about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/CODEOWNERS8
-rw-r--r--.github/PULL_REQUEST_TEMPLATE.md4
-rw-r--r--CONTRIBUTING.md2
-rw-r--r--doc/languages-frameworks/python.section.md1
-rw-r--r--maintainers/maintainer-list.nix91
-rw-r--r--maintainers/scripts/luarocks-packages.csv1
-rw-r--r--maintainers/scripts/pluginupdate.py5
-rw-r--r--maintainers/team-list.nix1
-rw-r--r--nixos/doc/manual/development/activation-script.section.md2
-rw-r--r--nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md4
-rw-r--r--nixos/doc/manual/release-notes/rl-2311.section.md10
-rw-r--r--nixos/lib/test-driver/test_driver/machine.py22
-rw-r--r--nixos/modules/config/fanout.nix49
-rw-r--r--nixos/modules/config/iproute2.nix2
-rw-r--r--nixos/modules/config/qt.nix165
-rw-r--r--nixos/modules/config/stevenblack.nix2
-rw-r--r--nixos/modules/hardware/corectrl.nix4
-rw-r--r--nixos/modules/hardware/i2c.nix2
-rw-r--r--nixos/modules/hardware/keyboard/uhk.nix2
-rw-r--r--nixos/modules/hardware/keyboard/zsa.nix2
-rw-r--r--nixos/modules/hardware/openrazer.nix2
-rw-r--r--nixos/modules/hardware/tuxedo-keyboard.nix2
-rw-r--r--nixos/modules/hardware/video/nvidia.nix26
-rw-r--r--nixos/modules/hardware/video/webcam/facetimehd.nix2
-rw-r--r--nixos/modules/misc/ids.nix4
-rw-r--r--nixos/modules/misc/nixops-autoluks.nix2
-rw-r--r--nixos/modules/module-list.nix4
-rw-r--r--nixos/modules/programs/calls.nix2
-rw-r--r--nixos/modules/programs/cnping.nix2
-rw-r--r--nixos/modules/programs/direnv.nix2
-rw-r--r--nixos/modules/programs/feedbackd.nix4
-rw-r--r--nixos/modules/programs/firefox.nix25
-rw-r--r--nixos/modules/programs/fish.nix4
-rw-r--r--nixos/modules/programs/kdeconnect.nix2
-rw-r--r--nixos/modules/programs/wayland/wayfire.nix2
-rw-r--r--nixos/modules/rename.nix1
-rw-r--r--nixos/modules/security/apparmor/profiles.nix6
-rw-r--r--nixos/modules/services/backup/znapzend.nix20
-rw-r--r--nixos/modules/services/databases/cassandra.nix2
-rw-r--r--nixos/modules/services/databases/ferretdb.nix2
-rw-r--r--nixos/modules/services/databases/redis.nix2
-rw-r--r--nixos/modules/services/databases/surrealdb.nix2
-rw-r--r--nixos/modules/services/desktops/deepin/app-services.nix2
-rw-r--r--nixos/modules/services/desktops/deepin/dde-api.nix4
-rw-r--r--nixos/modules/services/desktops/deepin/dde-daemon.nix2
-rw-r--r--nixos/modules/services/desktops/gnome/gnome-browser-connector.nix4
-rw-r--r--nixos/modules/services/games/asf.nix22
-rw-r--r--nixos/modules/services/hardware/supergfxd.nix2
-rw-r--r--nixos/modules/services/hardware/tuxedo-rs.nix4
-rw-r--r--nixos/modules/services/home-automation/home-assistant.nix3
-rw-r--r--nixos/modules/services/mail/dovecot.nix2
-rw-r--r--nixos/modules/services/mail/mailman.nix2
-rw-r--r--nixos/modules/services/matrix/mjolnir.nix4
-rw-r--r--[-rwxr-xr-x]nixos/modules/services/misc/confd.nix0
-rw-r--r--nixos/modules/services/misc/klipper.nix4
-rw-r--r--nixos/modules/services/misc/packagekit.nix4
-rw-r--r--nixos/modules/services/misc/rshim.nix2
-rw-r--r--nixos/modules/services/misc/soft-serve.nix99
-rw-r--r--nixos/modules/services/misc/sourcehut/default.nix2
-rw-r--r--nixos/modules/services/misc/tp-auto-kbbl.nix2
-rw-r--r--nixos/modules/services/misc/zoneminder.nix4
-rw-r--r--nixos/modules/services/monitoring/mackerel-agent.nix6
-rw-r--r--nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix2
-rw-r--r--nixos/modules/services/network-filesystems/openafs/server.nix4
-rw-r--r--nixos/modules/services/networking/create_ap.nix2
-rw-r--r--nixos/modules/services/networking/dae.nix6
-rw-r--r--nixos/modules/services/networking/ddclient.nix234
-rw-r--r--nixos/modules/services/networking/deconz.nix8
-rw-r--r--nixos/modules/services/networking/go-neb.nix2
-rw-r--r--nixos/modules/services/networking/hostapd.nix4
-rw-r--r--nixos/modules/services/networking/hylafax/options.nix8
-rw-r--r--nixos/modules/services/networking/i2pd.nix8
-rw-r--r--nixos/modules/services/networking/iscsi/initiator.nix2
-rw-r--r--nixos/modules/services/networking/nar-serve.nix2
-rw-r--r--nixos/modules/services/networking/networkmanager.nix93
-rw-r--r--nixos/modules/services/networking/nftables.nix2
-rw-r--r--nixos/modules/services/networking/snowflake-proxy.nix2
-rw-r--r--nixos/modules/services/networking/yggdrasil.nix4
-rw-r--r--nixos/modules/services/security/fail2ban.nix6
-rw-r--r--nixos/modules/services/security/jitterentropy-rngd.nix18
-rw-r--r--nixos/modules/services/system/earlyoom.nix2
-rw-r--r--nixos/modules/services/system/systembus-notify.nix2
-rw-r--r--nixos/modules/services/torrent/flexget.nix2
-rw-r--r--nixos/modules/services/video/mediamtx.nix2
-rw-r--r--nixos/modules/services/web-apps/cloudlog.nix2
-rw-r--r--nixos/modules/services/web-apps/dex.nix7
-rw-r--r--nixos/modules/services/web-apps/hedgedoc.nix1226
-rw-r--r--nixos/modules/services/web-apps/hledger-web.nix2
-rw-r--r--nixos/modules/services/web-apps/isso.nix4
-rw-r--r--nixos/modules/services/web-apps/jitsi-meet.nix4
-rw-r--r--nixos/modules/services/web-apps/meme-bingo-web.nix4
-rw-r--r--nixos/modules/services/web-apps/outline.nix50
-rw-r--r--nixos/modules/services/web-apps/phylactery.nix2
-rw-r--r--nixos/modules/services/web-apps/snipe-it.nix2
-rw-r--r--nixos/modules/services/web-apps/zitadel.nix2
-rw-r--r--nixos/modules/services/web-servers/keter/default.nix2
-rw-r--r--nixos/modules/services/web-servers/nginx/default.nix4
-rw-r--r--nixos/modules/services/web-servers/nginx/vhost-options.nix7
-rw-r--r--nixos/modules/services/web-servers/rustus.nix2
-rw-r--r--nixos/modules/services/x11/desktop-managers/deepin.nix2
-rw-r--r--nixos/modules/system/activation/bootspec.nix2
-rwxr-xr-xnixos/modules/system/activation/switch-to-configuration.pl4
-rw-r--r--nixos/modules/system/boot/grow-partition.nix56
-rw-r--r--nixos/modules/system/boot/loader/external/external.nix2
-rw-r--r--nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix2
-rw-r--r--nixos/modules/system/boot/systemd/homed.nix2
-rw-r--r--nixos/modules/system/boot/systemd/initrd.nix2
-rw-r--r--nixos/modules/system/boot/systemd/userdbd.nix2
-rw-r--r--nixos/modules/tasks/filesystems/btrfs.nix17
-rw-r--r--nixos/modules/tasks/filesystems/cifs.nix2
-rw-r--r--nixos/modules/tasks/filesystems/ext.nix2
-rw-r--r--nixos/modules/tasks/filesystems/f2fs.nix2
-rw-r--r--nixos/modules/tasks/filesystems/jfs.nix2
-rw-r--r--nixos/modules/tasks/filesystems/reiserfs.nix2
-rw-r--r--nixos/modules/tasks/filesystems/vfat.nix2
-rw-r--r--nixos/modules/tasks/filesystems/xfs.nix2
-rw-r--r--nixos/modules/tasks/filesystems/zfs.nix10
-rw-r--r--nixos/modules/tasks/network-interfaces.nix22
-rw-r--r--nixos/modules/virtualisation/qemu-vm.nix1
-rw-r--r--nixos/tests/all-tests.nix4
-rw-r--r--nixos/tests/fanout.nix30
-rw-r--r--nixos/tests/grow-partition.nix83
-rw-r--r--nixos/tests/hedgedoc.nix62
-rw-r--r--nixos/tests/installer.nix3
-rw-r--r--nixos/tests/nginx-unix-socket.nix27
-rw-r--r--nixos/tests/soft-serve.nix102
-rw-r--r--nixos/tests/systemd.nix2
-rw-r--r--pkgs/README.md2
-rw-r--r--[-rwxr-xr-x]pkgs/applications/audio/soundwireserver/default.nix0
-rw-r--r--pkgs/applications/blockchains/bitcoin/default.nix4
-rw-r--r--pkgs/applications/blockchains/lighthouse/default.nix2
-rw-r--r--pkgs/applications/blockchains/polkadot/default.nix5
-rw-r--r--pkgs/applications/blockchains/snarkos/default.nix6
-rw-r--r--pkgs/applications/blockchains/trezor-suite/default.nix6
-rw-r--r--pkgs/applications/editors/hexdino/default.nix6
-rw-r--r--pkgs/applications/editors/jetbrains/plugins/plugins.json97
-rw-r--r--pkgs/applications/editors/jetbrains/versions.json96
-rw-r--r--[-rwxr-xr-x]pkgs/applications/editors/neovim/neovim-gtk.nix0
-rw-r--r--pkgs/applications/editors/pulsar/default.nix9
-rw-r--r--pkgs/applications/editors/texmacs/default.nix42
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix12
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-plugin-names1
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix4
-rw-r--r--pkgs/applications/emulators/yuzu/generic.nix4
-rw-r--r--pkgs/applications/emulators/yuzu/sources.nix14
-rw-r--r--pkgs/applications/file-managers/yazi/default.nix13
-rw-r--r--[-rwxr-xr-x]pkgs/applications/graphics/structorizer/default.nix0
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/default.nix5
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/deps.nix21
-rwxr-xr-xpkgs/applications/misc/ArchiSteamFarm/update.sh8
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/web-ui/.gitignore1
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix12
-rwxr-xr-xpkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh16
-rw-r--r--pkgs/applications/misc/albert/default.nix2
-rw-r--r--pkgs/applications/misc/blender/default.nix4
-rw-r--r--pkgs/applications/misc/dasel/default.nix6
-rw-r--r--[-rwxr-xr-x]pkgs/applications/misc/fluxboxlauncher/default.nix0
-rw-r--r--pkgs/applications/misc/get_iplayer/default.nix6
-rw-r--r--pkgs/applications/misc/html5validator/default.nix36
-rw-r--r--pkgs/applications/misc/leetcode-cli/default.nix9
-rw-r--r--pkgs/applications/misc/nwg-displays/default.nix4
-rw-r--r--pkgs/applications/misc/nwg-panel/default.nix4
-rw-r--r--pkgs/applications/misc/obsidian/default.nix4
-rw-r--r--pkgs/applications/misc/octoprint/default.nix5
-rw-r--r--pkgs/applications/misc/slweb/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/brave/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix60
-rwxr-xr-xpkgs/applications/networking/browsers/chromium/update.py25
-rw-r--r--pkgs/applications/networking/browsers/chromium/upstream-info.nix16
-rw-r--r--pkgs/applications/networking/cluster/argocd-autopilot/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/eks-node-viewer/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/flink/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/kaniko/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/kubernetes/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/starboard/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/tektoncd-cli/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/terraform-backend-git/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json8
-rw-r--r--pkgs/applications/networking/cluster/terraform/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/terragrunt/default.nix6
-rw-r--r--pkgs/applications/networking/gopher/sacc/default.nix4
-rw-r--r--pkgs/applications/networking/ids/zeek/default.nix5
-rw-r--r--pkgs/applications/networking/instant-messengers/discord/default.nix32
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix8
-rw-r--r--pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix6
-rw-r--r--pkgs/applications/networking/opsdroid/default.nix2
-rw-r--r--pkgs/applications/networking/p2p/tremotesf/default.nix4
-rw-r--r--pkgs/applications/networking/sync/rclone/default.nix4
-rw-r--r--pkgs/applications/networking/sync/storj-uplink/default.nix6
-rw-r--r--pkgs/applications/office/activitywatch/default.nix2
-rw-r--r--pkgs/applications/science/biology/bioawk/default.nix50
-rw-r--r--pkgs/applications/science/biology/bowtie2/default.nix52
-rw-r--r--[-rwxr-xr-x]pkgs/applications/science/biology/poretools/default.nix0
-rw-r--r--[-rwxr-xr-x]pkgs/applications/science/biology/trimal/default.nix0
-rw-r--r--[-rwxr-xr-x]pkgs/applications/science/biology/vcftools/default.nix0
-rw-r--r--pkgs/applications/science/misc/root/default.nix4
-rw-r--r--pkgs/applications/science/molecular-dynamics/gromacs/default.nix4
-rw-r--r--pkgs/applications/version-management/git-mit/default.nix6
-rw-r--r--pkgs/applications/version-management/stgit/default.nix6
-rw-r--r--pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix4
-rw-r--r--pkgs/applications/video/kodi/addons/netflix/default.nix6
-rw-r--r--pkgs/applications/video/kodi/addons/youtube/default.nix15
-rw-r--r--[-rwxr-xr-x]pkgs/applications/virtualization/vmware-workstation/default.nix0
-rw-r--r--pkgs/applications/window-managers/cwm/default.nix4
-rw-r--r--pkgs/build-support/fetchdocker/credentials.nix1
-rw-r--r--pkgs/build-support/fetchdocker/generic-fetcher.nix2
-rw-r--r--pkgs/build-support/kernel/make-initrd-ng/src/main.rs2
-rw-r--r--pkgs/by-name/al/alpine-make-rootfs/package.nix33
-rw-r--r--pkgs/by-name/ar/argagg/package.nix (renamed from pkgs/development/libraries/argagg/default.nix)25
-rw-r--r--pkgs/by-name/ar/argtable/package.nix (renamed from pkgs/development/libraries/argtable/default.nix)22
-rw-r--r--pkgs/by-name/ba/bashly/Gemfile2
-rw-r--r--pkgs/by-name/ba/bashly/Gemfile.lock59
-rw-r--r--pkgs/by-name/ba/bashly/gemset.nix231
-rw-r--r--pkgs/by-name/ba/bashly/package.nix38
-rw-r--r--pkgs/by-name/ez/eza/package.nix6
-rw-r--r--pkgs/by-name/fi/firewalk/package.nix27
-rw-r--r--pkgs/by-name/fl/flip/package.nix32
-rw-r--r--pkgs/by-name/fo/fortune-kind/package.nix6
-rw-r--r--pkgs/by-name/ge/geticons/package.nix27
-rw-r--r--pkgs/by-name/hi/hifile/package.nix41
-rw-r--r--pkgs/by-name/ji/jitterentropy-rngd/package.nix34
-rw-r--r--pkgs/by-name/km/kmsvnc/package.nix43
-rw-r--r--pkgs/by-name/ko/kokkos/package.nix44
-rw-r--r--pkgs/by-name/ko/konbucase/package.nix52
-rw-r--r--pkgs/by-name/on/onedriver/package.nix64
-rw-r--r--pkgs/by-name/pg/pgmoneta/package.nix61
-rw-r--r--pkgs/by-name/pr/presenterm/package.nix8
-rw-r--r--pkgs/by-name/re/reactphysics3d/package.nix23
-rw-r--r--pkgs/by-name/te/tecoc/package.nix (renamed from pkgs/applications/editors/tecoc/default.nix)8
-rw-r--r--pkgs/by-name/tk/tkdiff/189.patch71
-rw-r--r--pkgs/by-name/tk/tkdiff/package.nix43
-rw-r--r--pkgs/by-name/tp/tpm2-totp/package.nix46
-rw-r--r--pkgs/by-name/tr/trealla/package.nix4
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix55
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/cputnik.nix46
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/default.nix29
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix32
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix36
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/wmcube.nix48
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix39
-rw-r--r--pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix36
-rw-r--r--pkgs/by-name/wi/windowmaker/package.nix5
-rw-r--r--pkgs/data/documentation/scheme-manpages/default.nix6
-rw-r--r--pkgs/data/fonts/sketchybar-app-font/default.nix4
-rw-r--r--[-rwxr-xr-x]pkgs/data/fonts/vazir-fonts/default.nix0
-rw-r--r--pkgs/data/icons/tela-circle-icon-theme/default.nix4
-rw-r--r--pkgs/data/themes/nordic/default.nix10
-rw-r--r--pkgs/data/themes/orchis-theme/default.nix4
-rw-r--r--pkgs/desktops/gnome/core/zenity/default.nix1
-rw-r--r--pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix11
-rw-r--r--pkgs/development/compilers/flix/default.nix4
-rw-r--r--pkgs/development/compilers/mrustc/default.nix6
-rw-r--r--pkgs/development/interpreters/janet/default.nix40
-rw-r--r--pkgs/development/libraries/CGAL/default.nix12
-rw-r--r--pkgs/development/libraries/argagg/0001-catch.diff20
-rw-r--r--pkgs/development/libraries/duckdb/default.nix10
-rw-r--r--pkgs/development/libraries/duckdb/version.patch22
-rw-r--r--pkgs/development/libraries/jemalloc/rust.nix24
-rw-r--r--pkgs/development/libraries/ldb/default.nix4
-rw-r--r--pkgs/development/libraries/libspf2/default.nix18
-rw-r--r--pkgs/development/libraries/libunarr/default.nix4
-rw-r--r--pkgs/development/libraries/openxr-loader/default.nix4
-rw-r--r--pkgs/development/libraries/science/chemistry/tblite/default.nix9
-rw-r--r--pkgs/development/libraries/toml-f/default.nix4
-rw-r--r--pkgs/development/libraries/virglrenderer/default.nix12
-rw-r--r--pkgs/development/libraries/zlib-ng/default.nix4
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix24
-rw-r--r--pkgs/development/node-packages/node-packages.json1
-rw-r--r--pkgs/development/node-packages/node-packages.nix359
-rw-r--r--pkgs/development/php-packages/opentelemetry/default.nix4
-rw-r--r--pkgs/development/php-packages/xdebug/default.nix4
-rw-r--r--pkgs/development/python-modules/aioairzone-cloud/default.nix4
-rw-r--r--pkgs/development/python-modules/aioairzone/default.nix4
-rw-r--r--pkgs/development/python-modules/aioelectricitymaps/default.nix55
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix4
-rw-r--r--pkgs/development/python-modules/aiohomekit/default.nix4
-rw-r--r--pkgs/development/python-modules/annotated-types/default.nix6
-rw-r--r--pkgs/development/python-modules/argilla/default.nix4
-rw-r--r--pkgs/development/python-modules/asdf-transform-schemas/default.nix9
-rw-r--r--pkgs/development/python-modules/async-upnp-client/default.nix4
-rw-r--r--pkgs/development/python-modules/asyncwhois/default.nix4
-rw-r--r--[-rwxr-xr-x]pkgs/development/python-modules/atlassian-python-api/default.nix0
-rw-r--r--pkgs/development/python-modules/aws-adfs/default.nix26
-rw-r--r--pkgs/development/python-modules/bellows/default.nix4
-rw-r--r--pkgs/development/python-modules/bespon/default.nix10
-rw-r--r--pkgs/development/python-modules/bimmer-connected/default.nix4
-rw-r--r--pkgs/development/python-modules/bleak/default.nix12
-rw-r--r--pkgs/development/python-modules/cantools/default.nix58
-rw-r--r--pkgs/development/python-modules/certbot-dns-ovh/default.nix39
-rw-r--r--pkgs/development/python-modules/chex/default.nix6
-rw-r--r--pkgs/development/python-modules/crytic-compile/default.nix8
-rw-r--r--pkgs/development/python-modules/dbus-fast/default.nix4
-rw-r--r--pkgs/development/python-modules/desktop-entry-lib/default.nix35
-rw-r--r--pkgs/development/python-modules/dramatiq/default.nix106
-rw-r--r--pkgs/development/python-modules/duckdb/default.nix16
-rw-r--r--pkgs/development/python-modules/duckdb/setup.patch30
-rw-r--r--pkgs/development/python-modules/elgato/default.nix21
-rw-r--r--pkgs/development/python-modules/flask-dramatiq/default.nix85
-rw-r--r--pkgs/development/python-modules/fnv-hash-fast/default.nix4
-rw-r--r--pkgs/development/python-modules/fypp/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-asset/default.nix4
-rw-r--r--pkgs/development/python-modules/google-cloud-automl/default.nix4
-rw-r--r--pkgs/development/python-modules/gpaw/default.nix4
-rw-r--r--pkgs/development/python-modules/guppy3/default.nix4
-rw-r--r--pkgs/development/python-modules/jax/default.nix6
-rw-r--r--pkgs/development/python-modules/jaxlib/bin.nix10
-rw-r--r--pkgs/development/python-modules/jaxlib/default.nix10
-rw-r--r--pkgs/development/python-modules/logilab/common.nix4
-rw-r--r--pkgs/development/python-modules/lsprotocol/default.nix6
-rw-r--r--pkgs/development/python-modules/num2words/default.nix4
-rw-r--r--pkgs/development/python-modules/opsdroid-get-image-size/default.nix (renamed from pkgs/development/python-modules/opsdroid_get_image_size/default.nix)17
-rw-r--r--pkgs/development/python-modules/optuna/default.nix8
-rw-r--r--[-rwxr-xr-x]pkgs/development/python-modules/osmnx/default.nix0
-rw-r--r--pkgs/development/python-modules/peaqevcore/default.nix4
-rw-r--r--pkgs/development/python-modules/periodiq/default.nix55
-rw-r--r--pkgs/development/python-modules/persim/default.nix4
-rw-r--r--pkgs/development/python-modules/plugwise/default.nix4
-rw-r--r--pkgs/development/python-modules/polars/default.nix5
-rw-r--r--pkgs/development/python-modules/publicsuffixlist/default.nix4
-rw-r--r--pkgs/development/python-modules/pvo/default.nix20
-rw-r--r--pkgs/development/python-modules/pydiscovergy/default.nix4
-rw-r--r--pkgs/development/python-modules/pyduotecno/default.nix4
-rw-r--r--pkgs/development/python-modules/pyenphase/default.nix4
-rw-r--r--pkgs/development/python-modules/pyliblo/default.nix11
-rw-r--r--pkgs/development/python-modules/pyscf/default.nix4
-rw-r--r--pkgs/development/python-modules/pytensor/default.nix4
-rw-r--r--pkgs/development/python-modules/python-myq/default.nix (renamed from pkgs/development/python-modules/pymyq/default.nix)2
-rw-r--r--pkgs/development/python-modules/pyyardian/default.nix4
-rw-r--r--pkgs/development/python-modules/ratelimiter/default.nix43
-rw-r--r--pkgs/development/python-modules/readmdict/default.nix50
-rw-r--r--pkgs/development/python-modules/recaptcha_client/default.nix23
-rw-r--r--pkgs/development/python-modules/rtree/default.nix4
-rw-r--r--pkgs/development/python-modules/sensor-state-data/default.nix4
-rw-r--r--pkgs/development/python-modules/sphinx_pypi_upload/default.nix21
-rw-r--r--pkgs/development/python-modules/staticmap/default.nix31
-rw-r--r--[-rwxr-xr-x]pkgs/development/python-modules/streamlit/default.nix0
-rw-r--r--pkgs/development/python-modules/textparser/default.nix39
-rw-r--r--pkgs/development/python-modules/toonapi/default.nix16
-rw-r--r--pkgs/development/python-modules/trezor/default.nix4
-rw-r--r--pkgs/development/python-modules/twentemilieu/default.nix12
-rw-r--r--pkgs/development/python-modules/twilio/default.nix4
-rw-r--r--pkgs/development/python-modules/types-click/default.nix28
-rw-r--r--pkgs/development/python-modules/universal-pathlib/default.nix4
-rw-r--r--pkgs/development/python-modules/vehicle/default.nix6
-rw-r--r--pkgs/development/python-modules/velbus-aio/default.nix4
-rw-r--r--pkgs/development/python-modules/wallbox/default.nix4
-rw-r--r--pkgs/development/python-modules/watchdog-gevent/default.nix40
-rw-r--r--pkgs/development/python-modules/zope-lifecycleevent/default.nix44
-rw-r--r--pkgs/development/python-modules/zope_lifecycleevent/default.nix36
-rw-r--r--[-rwxr-xr-x]pkgs/development/python-modules/zstandard/default.nix0
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix4
-rw-r--r--pkgs/development/tools/analysis/rizin/default.nix4
-rw-r--r--pkgs/development/tools/buildkit/default.nix4
-rw-r--r--pkgs/development/tools/clj-kondo/default.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/jenkins/default.nix4
-rw-r--r--pkgs/development/tools/database/timescaledb-tune/default.nix4
-rw-r--r--pkgs/development/tools/electron/binary/generic.nix4
-rw-r--r--pkgs/development/tools/golangci-lint/default.nix6
-rw-r--r--pkgs/development/tools/java/dex2jar/default.nix6
-rw-r--r--pkgs/development/tools/kustomize/default.nix6
-rw-r--r--pkgs/development/tools/misc/runme/default.nix2
-rw-r--r--pkgs/development/tools/misc/slint-lsp/default.nix6
-rw-r--r--pkgs/development/tools/misc/texlab/default.nix8
-rw-r--r--pkgs/development/tools/mold/default.nix10
-rw-r--r--pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json3
-rw-r--r--pkgs/development/tools/railway/default.nix6
-rw-r--r--pkgs/development/tools/ruff/default.nix11
-rw-r--r--pkgs/development/tools/rust/cargo-codspeed/default.nix6
-rw-r--r--pkgs/development/tools/symfony-cli/default.nix6
-rw-r--r--pkgs/development/web/minify/default.nix6
-rw-r--r--pkgs/development/web/nodejs/v21.nix19
-rw-r--r--pkgs/games/openra/build-engine.nix2
-rw-r--r--pkgs/games/starsector/default.nix8
-rw-r--r--pkgs/games/steam/fhsenv.nix15
-rw-r--r--[-rwxr-xr-x]pkgs/misc/uq/default.nix0
-rw-r--r--pkgs/misc/vencord/default.nix8
-rw-r--r--pkgs/misc/vencord/package-lock.json4
-rw-r--r--pkgs/os-specific/linux/cpufrequtils/default.nix3
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix113
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json10
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json12
-rw-r--r--pkgs/os-specific/linux/kernel/zen-kernels.nix10
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix2
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix2
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix4
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix3
-rw-r--r--pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix4
-rw-r--r--pkgs/os-specific/linux/ryzenadj/default.nix2
-rw-r--r--pkgs/servers/computing/slurm/default.nix4
-rw-r--r--pkgs/servers/geospatial/fit-trackee/default.nix105
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix6
-rw-r--r--pkgs/servers/home-assistant/default.nix6
-rw-r--r--pkgs/servers/home-assistant/stubs.nix4
-rw-r--r--pkgs/servers/http/apache-httpd/2.4.nix4
-rw-r--r--pkgs/servers/http/lighttpd/default.nix15
-rw-r--r--pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch35
-rw-r--r--pkgs/servers/http/nginx/generic.nix18
-rw-r--r--pkgs/servers/http/tomcat/tomcat-native.nix4
-rw-r--r--pkgs/servers/kanidm/default.nix2
-rw-r--r--pkgs/servers/mail/spamassassin/default.nix3
-rw-r--r--pkgs/servers/matrix-conduit/default.nix6
-rw-r--r--pkgs/servers/monitoring/librenms/default.nix1
-rw-r--r--pkgs/servers/monitoring/plugins/default.nix8
-rw-r--r--pkgs/servers/monitoring/telegraf/default.nix6
-rw-r--r--pkgs/servers/nosql/redis/default.nix4
-rw-r--r--pkgs/servers/samba/4.x.nix4
-rw-r--r--pkgs/servers/search/qdrant/default.nix6
-rw-r--r--pkgs/servers/search/quickwit/default.nix5
-rw-r--r--pkgs/servers/shairport-sync/default.nix4
-rw-r--r--pkgs/servers/sickbeard/sickgear.nix4
-rw-r--r--pkgs/servers/snac2/default.nix4
-rw-r--r--pkgs/servers/soft-serve/default.nix14
-rw-r--r--pkgs/servers/sql/pgbouncer/default.nix5
-rw-r--r--pkgs/servers/teleport/11/default.nix4
-rw-r--r--pkgs/servers/teleport/12/Cargo.lock4
-rw-r--r--pkgs/servers/teleport/12/default.nix8
-rw-r--r--pkgs/servers/teleport/13/Cargo.lock4
-rw-r--r--pkgs/servers/teleport/13/default.nix8
-rw-r--r--pkgs/servers/teleport/14/Cargo.lock4
-rw-r--r--pkgs/servers/teleport/14/default.nix8
-rw-r--r--[-rwxr-xr-x]pkgs/servers/unifi-video/default.nix0
-rw-r--r--pkgs/servers/web-apps/lemmy/package.json2
-rw-r--r--pkgs/servers/web-apps/lemmy/pin.json10
-rw-r--r--pkgs/shells/fish/default.nix2
-rw-r--r--pkgs/shells/fish/plugins/tide.nix4
-rw-r--r--pkgs/shells/fish/wrapper.nix2
-rw-r--r--pkgs/shells/nushell/default.nix6
-rw-r--r--pkgs/shells/nushell/plugins/default.nix1
-rw-r--r--pkgs/shells/nushell/plugins/regex.nix32
-rw-r--r--pkgs/stdenv/adapters.nix14
-rw-r--r--pkgs/stdenv/linux/default.nix2
-rw-r--r--pkgs/tools/X11/xssstate/default.nix24
-rw-r--r--pkgs/tools/admin/chamber/default.nix6
-rw-r--r--pkgs/tools/admin/pgadmin/default.nix8
-rw-r--r--pkgs/tools/admin/pgadmin/expose-setup.py.patch28
-rwxr-xr-xpkgs/tools/admin/pgadmin/update.sh2
-rw-r--r--pkgs/tools/admin/pgadmin/yarn.lock288
-rw-r--r--pkgs/tools/admin/stripe-cli/default.nix4
-rw-r--r--pkgs/tools/admin/syft/default.nix6
-rw-r--r--[-rwxr-xr-x]pkgs/tools/archivers/payload-dumper-go/default.nix0
-rw-r--r--pkgs/tools/audio/openai-whisper-cpp/default.nix4
-rw-r--r--pkgs/tools/filesystems/erofs-utils/default.nix1
-rw-r--r--pkgs/tools/graphics/wdisplays/default.nix16
-rw-r--r--pkgs/tools/inputmethods/evsieve/default.nix31
-rw-r--r--pkgs/tools/misc/ckb-next/default.nix12
-rw-r--r--pkgs/tools/misc/codebraid/default.nix8
-rw-r--r--pkgs/tools/misc/dooit/default.nix4
-rw-r--r--pkgs/tools/misc/esphome/default.nix4
-rw-r--r--pkgs/tools/misc/fd/default.nix10
-rw-r--r--pkgs/tools/misc/fzf/default.nix5
-rw-r--r--pkgs/tools/misc/lazydocker/default.nix4
-rw-r--r--pkgs/tools/misc/progress/default.nix4
-rw-r--r--pkgs/tools/misc/remind/default.nix4
-rw-r--r--[-rwxr-xr-x]pkgs/tools/misc/starfetch/default.nix0
-rw-r--r--[-rwxr-xr-x]pkgs/tools/misc/szyszka/default.nix0
-rw-r--r--pkgs/tools/misc/tbls/default.nix6
-rw-r--r--pkgs/tools/misc/timer/default.nix6
-rw-r--r--pkgs/tools/misc/topgrade/default.nix6
-rw-r--r--pkgs/tools/misc/turbo/default.nix2
-rw-r--r--pkgs/tools/misc/uutils-coreutils/default.nix6
-rw-r--r--pkgs/tools/misc/vector/default.nix3
-rw-r--r--pkgs/tools/networking/ddclient/default.nix53
-rw-r--r--pkgs/tools/networking/globalping-cli/default.nix4
-rw-r--r--pkgs/tools/networking/hysteria/default.nix6
-rw-r--r--[-rwxr-xr-x]pkgs/tools/networking/ipfetch/default.nix0
-rw-r--r--pkgs/tools/networking/requestly/default.nix4
-rw-r--r--pkgs/tools/networking/sish/default.nix6
-rw-r--r--pkgs/tools/networking/tgt/default.nix4
-rw-r--r--pkgs/tools/networking/voms/default.nix15
-rw-r--r--pkgs/tools/networking/xrootd/default.nix23
-rw-r--r--pkgs/tools/networking/xrootd/fetchxrd.nix4
-rw-r--r--pkgs/tools/package-management/nix/default.nix8
-rw-r--r--pkgs/tools/package-management/zkg/default.nix42
-rw-r--r--pkgs/tools/security/aws-iam-authenticator/default.nix23
-rw-r--r--pkgs/tools/security/evil-winrm/default.nix26
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/fail2ban/default.nix7
-rw-r--r--pkgs/tools/security/ldeep/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/Gemfile2
-rw-r--r--pkgs/tools/security/metasploit/Gemfile.lock18
-rw-r--r--pkgs/tools/security/metasploit/default.nix4
-rw-r--r--pkgs/tools/security/metasploit/gemset.nix10
-rw-r--r--pkgs/tools/security/nuclei/default.nix7
-rw-r--r--pkgs/tools/security/pynitrokey/default.nix4
-rw-r--r--pkgs/tools/security/rekor/default.nix6
-rw-r--r--pkgs/tools/security/scrypt/default.nix4
-rw-r--r--pkgs/tools/security/sequoia-sqop/default.nix6
-rw-r--r--pkgs/tools/security/sshocker/default.nix6
-rw-r--r--pkgs/tools/security/uncover/default.nix6
-rw-r--r--pkgs/tools/system/netdata/default.nix7
-rw-r--r--pkgs/tools/text/mdhtml/default.nix28
-rw-r--r--pkgs/tools/text/ov/default.nix6
-rw-r--r--pkgs/tools/text/rsbkb/default.nix6
-rw-r--r--pkgs/tools/typesetting/sile/default.nix4
-rw-r--r--pkgs/tools/wayland/swaykbdd/default.nix4
-rw-r--r--pkgs/top-level/aliases.nix2
-rw-r--r--pkgs/top-level/all-packages.nix69
-rw-r--r--pkgs/top-level/perl-packages.nix91
-rw-r--r--pkgs/top-level/python-aliases.nix6
-rw-r--r--pkgs/top-level/python-packages.nix40
500 files changed, 5781 insertions, 2936 deletions
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 6344ca3902eed..7bca80f5af88c 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -24,10 +24,10 @@
 # Libraries
 /lib                        @edolstra @infinisil
 /lib/systems                @alyssais @ericson2314 @amjoseph-nixpkgs
-/lib/generators.nix         @edolstra @Profpatsch
-/lib/cli.nix                @edolstra @Profpatsch
-/lib/debug.nix              @edolstra @Profpatsch
-/lib/asserts.nix            @edolstra @Profpatsch
+/lib/generators.nix         @infinisil @edolstra @Profpatsch
+/lib/cli.nix                @infinisil @edolstra @Profpatsch
+/lib/debug.nix              @infinisil @edolstra @Profpatsch
+/lib/asserts.nix            @infinisil @edolstra @Profpatsch
 /lib/path.*                 @infinisil @fricklerhandwerk
 /lib/fileset                @infinisil
 /doc/functions/fileset.section.md @infinisil
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 4517080bb301c..a7d8a17865622 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -14,7 +14,9 @@ For new packages please briefly describe the package or provide a link to its ho
   - [ ] aarch64-linux
   - [ ] x86_64-darwin
   - [ ] aarch64-darwin
-- [ ] For non-Linux: Is `sandbox = true` set in `nix.conf`? (See [Nix manual](https://nixos.org/manual/nix/stable/command-ref/conf-file.html))
+- For non-Linux: Is sandboxing enabled in `nix.conf`? (See [Nix manual](https://nixos.org/manual/nix/stable/command-ref/conf-file.html))
+  - [ ] `sandbox = relaxed`
+  - [ ] `sandbox = true`
 - [ ] Tested, as applicable:
   - [NixOS test(s)](https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests) (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
   - and/or [package tests](https://nixos.org/manual/nixpkgs/unstable/#sec-package-tests)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 32201333c37ba..06b9c10dfec6f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -565,7 +565,7 @@ Names of files and directories should be in lowercase, with dashes between words
 
 - Do not use tab characters, i.e. configure your editor to use soft tabs. For instance, use `(setq-default indent-tabs-mode nil)` in Emacs. Everybody has different tab settings so it’s asking for trouble.
 
-- Use `lowerCamelCase` for variable names, not `UpperCamelCase`. Note, this rule does not apply to package attribute names, which instead follow the rules in [](#sec-package-naming).
+- Use `lowerCamelCase` for variable names, not `UpperCamelCase`. Note, this rule does not apply to package attribute names, which instead follow the rules in [package naming](./pkgs/README.md#package-naming).
 
 - Function calls with attribute set arguments are written as
 
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 40236d141d3d2..cdd5c806912e1 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -12,6 +12,7 @@
 | python310  | python3         | CPython 3.10 |
 | python311  |                 | CPython 3.11 |
 | python312  |                 | CPython 3.12 |
+| python313  |                 | CPython 3.13 |
 | pypy27     | pypy2, pypy     | PyPy2.7 |
 | pypy39     | pypy3           | PyPy 3.9 |
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 6c834689f3c7a..e5b7da9fa36cb 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1274,6 +1274,9 @@
     github = "antonmosich";
     githubId = 27223336;
     name = "Anton Mosich";
+    keys = [ {
+      fingerprint = "F401 287C 324F 0A1C B321  657B 9B96 97B8 FB18 7D14";
+    } ];
   };
   antono = {
     email = "self@antono.info";
@@ -2608,12 +2611,6 @@
     githubId = 200617;
     name = "Ben Sima";
   };
-  bstrik = {
-    email = "dutchman55@gmx.com";
-    github = "bstrik";
-    githubId = 7716744;
-    name = "Berno Strik";
-  };
   btlvr = {
     email = "btlvr@protonmail.com";
     github = "btlvr";
@@ -3880,12 +3877,25 @@
     githubId = 50051176;
     name = "Daniel Rolls";
   };
+  danielsidhion = {
+    email = "nixpkgs@sidhion.com";
+    github = "DanielSidhion";
+    githubId = 160084;
+    name = "Daniel Sidhion";
+  };
   daniyalsuri6 = {
     email = "daniyal.suri@gmail.com";
     github = "daniyalsuri6";
     githubId = 107034852;
     name = "Daniyal Suri";
   };
+  dannixon = {
+    email = "dan@dan-nixon.com";
+    github = "DanNixon";
+    githubId = 4037377;
+    name = "Dan Nixon";
+    matrix = "@dannixon:matrix.org";
+  };
   dansbandit = {
     github = "dansbandit";
     githubId = 4530687;
@@ -6189,6 +6199,16 @@
     githubId = 45048741;
     name = "Alwanga Oyango";
   };
+  galaxy = {
+    email = "galaxy@dmc.chat";
+    matrix = "@galaxy:mozilla.org";
+    name = "The Galaxy";
+    github = "ga1aksy";
+    githubId = 148551648;
+    keys = [{
+      fingerprint = "48CA 3873 9E9F CA8E 76A0  835A E3DE CF85 4212 E1EA";
+    }];
+  };
   gal_bolle = {
     email = "florent.becker@ens-lyon.org";
     github = "FlorentBecker";
@@ -6621,6 +6641,12 @@
     githubId = 4656860;
     name = "Gaute Ravndal";
   };
+  gray-heron = {
+    email = "ave+nix@cezar.info";
+    github = "gray-heron";
+    githubId = 7032646;
+    name = "Cezary Siwek";
+  };
   graysonhead = {
     email = "grayson@graysonhead.net";
     github = "graysonhead";
@@ -7218,6 +7244,7 @@
   };
   hubble = {
     name = "Hubble the Wolverine";
+    email = "hubblethewolverine@gmail.com";
     matrix = "@hubofeverything:bark.lgbt";
     github = "the-furry-hubofeverything";
     githubId = 53921912;
@@ -10922,6 +10949,12 @@
     githubId = 29855073;
     name = "Michael Colicchia";
   };
+  massimogengarelli = {
+    email = "massimo.gengarelli@gmail.com";
+    github = "massix";
+    githubId = 585424;
+    name = "Massimo Gengarelli";
+  };
   matejc = {
     email = "cotman.matej@gmail.com";
     github = "matejc";
@@ -11666,6 +11699,13 @@
     githubId = 149558;
     name = "Merlin Gaillard";
   };
+  mirkolenz = {
+    name = "Mirko Lenz";
+    email = "mirko@mirkolenz.com";
+    matrix = "@mlenz:matrix.org";
+    github = "mirkolenz";
+    githubId = 5160954;
+  };
   mirrexagon = {
     email = "mirrexagon@mirrexagon.com";
     github = "mirrexagon";
@@ -13902,6 +13942,12 @@
     githubId = 610615;
     name = "Chih-Mao Chen";
   };
+  pks = {
+    email = "ps@pks.im";
+    github = "pks-t";
+    githubId = 4056630;
+    name = "Patrick Steinhardt";
+  };
   plabadens = {
     name = "Pierre Labadens";
     email = "labadens.pierre+nixpkgs@gmail.com";
@@ -14804,6 +14850,12 @@
     githubId = 165283;
     name = "Alexey Kutepov";
   };
+  rexxDigital = {
+    email = "joellarssonpriv@gmail.com";
+    github = "rexxDigital";
+    githubId = 44014925;
+    name = "Rexx Larsson";
+  };
   rgnns = {
     email = "jglievano@gmail.com";
     github = "rgnns";
@@ -15036,6 +15088,12 @@
     githubId = 496447;
     name = "Robert Hensing";
   };
+  robert-manchester = {
+    email = "robert.manchester@gmail.com";
+    github = "robert-manchester";
+    githubId = 86313040;
+    name = "Robert Manchester";
+  };
   robertodr = {
     email = "roberto.diremigio@gmail.com";
     github = "robertodr";
@@ -17784,6 +17842,12 @@
     githubId = 858790;
     name = "Tobias Mayer";
   };
+  tochiaha = {
+    email = "tochiahan@proton.me";
+    github = "Tochiaha";
+    githubId = 74688871;
+    name = "Tochukwu Ahanonu";
+  };
   tokudan = {
     email = "git@danielfrank.net";
     github = "tokudan";
@@ -17829,6 +17893,10 @@
     githubId = 13155277;
     name = "Tom Houle";
   };
+  tomkoid = {
+    email = "tomaszierl@outlook.com";
+    name = "Tomkoid";
+  };
   tomodachi94 = {
     email = "tomodachi94+nixpkgs@protonmail.com";
     matrix = "@tomodachi94:matrix.org";
@@ -17984,6 +18052,12 @@
     githubId = 15064765;
     name = "tshaynik";
   };
+  tsowell = {
+    email = "tom@ldtlb.com";
+    github = "tsowell";
+    githubId = 4044033;
+    name = "Thomas Sowell";
+  };
   ttuegel = {
     email = "ttuegel@mailbox.org";
     github = "ttuegel";
@@ -19336,6 +19410,11 @@
     github = "ymeister";
     githubId = 47071325;
   };
+  ymstnt = {
+    name = "YMSTNT";
+    github = "ymstnt";
+    githubId = 21342713;
+  };
   yoavlavi = {
     email = "yoav@yoavlavi.com";
     github = "yoav-lavi";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 5897948a9f83d..f03ef4fa09c95 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -16,6 +16,7 @@ cyrussasl,https://github.com/JorjBauer/lua-cyrussasl.git,,,,,
 digestif,https://github.com/astoff/digestif.git,,,0.2-1,5.3,
 dkjson,,,,,,
 fennel,,,,,,misterio77
+ferris.nvim,,,,,,mrcjkb
 fifo,,,,,,
 fluent,,,,,,alerque
 gitsigns.nvim,https://github.com/lewis6991/gitsigns.nvim.git,,,,5.1,
diff --git a/maintainers/scripts/pluginupdate.py b/maintainers/scripts/pluginupdate.py
index 5ceaab8db901a..52e9af399709b 100644
--- a/maintainers/scripts/pluginupdate.py
+++ b/maintainers/scripts/pluginupdate.py
@@ -786,8 +786,11 @@ def update_plugins(editor: Editor, args):
     autocommit = not args.no_commit
 
     if autocommit:
+        from datetime import date
         editor.nixpkgs_repo = git.Repo(editor.root, search_parent_directories=True)
-        commit(editor.nixpkgs_repo, f"{editor.attr_path}: update", [args.outfile])
+        updated = date.today().strftime('%m-%d-%Y')
+
+        commit(editor.nixpkgs_repo, f"{editor.attr_path}: updated the {updated}", [args.outfile])
 
     if redirects:
         update()
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index b8811da00299b..d5705a294aafa 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -611,6 +611,7 @@ with lib.maintainers; {
 
   minimal-bootstrap = {
     members = [
+      alejandrosame
       artturin
       emilytrau
       ericson2314
diff --git a/nixos/doc/manual/development/activation-script.section.md b/nixos/doc/manual/development/activation-script.section.md
index c339258c6dc48..cc317a6a01aa8 100644
--- a/nixos/doc/manual/development/activation-script.section.md
+++ b/nixos/doc/manual/development/activation-script.section.md
@@ -69,4 +69,4 @@ do:
   `/etc/group` and `/etc/shadow`. This also creates home directories
 - `usrbinenv` creates `/usr/bin/env`
 - `var` creates some directories in `/var` that are not service-specific
-- `wrappers` creates setuid wrappers like `ping` and `sudo`
+- `wrappers` creates setuid wrappers like `sudo`
diff --git a/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md b/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
index 5d6d67f1aa92c..82522b33740e7 100644
--- a/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
+++ b/nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md
@@ -44,6 +44,10 @@ of actions is always the same:
 - Inspect what changed during these actions and print units that failed and
   that were newly started
 
+By default, some units are filtered from the outputs to make it less spammy.
+This can be disabled for development or testing by setting the environment variable
+`STC_DISPLAY_ALL_UNITS=1`
+
 Most of these actions are either self-explaining but some of them have to do
 with our units or the activation script. For this reason, these topics are
 explained in the next sections.
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 9a682077230c5..bd73c4c04f02a 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -113,6 +113,8 @@
 
 - [virt-manager](https://virt-manager.org/), an UI for managing virtual machines in libvirt, is now available as `programs.virt-manager`.
 
+- [Soft Serve](https://github.com/charmbracelet/soft-serve), a tasty, self-hostable Git server for the command line. Available as [services.soft-serve](#opt-services.soft-serve.enable).
+
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}
 
 - `network-online.target` has been fixed to no longer time out for systems with `networking.useDHCP = true` and `networking.useNetworkd = true`.
@@ -254,6 +256,8 @@
 
 - Garage has been upgraded to 0.9.x. `services.garage.package` now needs to be explicitly set, so version upgrades can be done in a controlled fashion. For this, we expose `garage_x_y` attributes which can be set here.
 
+- `voms` and `xrootd` now moves the `$out/etc` content to the `$etc` output instead of `$out/etc.orig`, when input argument `externalEtc` is not `null`.
+
 - The `woodpecker-*` CI packages have been updated to 1.0.0. This release is wildly incompatible with the 0.15.X versions that were previously packaged. Please read [upstream's documentation](https://woodpecker-ci.org/docs/next/migrations#100) to learn how to update your CI configurations.
 
 - The Caddy module gained a new option named `services.caddy.enableReload` which is enabled by default. It allows reloading the service instead of restarting it, if only a config file has changed. This option must be disabled if you have turned off the [Caddy admin API](https://caddyserver.com/docs/caddyfile/options#admin). If you keep this option enabled, you should consider setting [`grace_period`](https://caddyserver.com/docs/caddyfile/options#grace-period) to a non-infinite value to prevent Caddy from delaying the reload indefinitely.
@@ -343,6 +347,8 @@
 
 - DocBook option documentation is no longer supported, all module documentation now uses markdown.
 
+- `services.outline` can now be configured to use local filesystem storage instead of S3 storage using [services.outline.storage.storageType](#opt-services.outline.storage.storageType).
+
 - `buildGoModule` `go-modules` attrs have been renamed to `goModules`.
 
 - The `fonts.fonts` and `fonts.enableDefaultFonts` options have been renamed to `fonts.packages` and `fonts.enableDefaultPackages` respectively.
@@ -353,6 +359,8 @@
 
 - The application firewall `opensnitch` now uses the process monitor method eBPF as default as recommended by upstream. The method can be changed with the setting [services.opensnitch.settings.ProcMonitorMethod](#opt-services.opensnitch.settings.ProcMonitorMethod).
 
+- `services.hedgedoc` has been heavily refactored, reducing the amount of declared options in the module. Most of the options should still work without any changes. Some options have been deprecated, as they no longer have any effect. See [#244941](https://github.com/NixOS/nixpkgs/pull/244941) for more details.
+
 - The module [services.ankisyncd](#opt-services.ankisyncd.package) has been switched to [anki-sync-server-rs](https://github.com/ankicommunity/anki-sync-server-rs) from the old python version, which was difficult to update, had not been updated in a while, and did not support recent versions of anki.
 Unfortunately all servers supporting new clients (newer version of anki-sync-server, anki's built in sync server and this new rust package) do not support the older sync protocol that was used in the old server, so such old clients will also need updating and in particular the anki package in nixpkgs is also being updated in this release.
 The module update takes care of the new config syntax and the data itself (user login and cards) are compatible, so users of the module will be able to just log in again after updating both client and server without any extra action.
@@ -392,6 +400,8 @@ The module update takes care of the new config syntax and the data itself (user
 
 - Suricata was upgraded from 6.0 to 7.0 and no longer considers HTTP/2 support as experimental, see [upstream release notes](https://forum.suricata.io/t/suricata-7-0-0-released/3715) for more details.
 
