5V7tQa0=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/system/zenith/default.nix b/pkgs/tools/system/zenith/default.nix
index 4318ba492aeec..52ad79fab689a 100644
--- a/pkgs/tools/system/zenith/default.nix
+++ b/pkgs/tools/system/zenith/default.nix
@@ -48,7 +48,7 @@ rustPlatform.buildRustPackage rec {
       + lib.optionalString nvidiaSupport ", and NVIDIA GPU usage";
     homepage = "https://github.com/bvaisvil/zenith";
     license = licenses.mit;
-    maintainers = with maintainers; [ bbigras ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/typesetting/tex/texlive/build-tex-env.nix b/pkgs/tools/typesetting/tex/texlive/build-tex-env.nix
index 99eb67aa6ff2a..41231ae1b186a 100644
--- a/pkgs/tools/typesetting/tex/texlive/build-tex-env.nix
+++ b/pkgs/tools/typesetting/tex/texlive/build-tex-env.nix
@@ -40,9 +40,10 @@ lib.fix (self: {
 let
   ### texlive.combine backward compatibility
   # if necessary, convert old style { pkgs = [ ... ]; } packages to attribute sets
-  ensurePkgSets = ps: if ! __fromCombineWrapper && builtins.any (p: p ? pkgs && builtins.all (p: p ? tlType) p.pkgs) ps
-    then let oldStyle = builtins.partition (p: p ? pkgs && builtins.all (p: p ? tlType) p.pkgs) ps;
-      in oldStyle.wrong ++ lib.concatMap toTLPkgSets oldStyle.right
+  isOldPkgList = p: ! p.outputSpecified or false && p ? pkgs && builtins.all (p: p ? tlType) p.pkgs;
+  ensurePkgSets = ps: if ! __fromCombineWrapper && builtins.any isOldPkgList ps
+    then let oldPkgLists = builtins.partition isOldPkgList ps;
+      in oldPkgLists.wrong ++ lib.concatMap toTLPkgSets oldPkgLists.right
     else ps;
 
   pkgList = rec {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3ec4961fca23f..8388ef624c6b2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2506,6 +2506,8 @@ with pkgs;
 
   gst = callPackage ../applications/version-management/gst { };
 
+  guilt = callPackage ../applications/version-management/guilt { };
+
   gut = callPackage ../applications/version-management/gut { };
 
   hred = callPackage ../development/tools/hred { };
@@ -33933,7 +33935,7 @@ with pkgs;
     wlroots = wlroots_0_15;
   };
 
-  mpvScripts = import ../applications/video/mpv/scripts { inherit lib callPackage config; };
+  mpvScripts = callPackage ../applications/video/mpv/scripts { };
 
   open-in-mpv = callPackage ../applications/video/open-in-mpv { };
 
@@ -34140,9 +34142,7 @@ with pkgs;
 
   pnglatex = with python3Packages; toPythonApplication pnglatex;
 
-  polybar = callPackage ../applications/misc/polybar { };
-
-  polybarFull = callPackage ../applications/misc/polybar {
+  polybarFull = polybar.override {
     alsaSupport = true;
     githubSupport = true;
     mpdSupport = true;
@@ -35862,7 +35862,9 @@ with pkgs;
 
   tofi = callPackage ../applications/misc/tofi { };
 
-  tokyo-night-gtk = callPackage ../data/themes/tokyo-night-gtk { };
+  tokyo-night-gtk = tokyo-night-gtk-variants.full;
+
+  tokyo-night-gtk-variants = recurseIntoAttrs (callPackage ../data/themes/tokyo-night-gtk { });
 
   topydo = callPackage ../applications/misc/topydo { };
 
@@ -37318,7 +37320,7 @@ with pkgs;
 
   heroic-unwrapped = callPackage ../games/heroic {
     # Match the version used by the upstream package.
-    electron = electron_24;
+    electron = electron_27;
   };
 
   heroic = callPackage ../games/heroic/fhsenv.nix { };
@@ -41251,7 +41253,7 @@ with pkgs;
   vazir-code-font = callPackage ../data/fonts/vazir-code-font { };
 
   vaultwarden = callPackage ../tools/security/vaultwarden {
-    inherit (darwin.apple_sdk.frameworks) Security CoreServices;
+    inherit (darwin.apple_sdk.frameworks) Security CoreServices SystemConfiguration;
   };
   vaultwarden-sqlite = vaultwarden;
   vaultwarden-mysql = vaultwarden.override { dbBackend = "mysql"; };
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index e0ccb6aa9a084..3810390f7862f 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -266,6 +266,8 @@ lib.makeScope pkgs.newScope (self: with self; {
 
     meminfo = callPackage ../development/php-packages/meminfo { };
 
+    memprof = callPackage ../development/php-packages/memprof { };
+
     mongodb = callPackage ../development/php-packages/mongodb {
       inherit (pkgs) darwin;
     };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b51096ec9919a..54f155f47c95f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1573,6 +1573,8 @@ self: super: with self; {
     enablePython = true;
   });
 
+  bork = callPackage ../development/python-modules/bork { };
+
   boschshcpy = callPackage ../development/python-modules/boschshcpy { };
 
   bottombar = callPackage ../development/python-modules/bottombar { };
@@ -3787,6 +3789,8 @@ self: super: with self; {
 
   farama-notifications = callPackage ../development/python-modules/farama-notifications { };
 
+  farm-haystack = callPackage ../development/python-modules/farm-haystack { };
+
   fastai = callPackage ../development/python-modules/fastai { };
 
   fastapi = callPackage ../development/python-modules/fastapi { };
@@ -12014,7 +12018,7 @@ self: super: with self; {
 
   rangehttpserver = callPackage ../development/python-modules/rangehttpserver { };
 
-  rank_bm25 = callPackage ../development/python-modules/rank_bm25 { };
+  rank-bm25 = callPackage ../development/python-modules/rank-bm25 { };
 
   rapidfuzz = callPackage ../development/python-modules/rapidfuzz { };
 
@@ -15976,6 +15980,8 @@ self: super: with self; {
 
   zc_lockfile = callPackage ../development/python-modules/zc_lockfile { };
 
+  zcbor = callPackage ../development/python-modules/zcbor { };
+
   zconfig = callPackage ../development/python-modules/zconfig { };
 
   zcs = callPackage ../development/python-modules/zcs { };