+- Cloud support in the `netdata` package is now disabled by default. To enable it use the `netdataCloud` package.
+
 - `networking.nftables` now has the option `networking.nftables.table.<table>` to create tables
   and have them be updated atomically, instead of flushing the ruleset.
 
diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/test_driver/machine.py
index 7ed001a1dfce4..b1688cd3b64f0 100644
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@@ -791,6 +791,28 @@ class Machine:
         with self.nested(f"waiting for TCP port {port} on {addr}"):
             retry(port_is_open, timeout)
 
+    def wait_for_open_unix_socket(
+        self, addr: str, is_datagram: bool = False, timeout: int = 900
+    ) -> None:
+        """
+        Wait until a process is listening on the given UNIX-domain socket
+        (default to a UNIX-domain stream socket).
+        """
+
+        nc_flags = [
+            "-z",
+            "-uU" if is_datagram else "-U",
+        ]
+
+        def socket_is_open(_: Any) -> bool:
+            status, _ = self.execute(f"nc {' '.join(nc_flags)} {addr}")
+            return status == 0
+
+        with self.nested(
+            f"waiting for UNIX-domain {'datagram' if is_datagram else 'stream'} on '{addr}'"
+        ):
+            retry(socket_is_open, timeout)
+
     def wait_for_closed_port(
         self, port: int, addr: str = "localhost", timeout: int = 900
     ) -> None:
diff --git a/nixos/modules/config/fanout.nix b/nixos/modules/config/fanout.nix
new file mode 100644
index 0000000000000..60ee145f19af4
--- /dev/null
+++ b/nixos/modules/config/fanout.nix
@@ -0,0 +1,49 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.fanout;
+  mknodCmds = n: lib.lists.imap0 (i: s:
+    "mknod /dev/fanout${builtins.toString i} c $MAJOR ${builtins.toString i}"
+  ) (lib.lists.replicate n "");
+in
+{
+  options.services.fanout = {
+    enable = lib.mkEnableOption (lib.mdDoc "fanout");
+    fanoutDevices = lib.mkOption {
+      type = lib.types.int;
+      default = 1;
+      description = "Number of /dev/fanout devices";
+    };
+    bufferSize = lib.mkOption {
+      type = lib.types.int;
+      default = 16384;
+      description = "Size of /dev/fanout buffer in bytes";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.extraModulePackages = [ config.boot.kernelPackages.fanout.out ];
+
+    boot.kernelModules = [ "fanout" ];
+
+    boot.extraModprobeConfig = ''
+      options fanout buffersize=${builtins.toString cfg.bufferSize}
+    '';
+
+    systemd.services.fanout = {
+      description = "Bring up /dev/fanout devices";
+      script = ''
+        MAJOR=$(${pkgs.gnugrep}/bin/grep fanout /proc/devices | ${pkgs.gawk}/bin/awk '{print $1}')
+        ${lib.strings.concatLines (mknodCmds cfg.fanoutDevices)}
+      '';
+
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+        RemainAfterExit = "yes";
+        Restart = "no";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/config/iproute2.nix b/nixos/modules/config/iproute2.nix
index 8f49e7dbf7de5..7e4fb4d848e39 100644
--- a/nixos/modules/config/iproute2.nix
+++ b/nixos/modules/config/iproute2.nix
@@ -7,7 +7,7 @@ let
 in
 {
   options.networking.iproute2 = {
-    enable = mkEnableOption (lib.mdDoc "copy IP route configuration files");
+    enable = mkEnableOption (lib.mdDoc "copying IP route configuration files");
     rttablesExtraConfig = mkOption {
       type = types.lines;
       default = "";
diff --git a/nixos/modules/config/qt.nix b/nixos/modules/config/qt.nix
index 2b09281e467f9..f82b7ab85a8c3 100644
--- a/nixos/modules/config/qt.nix
+++ b/nixos/modules/config/qt.nix
@@ -1,121 +1,154 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
-
   cfg = config.qt;
 
-  isQGnome = cfg.platformTheme == "gnome" && builtins.elem cfg.style ["adwaita" "adwaita-dark"];
-  isQtStyle = cfg.platformTheme == "gtk2" && !(builtins.elem cfg.style ["adwaita" "adwaita-dark"]);
-  isQt5ct = cfg.platformTheme == "qt5ct";
-  isLxqt = cfg.platformTheme == "lxqt";
-  isKde = cfg.platformTheme == "kde";
-
-  packages =
-    if isQGnome then [
-      pkgs.qgnomeplatform
-      pkgs.adwaita-qt
-      pkgs.qgnomeplatform-qt6
-      pkgs.adwaita-qt6
-    ]
-    else if isQtStyle then [ pkgs.libsForQt5.qtstyleplugins pkgs.qt6Packages.qt6gtk2 ]
-    else if isQt5ct then [ pkgs.libsForQt5.qt5ct pkgs.qt6Packages.qt6ct ]
-    else if isLxqt then [ pkgs.lxqt.lxqt-qtplugin pkgs.lxqt.lxqt-config ]
-    else if isKde then [ pkgs.libsForQt5.plasma-integration pkgs.libsForQt5.systemsettings ]
-    else throw "`qt.platformTheme` ${cfg.platformTheme} and `qt.style` ${cfg.style} are not compatible.";
+  platformPackages = with pkgs; {
+    gnome = [ qgnomeplatform qgnomeplatform-qt6 ];
+    gtk2 = [ libsForQt5.qtstyleplugins qt6Packages.qt6gtk2 ];
+    kde = [ libsForQt5.plasma-integration libsForQt5.systemsettings ];
+    lxqt = [ lxqt.lxqt-qtplugin lxqt.lxqt-config ];
+    qt5ct = [ libsForQt5.qt5ct qt6Packages.qt6ct ];
+  };
+
+  stylePackages = with pkgs; {
+    bb10bright = [ libsForQt5.qtstyleplugins ];
+    bb10dark = [ libsForQt5.qtstyleplugins ];
+    cde = [ libsForQt5.qtstyleplugins ];
+    cleanlooks = [ libsForQt5.qtstyleplugins ];
+    gtk2 = [ libsForQt5.qtstyleplugins qt6Packages.qt6gtk2 ];
+    motif = [ libsForQt5.qtstyleplugins ];
+    plastique = [ libsForQt5.qtstyleplugins ];
 
-in
+    adwaita = [ adwaita-qt adwaita-qt6 ];
+    adwaita-dark = [ adwaita-qt adwaita-qt6 ];
+    adwaita-highcontrast = [ adwaita-qt adwaita-qt6 ];
+    adwaita-highcontrastinverse = [ adwaita-qt adwaita-qt6 ];
+
+    breeze = [ libsForQt5.breeze-qt5 ];
 
+    kvantum = [ libsForQt5.qtstyleplugin-kvantum qt6Packages.qtstyleplugin-kvantum ];
+  };
+in
 {
-  meta.maintainers = [ maintainers.romildo ];
+  meta.maintainers = with lib.maintainers; [ romildo thiagokokada ];
 
   imports = [
-    (mkRenamedOptionModule ["qt5" "enable" ] ["qt" "enable" ])
-    (mkRenamedOptionModule ["qt5" "platformTheme" ] ["qt" "platformTheme" ])
-    (mkRenamedOptionModule ["qt5" "style" ] ["qt" "style" ])
+    (lib.mkRenamedOptionModule [ "qt5" "enable" ] [ "qt" "enable" ])
+    (lib.mkRenamedOptionModule [ "qt5" "platformTheme" ] [ "qt" "platformTheme" ])
+    (lib.mkRenamedOptionModule [ "qt5" "style" ] [ "qt" "style" ])
   ];
 
   options = {
     qt = {
+      enable = lib.mkEnableOption "" // {
+        description = lib.mdDoc ''
+          Whether to enable Qt configuration, including theming.
 
-      enable = mkEnableOption (lib.mdDoc "Qt theming configuration");
+          Enabling this option is necessary for Qt plugins to work in the
+          installed profiles (e.g.: `nix-env -i` or `environment.systemPackages`).
+        '';
+      };
 
-      platformTheme = mkOption {
-        type = types.enum [
-          "gtk2"
-          "gnome"
-          "lxqt"
-          "qt5ct"
-          "kde"
-        ];
+      platformTheme = lib.mkOption {
+        type = with lib.types; nullOr (enum (lib.attrNames platformPackages));
+        default = null;
         example = "gnome";
         relatedPackages = [
           "qgnomeplatform"
           "qgnomeplatform-qt6"
-          ["libsForQt5" "qtstyleplugins"]
-          ["libsForQt5" "qt5ct"]
-          ["lxqt" "lxqt-qtplugin"]
-          ["libsForQt5" "plasma-integration"]
+          [ "libsForQt5" "plasma-integration" ]
+          [ "libsForQt5" "qt5ct" ]
+          [ "libsForQt5" "qtstyleplugins" ]
+          [ "libsForQt5" "systemsettings" ]
+          [ "lxqt" "lxqt-config" ]
+          [ "lxqt" "lxqt-qtplugin" ]
+          [ "qt6Packages" "qt6ct" ]
+          [ "qt6Packages" "qt6gtk2" ]
         ];
         description = lib.mdDoc ''
           Selects the platform theme to use for Qt applications.
 
           The options are
-          - `gtk`: Use GTK theme with [qtstyleplugins](https://github.com/qt/qtstyleplugins)
           - `gnome`: Use GNOME theme with [qgnomeplatform](https://github.com/FedoraQt/QGnomePlatform)
+          - `gtk2`: Use GTK theme with [qtstyleplugins](https://github.com/qt/qtstyleplugins)
+          - `kde`: Use Qt settings from Plasma.
           - `lxqt`: Use LXQt style set using the [lxqt-config-appearance](https://github.com/lxqt/lxqt-config)
              application.
           - `qt5ct`: Use Qt style set using the [qt5ct](https://sourceforge.net/projects/qt5ct/)
-             application.
-          - `kde`: Use Qt settings from Plasma.
+             and [qt6ct](https://github.com/trialuser02/qt6ct) applications.
         '';
       };
 
-      style = mkOption {
-        type = types.enum [
-          "adwaita"
-          "adwaita-dark"
-          "cleanlooks"
-          "gtk2"
-          "motif"
-          "plastique"
-        ];
+      style = lib.mkOption {
+        type = with lib.types; nullOr (enum (lib.attrNames stylePackages));
+        default = null;
         example = "adwaita";
         relatedPackages = [
           "adwaita-qt"
           "adwaita-qt6"
-          ["libsForQt5" "qtstyleplugins"]
-          ["qt6Packages" "qt6gtk2"]
+          [ "libsForQt5" "breeze-qt5" ]
+          [ "libsForQt5" "qtstyleplugin-kvantum" ]
+          [ "libsForQt5" "qtstyleplugins" ]
+          [ "qt6Packages" "qt6gtk2" ]
+          [ "qt6Packages" "qtstyleplugin-kvantum" ]
         ];
         description = lib.mdDoc ''
           Selects the style to use for Qt applications.
 
           The options are
-          - `adwaita`, `adwaita-dark`: Use Adwaita Qt style with
+          - `adwaita`, `adwaita-dark`, `adwaita-highcontrast`, `adawaita-highcontrastinverse`:
+            Use Adwaita Qt style with
             [adwaita](https://github.com/FedoraQt/adwaita-qt)
-          - `cleanlooks`, `gtk2`, `motif`, `plastique`: Use styles from
+          - `breeze`: Use the Breeze style from
+            [breeze](https://github.com/KDE/breeze)
+          - `bb10bright`, `bb10dark`, `cleanlooks`, `gtk2`, `motif`, `plastique`:
+            Use styles from
             [qtstyleplugins](https://github.com/qt/qtstyleplugins)
+          - `kvantum`: Use styles from
+            [kvantum](https://github.com/tsujan/Kvantum)
         '';
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
+    assertions =
+      let
+        gnomeStyles = [
+          "adwaita"
+          "adwaita-dark"
+          "adwaita-highcontrast"
+          "adwaita-highcontrastinverse"
+          "breeze"
+        ];
+      in
+      [
+        {
+          assertion = cfg.platformTheme == "gnome" -> (builtins.elem cfg.style gnomeStyles);
+          message = ''
+            `qt.platformTheme` "gnome" must have `qt.style` set to a theme that supports both Qt and Gtk,
+            for example: ${lib.concatStringsSep ", " gnomeStyles}.
+          '';
+        }
+      ];
 
     environment.variables = {
-      QT_QPA_PLATFORMTHEME = cfg.platformTheme;
-      QT_STYLE_OVERRIDE = mkIf (! (isQt5ct || isLxqt || isKde)) cfg.style;
+      QT_QPA_PLATFORMTHEME = lib.mkIf (cfg.platformTheme != null) cfg.platformTheme;
+      QT_STYLE_OVERRIDE = lib.mkIf (cfg.style != null) cfg.style;
     };
 
-    environment.profileRelativeSessionVariables = let
-      qtVersions = with pkgs; [ qt5 qt6 ];
-    in {
-      QT_PLUGIN_PATH = map (qt: "/${qt.qtbase.qtPluginPrefix}") qtVersions;
-      QML2_IMPORT_PATH = map (qt: "/${qt.qtbase.qtQmlPrefix}") qtVersions;
-    };
-
-    environment.systemPackages = packages;
+    environment.profileRelativeSessionVariables =
+      let
+        qtVersions = with pkgs; [ qt5 qt6 ];
+      in
+      {
+        QT_PLUGIN_PATH = map (qt: "/${qt.qtbase.qtPluginPrefix}") qtVersions;
+        QML2_IMPORT_PATH = map (qt: "/${qt.qtbase.qtQmlPrefix}") qtVersions;
+      };
 
+    environment.systemPackages =
+      lib.optionals (cfg.platformTheme != null) (platformPackages.${cfg.platformTheme})
+      ++ lib.optionals (cfg.style != null) (stylePackages.${cfg.style});
   };
 }
diff --git a/nixos/modules/config/stevenblack.nix b/nixos/modules/config/stevenblack.nix
index 07a0aa339a561..30ef7ff259f09 100644
--- a/nixos/modules/config/stevenblack.nix
+++ b/nixos/modules/config/stevenblack.nix
@@ -15,7 +15,7 @@ let
 in
 {
   options.networking.stevenblack = {
-    enable = mkEnableOption (mdDoc "Enable the stevenblack hosts file blocklist");
+    enable = mkEnableOption (mdDoc "the stevenblack hosts file blocklist");
 
     block = mkOption {
       type = types.listOf (types.enum [ "fakenews" "gambling" "porn" "social" ]);
diff --git a/nixos/modules/hardware/corectrl.nix b/nixos/modules/hardware/corectrl.nix
index 965cbe0267e08..8ef61a158d5ce 100644
--- a/nixos/modules/hardware/corectrl.nix
+++ b/nixos/modules/hardware/corectrl.nix
@@ -8,13 +8,13 @@ in
 {
   options.programs.corectrl = {
     enable = mkEnableOption (lib.mdDoc ''
-      A tool to overclock amd graphics cards and processors.
+      CoreCtrl, a tool to overclock amd graphics cards and processors.
       Add your user to the corectrl group to run corectrl without needing to enter your password
     '');
 
     gpuOverclock = {
       enable = mkEnableOption (lib.mdDoc ''
-        true
+        GPU overclocking
       '');
       ppfeaturemask = mkOption {
         type = types.str;
diff --git a/nixos/modules/hardware/i2c.nix b/nixos/modules/hardware/i2c.nix
index 9a5a2e44813ed..bd4c4ebe21bde 100644
--- a/nixos/modules/hardware/i2c.nix
+++ b/nixos/modules/hardware/i2c.nix
@@ -11,7 +11,7 @@ in
     enable = mkEnableOption (lib.mdDoc ''
       i2c devices support. By default access is granted to users in the "i2c"
       group (will be created if non-existent) and any user with a seat, meaning
-      logged on the computer locally.
+      logged on the computer locally
     '');
 
     group = mkOption {
diff --git a/nixos/modules/hardware/keyboard/uhk.nix b/nixos/modules/hardware/keyboard/uhk.nix
index 17baff83d886b..ff984fa5daa6b 100644
--- a/nixos/modules/hardware/keyboard/uhk.nix
+++ b/nixos/modules/hardware/keyboard/uhk.nix
@@ -11,7 +11,7 @@ in
       non-root access to the firmware of UHK keyboards.
       You need it when you want to flash a new firmware on the keyboard.
       Access to the keyboard is granted to users in the "input" group.
-      You may want to install the uhk-agent package.
+      You may want to install the uhk-agent package
     '');
 
   };
diff --git a/nixos/modules/hardware/keyboard/zsa.nix b/nixos/modules/hardware/keyboard/zsa.nix
index a04b67b5c8d0e..191fb12cca4f9 100644
--- a/nixos/modules/hardware/keyboard/zsa.nix
+++ b/nixos/modules/hardware/keyboard/zsa.nix
@@ -11,7 +11,7 @@ in
       udev rules for keyboards from ZSA like the ErgoDox EZ, Planck EZ and Moonlander Mark I.
       You need it when you want to flash a new configuration on the keyboard
       or use their live training in the browser.
-      You may want to install the wally-cli package.
+      You may want to install the wally-cli package
     '');
   };
 
diff --git a/nixos/modules/hardware/openrazer.nix b/nixos/modules/hardware/openrazer.nix
index aaa4000e758ff..abbafaee89501 100644
--- a/nixos/modules/hardware/openrazer.nix
+++ b/nixos/modules/hardware/openrazer.nix
@@ -50,7 +50,7 @@ in
   options = {
     hardware.openrazer = {
       enable = mkEnableOption (lib.mdDoc ''
-        OpenRazer drivers and userspace daemon.
+        OpenRazer drivers and userspace daemon
       '');
 
       verboseLogging = mkOption {
diff --git a/nixos/modules/hardware/tuxedo-keyboard.nix b/nixos/modules/hardware/tuxedo-keyboard.nix
index 3ae876bd1f18b..fd8b48a5e9eaf 100644
--- a/nixos/modules/hardware/tuxedo-keyboard.nix
+++ b/nixos/modules/hardware/tuxedo-keyboard.nix
@@ -9,7 +9,7 @@ in
   {
     options.hardware.tuxedo-keyboard = {
       enable = mkEnableOption (lib.mdDoc ''
-          Enables the tuxedo-keyboard driver.
+          the tuxedo-keyboard driver.
 
           To configure the driver, pass the options to the {option}`boot.kernelParams` configuration.
           There are several parameters you can change. It's best to check at the source code description which options are supported.
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index a40713ac25c75..4320edf60da51 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -24,7 +24,7 @@ in {
   options = {
     hardware.nvidia = {
       datacenter.enable = lib.mkEnableOption (lib.mdDoc ''
-        Data Center drivers for NVIDIA cards on a NVLink topology.
+        Data Center drivers for NVIDIA cards on a NVLink topology
       '');
       datacenter.settings = lib.mkOption {
         type = settingsFormat.type;
@@ -79,18 +79,18 @@ in {
 
       powerManagement.enable = lib.mkEnableOption (lib.mdDoc ''
         experimental power management through systemd. For more information, see
-        the NVIDIA docs, on Chapter 21. Configuring Power Management Support.
+        the NVIDIA docs, on Chapter 21. Configuring Power Management Support
       '');
 
       powerManagement.finegrained = lib.mkEnableOption (lib.mdDoc ''
         experimental power management of PRIME offload. For more information, see
-        the NVIDIA docs, on Chapter 22. PCI-Express Runtime D3 (RTD3) Power Management.
+        the NVIDIA docs, on Chapter 22. PCI-Express Runtime D3 (RTD3) Power Management
       '');
 
       dynamicBoost.enable = lib.mkEnableOption (lib.mdDoc ''
         dynamic Boost balances power between the CPU and the GPU for improved
         performance on supported laptops using the nvidia-powerd daemon. For more
-        information, see the NVIDIA docs, on Chapter 23. Dynamic Boost on Linux.
+        information, see the NVIDIA docs, on Chapter 23. Dynamic Boost on Linux
       '');
 
       modesetting.enable = lib.mkEnableOption (lib.mdDoc ''
@@ -99,7 +99,7 @@ in {
         Enabling this fixes screen tearing when using Optimus via PRIME (see
         {option}`hardware.nvidia.prime.sync.enable`. This is not enabled
         by default because it is not officially supported by NVIDIA and would not
-        work with SLI.
+        work with SLI
       '');
 
       prime.nvidiaBusId = lib.mkOption {
@@ -153,11 +153,11 @@ in {
 
         Note that this configuration will only be successful when a display manager
         for which the {option}`services.xserver.displayManager.setupCommands`
-        option is supported is used.
+        option is supported is used
       '');
 
       prime.allowExternalGpu = lib.mkEnableOption (lib.mdDoc ''
-        configuring X to allow external NVIDIA GPUs when using Prime [Reverse] sync optimus.
+        configuring X to allow external NVIDIA GPUs when using Prime [Reverse] sync optimus
       '');
 
       prime.offload.enable = lib.mkEnableOption (lib.mdDoc ''
@@ -166,7 +166,7 @@ in {
         If this is enabled, then the bus IDs of the NVIDIA and Intel/AMD GPUs have to
         be specified ({option}`hardware.nvidia.prime.nvidiaBusId` and
         {option}`hardware.nvidia.prime.intelBusId` or
-        {option}`hardware.nvidia.prime.amdgpuBusId`).
+        {option}`hardware.nvidia.prime.amdgpuBusId`)
       '');
 
       prime.offload.enableOffloadCmd = lib.mkEnableOption (lib.mdDoc ''
@@ -174,7 +174,7 @@ in {
         for offloading programs to an nvidia device. To work, should have also enabled
         {option}`hardware.nvidia.prime.offload.enable` or {option}`hardware.nvidia.prime.reverseSync.enable`.
 
-        Example usage `nvidia-offload sauerbraten_client`.
+        Example usage `nvidia-offload sauerbraten_client`
       '');
 
       prime.reverseSync.enable = lib.mkEnableOption (lib.mdDoc ''
@@ -202,25 +202,25 @@ in {
 
         Note that this configuration will only be successful when a display manager
         for which the {option}`services.xserver.displayManager.setupCommands`
-        option is supported is used.
+        option is supported is used
       '');
 
       nvidiaSettings =
         (lib.mkEnableOption (lib.mdDoc ''
-          nvidia-settings, NVIDIA's GUI configuration tool.
+          nvidia-settings, NVIDIA's GUI configuration tool
         ''))
         // {default = true;};
 
       nvidiaPersistenced = lib.mkEnableOption (lib.mdDoc ''
         nvidia-persistenced a update for NVIDIA GPU headless mode, i.e.
-        It ensures all GPUs stay awake even during headless mode.
+        It ensures all GPUs stay awake even during headless mode
       '');
 
       forceFullCompositionPipeline = lib.mkEnableOption (lib.mdDoc ''
         forcefully the full composition pipeline.
         This sometimes fixes screen tearing issues.
         This has been reported to reduce the performance of some OpenGL applications and may produce issues in WebGL.
-        It also drastically increases the time the driver needs to clock down after load.
+        It also drastically increases the time the driver needs to clock down after load
       '');
 
       package = lib.mkOption {
diff --git a/nixos/modules/hardware/video/webcam/facetimehd.nix b/nixos/modules/hardware/video/webcam/facetimehd.nix
index 480c636aa0d9d..a0ec9c98a54c9 100644
--- a/nixos/modules/hardware/video/webcam/facetimehd.nix
+++ b/nixos/modules/hardware/video/webcam/facetimehd.nix
@@ -12,7 +12,7 @@ in
 
 {
 
-  options.hardware.facetimehd.enable = mkEnableOption (lib.mdDoc "facetimehd kernel module");
+  options.hardware.facetimehd.enable = mkEnableOption (lib.mdDoc "the facetimehd kernel module");
 
   options.hardware.facetimehd.withCalibration = mkOption {
     default = false;
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index dc59ccb357d44..5b278b5e80625 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -69,7 +69,7 @@ in
       #dialout = 27; # unused
       polkituser = 28;
       #utmp = 29; # unused
-      # ddclient = 30; # software removed
+      # ddclient = 30; # converted to DynamicUser = true
       davfs2 = 31;
       disnix = 33;
       osgi = 34;
@@ -394,7 +394,7 @@ in
       dialout = 27;
       #polkituser = 28; # currently unused, polkitd doesn't need a group
       utmp = 29;
-      # ddclient = 30; # software removed
+      # ddclient = 30; # converted to DynamicUser = true
       davfs2 = 31;
       disnix = 33;
       osgi = 34;
diff --git a/nixos/modules/misc/nixops-autoluks.nix b/nixos/modules/misc/nixops-autoluks.nix
index 221b34f3cc366..e6817633119d9 100644
--- a/nixos/modules/misc/nixops-autoluks.nix
+++ b/nixos/modules/misc/nixops-autoluks.nix
@@ -5,7 +5,7 @@ let
 
   inherit (config.nixops) enableDeprecatedAutoLuks;
 in {
-  options.nixops.enableDeprecatedAutoLuks = lib.mkEnableOption (lib.mdDoc "Enable the deprecated NixOps AutoLuks module");
+  options.nixops.enableDeprecatedAutoLuks = lib.mkEnableOption (lib.mdDoc "the deprecated NixOps AutoLuks module");
 
   config = {
     assertions = [
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 2c06f49317256..395a638033fe1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -2,6 +2,7 @@
   ./config/appstream.nix
   ./config/console.nix
   ./config/debug-info.nix
+  ./config/fanout.nix
   ./config/fonts/fontconfig.nix
   ./config/fonts/fontdir.nix
   ./config/fonts/ghostscript.nix
@@ -730,6 +731,7 @@
   ./services/misc/signald.nix
   ./services/misc/siproxd.nix
   ./services/misc/snapper.nix
+  ./services/misc/soft-serve.nix
   ./services/misc/sonarr.nix
   ./services/misc/sourcehut
   ./services/misc/spice-vdagentd.nix
@@ -884,6 +886,7 @@
   ./services/networking/dae.nix
   ./services/networking/dante.nix
   ./services/networking/deconz.nix
+  ./services/networking/ddclient.nix
   ./services/networking/dhcpcd.nix
   ./services/networking/dnscache.nix
   ./services/networking/dnscrypt-proxy2.nix
@@ -1153,6 +1156,7 @@
   ./services/security/hologram-agent.nix
   ./services/security/hologram-server.nix
   ./services/security/infnoise.nix
+  ./services/security/jitterentropy-rngd.nix
   ./services/security/kanidm.nix
   ./services/security/munge.nix
   ./services/security/nginx-sso.nix
diff --git a/nixos/modules/programs/calls.nix b/nixos/modules/programs/calls.nix
index 7a18982915a9f..3d757bc1fc320 100644
--- a/nixos/modules/programs/calls.nix
+++ b/nixos/modules/programs/calls.nix
@@ -8,7 +8,7 @@ in {
   options = {
     programs.calls = {
       enable = mkEnableOption (lib.mdDoc ''
-        Whether to enable GNOME calls: a phone dialer and call handler.
+        GNOME calls: a phone dialer and call handler
       '');
     };
   };
diff --git a/nixos/modules/programs/cnping.nix b/nixos/modules/programs/cnping.nix
index d3cf659d4297f..143267fc9a426 100644
--- a/nixos/modules/programs/cnping.nix
+++ b/nixos/modules/programs/cnping.nix
@@ -8,7 +8,7 @@ in
 {
   options = {
     programs.cnping = {
-      enable = mkEnableOption (lib.mdDoc "Whether to install a setcap wrapper for cnping");
+      enable = mkEnableOption (lib.mdDoc "a setcap wrapper for cnping");
     };
   };
 
diff --git a/nixos/modules/programs/direnv.nix b/nixos/modules/programs/direnv.nix
index 1a80cb2028066..77a6568e73b88 100644
--- a/nixos/modules/programs/direnv.nix
+++ b/nixos/modules/programs/direnv.nix
@@ -11,7 +11,7 @@ in {
     enable = lib.mkEnableOption (lib.mdDoc ''
       direnv integration. Takes care of both installation and
       setting up the sourcing of the shell. Additionally enables nix-direnv
-      integration. Note that you need to logout and login for this change to apply.
+      integration. Note that you need to logout and login for this change to apply
     '');
 
     package = lib.mkPackageOptionMD pkgs "direnv" {};
diff --git a/nixos/modules/programs/feedbackd.nix b/nixos/modules/programs/feedbackd.nix
index cee8daa314622..e3fde947a3dfe 100644
--- a/nixos/modules/programs/feedbackd.nix
+++ b/nixos/modules/programs/feedbackd.nix
@@ -8,9 +8,9 @@ in {
   options = {
     programs.feedbackd = {
       enable = mkEnableOption (lib.mdDoc ''
-        Whether to enable the feedbackd D-BUS service and udev rules.
+        the feedbackd D-BUS service and udev rules.
 
-        Your user needs to be in the `feedbackd` group to trigger effects.
+        Your user needs to be in the `feedbackd` group to trigger effects
       '');
       package = mkOption {
         description = lib.mdDoc ''
diff --git a/nixos/modules/programs/firefox.nix b/nixos/modules/programs/firefox.nix
index 83a3edaf813ef..99236f01c5370 100644
--- a/nixos/modules/programs/firefox.nix
+++ b/nixos/modules/programs/firefox.nix
@@ -220,23 +220,20 @@ in
 
   config = mkIf cfg.enable {
     environment.systemPackages = [
-      (cfg.package.override {
+      (cfg.package.override (old: {
         extraPrefs = cfg.autoConfig;
-        extraNativeMessagingHosts = with pkgs; optionals nmh.ff2mpv [
-          ff2mpv
-        ] ++ optionals nmh.euwebid [
-          web-eid-app
-        ] ++ optionals nmh.gsconnect [
-          gnomeExtensions.gsconnect
-        ] ++ optionals nmh.jabref [
-          jabref
-        ] ++ optionals nmh.passff [
-          passff-host
-        ];
+        extraNativeMessagingHosts =
+          old.extraNativeMessagingHosts or []
+          ++ optional nmh.ff2mpv ff2mpv
+          ++ optional nmh.euwebid web-eid-app
+          ++ optional nmh.gsconnect gnomeExtensions.gsconnect
+          ++ optional nmh.jabref jabref
+          ++ optional nmh.passff passff-host;
         cfg = let
           # copy-pasted from the wrapper; TODO: figure out fix
           applicationName = cfg.package.binaryName or (lib.getName cfg.package);
 
+          oldCfg = old.cfg or {};
           nixpkgsConfig = pkgs.config.${applicationName} or {};
           optionConfig = cfg.wrapperConfig;
           nmhConfig = {
@@ -246,8 +243,8 @@ in
             enableUgetIntegrator = nmh.ugetIntegrator;
             enableFXCastBridge = nmh.fxCast;
           };
-        in nixpkgsConfig // optionConfig // nmhConfig;
-      })
+        in oldCfg // nixpkgsConfig // optionConfig // nmhConfig;
+      }))
     ];
 
     environment.etc =
diff --git a/nixos/modules/programs/fish.nix b/nixos/modules/programs/fish.nix
index b500b8f24b2cb..e6ac6e9957bac 100644
--- a/nixos/modules/programs/fish.nix
+++ b/nixos/modules/programs/fish.nix
@@ -208,7 +208,7 @@ in
         end
 
         # if we haven't sourced the login config, do it
-        status --is-login; and not set -q __fish_nixos_login_config_sourced
+        status is-login; and not set -q __fish_nixos_login_config_sourced
         and begin
           ${sourceEnv "loginShellInit"}
 
@@ -220,7 +220,7 @@ in
         end
 
         # if we haven't sourced the interactive config, do it
-        status --is-interactive; and not set -q __fish_nixos_interactive_config_sourced
+        status is-interactive; and not set -q __fish_nixos_interactive_config_sourced
         and begin
           ${fishAbbrs}
           ${fishAliases}
diff --git a/nixos/modules/programs/kdeconnect.nix b/nixos/modules/programs/kdeconnect.nix
index 4978c428ce341..4ba156f2db8d3 100644
--- a/nixos/modules/programs/kdeconnect.nix
+++ b/nixos/modules/programs/kdeconnect.nix
@@ -9,7 +9,7 @@ with lib;
       1714 to 1764 as they are needed for it to function properly.
       You can use the {option}`package` to use
       `gnomeExtensions.gsconnect` as an alternative
-      implementation if you use Gnome.
+      implementation if you use Gnome
     '');
     package = mkOption {
       default = pkgs.plasma5Packages.kdeconnect-kde;
diff --git a/nixos/modules/programs/wayland/wayfire.nix b/nixos/modules/programs/wayland/wayfire.nix
index d0b280e3940fc..9ea2010cf59c8 100644
--- a/nixos/modules/programs/wayland/wayfire.nix
+++ b/nixos/modules/programs/wayland/wayfire.nix
@@ -6,7 +6,7 @@ in
   meta.maintainers = with lib.maintainers; [ rewine ];
 
   options.programs.wayfire = {
-    enable = lib.mkEnableOption (lib.mdDoc "Wayfire, a wayland compositor based on wlroots.");
+    enable = lib.mkEnableOption (lib.mdDoc "Wayfire, a wayland compositor based on wlroots");
 
     package = lib.mkPackageOptionMD pkgs "wayfire" { };
 
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 408c515044c80..0fbb2351f9863 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -54,7 +54,6 @@ in
     (mkRemovedOptionModule [ "services" "chronos" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "couchpotato" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "dd-agent" ] "dd-agent was removed from nixpkgs in favor of the newer datadog-agent.")
-    (mkRemovedOptionModule [ "services" "ddclient" ] "ddclient has been removed on the request of the upstream maintainer because it is unmaintained and has bugs. Please switch to a different software like `inadyn` or `knsupdate`.") # Added 2023-07-04
     (mkRemovedOptionModule [ "services" "dnscrypt-proxy" ] "Use services.dnscrypt-proxy2 instead")
     (mkRemovedOptionModule [ "services" "exhibitor" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "firefox" "syncserver" ] "The corresponding package was removed from nixpkgs.")
diff --git a/nixos/modules/security/apparmor/profiles.nix b/nixos/modules/security/apparmor/profiles.nix
index 8eb630b5a48a5..0bf90a0086556 100644
--- a/nixos/modules/security/apparmor/profiles.nix
+++ b/nixos/modules/security/apparmor/profiles.nix
@@ -2,10 +2,4 @@
 let apparmor = config.security.apparmor; in
 {
 config.security.apparmor.packages = [ pkgs.apparmor-profiles ];
-config.security.apparmor.policies."bin.ping".profile = lib.mkIf apparmor.policies."bin.ping".enable ''
-  include "${pkgs.iputils.apparmor}/bin.ping"
-  include "${pkgs.inetutils.apparmor}/bin.ping"
-  # Note that including those two profiles in the same profile
-  # would not work if the second one were to re-include <tunables/global>.
-'';
 }
diff --git a/nixos/modules/services/backup/znapzend.nix b/nixos/modules/services/backup/znapzend.nix
index 76f147c18affa..2ebe8ad2f69ae 100644
--- a/nixos/modules/services/backup/znapzend.nix
+++ b/nixos/modules/services/backup/znapzend.nix
@@ -359,14 +359,14 @@ in
       };
 
       features.oracleMode = mkEnableOption (lib.mdDoc ''
-        Destroy snapshots one by one instead of using one long argument list.
+        destroying snapshots one by one instead of using one long argument list.
         If source and destination are out of sync for a long time, you may have
         so many snapshots to destroy that the argument gets is too long and the
-        command fails.
+        command fails
       '');
       features.recvu = mkEnableOption (lib.mdDoc ''
         recvu feature which uses `-u` on the receiving end to keep the destination
-        filesystem unmounted.
+        filesystem unmounted
       '');
       features.compressed = mkEnableOption (lib.mdDoc ''
         compressed feature which adds the options `-Lce` to
@@ -377,7 +377,7 @@ in
         support and -e is for embedded data support. see
         {manpage}`znapzend(1)`
         and {manpage}`zfs(8)`
-        for more info.
+        for more info
       '');
       features.sendRaw = mkEnableOption (lib.mdDoc ''
         sendRaw feature which adds the options `-w` to the
@@ -386,25 +386,25 @@ in
         backup that can't be read without the encryption key/passphrase, useful
         when the remote isn't fully trusted or not physically secure. This
         option must be used consistently, raw incrementals cannot be based on
-        non-raw snapshots and vice versa.
+        non-raw snapshots and vice versa
       '');
       features.skipIntermediates = mkEnableOption (lib.mdDoc ''
-        Enable the skipIntermediates feature to send a single increment
+        the skipIntermediates feature to send a single increment
         between latest common snapshot and the newly made one. It may skip
         several source snaps if the destination was offline for some time, and
         it should skip snapshots not managed by znapzend. Normally for online
         destinations, the new snapshot is sent as soon as it is created on the
-        source, so there are no automatic increments to skip.
+        source, so there are no automatic increments to skip
       '');
       features.lowmemRecurse = mkEnableOption (lib.mdDoc ''
         use lowmemRecurse on systems where you have too many datasets, so a
         recursive listing of attributes to find backup plans exhausts the
         memory available to {command}`znapzend`: instead, go the slower
         way to first list all impacted dataset names, and then query their
-        configs one by one.
+        configs one by one
       '');
       features.zfsGetType = mkEnableOption (lib.mdDoc ''
-        use zfsGetType if your {command}`zfs get` supports a
+        using zfsGetType if your {command}`zfs get` supports a
         `-t` argument for filtering by dataset type at all AND
         lists properties for snapshots by default when recursing, so that there
         is too much data to process while searching for backup plans.
@@ -412,7 +412,7 @@ in
         `--recursive` search for backup plans can literally
         differ by hundreds of times (depending on the amount of snapshots in
         that dataset tree... and a decent backup plan will ensure you have a lot
-        of those), so you would benefit from requesting this feature.
+        of those), so you would benefit from requesting this feature
       '');
     };
   };
diff --git a/nixos/modules/services/databases/cassandra.nix b/nixos/modules/services/databases/cassandra.nix
index e26acb88d8c85..cd816ffaf0dde 100644
--- a/nixos/modules/services/databases/cassandra.nix
+++ b/nixos/modules/services/databases/cassandra.nix
@@ -122,7 +122,7 @@ in
   options.services.cassandra = {
 
     enable = mkEnableOption (lib.mdDoc ''
-      Apache Cassandra – Scalable and highly available database.
+      Apache Cassandra – Scalable and highly available database
     '');
 
     clusterName = mkOption {
diff --git a/nixos/modules/services/databases/ferretdb.nix b/nixos/modules/services/databases/ferretdb.nix
index 5b2cc59d8c068..45f822d646910 100644
--- a/nixos/modules/services/databases/ferretdb.nix
+++ b/nixos/modules/services/databases/ferretdb.nix
@@ -11,7 +11,7 @@ in
 
   options = {
     services.ferretdb = {
-      enable = mkEnableOption "FerretDB, an Open Source MongoDB alternative.";
+      enable = mkEnableOption "FerretDB, an Open Source MongoDB alternative";
 
       package = mkOption {
         type = types.package;
diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index 1464f4487e39d..86b295dadf494 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -75,7 +75,7 @@ in {
               Note that the NixOS module for Redis disables kernel support
               for Transparent Huge Pages (THP),
               because this features causes major performance problems for Redis,
-              e.g. (https://redis.io/topics/latency).
+              e.g. (https://redis.io/topics/latency)
             '');
 
             user = mkOption {
diff --git a/nixos/modules/services/databases/surrealdb.nix b/nixos/modules/services/databases/surrealdb.nix
index 28bd97cd731ea..e1a1faed1f8f7 100644
--- a/nixos/modules/services/databases/surrealdb.nix
+++ b/nixos/modules/services/databases/surrealdb.nix
@@ -8,7 +8,7 @@ in {
 
   options = {
     services.surrealdb = {
-      enable = mkEnableOption (lib.mdDoc "A scalable, distributed, collaborative, document-graph database, for the realtime web ");
+      enable = mkEnableOption (lib.mdDoc "SurrealDB, a scalable, distributed, collaborative, document-graph database, for the realtime web");
 
       package = mkOption {
         default = pkgs.surrealdb;
diff --git a/nixos/modules/services/desktops/deepin/app-services.nix b/nixos/modules/services/desktops/deepin/app-services.nix
index 6f9932e487336..4592bc7bb340c 100644
--- a/nixos/modules/services/desktops/deepin/app-services.nix
+++ b/nixos/modules/services/desktops/deepin/app-services.nix
@@ -14,7 +14,7 @@ with lib;
 
     services.deepin.app-services = {
 
-      enable = mkEnableOption (lib.mdDoc "Service collection of DDE applications, including dconfig-center");
+      enable = mkEnableOption (lib.mdDoc "service collection of DDE applications, including dconfig-center");
 
     };
 
diff --git a/nixos/modules/services/desktops/deepin/dde-api.nix b/nixos/modules/services/desktops/deepin/dde-api.nix
index 472d9860c1089..459876febf21f 100644
--- a/nixos/modules/services/desktops/deepin/dde-api.nix
+++ b/nixos/modules/services/desktops/deepin/dde-api.nix
@@ -15,8 +15,8 @@ with lib;
     services.deepin.dde-api = {
 
       enable = mkEnableOption (lib.mdDoc ''
-        Provides some dbus interfaces that is used for screen zone detecting,
-        thumbnail generating, and sound playing in Deepin Desktop Environment.
+        some dbus interfaces that is used for screen zone detecting,
+        thumbnail generating, and sound playing in Deepin Desktop Environment
       '');
 
     };
diff --git a/nixos/modules/services/desktops/deepin/dde-daemon.nix b/nixos/modules/services/desktops/deepin/dde-daemon.nix
index 9377f523ebf9c..356d323bcbdf9 100644
--- a/nixos/modules/services/desktops/deepin/dde-daemon.nix
+++ b/nixos/modules/services/desktops/deepin/dde-daemon.nix
@@ -14,7 +14,7 @@ with lib;
 
     services.deepin.dde-daemon = {
 
-      enable = mkEnableOption (lib.mdDoc "Daemon for handling the deepin session settings");
+      enable = mkEnableOption (lib.mdDoc "daemon for handling the deepin session settings");
 
     };
 
diff --git a/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix b/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix
index 9a45d839629b5..d18e303891e47 100644
--- a/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-browser-connector.nix
@@ -24,8 +24,8 @@ in
 
   options = {
     services.gnome.gnome-browser-connector.enable = mkEnableOption (mdDoc ''
-      Native host connector for the GNOME Shell browser extension, a DBus service
-      allowing to install GNOME Shell extensions from a web browser.
+      native host connector for the GNOME Shell browser extension, a DBus service
+      allowing to install GNOME Shell extensions from a web browser
     '');
   };
 
diff --git a/nixos/modules/services/games/asf.nix b/nixos/modules/services/games/asf.nix
index f15d7077d965c..432de6336ce24 100644
--- a/nixos/modules/services/games/asf.nix
+++ b/nixos/modules/services/games/asf.nix
@@ -187,29 +187,41 @@ in
             Group = "asf";
             WorkingDirectory = cfg.dataDir;
             Type = "simple";
-            ExecStart = "${cfg.package}/bin/ArchiSteamFarm --path ${cfg.dataDir} --process-required --no-restart --service --no-config-migrate";
+            ExecStart = "${lib.getExe cfg.package} --no-restart --process-required --service --system-required --path ${cfg.dataDir}";
             Restart = "always";
 
-            # mostly copied from the default systemd service
-            PrivateTmp = true;
+            # copied from the default systemd service at
+            # https://github.com/JustArchiNET/ArchiSteamFarm/blob/main/ArchiSteamFarm/overlay/variant-base/linux/ArchiSteamFarm%40.service
+            CapabilityBoundingSet = "";
+            DevicePolicy = "closed";
             LockPersonality = true;
+            NoNewPrivileges = true;
             PrivateDevices = true;
             PrivateIPC = true;
             PrivateMounts = true;
+            PrivateTmp = true; # instead of rw /tmp
             PrivateUsers = true;
+            ProcSubset = "pid";
             ProtectClock = true;
             ProtectControlGroups = true;
+            ProtectHome = true;
             ProtectHostname = true;
             ProtectKernelLogs = true;
             ProtectKernelModules = true;
             ProtectKernelTunables = true;
             ProtectProc = "invisible";
-            ProtectSystem = "full";
+            ProtectSystem = "strict";
             RemoveIPC = true;
-            RestrictAddressFamilies = "AF_INET AF_INET6";
+            RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK AF_UNIX";
             RestrictNamespaces = true;
             RestrictRealtime = true;
             RestrictSUIDSGID = true;
+            SystemCallArchitectures = "native";
+            UMask = "0077";
+
+            # we luckily already have systemd v247+
+            SecureBits = "noroot-locked";
+            SystemCallFilter = [ "@system-service" "~@privileged" ];
           }
         ];
 
diff --git a/nixos/modules/services/hardware/supergfxd.nix b/nixos/modules/services/hardware/supergfxd.nix
index bd82775e82461..f7af993d7238c 100644
--- a/nixos/modules/services/hardware/supergfxd.nix
+++ b/nixos/modules/services/hardware/supergfxd.nix
@@ -7,7 +7,7 @@ in
 {
   options = {
     services.supergfxd = {
-      enable = lib.mkEnableOption (lib.mdDoc "Enable the supergfxd service");
+      enable = lib.mkEnableOption (lib.mdDoc "the supergfxd service");
 
       settings = lib.mkOption {
         type = lib.types.nullOr json.type;
diff --git a/nixos/modules/services/hardware/tuxedo-rs.nix b/nixos/modules/services/hardware/tuxedo-rs.nix
index 343f6845fabbd..0daccfef3a530 100644
--- a/nixos/modules/services/hardware/tuxedo-rs.nix
+++ b/nixos/modules/services/hardware/tuxedo-rs.nix
@@ -9,9 +9,9 @@ in
 {
   options = {
     hardware.tuxedo-rs = {
-      enable = mkEnableOption (lib.mdDoc "Rust utilities for interacting with hardware from TUXEDO Computers.");
+      enable = mkEnableOption (lib.mdDoc "Rust utilities for interacting with hardware from TUXEDO Computers");
 
-      tailor-gui.enable = mkEnableOption (lib.mdDoc "Alternative to TUXEDO Control Center, written in Rust.");
+      tailor-gui.enable = mkEnableOption (lib.mdDoc "tailor-gui, an alternative to TUXEDO Control Center, written in Rust");
     };
   };
 
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 7dc08d4356aab..99bac86a8e9a6 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -588,11 +588,12 @@ in {
           "~@privileged"
         ] ++ optionals (any useComponent componentsUsingPing) [
           "capset"
+          "setuid"
         ];
         UMask = "0077";
       };
       path = [
-        "/run/wrappers" # needed for ping
+        pkgs.unixtools.ping # needed for ping
       ];
     };
 
diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index 21bafd859c3c2..abbb2f32e6ccc 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -302,7 +302,7 @@ in
 
     enablePAM = mkEnableOption (lib.mdDoc "creating a own Dovecot PAM service and configure PAM user logins") // { default = true; };
 
-    enableDHE = mkEnableOption (lib.mdDoc "enable ssl_dh and generation of primes for the key exchange") // { default = true; };
+    enableDHE = mkEnableOption (lib.mdDoc "ssl_dh and generation of primes for the key exchange") // { default = true; };
 
     sieveScripts = mkOption {
       type = types.attrsOf types.path;
diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix
index 9f43d5829f099..9cc1ade3f41e8 100644
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@@ -260,7 +260,7 @@ in {
       };
 
       serve = {
-        enable = mkEnableOption (lib.mdDoc "Automatic nginx and uwsgi setup for mailman-web");
+        enable = mkEnableOption (lib.mdDoc "automatic nginx and uwsgi setup for mailman-web");
 
         virtualRoot = mkOption {
           default = "/";
diff --git a/nixos/modules/services/matrix/mjolnir.nix b/nixos/modules/services/matrix/mjolnir.nix
index 0824be663340b..4e9a915c23c7b 100644
--- a/nixos/modules/services/matrix/mjolnir.nix
+++ b/nixos/modules/services/matrix/mjolnir.nix
@@ -96,8 +96,8 @@ in
       type = types.submodule {
         options = {
           enable = mkEnableOption (lib.mdDoc ''
-            If true, accessToken is ignored and the username/password below will be
-            used instead. The access token of the bot will be stored in the dataPath.
+            ignoring the accessToken. If true, accessToken is ignored and the username/password below will be
+            used instead. The access token of the bot will be stored in the dataPath
           '');
 
           username = mkOption {
diff --git a/nixos/modules/services/misc/confd.nix b/nixos/modules/services/misc/confd.nix
index 17c1be57ccbcd..17c1be57ccbcd 100755..100644
--- a/nixos/modules/services/misc/confd.nix
+++ b/nixos/modules/services/misc/confd.nix
diff --git a/nixos/modules/services/misc/klipper.nix b/nixos/modules/services/misc/klipper.nix
index 67a217c994e45..9eb2fdb465932 100644
--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@@ -111,11 +111,11 @@ in
           (submodule {
             options = {
               enable = mkEnableOption (lib.mdDoc ''
-                building of firmware for manual flashing.
+                building of firmware for manual flashing
               '');
               enableKlipperFlash = mkEnableOption (lib.mdDoc ''
                 flashings scripts for firmware. This will add `klipper-flash-$mcu` scripts to your environment which can be called to flash the firmware.
-                Please check the configs at [klipper](https://github.com/Klipper3d/klipper/tree/master/config) whether your board supports flashing via `make flash`.
+                Please check the configs at [klipper](https://github.com/Klipper3d/klipper/tree/master/config) whether your board supports flashing via `make flash`
               '');
               serial = mkOption {
                 type = types.nullOr path;
diff --git a/nixos/modules/services/misc/packagekit.nix b/nixos/modules/services/misc/packagekit.nix
index f3e6bf50e9b2f..5a0d314d25cd6 100644
--- a/nixos/modules/services/misc/packagekit.nix
+++ b/nixos/modules/services/misc/packagekit.nix
@@ -40,9 +40,9 @@ in
 
   options.services.packagekit = {
     enable = mkEnableOption (lib.mdDoc ''
-      PackageKit provides a cross-platform D-Bus abstraction layer for
+      PackageKit, a cross-platform D-Bus abstraction layer for
       installing software. Software utilizing PackageKit can install
-      software regardless of the package manager.
+      software regardless of the package manager
     '');
 
     settings = mkOption {
diff --git a/nixos/modules/services/misc/rshim.nix b/nixos/modules/services/misc/rshim.nix
index 0fef2cc228c91..706cf9136b005 100644
--- a/nixos/modules/services/misc/rshim.nix
+++ b/nixos/modules/services/misc/rshim.nix
@@ -12,7 +12,7 @@ let
 in
 {
   options.services.rshim = {
-    enable = lib.mkEnableOption (lib.mdDoc "User-space rshim driver for the BlueField SoC");
+    enable = lib.mkEnableOption (lib.mdDoc "user-space rshim driver for the BlueField SoC");
 
     package = lib.mkPackageOptionMD pkgs "rshim-user-space" { };
 
diff --git a/nixos/modules/services/misc/soft-serve.nix b/nixos/modules/services/misc/soft-serve.nix
new file mode 100644
index 0000000000000..0f246493880b9
--- /dev/null
+++ b/nixos/modules/services/misc/soft-serve.nix
@@ -0,0 +1,99 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.soft-serve;
+  configFile = format.generate "config.yaml" cfg.settings;
+  format = pkgs.formats.yaml { };
+  docUrl = "https://charm.sh/blog/self-hosted-soft-serve/";
+  stateDir = "/var/lib/soft-serve";
+in
+{
+  options = {
+    services.soft-serve = {
+      enable = mkEnableOption "Enable soft-serve service";
+
+      package = mkPackageOption pkgs "soft-serve" { };
+
+      settings = mkOption {
+        type = format.type;
+        default = { };
+        description = mdDoc ''
+          The contents of the configuration file.
+
+          See <${docUrl}>.
+        '';
+        example = literalExpression ''
+          {
+            name = "dadada's repos";
+            log_format = "text";
+            ssh = {
+              listen_addr = ":23231";
+              public_url = "ssh://localhost:23231";
+              max_timeout = 30;
+              idle_timeout = 120;
+            };
+            stats.listen_addr = ":23233";
+          }
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.tmpfiles.rules = [
+      # The config file has to be inside the state dir
+      "L+ ${stateDir}/config.yaml - - - - ${configFile}"
+    ];
+
+    systemd.services.soft-serve = {
+      description = "Soft Serve git server";
+      documentation = [ docUrl ];
+      requires = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment.SOFT_SERVE_DATA_PATH = stateDir;
+
+      serviceConfig = {
+        Type = "simple";
+        DynamicUser = true;
+        Restart = "always";
+        ExecStart = "${getExe cfg.package} serve";
+        StateDirectory = "soft-serve";
+        WorkingDirectory = stateDir;
+        RuntimeDirectory = "soft-serve";
+        RuntimeDirectoryMode = "0750";
+        ProcSubset = "pid";
+        ProtectProc = "invisible";
+        UMask = "0027";
+        CapabilityBoundingSet = "";
+        ProtectHome = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        RemoveIPC = true;
+        PrivateMounts = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @setuid @swap"
+        ];
+      };
+    };
+  };
+
+  meta.maintainers = [ maintainers.dadada ];
+}
diff --git a/nixos/modules/services/misc/sourcehut/default.nix b/nixos/modules/services/misc/sourcehut/default.nix
index 580a009a0ad39..bee9716629722 100644
--- a/nixos/modules/services/misc/sourcehut/default.nix
+++ b/nixos/modules/services/misc/sourcehut/default.nix
@@ -438,7 +438,7 @@ in
         };
 
         options."lists.sr.ht" = commonServiceSettings "lists" // {
-          allow-new-lists = mkEnableOption (lib.mdDoc "Allow creation of new lists");
+          allow-new-lists = mkEnableOption (lib.mdDoc "creation of new lists");
           notify-from = mkOption {
             description = lib.mdDoc "Outgoing email for notifications generated by users.";
             type = types.str;
diff --git a/nixos/modules/services/misc/tp-auto-kbbl.nix b/nixos/modules/services/misc/tp-auto-kbbl.nix
index 8d92d3d936773..1076c814e86cd 100644
--- a/nixos/modules/services/misc/tp-auto-kbbl.nix
+++ b/nixos/modules/services/misc/tp-auto-kbbl.nix
@@ -9,7 +9,7 @@ in {
 
   options = {
     services.tp-auto-kbbl = {
-      enable = mkEnableOption (lib.mdDoc "Auto toggle keyboard back-lighting on Thinkpads (and maybe other laptops) for Linux");
+      enable = mkEnableOption (lib.mdDoc "auto toggle keyboard back-lighting on Thinkpads (and maybe other laptops) for Linux");
 
       package = mkOption {
         type = types.package;
diff --git a/nixos/modules/services/misc/zoneminder.nix b/nixos/modules/services/misc/zoneminder.nix
index b2e4e760d8287..fca03b2ad4e10 100644
--- a/nixos/modules/services/misc/zoneminder.nix
+++ b/nixos/modules/services/misc/zoneminder.nix
@@ -67,14 +67,14 @@ in {
   options = {
     services.zoneminder = with lib; {
       enable = lib.mkEnableOption (lib.mdDoc ''
-        ZoneMinder
+        ZoneMinder.
 
         If you intend to run the database locally, you should set
         `config.services.zoneminder.database.createLocally` to true. Otherwise,
         when set to `false` (the default), you will have to create the database
         and database user as well as populate the database yourself.
         Additionally, you will need to run `zmupdate.pl` yourself when
-        upgrading to a newer version.
+        upgrading to a newer version
       '');
 
       webserver = mkOption {
diff --git a/nixos/modules/services/monitoring/mackerel-agent.nix b/nixos/modules/services/monitoring/mackerel-agent.nix
index 67dc1bc19edd8..62a7858500f24 100644
--- a/nixos/modules/services/monitoring/mackerel-agent.nix
+++ b/nixos/modules/services/monitoring/mackerel-agent.nix
@@ -11,10 +11,10 @@ in {
 
     # the upstream package runs as root, but doesn't seem to be strictly
     # necessary for basic functionality
-    runAsRoot = mkEnableOption (lib.mdDoc "Whether to run as root");
+    runAsRoot = mkEnableOption (lib.mdDoc "running as root");
 
     autoRetirement = mkEnableOption (lib.mdDoc ''
-      Whether to automatically retire the host upon OS shutdown.
+      retiring the host upon OS shutdown
     '');
 
     apiKeyFile = mkOption {
@@ -59,7 +59,7 @@ in {
         };
 
         options.diagnostic =
-          mkEnableOption (lib.mdDoc "Collect memory usage for the agent itself");
+          mkEnableOption (lib.mdDoc "collecting memory usage for the agent itself");
       };
     };
   };
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix b/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
index c98dcd9f64bfb..9b7590314936e 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
@@ -11,7 +11,7 @@ in {
     ({ options.warnings = options.warnings; options.assertions = options.assertions; })
   ];
   extraOpts = {
-    verbose = mkEnableOption (lib.mdDoc "Verbose logging mode for prometheus-wireguard-exporter");
+    verbose = mkEnableOption (lib.mdDoc "verbose logging mode for prometheus-wireguard-exporter");
 
     wireguardConfig = mkOption {
       type = with types; nullOr (either path str);
diff --git a/nixos/modules/services/network-filesystems/openafs/server.nix b/nixos/modules/services/network-filesystems/openafs/server.nix
index ad0fd7835670d..fbaa7cfc19293 100644
--- a/nixos/modules/services/network-filesystems/openafs/server.nix
+++ b/nixos/modules/services/network-filesystems/openafs/server.nix
@@ -177,13 +177,13 @@ in {
 
         backup = {
           enable = mkEnableOption (lib.mdDoc ''
-            Backup server role. When using OpenAFS built-in buserver, use in conjunction with the
+            the backup server role. When using OpenAFS built-in buserver, use in conjunction with the
             `database` role to maintain the Backup
             Database. Normally only used in conjunction with tape storage
             or IBM's Tivoli Storage Manager.
 
             For a modern backup server, enable this role and see
-            {option}`enableFabs`.
+            {option}`enableFabs`
           '');
 
           enableFabs = mkEnableOption (lib.mdDoc ''
diff --git a/nixos/modules/services/networking/create_ap.nix b/nixos/modules/services/networking/create_ap.nix
index e772cf21ec573..994aa6d36d2ae 100644
--- a/nixos/modules/services/networking/create_ap.nix
+++ b/nixos/modules/services/networking/create_ap.nix
@@ -8,7 +8,7 @@ let
 in {
   options = {
     services.create_ap = {
-      enable = mkEnableOption (lib.mdDoc "setup wifi hotspots using create_ap");
+      enable = mkEnableOption (lib.mdDoc "setting up wifi hotspots using create_ap");
       settings = mkOption {
         type = with types; attrsOf (oneOf [ int bool str ]);
         default = {};
diff --git a/nixos/modules/services/networking/dae.nix b/nixos/modules/services/networking/dae.nix
index 3c7f386d2d482..cf3fead19be58 100644
--- a/nixos/modules/services/networking/dae.nix
+++ b/nixos/modules/services/networking/dae.nix
@@ -14,7 +14,7 @@ in
   options = {
     services.dae = with lib;{
       enable = mkEnableOption
-        (mdDoc "A Linux high-performance transparent proxy solution based on eBPF");
+        (mdDoc "dae, a Linux high-performance transparent proxy solution based on eBPF");
 
       package = mkPackageOptionMD pkgs "dae" { };
 
@@ -46,7 +46,7 @@ in
       openFirewall = mkOption {
         type = with types; submodule {
           options = {
-            enable = mkEnableOption "enable";
+            enable = mkEnableOption (mdDoc "opening {option}`port` in the firewall");
             port = mkOption {
               type = types.port;
               description = ''
@@ -91,7 +91,7 @@ in
       };
 
       disableTxChecksumIpGeneric =
-        mkEnableOption (mdDoc "See <https://github.com/daeuniverse/dae/issues/43>");
+        mkEnableOption "" // { description = mdDoc "See <https://github.com/daeuniverse/dae/issues/43>"; };
 
     };
   };
diff --git a/nixos/modules/services/networking/ddclient.nix b/nixos/modules/services/networking/ddclient.nix
new file mode 100644
index 0000000000000..8f4fb0bc78d4e
--- /dev/null
+++ b/nixos/modules/services/networking/ddclient.nix
@@ -0,0 +1,234 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.services.ddclient;
+  boolToStr = bool: if bool then "yes" else "no";
+  dataDir = "/var/lib/ddclient";
+  StateDirectory = builtins.baseNameOf dataDir;
+  RuntimeDirectory = StateDirectory;
+
+  configFile' = pkgs.writeText "ddclient.conf" ''
+    # This file can be used as a template for configFile or is automatically generated by Nix options.
+    cache=${dataDir}/ddclient.cache
+    foreground=YES
+    use=${cfg.use}
+    login=${cfg.username}
+    password=${if cfg.protocol == "nsupdate" then "/run/${RuntimeDirectory}/ddclient.key" else "@password_placeholder@"}
+    protocol=${cfg.protocol}
+    ${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
+    ${lib.optionalString (cfg.server != "") "server=${cfg.server}"}
+    ${lib.optionalString (cfg.zone != "")   "zone=${cfg.zone}"}
+    ssl=${boolToStr cfg.ssl}
+    wildcard=YES
+    quiet=${boolToStr cfg.quiet}
+    verbose=${boolToStr cfg.verbose}
+    ${cfg.extraConfig}
+    ${lib.concatStringsSep "," cfg.domains}
+  '';
+  configFile = if (cfg.configFile != null) then cfg.configFile else configFile';
+
+  preStart = ''
+    install --mode=600 --owner=$USER ${configFile} /run/${RuntimeDirectory}/ddclient.conf
+    ${lib.optionalString (cfg.configFile == null) (if (cfg.protocol == "nsupdate") then ''
+      install --mode=600 --owner=$USER ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
+    '' else if (cfg.passwordFile != null) then ''
+      "${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "${cfg.passwordFile}" "/run/${RuntimeDirectory}/ddclient.conf"
+    '' else ''
+      sed -i '/^password=@password_placeholder@$/d' /run/${RuntimeDirectory}/ddclient.conf
+    '')}
+  '';
+
+in
+
+with lib;
+
+{
+
+  imports = [
+    (mkChangedOptionModule [ "services" "ddclient" "domain" ] [ "services" "ddclient" "domains" ]
+      (config:
+        let value = getAttrFromPath [ "services" "ddclient" "domain" ] config;
+        in optional (value != "") value))
+    (mkRemovedOptionModule [ "services" "ddclient" "homeDir" ] "")
+    (mkRemovedOptionModule [ "services" "ddclient" "password" ] "Use services.ddclient.passwordFile instead.")
+    (mkRemovedOptionModule [ "services" "ddclient" "ipv6" ] "")
+  ];
+
+  ###### interface
+
+  options = {
+
+    services.ddclient = with lib.types; {
+
+      enable = mkOption {
+        default = false;
+        type = bool;
+        description = lib.mdDoc ''
+          Whether to synchronise your machine's IP address with a dynamic DNS provider (e.g. dyndns.org).
+        '';
+      };
+
+      package = mkOption {
+        type = package;
+        default = pkgs.ddclient;
+        defaultText = lib.literalExpression "pkgs.ddclient";
+        description = lib.mdDoc ''
+          The ddclient executable package run by the service.
+        '';
+      };
+
+      domains = mkOption {
+        default = [ "" ];
+        type = listOf str;
+        description = lib.mdDoc ''
+          Domain name(s) to synchronize.
+        '';
+      };
+
+      username = mkOption {
+        # For `nsupdate` username contains the path to the nsupdate executable
+        default = lib.optionalString (config.services.ddclient.protocol == "nsupdate") "${pkgs.bind.dnsutils}/bin/nsupdate";
+        defaultText = "";
+        type = str;
+        description = lib.mdDoc ''
+          User name.
+        '';
+      };
+
+      passwordFile = mkOption {
+        default = null;
+        type = nullOr str;
+        description = lib.mdDoc ''
+          A file containing the password or a TSIG key in named format when using the nsupdate protocol.
+        '';
+      };
+
+      interval = mkOption {
+        default = "10min";
+        type = str;
+        description = lib.mdDoc ''
+          The interval at which to run the check and update.
+          See {command}`man 7 systemd.time` for the format.
+        '';
+      };
+
+      configFile = mkOption {
+        default = null;
+        type = nullOr path;
+        description = lib.mdDoc ''
+          Path to configuration file.
+          When set this overrides the generated configuration from module options.
+        '';
+        example = "/root/nixos/secrets/ddclient.conf";
+      };
+
+      protocol = mkOption {
+        default = "dyndns2";
+        type = str;
+        description = lib.mdDoc ''
+          Protocol to use with dynamic DNS provider (see https://sourceforge.net/p/ddclient/wiki/protocols).
+        '';
+      };
+
+      server = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          Server address.
+        '';
+      };
+
+      ssl = mkOption {
+        default = true;
+        type = bool;
+        description = lib.mdDoc ''
+          Whether to use SSL/TLS to connect to dynamic DNS provider.
+        '';
+      };
+
+      quiet = mkOption {
+        default = false;
+        type = bool;
+        description = lib.mdDoc ''
+          Print no messages for unnecessary updates.
+        '';
+      };
+
+      script = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          script as required by some providers.
+        '';
+      };
+
+      use = mkOption {
+        default = "web, web=checkip.dyndns.com/, web-skip='Current IP Address: '";
+        type = str;
+        description = lib.mdDoc ''
+          Method to determine the IP address to send to the dynamic DNS provider.
+        '';
+      };
+
+      verbose = mkOption {
+        default = false;
+        type = bool;
+        description = lib.mdDoc ''
+          Print verbose information.
+        '';
+      };
+
+      zone = mkOption {
+        default = "";
+        type = str;
+        description = lib.mdDoc ''
+          zone as required by some providers.
+        '';
+      };
+
+      extraConfig = mkOption {
+        default = "";
+        type = lines;
+        description = lib.mdDoc ''
+          Extra configuration. Contents will be added verbatim to the configuration file.
+
+          ::: {.note}
+          `daemon` should not be added here because it does not work great with the systemd-timer approach the service uses.
+          :::
+        '';
+      };
+    };
+  };
+
+
+  ###### implementation
+
+  config = mkIf config.services.ddclient.enable {
+    systemd.services.ddclient = {
+      description = "Dynamic DNS Client";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      restartTriggers = optional (cfg.configFile != null) cfg.configFile;
+      path = lib.optional (lib.hasPrefix "if," cfg.use) pkgs.iproute2;
+
+      serviceConfig = {
+        DynamicUser = true;
+        RuntimeDirectoryMode = "0700";
+        inherit RuntimeDirectory;
+        inherit StateDirectory;
+        Type = "oneshot";
+        ExecStartPre = "!${pkgs.writeShellScript "ddclient-prestart" preStart}";
+        ExecStart = "${lib.getExe cfg.package} -file /run/${RuntimeDirectory}/ddclient.conf";
+      };
+    };
+
+    systemd.timers.ddclient = {
+      description = "Run ddclient";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = cfg.interval;
+        OnUnitInactiveSec = cfg.interval;
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/deconz.nix b/nixos/modules/services/networking/deconz.nix
index 1fe103733212f..05b7247087771 100644
--- a/nixos/modules/services/networking/deconz.nix
+++ b/nixos/modules/services/networking/deconz.nix
@@ -54,13 +54,13 @@ in
       description = "TCP port for the WebSocket.";
     };
 
-    openFirewall = lib.mkEnableOption "open up the service ports in the firewall";
+    openFirewall = lib.mkEnableOption "opening up the service ports in the firewall";
 
-    allowRebootSystem = lib.mkEnableOption "allow rebooting the system";
+    allowRebootSystem = lib.mkEnableOption "rebooting the system";
 
-    allowRestartService = lib.mkEnableOption "allow killing/restarting processes";
+    allowRestartService = lib.mkEnableOption "killing/restarting processes";
 
-    allowSetSystemTime = lib.mkEnableOption "allow setting the system time";
+    allowSetSystemTime = lib.mkEnableOption "setting the system time";
 
     extraArgs = lib.mkOption {
       type = lib.types.listOf lib.types.str;
diff --git a/nixos/modules/services/networking/go-neb.nix b/nixos/modules/services/networking/go-neb.nix
index b65bb5f548ee8..78d24ecf17d98 100644
--- a/nixos/modules/services/networking/go-neb.nix
+++ b/nixos/modules/services/networking/go-neb.nix
@@ -9,7 +9,7 @@ let
   configFile = settingsFormat.generate "config.yaml" cfg.config;
 in {
   options.services.go-neb = {
-    enable = mkEnableOption (lib.mdDoc "Extensible matrix bot written in Go");
+    enable = mkEnableOption (lib.mdDoc "an extensible matrix bot written in Go");
 
     bindAddress = mkOption {
       type = types.str;
diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix
index 4ec066c2ec970..ffb1544630531 100644
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@@ -116,10 +116,10 @@ in {
   options = {
     services.hostapd = {
       enable = mkEnableOption (mdDoc ''
-        Whether to enable hostapd. hostapd is a user space daemon for access point and
+        hostapd, a user space daemon for access point and
         authentication servers. It implements IEEE 802.11 access point management,
         IEEE 802.1X/WPA/WPA2/EAP Authenticators, RADIUS client, EAP server, and RADIUS
-        authentication server.
+        authentication server
       '');
 
       package = mkPackageOption pkgs "hostapd" {};
diff --git a/nixos/modules/services/networking/hylafax/options.nix b/nixos/modules/services/networking/hylafax/options.nix
index 82c144236f3b8..49b2bef90a5fe 100644
--- a/nixos/modules/services/networking/hylafax/options.nix
+++ b/nixos/modules/services/networking/hylafax/options.nix
@@ -272,18 +272,18 @@ in
     };
 
     faxcron.enable.spoolInit = mkEnableOption (lib.mdDoc ''
-      Purge old files from the spooling area with
+      purging old files from the spooling area with
       {file}`faxcron`
-      each time the spooling area is initialized.
+      each time the spooling area is initialized
     '');
     faxcron.enable.frequency = mkOption {
       type = nullOr nonEmptyStr;
       default = null;
       example = "daily";
       description = lib.mdDoc ''
-        Purge old files from the spooling area with
+        purging old files from the spooling area with
         {file}`faxcron` with the given frequency
-        (see systemd.time(7)).
+        (see systemd.time(7))
       '';
     };
     faxcron.infoDays = mkOption {
diff --git a/nixos/modules/services/networking/i2pd.nix b/nixos/modules/services/networking/i2pd.nix
index c940324ad0964..f872daf05b8f0 100644
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@@ -265,7 +265,7 @@ in
         '';
       };
 
-      logCLFTime = mkEnableOption (lib.mdDoc "Full CLF-formatted date and time to log");
+      logCLFTime = mkEnableOption (lib.mdDoc "full CLF-formatted date and time to log");
 
       address = mkOption {
         type = with types; nullOr str;
@@ -456,7 +456,7 @@ in
         '';
       };
 
-      trust.enable = mkEnableOption (lib.mdDoc "Explicit trust options");
+      trust.enable = mkEnableOption (lib.mdDoc "explicit trust options");
 
       trust.family = mkOption {
         type = with types; nullOr str;
@@ -474,7 +474,7 @@ in
         '';
       };
 
-      trust.hidden = mkEnableOption (lib.mdDoc "Router concealment");
+      trust.hidden = mkEnableOption (lib.mdDoc "router concealment");
 
       websocket = mkEndpointOpt "websockets" "127.0.0.1" 7666;
 
@@ -552,7 +552,7 @@ in
 
       proto.http = (mkEndpointOpt "http" "127.0.0.1" 7070) // {
 
-        auth = mkEnableOption (lib.mdDoc "Webconsole authentication");
+        auth = mkEnableOption (lib.mdDoc "webconsole authentication");
 
         user = mkOption {
           type = types.str;
diff --git a/nixos/modules/services/networking/iscsi/initiator.nix b/nixos/modules/services/networking/iscsi/initiator.nix
index d2865a660ead0..9c71a988f29cc 100644
--- a/nixos/modules/services/networking/iscsi/initiator.nix
+++ b/nixos/modules/services/networking/iscsi/initiator.nix
@@ -7,7 +7,7 @@ in
     enable = mkEnableOption (lib.mdDoc "the openiscsi iscsi daemon");
     enableAutoLoginOut = mkEnableOption (lib.mdDoc ''
       automatic login and logout of all automatic targets.
-      You probably do not want this.
+      You probably do not want this
     '');
     discoverPortal = mkOption {
       type = nullOr str;
diff --git a/nixos/modules/services/networking/nar-serve.nix b/nixos/modules/services/networking/nar-serve.nix
index beee53c8a2425..b8b76120e44f6 100644
--- a/nixos/modules/services/networking/nar-serve.nix
+++ b/nixos/modules/services/networking/nar-serve.nix
@@ -10,7 +10,7 @@ in
   };
   options = {
     services.nar-serve = {
-      enable = mkEnableOption (lib.mdDoc "Serve NAR file contents via HTTP");
+      enable = mkEnableOption (lib.mdDoc "serving NAR file contents via HTTP");
 
       port = mkOption {
         type = types.port;
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 53c847ee3ca28..d32712c8243d7 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -4,6 +4,7 @@ with lib;
 
 let
   cfg = config.networking.networkmanager;
+  ini = pkgs.formats.ini { };
 
   delegateWireless = config.networking.wireless.enable == true && cfg.unmanaged != [ ];
 
@@ -379,6 +380,74 @@ in
           https://modemmanager.org/docs/modemmanager/fcc-unlock/#integration-with-third-party-fcc-unlock-tools.
         '';
       };
+      ensureProfiles = {
+        profiles = with lib.types; mkOption {
+          type = attrsOf (submodule {
+            freeformType = ini.type;
+
+            options = {
+              connection = {
+                id = lib.mkOption {
+                  type = str;
+                  description = "This is the name that will be displayed by NetworkManager and GUIs.";
+                };
+                type = lib.mkOption {
+                  type = str;
+                  description = "The connection type defines the connection kind, like vpn, wireguard, gsm, wifi and more.";
+                  example = "vpn";
+                };
+              };
+            };
+          });
+          apply = (lib.filterAttrsRecursive (n: v: v != { }));
+          default = { };
+          example = {
+            home-wifi = {
+              connection = {
+                id = "home-wifi";
+                type = "wifi";
+                permissions = "";
+              };
+              wifi = {
+                mac-address-blacklist = "";
+                mode = "infrastructure";
+                ssid = "Home Wi-Fi";
+              };
+              wifi-security = {
+                auth-alg = "open";
+                key-mgmt = "wpa-psk";
+                psk = "$HOME_WIFI_PASSWORD";
+              };
+              ipv4 = {
+                dns-search = "";
+                method = "auto";
+              };
+              ipv6 = {
+                addr-gen-mode = "stable-privacy";
+                dns-search = "";
+                method = "auto";
+              };
+            };
+          };
+          description = lib.mdDoc ''
+            Declaratively define NetworkManager profiles. You can find information about the generated file format [here](https://networkmanager.dev/docs/api/latest/nm-settings-keyfile.html) and [here](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/assembly_networkmanager-connection-profiles-in-keyfile-format_configuring-and-managing-networking).
+            You current profiles which are most likely stored in `/etc/NetworkManager/system-connections` and there is [a tool](https://github.com/janik-haag/nm2nix) to convert them to the needed nix code.
+            If you add a new ad-hoc connection via a GUI or nmtui or anything similar it should just work together with the declarative ones.
+            And if you edit a declarative profile NetworkManager will move it to the persistent storage and treat it like a ad-hoc one,
+            but there will be two profiles as soon as the systemd unit from this option runs again which can be confusing since NetworkManager tools will start displaying two profiles with the same name and probably a bit different settings depending on what you edited.
+            A profile won't be deleted even if it's removed from the config until the system reboots because that's when NetworkManager clears it's temp directory.
+          '';
+        };
+        environmentFiles = mkOption {
+          default = [];
+          type = types.listOf types.path;
+          example = [ "/run/secrets/network-manager.env" ];
+          description = lib.mdDoc ''
+            Files to load as environment file. Environment variables from this file
+            will be substituted into the static configuration file using [envsubst](https://github.com/a8m/envsubst).
+          '';
+        };
+      };
     };
   };
 
@@ -507,6 +576,30 @@ in
       aliases = [ "dbus-org.freedesktop.nm-dispatcher.service" ];
     };
 
+    systemd.services.NetworkManager-ensure-profiles = mkIf (cfg.ensureProfiles.profiles != { }) {
+      description = "Ensure that NetworkManager declarative profiles are created";
+      wantedBy = [ "multi-user.target" ];
+      before = [ "network-online.target" ];
+      script = let
+        path = id: "/run/NetworkManager/system-connections/${id}.nmconnection";
+      in ''
+        mkdir -p /run/NetworkManager/system-connections
+      '' + lib.concatMapStringsSep "\n"
+        (profile: ''
+          ${pkgs.envsubst}/bin/envsubst -i ${ini.generate (lib.escapeShellArg profile.n) profile.v} > ${path (lib.escapeShellArg profile.n)}
+        '') (lib.mapAttrsToList (n: v: { inherit n v; }) cfg.ensureProfiles.profiles)
+      + ''
+        if systemctl is-active --quiet NetworkManager; then
+          ${pkgs.networkmanager}/bin/nmcli connection reload
+        fi
+      '';
+      serviceConfig = {
+        EnvironmentFile = cfg.ensureProfiles.environmentFiles;
+        UMask = "0177";
+        Type = "oneshot";
+      };
+    };
+
     # Turn off NixOS' network management when networking is managed entirely by NetworkManager
     networking = mkMerge [
       (mkIf (!delegateWireless) {
diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index a0afdb4527528..424d005dc0b5e 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -103,7 +103,7 @@ in
       '';
     };
 
-    networking.nftables.flushRuleset = mkEnableOption (lib.mdDoc "Flush the entire ruleset on each reload.");
+    networking.nftables.flushRuleset = mkEnableOption (lib.mdDoc "flushing the entire ruleset on each reload");
 
     networking.nftables.extraDeletions = mkOption {
       type = types.lines;
diff --git a/nixos/modules/services/networking/snowflake-proxy.nix b/nixos/modules/services/networking/snowflake-proxy.nix
index ca015ed9d44bc..19b68f1e20ba6 100644
--- a/nixos/modules/services/networking/snowflake-proxy.nix
+++ b/nixos/modules/services/networking/snowflake-proxy.nix
@@ -8,7 +8,7 @@ in
 {
   options = {
     services.snowflake-proxy = {
-      enable = mkEnableOption (lib.mdDoc "System to defeat internet censorship");
+      enable = mkEnableOption (lib.mdDoc "snowflake-proxy, a system to defeat internet censorship");
 
       broker = mkOption {
         description = lib.mdDoc "Broker URL (default \"https://snowflake-broker.torproject.net/\")";
diff --git a/nixos/modules/services/networking/yggdrasil.nix b/nixos/modules/services/networking/yggdrasil.nix
index 8335583d2dadc..56d81fb040137 100644
--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@@ -116,9 +116,9 @@ in
       };
 
       persistentKeys = mkEnableOption (lib.mdDoc ''
-        If enabled then keys will be generated once and Yggdrasil
+        persistent keys. If enabled then keys will be generated once and Yggdrasil
         will retain the same IPv6 address when the service is
-        restarted. Keys are stored at ${keysPath}.
+        restarted. Keys are stored at ${keysPath}
       '');
 
       extraArgs = mkOption {
diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix
index 7059284850a50..235f29ab8a6a2 100644
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@@ -103,9 +103,9 @@ in
       };
 
       bantime = mkOption {
-        default = null;
-        type = types.nullOr types.str;
-        example = "10m";
+        default = "10m";
+        type = types.str;
+        example = "1h";
         description = lib.mdDoc "Number of seconds that a host is banned.";
       };
 
diff --git a/nixos/modules/services/security/jitterentropy-rngd.nix b/nixos/modules/services/security/jitterentropy-rngd.nix
new file mode 100644
index 0000000000000..7bfacb5ddc5de
--- /dev/null
+++ b/nixos/modules/services/security/jitterentropy-rngd.nix
@@ -0,0 +1,18 @@
+{ lib, config, pkgs, ... }:
+let
+  cfg = config.services.jitterentropy-rngd;
+in
+{
+  options.services.jitterentropy-rngd = {
+    enable =
+      lib.mkEnableOption (lib.mdDoc "jitterentropy-rngd service configuration");
+    package = lib.mkPackageOptionMD pkgs "jitterentropy-rngd" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.packages = [ cfg.package ];
+    systemd.services."jitterentropy".wantedBy = [ "basic.target" ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ thillux ];
+}
diff --git a/nixos/modules/services/system/earlyoom.nix b/nixos/modules/services/system/earlyoom.nix
index 3f501d4534603..38805eba2ca10 100644
--- a/nixos/modules/services/system/earlyoom.nix
+++ b/nixos/modules/services/system/earlyoom.nix
@@ -11,7 +11,7 @@ let
 in
 {
   options.services.earlyoom = {
-    enable = mkEnableOption (lib.mdDoc "Early out of memory killing");
+    enable = mkEnableOption (lib.mdDoc "early out of memory killing");
 
     freeMemThreshold = mkOption {
       type = types.ints.between 1 100;
diff --git a/nixos/modules/services/system/systembus-notify.nix b/nixos/modules/services/system/systembus-notify.nix
index 269197b3997e3..f79879fa13606 100644
--- a/nixos/modules/services/system/systembus-notify.nix
+++ b/nixos/modules/services/system/systembus-notify.nix
@@ -13,7 +13,7 @@ in
 
       WARNING: enabling this option (while convenient) should *not* be done on a
       machine where you do not trust the other users as it allows any other
-      local user to DoS your session by spamming notifications.
+      local user to DoS your session by spamming notifications
     '');
   };
 
diff --git a/nixos/modules/services/torrent/flexget.nix b/nixos/modules/services/torrent/flexget.nix
index 1b971838b32e0..5cd7ae6ad7db3 100644
--- a/nixos/modules/services/torrent/flexget.nix
+++ b/nixos/modules/services/torrent/flexget.nix
@@ -14,7 +14,7 @@ let
 in {
   options = {
     services.flexget = {
-      enable = mkEnableOption (lib.mdDoc "Run FlexGet Daemon");
+      enable = mkEnableOption (lib.mdDoc "FlexGet daemon");
 
       package = mkPackageOptionMD pkgs "flexget" {};
 
diff --git a/nixos/modules/services/video/mediamtx.nix b/nixos/modules/services/video/mediamtx.nix
index c3abd9cdcc5cb..50f8e8810278b 100644
--- a/nixos/modules/services/video/mediamtx.nix
+++ b/nixos/modules/services/video/mediamtx.nix
@@ -40,7 +40,7 @@ in
       };
 
       allowVideoAccess = lib.mkEnableOption (lib.mdDoc ''
-        Enable access to video devices like cameras on the system.
+        access to video devices like cameras on the system
       '');
     };
   };
diff --git a/nixos/modules/services/web-apps/cloudlog.nix b/nixos/modules/services/web-apps/cloudlog.nix
index da2cf93d7f1c8..5519d6967a128 100644
--- a/nixos/modules/services/web-apps/cloudlog.nix
+++ b/nixos/modules/services/web-apps/cloudlog.nix
@@ -69,7 +69,7 @@ let
 in
 {
   options.services.cloudlog = with types; {
-    enable = mkEnableOption (mdDoc "Whether to enable Cloudlog");
+    enable = mkEnableOption (mdDoc "Cloudlog");
     dataDir = mkOption {
       type = str;
       default = "/var/lib/cloudlog";
diff --git a/nixos/modules/services/web-apps/dex.nix b/nixos/modules/services/web-apps/dex.nix
index bd041db007a1e..0c4a71c6dfe4b 100644
--- a/nixos/modules/services/web-apps/dex.nix
+++ b/nixos/modules/services/web-apps/dex.nix
@@ -108,8 +108,7 @@ in
         ProtectClock = true;
         ProtectHome = true;
         ProtectHostname = true;
-        # Would re-mount paths ignored by temporary root
-        #ProtectSystem = "strict";
+        ProtectSystem = "strict";
         ProtectControlGroups = true;
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
@@ -121,9 +120,7 @@ in
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
         SystemCallFilter = [ "@system-service" "~@privileged @setuid @keyring" ];
-        TemporaryFileSystem = "/:ro";
-        # Does not work well with the temporary root
-        #UMask = "0066";
+        UMask = "0066";
       } // optionalAttrs (cfg.environmentFile != null) {
         EnvironmentFile = cfg.environmentFile;
       };
diff --git a/nixos/modules/services/web-apps/hedgedoc.nix b/nixos/modules/services/web-apps/hedgedoc.nix
index bfa5fd5aff25f..1a66f077b09d7 100644
--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (lib) literalExpression mdDoc mkEnableOption mkIf mkOption mkPackageOptionMD mkRenamedOptionModule types versionAtLeast;
+  inherit (lib) mkOption types mdDoc literalExpression;
 
   cfg = config.services.hedgedoc;
 
@@ -9,990 +9,189 @@ let
   # versionAtLeast statement remains set to 21.03 for backwards compatibility.
   # See https://github.com/NixOS/nixpkgs/pull/108899 and
   # https://github.com/NixOS/rfcs/blob/master/rfcs/0080-nixos-release-schedule.md.
-  name = if versionAtLeast config.system.stateVersion "21.03"
-    then "hedgedoc"
-    else "codimd";
+  name = if lib.versionAtLeast config.system.stateVersion "21.03" then
+    "hedgedoc"
+  else
+    "codimd";
 
-  settingsFormat = pkgs.formats.json {};
-
-  prettyJSON = conf:
-    pkgs.runCommandLocal "hedgedoc-config.json" {
-      nativeBuildInputs = [ pkgs.jq ];
-    } ''
-      jq '{production:del(.[]|nulls)|del(.[][]?|nulls)}' \
-        < ${settingsFormat.generate "hedgedoc-ugly.json" cfg.settings} \
-        > $out
-    '';
+  settingsFormat = pkgs.formats.json { };
 in
 {
+  meta.maintainers = with lib.maintainers; [ SuperSandro2000 h7x4 ];
+
   imports = [
-    (mkRenamedOptionModule [ "services" "codimd" ] [ "services" "hedgedoc" ])
-    (mkRenamedOptionModule
-      [ "services" "hedgedoc" "configuration" ] [ "services" "hedgedoc" "settings" ])
+    (lib.mkRenamedOptionModule [ "services" "codimd" ] [ "services" "hedgedoc" ])
+    (lib.mkRenamedOptionModule [ "services" "hedgedoc" "configuration" ] [ "services" "hedgedoc" "settings" ])
+    (lib.mkRenamedOptionModule [ "services" "hedgedoc" "groups" ] [ "users" "users" "hedgedoc" "extraGroups" ])
+    (lib.mkRemovedOptionModule [ "services" "hedgedoc" "workDir" ] ''
+      This option has been removed in favor of systemd managing the state directory.
+
+      If you have set this option without specifying `services.settings.uploadsDir`,
+      please move these files to `/var/lib/hedgedoc/uploads`, or set the option to point
+      at the correct location.
+    '')
   ];
 
   options.services.hedgedoc = {
-    package = mkPackageOptionMD pkgs "hedgedoc" { };
-    enable = mkEnableOption (lib.mdDoc "the HedgeDoc Markdown Editor");
+    package = lib.mkPackageOptionMD pkgs "hedgedoc" { };
+    enable = lib.mkEnableOption (mdDoc "the HedgeDoc Markdown Editor");
 
-    groups = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      description = lib.mdDoc ''
-        Groups to which the service user should be added.
-      '';
-    };
-
-    workDir = mkOption {
-      type = types.path;
-      default = "/var/lib/${name}";
-      description = lib.mdDoc ''
-        Working directory for the HedgeDoc service.
-      '';
-    };
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          domain = mkOption {
+            type = with types; nullOr str;
+            default = null;
+            example = "hedgedoc.org";
+            description = mdDoc ''
+              Domain to use for website.
 
-    settings = let options = {
-      debug = mkEnableOption (lib.mdDoc "debug mode");
-      domain = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "hedgedoc.org";
-        description = lib.mdDoc ''
-          Domain name for the HedgeDoc instance.
-        '';
-      };
-      urlPath = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "/url/path/to/hedgedoc";
-        description = lib.mdDoc ''
-          Path under which HedgeDoc is accessible.
-        '';
-      };
-      host = mkOption {
-        type = types.str;
-        default = "localhost";
-        description = lib.mdDoc ''
-          Address to listen on.
-        '';
-      };
-      port = mkOption {
-        type = types.port;
-        default = 3000;
-        example = 80;
-        description = lib.mdDoc ''
-          Port to listen on.
-        '';
-      };
-      path = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "/run/hedgedoc.sock";
-        description = lib.mdDoc ''
-          Specify where a UNIX domain socket should be placed.
-        '';
-      };
-      allowOrigin = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "localhost" "hedgedoc.org" ];
-        description = lib.mdDoc ''
-          List of domains to whitelist.
-        '';
-      };
-      useSSL = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Enable to use SSL server. This will also enable
-          {option}`protocolUseSSL`.
-        '';
-      };
-      enableStatsApi = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Enables or disables the /status and /metrics endpoint.
-        '';
-      };
-      hsts = {
-        enable = mkOption {
-          type = types.bool;
-          default = true;
-          description = lib.mdDoc ''
-            Whether to enable HSTS if HTTPS is also enabled.
-          '';
-        };
-        maxAgeSeconds = mkOption {
-          type = types.int;
-          default = 31536000;
-          description = lib.mdDoc ''
-            Max duration for clients to keep the HSTS status.
-          '';
-        };
-        includeSubdomains = mkOption {
-          type = types.bool;
-          default = true;
-          description = lib.mdDoc ''
-            Whether to include subdomains in HSTS.
-          '';
-        };
-        preload = mkOption {
-          type = types.bool;
-          default = true;
-          description = lib.mdDoc ''
-            Whether to allow preloading of the site's HSTS status.
-          '';
-        };
-      };
-      csp = mkOption {
-        type = types.nullOr types.attrs;
-        default = null;
-        example = literalExpression ''
-          {
-            enable = true;
-            directives = {
-              scriptSrc = "trustworthy.scripts.example.com";
-            };
-            upgradeInsecureRequest = "auto";
-            addDefaults = true;
-          }
-        '';
-        description = lib.mdDoc ''
-          Specify the Content Security Policy which is passed to Helmet.
-          For configuration details see <https://helmetjs.github.io/docs/csp/>.
-        '';
-      };
-      protocolUseSSL = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Enable to use TLS for resource paths.
-          This only applies when {option}`domain` is set.
-        '';
-      };
-      urlAddPort = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Enable to add the port to callback URLs.
-          This only applies when {option}`domain` is set
-          and only for ports other than 80 and 443.
-        '';
-      };
-      useCDN = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Whether to use CDN resources or not.
-        '';
-      };
-      allowAnonymous = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          Whether to allow anonymous usage.
-        '';
-      };
-      allowAnonymousEdits = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Whether to allow guests to edit existing notes with the `freely` permission,
-          when {option}`allowAnonymous` is enabled.
-        '';
-      };
-      allowFreeURL = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Whether to allow note creation by accessing a nonexistent note URL.
-        '';
-      };
-      requireFreeURLAuthentication = mkOption {
-        type = types.bool;
-        default = false;
-        description = lib.mdDoc ''
-          Whether to require authentication for FreeURL mode style note creation.
-        '';
-      };
-      defaultPermission = mkOption {
-        type = types.enum [ "freely" "editable" "limited" "locked" "private" ];
-        default = "editable";
-        description = lib.mdDoc ''
-          Default permissions for notes.
-          This only applies for signed-in users.
-        '';
-      };
-      dbURL = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = ''
-          postgres://user:pass@host:5432/dbname
-        '';
-        description = lib.mdDoc ''
-          Specify which database to use.
-          HedgeDoc supports mysql, postgres, sqlite and mssql.
-          See [
-          https://sequelize.readthedocs.io/en/v3/](https://sequelize.readthedocs.io/en/v3/) for more information.
-          Note: This option overrides {option}`db`.
-        '';
-      };
-      db = mkOption {
-        type = types.attrs;
-        default = {};
-        example = literalExpression ''
-          {
-            dialect = "sqlite";
-            storage = "/var/lib/${name}/db.${name}.sqlite";
-          }
-        '';
-        description = lib.mdDoc ''
-          Specify the configuration for sequelize.
-          HedgeDoc supports mysql, postgres, sqlite and mssql.
-          See [
-          https://sequelize.readthedocs.io/en/v3/](https://sequelize.readthedocs.io/en/v3/) for more information.
-          Note: This option overrides {option}`db`.
-        '';
-      };
-      sslKeyPath= mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "/var/lib/hedgedoc/hedgedoc.key";
-        description = lib.mdDoc ''
-          Path to the SSL key. Needed when {option}`useSSL` is enabled.
-        '';
-      };
-      sslCertPath = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "/var/lib/hedgedoc/hedgedoc.crt";
-        description = lib.mdDoc ''
-          Path to the SSL cert. Needed when {option}`useSSL` is enabled.
-        '';
-      };
-      sslCAPath = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "/var/lib/hedgedoc/ca.crt" ];
-        description = lib.mdDoc ''
-          SSL ca chain. Needed when {option}`useSSL` is enabled.
-        '';
-      };
-      dhParamPath = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "/var/lib/hedgedoc/dhparam.pem";
-        description = lib.mdDoc ''
-          Path to the SSL dh params. Needed when {option}`useSSL` is enabled.
-        '';
-      };
-      tmpPath = mkOption {
-        type = types.str;
-        default = "/tmp";
-        description = lib.mdDoc ''
-          Path to the temp directory HedgeDoc should use.
-          Note that {option}`serviceConfig.PrivateTmp` is enabled for
-          the HedgeDoc systemd service by default.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      defaultNotePath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/default.md";
-        defaultText = literalExpression "\"\${cfg.package}/public/default.md\"";
-        description = lib.mdDoc ''
-          Path to the default Note file.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      docsPath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/docs";
-        defaultText = literalExpression "\"\${cfg.package}/public/docs\"";
-        description = lib.mdDoc ''
-          Path to the docs directory.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      indexPath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/views/index.ejs";
-        defaultText = literalExpression "\"\${cfg.package}/public/views/index.ejs\"";
-        description = lib.mdDoc ''
-          Path to the index template file.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      hackmdPath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/views/hackmd.ejs";
-        defaultText = literalExpression "\"\${cfg.package}/public/views/hackmd.ejs\"";
-        description = lib.mdDoc ''
-          Path to the hackmd template file.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      errorPath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/views/error.ejs";
-        defaultText = literalExpression "\"\${cfg.package}/public/views/error.ejs\"";
-        description = lib.mdDoc ''
-          Path to the error template file.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      prettyPath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/views/pretty.ejs";
-        defaultText = literalExpression "\"\${cfg.package}/public/views/pretty.ejs\"";
-        description = lib.mdDoc ''
-          Path to the pretty template file.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      slidePath = mkOption {
-        type = types.nullOr types.str;
-        default = "${cfg.package}/public/views/slide.hbs";
-        defaultText = literalExpression "\"\${cfg.package}/public/views/slide.hbs\"";
-        description = lib.mdDoc ''
-          Path to the slide template file.
-          (Non-canonical paths are relative to HedgeDoc's base directory)
-        '';
-      };
-      uploadsPath = mkOption {
-        type = types.str;
-        default = "${cfg.workDir}/uploads";
-        defaultText = literalExpression "\"\${cfg.workDir}/uploads\"";
-        description = lib.mdDoc ''
-          Path under which uploaded files are saved.
-        '';
-      };
-      sessionName = mkOption {
-        type = types.str;
-        default = "connect.sid";
-        description = lib.mdDoc ''
-          Specify the name of the session cookie.
-        '';
-      };
-      sessionSecret = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = lib.mdDoc ''
-          Specify the secret used to sign the session cookie.
-          If unset, one will be generated on startup.
-        '';
-      };
-      sessionLife = mkOption {
-        type = types.int;
-        default = 1209600000;
-        description = lib.mdDoc ''
-          Session life time in milliseconds.
-        '';
-      };
-      heartbeatInterval = mkOption {
-        type = types.int;
-        default = 5000;
-        description = lib.mdDoc ''
-          Specify the socket.io heartbeat interval.
-        '';
-      };
-      heartbeatTimeout = mkOption {
-        type = types.int;
-        default = 10000;
-        description = lib.mdDoc ''
-          Specify the socket.io heartbeat timeout.
-        '';
-      };
-      documentMaxLength = mkOption {
-        type = types.int;
-        default = 100000;
-        description = lib.mdDoc ''
-          Specify the maximum document length.
-        '';
-      };
-      email = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          Whether to enable email sign-in.
-        '';
-      };
-      allowEmailRegister = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          Whether to enable email registration.
-        '';
-      };
-      allowGravatar = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          Whether to use gravatar as profile picture source.
-        '';
-      };
-      imageUploadType = mkOption {
-        type = types.enum [ "imgur" "s3" "minio" "filesystem" ];
-        default = "filesystem";
-        description = lib.mdDoc ''
-          Specify where to upload images.
-        '';
-      };
-      minio = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            accessKey = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Minio access key.
-              '';
-            };
-            secretKey = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Minio secret key.
-              '';
-            };
-            endPoint = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Minio endpoint.
-              '';
-            };
-            port = mkOption {
-              type = types.port;
-              default = 9000;
-              description = lib.mdDoc ''
-                Minio listen port.
-              '';
-            };
-            secure = mkOption {
-              type = types.bool;
-              default = true;
-              description = lib.mdDoc ''
-                Whether to use HTTPS for Minio.
-              '';
-            };
+              This is useful if you are trying to run hedgedoc behind
+              a reverse proxy.
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the minio third-party integration.";
-      };
-      s3 = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            accessKeyId = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                AWS access key id.
-              '';
-            };
-            secretAccessKey = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                AWS access key.
-              '';
-            };
-            region = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                AWS S3 region.
-              '';
-            };
-          };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the s3 third-party integration.";
-      };
-      s3bucket = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = lib.mdDoc ''
-          Specify the bucket name for upload types `s3` and `minio`.
-        '';
-      };
-      allowPDFExport = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          Whether to enable PDF exports.
-        '';
-      };
-      imgur.clientId = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = lib.mdDoc ''
-          Imgur API client ID.
-        '';
-      };
-      azure = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            connectionString = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Azure Blob Storage connection string.
-              '';
-            };
-            container = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Azure Blob Storage container name.
-                It will be created if non-existent.
-              '';
-            };
-          };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the azure third-party integration.";
-      };
-      oauth2 = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            authorizationURL = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Specify the OAuth authorization URL.
-              '';
-            };
-            tokenURL = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Specify the OAuth token URL.
-              '';
-            };
-            baseURL = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the OAuth base URL.
-              '';
-            };
-            userProfileURL = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the OAuth userprofile URL.
-              '';
-            };
-            userProfileUsernameAttr = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the name of the attribute for the username from the claim.
-              '';
-            };
-            userProfileDisplayNameAttr = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the name of the attribute for the display name from the claim.
-              '';
-            };
-            userProfileEmailAttr = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the name of the attribute for the email from the claim.
-              '';
-            };
-            scope = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the OAuth scope.
-              '';
-            };
-            providerName = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the name to be displayed for this strategy.
-              '';
-            };
-            rolesClaim = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the role claim name.
-              '';
-            };
-            accessRole = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify role which should be included in the ID token roles claim to grant access
-              '';
-            };
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Specify the OAuth client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = with types; nullOr str;
-              default = null;
-              description = lib.mdDoc ''
-                Specify the OAuth client secret.
-              '';
-            };
+          urlPath = mkOption {
+            type = with types; nullOr str;
+            default = null;
+            example = "hedgedoc";
+            description = mdDoc ''
+              URL path for the website.
+
+              This is useful if you are hosting hedgedoc on a path like
+              `www.example.com/hedgedoc`
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the OAuth integration.";
-      };
-      facebook = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Facebook API client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Facebook API client secret.
-              '';
-            };
+          host = mkOption {
+            type = with types; nullOr str;
+            default = "localhost";
+            description = mdDoc ''
+              Address to listen on.
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the facebook third-party integration";
-      };
-      twitter = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            consumerKey = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Twitter API consumer key.
-              '';
-            };
-            consumerSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Twitter API consumer secret.
-              '';
-            };
+          port = mkOption {
+            type = types.port;
+            default = 3000;
+            example = 80;
+            description = mdDoc ''
+              Port to listen on.
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the Twitter third-party integration.";
-      };
-      github = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                GitHub API client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Github API client secret.
-              '';
-            };
+          path = mkOption {
+            type = with types; nullOr path;
+            default = null;
+            example = "/run/hedgedoc/hedgedoc.sock";
+            description = mdDoc ''
+              Path to UNIX domain socket to listen on
+
+              ::: {.note}
+                If specified, {option}`host` and {option}`port` will be ignored.
+              :::
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the GitHub third-party integration.";
-      };
-      gitlab = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            baseURL = mkOption {
-              type = types.str;
-              default = "";
-              description = lib.mdDoc ''
-                GitLab API authentication endpoint.
-                Only needed for other endpoints than gitlab.com.
-              '';
-            };
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                GitLab API client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                GitLab API client secret.
-              '';
-            };
-            scope = mkOption {
-              type = types.enum [ "api" "read_user" ];
-              default = "api";
-              description = lib.mdDoc ''
-                GitLab API requested scope.
-                GitLab snippet import/export requires api scope.
-              '';
-            };
+          protocolUseSSL = mkOption {
+            type = types.bool;
+            default = false;
+            example = true;
+            description = mdDoc ''
+              Use `https://` for all links.
+
+              This is useful if you are trying to run hedgedoc behind
+              a reverse proxy.
+
+              ::: {.note}
+                Only applied if {option}`domain` is set.
+              :::
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the GitLab third-party integration.";
-      };
-      mattermost = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            baseURL = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Mattermost authentication endpoint.
-              '';
-            };
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Mattermost API client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Mattermost API client secret.
-              '';
-            };
+          allowOrigin = mkOption {
+            type = with types; listOf str;
+            default = with cfg.settings; [ host ] ++ lib.optionals (domain != null) [ domain ];
+            defaultText = literalExpression ''
+              with config.services.hedgedoc.settings; [ host ] ++ lib.optionals (domain != null) [ domain ]
+            '';
+            example = [ "localhost" "hedgedoc.org" ];
+            description = mdDoc ''
+              List of domains to whitelist.
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the Mattermost third-party integration.";
-      };
-      dropbox = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Dropbox API client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Dropbox API client secret.
-              '';
-            };
-            appKey = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Dropbox app key.
-              '';
-            };
+          db = mkOption {
+            type = types.attrs;
+            default = {
+              dialect = "sqlite";
+              storage = "/var/lib/${name}/db.sqlite";
+            };
+            defaultText = literalExpression ''
+              {
+                dialect = "sqlite";
+                storage = "/var/lib/hedgedoc/db.sqlite";
+              }
+            '';
+            example = literalExpression ''
+              db = {
+                username = "hedgedoc";
+                database = "hedgedoc";
+                host = "localhost:5432";
+                # or via socket
+                # host = "/run/postgresql";
+                dialect = "postgresql";
+              };
+            '';
+            description = mdDoc ''
+              Specify the configuration for sequelize.
+              HedgeDoc supports `mysql`, `postgres`, `sqlite` and `mssql`.
+              See <https://sequelize.readthedocs.io/en/v3/>
+              for more information.
+
+              ::: {.note}
+                The relevant parts will be overriden if you set {option}`dbURL`.
+              :::
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the Dropbox third-party integration.";
-      };
-      google = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            clientID = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Google API client ID.
-              '';
-            };
-            clientSecret = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Google API client secret.
-              '';
-            };
+          useSSL = mkOption {
+            type = types.bool;
+            default = false;
+            description = mdDoc ''
+              Enable to use SSL server.
+
+              ::: {.note}
+                This will also enable {option}`protocolUseSSL`.
+
+                It will also require you to set the following:
+
+                - {option}`sslKeyPath`
+                - {option}`sslCertPath`
+                - {option}`sslCAPath`
+                - {option}`dhParamPath`
+              :::
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the Google third-party integration.";
-      };
-      ldap = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            providerName = mkOption {
-              type = types.str;
-              default = "";
-              description = lib.mdDoc ''
-                Optional name to be displayed at login form, indicating the LDAP provider.
-              '';
-            };
-            url = mkOption {
-              type = types.str;
-              example = "ldap://localhost";
-              description = lib.mdDoc ''
-                URL of LDAP server.
-              '';
-            };
-            bindDn = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Bind DN for LDAP access.
-              '';
-            };
-            bindCredentials = mkOption {
-              type = types.str;
-              description = lib.mdDoc ''
-                Bind credentials for LDAP access.
-              '';
-            };
-            searchBase = mkOption {
-              type = types.str;
-              example = "o=users,dc=example,dc=com";
-              description = lib.mdDoc ''
-                LDAP directory to begin search from.
-              '';
-            };
-            searchFilter = mkOption {
-              type = types.str;
-              example = "(uid={{username}})";
-              description = lib.mdDoc ''
-                LDAP filter to search with.
-              '';
-            };
-            searchAttributes = mkOption {
-              type = types.nullOr (types.listOf types.str);
-              default = null;
-              example = [ "displayName" "mail" ];
-              description = lib.mdDoc ''
-                LDAP attributes to search with.
-              '';
-            };
-            userNameField = mkOption {
-              type = types.str;
-              default = "";
-              description = lib.mdDoc ''
-                LDAP field which is used as the username on HedgeDoc.
-                By default {option}`useridField` is used.
-              '';
-            };
-            useridField = mkOption {
-              type = types.str;
-              example = "uid";
-              description = lib.mdDoc ''
-                LDAP field which is a unique identifier for users on HedgeDoc.
-              '';
-            };
-            tlsca = mkOption {
-              type = types.str;
-              default = "/etc/ssl/certs/ca-certificates.crt";
-              example = "server-cert.pem,root.pem";
-              description = lib.mdDoc ''
-                Root CA for LDAP TLS in PEM format.
-              '';
-            };
+          uploadsPath = mkOption {
+            type = types.path;
+            default = "/var/lib/${name}/uploads";
+            defaultText = "/var/lib/hedgedoc/uploads";
+            description = mdDoc ''
+              Directory for storing uploaded images.
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the LDAP integration.";
-      };
-      saml = mkOption {
-        type = types.nullOr (types.submodule {
-          options = {
-            idpSsoUrl = mkOption {
-              type = types.str;
-              example = "https://idp.example.com/sso";
-              description = lib.mdDoc ''
-                IdP authentication endpoint.
-              '';
-            };
-            idpCert = mkOption {
-              type = types.path;
-              example = "/path/to/cert.pem";
-              description = lib.mdDoc ''
-                Path to IdP certificate file in PEM format.
-              '';
-            };
-            issuer = mkOption {
-              type = types.str;
-              default = "";
-              description = lib.mdDoc ''
-                Optional identity of the service provider.
-                This defaults to the server URL.
-              '';
-            };
-            identifierFormat = mkOption {
-              type = types.str;
-              default = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
-              description = lib.mdDoc ''
-                Optional name identifier format.
-              '';
-            };
-            groupAttribute = mkOption {
-              type = types.str;
-              default = "";
-              example = "memberOf";
-              description = lib.mdDoc ''
-                Optional attribute name for group list.
-              '';
-            };
-            externalGroups = mkOption {
-              type = types.listOf types.str;
-              default = [];
-              example = [ "Temporary-staff" "External-users" ];
-              description = lib.mdDoc ''
-                Excluded group names.
-              '';
-            };
-            requiredGroups = mkOption {
-              type = types.listOf types.str;
-              default = [];
-              example = [ "Hedgedoc-Users" ];
-              description = lib.mdDoc ''
-                Required group names.
-              '';
-            };
-            providerName = mkOption {
-              type = types.str;
-              default = "";
-              example = "My institution";
-              description = lib.mdDoc ''
-                Optional name to be displayed at login form indicating the SAML provider.
-              '';
-            };
-            attribute = {
-              id = mkOption {
-                type = types.str;
-                default = "";
-                description = lib.mdDoc ''
-                  Attribute map for `id`.
-                  Defaults to `NameID` of SAML response.
-                '';
-              };
-              username = mkOption {
-                type = types.str;
-                default = "";
-                description = lib.mdDoc ''
-                  Attribute map for `username`.
-                  Defaults to `NameID` of SAML response.
-                '';
-              };
-              email = mkOption {
-                type = types.str;
-                default = "";
-                description = lib.mdDoc ''
-                  Attribute map for `email`.
-                  Defaults to `NameID` of SAML response if
-                  {option}`identifierFormat` has
-                  the default value.
-                '';
-              };
-            };
+
+          # Declared because we change the default to false.
+          allowGravatar = mkOption {
+            type = types.bool;
+            default = false;
+            example = true;
+            description = mdDoc ''
+              Whether to enable [Libravatar](https://wiki.libravatar.org/) as
+              profile picture source on your instance.
+
+              Despite the naming of the setting, Hedgedoc replaced Gravatar
+              with Libravatar in [CodiMD 1.4.0](https://hedgedoc.org/releases/1.4.0/)
+            '';
           };
-        });
-        default = null;
-        description = lib.mdDoc "Configure the SAML integration.";
-      };
-    }; in lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-        inherit options;
+        };
       };
-      description = lib.mdDoc ''
+
+      description = mdDoc ''
         HedgeDoc configuration, see
         <https://docs.hedgedoc.org/configuration/>
         for documentation.
@@ -1003,7 +202,7 @@ in
       type = with types; nullOr path;
       default = null;
       example = "/var/lib/hedgedoc/hedgedoc.env";
-      description = lib.mdDoc ''
+      description = mdDoc ''
         Environment file as defined in {manpage}`systemd.exec(5)`.
 
         Secrets may be passed to the service without adding them to the world-readable
@@ -1028,45 +227,94 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    assertions = [
-      { assertion = cfg.settings.db == {} -> (
-          cfg.settings.dbURL != "" && cfg.settings.dbURL != null
-        );
-        message = "Database configuration for HedgeDoc missing."; }
-    ];
-    users.groups.${name} = {};
+  config = lib.mkIf cfg.enable {
+    users.groups.${name} = { };
     users.users.${name} = {
       description = "HedgeDoc service user";
       group = name;
-      extraGroups = cfg.groups;
-      home = cfg.workDir;
-      createHome = true;
       isSystemUser = true;
     };
 
+    services.hedgedoc.settings = {
+      defaultNotePath = lib.mkDefault "${cfg.package}/public/default.md";
+      docsPath = lib.mkDefault "${cfg.package}/public/docs";
+      viewPath = lib.mkDefault "${cfg.package}/public/views";
+    };
+
     systemd.services.hedgedoc = {
       description = "HedgeDoc Service";
+      documentation = [ "https://docs.hedgedoc.org/" ];
       wantedBy = [ "multi-user.target" ];
       after = [ "networking.target" ];
-      preStart = ''
-        ${pkgs.envsubst}/bin/envsubst \
-          -o ${cfg.workDir}/config.json \
-          -i ${prettyJSON cfg.settings}
-        mkdir -p ${cfg.settings.uploadsPath}
-      '';
+      preStart =
+        let
+          configFile = settingsFormat.generate "hedgedoc-config.json" {
+            production = cfg.settings;
+          };
+        in
+        ''
+          ${pkgs.envsubst}/bin/envsubst \
+            -o /run/${name}/config.json \
+            -i ${configFile}
+          ${pkgs.coreutils}/bin/mkdir -p ${cfg.settings.uploadsPath}
+        '';
       serviceConfig = {
-        WorkingDirectory = cfg.workDir;
-        StateDirectory = [ cfg.workDir cfg.settings.uploadsPath ];
-        ExecStart = "${lib.getExe cfg.package}";
-        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+        User = name;
+        Group = name;
+
+        Restart = "always";
+        ExecStart = "${cfg.package}/bin/hedgedoc";
+        RuntimeDirectory = [ name ];
+        StateDirectory = [ name ];
+        WorkingDirectory = "/run/${name}";
+        ReadWritePaths = [
+          "-${cfg.settings.uploadsPath}"
+        ] ++ lib.optionals (cfg.settings.db ? "storage") [ "-${cfg.settings.db.storage}" ];
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
         Environment = [
-          "CMD_CONFIG_FILE=${cfg.workDir}/config.json"
+          "CMD_CONFIG_FILE=/run/${name}/config.json"
           "NODE_ENV=production"
         ];
-        Restart = "always";
-        User = name;
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
         PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          # Required for connecting to database sockets,
+          # and listening to unix socket at `cfg.settings.path`
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SocketBindAllow = lib.mkIf (cfg.settings.path == null) cfg.settings.port;
+        SocketBindDeny = "any";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged @obsolete"
+          "@pkey"
+        ];
+        UMask = "0007";
       };
     };
   };
diff --git a/nixos/modules/services/web-apps/hledger-web.nix b/nixos/modules/services/web-apps/hledger-web.nix
index 0fc283ff52191..be8ecc645e59c 100644
--- a/nixos/modules/services/web-apps/hledger-web.nix
+++ b/nixos/modules/services/web-apps/hledger-web.nix
@@ -7,7 +7,7 @@ in {
 
     enable = mkEnableOption (lib.mdDoc "hledger-web service");
 
-    serveApi = mkEnableOption (lib.mdDoc "Serve only the JSON web API, without the web UI");
+    serveApi = mkEnableOption (lib.mdDoc "serving only the JSON web API, without the web UI");
 
     host = mkOption {
       type = types.str;
diff --git a/nixos/modules/services/web-apps/isso.nix b/nixos/modules/services/web-apps/isso.nix
index 1a852ec352f2c..6cb2d9ec785eb 100644
--- a/nixos/modules/services/web-apps/isso.nix
+++ b/nixos/modules/services/web-apps/isso.nix
@@ -12,11 +12,11 @@ in {
   options = {
     services.isso = {
       enable = mkEnableOption (lib.mdDoc ''
-        A commenting server similar to Disqus.
+        isso, a commenting server similar to Disqus.
 
         Note: The application's author suppose to run isso behind a reverse proxy.
         The embedded solution offered by NixOS is also only suitable for small installations
-        below 20 requests per second.
+        below 20 requests per second
       '');
 
       settings = mkOption {
diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix
index 3825b03c24496..21416be358773 100644
--- a/nixos/modules/services/web-apps/jitsi-meet.nix
+++ b/nixos/modules/services/web-apps/jitsi-meet.nix
@@ -105,9 +105,9 @@ in
         type = bool;
         default = true;
         description = lib.mdDoc ''
-          Whether to enable Jitsi Videobridge instance and configure it to connect to Prosody.
+          Jitsi Videobridge instance and configure it to connect to Prosody.
 
-          Additional configuration is possible with {option}`services.jitsi-videobridge`.
+          Additional configuration is possible with {option}`services.jitsi-videobridge`
         '';
       };
 
diff --git a/nixos/modules/services/web-apps/meme-bingo-web.nix b/nixos/modules/services/web-apps/meme-bingo-web.nix
index cb864321ef276..652dc8840252d 100644
--- a/nixos/modules/services/web-apps/meme-bingo-web.nix
+++ b/nixos/modules/services/web-apps/meme-bingo-web.nix
@@ -8,9 +8,9 @@ in {
   options = {
     services.meme-bingo-web = {
       enable = mkEnableOption (mdDoc ''
-        A web app for the meme bingo, rendered entirely on the web server and made interactive with forms.
+        a web app for the meme bingo, rendered entirely on the web server and made interactive with forms.
 
-        Note: The application's author suppose to run meme-bingo-web behind a reverse proxy for SSL and HTTP/3.
+        Note: The application's author suppose to run meme-bingo-web behind a reverse proxy for SSL and HTTP/3
       '');
 
       package = mkOption {
diff --git a/nixos/modules/services/web-apps/outline.nix b/nixos/modules/services/web-apps/outline.nix
index 1d8298963e6df..0e3bd07c1fc14 100644
--- a/nixos/modules/services/web-apps/outline.nix
+++ b/nixos/modules/services/web-apps/outline.nix
@@ -117,13 +117,14 @@ in
     storage = lib.mkOption {
       description = lib.mdDoc ''
         To support uploading of images for avatars and document attachments an
-        s3-compatible storage must be provided. AWS S3 is recommended for
+        s3-compatible storage can be provided. AWS S3 is recommended for
         redundancy however if you want to keep all file storage local an
         alternative such as [minio](https://github.com/minio/minio)
         can be used.
+        Local filesystem storage can also be used.
 
-        A more detailed guide on setting up S3 is available
-        [here](https://wiki.generaloutline.com/share/125de1cc-9ff6-424b-8415-0d58c809a40f).
+        A more detailed guide on setting up storage is available
+        [here](https://docs.getoutline.com/s/hosting/doc/file-storage-N4M0T6Ypu7).
       '';
       example = lib.literalExpression ''
         {
@@ -136,6 +137,19 @@ in
       '';
       type = lib.types.submodule {
         options = {
+          storageType = lib.mkOption {
+            type = lib.types.enum [ "local" "s3" ];
+            description = lib.mdDoc "File storage type, it can be local or s3.";
+            default = "s3";
+          };
+          localRootDir = lib.mkOption {
+            type = lib.types.str;
+            description = lib.mdDoc ''
+              If `storageType` is `local`, this sets the parent directory
+              under which all attachments/images go.
+            '';
+            default = "/var/lib/outline/data";
+          };
           accessKey = lib.mkOption {
             type = lib.types.str;
             description = lib.mdDoc "S3 access key.";
@@ -557,7 +571,10 @@ in
     systemd.tmpfiles.rules = [
       "f ${cfg.secretKeyFile} 0600 ${cfg.user} ${cfg.group} -"
       "f ${cfg.utilsSecretFile} 0600 ${cfg.user} ${cfg.group} -"
-      "f ${cfg.storage.secretKeyFile} 0600 ${cfg.user} ${cfg.group} -"
+      (if (cfg.storage.storageType == "s3") then
+        "f ${cfg.storage.secretKeyFile} 0600 ${cfg.user} ${cfg.group} -"
+      else
+        "d ${cfg.storage.localRootDir} 0700 ${cfg.user} ${cfg.group} - -")
     ];
 
     services.postgresql = lib.mkIf (cfg.databaseUrl == "local") {
@@ -599,14 +616,6 @@ in
           URL = cfg.publicUrl;
           PORT = builtins.toString cfg.port;
 
-          AWS_ACCESS_KEY_ID = cfg.storage.accessKey;
-          AWS_REGION = cfg.storage.region;
-          AWS_S3_UPLOAD_BUCKET_URL = cfg.storage.uploadBucketUrl;
-          AWS_S3_UPLOAD_BUCKET_NAME = cfg.storage.uploadBucketName;
-          AWS_S3_UPLOAD_MAX_SIZE = builtins.toString cfg.storage.uploadMaxSize;
-          AWS_S3_FORCE_PATH_STYLE = builtins.toString cfg.storage.forcePathStyle;
-          AWS_S3_ACL = cfg.storage.acl;
-
           CDN_URL = cfg.cdnUrl;
           FORCE_HTTPS = builtins.toString cfg.forceHttps;
           ENABLE_UPDATES = builtins.toString cfg.enableUpdateCheck;
@@ -622,8 +631,21 @@ in
           RATE_LIMITER_ENABLED = builtins.toString cfg.rateLimiter.enable;
           RATE_LIMITER_REQUESTS = builtins.toString cfg.rateLimiter.requests;
           RATE_LIMITER_DURATION_WINDOW = builtins.toString cfg.rateLimiter.durationWindow;
+
+          FILE_STORAGE = cfg.storage.storageType;
+          FILE_STORAGE_UPLOAD_MAX_SIZE = builtins.toString cfg.storage.uploadMaxSize;
+          FILE_STORAGE_LOCAL_ROOT_DIR = cfg.storage.localRootDir;
         }
 
+        (lib.mkIf (cfg.storage.storageType == "s3") {
+          AWS_ACCESS_KEY_ID = cfg.storage.accessKey;
+          AWS_REGION = cfg.storage.region;
+          AWS_S3_UPLOAD_BUCKET_URL = cfg.storage.uploadBucketUrl;
+          AWS_S3_UPLOAD_BUCKET_NAME = cfg.storage.uploadBucketName;
+          AWS_S3_FORCE_PATH_STYLE = builtins.toString cfg.storage.forcePathStyle;
+          AWS_S3_ACL = cfg.storage.acl;
+        })
+
         (lib.mkIf (cfg.slackAuthentication != null) {
           SLACK_CLIENT_ID = cfg.slackAuthentication.clientId;
         })
@@ -676,7 +698,9 @@ in
       script = ''
         export SECRET_KEY="$(head -n1 ${lib.escapeShellArg cfg.secretKeyFile})"
         export UTILS_SECRET="$(head -n1 ${lib.escapeShellArg cfg.utilsSecretFile})"
-        export AWS_SECRET_ACCESS_KEY="$(head -n1 ${lib.escapeShellArg cfg.storage.secretKeyFile})"
+        ${lib.optionalString (cfg.storage.storageType == "s3") ''
+          export AWS_SECRET_ACCESS_KEY="$(head -n1 ${lib.escapeShellArg cfg.storage.secretKeyFile})"
+        ''}
         ${lib.optionalString (cfg.slackAuthentication != null) ''
           export SLACK_CLIENT_SECRET="$(head -n1 ${lib.escapeShellArg cfg.slackAuthentication.secretFile})"
         ''}
diff --git a/nixos/modules/services/web-apps/phylactery.nix b/nixos/modules/services/web-apps/phylactery.nix
index 4801bd203b489..723b38ee75d93 100644
--- a/nixos/modules/services/web-apps/phylactery.nix
+++ b/nixos/modules/services/web-apps/phylactery.nix
@@ -4,7 +4,7 @@ with lib;
 let cfg = config.services.phylactery;
 in {
   options.services.phylactery = {
-    enable = mkEnableOption (lib.mdDoc "Whether to enable Phylactery server");
+    enable = mkEnableOption (lib.mdDoc "Phylactery server");
 
     host = mkOption {
       type = types.str;
diff --git a/nixos/modules/services/web-apps/snipe-it.nix b/nixos/modules/services/web-apps/snipe-it.nix
index e861a41851945..9cba5cb4fa9e0 100644
--- a/nixos/modules/services/web-apps/snipe-it.nix
+++ b/nixos/modules/services/web-apps/snipe-it.nix
@@ -30,7 +30,7 @@ let
 in {
   options.services.snipe-it = {
 
-    enable = mkEnableOption (lib.mdDoc "A free open source IT asset/license management system");
+    enable = mkEnableOption (lib.mdDoc "snipe-it, a free open source IT asset/license management system");
 
     user = mkOption {
       default = "snipeit";
diff --git a/nixos/modules/services/web-apps/zitadel.nix b/nixos/modules/services/web-apps/zitadel.nix
index f225d138cc434..99b0a0bc56f67 100644
--- a/nixos/modules/services/web-apps/zitadel.nix
+++ b/nixos/modules/services/web-apps/zitadel.nix
@@ -9,7 +9,7 @@ in
   options.services.zitadel =
     let inherit (lib) mkEnableOption mkOption mkPackageOption types;
     in {
-      enable = mkEnableOption "ZITADEL, a user and identity access management platform.";
+      enable = mkEnableOption "ZITADEL, a user and identity access management platform";
 
       package = mkPackageOption pkgs "ZITADEL" { default = [ "zitadel" ]; };
 
diff --git a/nixos/modules/services/web-servers/keter/default.nix b/nixos/modules/services/web-servers/keter/default.nix
index 3916c486475de..0cd9c30cea14d 100644
--- a/nixos/modules/services/web-servers/keter/default.nix
+++ b/nixos/modules/services/web-servers/keter/default.nix
@@ -16,7 +16,7 @@ in
   options.services.keter = {
     enable = lib.mkEnableOption (lib.mdDoc ''keter, a web app deployment manager.
 Note that this module only support loading of webapps:
-Keep an old app running and swap the ports when the new one is booted.
+Keep an old app running and swap the ports when the new one is booted
 '');
 
     root = lib.mkOption {
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 955d6e19064ef..9eebd18855c77 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -329,7 +329,7 @@ let
         listenString = { addr, port, ssl, proxyProtocol ? false, extraParameters ? [], ... }:
           # UDP listener for QUIC transport protocol.
           (optionalString (ssl && vhost.quic) ("
-            listen ${addr}:${toString port} quic "
+            listen ${addr}${optionalString (port != null) ":${toString port}"} quic "
           + optionalString vhost.default "default_server "
           + optionalString vhost.reuseport "reuseport "
           + optionalString (extraParameters != []) (concatStringsSep " "
@@ -338,7 +338,7 @@ let
             in filter isCompatibleParameter extraParameters))
           + ";"))
           + "
-            listen ${addr}:${toString port} "
+            listen ${addr}${optionalString (port != null) ":${toString port}"} "
           + optionalString (ssl && vhost.http2 && oldHTTP2) "http2 "
           + optionalString ssl "ssl "
           + optionalString vhost.default "default_server "
diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix
index 7636c1b26115f..c82f02ecefecd 100644
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -31,12 +31,12 @@ with lib;
         options = {
           addr = mkOption {
             type = str;
-            description = lib.mdDoc "IP address.";
+            description = lib.mdDoc "Listen address.";
           };
           port = mkOption {
-            type = port;
+            type = types.nullOr port;
             description = lib.mdDoc "Port number.";
-            default = 80;
+            default = null;
           };
           ssl = mkOption {
             type = bool;
@@ -60,6 +60,7 @@ with lib;
       example = [
         { addr = "195.154.1.1"; port = 443; ssl = true; }
         { addr = "192.154.1.1"; port = 80; }
+        { addr = "unix:/var/run/nginx.sock"; }
       ];
       description = lib.mdDoc ''
         Listen addresses and ports for this virtual host.
diff --git a/nixos/modules/services/web-servers/rustus.nix b/nixos/modules/services/web-servers/rustus.nix
index 878d790e36667..6d3b2e6a65d98 100644
--- a/nixos/modules/services/web-servers/rustus.nix
+++ b/nixos/modules/services/web-servers/rustus.nix
@@ -8,7 +8,7 @@ in
 
   options.services.rustus = {
 
-    enable = mkEnableOption (lib.mdDoc "TUS protocol implementation in Rust.");
+    enable = mkEnableOption (lib.mdDoc "TUS protocol implementation in Rust");
 
     host = mkOption {
       type = types.str;
diff --git a/nixos/modules/services/x11/desktop-managers/deepin.nix b/nixos/modules/services/x11/desktop-managers/deepin.nix
index b2369e2426f82..28d751305892b 100644
--- a/nixos/modules/services/x11/desktop-managers/deepin.nix
+++ b/nixos/modules/services/x11/desktop-managers/deepin.nix
@@ -15,7 +15,7 @@ in
   options = {
 
     services.xserver.desktopManager.deepin = {
-      enable = mkEnableOption (lib.mdDoc "Enable Deepin desktop manager");
+      enable = mkEnableOption (lib.mdDoc "Deepin desktop manager");
       extraGSettingsOverrides = mkOption {
         default = "";
         type = types.lines;
diff --git a/nixos/modules/system/activation/bootspec.nix b/nixos/modules/system/activation/bootspec.nix
index 9e1fa309d5db0..98c234bc340d0 100644
--- a/nixos/modules/system/activation/bootspec.nix
+++ b/nixos/modules/system/activation/bootspec.nix
@@ -79,7 +79,7 @@ in
       // { default = true; internal = true; };
     enableValidation = lib.mkEnableOption (lib.mdDoc ''the validation of bootspec documents for each build.
       This will introduce Go in the build-time closure as we are relying on [Cuelang](https://cuelang.org/) for schema validation.
-      Enable this option if you want to ascertain that your documents are correct.
+      Enable this option if you want to ascertain that your documents are correct
       ''
     );
 
diff --git a/nixos/modules/system/activation/switch-to-configuration.pl b/nixos/modules/system/activation/switch-to-configuration.pl
index e05f89bb0fb4b..b3ff3ac0abf30 100755
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@@ -599,7 +599,9 @@ while (my ($unit, $state) = each(%{$active_cur})) {
                     $units_to_start{$unit} = 1;
                     record_unit($start_list_file, $unit);
                     # Don't spam the user with target units that always get started.
-                    $units_to_filter{$unit} = 1;
+                    if (($ENV{"STC_DISPLAY_ALL_UNITS"} // "") ne "1") {
+                        $units_to_filter{$unit} = 1;
+                    }
                 }
             }
 
diff --git a/nixos/modules/system/boot/grow-partition.nix b/nixos/modules/system/boot/grow-partition.nix
index a2764187a5333..897602f9826ab 100644
--- a/nixos/modules/system/boot/grow-partition.nix
+++ b/nixos/modules/system/boot/grow-partition.nix
@@ -12,33 +12,32 @@ with lib;
   ];
 
   options = {
-    boot.growPartition = mkEnableOption (lib.mdDoc "grow the root partition on boot");
+    boot.growPartition = mkEnableOption (lib.mdDoc "growing the root partition on boot");
   };
 
   config = mkIf config.boot.growPartition {
-
-    assertions = [{
-      assertion = !config.boot.initrd.systemd.enable;
-      message = "systemd stage 1 does not support 'boot.growPartition' yet.";
-    }];
-
-    boot.initrd.extraUtilsCommands = ''
-      copy_bin_and_libs ${pkgs.gawk}/bin/gawk
-      copy_bin_and_libs ${pkgs.gnused}/bin/sed
-      copy_bin_and_libs ${pkgs.util-linux}/sbin/sfdisk
-      copy_bin_and_libs ${pkgs.util-linux}/sbin/lsblk
-
-      substitute "${pkgs.cloud-utils.guest}/bin/.growpart-wrapped" "$out/bin/growpart" \
-        --replace "${pkgs.bash}/bin/sh" "/bin/sh" \
-        --replace "awk" "gawk" \
-        --replace "sed" "gnused"
-
-      ln -s sed $out/bin/gnused
-    '';
-
-    boot.initrd.postDeviceCommands = ''
-      rootDevice="${config.fileSystems."/".device}"
-      if waitDevice "$rootDevice"; then
+    assertions = [
+      {
+        assertion = !config.boot.initrd.systemd.repart.enable && !config.systemd.repart.enable;
+        message = "systemd-repart already grows the root partition and thus you should not use boot.growPartition";
+      }
+    ];
+    systemd.services.growpart = {
+      wantedBy = [ "-.mount" ];
+      after = [ "-.mount" ];
+      before = [ "systemd-growfs-root.service" ];
+      conflicts = [ "shutdown.target" ];
+      unitConfig.DefaultDependencies = false;
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        TimeoutSec = "infinity";
+        # growpart returns 1 if the partition is already grown
+        SuccessExitStatus = "0 1";
+      };
+
+      script = ''
+        rootDevice="${config.fileSystems."/".device}"
         rootDevice="$(readlink -f "$rootDevice")"
         parentDevice="$rootDevice"
         while [ "''${parentDevice%[0-9]}" != "''${parentDevice}" ]; do
@@ -48,11 +47,8 @@ with lib;
         if [ "''${parentDevice%[0-9]p}" != "''${parentDevice}" ] && [ -b "''${parentDevice%p}" ]; then
           parentDevice="''${parentDevice%p}"
         fi
-        TMPDIR=/run sh $(type -P growpart) "$parentDevice" "$partNum"
-        udevadm settle
-      fi
-    '';
-
+        "${pkgs.cloud-utils.guest}/bin/growpart" "$parentDevice" "$partNum"
+      '';
+    };
   };
-
 }
diff --git a/nixos/modules/system/boot/loader/external/external.nix b/nixos/modules/system/boot/loader/external/external.nix
index 926cbd2b4b3f3..78982356a9ea8 100644
--- a/nixos/modules/system/boot/loader/external/external.nix
+++ b/nixos/modules/system/boot/loader/external/external.nix
@@ -12,7 +12,7 @@ in
   };
 
   options.boot.loader.external = {
-    enable = mkEnableOption (lib.mdDoc "use an external tool to install your bootloader");
+    enable = mkEnableOption (lib.mdDoc "using an external tool to install your bootloader");
 
     installHook = mkOption {
       type = with types; path;
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
index 6f0a62d0ea899..64c8ab74bba6a 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@@ -49,7 +49,7 @@ let
     '';
   };
 
-  checkedSystemdBootBuilder = pkgs.runCommand "systemd-boot" {
+  checkedSystemdBootBuilder = pkgs.runCommandLocal "systemd-boot" {
     nativeBuildInputs = [ pkgs.mypy ];
   } ''
     install -m755 ${systemdBootBuilder} $out
diff --git a/nixos/modules/system/boot/systemd/homed.nix b/nixos/modules/system/boot/systemd/homed.nix
index 403d1690124db..b216820c0c0cd 100644
--- a/nixos/modules/system/boot/systemd/homed.nix
+++ b/nixos/modules/system/boot/systemd/homed.nix
@@ -5,7 +5,7 @@ let
 in
 {
   options.services.homed.enable = lib.mkEnableOption (lib.mdDoc ''
-    Enable systemd home area/user account manager
+    systemd home area/user account manager
   '');
 
   config = lib.mkIf cfg.enable {
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 61af2768e2959..175e757cbbb6c 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -358,7 +358,7 @@ in {
     ++ lib.optional (cfg.enableTpm2 && !(pkgs.stdenv.hostPlatform.isRiscV64 || pkgs.stdenv.hostPlatform.isArmv7)) "tpm-crb";
 
     boot.initrd.systemd = {
-      initrdBin = [pkgs.bash pkgs.coreutils cfg.package.kmod cfg.package] ++ config.system.fsPackages;
+      initrdBin = [pkgs.bash pkgs.coreutils cfg.package.kmod cfg.package];
       extraBin = {
         less = "${pkgs.less}/bin/less";
         mount = "${cfg.package.util-linux}/bin/mount";
diff --git a/nixos/modules/system/boot/systemd/userdbd.nix b/nixos/modules/system/boot/systemd/userdbd.nix
index 994aa3ca3b8c1..e7f6d42341c4e 100644
--- a/nixos/modules/system/boot/systemd/userdbd.nix
+++ b/nixos/modules/system/boot/systemd/userdbd.nix
@@ -5,7 +5,7 @@ let
 in
 {
   options.services.userdbd.enable = lib.mkEnableOption (lib.mdDoc ''
-    Enables the systemd JSON user/group record lookup service
+    the systemd JSON user/group record lookup service
   '');
   config = lib.mkIf cfg.enable {
     systemd.additionalUpstreamSystemUnits = [
diff --git a/nixos/modules/tasks/filesystems/btrfs.nix b/nixos/modules/tasks/filesystems/btrfs.nix
index 82fdd60587106..87fe326c09740 100644
--- a/nixos/modules/tasks/filesystems/btrfs.nix
+++ b/nixos/modules/tasks/filesystems/btrfs.nix
@@ -52,34 +52,37 @@ in
   config = mkMerge [
     (mkIf enableBtrfs {
       system.fsPackages = [ pkgs.btrfs-progs ];
+    })
 
-      boot.initrd.kernelModules = mkIf inInitrd [ "btrfs" ];
-      boot.initrd.availableKernelModules = mkIf inInitrd (
+    (mkIf inInitrd {
+      boot.initrd.kernelModules = [ "btrfs" ];
+      boot.initrd.availableKernelModules =
         [ "crc32c" ]
         ++ optionals (config.boot.kernelPackages.kernel.kernelAtLeast "5.5") [
           # Needed for mounting filesystems with new checksums
           "xxhash_generic"
           "blake2b_generic"
           "sha256_generic" # Should be baked into our kernel, just to be sure
-        ]
-      );
+        ];
 
-      boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable)
+      boot.initrd.extraUtilsCommands = mkIf (!config.boot.initrd.systemd.enable)
       ''
         copy_bin_and_libs ${pkgs.btrfs-progs}/bin/btrfs
         ln -sv btrfs $out/bin/btrfsck
         ln -sv btrfsck $out/bin/fsck.btrfs
       '';
 
-      boot.initrd.extraUtilsCommandsTest = mkIf (inInitrd && !config.boot.initrd.systemd.enable)
+      boot.initrd.extraUtilsCommandsTest = mkIf (!config.boot.initrd.systemd.enable)
       ''
         $out/bin/btrfs --version
       '';
 
-      boot.initrd.postDeviceCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable)
+      boot.initrd.postDeviceCommands = mkIf (!config.boot.initrd.systemd.enable)
       ''
         btrfs device scan
       '';
+
+      boot.initrd.systemd.initrdBin = [ pkgs.btrfs-progs ];
     })
 
     (mkIf enableAutoScrub {
diff --git a/nixos/modules/tasks/filesystems/cifs.nix b/nixos/modules/tasks/filesystems/cifs.nix
index 0de292a692082..837b9e19bfb9d 100644
--- a/nixos/modules/tasks/filesystems/cifs.nix
+++ b/nixos/modules/tasks/filesystems/cifs.nix
@@ -21,5 +21,7 @@ in
         copy_bin_and_libs ${pkgs.cifs-utils}/sbin/mount.cifs
       '';
 
+    boot.initrd.systemd.extraBin."mount.cifs" = mkIf inInitrd "${pkgs.cifs-utils}/sbin/mount.cifs";
+
   };
 }
diff --git a/nixos/modules/tasks/filesystems/ext.nix b/nixos/modules/tasks/filesystems/ext.nix
index edc0efc552136..1c34ee2c70356 100644
--- a/nixos/modules/tasks/filesystems/ext.nix
+++ b/nixos/modules/tasks/filesystems/ext.nix
@@ -25,5 +25,7 @@ in
         ln -sv e2fsck $out/bin/fsck.ext4
       '';
 
+    boot.initrd.systemd.initrdBin = lib.mkIf inInitrd [ pkgs.e2fsprogs ];
+
   };
 }
diff --git a/nixos/modules/tasks/filesystems/f2fs.nix b/nixos/modules/tasks/filesystems/f2fs.nix
index 035784f43df83..4f99f9a57fa6d 100644
--- a/nixos/modules/tasks/filesystems/f2fs.nix
+++ b/nixos/modules/tasks/filesystems/f2fs.nix
@@ -16,5 +16,7 @@ in
     boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable) ''
       copy_bin_and_libs ${pkgs.f2fs-tools}/sbin/fsck.f2fs
     '';
+
+    boot.initrd.systemd.initrdBin = mkIf inInitrd [ pkgs.f2fs-tools ];
   };
 }
diff --git a/nixos/modules/tasks/filesystems/jfs.nix b/nixos/modules/tasks/filesystems/jfs.nix
index 6d80c4c657da6..b5132b4caa334 100644
--- a/nixos/modules/tasks/filesystems/jfs.nix
+++ b/nixos/modules/tasks/filesystems/jfs.nix
@@ -15,5 +15,7 @@ in
     boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable) ''
       copy_bin_and_libs ${pkgs.jfsutils}/sbin/fsck.jfs
     '';
+
+    boot.initrd.systemd.initrdBin = mkIf inInitrd [ pkgs.jfsutils ];
   };
 }
diff --git a/nixos/modules/tasks/filesystems/reiserfs.nix b/nixos/modules/tasks/filesystems/reiserfs.nix
index 7b017a83db848..3c6a0f0cd917f 100644
--- a/nixos/modules/tasks/filesystems/reiserfs.nix
+++ b/nixos/modules/tasks/filesystems/reiserfs.nix
@@ -21,5 +21,7 @@ in
         ln -s reiserfsck $out/bin/fsck.reiserfs
       '';
 
+    boot.initrd.systemd.initrdBin = mkIf inInitrd [ pkgs.reiserfsprogs ];
+
   };
 }
diff --git a/nixos/modules/tasks/filesystems/vfat.nix b/nixos/modules/tasks/filesystems/vfat.nix
index 5421b617b43b9..e535e97759b22 100644
--- a/nixos/modules/tasks/filesystems/vfat.nix
+++ b/nixos/modules/tasks/filesystems/vfat.nix
@@ -21,5 +21,7 @@ in
         ln -sv dosfsck $out/bin/fsck.vfat
       '';
 
+    boot.initrd.systemd.extraBin = mkIf inInitrd [ pkgs.dosfstools ];
+
   };
 }
diff --git a/nixos/modules/tasks/filesystems/xfs.nix b/nixos/modules/tasks/filesystems/xfs.nix
index f81f586465519..76f31e660ad3d 100644
--- a/nixos/modules/tasks/filesystems/xfs.nix
+++ b/nixos/modules/tasks/filesystems/xfs.nix
@@ -26,5 +26,7 @@ in
       ''
         sed -i -e 's,^#!.*,#!'$out/bin/sh, $out/bin/fsck.xfs
       '';
+
+    boot.initrd.systemd.initrdBin = mkIf inInitrd [ pkgs.xfsprogs.bin ];
   };
 }
diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix
index 5cf863c87f27c..082634ec9d010 100644
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@@ -90,12 +90,17 @@ let
 
   getPoolMounts = prefix: pool:
     let
+      poolFSes = getPoolFilesystems pool;
+
       # Remove the "/" suffix because even though most mountpoints
       # won't have it, the "/" mountpoint will, and we can't have the
       # trailing slash in "/sysroot/" in stage 1.
       mountPoint = fs: escapeSystemdPath (prefix + (lib.removeSuffix "/" fs.mountPoint));
+
+      hasUsr = lib.any (fs: fs.mountPoint == "/usr") poolFSes;
     in
-      map (x: "${mountPoint x}.mount") (getPoolFilesystems pool);
+      map (x: "${mountPoint x}.mount") poolFSes
+      ++ lib.optional hasUsr "sysusr-usr.mount";
 
   getKeyLocations = pool: if isBool cfgZfs.requestEncryptionCredentials then {
     hasKeys = cfgZfs.requestEncryptionCredentials;
@@ -632,7 +637,8 @@ in
           targets.zfs-import.wantedBy = [ "zfs.target" ];
           targets.zfs.wantedBy = [ "initrd.target" ];
           extraBin = {
-            # zpool and zfs are already in thanks to fsPackages
+            zpool = "${cfgZfs.package}/sbin/zpool";
+            zfs = "${cfgZfs.package}/sbin/zfs";
             awk = "${pkgs.gawk}/bin/awk";
           };
         };
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index cd0de51a6e08a..853a2cb31432b 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1406,28 +1406,6 @@ in
           val = tempaddrValues.${opt}.sysctl;
          in nameValuePair "net.ipv6.conf.${replaceStrings ["."] ["/"] i.name}.use_tempaddr" val));
 
-    security.wrappers = {
-      ping = {
-        owner = "root";
-        group = "root";
-        capabilities = "cap_net_raw+p";
-        source = "${pkgs.iputils.out}/bin/ping";
-      };
-    };
-    security.apparmor.policies."bin.ping".profile = lib.mkIf config.security.apparmor.policies."bin.ping".enable (lib.mkAfter ''
-      /run/wrappers/bin/ping {
-        include <abstractions/base>
-        include <nixos/security.wrappers/ping>
-        rpx /run/wrappers/wrappers.*/ping,
-      }
-      /run/wrappers/wrappers.*/ping {
-        include <abstractions/base>
-        include <nixos/security.wrappers/ping>
-        capability net_raw,
-        capability setpcap,
-      }
-    '');
-
     # Set the host and domain names in the activation script.  Don't
     # clear it if it's not configured in the NixOS configuration,
     # since it may have been set by dhcpcd in the meantime.
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index e0004df6f6b2f..737a935711ae6 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -267,6 +267,7 @@ let
   };
 
   storeImage = import ../../lib/make-disk-image.nix {
+    name = "nix-store-image";
     inherit pkgs config lib;
     additionalPaths = [ regInfo ];
     format = "qcow2";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 22371c9fec374..ef98efd7dbcaa 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -272,6 +272,7 @@ in {
   fail2ban = handleTest ./fail2ban.nix { };
   fakeroute = handleTest ./fakeroute.nix {};
   fancontrol = handleTest ./fancontrol.nix {};
+  fanout = handleTest ./fanout.nix {};
   fcitx5 = handleTest ./fcitx5 {};
   fenics = handleTest ./fenics.nix {};
   ferm = handleTest ./ferm.nix {};
@@ -332,6 +333,7 @@ in {
   graphite = handleTest ./graphite.nix {};
   graylog = handleTest ./graylog.nix {};
   grocy = handleTest ./grocy.nix {};
+  grow-partition = runTest ./grow-partition.nix;
   grub = handleTest ./grub.nix {};
   guacamole-server = handleTest ./guacamole-server.nix {};
   gvisor = handleTest ./gvisor.nix {};
@@ -558,6 +560,7 @@ in {
   nginx-sso = handleTest ./nginx-sso.nix {};
   nginx-status-page = handleTest ./nginx-status-page.nix {};
   nginx-tmpdir = handleTest ./nginx-tmpdir.nix {};
+  nginx-unix-socket = handleTest ./nginx-unix-socket.nix {};
   nginx-variants = handleTest ./nginx-variants.nix {};
   nifi = handleTestOn ["x86_64-linux"] ./web-apps/nifi.nix {};
   nitter = handleTest ./nitter.nix {};
@@ -731,6 +734,7 @@ in {
   snapper = handleTest ./snapper.nix {};
   snipe-it = runTest ./web-apps/snipe-it.nix;
   soapui = handleTest ./soapui.nix {};
+  soft-serve = handleTest ./soft-serve.nix {};
   sogo = handleTest ./sogo.nix {};
   solanum = handleTest ./solanum.nix {};
   sonarr = handleTest ./sonarr.nix {};
diff --git a/nixos/tests/fanout.nix b/nixos/tests/fanout.nix
new file mode 100644
index 0000000000000..c36d34dcce0be
--- /dev/null
+++ b/nixos/tests/fanout.nix
@@ -0,0 +1,30 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+}:
+import ./make-test-python.nix ({lib, pkgs, ...}: {
+  name = "fanout";
+  meta.maintainers = [ lib.maintainers.therishidesai ];
+
+  nodes = let
+    cfg = { ... }: {
+      services.fanout = {
+        enable = true;
+        fanoutDevices = 2;
+        bufferSize = 8192;
+      };
+    };
+  in {
+    machine = cfg;
+  };
+
+  testScript = ''
+    start_all()
+
+    # mDNS.
+    machine.wait_for_unit("multi-user.target")
+
+    machine.succeed("test -c /dev/fanout0")
+    machine.succeed("test -c /dev/fanout1")
+  '';
+})
diff --git a/nixos/tests/grow-partition.nix b/nixos/tests/grow-partition.nix
new file mode 100644
index 0000000000000..344910848dca8
--- /dev/null
+++ b/nixos/tests/grow-partition.nix
@@ -0,0 +1,83 @@
+{ lib, ... }:
+
+let
+  rootFslabel = "external";
+  rootFsDevice = "/dev/disk/by-label/${rootFslabel}";
+
+  externalModule = partitionTableType: { config, lib, pkgs, ... }: {
+    virtualisation.directBoot.enable = false;
+    virtualisation.mountHostNixStore = false;
+    virtualisation.useEFIBoot = partitionTableType == "efi";
+
+    # This stops the qemu-vm module from overriding the fileSystems option
+    # with virtualisation.fileSystems.
+    virtualisation.fileSystems = lib.mkForce { };
+
+
+    boot.loader.grub.enable = true;
+    boot.loader.grub.efiSupport = partitionTableType == "efi";
+    boot.loader.grub.efiInstallAsRemovable = partitionTableType == "efi";
+    boot.loader.grub.device = if partitionTableType == "efi" then "nodev" else "/dev/vda";
+
+    boot.growPartition = true;
+
+    fileSystems = {
+      "/".device = rootFsDevice;
+    };
+
+    system.build.diskImage = import ../lib/make-disk-image.nix {
+      inherit config lib pkgs;
+      label = rootFslabel;
+      inherit partitionTableType;
+      format = "raw";
+      bootSize = "128M";
+      additionalSpace = "0M";
+      copyChannel = false;
+    };
+  };
+in
+{
+  name = "grow-partition";
+
+  meta.maintainers = with lib.maintainers; [ arianvp ];
+
+  nodes = {
+    efi = externalModule "efi";
+    legacy = externalModule "legacy";
+    legacyGPT = externalModule "legacy+gpt";
+    hybrid = externalModule "hybrid";
+  };
+
+
+  testScript = { nodes, ... }:
+    lib.concatLines (lib.mapAttrsToList (name: node: ''
+    import os
+    import subprocess
+    import tempfile
+    import shutil
+
+    tmp_disk_image = tempfile.NamedTemporaryFile()
+
+    shutil.copyfile("${node.system.build.diskImage}/nixos.img", tmp_disk_image.name)
+
+    subprocess.run([
+      "${node.virtualisation.qemu.package}/bin/qemu-img",
+      "resize",
+      "-f",
+      "raw",
+      tmp_disk_image.name,
+      "+32M",
+    ])
+
+    # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
+    os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
+
+    ${name}.wait_for_unit("growpart.service")
+    systemd_growpart_logs = ${name}.succeed("journalctl --boot --unit growpart.service")
+    assert "CHANGED" in systemd_growpart_logs
+    ${name}.succeed("systemctl restart growpart.service")
+    systemd_growpart_logs = ${name}.succeed("journalctl --boot --unit growpart.service")
+    assert "NOCHANGE" in systemd_growpart_logs
+
+    '') nodes);
+}
diff --git a/nixos/tests/hedgedoc.nix b/nixos/tests/hedgedoc.nix
index 410350d83627c..16e0dc14e947b 100644
--- a/nixos/tests/hedgedoc.nix
+++ b/nixos/tests/hedgedoc.nix
@@ -8,25 +8,54 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
 
   nodes = {
     hedgedocSqlite = { ... }: {
+      services.hedgedoc.enable = true;
+    };
+
+    hedgedocPostgresWithTCPSocket = { ... }: {
+      systemd.services.hedgedoc.after = [ "postgresql.service" ];
       services = {
         hedgedoc = {
           enable = true;
-          settings.dbURL = "sqlite:///var/lib/hedgedoc/hedgedoc.db";
+          settings.db = {
+            dialect = "postgres";
+            user = "hedgedoc";
+            password = "$DB_PASSWORD";
+            host = "localhost";
+            port = 5432;
+            database = "hedgedocdb";
+          };
+
+          /*
+           * Do not use pkgs.writeText for secrets as
+           * they will end up in the world-readable Nix store.
+           */
+          environmentFile = pkgs.writeText "hedgedoc-env" ''
+            DB_PASSWORD=snakeoilpassword
+          '';
+        };
+        postgresql = {
+          enable = true;
+          initialScript = pkgs.writeText "pg-init-script.sql" ''
+            CREATE ROLE hedgedoc LOGIN PASSWORD 'snakeoilpassword';
+            CREATE DATABASE hedgedocdb OWNER hedgedoc;
+          '';
         };
       };
     };
 
-    hedgedocPostgres = { ... }: {
+    hedgedocPostgresWithUNIXSocket = { ... }: {
       systemd.services.hedgedoc.after = [ "postgresql.service" ];
       services = {
         hedgedoc = {
           enable = true;
-          settings.dbURL = "postgres://hedgedoc:\${DB_PASSWORD}@localhost:5432/hedgedocdb";
+          settings.db = {
+            dialect = "postgres";
+            user = "hedgedoc";
+            password = "$DB_PASSWORD";
+            host = "/run/postgresql";
+            database = "hedgedocdb";
+          };
 
-          /*
-           * Do not use pkgs.writeText for secrets as
-           * they will end up in the world-readable Nix store.
-           */
           environmentFile = pkgs.writeText "hedgedoc-env" ''
             DB_PASSWORD=snakeoilpassword
           '';
@@ -50,11 +79,18 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
         hedgedocSqlite.wait_for_open_port(3000)
         hedgedocSqlite.wait_until_succeeds("curl -sSf http://localhost:3000/new")
 
-    with subtest("HedgeDoc postgres"):
-        hedgedocPostgres.wait_for_unit("postgresql.service")
-        hedgedocPostgres.wait_for_unit("hedgedoc.service")
-        hedgedocPostgres.wait_for_open_port(5432)
-        hedgedocPostgres.wait_for_open_port(3000)
-        hedgedocPostgres.wait_until_succeeds("curl -sSf http://localhost:3000/new")
+    with subtest("HedgeDoc postgres with TCP socket"):
+        hedgedocPostgresWithTCPSocket.wait_for_unit("postgresql.service")
+        hedgedocPostgresWithTCPSocket.wait_for_unit("hedgedoc.service")
+        hedgedocPostgresWithTCPSocket.wait_for_open_port(5432)
+        hedgedocPostgresWithTCPSocket.wait_for_open_port(3000)
+        hedgedocPostgresWithTCPSocket.wait_until_succeeds("curl -sSf http://localhost:3000/new")
+
+    with subtest("HedgeDoc postgres with UNIX socket"):
+        hedgedocPostgresWithUNIXSocket.wait_for_unit("postgresql.service")
+        hedgedocPostgresWithUNIXSocket.wait_for_unit("hedgedoc.service")
+        hedgedocPostgresWithUNIXSocket.wait_for_open_port(5432)
+        hedgedocPostgresWithUNIXSocket.wait_for_open_port(3000)
+        hedgedocPostgresWithUNIXSocket.wait_until_succeeds("curl -sSf http://localhost:3000/new")
   '';
 })
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 3268a16967d75..5111cedf9256d 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -690,6 +690,9 @@ in {
           "zpool create rpool /dev/vda2",
           "zfs create -o mountpoint=legacy rpool/root",
           "mount -t zfs rpool/root /mnt",
+          "zfs create -o mountpoint=legacy rpool/root/usr",
+          "mkdir /mnt/usr",
+          "mount -t zfs rpool/root/usr /mnt/usr",
           "udevadm settle",
       )
     '';
diff --git a/nixos/tests/nginx-unix-socket.nix b/nixos/tests/nginx-unix-socket.nix
new file mode 100644
index 0000000000000..4640eaa171bdf
--- /dev/null
+++ b/nixos/tests/nginx-unix-socket.nix
@@ -0,0 +1,27 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+let
+  nginxSocketPath = "/var/run/nginx/test.sock";
+in
+{
+  name = "nginx-unix-socket";
+
+  nodes = {
+    webserver = { pkgs, lib, ... }: {
+      services.nginx = {
+        enable = true;
+        virtualHosts.localhost = {
+          serverName = "localhost";
+          listen = [{ addr = "unix:${nginxSocketPath}"; }];
+          locations."/test".return = "200 'foo'";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_open_unix_socket("${nginxSocketPath}")
+
+    webserver.succeed("curl --fail --silent --unix-socket '${nginxSocketPath}' http://localhost/test | grep '^foo$'")
+  '';
+})
diff --git a/nixos/tests/soft-serve.nix b/nixos/tests/soft-serve.nix
new file mode 100644
index 0000000000000..1c4cb4c95819e
--- /dev/null
+++ b/nixos/tests/soft-serve.nix
@@ -0,0 +1,102 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+let
+  inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+  sshPort = 8231;
+  httpPort = 8232;
+  statsPort = 8233;
+  gitPort = 8418;
+in
+{
+  name = "soft-serve";
+  meta.maintainers = with lib.maintainers; [ dadada ];
+  nodes = {
+    client = { pkgs, ... }: {
+      environment.systemPackages = with pkgs; [
+        curl
+        git
+        openssh
+      ];
+      environment.etc.sshKey = {
+        source = snakeOilPrivateKey;
+        mode = "0600";
+      };
+    };
+
+    server =
+      { config, ... }:
+      {
+        services.soft-serve = {
+          enable = true;
+          settings = {
+            name = "TestServer";
+            ssh.listen_addr = ":${toString sshPort}";
+            git.listen_addr = ":${toString gitPort}";
+            http.listen_addr = ":${toString httpPort}";
+            stats.listen_addr = ":${toString statsPort}";
+            initial_admin_keys = [ snakeOilPublicKey ];
+          };
+        };
+        networking.firewall.allowedTCPPorts = [ sshPort httpPort statsPort ];
+      };
+  };
+
+  testScript =
+    { ... }:
+    ''
+      SSH_PORT = ${toString sshPort}
+      HTTP_PORT = ${toString httpPort}
+      STATS_PORT = ${toString statsPort}
+      KEY = "${snakeOilPublicKey}"
+      SSH_KEY = "/etc/sshKey"
+      SSH_COMMAND = f"ssh -p {SSH_PORT} -i {SSH_KEY} -o StrictHostKeyChecking=no"
+      TEST_DIR = "/tmp/test"
+      GIT = f"git -C {TEST_DIR}"
+
+      for machine in client, server:
+          machine.wait_for_unit("network.target")
+
+      server.wait_for_unit("soft-serve.service")
+      server.wait_for_open_port(SSH_PORT)
+
+      with subtest("Get info"):
+          status, test = client.execute(f"{SSH_COMMAND} server info")
+          if status != 0:
+              raise Exception("Failed to get SSH info")
+          key = " ".join(KEY.split(" ")[0:2])
+          if not key in test:
+              raise Exception("Admin key must be configured correctly")
+
+      with subtest("Create user"):
+          client.succeed(f"{SSH_COMMAND} server user create beatrice")
+          client.succeed(f"{SSH_COMMAND} server user info beatrice")
+
+      with subtest("Create repo"):
+          client.succeed(f"git init {TEST_DIR}")
+          client.succeed(f"{GIT} config --global user.email you@example.com")
+          client.succeed(f"touch {TEST_DIR}/foo")
+          client.succeed(f"{GIT} add foo")
+          client.succeed(f"{GIT} commit --allow-empty -m test")
+          client.succeed(f"{GIT} remote add origin git@server:test")
+          client.succeed(f"GIT_SSH_COMMAND='{SSH_COMMAND}' {GIT} push -u origin master")
+          client.execute("rm -r /tmp/test")
+
+      server.wait_for_open_port(HTTP_PORT)
+
+      with subtest("Clone over HTTP"):
+          client.succeed(f"curl --connect-timeout 10 http://server:{HTTP_PORT}/")
+          client.succeed(f"git clone http://server:{HTTP_PORT}/test /tmp/test")
+          client.execute("rm -r /tmp/test")
+
+      with subtest("Clone over SSH"):
+          client.succeed(f"GIT_SSH_COMMAND='{SSH_COMMAND}' git clone git@server:test /tmp/test")
+          client.execute("rm -r /tmp/test")
+
+      with subtest("Get stats over HTTP"):
+          server.wait_for_open_port(STATS_PORT)
+          status, test = client.execute(f"curl --connect-timeout 10 http://server:{STATS_PORT}/metrics")
+          if status != 0:
+              raise Exception("Failed to get metrics from status port")
+          if not "go_gc_duration_seconds_count" in test:
+              raise Exception("Metrics did not contain key 'go_gc_duration_seconds_count'")
+    '';
+})
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index 3c36291b733d2..5fb7ba53ad844 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -169,7 +169,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
 
     # Do some IP traffic
     output_ping = machine.succeed(
-        "systemd-run --wait -- /run/wrappers/bin/ping -c 1 127.0.0.1 2>&1"
+        "systemd-run --wait -- ping -c 1 127.0.0.1 2>&1"
     )
 
     with subtest("systemd reports accounting data on system.slice"):
diff --git a/pkgs/README.md b/pkgs/README.md
index bfa7e611255d3..4845cfa31755c 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -362,7 +362,7 @@ All versions of a package _must_ be included in `all-packages.nix` to make sure
   * If there is no upstream license, `meta.license` should default to `lib.licenses.unfree`.
   * If in doubt, try to contact the upstream developers for clarification.
 * `meta.mainProgram` must be set when appropriate.
-* `meta.maintainers` should be set.
+* `meta.maintainers` must be set for new packages.
 
 See the Nixpkgs manual for more details on [standard meta-attributes](https://nixos.org/nixpkgs/manual/#sec-standard-meta-attributes).
 
diff --git a/pkgs/applications/audio/soundwireserver/default.nix b/pkgs/applications/audio/soundwireserver/default.nix
index b296ebdad602a..b296ebdad602a 100755..100644
--- a/pkgs/applications/audio/soundwireserver/default.nix
+++ b/pkgs/applications/audio/soundwireserver/default.nix
diff --git a/pkgs/applications/blockchains/bitcoin/default.nix b/pkgs/applications/blockchains/bitcoin/default.nix
index 24f7d78e4f56f..1d0736244b68a 100644
--- a/pkgs/applications/blockchains/bitcoin/default.nix
+++ b/pkgs/applications/blockchains/bitcoin/default.nix
@@ -33,14 +33,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = if withGui then "bitcoin" else "bitcoind";
-  version = "25.0";
+  version = "25.1";
 
   src = fetchurl {
     urls = [
       "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
     ];
     # hash retrieved from signed SHA256SUMS
-    sha256 = "5df67cf42ca3b9a0c38cdafec5bbb517da5b58d251f32c8d2a47511f9be1ebc2";
+    sha256 = "bec2a598d8dfa8c2365b77f13012a733ec84b8c30386343b7ac1996e901198c9";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/applications/blockchains/lighthouse/default.nix b/pkgs/applications/blockchains/lighthouse/default.nix
index 20792dd8fd950..44cbb147bd206 100644
--- a/pkgs/applications/blockchains/lighthouse/default.nix
+++ b/pkgs/applications/blockchains/lighthouse/default.nix
@@ -14,6 +14,7 @@
 , rustPlatform
 , Security
 , sqlite
+, rust-jemalloc-sys
 , stdenv
 , SystemConfiguration
 , testers
@@ -70,6 +71,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     sqlite
+    rust-jemalloc-sys
   ] ++ lib.optionals stdenv.isDarwin [
     CoreFoundation
     Security
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index 1ed5d9819110a..4be874ef5ce19 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -2,6 +2,7 @@
 , lib
 , protobuf
 , rocksdb
+, rust-jemalloc-sys-unprefixed
 , rustPlatform
 , rustc-wasm32
 , stdenv
@@ -60,7 +61,9 @@ rustPlatform.buildRustPackage rec {
     rustc-wasm32.llvmPackages.lld
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
+  buildInputs = [
+    rust-jemalloc-sys-unprefixed
+  ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
   # NOTE: we need to force lld otherwise rust-lld is not found for wasm32 target
   CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_LINKER = "lld";
diff --git a/pkgs/applications/blockchains/snarkos/default.nix b/pkgs/applications/blockchains/snarkos/default.nix
index 080cc4b5c108f..000c1ace4a4ce 100644
--- a/pkgs/applications/blockchains/snarkos/default.nix
+++ b/pkgs/applications/blockchains/snarkos/default.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "snarkos";
-  version = "2.1.7";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "AleoHQ";
     repo = "snarkOS";
     rev = "v${version}";
-    sha256 = "sha256-kW41SNbl2vckgUth+BZ6/aM03aT6MFeY4Hwi9OVWtTI=";
+    sha256 = "sha256-vEoEnjVjxVnjZ3Lya1qO2kOypNu07aYSlrSya5NJZzs=";
   };
 
-  cargoHash = "sha256-znEAb4q9H0Doc+XYCf27hV/z2t74kjQUffl/aJzW6tI=";
+  cargoHash = "sha256-CVHvBqfcTqWBtLFcEcs9y/LmQ4gXjX+dfqqZSxN+33A=";
 
   # buildAndTestSubdir = "cli";
 
diff --git a/pkgs/applications/blockchains/trezor-suite/default.nix b/pkgs/applications/blockchains/trezor-suite/default.nix
index c56e6da52f0f3..e5f8963e921c6 100644
--- a/pkgs/applications/blockchains/trezor-suite/default.nix
+++ b/pkgs/applications/blockchains/trezor-suite/default.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "trezor-suite";
-  version = "23.4.2";
+  version = "23.10.1";
   name = "${pname}-${version}";
 
   suffix = {
@@ -19,8 +19,8 @@ let
   src = fetchurl {
     url = "https://github.com/trezor/${pname}/releases/download/v${version}/Trezor-Suite-${version}-${suffix}.AppImage";
     hash = { # curl -Lfs https://github.com/trezor/trezor-suite/releases/latest/download/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-      aarch64-linux = "sha512-+dcogzj0mENWSAVKqUG/xyF+TD/nKpA3UiNyI2M7iiCaW+tpwO5Y0uUmzb1rFRtDsKMflDPZNWe8qMJmrtaIrA==";
-      x86_64-linux  = "sha512-8UyPa3hDmALiYGao451ZBQLxv9H9OLbzzHiANp4zgvjBLGNhZnPFBIYM6KGyKkgRJJiTcgd7VHCgEhPpfm0qzg==";
+      aarch64-linux = "sha512-MR9BYg6R+Oof3zh02KSh48V2m6J7JpsrYpi6gj5kTvKuCU5Ci5AwPEAvnTjHAR6xlappvoNQmeA5nCEoTWaL7A==";
+      x86_64-linux  = "sha512-BqdfhYLG4z+9B7KbJGWGPml7U2fl/RQ1nZK0vdeA/cKhG0SjH0K8er9bemg60RPBXj0AeuK80v/6vMbDtyEnRQ==";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
diff --git a/pkgs/applications/editors/hexdino/default.nix b/pkgs/applications/editors/hexdino/default.nix
index cc3b39ed4bf78..5eb023f8b9ed0 100644
--- a/pkgs/applications/editors/hexdino/default.nix
+++ b/pkgs/applications/editors/hexdino/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hexdino";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "Luz";
     repo = pname;
     rev = version;
-    sha256 = "sha256-OFtOa6StpOuLgkULnY5MlqDcSTEiMxogowHIBEiGr4E=";
+    hash = "sha256-glbyftCJiP0/5trW7DOcVCU2q4ZH3zFK96eyGuYR8eY=";
   };
 
-  cargoSha256 = "sha256-lvLiRQNH3rpu+JTXWhQtXczmGRWGtnnLDknZaMp3d0s=";
+  cargoHash = "sha256-nldA8gDMj0iO+HgatiuMqzR6ZCjbxFsTp5pDGbFKA1k=";
 
   meta = with lib; {
     description = "A hex editor with vim like keybindings written in Rust";
diff --git a/pkgs/applications/editors/jetbrains/plugins/plugins.json b/pkgs/applications/editors/jetbrains/plugins/plugins.json
index d93a243b0a375..353d4a5d4b0b8 100644
--- a/pkgs/applications/editors/jetbrains/plugins/plugins.json
+++ b/pkgs/applications/editors/jetbrains/plugins/plugins.json
@@ -22,10 +22,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip"
       },
       "name": "ideavim"
@@ -61,10 +61,10 @@
         "232.10072.21": null,
         "232.10072.27": null,
         "232.10072.28": null,
+        "232.10072.31": null,
+        "232.10072.32": null,
         "232.9921.42": null,
-        "232.9921.55": null,
         "232.9921.83": null,
-        "232.9921.89": null,
         "233.8264.22": null
       },
       "name": "kotlin"
@@ -87,14 +87,14 @@
       ],
       "builds": {
         "223.8836.1185": null,
-        "232.10072.15": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
-        "232.10072.21": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
-        "232.10072.27": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
-        "232.10072.28": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
+        "232.10072.15": "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip",
+        "232.10072.21": "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip",
+        "232.10072.27": "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip",
+        "232.10072.28": "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/6981/407738/ini-233.8264.9.zip"
       },
       "name": "ini"
@@ -105,8 +105,8 @@
         "phpstorm"
       ],
       "builds": {
-        "232.10072.27": "https://plugins.jetbrains.com/files/7219/408569/Symfony_Plugin-2022.1.258.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/7219/408569/Symfony_Plugin-2022.1.258.zip"
+        "232.10072.27": "https://plugins.jetbrains.com/files/7219/419684/Symfony_Plugin-2022.1.259.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/7219/419684/Symfony_Plugin-2022.1.259.zip"
       },
       "name": "symfony-support"
     },
@@ -117,7 +117,7 @@
       ],
       "builds": {
         "232.10072.27": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip"
+        "232.10072.32": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip"
       },
       "name": "php-annotations"
     },
@@ -158,10 +158,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
-        "232.9921.83": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip"
+        "232.9921.83": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip"
       },
       "name": "-deprecated-rust"
     },
@@ -186,10 +186,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
-        "232.9921.83": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip"
+        "232.9921.83": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip"
       },
       "name": "-deprecated-rust-beta"
     },
@@ -207,7 +207,7 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/8554/374977/featuresTrainer-232.9559.6.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/8554/374977/featuresTrainer-232.9559.6.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/8554/374977/featuresTrainer-232.9559.6.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/8554/374977/featuresTrainer-232.9559.6.zip"
+        "232.10072.31": "https://plugins.jetbrains.com/files/8554/374977/featuresTrainer-232.9559.6.zip"
       },
       "name": "ide-features-trainer"
     },
@@ -233,10 +233,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "233.8264.22": null
       },
       "name": "nixidea"
@@ -267,16 +267,16 @@
         "webstorm"
       ],
       "builds": {
-        "223.8836.1185": "https://plugins.jetbrains.com/files/10037/358812/CSVEditor-3.2.1-223.zip",
-        "232.10072.15": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.10072.21": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.10072.27": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.10072.28": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9921.42": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9921.83": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "233.8264.22": "https://plugins.jetbrains.com/files/10037/243092/CSV-2.21.0.zip"
+        "223.8836.1185": "https://plugins.jetbrains.com/files/10037/417700/CSVEditor-3.2.2-223.zip",
+        "232.10072.15": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.10072.21": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.10072.27": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.10072.28": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.9921.42": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.9921.83": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "233.8264.22": "https://plugins.jetbrains.com/files/10037/417702/CSVEditor-3.2.2-233.zip"
       },
       "name": "csv-editor"
     },
@@ -302,10 +302,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/12062/405118/keymap-vscode-233.8264.3.zip"
       },
       "name": "vscode-keymap"
@@ -332,10 +332,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/12559/405631/keymap-eclipse-233.8264.9.zip"
       },
       "name": "eclipse-keymap"
@@ -362,10 +362,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/13017/405636/keymap-visualStudio-233.8264.9.zip"
       },
       "name": "visual-studio-keymap"
@@ -392,10 +392,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.10072.27": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.10072.28": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
+        "232.10072.31": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
+        "232.10072.32": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9921.42": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "232.9921.55": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9921.83": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "232.9921.89": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "233.8264.22": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar"
       },
       "name": "darcula-pitch-black"
@@ -422,10 +422,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip"
       },
       "name": "github-copilot"
@@ -452,10 +452,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip"
       },
       "name": "netbeans-6-5-keymap"
@@ -475,9 +475,9 @@
     }
   },
   "files": {
-    "https://plugins.jetbrains.com/files/10037/243092/CSV-2.21.0.zip": "sha256-Mfo8z2pjn+Gk1uumw5xpZQwpkqLRVqAu2Z07zjn2N1M=",
-    "https://plugins.jetbrains.com/files/10037/358812/CSVEditor-3.2.1-223.zip": "sha256-l8xq7XXQheZYcP+kdnLXAO7FhfPJYwIh+ZffbttBI9s=",
-    "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip": "sha256-m9ocJSFWparZLrX1MQA0IlSH5LHodmzzVmGZ6eHml24=",
+    "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip": "sha256-3bHSRhzvVO07mvuD6tpkiKFXTF66zCK/wpXFVb8IkfY=",
+    "https://plugins.jetbrains.com/files/10037/417700/CSVEditor-3.2.2-223.zip": "sha256-4Y/DZpCWKljaslJFsaqItq1DVJVVRlQjWpM6GLRo8QA=",
+    "https://plugins.jetbrains.com/files/10037/417702/CSVEditor-3.2.2-233.zip": "sha256-n4psF9fFFU8ohtbOndRx6i20EntjEzL3BvMObAZyOOw=",
     "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip": "sha256-q5i1eAANK+6uBYrtioKLzvJf5ALUB0K4d31Ut0vT/lE=",
     "https://plugins.jetbrains.com/files/12062/405118/keymap-vscode-233.8264.3.zip": "sha256-cB3DTeWhDgAwHlxwYogd0/DuYBzo5DqaRtBvEC/p8I4=",
     "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip": "sha256-eRCsivZbDNrc+kesa9jVsOoMFFz+WpYfSMXxPCCjWjw=",
@@ -495,7 +495,8 @@
     "https://plugins.jetbrains.com/files/6954/381727/kotlin-plugin-223-1.9.10-release-459-IJ8836.35.zip": "sha256-gHkNQyWh6jtY1986aI7Qo6ZNrniPy+Yq4XLLA0pKJkA=",
     "https://plugins.jetbrains.com/files/6981/407738/ini-233.8264.9.zip": "sha256-E3xWjwTxtLkOtm9748BbkKGaS4l8SlZOkj3w6VgqlFQ=",
     "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip": "sha256-XIdhTQMxl/nJnntfQlHLlcyA79IS3hnGEGrXhKBFgY0=",
-    "https://plugins.jetbrains.com/files/7219/408569/Symfony_Plugin-2022.1.258.zip": "sha256-O4ARifSoeL5kXnFQTs6YoLcJvdg5VHks5LIgnwwUAeQ=",
+    "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip": "sha256-eC5Zs6ph/4C3Xf6e07DfyqhBmsG3bAFLnvae1JiFzpE=",
+    "https://plugins.jetbrains.com/files/7219/419684/Symfony_Plugin-2022.1.259.zip": "sha256-3UxSPvEXXhAf3zYg2H/jja4F5fuDFWQ6SWFRvcWJ0Iw=",
     "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip": "sha256-hT5K4w4lhvNwDzDMDSvsIDGj9lyaRqglfOhlbNdqpWs=",
     "https://plugins.jetbrains.com/files/7322/401058/python-ce-232.9921.77.zip": "sha256-cr4LxSz8xVzC+Zm+6LnWGLbF6aGBVLW56crCIQOawhc=",
     "https://plugins.jetbrains.com/files/7322/405773/python-ce-233.8264.8.zip": "sha256-LjN0BkcnX8mVHh2dPULddVwooi9fcABkrRVhTPA7XSo=",
diff --git a/pkgs/applications/editors/jetbrains/versions.json b/pkgs/applications/editors/jetbrains/versions.json
index c95feebdb674a..5bbbd9dfc7b66 100644
--- a/pkgs/applications/editors/jetbrains/versions.json
+++ b/pkgs/applications/editors/jetbrains/versions.json
@@ -67,27 +67,27 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.tar.gz",
-      "version": "2023.2.2",
-      "sha256": "5e3dd021b82dcad0f51bded677aa87680dcc3f5d843951c48848a9191141bf1d",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2.tar.gz",
-      "build_number": "232.9921.55",
+      "version": "2023.2.3",
+      "sha256": "dd8d771508b277ab2a713b8f546c2ec6dbb261ba8c23072e46ec6ce2ea9ab2a0",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.3.tar.gz",
+      "build_number": "232.10072.32",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}.tar.gz",
-      "version": "2023.2.2",
-      "sha256": "2bb4f73d041b818a7b631feb3fee77036de764543c669efe9cf6766510a68e3f",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.2.tar.gz",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "d59dd88c1eb51cdd756433d415588c573ca944ebf6f08844b8ac8cd2e3d9937b",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.3.tar.gz",
+      "build_number": "232.10072.31"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}.tar.gz",
-      "version": "2023.2.2",
-      "sha256": "f7263b17e2456efcb5efab1eac53aafb6a0be1a7f9fbf25a419c9d7b447f6ded",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.2.tar.gz",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "e625fea80b72c9e12f986a8eb918425c6ef1d3f7b31117b40d122e3ce76046b1",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.3.tar.gz",
+      "build_number": "232.10072.31"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
@@ -190,27 +190,27 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.tar.gz",
-      "version": "2023.2.2",
-      "sha256": "b3067ffa32fab0880ffce8dff000d463b86bef9b30f53fc4d41f5d4e518c7528",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2-aarch64.tar.gz",
-      "build_number": "232.9921.55",
+      "version": "2023.2.3",
+      "sha256": "577bea15c1208e0b842bcdb2ff0f0205144a8800fcadf87f873af7c067e0ce73",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.3-aarch64.tar.gz",
+      "build_number": "232.10072.32",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}-aarch64.tar.gz",
-      "version": "2023.2.2",
-      "sha256": "7d15908f9261ee7905b61d83d4a048fee1e3a2fea9465ada1fc459b2ea0e4d5f",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.2-aarch64.tar.gz",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "6fdc5238ffa4767834b11b52b650107f1c64d6a53d0e2bbc23581b6c90b67ab5",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.3-aarch64.tar.gz",
+      "build_number": "232.10072.31"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}-aarch64.tar.gz",
-      "version": "2023.2.2",
-      "sha256": "2cf259859847f7a979565f31faa60148d571206c78c9309dcdf867b76c16ef25",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.2-aarch64.tar.gz",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "578ecbd059ccb010682cf602e959454b296ec2e741202f236fbdb38897b296dd",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.3-aarch64.tar.gz",
+      "build_number": "232.10072.31"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
@@ -313,27 +313,27 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.dmg",
-      "version": "2023.2.2",
-      "sha256": "99a9bb313a5c141ecd1810306deaca3cf52d338edf206362b3f9d9337a27890e",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2.dmg",
-      "build_number": "232.9921.55",
+      "version": "2023.2.3",
+      "sha256": "7ce4ff6b344ff8ce18ef8a821ba3fd1d222f9222a9b3e65744a796379d92417e",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.3.dmg",
+      "build_number": "232.10072.32",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}.dmg",
-      "version": "2023.2.2",
-      "sha256": "f482b6d451efec897764487b116f7bf09d507a5ebfb841c33e2abd2441c3b3a7",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.2.dmg",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "b914bd3c0018f951bef5da9c04907355a88546ce983dcf4115bbf11556015ec7",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.3.dmg",
+      "build_number": "232.10072.31"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}.dmg",
-      "version": "2023.2.2",
-      "sha256": "830f590d63199b389bbaa955c8602fa027bc1eb25bd8ce5636474eec72745b58",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.2.dmg",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "b33bbd30222363cdc3091aee923ed1c309edba799616a3a681cd9a1ca94e822a",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.3.dmg",
+      "build_number": "232.10072.31"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
@@ -436,27 +436,27 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.dmg",
-      "version": "2023.2.2",
-      "sha256": "a31daeddae532324436b2d11acbd5fb657721883f17c7ef4457ac76a51bd4189",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2-aarch64.dmg",
-      "build_number": "232.9921.55",
+      "version": "2023.2.3",
+      "sha256": "68d543fb2a79cd0b07ddb94a4c00d8c0c1aca7f604bc838ac92e232e763489b3",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.3-aarch64.dmg",
+      "build_number": "232.10072.32",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}-aarch64.dmg",
-      "version": "2023.2.2",
-      "sha256": "2bcddf3e58902578745dd1803f17ebd18f4c98dc76bf48b0945afbc7bae45832",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.2-aarch64.dmg",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "08c45adbb0dca219955f511993ca8150dcca235bdba3ac24c67ae035c68ba992",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.3-aarch64.dmg",
+      "build_number": "232.10072.31"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}-aarch64.dmg",
-      "version": "2023.2.2",
-      "sha256": "5d4292dd0e40db35199ebcd6472d4b46c505d3357d2324690338758355e0f092",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.2-aarch64.dmg",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "63d68b20963575f76937ca0ce18a8150639c47b8cf8f3d6e96fa3306191cd076",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.3-aarch64.dmg",
+      "build_number": "232.10072.31"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
diff --git a/pkgs/applications/editors/neovim/neovim-gtk.nix b/pkgs/applications/editors/neovim/neovim-gtk.nix
index eebb980f85cb5..eebb980f85cb5 100755..100644
--- a/pkgs/applications/editors/neovim/neovim-gtk.nix
+++ b/pkgs/applications/editors/neovim/neovim-gtk.nix
diff --git a/pkgs/applications/editors/pulsar/default.nix b/pkgs/applications/editors/pulsar/default.nix
index d2162dc9c9ef1..ef08ac9352dde 100644
--- a/pkgs/applications/editors/pulsar/default.nix
+++ b/pkgs/applications/editors/pulsar/default.nix
@@ -209,5 +209,14 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ colamaroro ];
+    knownVulnerabilities = [
+      "CVE-2023-5217"
+      "CVE-2022-21718"
+      "CVE-2022-29247"
+      "CVE-2022-29257"
+      "CVE-2022-36077"
+      "CVE-2023-29198"
+      "CVE-2023-39956"
+    ];
   };
 }
diff --git a/pkgs/applications/editors/texmacs/default.nix b/pkgs/applications/editors/texmacs/default.nix
index 427d0aa3ace80..00372c1cab8b7 100644
--- a/pkgs/applications/editors/texmacs/default.nix
+++ b/pkgs/applications/editors/texmacs/default.nix
@@ -1,5 +1,5 @@
-{ lib, mkDerivation, callPackage, fetchurl,
-  guile_1_8, qtbase, xmodmap, which, freetype,
+{ lib, stdenv, callPackage, fetchurl,
+  guile_1_8, xmodmap, which, freetype,
   libjpeg,
   sqlite,
   tex ? null,
@@ -8,6 +8,11 @@
   python3 ? null,
   cmake,
   pkg-config,
+  wrapQtAppsHook,
+  xdg-utils,
+  qtbase,
+  qtsvg,
+  qtmacextras,
   ghostscriptX ? null,
   extraFonts ? false,
   chineseFonts ? false,
@@ -15,32 +20,49 @@
   koreanFonts ? false }:
 
 let
-  pname = "TeXmacs";
-  version = "2.1";
+  pname = "texmacs";
+  version = "2.1.2";
   common = callPackage ./common.nix {
     inherit tex extraFonts chineseFonts japaneseFonts koreanFonts;
   };
 in
-mkDerivation {
+stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://www.texmacs.org/Download/ftp/tmftp/source/TeXmacs-${version}-src.tar.gz";
-    sha256 = "1gl6k1bwrk1y7hjyl4xvlqvmk5crl4jvsk8wrfp7ynbdin6n2i48";
+    hash = "sha256-Ds9gxOwMYSttEWrawgxLHGxHyMBvt8WmyPIwBP2g/CM=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  postPatch = common.postPatch + ''
+    substituteInPlace configure \
+      --replace "-mfpmath=sse -msse2" ""
+  '';
+
+  nativeBuildInputs = [
+    guile_1_8
+    pkg-config
+    wrapQtAppsHook
+    xdg-utils
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    cmake
+  ];
+
   buildInputs = [
     guile_1_8
     qtbase
+    qtsvg
     ghostscriptX
     freetype
     libjpeg
     sqlite
     git
     python3
+  ] ++ lib.optionals stdenv.isDarwin [
+    qtmacextras
   ];
-  NIX_LDFLAGS = "-lz";
+
+  env.NIX_LDFLAGS = "-lz";
 
   qtWrapperArgs = [
     "--suffix" "PATH" ":" (lib.makeBinPath [
@@ -58,10 +80,8 @@ mkDerivation {
     wrapQtApp $out/bin/texmacs
   '';
 
-  inherit (common) postPatch;
-
   meta = common.meta // {
     maintainers = [ lib.maintainers.roconnor ];
-    platforms = lib.platforms.gnu ++ lib.platforms.linux;  # arbitrary choice
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ecd22ae6102bf..a38f9c137edc4 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -3333,6 +3333,18 @@ final: prev:
     meta.homepage = "https://github.com/wincent/ferret/";
   };
 
+  ferris-nvim = buildNeovimPlugin {
+    pname = "ferris.nvim";
+    version = "2023-11-21";
+    src = fetchFromGitHub {
+      owner = "mrcjkb";
+      repo = "ferris.nvim";
+      rev = "54943eaeb0d4534988d2378936052655c988c3c2";
+      sha256 = "o4yY4IHYBCnanfy7dx/wGdiPFMLMKZsYrG2SqlPRvdI=";
+    };
+    meta.homepage = "https://github.com/mrcjkb/ferris.nvim/";
+  };
+
   fidget-nvim = buildVimPlugin {
     pname = "fidget.nvim";
     version = "2023-06-10";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index ab353da48e241..8284657644081 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -277,6 +277,7 @@ https://github.com/freddiehaddad/feline.nvim/,,
 https://github.com/bakpakin/fennel.vim/,,
 https://github.com/lambdalisue/fern.vim/,,
 https://github.com/wincent/ferret/,,
+https://github.com/mrcjkb/ferris.nvim/,HEAD,
 https://github.com/j-hui/fidget.nvim/,legacy,
 https://github.com/bogado/file-line/,,
 https://github.com/glacambre/firenvim/,HEAD,
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index c0d3415713fce..fb6e709bba202 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -326,8 +326,8 @@ let
         mktplcRef = {
           name = "astro-vscode";
           publisher = "astro-build";
-          version = "2.1.1";
-          sha256 = "sha256-UVZOpkOHbLiwA4VfTgXxuIU8EtJLnqRa5zUVha6xQJY=";
+          version = "2.3.3";
+          sha256 = "sha256-A7+7lnCPAtSWUfHLNKbYqKuTxi2Nx05Qdh5HCkT1dnM=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/astro-build.astro-vscode/changelog";
diff --git a/pkgs/applications/emulators/yuzu/generic.nix b/pkgs/applications/emulators/yuzu/generic.nix
index 3fdd6db84661a..a24ded8525310 100644
--- a/pkgs/applications/emulators/yuzu/generic.nix
+++ b/pkgs/applications/emulators/yuzu/generic.nix
@@ -49,10 +49,10 @@
 }:
 
 let
-  tzinfoVersion = "220816";
+  tzinfoVersion = "221202";
   tzinfo = fetchurl {
     url = "https://github.com/lat9nq/tzdb_to_nx/releases/download/${tzinfoVersion}/${tzinfoVersion}.zip";
-    hash = "sha256-yv8ykEYPu9upeXovei0u16iqQ7NasH6873KnQy4+KwI=";
+    hash = "sha256-mRzW+iIwrU1zsxHmf+0RArU8BShAoEMvCz+McXFFK3c=";
   };
 in stdenv.mkDerivation {
   pname = "yuzu-${branch}";
diff --git a/pkgs/applications/emulators/yuzu/sources.nix b/pkgs/applications/emulators/yuzu/sources.nix
index fc6d1813afb51..3371bf15c5c99 100644
--- a/pkgs/applications/emulators/yuzu/sources.nix
+++ b/pkgs/applications/emulators/yuzu/sources.nix
@@ -1,19 +1,19 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2023-10-07
+# Last updated: 2023-10-20
 {
   compatList = {
-    rev = "156a0a80efc47069ba3360f8a1b268a1c6f2f505";
+    rev = "9d17cbd71408476c6a28cbf0fa8177155c511681";
     hash = "sha256:1hdsza3wf9a0yvj6h55gsl7xqvhafvbz1i8paz9kg7l49b0gnlh1";
   };
 
   mainline = {
-    version = "1579";
-    hash = "sha256:0689w42as1di8xbh8kq2p0cws8gdwq64zdj3i8wq612nkw0q5s60";
+    version = "1595";
+    hash = "sha256:09b0w6z4w9z4ms2pvik2vrmklfcx25jxcgs61bff3nflilnw9m97";
   };
 
   ea = {
-    version = "3911";
-    distHash = "sha256:0xj642kjhj0gp9l15b3ysj3gmyy47rcvzw9amghsfl13bg5ffnwh";
-    fullHash = "sha256:13rd6kwnhpvjzp67k6pqgl9fsqzwy5d8043hv6kd93gg8jbxkp38";
+    version = "3940";
+    distHash = "sha256:0g0vv274sh3iy56n7s324km87g302005ahi9zh2qhwkiirbnc811";
+    fullHash = "sha256:0ywppc4z5d4b1zl1cr8yfnba58hgi0z2szficwpinapai7q0pyid";
   };
 }
diff --git a/pkgs/applications/file-managers/yazi/default.nix b/pkgs/applications/file-managers/yazi/default.nix
index 7757a1322b15a..cd0476c1e00d6 100644
--- a/pkgs/applications/file-managers/yazi/default.nix
+++ b/pkgs/applications/file-managers/yazi/default.nix
@@ -3,6 +3,7 @@
 , lib
 
 , makeWrapper
+, installShellFiles
 , stdenv
 , Foundation
 
@@ -30,18 +31,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yazi";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "sxyazi";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ARpludMVQlZtCRAfW0cNYVmT3m9t9lunMIW24peYX6Y=";
+    hash = "sha256-FhKrq4N32uJRHGc0qRl+CIVNRW597jACcTFEgj8hiSE=";
   };
 
-  cargoHash = "sha256-dhdk5aGKv6tY8x7MmA0hWcmJBiXOXC92DlQTd/1AKtQ=";
+  cargoHash = "sha256-YUymZhDp1Pjm+W6m8Vmh2AgMCdaNt6TQQpiJwSg/gPw=";
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ Foundation ];
 
   postInstall = with lib;
@@ -60,6 +61,10 @@ rustPlatform.buildRustPackage rec {
     ''
       wrapProgram $out/bin/yazi \
          --prefix PATH : "${makeBinPath runtimePaths}"
+      installShellCompletion --cmd yazi \
+        --bash ./config/completions/yazi.bash \
+        --fish ./config/completions/yazi.fish \
+        --zsh  ./config/completions/_yazi
     '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/applications/graphics/structorizer/default.nix b/pkgs/applications/graphics/structorizer/default.nix
index d1f796e42fee1..d1f796e42fee1 100755..100644
--- a/pkgs/applications/graphics/structorizer/default.nix
+++ b/pkgs/applications/graphics/structorizer/default.nix
diff --git a/pkgs/applications/misc/ArchiSteamFarm/default.nix b/pkgs/applications/misc/ArchiSteamFarm/default.nix
index 60b835c719b57..1a0e90546bec7 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@@ -11,13 +11,13 @@
 buildDotnetModule rec {
   pname = "ArchiSteamFarm";
   # nixpkgs-update: no auto update
-  version = "5.4.9.3";
+  version = "5.4.12.5";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
     repo = "ArchiSteamFarm";
     rev = version;
-    hash = "sha256-Yp8hnMIeV+ZHY6yISJdFd1yAQipQsU5vcXgxFDvkGnA=";
+    hash = "sha256-iIYA9BnHUfsB4J7VbSLKaRdJHMW/xULJxKfv8atfAd8=";
   };
 
   dotnet-runtime = dotnetCorePackages.aspnetcore_7_0;
@@ -77,6 +77,7 @@ buildDotnetModule rec {
     homepage = "https://github.com/JustArchiNET/ArchiSteamFarm";
     license = licenses.asl20;
     platforms = [ "x86_64-linux" "aarch64-linux" ];
+    mainProgram = "ArchiSteamFarm";
     maintainers = with maintainers; [ SuperSandro2000 lom ];
   };
 }
diff --git a/pkgs/applications/misc/ArchiSteamFarm/deps.nix b/pkgs/applications/misc/ArchiSteamFarm/deps.nix
index 5d353bfdf6b89..6154d1ca6e2d9 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/deps.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/deps.nix
@@ -57,11 +57,11 @@
   (fetchNuGet { pname = "Humanizer.Core.zh-Hans"; version = "2.14.1"; sha256 = "0zn99311zfn602phxyskfjq9vly0w5712z6fly8r4q0h94qa8c85"; })
   (fetchNuGet { pname = "Humanizer.Core.zh-Hant"; version = "2.14.1"; sha256 = "0qxjnbdj645l5sd6y3100yyrq1jy5misswg6xcch06x8jv7zaw1p"; })
   (fetchNuGet { pname = "JetBrains.Annotations"; version = "2023.2.0"; sha256 = "0nx7nrzbg9gk9skdc9x330cbr5xbsly6z9gzxm46vywf55yp8vaj"; })
-  (fetchNuGet { pname = "Markdig.Signed"; version = "0.32.0"; sha256 = "0rc1d8pwypq44pr15wn8g52zbqz70swdrdmjlzccf6zvwy1vyqkc"; })
+  (fetchNuGet { pname = "Markdig.Signed"; version = "0.33.0"; sha256 = "0816lmn0varxwhdklhh5hdqp0xnfz3nlrvaf2wpkk5v1mq86216h"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.JsonPatch"; version = "7.0.0"; sha256 = "1f13vsfs1rp9bmdp3khk4mk2fif932d72yxm2wszpsr239x4s2bf"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.NewtonsoftJson"; version = "7.0.0"; sha256 = "1w49rg0n5wb1m5wnays2mmym7qy7bsi2b1zxz97af2rkbw3s3hbd"; })
   (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; sha256 = "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"; })
-  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.7.0"; sha256 = "12m9fay2d7jvj00hfpws37vflpqvz4dy4gcm25bjycg1zyfpzvly"; })
+  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.7.2"; sha256 = "09mf5kpxn1a1m8ciwklhh6ascx0yqpcs5r2hvmfj80j44n3qrwhm"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.7.0"; sha256 = "0gd67zlw554j098kabg887b5a6pq9kzavpa3jjy5w53ccjzjfy8j"; })
   (fetchNuGet { pname = "Microsoft.Extensions.ApiDescription.Server"; version = "6.0.5"; sha256 = "1pi2bm3cm0a7jzqzmfc2r7bpcdkmk3hhjfvb2c81j7wl7xdw3624"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "6.0.0"; sha256 = "0w6wwxv12nbc3sghvr68847wc9skkdgsicrz3fx4chgng1i3xy0j"; })
@@ -71,11 +71,15 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "6.0.0"; sha256 = "0b75fmins171zi6bfdcq1kcvyrirs8n91mknjnxy4c3ygi1rrnj0"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "6.0.0"; sha256 = "008pnk2p50i594ahz308v81a41mbjz9mwcarqhmrjpl2d20c868g"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "6.0.0"; sha256 = "1kjiw6s4yfz9gm7mx3wkhp06ghnbs95icj9hi505shz9rjrg42q2"; })
-  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.7.0"; sha256 = "1srhqqmnf9pxdbpffr7dh0bihhf09d0iq5g6gh8ql7brfrh99lvb"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.0.3"; sha256 = "0njmg2lygnirnfjv9gck2f5lq4ly5rgws9cpf8qj3kwcwxfp0b9s"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.0.3"; sha256 = "1ayh85xqdq8rqjk2iqcn7iaczcl7d8qg6bxk0b4rgx59fmsmbqj7"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.0.3"; sha256 = "13cjqmf59k895q6gkd5ycl89mnpalckda7rhsdl11jdyr32hsfnv"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.0.3"; sha256 = "1pmhd0imh9wlhvbvvwjrpjsqvzagi2ly22nddwr4r0pi234khyz1"; })
+  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.7.2"; sha256 = "08g9dpp766racnh90s1sy3ncl291majgq6v2604hfw1f6zkmbjqh"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "5.0.0"; sha256 = "0mwpwdflidzgzfx2dlpkvvnkgkr2ayaf0s80737h4wa35gaj11rc"; })
   (fetchNuGet { pname = "Microsoft.OpenApi"; version = "1.2.3"; sha256 = "07b19k89whj69j87afkz86gp9b3iybw8jqwvlgcn43m7fb2y99rr"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.7.0"; sha256 = "1sqmk99644fx66zk2qa2ims1zl6741i3wl4rjh4z6jakd4xbc28i"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.7.0"; sha256 = "1s8ap0ljqssbqp1ilgsidjr948b9szf1cbl3fgl6smxig9im4zrl"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.7.2"; sha256 = "0xdjkdnrvnaxqgg38y5w1l3jbppigg68cc8q9jn0p21vn48bgrxq"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.7.2"; sha256 = "1szsg1iy77f0caxzkk0ihpp4ifbfnbdbn8k0wbbhbdprxj8pr356"; })
   (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "5.0.0"; sha256 = "102hvhq2gmlcbq8y2cb7hdr2dnmjzfp2k3asr1ycwrfacwyaak7n"; })
   (fetchNuGet { pname = "MSTest.TestAdapter"; version = "3.1.1"; sha256 = "0y3ic8jv5jhld6gan2qfa2wyk4z57f7y4y5a47njr0jvxxnarg2c"; })
   (fetchNuGet { pname = "MSTest.TestFramework"; version = "3.1.1"; sha256 = "1lbgkrbrkmw4c54g61cwbmwc4zl8hyqmp283ymvj93lq7chbxasn"; })
@@ -86,9 +90,9 @@
   (fetchNuGet { pname = "Nito.AsyncEx.Tasks"; version = "5.1.2"; sha256 = "11wp47kc69sjdxrbg5pgx0wlffqlp0x5kr54ggnz2v19kmjz362v"; })
   (fetchNuGet { pname = "Nito.Collections.Deque"; version = "1.1.1"; sha256 = "152564q3s0n5swfv5p5rx0ghn2sm0g2xsnbd7gv8vb9yfklv7yg8"; })
   (fetchNuGet { pname = "Nito.Disposables"; version = "2.2.1"; sha256 = "1hx5k8497j34kxxgh060bvij0vfnraw90dmm3h9bmamcdi8wp80l"; })
-  (fetchNuGet { pname = "NLog"; version = "5.2.3"; sha256 = "0srai3s2kk9y2jimdvw1xw86nch38q6nza598dpr81dghx3s6j6w"; })
-  (fetchNuGet { pname = "NLog.Extensions.Logging"; version = "5.3.3"; sha256 = "0j19fljxbcc0bysmj7i0fmiax6sp5kjapf2llkimv7dh63rj9ckg"; })
-  (fetchNuGet { pname = "NLog.Web.AspNetCore"; version = "5.3.3"; sha256 = "0rhha2lwrzwlx0q1a8w9ph9xwayl3kmmy200ygsghcd02srlazkj"; })
+  (fetchNuGet { pname = "NLog"; version = "5.2.5"; sha256 = "02fybqi9d7czz3jmhmgb8wia2hpjj5hmcnij6zsgs69rkv6hf9j0"; })
+  (fetchNuGet { pname = "NLog.Extensions.Logging"; version = "5.3.5"; sha256 = "0jzfqa12l5vvxd2j684cnm29w19v386cpm11pw8h6prpf57affaj"; })
+  (fetchNuGet { pname = "NLog.Web.AspNetCore"; version = "5.3.5"; sha256 = "0li0sw04w0a4zms5jjv1ga45wxiqlcvaw8gi0wbhiifrdzz5yckb"; })
   (fetchNuGet { pname = "NuGet.Frameworks"; version = "6.5.0"; sha256 = "0s37d1p4md0k6d4cy6sq36f2dgkd9qfbzapxhkvi8awwh0vrynhj"; })
   (fetchNuGet { pname = "protobuf-net"; version = "3.2.16"; sha256 = "0pwlqlq2p8my2sr8b0cvdav5cm8wpwf3s4gy7s1ba701ac2zyb9y"; })
   (fetchNuGet { pname = "protobuf-net.Core"; version = "3.2.16"; sha256 = "00znhikq7valr3jaxg66cwli9hf75wkmmpf6rf8p790hf8lxq0c5"; })
@@ -108,6 +112,7 @@
   (fetchNuGet { pname = "System.Composition.Runtime"; version = "7.0.0"; sha256 = "1p9xpqzx42s8cdizv6nh15hcjvl2km0rwby66nfkj4cb472l339s"; })
   (fetchNuGet { pname = "System.Composition.TypedParts"; version = "7.0.0"; sha256 = "0syz7y6wgnxxgjvfqgymn9mnaa5fjy1qp06qnsvh3agr9mvcv779"; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "6.0.0"; sha256 = "0rrihs9lnb1h6x4h0hn6kgfnh58qq7hx8qq99gh6fayx4dcnx3s5"; })
+  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "7.0.3"; sha256 = "1fls88ffq34j1gr6zay1crm27v3sjs5fa4mvj9akqjq05bxanlhk"; })
   (fetchNuGet { pname = "System.Linq.Async"; version = "6.0.1"; sha256 = "10ira8hmv0i54yp9ggrrdm1c06j538sijfjpn1kmnh9j2xk5yzmq"; })
   (fetchNuGet { pname = "System.Reflection.Metadata"; version = "1.6.0"; sha256 = "1wdbavrrkajy7qbdblpbpbalbdl48q3h34cchz24gvdgyrlf15r4"; })
   (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
diff --git a/pkgs/applications/misc/ArchiSteamFarm/update.sh b/pkgs/applications/misc/ArchiSteamFarm/update.sh
index 9af9acb69835b..53d3ee6641912 100755
--- a/pkgs/applications/misc/ArchiSteamFarm/update.sh
+++ b/pkgs/applications/misc/ArchiSteamFarm/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p curl gnused jq common-updater-scripts nix-prefetch prefetch-npm-deps
+#!nix-shell -I nixpkgs=./. -i bash -p curl gnused jq common-updater-scripts
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
@@ -14,7 +14,7 @@ if [[ "$new_version" == "$old_version" ]]; then
 fi
 
 asf_path=$PWD
-pushd ../../../..
+cd ../../../..
 
 if [[ "${1:-}" != "--deps-only" ]]; then
     update-source-version ArchiSteamFarm "$new_version"
@@ -22,5 +22,5 @@ fi
 
 $(nix-build -A ArchiSteamFarm.fetch-deps --no-out-link)
 
-popd
-"$asf_path/web-ui/update.sh"
+cd "$asf_path/web-ui"
+./update.sh
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/.gitignore b/pkgs/applications/misc/ArchiSteamFarm/web-ui/.gitignore
new file mode 100644
index 0000000000000..d8b83df9cdb66
--- /dev/null
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/.gitignore
@@ -0,0 +1 @@
+package-lock.json
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
index 77f4e9c6e299b..4dad0b1f5b6b5 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
@@ -1,19 +1,19 @@
-{ lib, fetchFromGitHub, buildNpmPackage, nodePackages, ArchiSteamFarm }:
+{ lib, fetchFromGitHub, buildNpmPackage, ArchiSteamFarm }:
 
-buildNpmPackage {
+buildNpmPackage rec {
   pname = "asf-ui";
-  inherit (ArchiSteamFarm) version;
+  version = "fceb2fb828cfa420c77dc5cde433fd519a6717d4";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
     repo = "ASF-ui";
     # updated by the update script
     # this is always the commit that should be used with asf-ui from the latest asf version
-    rev = "0b812a7ab0d2f01a675d27f80008ad7b6972b4aa";
-    hash = "sha256-ut0x/qT3DyDASW4QbNT+BF6eXHCIbTol5E+3+tirFDA=";
+    rev = version;
+    hash = "sha256-gMQWly7HN5rIV9r72Qa+gHuBuQMs9sh09od4ja4sRGU=";
   };
 
-  npmDepsHash = "sha256-HpBEoAIGejpHJnUciz4iWILcXdgpw7X1xFuXmx9Z9dw=";
+  npmDepsHash = "sha256-UDCQTRpcPDcuvPzlqTu315EkGr5G0+z7qMSsPgYQacA=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh b/pkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh
index 7f026383383df..6fa8e67a1217a 100755
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh
@@ -1,23 +1,19 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=../../../.. -i bash -p nodePackages.node2nix gnused jq curl
+#! nix-shell -I nixpkgs=../../../../.. -i bash -p curl gnused jq common-updater-scripts prefetch-npm-deps
 set -eou pipefail
 
-cd "$(dirname "$0")"
-pushd ../../../../..
+cd "$(dirname "$0")"/../../../../..
 version=$(nix-instantiate --strict --eval -A ArchiSteamFarm.version | jq -r)
-popd
-pushd "$(dirname "$0")"
+cd -
 ui=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/JustArchiNET/ArchiSteamFarm/contents/ASF-ui?ref=$version" | jq -r .sha)
 
 curl "https://raw.githubusercontent.com/JustArchiNET/ASF-ui/$ui/package-lock.json" -o package-lock.json
 
-# update-source-version doesn't work for some reason
-sed -i "s/rev\\s*=\\s*.*/rev = \"$ui\";/" default.nix
-sed -i "s/hash\\s*=\\s*.*/hash = \"$(nix-prefetch fetchurl --url "https://github.com/JustArchiNET/ASF-ui/archive/$ui.tar.gz")\";/" default.nix
+cd -
+update-source-version ArchiSteamFarm.ui "$ui"
+cd -
 
 npmDepsHash=$(prefetch-npm-deps ./package-lock.json)
 sed -E 's#\bnpmDepsHash = ".*?"#npmDepsHash = "'"$npmDepsHash"'"#' -i default.nix
 
 rm package-lock.json
-
-popd
diff --git a/pkgs/applications/misc/albert/default.nix b/pkgs/applications/misc/albert/default.nix
index a9008283dd285..ceb74f7b0a323 100644
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@@ -10,6 +10,7 @@
 , qtscxml
 , qtsvg
 , qtdeclarative
+, qtwayland
 , qt5compat
 , wrapQtAppsHook
 , nix-update-script
@@ -42,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     qtscxml
     qtsvg
     qtdeclarative
+    qtwayland
     qt5compat
   ] ++ (with python3Packages; [ python pybind11 ]);
 
diff --git a/pkgs/applications/misc/blender/default.nix b/pkgs/applications/misc/blender/default.nix
index 00bbcdafff13f..8e7fde6d9c299 100644
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@@ -31,11 +31,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "blender";
-  version = "3.6.4";
+  version = "3.6.5";
 
   src = fetchurl {
     url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    hash = "sha256-zFL0GRWAtNC3C+SAspWZmGa8US92EiYQgVfiOsCJRx4=";
+    hash = "sha256-QAHA/pn22HLsfH6VX4Sp7r25raFxAPS1Gergjez38kM=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/dasel/default.nix b/pkgs/applications/misc/dasel/default.nix
index 04804732edc49..14a8f6013f2be 100644
--- a/pkgs/applications/misc/dasel/default.nix
+++ b/pkgs/applications/misc/dasel/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "dasel";
-  version = "2.3.6";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = "dasel";
     rev = "v${version}";
-    sha256 = "sha256-k+I4n05IbQT7tGzkJ0aPW6kLT1mGqwQOwoKDyal8L3w=";
+    sha256 = "sha256-zxTT/CkSbH40R7itXAx0zD+haHOoMep/W4KfalJQ/8w=";
   };
 
-  vendorHash = "sha256-Gueo8aZS5N1rLqZweXjXv7BLrtShxGDSGfbkYXhy4DQ=";
+  vendorHash = "sha256-CbR0uHtha2OoHW9mcB1I2lGJbjerbZARVN/mTstv/Y0=";
 
   ldflags = [
     "-s" "-w" "-X github.com/tomwright/dasel/v2/internal.Version=${version}"
diff --git a/pkgs/applications/misc/fluxboxlauncher/default.nix b/pkgs/applications/misc/fluxboxlauncher/default.nix
index 4794e14b4698e..4794e14b4698e 100755..100644
--- a/pkgs/applications/misc/fluxboxlauncher/default.nix
+++ b/pkgs/applications/misc/fluxboxlauncher/default.nix
diff --git a/pkgs/applications/misc/get_iplayer/default.nix b/pkgs/applications/misc/get_iplayer/default.nix
index 2483cc000f01d..fe33a7df75690 100644
--- a/pkgs/applications/misc/get_iplayer/default.nix
+++ b/pkgs/applications/misc/get_iplayer/default.nix
@@ -11,13 +11,13 @@
 
 perlPackages.buildPerlPackage rec {
   pname = "get_iplayer";
-  version = "3.31";
+  version = "3.33";
 
   src = fetchFromGitHub {
     owner = "get-iplayer";
     repo = "get_iplayer";
     rev = "v${version}";
-    sha256 = "+ChCF27nmPKbqaZVxsZ6TlbzSdEz6RfMs87NE8xaSRw=";
+    hash = "sha256-cX+ydMvpQNFfQICRVKyhnB5gZkVnOMLPbGgdFymzmeA=";
   };
 
   nativeBuildInputs = [ makeWrapper ] ++ lib.optional stdenv.isDarwin shortenPerlShebang;
@@ -32,10 +32,12 @@ perlPackages.buildPerlPackage rec {
 
   installPhase = ''
     runHook preInstall
+
     mkdir -p $out/bin $out/share/man/man1
     cp get_iplayer $out/bin
     wrapProgram $out/bin/get_iplayer --suffix PATH : ${lib.makeBinPath [ atomicparsley ffmpeg ]} --prefix PERL5LIB : $PERL5LIB
     cp get_iplayer.1 $out/share/man/man1
+
     runHook postInstall
   '';
 
diff --git a/pkgs/applications/misc/html5validator/default.nix b/pkgs/applications/misc/html5validator/default.nix
index 71ba3dcf100ad..6c9c65cf4270e 100644
--- a/pkgs/applications/misc/html5validator/default.nix
+++ b/pkgs/applications/misc/html5validator/default.nix
@@ -1,25 +1,41 @@
-{ buildPythonApplication, fetchFromGitHub, nose, openjdk, lib }:
+{ lib
+, fetchFromGitHub
+, openjdk
+, python3
+}:
 
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "html5validator";
-  version = "0.3.3";
+  version = "0.4.2";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "svenkreiss";
     repo = "html5validator";
-    rev = "v${version}";
-    sha256 = "130acqi0dsy3midg7hwslykzry6crr4ln6ia0f0avyywkz4bplsv";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-yvclqE4+2R9q/UJU9W95U1/xVJeNj+5eKvT6VQel9k8=";
   };
 
-  propagatedBuildInputs = [ openjdk ];
+  propagatedBuildInputs = [
+    openjdk
+  ] ++ (with python3.pkgs; [
+    pyyaml
+  ]);
 
-  nativeCheckInputs = [ nose ];
-  checkPhase = "PATH=$PATH:$out/bin nosetests";
+  nativeCheckInputs = with python3.pkgs; [
+    hacking
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export PATH="$PATH:$out/bin";
+  '';
 
   meta = with lib; {
-    homepage = "https://github.com/svenkreiss/html5validator";
     description = "Command line tool that tests files for HTML5 validity";
+    homepage = "https://github.com/svenkreiss/html5validator";
+    changelog = "https://github.com/svenkreiss/html5validator/releases/tag/v${version}";
     license = licenses.mit;
-    maintainers = [ maintainers.phunehehe ];
+    maintainers = with maintainers; [ phunehehe ];
   };
 }
diff --git a/pkgs/applications/misc/leetcode-cli/default.nix b/pkgs/applications/misc/leetcode-cli/default.nix
index be9102b6120b3..4ea55b39c5315 100644
--- a/pkgs/applications/misc/leetcode-cli/default.nix
+++ b/pkgs/applications/misc/leetcode-cli/default.nix
@@ -2,6 +2,7 @@
 , fetchCrate
 , rustPlatform
 , pkg-config
+, installShellFiles
 , openssl
 , dbus
 , sqlite
@@ -24,6 +25,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
+    installShellFiles
   ];
 
   buildInputs = [
@@ -32,6 +34,13 @@ rustPlatform.buildRustPackage rec {
     sqlite
   ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
+  postInstall = ''
+    installShellCompletion --cmd leetcode \
+      --bash <($out/bin/leetcode completions bash) \
+      --fish <($out/bin/leetcode completions fish) \
+      --zsh <($out/bin/leetcode completions zsh)
+  '';
+
   passthru.tests = testers.testVersion {
     package = leetcode-cli;
     command = "leetcode -V";
diff --git a/pkgs/applications/misc/nwg-displays/default.nix b/pkgs/applications/misc/nwg-displays/default.nix
index f0fc2b1bb368d..18ba079088af7 100644
--- a/pkgs/applications/misc/nwg-displays/default.nix
+++ b/pkgs/applications/misc/nwg-displays/default.nix
@@ -14,13 +14,13 @@
 
 python310Packages.buildPythonApplication rec {
   pname = "nwg-displays";
-  version = "0.3.7";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-displays";
     rev = "v${version}";
-    hash = "sha256-Y405ZeOSpc1aPKEzFdvlgJgpGAi9HUR+Hvx63uYdp88=";
+    hash = "sha256-9v5TQTliUEnynoGDf1UXsQ9Ym7x2gPmx4QiRJH5BId4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/nwg-panel/default.nix b/pkgs/applications/misc/nwg-panel/default.nix
index a4d333e594c31..90864dee69ba4 100644
--- a/pkgs/applications/misc/nwg-panel/default.nix
+++ b/pkgs/applications/misc/nwg-panel/default.nix
@@ -15,13 +15,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-panel";
-  version = "0.9.13";
+  version = "0.9.14";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     rev = "v${version}";
-    hash = "sha256-dP/FbMrjPextwedQeLJHM6f/a+EuZ+hQSLrH/rF2XOg=";
+    hash = "sha256-ThcB/BhnJbBHUoRh120iqN6LMGOnkekzALTTgd8uUx4=";
   };
 
   # No tests
diff --git a/pkgs/applications/misc/obsidian/default.nix b/pkgs/applications/misc/obsidian/default.nix
index 78967c55a5d72..43ea198d62c9b 100644
--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@@ -12,7 +12,7 @@
 let
   inherit (stdenv.hostPlatform) system;
   pname = "obsidian";
-  version = "1.4.14";
+  version = "1.4.16";
   appname = "Obsidian";
   meta = with lib; {
     description = "A powerful knowledge base that works on top of a local folder of plain text Markdown files";
@@ -25,7 +25,7 @@ let
   filename = if stdenv.isDarwin then "Obsidian-${version}-universal.dmg" else "obsidian-${version}.tar.gz";
   src = fetchurl {
     url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
-    hash = if stdenv.isDarwin then "sha256-5cVKlZJDtXOkil+RohijCcqyJVTrysmqyTvJR0dDAuc=" else "sha256-qFSQer37Nkh3A3oVAFP/0qXzPWJ7SqY2GYA6b1iaYmE=";
+    hash = if stdenv.isDarwin then "sha256-ydLWr+Snkza9G+R7HbPuUdoZsL25Uj+KDos67Mq/urY=" else "sha256-PBKLGs3MZyarSMiWnjqY7d9bQrKu2uLAvLUufpHLxcw=";
   };
 
   icon = fetchurl {
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index aa918ddce9e26..810b13afbf2a0 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -86,7 +86,7 @@ let
                 owner = "OctoPrint";
                 repo = "OctoPrint";
                 rev = version;
-                hash = "sha256-SYN/BrcukHMDwk70XGu/pO45fSPr/KOEyd4wxtz2Fo0=";
+                hash = "sha256-71uE8JvcS++xH8WSVWj5x0+9s3XIwf3A64c6YtxpSRc=";
               };
 
               propagatedBuildInputs = with self; [
@@ -114,7 +114,6 @@ let
                 netifaces
                 octoprint-filecheck
                 octoprint-firmwarecheck
-                octoprint-pisupport
                 passlib
                 pathvalidate
                 pkginfo
@@ -142,6 +141,8 @@ let
                 pydantic
               ] ++ lib.optionals stdenv.isDarwin [
                 py.pkgs.appdirs
+              ] ++ lib.optionals (!stdenv.isDarwin) [
+                octoprint-pisupport
               ];
 
               nativeCheckInputs = with self; [
diff --git a/pkgs/applications/misc/slweb/default.nix b/pkgs/applications/misc/slweb/default.nix
index 1c6931fadcd46..ee5e01b79956a 100644
--- a/pkgs/applications/misc/slweb/default.nix
+++ b/pkgs/applications/misc/slweb/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slweb";
-  version = "0.6.11";
+  version = "0.9.0";
 
   src = fetchFromSourcehut {
     owner = "~strahinja";
     repo = "slweb";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+bKapK/s1pmo1NRRslf7V4ogWTtchFNWpzi+S8YG6+4=";
+    hash = "sha256-QDHcp5pCmapgOlJpDDyyC12JOfh/biDyF6O+iKGbOGg=";
   };
 
   nativeBuildInputs = [ redo-apenwarr ];
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 8466850808cb3..c3495160029f2 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -92,11 +92,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.59.117";
+  version = "1.59.120";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-yckxTKAgglk6YRXist9RZufZdI22iitecmb01NmYPGQ=";
+    sha256 = "sha256-fkIU6XuydF6Bo8V0uS4NObh2fRuKxOWMqVft81uUs9Q=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index e3bb552d57c0d..72ae7ae6aa413 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -148,36 +148,39 @@ let
       else throw "no chromium Rosetta Stone entry for os: ${platform.config}";
   };
 
+  recompressTarball = { version, sha256 ? "" }: fetchzip {
+    name = "chromium-${version}.tar.zstd";
+    url = "https://commondatastorage.googleapis.com/chromium-browser-official/chromium-${version}.tar.xz";
+    inherit sha256;
+
+    nativeBuildInputs = [ zstd ];
+
+    postFetch = ''
+      echo removing unused code from tarball to stay under hydra limit
+      rm -r $out/third_party/{rust-src,llvm}
+
+      echo moving remains out of \$out
+      mv $out source
+
+      echo recompressing final contents into new tarball
+      # try to make a deterministic tarball
+      tar \
+        --use-compress-program "zstd -T$NIX_BUILD_CORES" \
+        --sort name \
+        --mtime 1970-01-01 \
+        --owner=root --group=root \
+        --numeric-owner --mode=go=rX,u+rw,a-s \
+        -cf $out source
+    '';
+  };
+
+
   base = rec {
     pname = "${packageName}-unwrapped";
     inherit (upstream-info) version;
     inherit packageName buildType buildPath;
 
-    src = fetchzip {
-      name = "chromium-${version}.tar.zstd";
-      url = "https://commondatastorage.googleapis.com/chromium-browser-official/chromium-${version}.tar.xz";
-      inherit (upstream-info) sha256;
-
-      nativeBuildInputs = [ zstd ];
-
-      postFetch = ''
-        echo removing unused code from tarball to stay under hydra limit
-        rm -r $out/third_party/{rust-src,llvm}
-
-        echo moving remains out of \$out
-        mv $out source
-
-        echo recompressing final contents into new tarball
-        # try to make a deterministic tarball
-        tar \
-          --use-compress-program "zstd -T$NIX_BUILD_CORES" \
-          --sort name \
-          --mtime 1970-01-01 \
-          --owner=root --group=root \
-          --numeric-owner --mode=go=rX,u+rw,a-s \
-          -cf $out source
-      '';
-    };
+    src = recompressTarball { inherit version; inherit (upstream-info) sha256; };
 
     nativeBuildInputs = [
       ninja pkg-config
@@ -312,9 +315,6 @@ let
       sed -i -e '/lib_loader.*Load/s!"\(libudev\.so\)!"${lib.getLib systemd}/lib/\1!' \
         device/udev_linux/udev?_loader.cc
     '' + ''
-      sed -i -e '/libpci_loader.*Load/s!"\(libpci\.so\)!"${pciutils}/lib/\1!' \
-        gpu/config/gpu_info_collector_linux.cc
-
       # Allow to put extensions into the system-path.
       sed -i -e 's,/usr,/run/current-system/sw,' chrome/common/chrome_paths.cc
 
@@ -476,9 +476,10 @@ let
 
     postFixup = ''
       # Make sure that libGLESv2 and libvulkan are found by dlopen.
+      # libpci (from pciutils) is needed by dlopen in angle/src/gpu_info_util/SystemInfo_libpci.cpp
       chromiumBinary="$libExecPath/$packageName"
       origRpath="$(patchelf --print-rpath "$chromiumBinary")"
-      patchelf --set-rpath "${lib.makeLibraryPath [ libGL vulkan-loader ]}:$origRpath" "$chromiumBinary"
+      patchelf --set-rpath "${lib.makeLibraryPath [ libGL vulkan-loader pciutils ]}:$origRpath" "$chromiumBinary"
     '';
 
     passthru = {
@@ -486,6 +487,7 @@ let
       chromiumDeps = {
         gn = gnChromium;
       };
+      inherit recompressTarball;
     };
   }
   # overwrite `version` with the exact same `version` from the same source,
diff --git a/pkgs/applications/networking/browsers/chromium/update.py b/pkgs/applications/networking/browsers/chromium/update.py
index f8dae95936019..fd8f367784059 100755
--- a/pkgs/applications/networking/browsers/chromium/update.py
+++ b/pkgs/applications/networking/browsers/chromium/update.py
@@ -21,12 +21,11 @@ from urllib.request import urlopen
 
 RELEASES_URL = 'https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/all/versions/all/releases'
 DEB_URL = 'https://dl.google.com/linux/chrome/deb/pool/main/g'
-BUCKET_URL = 'https://commondatastorage.googleapis.com/chromium-browser-official'
 
 PIN_PATH = dirname(abspath(__file__)) + '/upstream-info.nix'
 UNGOOGLED_FLAGS_PATH = dirname(abspath(__file__)) + '/ungoogled-flags.toml'
 COMMIT_MESSAGE_SCRIPT = dirname(abspath(__file__)) + '/get-commit-message.py'
-
+NIXPKGS_PATH = subprocess.check_output(["git", "rev-parse", "--show-toplevel"], cwd=dirname(PIN_PATH)).strip()
 
 def load_as_json(path):
     """Loads the given nix file as JSON."""
@@ -41,6 +40,23 @@ def save_dict_as_nix(path, input):
     with open(path, 'w') as out:
         out.write(formatted.decode())
 
+def prefetch_src_sri_hash(attr_path, version):
+    """Prefetches the fixed-output-derivation source tarball and returns its SRI-Hash."""
+    print(f'nix-build (FOD prefetch) {attr_path} {version}')
+    out = subprocess.run(
+        ["nix-build", "--expr", f'(import ./. {{}}).{attr_path}.browser.passthru.recompressTarball {{ version = "{version}"; }}'],
+        cwd=NIXPKGS_PATH,
+        stderr=subprocess.PIPE
+    ).stderr.decode()
+
+    for line in iter(out.split("\n")):
+        match = re.match(r"\s+got:\s+(.+)$", line)
+        if match:
+            print(f'Hash: {match.group(1)}')
+            return match.group(1)
+    print(f'{out}\n\nError: Expected hash in nix-build stderr output.', file=sys.stderr)
+    sys.exit(1)
+
 def nix_prefetch_url(url, algo='sha256'):
     """Prefetches the content of the given URL."""
     print(f'nix-prefetch-url {url}')
@@ -206,7 +222,10 @@ with urlopen(RELEASES_URL) as resp:
             google_chrome_suffix = channel_name
 
         try:
-            channel['sha256'] = nix_prefetch_url(f'{BUCKET_URL}/chromium-{release["version"]}.tar.xz')
+            channel['sha256'] = prefetch_src_sri_hash(
+                channel_name_to_attr_name(channel_name),
+                release["version"]
+            )
             channel['sha256bin64'] = nix_prefetch_url(
                 f'{DEB_URL}/google-chrome-{google_chrome_suffix}/' +
                 f'google-chrome-{google_chrome_suffix}_{release["version"]}-1_amd64.deb')
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index 3086f82c9c48c..b8004a7d4b390 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -41,9 +41,9 @@
         version = "2023-08-10";
       };
     };
-    sha256 = "1g8rllmnmhmmpjzrmi3cww0nszxicq0kim2wd0l0ip2mzk2p8qlp";
-    sha256bin64 = "1bq170l0g9yq17x6xlg6fjar6gv3hdi0zijwmx4s02pmw6727484";
-    version = "118.0.5993.70";
+    sha256 = "sha256-CTkw92TiRD2tkYu5a5dy8fjpR2MMOMCvcbxXhJ36Bp8=";
+    sha256bin64 = "06rbsjh4khhl408181ns5nsdwasklb277fdjfajdv5h1j9a190k3";
+    version = "118.0.5993.88";
   };
   ungoogled-chromium = {
     deps = {
@@ -54,12 +54,12 @@
         version = "2023-08-10";
       };
       ungoogled-patches = {
-        rev = "118.0.5993.70-1";
-        sha256 = "0k6684cy1ks6yba2bdz17g244f05qy9769cvis4h2jzhgbf5rysh";
+        rev = "118.0.5993.88-1";
+        sha256 = "17j47d64l97ascp85h8cnfnr5wr4va3bdk95wmagqss7ym5c7zsf";
       };
     };
-    sha256 = "1g8rllmnmhmmpjzrmi3cww0nszxicq0kim2wd0l0ip2mzk2p8qlp";
-    sha256bin64 = "1bq170l0g9yq17x6xlg6fjar6gv3hdi0zijwmx4s02pmw6727484";
-    version = "118.0.5993.70";
+    sha256 = "sha256-CTkw92TiRD2tkYu5a5dy8fjpR2MMOMCvcbxXhJ36Bp8=";
+    sha256bin64 = "06rbsjh4khhl408181ns5nsdwasklb277fdjfajdv5h1j9a190k3";
+    version = "118.0.5993.88";
   };
 }
diff --git a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
index e42a4e0c4b491..3b0250c5f9a96 100644
--- a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
+++ b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "argocd-autopilot";
-  version = "0.4.16";
+  version = "0.4.17";
 
   src = fetchFromGitHub {
     owner = "argoproj-labs";
     repo = "argocd-autopilot";
     rev = "v${version}";
-    sha256 = "sha256-KxEH6FpCaOVOjdNKn7dYbFlT/W4gA8276Zt3sIs3Tg8=";
+    sha256 = "sha256-txbs1SzAaV1nCl104m0Ht5DwzCmK+sBDn4rZ1newdLc=";
   };
 
-  vendorHash = "sha256-3f5eEge5tGko/B7MtPcifoQOkkVr0jjFX5nF6g1kow4=";
+  vendorHash = "sha256-1nolJLWkArzSKf11fzlvvgiCnvMYSu5MHRNAn1lryms=";
 
   proxyVendor = true;
 
diff --git a/pkgs/applications/networking/cluster/eks-node-viewer/default.nix b/pkgs/applications/networking/cluster/eks-node-viewer/default.nix
index b4f9ce722e79e..80538f0f111c4 100644
--- a/pkgs/applications/networking/cluster/eks-node-viewer/default.nix
+++ b/pkgs/applications/networking/cluster/eks-node-viewer/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eks-node-viewer";
-  version = "0.4.3";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-570wOLUtKKzDDLLDrAOPAnAUpZeAqrwKsQWoHCBjKKk=";
+    sha256 = "sha256-kfX9BzARDWUOBIu67j60K38uwkRELxd/gXtEHOHAXS8=";
   };
 
-  vendorHash = "sha256-kRRUaA/psQDmcM1ZhzdZE3eyw8DWZpesJVA2zVfORGk=";
+  vendorHash = "sha256-7axI7R8cTntc1IcOwVPmPj8MHeIvhbnkYKQdqu5fZOU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/flink/default.nix b/pkgs/applications/networking/cluster/flink/default.nix
index f0547dcf56097..70c70d9ead43c 100644
--- a/pkgs/applications/networking/cluster/flink/default.nix
+++ b/pkgs/applications/networking/cluster/flink/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
       --prefix PATH : ${jre}/bin
 
     cat <<EOF >> $out/opt/flink/conf/flink-conf.yaml
-    env.java.home: ${jre}"
+    env.java.home: ${jre}
     env.log.dir: /tmp/flink-logs
     EOF
   '';
diff --git a/pkgs/applications/networking/cluster/kaniko/default.nix b/pkgs/applications/networking/cluster/kaniko/default.nix
index 7639c95a971f5..13ccf5599ce7d 100644
--- a/pkgs/applications/networking/cluster/kaniko/default.nix
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "kaniko";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "kaniko";
     rev = "v${version}";
-    hash = "sha256-PTcPlYJ0IHWNQKBJcMiotGp6GPH3qY3f6sJKgUVSTZU=";
+    hash = "sha256-O4FPz62QnvG+Q2l4Gr/O0XFpkXE2G4RO/G6KNDdanzk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index 97d3a3140209a..ac142ca3597e4 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -20,13 +20,13 @@
 
 buildGoModule rec {
   pname = "kubernetes";
-  version = "1.28.2";
+  version = "1.28.3";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    hash = "sha256-7juoX4nFvQbIIbhTlnIYVUEYUJGwu+aKrpw4ltujjXI=";
+    hash = "sha256-lb9FAk3b6J92viyHzLCzbYRxhQS94/FQvDr1m1kdTq8=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/starboard/default.nix b/pkgs/applications/networking/cluster/starboard/default.nix
index ddfa4443d826c..8f456f3fb4de9 100644
--- a/pkgs/applications/networking/cluster/starboard/default.nix
+++ b/pkgs/applications/networking/cluster/starboard/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "starboard";
-  version = "0.15.15";
+  version = "0.15.16";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-aKxRjPXvj9rGUheUjpjGWlzg9I6LaCxfc6FJV8Kzj3I=";
+    sha256 = "sha256-n4gChQQMVdtEKW2WqQAEVtlU2fFxLxBem2yAJzDjx2Q=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
index 3b9962b84a0fb..a729e62783b14 100644
--- a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tektoncd-cli";
-  version = "0.32.0";
+  version = "0.32.1";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-Ilue0stXko8bkMMzXEHrdgJYIV5ZcI39hwFUya8X4ac=";
+    sha256 = "sha256-qxKWyNQRWc0krdIfG6Mkn8ZZSkCkb0V41nIUsN5azGo=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/terraform-backend-git/default.nix b/pkgs/applications/networking/cluster/terraform-backend-git/default.nix
index 09cc62352d7b5..2e7f70eaf57d2 100644
--- a/pkgs/applications/networking/cluster/terraform-backend-git/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-backend-git/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "terraform-backend-git";
-  version = "0.1.5";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "plumber-cd";
     repo = "terraform-backend-git";
     rev = "v${version}";
-    hash = "sha256-ryHFuHIEJ4i1R3oBW3w3aAvtv+vIrO745qwx0+SqBF4=";
+    hash = "sha256-ZbQfL7uKCFD98HcoeqscZaIsWFvWH0Ytzlqr6fMmXUs=";
   };
 
   vendorHash = "sha256-Y/4UgG/2Vp+gxBnGrNpAgRNfPZWJXhVo8TVa/VfOYt0=";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 32f29dea87cab..efd18b33da1e9 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -953,11 +953,11 @@
     "vendorHash": null
   },
   "project": {
-    "hash": "sha256-D+UBv6JEbJKGfwTJU7/W5N6otOLW2lq6+euUKpoJ+To=",
+    "hash": "sha256-UO9GBBoOzA1stMq8naXWtxomme6CVdlngVCLQlbZDv0=",
     "homepage": "https://registry.terraform.io/providers/jfrog/project",
     "owner": "jfrog",
     "repo": "terraform-provider-project",
-    "rev": "v1.3.2",
+    "rev": "v1.3.3",
     "spdx": "Apache-2.0",
     "vendorHash": "sha256-Tj+NefCIacwpPS9rNPPxV2lLeKsXJMZhf9Xo+Rzz6gI="
   },
@@ -1279,11 +1279,11 @@
     "vendorHash": "sha256-4ulRYzb4bzk0TztT04CwqlnMGw8tp7YnoCm2/NqGN7Y="
   },
   "vultr": {
-    "hash": "sha256-65QWogqHR5RYUXBYjM50PNQSuVWYGtqtULTGNy1ivag=",
+    "hash": "sha256-8pj+udTNTjT/tXggOaIOThRQkYoI3v68rEssSUojM2A=",
     "homepage": "https://registry.terraform.io/providers/vultr/vultr",
     "owner": "vultr",
     "repo": "terraform-provider-vultr",
-    "rev": "v2.16.3",
+    "rev": "v2.16.4",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 38051dff543c2..5974560092c8b 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -167,9 +167,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.6.1";
-    hash = "sha256-qUJruwpec4uZ/gPWzpbQOMfSxkwRkRDlWDmVIgqe5A8=";
-    vendorHash = "sha256-1ZQDgNeMC59KrmZpA8T+Etbuk2MQKQsDYzqPGl6Y4Hg=";
+    version = "1.6.2";
+    hash = "sha256-24B8YlorL00OqmYYVM1xg5dM9hZ4enDWJ1XIGmeEAiM=";
+    vendorHash = "sha256-fIirGWt4Os2uZHo4ui7wmZEp+DRUHu/0p+cQCbUbzjc=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index 1e6c86915acd4..65cddcbc34d4b 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.52.1";
+  version = "0.52.3";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-t1GAcOZAYdfrI0lsyKUEBbnJaGzuFP0+Mz3Yrv4Bmik=";
+    hash = "sha256-o/4L7TBdFFHuPOKAO/wP0IBixQtZHGr1GSNlsEpq710=";
   };
 
-  vendorHash = "sha256-NSrZVLQ3Qbnp94qCV7NbrEav/7LCRbTov+B2vzbuvdM=";
+  vendorHash = "sha256-RmzSKt5qt9Qb4GDrfs4dJEhGQW/jFbXPn+AOLzEyo6c=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/gopher/sacc/default.nix b/pkgs/applications/networking/gopher/sacc/default.nix
index 9944238703983..686f671e13a52 100644
--- a/pkgs/applications/networking/gopher/sacc/default.nix
+++ b/pkgs/applications/networking/gopher/sacc/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sacc";
-  version = "1.06";
+  version = "1.07";
 
   src = fetchurl {
     url = "ftp://bitreich.org/releases/sacc/sacc-${version}.tar.gz";
-    hash = "sha512-eoleQy4dKLfZsrsqUybKMjUIdqLIDTncbBnnU0fXKkhH8apP8R8H6Kmt6hTqcbhNcIkNzBcP9s4Ld54dZYa0+g==";
+    hash = "sha256-LdEeZH+JWb7iEEzikAXaxG0N5GMPxjgTId4THLgdU2w=";
   };
 
   inherit patches;
diff --git a/pkgs/applications/networking/ids/zeek/default.nix b/pkgs/applications/networking/ids/zeek/default.nix
index 8ab64a6e57dd7..e4440b483595a 100644
--- a/pkgs/applications/networking/ids/zeek/default.nix
+++ b/pkgs/applications/networking/ids/zeek/default.nix
@@ -22,6 +22,7 @@
 
 let
   broker = callPackage ./broker { };
+  python = python3.withPackages (p: [ p.gitpython p.semantic-version ]);
 in
 stdenv.mkDerivation rec {
   pname = "zeek";
@@ -43,7 +44,7 @@ stdenv.mkDerivation rec {
     cmake
     file
     flex
-    python3
+    python
   ];
 
   buildInputs = [
@@ -56,11 +57,11 @@ stdenv.mkDerivation rec {
     openssl
     swig
     zlib
+    python
   ] ++ lib.optionals stdenv.isLinux [
     libkqueue
   ] ++ lib.optionals stdenv.isDarwin [
     gettext
-    python3
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 2cd7ee2d2c5bf..0420ae8ca946b 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -1,52 +1,52 @@
 { branch ? "stable", callPackage, fetchurl, lib, stdenv }:
 let
   versions = if stdenv.isLinux then {
-    stable = "0.0.31";
-    ptb = "0.0.49";
-    canary = "0.0.170";
-    development = "0.0.234";
+    stable = "0.0.32";
+    ptb = "0.0.51";
+    canary = "0.0.171";
+    development = "0.0.1";
   } else {
-    stable = "0.0.280";
-    ptb = "0.0.80";
-    canary = "0.0.315";
-    development = "0.0.8797";
+    stable = "0.0.281";
+    ptb = "0.0.82";
+    canary = "0.0.320";
+    development = "0.0.2";
   };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-toWwiMsEFsGaOYaPZziSmZtpzxGd9m+2MtxTrJwqFbw=";
+        hash = "sha256-XeGDKRKnvDyl0AWm9Vs/PDeIfAq/FL9AsjLt+dNg1HQ=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-o8cDoBe6A0wBjVLjp4JXrv3QsG7TZ/Kj4+T5lj6WHdY=";
+        hash = "sha256-VlvGZ5qy61zse0mhvrROYwr0C94Zy1Kh4D4dp+sJTN0=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-Lw+qLAAwyoDBKDPOBA9HR79gcnqwTshFq6GMpFS0tXA=";
+        hash = "sha256-NcmV+DPI5hfNdBUgoaOLsjG32QfjF+x7f01B6PR10Vc=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-R5UwgpXgb32mEohTzyRVXmumcgPl8UPan3UjmLFLxLo=";
+        hash = "sha256-ogLOZZ9pTXB01TqdnmdORIzZ8GbGzskUzbG4E68gZwY=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-SUbpzd8RIf+e+so/dXZh5OkjCvWRC+EyqgeIg4u32Hg=";
+        hash = "sha256-Qxh9K0u99xfsVPJyAD3bFeZPxBXg2EeDyM+rbF80EC8=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-IvrCjiZ5Oa616+U8C2ihg8THj7ePV2A8+82wUWqWoPY=";
+        hash = "sha256-U99FiR3IUL8saGtVrWblWqsCIJc0rK5ZMII9/BL5H7w=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-m43SijSBxcAvYAlSFpQKIFILUm4AgSQ5F4XyQJyftts=";
+        hash = "sha256-7fPlb4x116HIXEJr1G7wVHriOQu6/2u69SpbU9qxHNw=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-ra0El4Y7SqanY6ZBbHE1Y+pqel4OD7nXKKfg/vndULo=";
+        hash = "sha256-iMw61dXtThXvz2GnZiM4+tURMRfXhrN/ze1RTBL6zy8=";
       };
     };
     aarch64-darwin = x86_64-darwin;
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 7ae6a8a11abe0..d6118db16f3c5 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -1,12 +1,12 @@
 { callPackage }: builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; })) {
   signal-desktop = {
     dir = "Signal";
-    version = "6.32.0";
-    hash = "sha256-FZ2wG3nkgIndeoUfXag/9jftXGDSY/MNpT8mqSZpJzA=";
+    version = "6.34.1";
+    hash = "sha256-1kffRXPQmtxIsLZVOgPXDnxUmY59q+1umy25cditRhw=";
   };
   signal-desktop-beta = {
     dir = "Signal Beta";
-    version = "6.33.0-beta.1";
-    hash = "sha256-FLCZvRYUysiE8BLMJVnn0hOkA3km0z383AjN6JvOyWI=";
+    version = "6.35.0-beta.2";
+    hash = "sha256-TgzqKGt3ojkjq+mIu0EtqXfnnZ/xulWjiuS5/0dlwIM=";
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
index 157df8ca9a651..2307c4db01e30 100644
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -19,18 +19,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "teams-for-linux";
-  version = "1.3.13";
+  version = "1.3.14";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-WF2jWP6utopAMZPP/ZWOhqVGZJmACwHyLLE+HQaHJjg=";
+    hash = "sha256-2H7j8e2wPMd4cHXDKxSmyC2Ng/B3jb3/tGVTpUOU3XM=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-vgjPGO5qa4IYfW1svClJ+wP/KtIFFd3P02T2sht69C8=";
+    hash = "sha256-zB6H14VAf13pAHQmsWC51d/qqyfRmAEbltyLD5ucG4Y=";
   };
 
   nativeBuildInputs = [ yarn fixup_yarn_lock nodejs copyDesktopItems makeWrapper ];
diff --git a/pkgs/applications/networking/opsdroid/default.nix b/pkgs/applications/networking/opsdroid/default.nix
index 4398c771e535e..d4f2a9b26a185 100644
--- a/pkgs/applications/networking/opsdroid/default.nix
+++ b/pkgs/applications/networking/opsdroid/default.nix
@@ -17,7 +17,7 @@ python3Packages.buildPythonPackage rec {
   doCheck = false;
 
   propagatedBuildInputs = with python3Packages; [
-    click babel opsdroid_get_image_size slackclient webexteamssdk bleach
+    click babel opsdroid-get-image-size slackclient webexteamssdk bleach
     parse emoji puremagic yamale nbformat websockets pycron nbconvert
     aiohttp matrix-api-async aioredis aiosqlite arrow pyyaml motor regex
     mattermostdriver setuptools voluptuous ibm-watson tailer multidict
diff --git a/pkgs/applications/networking/p2p/tremotesf/default.nix b/pkgs/applications/networking/p2p/tremotesf/default.nix
index 6880d8472167d..4cd7358d2b77c 100644
--- a/pkgs/applications/networking/p2p/tremotesf/default.nix
+++ b/pkgs/applications/networking/p2p/tremotesf/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tremotesf";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "equeim";
     repo = "tremotesf2";
     rev = finalAttrs.version;
-    hash = "sha256-TKtBgMpCWIUl1bohAKCbTcZX2uaPmzeWut/OeNs/rME=";
+    hash = "sha256-mxk2BRUuet3XSNaKt2Dnnxe5dliazd1ArRSnKyoAp1s=";
     # We need this for src/libtremotesf
     fetchSubmodules = true;
   };
diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index 2e6dd8fa7fde5..cad0829b9c2bb 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -41,6 +41,10 @@ buildGoModule rec {
         ${rcloneBin}/bin/rclone genautocomplete $shell rclone.$shell
         installShellCompletion rclone.$shell
       done
+
+      # filesystem helpers
+      ln -s $out/bin/rclone $out/bin/rclonefs
+      ln -s $out/bin/rclone $out/bin/mount.rclone
     '' + lib.optionalString (enableCmount && !stdenv.isDarwin)
       # use --suffix here to ensure we don't shadow /run/wrappers/bin/fusermount,
       # as the setuid wrapper is required as non-root on NixOS.
diff --git a/pkgs/applications/networking/sync/storj-uplink/default.nix b/pkgs/applications/networking/sync/storj-uplink/default.nix
index f8b381b4384e2..f1cf8489c8086 100644
--- a/pkgs/applications/networking/sync/storj-uplink/default.nix
+++ b/pkgs/applications/networking/sync/storj-uplink/default.nix
@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.89.2";
+  version = "1.90.1";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-tbzdfKA3ojwTvJ+t7jLLy3iKQ/x/0lXDcb2w1XcyEhs=";
+    hash = "sha256-LJtNsemNbN+TLyUxSgB/wftKxOfI/y/t+qv1TjcsXzQ=";
   };
 
   subPackages = [ "cmd/uplink" ];
 
-  vendorHash = "sha256-AME5EM2j7PQ/DodK+3BiVepTRbwMqqItQbmCJ2lrGM8=";
+  vendorHash = "sha256-R713WhFrWT7Cgstk3SLuvvyk3/ZtT1LOH0qqmFcWzKw=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/applications/office/activitywatch/default.nix b/pkgs/applications/office/activitywatch/default.nix
index 04d58e74dadd9..4187da1bfabb2 100644
--- a/pkgs/applications/office/activitywatch/default.nix
+++ b/pkgs/applications/office/activitywatch/default.nix
@@ -5,6 +5,7 @@
 , pkg-config
 , perl
 , openssl
+, rust-jemalloc-sys
 , python3
 , wrapQtAppsHook
 , qtbase
@@ -173,6 +174,7 @@ rec {
 
     buildInputs = [
       openssl
+      rust-jemalloc-sys
     ];
 
     postFixup = ''
diff --git a/pkgs/applications/science/biology/bioawk/default.nix b/pkgs/applications/science/biology/bioawk/default.nix
new file mode 100644
index 0000000000000..cfbb1a551facb
--- /dev/null
+++ b/pkgs/applications/science/biology/bioawk/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, installShellFiles
+, bison
+, zlib
+}:
+
+stdenv.mkDerivation {
+  pname = "bioawk";
+  version = "unstable-2017-09-11";
+
+  src = fetchFromGitHub {
+    owner = "lh3";
+    repo = "bioawk";
+    rev = "fd40150b7c557da45e781a999d372abbc634cc21";
+    hash = "sha256-WWgz96DPP83J45isWkMbgEvOlibq6WefK//ImV6+AU0=";
+  };
+
+  nativeBuildInputs = [
+    bison
+    installShellFiles
+  ];
+
+  buildInputs = [
+    zlib
+  ];
+
+  buildFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 bioawk -t $out/bin
+    mv awk.1 bioawk.1
+    installManPage bioawk.1
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "BWK awk modified for biological data";
+    homepage = "https://github.com/lh3/bioawk";
+    license = licenses.hpnd;
+    maintainers = with maintainers; [ natsukium ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/applications/science/biology/bowtie2/default.nix b/pkgs/applications/science/biology/bowtie2/default.nix
index e5c9c28642251..356e90555f8d8 100644
--- a/pkgs/applications/science/biology/bowtie2/default.nix
+++ b/pkgs/applications/science/biology/bowtie2/default.nix
@@ -1,26 +1,62 @@
-{ lib, stdenv, fetchFromGitHub, cmake, tbb, zlib, python3, perl }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, perl
+, python3
+, tbb
+, zlib
+, runCommand
+, bowtie2
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "bowtie2";
   version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "BenLangmead";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-Bem4SHY/74suZPDbw/rwKMLBn3bRq5ooHbBoVnKuYk0=";
+    repo = "bowtie2";
+    rev = "refs/tags/v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-rWeopeYuCk9ZhJX2SFCcxZWcjXjjTiVRiwkzLQcIgd0=";
   };
 
+  # because of this flag, gcc on aarch64 cannot find the Threads
+  # Could NOT find Threads (missing: Threads_FOUND)
+  # TODO: check with other distros and report upstream
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace "-m64" ""
+  '';
+
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [ tbb zlib python3 perl ];
 
+  cmakeFlags = lib.optional (!stdenv.hostPlatform.isx86) ["-DCMAKE_CXX_FLAGS=-I${finalAttrs.src}/third_party"];
+
+  # ctest fails because of missing dependencies between tests
+  doCheck = false;
+
+  passthru.tests = {
+    ctest = runCommand "${finalAttrs.pname}-test" { } ''
+      mkdir $out
+      ${lib.getExe bowtie2} -x ${finalAttrs.src}/example/index/lambda_virus ${finalAttrs.src}/example/reads/longreads.fq -u 10
+      ${bowtie2}/bin/bowtie2-build-s -c GGGCGGCGACCTCGCGGGTTTTCGCTA $out/small
+      ${bowtie2}/bin/bowtie2-inspect-s $out/small
+      ${bowtie2}/bin/bowtie2-build-l -c GGGCGGCGACCTCGCGGGTTTTCGCTA $out/large
+      ${bowtie2}/bin/bowtie2-inspect-l $out/large
+    '';
+  };
+
   meta = with lib; {
     description = "An ultrafast and memory-efficient tool for aligning sequencing reads to long reference sequences";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
     homepage = "http://bowtie-bio.sf.net/bowtie2";
+    changelog = "https://github.com/BenLangmead/bowtie2/releases/tag/${finalAttrs.src.rev}";
     maintainers = with maintainers; [ rybern ];
     platforms = platforms.all;
-    broken = stdenv.isAarch64; # only x86 is supported
+    mainProgram = "bowtie2";
   };
-}
+})
diff --git a/pkgs/applications/science/biology/poretools/default.nix b/pkgs/applications/science/biology/poretools/default.nix
index efbedf9a121a0..efbedf9a121a0 100755..100644
--- a/pkgs/applications/science/biology/poretools/default.nix
+++ b/pkgs/applications/science/biology/poretools/default.nix
diff --git a/pkgs/applications/science/biology/trimal/default.nix b/pkgs/applications/science/biology/trimal/default.nix
index b27a63a2135ae..b27a63a2135ae 100755..100644
--- a/pkgs/applications/science/biology/trimal/default.nix
+++ b/pkgs/applications/science/biology/trimal/default.nix
diff --git a/pkgs/applications/science/biology/vcftools/default.nix b/pkgs/applications/science/biology/vcftools/default.nix
index a4ec84d4d5060..a4ec84d4d5060 100755..100644
--- a/pkgs/applications/science/biology/vcftools/default.nix
+++ b/pkgs/applications/science/biology/vcftools/default.nix
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index 6dc630181be2b..6b2598efc3dc8 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -57,7 +57,7 @@
 
 stdenv.mkDerivation rec {
   pname = "root";
-  version = "6.28.06";
+  version = "6.28.08";
 
   passthru = {
     tests = import ./tests { inherit callPackage; };
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    hash = "sha256-rztnO5rKOTpcmuG/huqyZyqvGEG2WMXG56MKuTxYZTM=";
+    hash = "sha256-o+ZLTAH4fNm75X5h75a0FibkmwRGCVBw1B2b+6NSaGI=";
   };
 
   nativeBuildInputs = [ makeWrapper cmake pkg-config git ];
diff --git a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
index cb1dbc15b3367..2ca47d812bbfe 100644
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@@ -20,11 +20,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "gromacs";
-  version = "2023.2";
+  version = "2023.3";
 
   src = fetchurl {
     url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-${version}.tar.gz";
-    sha256 = "sha256-vOFIByfksruQBBO3XZmjJm81B4d9pPWy1JHfeY+fza4=";
+    sha256 = "sha256-Tsj40MevdrE/j9FtuOLBIOdJ3kOa6VVNn2U/gS140cs=";
   };
 
   patches = [ ./pkgconfig.patch ];
diff --git a/pkgs/applications/version-management/git-mit/default.nix b/pkgs/applications/version-management/git-mit/default.nix
index ebfae6fa356e7..f53f021a80c0e 100644
--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "5.12.161";
+  version = "5.12.162";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-r0gRBOf/CC4HDh/N4Qi1/3DkPuuNlqfbvl4o5JqobKE=";
+    hash = "sha256-qwnzq1CKo7kJXITpPjKAhk1dbGSj6TXat7ioP7o3ifg=";
   };
 
-  cargoHash = "sha256-LgiO/wPoPjmxymcXl9zQ8n/xOnFfpravwpqEsUctxxw=";
+  cargoHash = "sha256-AGE+zA5DHabqgzCC/T1DDG9bGPciSdl1euZbbCeKPzQ=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/version-management/stgit/default.nix b/pkgs/applications/version-management/stgit/default.nix
index 12450fc440d82..196cdea93dbab 100644
--- a/pkgs/applications/version-management/stgit/default.nix
+++ b/pkgs/applications/version-management/stgit/default.nix
@@ -18,15 +18,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stgit";
-  version = "2.3.2";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "stacked-git";
     repo = "stgit";
     rev = "v${version}";
-    hash = "sha256-rQNX54zmVHZKplEUNaKyVtCrC8Q4DdxLzNSStiYvDGA=";
+    hash = "sha256-+ipNSdEaz3nVBTYS+A4Fauan0DaKZR69No95FTS2/4o=";
   };
-  cargoHash = "sha256-ju8JQnohidBsydwwm6gNx1L24brmDWYXwNgfCl7G/aA=";
+  cargoHash = "sha256-G0g+53HWxhJfozMGByhmgnxws6P10FY9fAOleqhn+Mk=";
 
   nativeBuildInputs = [
     pkg-config installShellFiles makeWrapper asciidoc xmlto docbook_xsl
diff --git a/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix b/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
index 1e8e2ae2f4d46..61e5147be3601 100644
--- a/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
+++ b/pkgs/applications/video/kodi/addons/inputstream-adaptive/default.nix
@@ -10,13 +10,13 @@ in
 buildKodiBinaryAddon rec {
   pname = "inputstream-adaptive";
   namespace = "inputstream.adaptive";
-  version = "20.3.9";
+  version = "20.3.13";
 
   src = fetchFromGitHub {
     owner = "xbmc";
     repo = "inputstream.adaptive";
     rev = "${version}-${rel}";
-    sha256 = "sha256-Z5p/lw7qg6aacJ0eSqswaiwTOsUmuDbNlRRs51LdjRw=";
+    sha256 = "sha256-xvU+DcVEaQ/1sm6o21/6N1znCtzrct0qDhMxXGFZjL4=";
   };
 
   extraCMakeFlags = [
diff --git a/pkgs/applications/video/kodi/addons/netflix/default.nix b/pkgs/applications/video/kodi/addons/netflix/default.nix
index ab034c13755e0..3352ae4c63d30 100644
--- a/pkgs/applications/video/kodi/addons/netflix/default.nix
+++ b/pkgs/applications/video/kodi/addons/netflix/default.nix
@@ -3,13 +3,13 @@
 buildKodiAddon rec {
   pname = "netflix";
   namespace = "plugin.video.netflix";
-  version = "1.20.2";
+  version = "1.22.3";
 
   src = fetchFromGitHub {
     owner = "CastagnaIT";
     repo = namespace;
     rev = "v${version}";
-    sha256 = "sha256-k2O8a0P+TzQVoFQJkzmdqmkKh3Aj7OlsnuhJfUwxOmI=";
+    sha256 = "sha256-8NGj8n1p8euqYYdPDSeFh2ZE9lly5ThSmg69yXY3Te8=";
   };
 
   propagatedBuildInputs = [
@@ -24,6 +24,6 @@ buildKodiAddon rec {
     homepage = "https://github.com/CastagnaIT/plugin.video.netflix";
     description = "Netflix VOD Services Add-on";
     license = licenses.mit;
-    maintainers = teams.kodi.members;
+    maintainers = teams.kodi.members ++ [ maintainers.pks ];
   };
 }
diff --git a/pkgs/applications/video/kodi/addons/youtube/default.nix b/pkgs/applications/video/kodi/addons/youtube/default.nix
index bdc4be3a23faa..3d3683ed87760 100644
--- a/pkgs/applications/video/kodi/addons/youtube/default.nix
+++ b/pkgs/applications/video/kodi/addons/youtube/default.nix
@@ -1,13 +1,15 @@
-{ lib, buildKodiAddon, fetchzip, addonUpdateScript, six, requests, infotagger, inputstreamhelper }:
+{ lib, buildKodiAddon, fetchFromGitHub, six, requests, infotagger, inputstreamhelper }:
 
 buildKodiAddon rec {
   pname = "youtube";
   namespace = "plugin.video.youtube";
-  version = "7.0.1";
+  version = "7.0.2.2";
 
-  src = fetchzip {
-    url = "https://mirrors.kodi.tv/addons/nexus/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-Wdju7d2kFX0V1J1TB75qEVq0UWN2xYYFNlD8UTt1New=";
+  src = fetchFromGitHub {
+    owner = "anxdpanic";
+    repo = "plugin.video.youtube";
+    rev = "v${version}";
+    hash = "sha256-BUeE/8oQYBiq4XgIp4nv0hjEQz3nnkDWCnAf4kpptwk=";
   };
 
   propagatedBuildInputs = [
@@ -19,9 +21,6 @@ buildKodiAddon rec {
 
   passthru = {
     pythonPath = "resources/lib";
-    updateScript = addonUpdateScript {
-      attrPath = "kodi.packages.youtube";
-    };
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/virtualization/vmware-workstation/default.nix b/pkgs/applications/virtualization/vmware-workstation/default.nix
index 8fe79b6e237cb..8fe79b6e237cb 100755..100644
--- a/pkgs/applications/virtualization/vmware-workstation/default.nix
+++ b/pkgs/applications/virtualization/vmware-workstation/default.nix
diff --git a/pkgs/applications/window-managers/cwm/default.nix b/pkgs/applications/window-managers/cwm/default.nix
index d46811290a2c3..94b75af3ea5c5 100644
--- a/pkgs/applications/window-managers/cwm/default.nix
+++ b/pkgs/applications/window-managers/cwm/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
 
   pname = "cwm";
-  version = "7.1";
+  version = "7.4";
 
   src = fetchFromGitHub {
     owner = "leahneukirchen";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lkjsxGMXOrnu4cUiV/TO7yzd9FzM297MhaFKauqmiHo=";
+    sha256 = "sha256-L3u4mH2UH2pTHhSPVr5dUi94b9DheslkIWL6EgQ05yA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/build-support/fetchdocker/credentials.nix b/pkgs/build-support/fetchdocker/credentials.nix
index da19848326840..f8a229ccb6bb1 100644
--- a/pkgs/build-support/fetchdocker/credentials.nix
+++ b/pkgs/build-support/fetchdocker/credentials.nix
@@ -1,3 +1,4 @@
+{ lib }:
 # We provide three paths to get the credentials into the builder's
 # environment:
 #
diff --git a/pkgs/build-support/fetchdocker/generic-fetcher.nix b/pkgs/build-support/fetchdocker/generic-fetcher.nix
index 6a7b977db29f8..95b193490a82d 100644
--- a/pkgs/build-support/fetchdocker/generic-fetcher.nix
+++ b/pkgs/build-support/fetchdocker/generic-fetcher.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, haskellPackages, writeText, gawk }:
 let
   awk                   = "${gawk}/bin/awk";
-  dockerCredentialsFile = import ./credentials.nix;
+  dockerCredentialsFile = import ./credentials.nix { inherit lib; };
 in
 { fetcher
 , name
diff --git a/pkgs/build-support/kernel/make-initrd-ng/src/main.rs b/pkgs/build-support/kernel/make-initrd-ng/src/main.rs
index 53096a842329c..daa688976c6c8 100644
--- a/pkgs/build-support/kernel/make-initrd-ng/src/main.rs
+++ b/pkgs/build-support/kernel/make-initrd-ng/src/main.rs
@@ -195,7 +195,7 @@ fn handle_path(
                         .wrap_err_with(|| format!("failed to resolve symlink of {:?}", source))?;
 
                     // Create the link, then push its target to the queue
-                    if !target.exists() {
+                    if !target.exists() && !target.is_symlink() {
                         unix::fs::symlink(&link_target, &target).wrap_err_with(|| {
                             format!("failed to symlink {:?} to {:?}", link_target, target)
                         })?;
diff --git a/pkgs/by-name/al/alpine-make-rootfs/package.nix b/pkgs/by-name/al/alpine-make-rootfs/package.nix
new file mode 100644
index 0000000000000..1fcfc23710a5a
--- /dev/null
+++ b/pkgs/by-name/al/alpine-make-rootfs/package.nix
@@ -0,0 +1,33 @@
+{ stdenvNoCC, lib, fetchFromGitHub, makeWrapper, apk-tools, coreutils, findutils, gnugrep, gnused, gnutar, gzip, rsync, util-linux, wget
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "alpine-make-rootfs";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "alpinelinux";
+    repo = "alpine-make-rootfs";
+    rev = "v${version}";
+    hash = "sha256-B5qYQ6ah4hFZfb3S5vwgevh7aEHI3YGLoA+IyipaDck=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontBuild = true;
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  postInstall = ''
+    wrapProgram $out/bin/alpine-make-rootfs --set PATH ${lib.makeBinPath [
+      apk-tools coreutils findutils gnugrep gnused gnutar gzip rsync util-linux wget
+    ]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/alpinelinux/alpine-make-rootfs";
+    description = "Make customized Alpine Linux rootfs (base image) for containers";
+    mainProgram = "alpine-make-rootfs";
+    maintainers = with maintainers; [ danielsidhion ];
+    license = licenses.mit;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/argagg/default.nix b/pkgs/by-name/ar/argagg/package.nix
index 7ff9eaac1e3e6..bb8507abbe977 100644
--- a/pkgs/development/libraries/argagg/default.nix
+++ b/pkgs/by-name/ar/argagg/package.nix
@@ -4,27 +4,22 @@
 , cmake
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "argagg";
-  version = "0.4.6";
+  version = "0.4.7";
 
   src = fetchFromGitHub {
     owner = "vietjtnguyen";
-    repo = pname;
-    rev = version;
-    hash = "sha256-MCtlAPfwdJpgfS8IH+zlcgaaxZ5AsP4hJvbZAFtOa4o=";
+    repo = "argagg";
+    rev = finalAttrs.version;
+    hash = "sha256-G0PzoKpUyb1MaziLvHgasq98jPODUu4EgPzywRjuIN8=";
   };
 
-  patches = [
-    # Fix compilation of macro catch statement
-    ./0001-catch.diff
-  ];
-
   nativeBuildInputs = [
     cmake
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/vietjtnguyen/argagg";
     description = "Argument Aggregator";
     longDescription = ''
@@ -38,9 +33,9 @@ stdenv.mkDerivation rec {
       types until you access them, so the result structures end up just being
       pointers into the original command line argument C-strings.
     '';
-    license = licenses.mit;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = with platforms; all;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.all;
     badPlatforms = [ "aarch64-darwin" ];
   };
-}
+})
diff --git a/pkgs/development/libraries/argtable/default.nix b/pkgs/by-name/ar/argtable/package.nix
index 9752b9600397c..18206202691c7 100644
--- a/pkgs/development/libraries/argtable/default.nix
+++ b/pkgs/by-name/ar/argtable/package.nix
@@ -4,29 +4,29 @@
 , cmake
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "argtable";
-  version = "3.2.1";
-  srcVersion = "v${version}.52f24e5";
+  version = "3.2.2";
+  srcVersion = "v${finalAttrs.version}.f25c624";
 
   src = fetchFromGitHub {
     owner = "argtable";
     repo = "argtable3";
-    rev = srcVersion;
-    hash = "sha256-HFsk91uJXQ0wpvAQxP4/yZwRQx9kLH7KgB3Y/+zcZC0=";
+    rev = finalAttrs.srcVersion;
+    hash = "sha256-X89xFLDs6NEgjzzwy8kplvTgukQd/CV3Xa9A3JXecf4=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=ON"
+    (lib.cmakeBool "BUILD_SHARED_LIBS" true)
   ];
 
   postPatch = ''
     patchShebangs tools/build
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/argtable/argtable3";
     description = "A single-file, ANSI C command-line parsing library";
     longDescription = ''
@@ -37,11 +37,11 @@ stdenv.mkDerivation rec {
       handling logic and textual descriptions of the command line syntax, which
       are essential but tedious to implement for a robust CLI program.
     '';
-    license = with licenses; bsd3;
-    maintainers = with maintainers; [ AndersonTorres artuuge ];
-    platforms = with platforms; all;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ AndersonTorres artuuge ];
+    platforms = lib.platforms.all;
   };
-}
+})
 # TODO: a NixOS test suite
 # TODO: multiple outputs
 # TODO: documentation
diff --git a/pkgs/by-name/ba/bashly/Gemfile b/pkgs/by-name/ba/bashly/Gemfile
new file mode 100644
index 0000000000000..b5d29f5f4c593
--- /dev/null
+++ b/pkgs/by-name/ba/bashly/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'bashly'
diff --git a/pkgs/by-name/ba/bashly/Gemfile.lock b/pkgs/by-name/ba/bashly/Gemfile.lock
new file mode 100644
index 0000000000000..0021014b37284
--- /dev/null
+++ b/pkgs/by-name/ba/bashly/Gemfile.lock
@@ -0,0 +1,59 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    bashly (1.1.1)
+      colsole (>= 0.8.1, < 2)
+      completely (~> 0.6.1)
+      filewatcher (~> 2.0)
+      gtx (~> 0.1)
+      lp (~> 0.2)
+      mister_bin (~> 0.7)
+      psych (>= 3.3.2, < 7)
+      tty-markdown (~> 0.7)
+    colsole (1.0.0)
+    completely (0.6.1)
+      colsole (>= 0.8.1, < 2)
+      mister_bin (~> 0.7)
+    docopt_ng (0.7.1)
+    filewatcher (2.1.0)
+      module_methods (~> 0.1.0)
+    gtx (0.1.0)
+    kramdown (2.4.0)
+      rexml
+    lp (0.2.1)
+    mister_bin (0.7.6)
+      colsole (>= 0.8.1, < 2)
+      docopt_ng (~> 0.7, >= 0.7.1)
+    module_methods (0.1.0)
+    pastel (0.8.0)
+      tty-color (~> 0.5)
+    psych (5.1.1.1)
+      stringio
+    rexml (3.2.6)
+    rouge (4.1.3)
+    stringio (3.0.8)
+    strings (0.2.1)
+      strings-ansi (~> 0.2)
+      unicode-display_width (>= 1.5, < 3.0)
+      unicode_utils (~> 1.4)
+    strings-ansi (0.2.0)
+    tty-color (0.6.0)
+    tty-markdown (0.7.2)
+      kramdown (>= 1.16.2, < 3.0)
+      pastel (~> 0.8)
+      rouge (>= 3.14, < 5.0)
+      strings (~> 0.2.0)
+      tty-color (~> 0.5)
+      tty-screen (~> 0.8)
+    tty-screen (0.8.1)
+    unicode-display_width (2.5.0)
+    unicode_utils (1.4.0)
+
+PLATFORMS
+  x86_64-linux
+
+DEPENDENCIES
+  bashly
+
+BUNDLED WITH
+   2.3.26
diff --git a/pkgs/by-name/ba/bashly/gemset.nix b/pkgs/by-name/ba/bashly/gemset.nix
new file mode 100644
index 0000000000000..e24c0b3483d76
--- /dev/null
+++ b/pkgs/by-name/ba/bashly/gemset.nix
@@ -0,0 +1,231 @@
+{
+  bashly = {
+    dependencies = ["colsole" "completely" "filewatcher" "gtx" "lp" "mister_bin" "psych" "tty-markdown"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1rhzbpv8j5qcm5a84m4vzrryb0j8z90q6djbpid4ay2fr492kvkq";
+      type = "gem";
+    };
+    version = "1.1.1";
+  };
+  colsole = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fvf6dz2wsvjk7q24z0dm8lajq3p2l6i5ywf3mxj683rmhwq49bg";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  completely = {
+    dependencies = ["colsole" "mister_bin"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01nk1cigb09z6rjy41qrhqf58cgpqm43xwjdkz33mfmwrnz04cw1";
+      type = "gem";
+    };
+    version = "0.6.1";
+  };
+  docopt_ng = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rsnl5s7k2s1gl4n4dg68ssg577kf11sl4a4l2lb2fpswj718950";
+      type = "gem";
+    };
+    version = "0.7.1";
+  };
+  filewatcher = {
+    dependencies = ["module_methods"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03f9v57c5zag09mi10yjhdx7y0vv2w5wrnwzbij9hhkwh43rk077";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  gtx = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "10hfhicvv371gy1i16x6vry1xglvxl0zh7qr6f14pqsx32qih6ff";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
+  kramdown = {
+    dependencies = ["rexml"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ic14hdcqxn821dvzki99zhmcy130yhv5fqfffkcf87asv5mnbmn";
+      type = "gem";
+    };
+    version = "2.4.0";
+  };
+  lp = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ns1aza32n929w7smg1dsn4g6qlfi7k1jrvssyn35cicmwn0gyyr";
+      type = "gem";
+    };
+    version = "0.2.1";
+  };
+  mister_bin = {
+    dependencies = ["colsole" "docopt_ng"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xx8cxvzcn47zsnshcllf477x4rbssrchvp76929qnsg5k9q7fas";
+      type = "gem";
+    };
+    version = "0.7.6";
+  };
+  module_methods = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1886wjscfripgzlmyvcd0jmlzwr6hxvklm2a5rm32dw5bf7bvjki";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
+  pastel = {
+    dependencies = ["tty-color"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xash2gj08dfjvq4hy6l1z22s5v30fhizwgs10d6nviggpxsj7a8";
+      type = "gem";
+    };
+    version = "0.8.0";
+  };
+  psych = {
+    dependencies = ["stringio"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0wjzrkssjfjpynij5dpycyflhqbjvi1gc2j73xgq3b196s1d3c24";
+      type = "gem";
+    };
+    version = "5.1.1.1";
+  };
+  rexml = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "05i8518ay14kjbma550mv0jm8a6di8yp5phzrd8rj44z9qnrlrp0";
+      type = "gem";
+    };
+    version = "3.2.6";
+  };
+  rouge = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19drl3x8fw65v3mpy7fk3cf3dfrywz5alv98n2rm4pp04vdn71lw";
+      type = "gem";
+    };
+    version = "4.1.3";
+  };
+  stringio = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ix96dxbjqlpymdigb4diwrifr0bq7qhsrng95fkkp18av326nqk";
+      type = "gem";
+    };
+    version = "3.0.8";
+  };
+  strings = {
+    dependencies = ["strings-ansi" "unicode-display_width" "unicode_utils"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1yynb0qhhhplmpzavfrrlwdnd1rh7rkwzcs4xf0mpy2wr6rr6clk";
+      type = "gem";
+    };
+    version = "0.2.1";
+  };
+  strings-ansi = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "120wa6yjc63b84lprglc52f40hx3fx920n4dmv14rad41rv2s9lh";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  tty-color = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0aik4kmhwwrmkysha7qibi2nyzb4c8kp42bd5vxnf8sf7b53g73g";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
+  tty-markdown = {
+    dependencies = ["kramdown" "pastel" "rouge" "strings" "tty-color" "tty-screen"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "04f599zn5rfndq4d9l0acllfpc041bzdkkz2h6x0dl18f2wivn0y";
+      type = "gem";
+    };
+    version = "0.7.2";
+  };
+  tty-screen = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "18jr6s1cg8yb26wzkqa6874q0z93rq0y5aw092kdqazk71y6a235";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
+  unicode-display_width = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1d0azx233nags5jx3fqyr23qa2rhgzbhv8pxp46dgbg1mpf82xky";
+      type = "gem";
+    };
+    version = "2.5.0";
+  };
+  unicode_utils = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0h1a5yvrxzlf0lxxa1ya31jcizslf774arnsd89vgdhk4g7x08mr";
+      type = "gem";
+    };
+    version = "1.4.0";
+  };
+}
diff --git a/pkgs/by-name/ba/bashly/package.nix b/pkgs/by-name/ba/bashly/package.nix
new file mode 100644
index 0000000000000..5a3d6661caa2d
--- /dev/null
+++ b/pkgs/by-name/ba/bashly/package.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenvNoCC
+, bundlerApp
+}:
+
+let
+  bashlyBundlerApp = bundlerApp {
+    pname = "bashly";
+    gemdir = ./.;
+    exes = [ "bashly" ];
+  };
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  name = "bashly";
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out;
+    cd $out;
+
+    mkdir bin; pushd bin;
+    ln -vs ${bashlyBundlerApp}/bin/bashly;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Bash command line framework and CLI generator";
+    homepage = "https://github.com/DannyBen/bashly";
+    license = lib.licenses.mit;
+    mainProgram = "bashly";
+    maintainers = with lib.maintainers; [ drupol ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index e7181d59afaff..804446d6fe7a6 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.14.2";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-eST70KMdGgbTo4FNL3K5YGn9lwIGroG4y4ExKDb30hU=";
+    hash = "sha256-52vBN/EdO0R2Lt/Iv33Odl437I8kgUhxXwtUuiaAcAU=";
   };
 
-  cargoHash = "sha256-h5ooNR0IeXWyY6PuZM/bQLkX4F0eZsEY2eoIgo0nRFA=";
+  cargoHash = "sha256-j6FsI6FpBXtaNcVDY84UBcqifXuJxBRW5Gdln8pq7Iw=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]
diff --git a/pkgs/by-name/fi/firewalk/package.nix b/pkgs/by-name/fi/firewalk/package.nix
new file mode 100644
index 0000000000000..8909a61062c77
--- /dev/null
+++ b/pkgs/by-name/fi/firewalk/package.nix
@@ -0,0 +1,27 @@
+{ lib
+, stdenv
+, fetchurl
+, libnet
+, libpcap
+, libdnet
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "firewalk";
+  version = "5.0";
+
+  src = fetchurl {
+    url = "https://salsa.debian.org/pkg-security-team/firewalk/-/archive/upstream/${finalAttrs.version}/firewalk-upstream-${finalAttrs.version}.tar.gz";
+    hash = "sha256-f0sHzcH3faeg7epfpWXbgaHrRWaWBKMEqLdy38+svGo=";
+  };
+
+  buildInputs = [ libnet libpcap libdnet ];
+
+  meta = with lib; {
+    description = "Gateway ACL scanner";
+    homepage = "http://packetfactory.openwall.net/projects/firewalk/";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ tochiaha ];
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/fl/flip/package.nix b/pkgs/by-name/fl/flip/package.nix
new file mode 100644
index 0000000000000..f7957c0990b00
--- /dev/null
+++ b/pkgs/by-name/fl/flip/package.nix
@@ -0,0 +1,32 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  cmake
+}:
+
+stdenv.mkDerivation {
+  pname = "flip";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "NVlabs";
+    repo = "flip";
+    rev = "8303adb2060d69423d040453995f4ad1a030a1cc";
+    hash = "sha256-jSB79qOtnW/cjApIDcLRqGabnzCIwS7saA+aF1TcyV0=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "A tool for visualizing and communicating the errors in rendered images.";
+    license = licenses.bsd3;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ zmitchell ];
+    mainProgram = "flip";
+  };
+}
diff --git a/pkgs/by-name/fo/fortune-kind/package.nix b/pkgs/by-name/fo/fortune-kind/package.nix
index 54d1ecc33fae9..c3e76a5f0c61a 100644
--- a/pkgs/by-name/fo/fortune-kind/package.nix
+++ b/pkgs/by-name/fo/fortune-kind/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fortune-kind";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "cafkafk";
     repo = "fortune-kind";
     rev = "v${version}";
-    hash = "sha256-xIibKXca3RXQpRJyQ62GL7l24ovX4KXhdk2zK1gB98M=";
+    hash = "sha256-bpQ1cPsgKgOU3stnUwGrMnY9RZGZnuoR6B05LyARtVY=";
   };
 
-  cargoHash = "sha256-7JBT3EhwrcNITR5ocQkLoQw4/R7xAoplZ9I1cTs9DW8=";
+  cargoHash = "sha256-2hL4vbbfvzJk73cvMU+eau+UHDFtokt4v8GBXyNkjbw=";
 
   nativeBuildInputs = [ makeBinaryWrapper installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
diff --git a/pkgs/by-name/ge/geticons/package.nix b/pkgs/by-name/ge/geticons/package.nix
new file mode 100644
index 0000000000000..f3afda0f136df
--- /dev/null
+++ b/pkgs/by-name/ge/geticons/package.nix
@@ -0,0 +1,27 @@
+{ lib
+, rustPlatform
+, fetchFromSourcehut
+, gitUpdater
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "geticons";
+  version = "1.2.2";
+
+  src = fetchFromSourcehut {
+    owner = "~zethra";
+    repo = pname;
+    rev = version;
+    hash = "sha256-HEnUfOLeRTi2dRRqjDPVwVVHo/GN9wE28x5qv3qOpCY=";
+  };
+
+  cargoHash = "sha256-Znwni7uMnG9cpZbztUMY1j73K+XrDLv5zyNEZDoxWg4=";
+  passthru.updateScript = gitUpdater { };
+
+  meta = with lib; {
+    description = "CLI utility to get icons for apps on your system or other generic icons by name";
+    homepage = "https://git.sr.ht/~zethra/geticons";
+    license = with licenses; [ gpl3Plus ];
+    maintainers = with maintainers; [ Madouura ];
+  };
+}
diff --git a/pkgs/by-name/hi/hifile/package.nix b/pkgs/by-name/hi/hifile/package.nix
new file mode 100644
index 0000000000000..bf2bda5100dcd
--- /dev/null
+++ b/pkgs/by-name/hi/hifile/package.nix
@@ -0,0 +1,41 @@
+{ lib, appimageTools, fetchurl }:
+
+let
+  version = "0.9.9.5";
+  pname = "hifile";
+
+  src = fetchurl {
+    url = "https://www.hifile.app/files/HiFile-${version}.AppImage";
+    hash = "sha256-Ks/NLPm5loo9q8pT0LdtfcrC38203beNE74sbEpyuJM=";
+  };
+
+  appimageContents = appimageTools.extractType2 {
+    inherit pname version src;
+  };
+
+in
+appimageTools.wrapType2 rec {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
+
+    install -m 444 -D ${appimageContents}/HiFile.desktop $out/share/applications/HiFile.desktop
+    install -m 444 -D ${appimageContents}/HiFile.png $out/share/icons/hicolor/512x512/apps/HiFile.png
+    substituteInPlace $out/share/applications/HiFile.desktop \
+      --replace 'Exec=HiFile' 'Exec=${pname}'
+  '';
+
+  meta = with lib; {
+    description = "Dual-pane graphical file manager for Windows, macOS and Linux";
+    longDescription = ''
+      HiFile is the next evolution of file managers. Its mission is to increase your productivity whenever you work with files or folders. It aims to be better in every way - more convenient, more versatile, more efficient, more elegant, more customizable, and more fun.
+    '';
+    homepage = "https://www.hifile.app/";
+    downloadPage = "https://www.hifile.app/download";
+    license = licenses.unfree;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ ymstnt ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/by-name/ji/jitterentropy-rngd/package.nix b/pkgs/by-name/ji/jitterentropy-rngd/package.nix
new file mode 100644
index 0000000000000..feb7d1e2fb126
--- /dev/null
+++ b/pkgs/by-name/ji/jitterentropy-rngd/package.nix
@@ -0,0 +1,34 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "jitterentropy-rngd";
+  version = "1.2.8";
+
+  src = fetchFromGitHub {
+    owner = "smuellerDD";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-LDym636ss3B1G/vrqatu9g5vbVEeDX0JQcxZ/IxGeY0=";
+  };
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    make install DESTDIR= PREFIX=$out UNITDIR=$out/lib/systemd/system
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = ''A random number generator, which injects entropy to the kernel'';
+    homepage = "https://github.com/smuellerDD/jitterentropy-rngd";
+    changelog = "https://github.com/smuellerDD/jitterentropy-rngd/releases/tag/v${version}";
+    license = [ licenses.gpl2Only licenses.bsd3 ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ thillux ];
+    mainProgram = "jitterentropy-rngd";
+  };
+}
diff --git a/pkgs/by-name/km/kmsvnc/package.nix b/pkgs/by-name/km/kmsvnc/package.nix
new file mode 100644
index 0000000000000..000dc8115b2b6
--- /dev/null
+++ b/pkgs/by-name/km/kmsvnc/package.nix
@@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, libdrm
+, libvncserver
+, libxkbcommon
+, libva
+}:
+
+stdenv.mkDerivation rec {
+  pname = "kmsvnc";
+  version = "0.0.5";
+
+  src = fetchFromGitHub {
+    owner = "isjerryxiao";
+    repo = "kmsvnc";
+    rev = "v${version}";
+    hash = "sha256-Dz1y4t8u9/rnmOiYMWMq6aEq3kV47uiIK7K4DSvjZNc=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    libdrm
+    libvncserver
+    libxkbcommon
+    libva
+  ];
+
+  meta = with lib; {
+    description = "A VNC server for DRM/KMS capable GNU/Linux devices";
+    homepage = "https://github.com/isjerryxiao/kmsvnc";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nickcao ];
+    mainProgram = "kmsvnc";
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/ko/kokkos/package.nix b/pkgs/by-name/ko/kokkos/package.nix
new file mode 100644
index 0000000000000..b6578f4a020f7
--- /dev/null
+++ b/pkgs/by-name/ko/kokkos/package.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, gitUpdater
+, cmake
+, python3
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kokkos";
+  version = "4.1.00";
+
+  src = fetchFromGitHub {
+    owner = "kokkos";
+    repo = "kokkos";
+    rev = finalAttrs.version;
+    hash = "sha256-bPgXn1Lv+EiiKEHgTVhRFhcELUnZCphaXDlrTYq6cpY=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    python3
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "Kokkos_ENABLE_TESTS" true)
+  ];
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  doCheck = true;
+  passthru.updateScript = gitUpdater { };
+
+  meta = with lib; {
+    description = "C++ Performance Portability Programming EcoSystem";
+    homepage = "https://github.com/kokkos/kokkos";
+    license = with licenses; [ asl20-llvm ];
+    maintainers = with maintainers; [ Madouura ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin;
+  };
+})
diff --git a/pkgs/by-name/ko/konbucase/package.nix b/pkgs/by-name/ko/konbucase/package.nix
new file mode 100644
index 0000000000000..75876d990661e
--- /dev/null
+++ b/pkgs/by-name/ko/konbucase/package.nix
@@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, vala
+, pkg-config
+, wrapGAppsHook
+, pantheon
+, gtksourceview5
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "konbucase";
+  version = "4.1.1";
+
+  src = fetchFromGitHub {
+    owner = "ryonakano";
+    repo = "konbucase";
+    rev = finalAttrs.version;
+    hash = "sha256-g3EDa9EXymi6c8dRHFZYGEAT7k8M2TXUAzZVKTnLzyk=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    vala
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    pantheon.granite7
+    gtksourceview5
+  ];
+
+  postInstall = ''
+    mv $out/bin/com.github.ryonakano.konbucase $out/bin/konbucase
+    substituteInPlace $out/share/applications/com.github.ryonakano.konbucase.desktop \
+      --replace 'Exec=com.github.ryonakano.konbucase' 'Exec=${placeholder "out"}/bin/konbucase'
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/ryonakano/konbucase";
+    description = "A case converting app suitable for coding or typing";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ galaxy ];
+    platforms = platforms.linux;
+    mainProgram = "konbucase";
+  };
+})
diff --git a/pkgs/by-name/on/onedriver/package.nix b/pkgs/by-name/on/onedriver/package.nix
new file mode 100644
index 0000000000000..f4087401ea92d
--- /dev/null
+++ b/pkgs/by-name/on/onedriver/package.nix
@@ -0,0 +1,64 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+, pkg-config
+, webkitgtk
+, glib
+, fuse
+, installShellFiles
+}:
+let
+  pname = "onedriver";
+  version = "0.13.0-2";
+
+  src = fetchFromGitHub {
+    owner = "jstaf";
+    repo = "onedriver";
+    rev = "v${version}";
+    hash = "sha256-Bcjgmx9a4pTRhkzR3tbOB6InjvuH71qomv4t+nRNc+w=";
+  };
+in
+buildGoModule {
+  inherit pname version src;
+  vendorHash = "sha256-OOiiKtKb+BiFkoSBUQQfqm4dMfDW3Is+30Kwcdg8LNA=";
+
+  nativeBuildInputs = [ pkg-config installShellFiles ];
+  buildInputs = [ webkitgtk glib fuse ];
+
+  ldflags = [ "-X github.com/jstaf/onedriver/cmd/common.commit=v${version}" ];
+
+  subPackages = [
+    "cmd/onedriver"
+    "cmd/onedriver-launcher"
+  ];
+
+  postInstall = ''
+    echo "Running postInstall"
+    install -Dm644 ./resources/onedriver.svg $out/share/icons/onedriver/onedriver.svg
+    install -Dm644 ./resources/onedriver.png $out/share/icons/onedriver/onedriver.png
+    install -Dm644 ./resources/onedriver-128.png $out/share/icons/onedriver/onedriver-128.png
+
+    install -Dm644 ./resources/onedriver.desktop $out/share/applications/onedriver.desktop
+
+    mkdir -p $out/share/man/man1
+    installManPage ./resources/onedriver.1
+
+    substituteInPlace $out/share/applications/onedriver.desktop \
+      --replace "/usr/bin/onedriver-launcher" "$out/bin/onedriver-launcher" \
+      --replace "/usr/share/icons" "$out/share/icons"
+  '';
+
+  meta = with lib; {
+    description = "A network filesystem for Linux";
+    longDescription = ''
+      onedriver is a network filesystem that gives your computer direct access to your files on Microsoft OneDrive.
+      This is not a sync client. Instead of syncing files, onedriver performs an on-demand download of files when
+      your computer attempts to use them. onedriver allows you to use files on OneDrive as if they were files on
+      your local computer.
+    '';
+    inherit (src.meta) homepage;
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.massimogengarelli ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/pg/pgmoneta/package.nix b/pkgs/by-name/pg/pgmoneta/package.nix
new file mode 100644
index 0000000000000..bbfbb1a64476f
--- /dev/null
+++ b/pkgs/by-name/pg/pgmoneta/package.nix
@@ -0,0 +1,61 @@
+{ lib
+, stdenv
+, bzip2
+, cjson
+, cmake
+, curl
+, docutils
+, fetchFromGitHub
+, libarchive
+, libev
+, libgccjit
+, libssh
+, lz4
+, openssl
+, systemd
+, zlib
+, zstd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pgmoneta";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "pgmoneta";
+    repo = "pgmoneta";
+    rev = version;
+    hash = "sha256-Acg60QFMmRTubYWkPxbHTciVOYoIWc3GZGQVauewZik=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    docutils # for rst2man
+  ];
+
+  buildInputs = [
+    bzip2
+    cjson
+    curl
+    libarchive
+    libev
+    libgccjit
+    libssh
+    lz4
+    openssl
+    systemd
+    zlib
+    zstd
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  meta = with lib; {
+    description = "Backup / restore solution for PostgreSQL";
+    homepage = "https://pgmoneta.github.io/";
+    changelog = "https://github.com/pgmoneta/pgmoneta/releases/tag/${version}";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.marsam ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/pr/presenterm/package.nix b/pkgs/by-name/pr/presenterm/package.nix
index e3c42056a2759..6e09e86f2059f 100644
--- a/pkgs/by-name/pr/presenterm/package.nix
+++ b/pkgs/by-name/pr/presenterm/package.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "presenterm";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "mfontanini";
     repo = "presenterm";
-    rev = version;
-    hash = "sha256-mNWnUUezKIffh5gMgMMdvApNZZTxxB8XrL0jFLyBxuk=";
+    rev = "v${version}";
+    hash = "sha256-sXVMVU34gxZKGNye6hoyv07a7N7f6UbivA6thbSOeZA=";
   };
 
-  cargoHash = "sha256-JLPJLhWN/yXpPIHa+FJ2aQ/GDUFKtZ7t+/8rvR8WNKM=";
+  cargoHash = "sha256-PsDaXMws/8hEvAZwClQ4okGuryg1iKg0IBr7Xp2QYBE=";
 
   meta = with lib; {
     description = "A terminal based slideshow tool";
diff --git a/pkgs/by-name/re/reactphysics3d/package.nix b/pkgs/by-name/re/reactphysics3d/package.nix
new file mode 100644
index 0000000000000..f775d7d542409
--- /dev/null
+++ b/pkgs/by-name/re/reactphysics3d/package.nix
@@ -0,0 +1,23 @@
+{ lib, stdenv, fetchFromGitHub, cmake }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "reactphysics3d";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "DanielChappuis";
+    repo = "reactphysics3d";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-AUdsUXsygsGfS8H+AHEV1fSrrX7zGmfsaTONYUG3zqk=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "An open source C++ physics engine library";
+    homepage = "https://www.reactphysics3d.com";
+    maintainers = with maintainers; [ rexxDigital ];
+    license = licenses.zlib;
+    platforms = platforms.all;
+  };
+})
diff --git a/pkgs/applications/editors/tecoc/default.nix b/pkgs/by-name/te/tecoc/package.nix
index 94889a13ef6db..a5531b3aa874b 100644
--- a/pkgs/applications/editors/tecoc/default.nix
+++ b/pkgs/by-name/te/tecoc/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tecoc";
-  version = "unstable-2023-04-21";
+  version = "unstable-2023-06-21";
 
   src = fetchFromGitHub {
     owner = "blakemcbride";
     repo = "TECOC";
-    rev = "021d1d15242b9d6c84d70c9ffcf1871793898f0a";
-    hash = "sha256-VGIO+uiAZkdzLYmJztmnKTS4HDIVow4AimaneHj7E1M=";
+    rev = "b4a96395a18c7e64ccaef0e25fdde3b7ef33ac4b";
+    hash = "sha256-KTOGsTtxJh2sneU2VoDNUHcL3m8zt+3rBZTDvK1n02A=";
   };
 
   buildInputs = [ ncurses ];
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
       TECOC is a portable C implementation of TECO-11.
     '';
     license = {
-      url = "https://github.com/blakemcbride/TECOC/tree/master/doc/readme-1st.txt";
+      url = "https://github.com/blakemcbride/TECOC/blob/${finalAttrs.src.rev}/doc/readme-1st.txt";
     };
     maintainers = [ lib.maintainers.AndersonTorres ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/tk/tkdiff/189.patch b/pkgs/by-name/tk/tkdiff/189.patch
new file mode 100644
index 0000000000000..c638727d3bd48
--- /dev/null
+++ b/pkgs/by-name/tk/tkdiff/189.patch
@@ -0,0 +1,71 @@
+Index: tkdiff
+===================================================================
+diff --git a/tkdiff b/tkdiff
+--- a/tkdiff	(revision 188)
++++ b/tkdiff	(revision 189)
+@@ -111,7 +111,7 @@
+ }
+ 
+ # Determine the name of the temporary directory, the rc file name,
+-# and possible VPATH EnvVar, all of which are platform dependent.
++# NULLdev, and possible VPATH EnvVar, all of which are platform dependent.
+ #
+ # Much MAY likely be overridden by a preference in .tkdiffrc,
+ # EXCEPT (obviously) when no such file actually exists yet
+@@ -126,6 +126,9 @@
+             set opts(tmpdir) C:/temp
+         }
+ 
++        # Reserved filename which is actually a NULL device
++        set opts(NULLdev) "nul"
++
+         # Split up and store a VPATH if it exists
+         if {[info exists ::env(VPATH)]} {
+             set finfo(Vpath) [split $::env(VPATH) ";"]
+@@ -145,6 +148,9 @@
+             set opts(tmpdir) $::env(TMPDIR)
+         }  {set opts(tmpdir) /tmp }
+ 
++        # Reserved filename which is actually a NULL device (Unix-like platforms)
++        set opts(NULLdev) "/dev/null"
++
+         # Split up and store a VPATH if it exists
+         if {[info exists ::env(VPATH)]} {
+             set finfo(Vpath) [split $::env(VPATH) ":"]
+@@ -2106,7 +2112,7 @@
+ #           1  Failed   (PLUS a 'pushed' HARD-error message to the caller)
+ ###############################################################################
+ proc get-file {fn ndx {probe 0}} {
+-    global g finfo
++    global g opts finfo
+ 
+     # Ancestor files are stored into a slightly adjusted array element name 
+     #   N.B> 'ndx' AS PASSED *can* be an EXPRESSION (not just a number): resolve!
+@@ -2121,7 +2127,7 @@
+     } elseif {!$tildechk} {
+         # DO NOT REPORT non-existence if this attempt was ONLY a probe
+         if {$probe} { return 1 } { set MSG "File '$fn' does not exist" }
+-    } elseif {[file isfile $fn]} {
++    } elseif {[file isfile $fn] || $fn == $opts(NULLdev)} {
+         set finfo(${A}lbl,$ndx) [shortNm [set finfo(${A}pth,$ndx) "$fn"]]
+     } else { set MSG "'$fn' exists, but is not a file" }
+ 
+@@ -2857,7 +2863,7 @@
+ # Align various label decorations to the CURRENT input file pairing
+ ###############################################################################
+ proc alignDecor {pairnum} {
+-    global g w finfo
++    global g w opts finfo
+ 
+     # Establish if 3way mode is NOW active and what file indices are in use
+     set g(is3way) [info exists finfo(albl,$pairnum)]
+@@ -2874,7 +2880,8 @@
+             set finfo(lbl,$LR) $finfo(ulbl,$ndx($n))    ;# Override lbl display
+         } else {set finfo(lbl,$LR) $finfo(lbl,$ndx($n))}
+ 
+-        if {![info exists finfo(tmp,$ndx($n))]} {
++        if {![info exists finfo(tmp,$ndx($n))] \
++            && $finfo(pth,$ndx($n)) != $opts(NULLdev)} {
+             #   (N.B> Tip data will ALSO be used by report generation heading)
+             set    g(tooltip,${LR}Label) "{$finfo(pth,$ndx($n))\n"
+             append g(tooltip,${LR}Label) \
diff --git a/pkgs/by-name/tk/tkdiff/package.nix b/pkgs/by-name/tk/tkdiff/package.nix
new file mode 100644
index 0000000000000..478ee4e29ff9e
--- /dev/null
+++ b/pkgs/by-name/tk/tkdiff/package.nix
@@ -0,0 +1,43 @@
+{ diffutils, fetchzip, lib, makeBinaryWrapper, stdenv, tk }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tkdiff";
+  version = "5.6";
+
+  src = fetchzip {
+    url = "mirror://sourceforge/tkdiff/tkdiff-${builtins.replaceStrings ["."] ["-"] finalAttrs.version}.zip";
+    hash = "sha256-EpbIdjsejkkTaSpoZRM5AHz0r1Cio+YzRryK0BoghBk=";
+  };
+
+  # fix regression: allow /dev/null again. eg: "tkdiff /dev/null file"
+  # svn diff --git -r188:189 https://svn.code.sf.net/p/tkdiff/code/trunk
+  patches = [ ./189.patch ];
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 -t $out/bin tkdiff
+    wrapProgram $out/bin/tkdiff \
+      --prefix PATH : ${lib.makeBinPath [ diffutils tk ]}
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A graphical front end to the diff program";
+    homepage = "https://tkdiff.sourceforge.io/";
+    license = lib.licenses.gpl2Plus;
+    longDescription = ''
+      TkDiff is a graphical front end to the diff program. It provides a
+      side-by-side view of the differences between two text files, along
+      with several innovative features such as diff bookmarks, a graphical
+      map of differences for quick navigation, and a facility for slicing
+      diff regions to achieve exactly the merge output desired.
+    '';
+    mainProgram = "tkdiff";
+    maintainers = with lib.maintainers; [ robert-manchester ];
+    platforms = tk.meta.platforms;
+  };
+})
diff --git a/pkgs/by-name/tp/tpm2-totp/package.nix b/pkgs/by-name/tp/tpm2-totp/package.nix
new file mode 100644
index 0000000000000..766c6e138af64
--- /dev/null
+++ b/pkgs/by-name/tp/tpm2-totp/package.nix
@@ -0,0 +1,46 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, tpm2-tss
+, autoreconfHook
+, autoconf-archive
+, pkg-config
+, qrencode
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tpm2-totp";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "tpm2-software";
+    repo = "tpm2-totp";
+    rev = "v${version}";
+    hash = "sha256-aeWhI2GQcWa0xAqlmHfcbCMg78UqcD6eanLlEVNVnRM=";
+  };
+
+  preConfigure = ''
+    echo '0.3.0' > VERSION
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    autoconf-archive
+    pkg-config
+  ];
+
+  buildInputs = [
+    tpm2-tss
+    qrencode
+  ];
+
+  meta = with lib; {
+    description = "Attest the trustworthiness of a device against a human using time-based one-time passwords";
+    homepage = "https://github.com/tpm2-software/tpm2-totp";
+    changelog = "https://github.com/tpm2-software/tpm2-totp/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.bsd3;
+    mainProgram = "tpm2-totp";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/by-name/tr/trealla/package.nix b/pkgs/by-name/tr/trealla/package.nix
index 1a9d5569f2351..6aee9c1598b9e 100644
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@@ -17,13 +17,13 @@
 assert lib.elem lineEditingLibrary [ "isocline" "readline" ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "2.28.12";
+  version = "2.29.36";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-uWCpCjYFtK2pNeHHZWhWI6YZ+cllQpkKz//nHracl5s=";
+    hash = "sha256-tQp2DOBW71Wm1aQqspW9tuH8aM8ir+ilZiENdElB/+0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix b/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix
index e22b02825b758..a6b78b70b2443 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/AlsaMixer-app.nix
@@ -1,38 +1,47 @@
-{ lib, stdenv, dockapps-sources, pkg-config, libX11, libXpm, libXext, alsa-lib }:
-
-stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, alsa-lib
+, dockapps-sources
+, libX11
+, libXext
+, libXpm
+, pkg-config
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "AlsaMixer.app";
-  version = "0.2.1";
 
-  src = dockapps-sources;
+  inherit (dockapps-sources) version src;
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libX11 libXpm libXext alsa-lib ];
+  sourceRoot = "${finalAttrs.src.name}/AlsaMixer.app";
 
-  setSourceRoot = ''
-    export sourceRoot=$(echo */${pname})
-  '';
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
-  dontConfigure = true;
+  buildInputs = [
+    alsa-lib
+    libX11
+    libXpm
+    libXext
+  ];
 
-  preInstall = ''
-    install -d ${placeholder "out"}/bin
-  '';
+  hardeningDisable = [ "fortify" ];
+
+  dontConfigure = true;
 
   installPhase = ''
     runHook preInstall
-    install -t ${placeholder "out"}/bin AlsaMixer.app
+    install -D -t ${placeholder "out"}/bin/ AlsaMixer.app
+    pushd ${placeholder "out"}/bin
+    ln -vs AlsaMixer.app AlsaMixer
     runHook postInstall
   '';
 
-  postInstall = ''
-    ln -s ${placeholder "out"}/bin/AlsaMixer.app ${placeholder "out"}/bin/AlsaMixer
-  '';
-
-  meta = with lib; {
+  meta = {
     description = "Alsa mixer application for Windowmaker";
     homepage = "https://www.dockapps.net/alsamixerapp";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.bstrik ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/cputnik.nix b/pkgs/by-name/wi/windowmaker/dockapps/cputnik.nix
new file mode 100644
index 0000000000000..6ac10e374e0fd
--- /dev/null
+++ b/pkgs/by-name/wi/windowmaker/dockapps/cputnik.nix
@@ -0,0 +1,46 @@
+{ lib
+, stdenv
+, dockapps-sources
+, libX11
+, libXext
+, libXpm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cputnik";
+
+  inherit (dockapps-sources) version src;
+
+  sourceRoot = "${finalAttrs.src.name}/cputnik/src";
+
+  buildInputs = [
+    libX11
+    libXpm
+    libXext
+  ];
+
+  preBuild = ''
+    makeFlagsArray+=(
+      INCS="-I${libX11.dev}/include -I${libXext.dev}/include -I${libXpm.dev}/include"
+      LIBS="-L${libX11}/lib -L${libXext}/lib -L${libXpm}/lib -lX11 -lXpm -lXext"
+    )
+  '';
+
+  hardeningDisable = [ "format" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 -t $out/bin/ cputnik
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A Calendar clock with antialiased text";
+    homepage = "https://www.dockapps.net/wmcalclock";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/default.nix b/pkgs/by-name/wi/windowmaker/dockapps/default.nix
index 8a66fdbd67f23..84cfe01bddf35 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/default.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/default.nix
@@ -1,20 +1,29 @@
 { config, lib, pkgs }:
 
-lib.makeScope pkgs.newScope (self: with self; {
+lib.makeScope pkgs.newScope (self: {
 
-  dockapps-sources = pkgs.fetchgit {
-    url = "https://repo.or.cz/dockapps.git";
-    rev = "b2b9d872ee61c9b329e4597c301e4417cbd9c3ea";
-    sha256 = "sha256-BuSnwPIj3gUWMjj++SK+117xm/77u4gXLQzRFttei0w=";
+  dockapps-sources = {
+    pname = "dockapps-sources";
+    version = "2023-10-11"; # Shall correspond to src.rev
+
+    src = pkgs.fetchFromRepoOrCz {
+      repo = "dockapps";
+      rev = "1bbb32008ecb58acaec9ea70e00b4ea1735408fc";
+      hash = "sha256-BLUDe/cIIuh9mCtafbcBSDatUXSRD83FeyYhcbem5FU=";
+    };
   };
 
-  libdockapp = callPackage ./libdockapp.nix { };
+  AlsaMixer-app = self.callPackage ./AlsaMixer-app.nix { };
+
+  cputnik = self.callPackage ./cputnik.nix { };
+
+  libdockapp = self.callPackage ./libdockapp.nix { };
 
-  AlsaMixer-app = callPackage ./AlsaMixer-app.nix { };
+  wmCalClock = self.callPackage ./wmCalClock.nix { };
 
-  wmCalClock = callPackage ./wmCalClock.nix { };
+  wmcube = self.callPackage ./wmcube.nix { };
 
-  wmsm-app = callPackage ./wmsm-app.nix { };
+  wmsm-app = self.callPackage ./wmsm-app.nix { };
 
-  wmsystemtray = callPackage ./wmsystemtray.nix { };
+  wmsystemtray = self.callPackage ./wmsystemtray.nix { };
 })
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix b/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix
index aaf99ec932e62..12446bfc7262f 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/libdockapp.nix
@@ -1,30 +1,36 @@
-{ lib, stdenv, dockapps-sources, autoreconfHook, pkg-config
-, libX11, libXext, libXpm, mkfontdir, fontutil }:
+{ lib
+, stdenv
+, autoreconfHook
+, dockapps-sources
+, fontutil
+, libX11
+, libXext
+, libXpm
+, mkfontdir
+, pkg-config
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libdockapp";
-  version = "0.7.3";
 
-  src = dockapps-sources;
+  inherit (dockapps-sources) version src;
+
+  sourceRoot = "${finalAttrs.src.name}/libdockapp";
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [ libX11 libXext libXpm fontutil mkfontdir ];
 
-  setSourceRoot = ''
-    export sourceRoot=$(echo */${pname})
-  '';
-
   # There is a bug on --with-font
   configureFlags = [
     "--with-examples=no"
     "--with-font=no"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "A library providing a framework for dockapps";
     homepage = "https://www.dockapps.net/libdockapp";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.bstrik ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix
index 9f49b4508c1ca..1dc130971ded4 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/wmCalClock.nix
@@ -1,17 +1,23 @@
-{ lib, stdenv, dockapps-sources
-, libX11, libXpm, libXext }:
-
-stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, dockapps-sources
+, libX11
+, libXext
+, libXpm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "wmCalClock";
-  version = "1.25";
 
-  src = dockapps-sources;
+  inherit (dockapps-sources) version src;
 
-  buildInputs = [ libX11 libXpm libXext ];
+  sourceRoot = "${finalAttrs.src.name}/wmCalClock";
 
-  setSourceRoot = ''
-    export sourceRoot=$(echo */${pname}/Src)
-  '';
+  buildInputs = [
+    libX11
+    libXpm
+    libXext
+  ];
 
   preBuild = ''
     makeFlagsArray+=(
@@ -28,11 +34,11 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "DESTDIR=${placeholder "out"}" ];
 
-  meta = with lib; {
+  meta = {
     description = "A Calendar clock with antialiased text";
     homepage = "https://www.dockapps.net/wmcalclock";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.bstrik ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/wmcube.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmcube.nix
new file mode 100644
index 0000000000000..5aaa00e23e344
--- /dev/null
+++ b/pkgs/by-name/wi/windowmaker/dockapps/wmcube.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, dockapps-sources
+, libX11
+, libXpm
+, libXext
+, libdockapp
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "wmcube";
+
+  inherit (dockapps-sources) version src;
+
+  sourceRoot = "${finalAttrs.src.name}/wmcube/wmcube";
+
+  buildInputs = [
+    libX11
+    libXext
+    libXpm
+    libdockapp
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89";
+
+  preBuild = ''
+    makeFlagsArray=(
+      CC="${stdenv.cc.targetPrefix}cc"
+      PREFIX="${placeholder "out"}"
+      VERSION="${finalAttrs.version}"
+      LIBDIR="-L${lib.getLib libX11}/lib -L${lib.getLib libXext}/lib \
+-L${lib.getLib libXpm}/lib -L${lib.getLib libdockapp}/lib"
+      INCDIR="-I${lib.getDev libX11}/lib -I${lib.getDev libXext}/lib \
+-I${lib.getDev libXpm}/lib -I${lib.getDev libdockapp}/lib"
+      LIBS="-lm -lXpm -lXext -lX11 -ldockapp"
+    )
+  '';
+
+  preInstall = ''
+    mkdir -pv $out/{bin,doc/wmcube-${finalAttrs.version},share/wmcube,man/man1}
+  '';
+
+  meta = {
+    description = "System monitor for Windowmaker";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
+  };
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix
index 5c68a39a1ead5..6becfce9578bc 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/wmsm-app.nix
@@ -1,20 +1,25 @@
-{ lib, stdenv, dockapps-sources
+{ lib
+, stdenv
+, dockapps-sources
 , libX11
 , libXpm
 , libXext
-, libdockapp }:
+, libdockapp
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation  (finalAttrs: {
   pname = "wmsm.app";
-  version = "0.2.1";
 
-  src = dockapps-sources;
+  inherit (dockapps-sources) version src;
 
-  buildInputs = [ libX11 libXpm libXext libdockapp ];
+  sourceRoot = "${src.name}/wmsm.app/wmsm";
 
-  setSourceRoot = ''
-    export sourceRoot=$(echo */${pname}/wmsm)
-  '';
+  buildInputs = [
+    libX11
+    libXext
+    libXpm
+    libdockapp
+  ];
 
   env.NIX_CFLAGS_COMPILE = "-std=gnu89";
 
@@ -24,7 +29,9 @@ stdenv.mkDerivation rec {
       --replace "/usr/bin/install" "install"
   '';
 
-  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
 
   installPhase = ''
     runHook preInstall
@@ -32,12 +39,14 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  installFlags = [ "PREFIX=${placeholder "out"}/bin" ];
+  installFlags = [
+    "PREFIX=${placeholder "out"}/bin"
+  ];
 
-  meta = with lib; {
+  meta = {
     description = "System monitor for Windowmaker";
     homepage = "https://www.dockapps.net/wmsmapp";
-    license = licenses.gpl2;
-    maintainers = [ maintainers.bstrik ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix b/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix
index ced4cad80556e..7f17475d318fa 100644
--- a/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix
+++ b/pkgs/by-name/wi/windowmaker/dockapps/wmsystemtray.nix
@@ -1,22 +1,40 @@
-{ lib, stdenv, fetchurl, pkg-config, libX11, libXpm, libXext, libXfixes, libXmu }:
+{ lib
+, stdenv
+, fetchurl
+, libX11
+, libXext
+, libXfixes
+, libXmu
+, libXpm
+, pkg-config
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "wmsystemtray";
   version = "1.4";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/${pname}/${pname}/${pname}-${version}.tar.gz";
-     sha256 = "sha256-jt70NpHp//BxAA4pFmx8GtQgwJVukGgVEGHogcisl+k=";
+    url = "mirror://sourceforge/project/wmsystemtray/wmsystemtray/wmsystemtray-${finalAttrs.version}.tar.gz";
+    hash = "sha256-jt70NpHp//BxAA4pFmx8GtQgwJVukGgVEGHogcisl+k=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libX11 libXpm libXext libXfixes libXmu ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
-  meta = with lib; {
+  buildInputs = [
+    libX11
+    libXext
+    libXfixes
+    libXmu
+    libXpm
+  ];
+
+  meta = {
     description = "A system tray for Windowmaker";
     homepage = "http://wmsystemtray.sourceforge.net";
     license = licenses.gpl2Only;
-    maintainers = [ maintainers.bstrik ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/wi/windowmaker/package.nix b/pkgs/by-name/wi/windowmaker/package.nix
index 2381c16f41ae0..6c39eadeb05b5 100644
--- a/pkgs/by-name/wi/windowmaker/package.nix
+++ b/pkgs/by-name/wi/windowmaker/package.nix
@@ -2,6 +2,7 @@
 , stdenv
 , fetchFromRepoOrCz
 , autoreconfHook
+, callPackage
 , pkg-config
 , imagemagick
 , libX11
@@ -62,6 +63,10 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-x"
   ];
 
+  passthru = {
+    dockapps = callPackage ./dockapps { };
+  };
+
   meta = {
     homepage = "http://windowmaker.org/";
     description = "NeXTSTEP-like window manager";
diff --git a/pkgs/data/documentation/scheme-manpages/default.nix b/pkgs/data/documentation/scheme-manpages/default.nix
index 08916f3e561f0..6eb1e3e74170a 100644
--- a/pkgs/data/documentation/scheme-manpages/default.nix
+++ b/pkgs/data/documentation/scheme-manpages/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "scheme-manpages";
-  version = "unstable-2023-08-13";
+  version = "unstable-2023-08-27";
 
   src = fetchFromGitHub {
     owner = "schemedoc";
     repo = "manpages";
-    rev = "c17abb7dfb733fede4cf776a932e9696ccc7a4f2";
-    hash = "sha256-9s/1sJEA4nowzQRpySOFzY+PxiUdz1Z3D931rMet4CA=";
+    rev = "44317b20616699b13b2b6276c86d796f4ae0c8dd";
+    hash = "sha256-qxj9sEQYOZ+me2IhDS5S2GRSho4KWWrEm+5MNxfw1VI=";
   };
 
   dontBuild = true;
diff --git a/pkgs/data/fonts/sketchybar-app-font/default.nix b/pkgs/data/fonts/sketchybar-app-font/default.nix
index c66d649de187f..df68dbb844c5b 100644
--- a/pkgs/data/fonts/sketchybar-app-font/default.nix
+++ b/pkgs/data/fonts/sketchybar-app-font/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sketchybar-app-font";
-  version = "1.0.16";
+  version = "1.0.17";
 
   src = fetchurl {
     url = "https://github.com/kvndrsslr/sketchybar-app-font/releases/download/v${finalAttrs.version}/sketchybar-app-font.ttf";
-    hash = "sha256-58gRCEJix9pnZEcoo6bm2zWduP0xXl3WWC6mt36SGuo=";
+    hash = "sha256-sDMasHVcITTSUP9B87w4I7IZ44tYmabNNWl+kE3dUoE=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/data/fonts/vazir-fonts/default.nix b/pkgs/data/fonts/vazir-fonts/default.nix
index d65b270c881f0..d65b270c881f0 100755..100644
--- a/pkgs/data/fonts/vazir-fonts/default.nix
+++ b/pkgs/data/fonts/vazir-fonts/default.nix
diff --git a/pkgs/data/icons/tela-circle-icon-theme/default.nix b/pkgs/data/icons/tela-circle-icon-theme/default.nix
index 6e32d09dac680..518f0d11efd79 100644
--- a/pkgs/data/icons/tela-circle-icon-theme/default.nix
+++ b/pkgs/data/icons/tela-circle-icon-theme/default.nix
@@ -19,13 +19,13 @@ lib.checkListOfEnum "${pname}: color variants" [ "standard" "black" "blue" "brow
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "2023-06-25";
+  version = "2023-10-07";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "nob0Isx785YRP4QIj2CK+v99CUiRwtkge1dNXCCwaDs=";
+    sha256 = "il+bYIcwm0BQF6U0J6h6rlzHSGSHYN/O8BezehYIpQ4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/themes/nordic/default.nix b/pkgs/data/themes/nordic/default.nix
index 8d977671fe7da..c8e956c3f83db 100644
--- a/pkgs/data/themes/nordic/default.nix
+++ b/pkgs/data/themes/nordic/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , gtk-engine-murrine
 , jdupes
+, libsForQt5
 }:
 
 stdenv.mkDerivation rec {
@@ -79,6 +80,15 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ jdupes ];
 
+  buildInputs = with libsForQt5; [
+    plasma-framework
+    qtgraphicaleffects
+    plasma-workspace
+    breeze-icons
+  ];
+
+  dontWrapQtApps = true;
+
   propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
   installPhase = ''
diff --git a/pkgs/data/themes/orchis-theme/default.nix b/pkgs/data/themes/orchis-theme/default.nix
index 2d07ac3ae380d..351c1c22207cd 100644
--- a/pkgs/data/themes/orchis-theme/default.nix
+++ b/pkgs/data/themes/orchis-theme/default.nix
@@ -26,13 +26,13 @@ lib.checkListOfEnum "${pname}: theme tweaks" validTweaks tweaks
 stdenvNoCC.mkDerivation
 rec {
   inherit pname;
-  version = "2023-05-27";
+  version = "2023-10-20";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    hash = "sha256-I1a8y9dAJqFgnhyMqfupSdGvbbScf6tSYKlAhAzY4Dk=";
+    hash = "sha256-GhSzTtbuvbAuXxKNm29sJX5kXE2s2jMDB6Ww6Q7GNSo=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];
diff --git a/pkgs/desktops/gnome/core/zenity/default.nix b/pkgs/desktops/gnome/core/zenity/default.nix
index b171ef202252a..6ff36b1c1960d 100644
--- a/pkgs/desktops/gnome/core/zenity/default.nix
+++ b/pkgs/desktops/gnome/core/zenity/default.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with lib; {
+    mainProgram = "zenity";
     description = "Tool to display dialogs from the commandline and shell scripts";
     homepage = "https://wiki.gnome.org/Projects/Zenity";
     license = licenses.lgpl21Plus;
diff --git a/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix b/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix
index 8d75389b079df..54f51ee2518cc 100644
--- a/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-notifyd/default.nix
@@ -1,9 +1,12 @@
 { lib
 , mkXfceDerivation
+, dbus
 , glib
 , gtk3
+, gtk-layer-shell
 , libcanberra-gtk3
 , libnotify
+, libX11
 , libxfce4ui
 , libxfce4util
 , sqlite
@@ -14,15 +17,19 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-notifyd";
-  version = "0.8.2";
+  version = "0.9.2";
+  odd-unstable = false;
 
-  sha256 = "sha256-M8L2HWTuQDl/prD7s6uptkW4XDscpk6fc+epoxjFNS8=";
+  sha256 = "sha256-BHhz5LURXLeILxQ+iNQ+50yHd/oIF7twHAqxiBQ2hFE=";
 
   buildInputs = [
+    dbus
     gtk3
+    gtk-layer-shell
     glib
     libcanberra-gtk3
     libnotify
+    libX11
     libxfce4ui
     libxfce4util
     sqlite
diff --git a/pkgs/development/compilers/flix/default.nix b/pkgs/development/compilers/flix/default.nix
index 47a84a6e5f2d2..9ce582623fe1b 100644
--- a/pkgs/development/compilers/flix/default.nix
+++ b/pkgs/development/compilers/flix/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "flix";
-  version = "0.40.0";
+  version = "0.41.0";
 
   src = fetchurl {
     url = "https://github.com/flix/flix/releases/download/v${version}/flix.jar";
-    sha256 = "sha256-NVQY2TgIR9ROy4x8PWxCjuaOkNx0bcUA4oZHjpQbHc4=";
+    sha256 = "sha256-bDeqwk+grkCxmGE9H8Ks7Q8KvLxNCzaLe44DlR6E7YE=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/compilers/mrustc/default.nix b/pkgs/development/compilers/mrustc/default.nix
index 6570199f8523b..eae17cbce91fa 100644
--- a/pkgs/development/compilers/mrustc/default.nix
+++ b/pkgs/development/compilers/mrustc/default.nix
@@ -4,9 +4,9 @@
 }:
 
 let
-  version = "0.10";
+  version = "0.10.1";
   tag = "v${version}";
-  rev = "b364724f15fd6fce8234ad8add68107c23a22151";
+  rev = "b6754f574f8846eb842feba4ccbeeecb10bdfacc";
 in
 
 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     owner = "thepowersgang";
     repo = "mrustc";
     rev = tag;
-    sha256 = "0f7kh4n2663sn0z3xib8gzw0s97qpvwag40g2vs3bfjlrbpgi9z0";
+    hash = "sha256-sYnx5dUTaQbK4ugnSzAJwIUwZKPUhThmNA+WlY+LEWc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/interpreters/janet/default.nix b/pkgs/development/interpreters/janet/default.nix
index 3c44239dc2fa2..f186021eb3d64 100644
--- a/pkgs/development/interpreters/janet/default.nix
+++ b/pkgs/development/interpreters/janet/default.nix
@@ -1,19 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, nix-update-script
+, runCommand
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "janet";
-  version = "1.31.0";
+  version = "1.32.1";
 
   src = fetchFromGitHub {
     owner = "janet-lang";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Dj2fj1dsdAMl/H0vNKTf9qjPB4GVRpgWPVR+PuZWZMc=";
+    repo = "janet";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-24d9N59pTfQATWmAZN4dAFT8RTTlUlBPKokcQ/Fd2No=";
   };
 
   postPatch = ''
     substituteInPlace janet.1 \
       --replace /usr/local/ $out/
+  '' + lib.optionalString stdenv.isDarwin ''
+    # error: Socket is not connected
+    substituteInPlace meson.build \
+      --replace "'test/suite-ev.janet'," ""
   '';
 
   nativeBuildInputs = [ meson ninja ];
@@ -29,6 +40,21 @@ stdenv.mkDerivation rec {
     $out/bin/janet -e '(+ 1 2 3)'
   '';
 
+  passthru = {
+    tests.run = runCommand "janet-test-run" {
+      nativeBuildInputs = [finalAttrs.finalPackage];
+    } ''
+      echo "(+ 1 2 3)" | janet | tail -n 1 > arithmeticTest.txt;
+      diff -U3 --color=auto <(cat arithmeticTest.txt) <(echo "6");
+
+      echo "(print \"Hello, World!\")" | janet | tail -n 2 > ioTest.txt;
+      diff -U3 --color=auto <(cat ioTest.txt) <(echo -e "Hello, World!\nnil");
+
+      touch $out;
+    '';
+    updateScript = nix-update-script {};
+  };
+
   meta = with lib; {
     description = "Janet programming language";
     homepage = "https://janet-lang.org/";
@@ -36,4 +62,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ andrewchambers peterhoeg ];
     platforms = platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/CGAL/default.nix b/pkgs/development/libraries/CGAL/default.nix
index 9d9233aad20e4..672facdc230cf 100644
--- a/pkgs/development/libraries/CGAL/default.nix
+++ b/pkgs/development/libraries/CGAL/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv
-, fetchFromGitHub
+, fetchurl
 , cmake
 , boost
 , gmp
@@ -8,13 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cgal";
-  version = "5.5.2";
+  version = "5.5.3";
 
-  src = fetchFromGitHub {
-    owner = "CGAL";
-    repo = "releases";
-    rev = "CGAL-${version}";
-    sha256 = "sha256-olMPT/8Q0bf+rooJoNc0k8NrO//O7z0yqBoP8KX39yQ=";
+  src = fetchurl {
+    url = "https://github.com/CGAL/cgal/releases/download/v${version}/CGAL-${version}.tar.xz";
+    hash = "sha256-CgT2YmkyVjKLBbq/q7XjpbfbL1pY1S48Ug350IKN3XM=";
   };
 
   # note: optional component libCGAL_ImageIO would need zlib and opengl;
diff --git a/pkgs/development/libraries/argagg/0001-catch.diff b/pkgs/development/libraries/argagg/0001-catch.diff
deleted file mode 100644
index f99649d568124..0000000000000
--- a/pkgs/development/libraries/argagg/0001-catch.diff
+++ /dev/null
@@ -1,20 +0,0 @@
---- old/test/doctest.h	2019-03-05 18:04:06.143740733 +0300
-+++ new/test/doctest.h	2019-03-05 18:04:43.577284916 +0300
-@@ -1307,7 +1307,7 @@
-                                                        __FILE__, __LINE__, #expr, #as);            \
-             try {                                                                                  \
-                 expr;                                                                              \
--            } catch(as) {                                                                          \
-+            } catch(as e) {                                                                          \
-                 _DOCTEST_RB.m_threw    = true;                                                     \
-                 _DOCTEST_RB.m_threw_as = true;                                                     \
-             } catch(...) { _DOCTEST_RB.m_threw = true; }                                           \
-@@ -1332,7 +1332,7 @@
- #define DOCTEST_REQUIRE_THROWS(expr) DOCTEST_ASSERT_THROWS(expr, DT_REQUIRE_THROWS)
- 
- #define DOCTEST_WARN_THROWS_AS(expr, ex) DOCTEST_ASSERT_THROWS_AS(expr, ex, DT_WARN_THROWS_AS)
--#define DOCTEST_CHECK_THROWS_AS(expr, ex) DOCTEST_ASSERT_THROWS_AS(expr, ex, DT_CHECK_THROWS_AS)
-+#define DOCTEST_CHECK_THROWS_AS(expr, ex) DOCTEST_ASSERT_THROWS_AS(expr, const ex &, DT_CHECK_THROWS_AS)
- #define DOCTEST_REQUIRE_THROWS_AS(expr, ex) DOCTEST_ASSERT_THROWS_AS(expr, ex, DT_REQUIRE_THROWS_AS)
- 
- #define DOCTEST_WARN_NOTHROW(expr) DOCTEST_ASSERT_NOTHROW(expr, DT_WARN_NOTHROW)
diff --git a/pkgs/development/libraries/duckdb/default.nix b/pkgs/development/libraries/duckdb/default.nix
index ea152c0cc099d..c9f6711780b0b 100644
--- a/pkgs/development/libraries/duckdb/default.nix
+++ b/pkgs/development/libraries/duckdb/default.nix
@@ -15,13 +15,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "duckdb";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-EKvDH7RwOC4Gu/lturrfnGpzXnJ9azIwAFeuVoa6L/Y=";
+    hash = "sha256-UG/vV/6WxVLq9mdze8pSDFJIekOgGsg93dzMq6eP6Dg=";
   };
 
   patches = [ ./version.patch ];
@@ -106,10 +106,12 @@ stdenv.mkDerivation rec {
     '';
 
   meta = with lib; {
-    homepage = "https://github.com/duckdb/duckdb";
+    changelog = "https://github.com/duckdb/duckdb/releases/tag/v${version}";
     description = "Embeddable SQL OLAP Database Management System";
+    homepage = "https://duckdb.org/";
     license = licenses.mit;
-    platforms = platforms.all;
+    mainProgram = "duckdb";
     maintainers = with maintainers; [ costrouc cpcloud ];
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/libraries/duckdb/version.patch b/pkgs/development/libraries/duckdb/version.patch
index 9b368eac5dbc6..f40785b430797 100644
--- a/pkgs/development/libraries/duckdb/version.patch
+++ b/pkgs/development/libraries/duckdb/version.patch
@@ -56,25 +56,3 @@ index 2b49e11288..0a4a69b9a0 100644
  
  message(STATUS "git hash ${GIT_COMMIT_HASH}, version ${DUCKDB_VERSION}")
  
-diff --git a/tools/pythonpkg/setup.py b/tools/pythonpkg/setup.py
-index fdf2911019..c363cc518a 100644
---- a/tools/pythonpkg/setup.py
-+++ b/tools/pythonpkg/setup.py
-@@ -163,8 +163,6 @@ if 'BUILD_HTTPFS' in os.environ:
- for ext in extensions:
-     toolchain_args.extend(['-DDUCKDB_EXTENSION_{}_LINKED'.format(ext.upper())])
- 
--toolchain_args.extend(['-DDUCKDB_EXTENSION_AUTOLOAD_DEFAULT=1', '-DDUCKDB_EXTENSION_AUTOINSTALL_DEFAULT=1'])
--
- 
- class get_pybind_include(object):
-     def __init__(self, user=False):
-@@ -343,7 +341,7 @@ setup(
-     packages=packages,
-     include_package_data=True,
-     python_requires='>=3.7.0',
--    setup_requires=setup_requires + ["setuptools_scm<7.0.0", 'pybind11>=2.6.0'],
-+    setup_requires=setup_requires + ["setuptools_scm", 'pybind11>=2.6.0'],
-     use_scm_version=setuptools_scm_conf,
-     tests_require=['google-cloud-storage', 'mypy', 'pytest'],
-     classifiers=[
diff --git a/pkgs/development/libraries/jemalloc/rust.nix b/pkgs/development/libraries/jemalloc/rust.nix
new file mode 100644
index 0000000000000..1a9968933b1e9
--- /dev/null
+++ b/pkgs/development/libraries/jemalloc/rust.nix
@@ -0,0 +1,24 @@
+{ lib
+, stdenv
+, jemalloc
+, writeText
+
+, unprefixed ? false
+}:
+
+let
+  # On some platforms the unprefixed feature will be ignored:
+  # https://github.com/tikv/jemallocator/blob/ab0676d77e81268cd09b059260c75b38dbef2d51/jemalloc-sys/src/env.rs
+  unprefixed' = unprefixed && !stdenv.hostPlatform.isMusl && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isAndroid;
+
+in jemalloc.overrideAttrs (oldAttrs: {
+  configureFlags = oldAttrs.configureFlags ++ [
+    "--with-private-namespace=_rjem_"
+  ] ++ lib.optionals (!unprefixed') [
+    "--with-jemalloc-prefix=_rjem_"
+  ];
+
+  setupHook = writeText "setup-hook.sh" ''
+    export JEMALLOC_OVERRIDE="@out@/lib/libjemalloc${stdenv.hostPlatform.extensions.library}"
+  '';
+})
diff --git a/pkgs/development/libraries/ldb/default.nix b/pkgs/development/libraries/ldb/default.nix
index 95547fb6382a3..de1af1f447e81 100644
--- a/pkgs/development/libraries/ldb/default.nix
+++ b/pkgs/development/libraries/ldb/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ldb";
-  version = "2.7.2";
+  version = "2.8.0";
 
   src = fetchurl {
     url = "mirror://samba/ldb/${pname}-${version}.tar.gz";
-    hash = "sha256-Ju5y1keFTmYtmWQ+srLTQWVavzH0mQg41mUPtc+SCcg=";
+    hash = "sha256-NY3KEPzScgeshXoNf0NaRtvGzR98ENu4QMGTG/GWXwg=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libspf2/default.nix b/pkgs/development/libraries/libspf2/default.nix
index b7bef29735232..997e89b82397c 100644
--- a/pkgs/development/libraries/libspf2/default.nix
+++ b/pkgs/development/libraries/libspf2/default.nix
@@ -1,23 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, fetchpatch }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "libspf2";
-  version = "2.2.12";
+  version = "2.2.13";
 
   src = fetchFromGitHub {
     owner = "helsinki-systems";
     repo = "libspf2";
     rev = "v${version}";
-    sha256 = "03iiaafdcwh220pqignk407h6klrakwz0zkb8iwk6nkwipkwvhsx";
+    hash = "sha256-tkCHP3B1sBb0+scHBjX5lCvaeSrZryfaGKye02LFlYs=";
   };
 
-  patches = [
-    # glibc-2.34 compat
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/gentoo/gentoo/dbb8a5c9f749cc11e61cfe558f164b165cbc30cb/mail-filter/libspf2/files/libspf2-1.2.11-undefined-dn_.patch";
-      sha256 = "sha256-6JVVkVGCcFJsNeBdVTPcLhW4KoHLY4ai/KXDMliXgPA=";
-    })
-  ];
+  nativeBuildInputs = [ autoreconfHook ];
+  strictDeps = true;
 
   postPatch = ''
     # disable static bins compilation
@@ -28,9 +23,6 @@ stdenv.mkDerivation rec {
       -e '/bin_PROGRAMS/s/spf_example_static//' src/spf_example/Makefile.am
   '';
 
-  # autoreconf necessary because we modified automake files
-  nativeBuildInputs = [ autoreconfHook ];
-
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libunarr/default.nix b/pkgs/development/libraries/libunarr/default.nix
index 1feafabfd4df9..c1e0881bf3ff2 100644
--- a/pkgs/development/libraries/libunarr/default.nix
+++ b/pkgs/development/libraries/libunarr/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libunarr";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchurl {
     url = "https://github.com/selmf/unarr/releases/download/v${version}/unarr-${version}.tar.xz";
-    hash = "sha256-5wCnhjoj+GTmaeDTCrUnm1Wt9SsWAbQcPSYM//FNeOA=";
+    hash = "sha256-Mo76BOqZbdOJFrEkeozxdqwpuFyvkhdONNMZmN5BdNI=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/openxr-loader/default.nix b/pkgs/development/libraries/openxr-loader/default.nix
index 1abc8a2633c69..53bfa41a8e253 100644
--- a/pkgs/development/libraries/openxr-loader/default.nix
+++ b/pkgs/development/libraries/openxr-loader/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openxr-loader";
-  version = "1.0.30";
+  version = "1.0.31";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenXR-SDK-Source";
     rev = "release-${version}";
-    sha256 = "sha256-lF8Pauyi+zSNVnpHqq86J3SGUTM6AhFmnT48eyFoYco=";
+    sha256 = "sha256-qK8l/v6nLuMAitz7DfVDjJyVjEmkeD2jgJkG5qOMCcQ=";
   };
 
   nativeBuildInputs = [ cmake python3 pkg-config ];
diff --git a/pkgs/development/libraries/science/chemistry/tblite/default.nix b/pkgs/development/libraries/science/chemistry/tblite/default.nix
index 0f05315b9d88c..7cc64937dc131 100644
--- a/pkgs/development/libraries/science/chemistry/tblite/default.nix
+++ b/pkgs/development/libraries/science/chemistry/tblite/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , gfortran
 , blas
@@ -26,6 +27,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-R7CAFG/x55k5Ieslxeq+DWq1wPip4cI+Yvn1cBbeVNs=";
   };
 
+  patches = [
+    # toml-f 0.4 compatibility
+    (fetchpatch {
+      url = "https://github.com/tblite/tblite/commit/da759fd02b8fbf470a5c6d3df9657cca6b1d0a9a.diff";
+      hash = "sha256-VaeA2VyK+Eas432HMSpJ0lXxHBBNGpfkUO1eHeWpYl0=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake gfortran ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/toml-f/default.nix b/pkgs/development/libraries/toml-f/default.nix
index d28447c400467..696e41ac71cc4 100644
--- a/pkgs/development/libraries/toml-f/default.nix
+++ b/pkgs/development/libraries/toml-f/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "toml-f";
-  version = "0.3.1";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-8FbnUkeJUP4fiuJCroAVDo6U2M7ZkFLpG2OYrapMYtU=";
+    hash = "sha256-sCU0uMdcXIA5O964hlK37cOrLTlk1CJeTcWD9FhevOs=";
   };
 
   nativeBuildInputs = [ gfortran cmake ];
diff --git a/pkgs/development/libraries/virglrenderer/default.nix b/pkgs/development/libraries/virglrenderer/default.nix
index 42ce297d45638..f64de57fcb89d 100644
--- a/pkgs/development/libraries/virglrenderer/default.nix
+++ b/pkgs/development/libraries/virglrenderer/default.nix
@@ -1,23 +1,21 @@
-{ lib, stdenv, fetchurl, cmake, meson, ninja, pkg-config, python3
+{ lib, stdenv, fetchurl, meson, ninja, pkg-config, python3
 , libGLU, libepoxy, libX11, libdrm, mesa
 }:
 
 stdenv.mkDerivation rec {
   pname = "virglrenderer";
-  version = "0.10.4";
+  version = "1.0.0";
 
   src = fetchurl {
-    url = "https://gitlab.freedesktop.org/virgl/virglrenderer/-/archive/virglrenderer-${version}/virglrenderer-virglrenderer-${version}.tar.bz2";
-    sha256 = "sha256-qqvnko2sN4bdm9+F0PVjDW5FsiL5k3UAfjPSTqG+73c=";
+    url = "https://gitlab.freedesktop.org/virgl/virglrenderer/-/archive/${version}/virglrenderer-${version}.tar.bz2";
+    hash = "sha256-KMGPP2MeuATHFXKr5oW9HuFOMmmYpmkVLvMvQi0cEdg=";
   };
 
   separateDebugInfo = true;
 
   buildInputs = [ libGLU libepoxy libX11 libdrm mesa ];
 
-  nativeBuildInputs = [ cmake meson ninja pkg-config python3 ];
-
-  dontUseCmakeConfigure = true;
+  nativeBuildInputs = [ meson ninja pkg-config python3 ];
 
   meta = with lib; {
     description = "A virtual 3D GPU library that allows a qemu guest to use the host GPU for accelerated 3D rendering";
diff --git a/pkgs/development/libraries/zlib-ng/default.nix b/pkgs/development/libraries/zlib-ng/default.nix
index 3f2ba22ea430c..2d3ba583cfd5b 100644
--- a/pkgs/development/libraries/zlib-ng/default.nix
+++ b/pkgs/development/libraries/zlib-ng/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zlib-ng";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "zlib-ng";
     repo = "zlib-ng";
     rev = version;
-    hash = "sha256-DC4KPPaMuqML0HEhWJmWjyox4WEbExPDfNnpnWzoaHc=";
+    hash = "sha256-okNmobCVAC9y7tjZqFd0DBhOjs3WWRPK8jvK1j9G29k=";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 636c411acca4d..f344bd9485153 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -478,6 +478,30 @@ buildLuarocksPackage {
   };
 }) {};
 
+ferris-nvim = callPackage({ fetchzip, buildLuarocksPackage, lua, luaOlder }:
+buildLuarocksPackage {
+  pname = "ferris.nvim";
+  version = "2.0.0-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/ferris.nvim-2.0.0-1.rockspec";
+    sha256 = "00d3x2hbs8625ky50r2w08c6idcx3bkrk0rks5qd8yh7v61nj53h";
+  }).outPath;
+  src = fetchzip {
+    url    = "https://github.com/mrcjkb/ferris.nvim/archive/2.0.0.zip";
+    sha256 = "1fb18k0ylb06h4ifs9k6lfc42y74xpavzwkqy55lfdkmlbc7jmhy";
+  };
+
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = {
+    homepage = "https://github.com/mrcjkb/ferris.nvim";
+    description = "Supercharge your Rust experience in Neovim! A heavily modified fork of rust-tools.nvim";
+    maintainers = with lib.maintainers; [ mrcjkb ];
+    license.fullName = "GPL-2.0";
+  };
+}) {};
+
 fifo = callPackage({ fetchzip, lua, buildLuarocksPackage }:
 buildLuarocksPackage {
   pname = "fifo";
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 74801b581eaa7..f0e9b379f4292 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -166,6 +166,7 @@
 , "markdown-link-check"
 , "mastodon-bot"
 , "mathjax"
+, "mathjax-node-cli"
 , "meat"
 , "mocha"
 , "multi-file-swagger"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index 2035839ec0fa7..2686f65e3b21d 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -19057,6 +19057,15 @@ let
         sha512 = "0yayqDxWQbqk3ojkYqUKqaAQ6AfNKeKWRNA8kR0WXzAsdHpP4BIaOmMAG87JGuO6qcobyW4GjxHd9PmhEd+T9w==";
       };
     };
+    "cliui-4.1.0" = {
+      name = "cliui";
+      packageName = "cliui";
+      version = "4.1.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/cliui/-/cliui-4.1.0.tgz";
+        sha512 = "4FG+RSG9DL7uEwRUZXZn3SS34DiDPfzP0VOiEwtUWlE+AR2EIg+hSyvrIgUUfhdgR/UkAeW2QHgeP+hWrXs7jQ==";
+      };
+    };
     "cliui-5.0.0" = {
       name = "cliui";
       packageName = "cliui";
@@ -32416,6 +32425,15 @@ let
         sha512 = "xgs2NH9AE66ucSq4cNG1nhSFghr5l6tdL15Pk+jl46bmmBapgoaY/AacXyaDznAqmGL99TiLSQgO/XazFSKYeQ==";
       };
     };
+    "invert-kv-2.0.0" = {
+      name = "invert-kv";
+      packageName = "invert-kv";
+      version = "2.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/invert-kv/-/invert-kv-2.0.0.tgz";
+        sha512 = "wPVv/y/QQ/Uiirj/vh3oP+1Ww+AWehmi1g5fFWGPF6IpCBCDVrhgHRMvrLfdYcwDh3QJbGXDW4JAuzxElLSqKA==";
+      };
+    };
     "iota-array-1.0.0" = {
       name = "iota-array";
       packageName = "iota-array";
@@ -34720,6 +34738,15 @@ let
         sha512 = "SdRK2C7jjs4k/kT2mwtO07KJN9RnjxtKn03d9JVj6c3j9WwaLcFYsICYDnLAzY0hp+wG2nxl+Cm2jWLiNVYb8g==";
       };
     };
+    "jsdom-11.12.0" = {
+      name = "jsdom";
+      packageName = "jsdom";
+      version = "11.12.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/jsdom/-/jsdom-11.12.0.tgz";
+        sha512 = "y8Px43oyiBM13Zc1z780FrfNLJCXTL40EWlty/LXUtcjykRBNgLlCjWXpfSPBl2iv+N7koQN+dvqszHZgT/Fjw==";
+      };
+    };
     "jsdom-14.1.0" = {
       name = "jsdom";
       packageName = "jsdom";
@@ -35917,6 +35944,15 @@ let
         sha512 = "YiGkH6EnGrDGqLMITnGjXtGmNtjoXw9SVUzcaos8RBi7Ps0VBylkq+vOcY9QE5poLasPCR849ucFUkl0UzUyOw==";
       };
     };
+    "lcid-2.0.0" = {
+      name = "lcid";
+      packageName = "lcid";
+      version = "2.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/lcid/-/lcid-2.0.0.tgz";
+        sha512 = "avPEb8P8EGnwXKClwsNUgryVjllcRqtMYa49NTsbQagYuT1DcXnl1915oxWjoyGrXR6zH/Y0Zc96xWsPcoDKeA==";
+      };
+    };
     "ldap-filter-0.3.3" = {
       name = "ldap-filter";
       packageName = "ldap-filter";
@@ -35971,6 +36007,15 @@ let
         sha512 = "IpSVCk9AYvLHo5ctcIXxOBpMWUe+4TKN3VPWAKUbJikkmsGp0VrSM8IttVc32D6J4WUsiPE6aEFRNmIoF/gdow==";
       };
     };
+    "left-pad-1.3.0" = {
+      name = "left-pad";
+      packageName = "left-pad";
+      version = "1.3.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz";
+        sha512 = "XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA==";
+      };
+    };
     "less-4.2.0" = {
       name = "less";
       packageName = "less";
@@ -38528,6 +38573,33 @@ let
         sha512 = "rUxjysqif/BZQH2yhd5Aaq7vXMSx9NdEsQcyA07uEzIvxgI7zIr33gGsh+RU0/XjmQpCW7RsVof1vlkvQVCK5A==";
       };
     };
+    "mathjax-2.7.9" = {
+      name = "mathjax";
+      packageName = "mathjax";
+      version = "2.7.9";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/mathjax/-/mathjax-2.7.9.tgz";
+        sha512 = "NOGEDTIM9+MrsqnjPEjVGNx4q0GQxqm61yQwSK+/5S59i26wId5IC5gNu9/bu8+CCVl5p9G2IHcAl/wJa+5+BQ==";
+      };
+    };
+    "mathjax-node-2.1.1" = {
+      name = "mathjax-node";
+      packageName = "mathjax-node";
+      version = "2.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/mathjax-node/-/mathjax-node-2.1.1.tgz";
+        sha512 = "i29tvqD8yHPB2WhrGV5rvliYnKwTT8a/TO8SCnuYtatpSHxLGy3aF7lDTVLD6B1bfuVMTFB6McZu2TBxk0XGeg==";
+      };
+    };
+    "mathjax-node-sre-3.0.3" = {
+      name = "mathjax-node-sre";
+      packageName = "mathjax-node-sre";
+      version = "3.0.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/mathjax-node-sre/-/mathjax-node-sre-3.0.3.tgz";
+        sha512 = "SBwqD3DEgdYyPQv7vUBqH/uCr0eOI23PbffzmhelFPY8KdVANZkE2hssJA0Dfl23y7uEefsoVOryckMLEmmzaw==";
+      };
+    };
     "mathml-tag-names-2.1.3" = {
       name = "mathml-tag-names";
       packageName = "mathml-tag-names";
@@ -43272,6 +43344,15 @@ let
         sha512 = "PRT7ZORmwu2MEFt4/fv3Q+mEfN4zetKxufQrkShY2oGvUms9r8otu5HfdyIFHkYXjO7laNsoVGmM2MANfuTA8g==";
       };
     };
+    "os-locale-3.1.0" = {
+      name = "os-locale";
+      packageName = "os-locale";
+      version = "3.1.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/os-locale/-/os-locale-3.1.0.tgz";
+        sha512 = "Z8l3R4wYWM40/52Z+S265okfFj8Kt2cC2MKY+xNi3kFs+XGI7WXu/I309QQQYbRW4ijiZ+yxs9pqEhJh0DqW3Q==";
+      };
+    };
     "os-paths-4.4.0" = {
       name = "os-paths";
       packageName = "os-paths";
@@ -44271,6 +44352,15 @@ let
         sha512 = "rgO9Zg5LLLkfJF9E6CCmXlSE4UVceloys8JrFqCcHloC3usd/kJCyPDwH2SOlzix2j3xaP9sUX3e8+kvkuleAA==";
       };
     };
+    "parse5-4.0.0" = {
+      name = "parse5";
+      packageName = "parse5";
+      version = "4.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/parse5/-/parse5-4.0.0.tgz";
+        sha512 = "VrZ7eOd3T1Fk4XWNXMgiGBK/z0MG48BWG2uQNU4I72fkQuKUTZpl+u9k+CxEG0twMVzSmXEEz12z5Fnw1jIQFA==";
+      };
+    };
     "parse5-5.1.0" = {
       name = "parse5";
       packageName = "parse5";
@@ -52254,6 +52344,15 @@ let
         sha512 = "1klA3Gi5PD1Wv9Q0wUoOQN1IWAuPu0D1U03ThXTr0cJ20+/iq2tHSDnK7Kk/0LXJ1ztUB2/1Os0wKmfyNgUQfg==";
       };
     };
+    "speech-rule-engine-2.4.0" = {
+      name = "speech-rule-engine";
+      packageName = "speech-rule-engine";
+      version = "2.4.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/speech-rule-engine/-/speech-rule-engine-2.4.0.tgz";
+        sha512 = "7IXDmpGiQOJWUPVy/rcayqi1aTCrhcQ/bVACu2oyueEuiYzPW8GebYRF4LeyMROL/E0kxkO5U66t0aFWCv0QCQ==";
+      };
+    };
     "speed-limiter-1.0.2" = {
       name = "speed-limiter";
       packageName = "speed-limiter";
@@ -59455,6 +59554,15 @@ let
         sha512 = "saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==";
       };
     };
+    "whatwg-url-6.5.0" = {
+      name = "whatwg-url";
+      packageName = "whatwg-url";
+      version = "6.5.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/whatwg-url/-/whatwg-url-6.5.0.tgz";
+        sha512 = "rhRZRqx/TLJQWUpQ6bmrt2UV4f0HCQ463yQuONJqC6fO2VoEb1pTYddbe59SkYq87aoM5A3bdhMZiUiVws+fzQ==";
+      };
+    };
     "whatwg-url-7.1.0" = {
       name = "whatwg-url";
       packageName = "whatwg-url";
@@ -59590,6 +59698,15 @@ let
         sha512 = "qe9UWWpkeG5yzZ0tNYxDmd7vo58HDBc39mZ0xWWpolAGADdFOzkfamWLDxkOWcvHQKVmdTyQdLD4NOfjLWTKew==";
       };
     };
+    "wicked-good-xpath-1.3.0" = {
+      name = "wicked-good-xpath";
+      packageName = "wicked-good-xpath";
+      version = "1.3.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/wicked-good-xpath/-/wicked-good-xpath-1.3.0.tgz";
+        sha512 = "Gd9+TUn5nXdwj/hFsPVx5cuHHiF5Bwuc30jZ4+ronF1qHK5O7HD0sgmXWSEgwKquT3ClLoKPVbO6qGwVwLzvAw==";
+      };
+    };
     "wide-align-1.1.5" = {
       name = "wide-align";
       packageName = "wide-align";
@@ -60094,6 +60211,15 @@ let
         sha512 = "61a+9LgtYZxTq1hAonhX8Xwpo2riK4IOR/BIVxioFbCfc3QFKmpE4x9dLExfLHKtUfVZigYa36tThVhO57erEw==";
       };
     };
+    "ws-5.2.3" = {
+      name = "ws";
+      packageName = "ws";
+      version = "5.2.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/ws/-/ws-5.2.3.tgz";
+        sha512 = "jZArVERrMsKUatIdnLzqvcfydI85dvd/Fp1u/VOpfdDWQ4c9qWXe+VIeAbQ5FrDwciAkr+lzofXLz3Kuf26AOA==";
+      };
+    };
     "ws-6.1.4" = {
       name = "ws";
       packageName = "ws";
@@ -60472,6 +60598,15 @@ let
         sha512 = "yS2uJflVQs6n+CyjHoaBmVSqIDevTAWrzMmjG1Gc7h1qQ7uVozNhEPJAwZXWyGQ/Gafo3fCwrcaokezLPupVyQ==";
       };
     };
+    "xmldom-sre-0.1.31" = {
+      name = "xmldom-sre";
+      packageName = "xmldom-sre";
+      version = "0.1.31";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/xmldom-sre/-/xmldom-sre-0.1.31.tgz";
+        sha512 = "f9s+fUkX04BxQf+7mMWAp5zk61pciie+fFLC9hX9UVvCeJQfNHRHXpeo5MPcR0EUf57PYLdt+ZO4f3Ipk2oZUw==";
+      };
+    };
     "xmlhttprequest-https://github.com/LearnBoost/node-XMLHttpRequest/archive/0f36d0b5ebc03d85f860d42a64ae9791e1daa433.tar.gz" = {
       name = "xmlhttprequest";
       packageName = "xmlhttprequest";
@@ -60680,6 +60815,15 @@ let
         sha512 = "C/FsVVhht4iPQYXOInoxUM/1ELSf9EsgKH34FofQOp6hwCPrW4vG4w5++TED3xRUo8gD7l0P1J1dLlDYzODsTQ==";
       };
     };
+    "yargs-12.0.5" = {
+      name = "yargs";
+      packageName = "yargs";
+      version = "12.0.5";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/yargs/-/yargs-12.0.5.tgz";
+        sha512 = "Lhz8TLaYnxq/2ObqHDql8dX8CJi97oHxrjUcYtzKbbykPtVW9WB+poxI+NM2UIzsMgNCZTIf0AQwsjK5yMAqZw==";
+      };
+    };
     "yargs-13.3.2" = {
       name = "yargs";
       packageName = "yargs";
@@ -60788,6 +60932,15 @@ let
         sha512 = "VCIyR1wJoEBZUqk5PA+oOBF6ypbwh5aNB3I50guxAL/quggdfs4TtNHQrSazFA3fYZ+tEqfs0zIGlv0c/rgjbQ==";
       };
     };
+    "yargs-parser-11.1.1" = {
+      name = "yargs-parser";
+      packageName = "yargs-parser";
+      version = "11.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/yargs-parser/-/yargs-parser-11.1.1.tgz";
+        sha512 = "C6kB/WJDiaxONLJQnF8ccx9SEeoTTLek8RVbaOIsrAUS8VrBEXfmeSnCZxygc+XC2sNMBIwOOnfcxiynjHsVSQ==";
+      };
+    };
     "yargs-parser-13.1.2" = {
       name = "yargs-parser";
       packageName = "yargs-parser";
@@ -86065,6 +86218,212 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  mathjax-node-cli = nodeEnv.buildNodePackage {
+    name = "mathjax-node-cli";
+    packageName = "mathjax-node-cli";
+    version = "1.0.1";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/mathjax-node-cli/-/mathjax-node-cli-1.0.1.tgz";
+      sha512 = "p1OB9zalQZkKYumfx+8mSX59MysF2Ox2H88gHSUQpdjpuMISwIPfw0MQmsvcS00hntSX05uEDa3uzo+1SgSk5w==";
+    };
+    dependencies = [
+      sources."abab-2.0.6"
+      sources."acorn-5.7.4"
+      (sources."acorn-globals-4.3.4" // {
+        dependencies = [
+          sources."acorn-6.4.2"
+        ];
+      })
+      sources."acorn-walk-6.2.0"
+      sources."ajv-6.12.6"
+      sources."ansi-regex-3.0.1"
+      sources."ansi-styles-4.3.0"
+      sources."array-equal-1.0.0"
+      sources."asn1-0.2.6"
+      sources."assert-plus-1.0.0"
+      sources."async-limiter-1.0.1"
+      sources."asynckit-0.4.0"
+      sources."aws-sign2-0.7.0"
+      sources."aws4-1.12.0"
+      sources."bcrypt-pbkdf-1.0.2"
+      sources."browser-process-hrtime-1.0.0"
+      sources."camelcase-5.3.1"
+      sources."caseless-0.12.0"
+      sources."cliui-4.1.0"
+      sources."code-point-at-1.1.0"
+      sources."color-convert-2.0.1"
+      sources."color-name-1.1.4"
+      sources."combined-stream-1.0.8"
+      sources."commander-11.0.0"
+      sources."core-util-is-1.0.2"
+      sources."cross-spawn-6.0.5"
+      sources."cssom-0.3.8"
+      sources."cssstyle-1.4.0"
+      sources."dashdash-1.14.1"
+      (sources."data-urls-1.1.0" // {
+        dependencies = [
+          sources."whatwg-url-7.1.0"
+        ];
+      })
+      sources."decamelize-1.2.0"
+      sources."deep-is-0.1.4"
+      sources."delayed-stream-1.0.0"
+      sources."domexception-1.0.1"
+      sources."ecc-jsbn-0.1.2"
+      sources."emoji-regex-8.0.0"
+      sources."end-of-stream-1.4.4"
+      sources."escalade-3.1.1"
+      sources."escodegen-1.14.3"
+      sources."esprima-4.0.1"
+      sources."estraverse-4.3.0"
+      sources."esutils-2.0.3"
+      sources."execa-1.0.0"
+      sources."extend-3.0.2"
+      sources."extsprintf-1.3.0"
+      sources."fast-deep-equal-3.1.3"
+      sources."fast-json-stable-stringify-2.1.0"
+      sources."fast-levenshtein-2.0.6"
+      sources."find-up-3.0.0"
+      sources."forever-agent-0.6.1"
+      sources."form-data-2.3.3"
+      sources."get-caller-file-1.0.3"
+      sources."get-stream-4.1.0"
+      sources."getpass-0.1.7"
+      sources."har-schema-2.0.0"
+      sources."har-validator-5.1.5"
+      sources."html-encoding-sniffer-1.0.2"
+      sources."http-signature-1.2.0"
+      sources."iconv-lite-0.4.24"
+      sources."invert-kv-2.0.0"
+      sources."is-fullwidth-code-point-2.0.0"
+      sources."is-stream-1.1.0"
+      sources."is-typedarray-1.0.0"
+      sources."isexe-2.0.0"
+      sources."isstream-0.1.2"
+      sources."jsbn-0.1.1"
+      sources."jsdom-11.12.0"
+      sources."json-schema-0.4.0"
+      sources."json-schema-traverse-0.4.1"
+      sources."json-stringify-safe-5.0.1"
+      sources."jsprim-1.4.2"
+      sources."lcid-2.0.0"
+      sources."left-pad-1.3.0"
+      sources."levn-0.3.0"
+      sources."locate-path-3.0.0"
+      sources."lodash-4.17.21"
+      sources."lodash.sortby-4.7.0"
+      sources."map-age-cleaner-0.1.3"
+      sources."mathjax-2.7.9"
+      sources."mathjax-node-2.1.1"
+      (sources."mathjax-node-sre-3.0.3" // {
+        dependencies = [
+          sources."yargs-12.0.5"
+        ];
+      })
+      sources."mem-4.3.0"
+      sources."mime-db-1.52.0"
+      sources."mime-types-2.1.35"
+      sources."mimic-fn-2.1.0"
+      sources."nice-try-1.0.5"
+      sources."npm-run-path-2.0.2"
+      sources."number-is-nan-1.0.1"
+      sources."nwsapi-2.2.7"
+      sources."oauth-sign-0.9.0"
+      sources."once-1.4.0"
+      sources."optionator-0.8.3"
+      sources."os-locale-3.1.0"
+      sources."p-defer-1.0.0"
+      sources."p-finally-1.0.0"
+      sources."p-is-promise-2.1.0"
+      sources."p-limit-2.3.0"
+      sources."p-locate-3.0.0"
+      sources."p-try-2.2.0"
+      sources."parse5-4.0.0"
+      sources."path-exists-3.0.0"
+      sources."path-key-2.0.1"
+      sources."performance-now-2.1.0"
+      sources."pn-1.1.0"
+      sources."prelude-ls-1.1.2"
+      sources."psl-1.9.0"
+      sources."pump-3.0.0"
+      sources."punycode-2.3.0"
+      sources."qs-6.5.3"
+      sources."request-2.88.2"
+      sources."request-promise-core-1.1.4"
+      sources."request-promise-native-1.0.9"
+      sources."require-directory-2.1.1"
+      sources."require-main-filename-1.0.1"
+      sources."safe-buffer-5.2.1"
+      sources."safer-buffer-2.1.2"
+      sources."sax-1.3.0"
+      sources."semver-5.7.2"
+      sources."set-blocking-2.0.0"
+      sources."shebang-command-1.2.0"
+      sources."shebang-regex-1.0.0"
+      sources."signal-exit-3.0.7"
+      sources."source-map-0.6.1"
+      sources."speech-rule-engine-2.4.0"
+      sources."sshpk-1.17.0"
+      sources."stealthy-require-1.1.1"
+      sources."string-width-2.1.1"
+      sources."strip-ansi-4.0.0"
+      sources."strip-eof-1.0.0"
+      sources."symbol-tree-3.2.4"
+      sources."tough-cookie-2.5.0"
+      sources."tr46-1.0.1"
+      sources."tunnel-agent-0.6.0"
+      sources."tweetnacl-0.14.5"
+      sources."type-check-0.3.2"
+      sources."uri-js-4.4.1"
+      sources."uuid-3.4.0"
+      sources."verror-1.10.0"
+      sources."w3c-hr-time-1.0.2"
+      sources."webidl-conversions-4.0.2"
+      sources."whatwg-encoding-1.0.5"
+      sources."whatwg-mimetype-2.3.0"
+      sources."whatwg-url-6.5.0"
+      sources."which-1.3.1"
+      sources."which-module-2.0.1"
+      sources."wicked-good-xpath-1.3.0"
+      sources."word-wrap-1.2.5"
+      (sources."wrap-ansi-2.1.0" // {
+        dependencies = [
+          sources."ansi-regex-2.1.1"
+          sources."is-fullwidth-code-point-1.0.0"
+          sources."string-width-1.0.2"
+          sources."strip-ansi-3.0.1"
+        ];
+      })
+      sources."wrappy-1.0.2"
+      sources."ws-5.2.3"
+      sources."xml-name-validator-3.0.0"
+      sources."xmldom-sre-0.1.31"
+      sources."y18n-4.0.3"
+      (sources."yargs-17.7.2" // {
+        dependencies = [
+          sources."ansi-regex-5.0.1"
+          sources."cliui-8.0.1"
+          sources."get-caller-file-2.0.5"
+          sources."is-fullwidth-code-point-3.0.0"
+          sources."string-width-4.2.3"
+          sources."strip-ansi-6.0.1"
+          sources."wrap-ansi-7.0.0"
+          sources."y18n-5.0.8"
+          sources."yargs-parser-21.1.1"
+        ];
+      })
+      sources."yargs-parser-11.1.1"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "CLI tools for calling mathjax-node";
+      homepage = "https://github.com/mathjax/mathjax-node-cli#readme";
+      license = "Apache-2.0";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   meat = nodeEnv.buildNodePackage {
     name = "meat";
     packageName = "meat";
diff --git a/pkgs/development/php-packages/opentelemetry/default.nix b/pkgs/development/php-packages/opentelemetry/default.nix
index 2bef82d8d8e9b..346a3cb369516 100644
--- a/pkgs/development/php-packages/opentelemetry/default.nix
+++ b/pkgs/development/php-packages/opentelemetry/default.nix
@@ -1,7 +1,7 @@
 { lib, buildPecl, fetchFromGitHub }:
 
 let
-  version = "1.0.0RC2";
+  version = "1.0.0RC3";
 in buildPecl {
   inherit version;
   pname = "opentelemetry";
@@ -10,7 +10,7 @@ in buildPecl {
     owner = "open-telemetry";
     repo = "opentelemetry-php-instrumentation";
     rev = version;
-    hash = "sha256-sCsJ4ZmQXTTG+ZxDzw3b6Su/8QUAVZv7vV6SuLBET+0=";
+    hash = "sha256-0jHXl+Amjv0vLSuSWhkGAU25pkRXbJgdx02N6o2dUyw=";
   };
 
   sourceRoot = "source/ext";
diff --git a/pkgs/development/php-packages/xdebug/default.nix b/pkgs/development/php-packages/xdebug/default.nix
index 61e83d9187655..3aa24ce15e43c 100644
--- a/pkgs/development/php-packages/xdebug/default.nix
+++ b/pkgs/development/php-packages/xdebug/default.nix
@@ -1,7 +1,7 @@
 { buildPecl, lib, fetchFromGitHub }:
 
 let
-  version = "3.2.2";
+  version = "3.3.0alpha3";
 in buildPecl {
   inherit version;
 
@@ -11,7 +11,7 @@ in buildPecl {
     owner = "xdebug";
     repo = "xdebug";
     rev = version;
-    hash = "sha256-zbgJw2oPzyUTK0UwLAqpShBi+toVsEQcjoG4tIBder0=";
+    hash = "sha256-LBrKQCR4qpV3yJpTknUNKX6mq+qSdBSveIoYmk5Vmoc=";
   };
 
   doCheck = true;
diff --git a/pkgs/development/python-modules/aioairzone-cloud/default.nix b/pkgs/development/python-modules/aioairzone-cloud/default.nix
index bdc21d70892f7..2108555b0d339 100644
--- a/pkgs/development/python-modules/aioairzone-cloud/default.nix
+++ b/pkgs/development/python-modules/aioairzone-cloud/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone-cloud";
-  version = "0.2.4";
+  version = "0.2.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone-cloud";
     rev = "refs/tags/${version}";
-    hash = "sha256-7sjiY20jDUHtEnqAMwEHsBboK9XCH5XjE0sHR82YvEA=";
+    hash = "sha256-v6cK4j16BhTqjdc5J9XQWGFCa1r9f0/dto9teVTNn0c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioairzone/default.nix b/pkgs/development/python-modules/aioairzone/default.nix
index ac094571d087d..39c12ac6e2c08 100644
--- a/pkgs/development/python-modules/aioairzone/default.nix
+++ b/pkgs/development/python-modules/aioairzone/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone";
-  version = "0.6.8";
+  version = "0.6.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.11";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-aCf0IO70t/QMmDmIwBKN3Um1HgHjHn1r6Dze/pWaQ5M=";
+    hash = "sha256-0nbH0pnTYRuSOkzG5Yn/fJmRKtXBMd6ti6Z+AW72j3Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioelectricitymaps/default.nix b/pkgs/development/python-modules/aioelectricitymaps/default.nix
new file mode 100644
index 0000000000000..502363de13c3a
--- /dev/null
+++ b/pkgs/development/python-modules/aioelectricitymaps/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, aiohttp
+, aresponses
+, buildPythonPackage
+, dataclasses-json
+, fetchFromGitHub
+, poetry-core
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+, syrupy
+}:
+
+buildPythonPackage rec {
+  pname = "aioelectricitymaps";
+  version = "0.1.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "jpbede";
+    repo = "aioelectricitymaps";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-2Ou3obpGRJ/iUPuaoBGlmDTJLx6+S8ivK9PbrbSvYyg=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    dataclasses-json
+  ];
+
+  nativeCheckInputs = [
+    aresponses
+    pytest-asyncio
+    pytestCheckHook
+    syrupy
+  ];
+
+  pythonImportsCheck = [
+    "aioelectricitymaps"
+  ];
+
+  meta = with lib; {
+    description = "Module for interacting with Electricity maps";
+    homepage = "https://github.com/jpbede/aioelectricitymaps";
+    changelog = "https://github.com/jpbede/aioelectricitymaps/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 79ef028fd36ee..c77a4dfadda50 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "17.2.0";
+  version = "18.0.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+yPHIXJ0vHaFO2X3xN+7WIQUlCvoYlGi1N7W+H/ng/0=";
+    hash = "sha256-Jgu9NEFY74Z0mZ2Cz4uaHG0gfywa2nF/H8G1j9YAyrw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index 7eb2a64d38e61..644c3cda08012 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "3.0.5";
+  version = "3.0.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Rux3fRP1lM42i42K24t27DwAadi+NRJJHDhPAjZXb7s=";
+    hash = "sha256-e7KSgUOEA3iAR4QdUhjYcHsPdtCJRxu6u+uxuDMaghQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/annotated-types/default.nix b/pkgs/development/python-modules/annotated-types/default.nix
index 645e3c40c48c2..85e2379507c6c 100644
--- a/pkgs/development/python-modules/annotated-types/default.nix
+++ b/pkgs/development/python-modules/annotated-types/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "annotated-types";
-  version = "0.5.0";
+  version = "0.6.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "annotated-types";
     repo = "annotated-types";
-    rev = "v${version}";
-    hash = "sha256-zCsWfJ8BQuov8FN+hlm9XBKWAAQ/KHPK/x024A8k2kE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-SZ9/rXYcns4DFM6vk6SRKvuv3MY3T7xO9aW7WAQqtVE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/argilla/default.nix b/pkgs/development/python-modules/argilla/default.nix
index 8ac1ccdc65f8e..8179d054a97f3 100644
--- a/pkgs/development/python-modules/argilla/default.nix
+++ b/pkgs/development/python-modules/argilla/default.nix
@@ -65,7 +65,7 @@
 }:
 let
   pname = "argilla";
-  version = "1.16.0";
+  version = "1.17.0";
   optional-dependencies = {
     server = [
       fastapi
@@ -126,7 +126,7 @@ buildPythonPackage {
     owner = "argilla-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-SKxIc7T9wmMMGQeebcRVOrB4Y5ETz9LSeKzzqI+wf80=";
+    hash = "sha256-ggw6ABPn3d+aOj+0ETKYWWTha/2Recdnp/LGBXG1HY4=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/asdf-transform-schemas/default.nix b/pkgs/development/python-modules/asdf-transform-schemas/default.nix
index 545062e0dd5a2..d00e43e756a39 100644
--- a/pkgs/development/python-modules/asdf-transform-schemas/default.nix
+++ b/pkgs/development/python-modules/asdf-transform-schemas/default.nix
@@ -9,15 +9,15 @@
 
 buildPythonPackage rec {
   pname = "asdf-transform-schemas";
-  version = "0.3.0";
-  format = "pyproject";
+  version = "0.4.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "asdf_transform_schemas";
     inherit version;
-    hash = "sha256-DPL/eyLMtAj+WN3ZskQaWbpz/jI+QW1ZueCkcop9LdY=";
+    hash = "sha256-3n/cP+41+5V/wylXh3oOnX3U0uhRvWMaclnxHCvSlMo=";
   };
 
   nativeBuildInputs = [
@@ -40,6 +40,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "ASDF schemas for validating transform tags";
     homepage = "https://github.com/asdf-format/asdf-transform-schemas";
+    changelog = "https://github.com/asdf-format/asdf-transform-schemas/releases/tag/${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/async-upnp-client/default.nix b/pkgs/development/python-modules/async-upnp-client/default.nix
index 03b7e8664c467..c51c99d00f0b4 100644
--- a/pkgs/development/python-modules/async-upnp-client/default.nix
+++ b/pkgs/development/python-modules/async-upnp-client/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "async-upnp-client";
-  version = "0.36.1";
+  version = "0.36.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "StevenLooman";
     repo = "async_upnp_client";
     rev = "refs/tags/${version}";
-    hash = "sha256-NFSJlBRVgeuhK7IXjNz2g6SbSgveSjaJpSQrxSACG04=";
+    hash = "sha256-f3x5adxLHT/C5dXfdBH6stKv0y2nuhbpe8jkJex1DKU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/asyncwhois/default.nix b/pkgs/development/python-modules/asyncwhois/default.nix
index 25cb21e7e2464..e462a0d0b49c1 100644
--- a/pkgs/development/python-modules/asyncwhois/default.nix
+++ b/pkgs/development/python-modules/asyncwhois/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "asyncwhois";
-  version = "1.0.8";
+  version = "1.0.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "pogzyb";
     repo = "asyncwhois";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fYXxoS4bGTat5QT98ETmWk/VKXJmg9mtkUu02SZT4Eo=";
+    hash = "sha256-5T/h4YzODH7zFyQpG8qVZetTK7V+Ii9jc+MQFgMUA8w=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index fd389308c9315..fd389308c9315 100755..100644
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
diff --git a/pkgs/development/python-modules/aws-adfs/default.nix b/pkgs/development/python-modules/aws-adfs/default.nix
index 85a4f6bbe6808..3a32d82ec9357 100644
--- a/pkgs/development/python-modules/aws-adfs/default.nix
+++ b/pkgs/development/python-modules/aws-adfs/default.nix
@@ -5,7 +5,6 @@
 , click
 , configparser
 , fetchFromGitHub
-, fetchpatch
 , fido2
 , lxml
 , poetry-core
@@ -19,16 +18,16 @@
 
 buildPythonPackage rec {
   pname = "aws-adfs";
-  version = "2.2.1";
-  format = "pyproject";
+  version = "2.8.1";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "venth";
     repo = pname;
-    rev = "refs/tags/${version}";
-    hash = "sha256-REJYuOGq22onMj4WcfA7i4/cG99UGZA9D99ESIKY1A8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-tpCDP924lNSaPJggj3A94U2Ur+TgxTXtV660OyQJEeY=";
   };
 
   nativeBuildInputs = [
@@ -47,20 +46,6 @@ buildPythonPackage rec {
     requests-kerberos
   ];
 
-  patches = [
-    # Apply new fido2 api (See: venth/aws-adfs#243)
-    (fetchpatch {
-      url = "https://github.com/venth/aws-adfs/commit/09836d89256f3537270d760d8aa30ab9284725a8.diff";
-      hash = "sha256-pAAJvOa43BXtyWvV8hsLe2xqd5oI+vzndckRTRol61s=";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'boto3 = "^1.20.50"' 'boto3 = "*"' \
-      --replace 'botocore = ">=1.12.6"' 'botocore = "*"'
-  '';
-
   nativeCheckInputs = [
     pytestCheckHook
     toml
@@ -77,6 +62,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Command line tool to ease AWS CLI authentication against ADFS";
     homepage = "https://github.com/venth/aws-adfs";
+    changelog = "https://github.com/venth/aws-adfs/releases/tag/v${version}";
     license = licenses.psfl;
     maintainers = with maintainers; [ bhipple ];
   };
diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index 2566e8e02e616..13cc8d9917742 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.36.6";
+  version = "0.36.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "bellows";
     rev = "refs/tags/${version}";
-    hash = "sha256-ThLUWcGMTHg/ASKiL19iLe+9hq7KybWm+38PdoDhWvk=";
+    hash = "sha256-j7Awqt14/J0BbYcKwIR10UtVeqt9BpQkzT8dqGRVEOU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bespon/default.nix b/pkgs/development/python-modules/bespon/default.nix
index da6820ef6ecc2..a942651dcb73e 100644
--- a/pkgs/development/python-modules/bespon/default.nix
+++ b/pkgs/development/python-modules/bespon/default.nix
@@ -1,18 +1,20 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 }:
 
 buildPythonPackage rec {
-  version = "0.6.0";
-  pname = "BespON";
+  version = "0.7.0";
+  pname = "bespon";
+  format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2f2bda67fea8ee95c8aa7e885835ab88bdbfa392a94077ce1c9d29017420ce7a";
+    hash = "sha256-dGtXw4uq6pdyXBVfSi9s7kCFUqA1PO7qWEGY0JNAz8Q=";
   };
 
-  propagatedBuildInputs = [ ];
+  nativeBuildInputs = [ setuptools ];
   # upstream doesn't contain tests
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/bimmer-connected/default.nix b/pkgs/development/python-modules/bimmer-connected/default.nix
index 40f7ad7cf8ab4..470eaf376a771 100644
--- a/pkgs/development/python-modules/bimmer-connected/default.nix
+++ b/pkgs/development/python-modules/bimmer-connected/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "bimmer-connected";
-  version = "0.14.1";
+  version = "0.14.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "bimmerconnected";
     repo = "bimmer_connected";
     rev = "refs/tags/${version}";
-    hash = "sha256-Fo30qDBqVxVuD/Ow0jsvN20Hx7Zhvie47CE+1ys1ewU=";
+    hash = "sha256-69H0hB+yVmyzJ5A2Cb7ZcaaoRzMt618U+TUHYQ03/cY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bleak/default.nix b/pkgs/development/python-modules/bleak/default.nix
index 61a069305d136..f53f614867ec1 100644
--- a/pkgs/development/python-modules/bleak/default.nix
+++ b/pkgs/development/python-modules/bleak/default.nix
@@ -25,6 +25,12 @@ buildPythonPackage rec {
     hash = "sha256-T0im8zKyNLbskAEDeUUFS/daJtvttlHlttjscqP8iSk=";
   };
 
+  postPatch = ''
+    # bleak checks BlueZ's version with a call to `bluetoothctl --version`
+    substituteInPlace bleak/backends/bluezdbus/version.py \
+      --replace \"bluetoothctl\" \"${bluez}/bin/bluetoothctl\"
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -40,12 +46,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    # bleak checks BlueZ's version with a call to `bluetoothctl --version`
-    substituteInPlace bleak/backends/bluezdbus/__init__.py \
-      --replace \"bluetoothctl\" \"${bluez}/bin/bluetoothctl\"
-  '';
-
   pythonImportsCheck = [
     "bleak"
   ];
diff --git a/pkgs/development/python-modules/cantools/default.nix b/pkgs/development/python-modules/cantools/default.nix
new file mode 100644
index 0000000000000..3cb260dd8d1bb
--- /dev/null
+++ b/pkgs/development/python-modules/cantools/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools-scm
+, argparse-addons
+, bitstruct
+, can
+, crccheck
+, diskcache
+, matplotlib
+, parameterized
+, pytestCheckHook
+, pythonOlder
+, textparser
+}:
+
+buildPythonPackage rec {
+  pname = "cantools";
+  version = "38.0.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-k7/m9L1lLzaXY+qRYrAnpi9CSoQA8kI9QRN5GM5oxo4=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    argparse-addons
+    bitstruct
+    can
+    crccheck
+    diskcache
+    matplotlib
+    textparser
+  ];
+
+  nativeCheckInputs = [
+    parameterized
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "cantools"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/cantools/cantools";
+    description = "CAN bus tools.";
+    license = licenses.mit;
+    maintainers = with maintainers; [ gray-heron ];
+  };
+}
diff --git a/pkgs/development/python-modules/certbot-dns-ovh/default.nix b/pkgs/development/python-modules/certbot-dns-ovh/default.nix
new file mode 100644
index 0000000000000..da0dd57cff874
--- /dev/null
+++ b/pkgs/development/python-modules/certbot-dns-ovh/default.nix
@@ -0,0 +1,39 @@
+{ buildPythonPackage
+, acme
+, certbot
+, dns-lexicon
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "certbot-dns-ovh";
+
+  inherit (certbot) src version;
+  disabled = pythonOlder "3.6";
+
+  sourceRoot = "${src.name}/certbot-dns-ovh";
+
+  propagatedBuildInputs = [
+    acme
+    certbot
+    dns-lexicon
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "-o cache_dir=$(mktemp -d)"
+
+    # Monitor https://github.com/certbot/certbot/issues/9606 for a solution
+    "-W 'ignore:pkg_resources is deprecated as an API:DeprecationWarning'"
+    "-W 'ignore:Package lexicon.providers is deprecated and will be removed in Lexicon 4>=.:DeprecationWarning'"
+    "-W 'ignore:Legacy configuration object has been used to load the ConfigResolver.:DeprecationWarning'"
+  ];
+
+  meta = certbot.meta // {
+    description = "OVH DNS Authenticator plugin for Certbot";
+  };
+}
diff --git a/pkgs/development/python-modules/chex/default.nix b/pkgs/development/python-modules/chex/default.nix
index 047073587b261..6bee1641242c0 100644
--- a/pkgs/development/python-modules/chex/default.nix
+++ b/pkgs/development/python-modules/chex/default.nix
@@ -15,16 +15,16 @@
 
 buildPythonPackage rec {
   pname = "chex";
-  version = "0.1.83";
+  version = "0.1.84";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "deepmind";
-    repo = pname;
+    repo = "chex";
     rev = "refs/tags/v${version}";
-    hash = "sha256-iEachJf5NjOnkMWdP0aVQHWNPgUUBkMnzHKq3GP7t4w=";
+    hash = "sha256-LsUMvSMVGjqZuFDcb+/61RtFxweeG6bSFzmJUUMv6rA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/crytic-compile/default.nix b/pkgs/development/python-modules/crytic-compile/default.nix
index 4e725dd8cde2c..26e7080c21399 100644
--- a/pkgs/development/python-modules/crytic-compile/default.nix
+++ b/pkgs/development/python-modules/crytic-compile/default.nix
@@ -6,20 +6,21 @@
 , pythonOlder
 , setuptools
 , solc-select
+, toml
 }:
 
 buildPythonPackage rec {
   pname = "crytic-compile";
-  version = "0.3.4";
+  version = "0.3.5";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "crytic";
     repo = "crytic-compile";
     rev = "refs/tags/${version}";
-    hash = "sha256-CeoACtgvMweDbIvYguK2Ca+iTBFONWcE2b0qUkBbQSU=";
+    hash = "sha256-aO2K0lc3qjKK8CZAbu/lotI5QJ/R+8npSIRX4a6HdrI=";
   };
 
   propagatedBuildInputs = [
@@ -27,6 +28,7 @@ buildPythonPackage rec {
     pycryptodome
     setuptools
     solc-select
+    toml
   ];
 
   # Test require network access
diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index b5d2ce8eef71d..4394271f7ebd2 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "2.11.1";
+  version = "2.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-oYBk+Rko5qK1k2TJdDNiN0rWdx7sdy6UpxMlDynKZ9Y=";
+    hash = "sha256-ZeDQn+/b6WBCodZ7Ow5IlC9XlWieAifCMJtM1yse5P8=";
   };
 
   # The project can build both an optimized cython version and an unoptimized
diff --git a/pkgs/development/python-modules/desktop-entry-lib/default.nix b/pkgs/development/python-modules/desktop-entry-lib/default.nix
new file mode 100644
index 0000000000000..5a6d3c00e7f03
--- /dev/null
+++ b/pkgs/development/python-modules/desktop-entry-lib/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, pytestCheckHook
+, fetchFromGitea
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "desktop-entry-lib";
+  version = "3.1";
+  pyproject = true;
+  disabled = pythonOlder "3.9";
+
+  # We could use fetchPypi, but then the tests won't run
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "JakobDev";
+    repo = pname;
+    rev = version;
+    hash = "sha256-+c+FuLv88wc4yVw3iyFFtfbocnWzTCIe2DS0SWoj+VI=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+  nativeCheckInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "desktop_entry_lib" ];
+
+  meta = with lib; {
+    description = "Allows reading and writing .desktop files according to the Desktop Entry Specification";
+    homepage = "https://codeberg.org/JakobDev/desktop-entry-lib";
+    changelog = "https://codeberg.org/JakobDev/desktop-entry-lib/releases/tag/${version}";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ Madouura ];
+  };
+}
diff --git a/pkgs/development/python-modules/dramatiq/default.nix b/pkgs/development/python-modules/dramatiq/default.nix
new file mode 100644
index 0000000000000..8b7300d786f5f
--- /dev/null
+++ b/pkgs/development/python-modules/dramatiq/default.nix
@@ -0,0 +1,106 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, gevent
+, pika
+, prometheus-client
+, pylibmc
+, pytestCheckHook
+, redis
+, watchdog
+, watchdog-gevent
+}:
+
+buildPythonPackage rec {
+  pname = "dramatiq";
+  version = "1.14.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "Bogdanp";
+    repo = "dramatiq";
+    rev = "v${version}";
+    hash = "sha256-yv6HUJI7wsAQdBJ5QNv7qXhtzPvCsrF1389kyemAV7Y=";
+  };
+
+  propagatedBuildInputs = [
+    prometheus-client
+  ];
+
+  passthru.optional-dependencies = {
+    all = [
+      gevent
+      pika
+      pylibmc
+      redis
+      watchdog
+      watchdog-gevent
+    ];
+    gevent = [
+      gevent
+    ];
+    memcached = [
+      pylibmc
+    ];
+    rabbitmq = [
+      pika
+    ];
+    redis = [
+      redis
+    ];
+    watch = [
+      watchdog
+      watchdog-gevent
+    ];
+  };
+
+  nativeCheckInputs = [ pytestCheckHook pika redis pylibmc ];
+
+  postPatch = ''
+    sed -i ./setup.cfg \
+      -e 's:--cov dramatiq::' \
+      -e 's:--cov-report html::' \
+      -e 's:--benchmark-autosave::' \
+      -e 's:--benchmark-compare::' \
+  '';
+
+  disabledTests = [
+    # Requires a running redis
+    "test_after_process_boot_call_has_no_blocked_signals"
+    "test_cli_can_be_reloaded_on_sighup"
+    "test_cli_can_watch_for_source_code_changes"
+    "test_cli_fork_functions_have_no_blocked_signals"
+    "test_consumer_threads_have_no_blocked_signals"
+    "test_middleware_fork_functions_have_no_blocked_signals"
+    "test_redis_broker_can_connect_via_client"
+    "test_redis_broker_can_connect_via_url"
+    "test_redis_process_100k_messages_with_cli"
+    "test_redis_process_10k_fib_with_cli"
+    "test_redis_process_1k_latency_with_cli"
+    "test_worker_threads_have_no_blocked_signals"
+    # Requires a running rabbitmq
+    "test_rabbitmq_broker_can_be_passed_a_list_of_parameters_for_failover"
+    "test_rabbitmq_broker_can_be_passed_a_list_of_uri_for_failover"
+    "test_rabbitmq_broker_can_be_passed_a_semicolon_separated_list_of_uris"
+    "test_rabbitmq_broker_connections_are_lazy"
+    "test_rabbitmq_process_100k_messages_with_cli"
+    "test_rabbitmq_process_10k_fib_with_cli"
+    "test_rabbitmq_process_1k_latency_with_cli"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Takes too long for darwin ofborg
+    "test_retry_exceptions_can_specify_a_delay"
+  ];
+
+  pythonImportsCheck = [ "dramatiq" ];
+
+  meta = with lib; {
+    description = "Background Processing for Python 3";
+    homepage = "https://github.com/Bogdanp/dramatiq";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
index e9aac74d835e7..5ff9956849926 100644
--- a/pkgs/development/python-modules/duckdb/default.nix
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -13,17 +13,19 @@
 }:
 
 buildPythonPackage rec {
-  inherit (duckdb) pname version src patches;
+  inherit (duckdb) pname version src;
   format = "setuptools";
 
-  postPatch = ''
+  # 1. let nix control build cores
+  # 2. default to extension autoload & autoinstall disabled
+  # 3. unconstrain setuptools_scm version
+  patches = (duckdb.patches or []) ++ [ ./setup.patch ];
+
+  postPatch = (duckdb.postPatch or "") + ''
     # we can't use sourceRoot otherwise patches don't apply, because the patches apply to the C++ library
     cd tools/pythonpkg
 
-    # 1. let nix control build cores
-    # 2. unconstrain setuptools_scm version
-    substituteInPlace setup.py \
-      --replace "multiprocessing.cpu_count()" "$NIX_BUILD_CORES"
+    substituteInPlace setup.py --subst-var NIX_BUILD_CORES
 
     # avoid dependency on mypy
     rm tests/stubs/test_stubs.py
@@ -54,6 +56,8 @@ buildPythonPackage rec {
   disabledTests = [
     # tries to make http request
     "test_install_non_existent_extension"
+    # test is racy and interrupt can be delivered before or after target point
+    "test_connection_interrupt"
   ];
 
   preCheck = ''
diff --git a/pkgs/development/python-modules/duckdb/setup.patch b/pkgs/development/python-modules/duckdb/setup.patch
new file mode 100644
index 0000000000000..8c8f790a66a1d
--- /dev/null
+++ b/pkgs/development/python-modules/duckdb/setup.patch
@@ -0,0 +1,30 @@
+diff --git a/tools/pythonpkg/setup.py b/tools/pythonpkg/setup.py
+index 30f1e1ccdd..6784169fcb 100644
+--- a/tools/pythonpkg/setup.py
++++ b/tools/pythonpkg/setup.py
+@@ -96,7 +96,7 @@ def parallel_cpp_compile(
+             return
+         self._compile(obj, src, ext, cc_args, extra_postargs, pp_opts)
+ 
+-    list(multiprocessing.pool.ThreadPool(multiprocessing.cpu_count()).imap(_single_compile, objects))
++    list(multiprocessing.pool.ThreadPool(@NIX_BUILD_CORES@).imap(_single_compile, objects))
+     return objects
+ 
+ 
+@@ -163,7 +163,6 @@ if 'BUILD_HTTPFS' in os.environ:
+ for ext in extensions:
+     toolchain_args.extend(['-DDUCKDB_EXTENSION_{}_LINKED'.format(ext.upper())])
+ 
+-toolchain_args.extend(['-DDUCKDB_EXTENSION_AUTOLOAD_DEFAULT=1', '-DDUCKDB_EXTENSION_AUTOINSTALL_DEFAULT=1'])
+ 
+ 
+ class get_pybind_include(object):
+@@ -348,7 +347,7 @@ setup(
+     packages=packages,
+     include_package_data=True,
+     python_requires='>=3.7.0',
+-    setup_requires=setup_requires + ["setuptools_scm<7.0.0", 'pybind11>=2.6.0'],
++    setup_requires=setup_requires + ["setuptools_scm", 'pybind11>=2.6.0'],
+     use_scm_version=setuptools_scm_conf,
+     tests_require=['google-cloud-storage', 'mypy', 'pytest'],
+     classifiers=[
diff --git a/pkgs/development/python-modules/elgato/default.nix b/pkgs/development/python-modules/elgato/default.nix
index 92b4cad66b5cd..3aeab819b76a5 100644
--- a/pkgs/development/python-modules/elgato/default.nix
+++ b/pkgs/development/python-modules/elgato/default.nix
@@ -13,18 +13,25 @@
 
 buildPythonPackage rec {
   pname = "elgato";
-  version = "4.0.1";
+  version = "5.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-elgato";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kyFnc/lMxgYy8s/gAP5vpEPV8a+dphOummr6G7deGQ4=";
+    hash = "sha256-TI5wu2FYVUMvgDkbktcwPLnTSD8XUSy8qwOCdrsiopk=";
   };
 
+  postPatch = ''
+    # Upstream doesn't set a version for the pyproject.toml
+    substituteInPlace pyproject.toml \
+      --replace "0.0.0" "${version}" \
+      --replace "--cov" ""
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -41,13 +48,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    # Upstream doesn't set a version for the pyproject.toml
-    substituteInPlace pyproject.toml \
-      --replace "0.0.0" "${version}" \
-      --replace "--cov" ""
-  '';
-
   pythonImportsCheck = [
     "elgato"
   ];
@@ -55,6 +55,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python client for Elgato Key Lights";
     homepage = "https://github.com/frenck/python-elgato";
+    changelog = "https://github.com/frenck/python-elgato/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/flask-dramatiq/default.nix b/pkgs/development/python-modules/flask-dramatiq/default.nix
new file mode 100644
index 0000000000000..6f8884516f498
--- /dev/null
+++ b/pkgs/development/python-modules/flask-dramatiq/default.nix
@@ -0,0 +1,85 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitLab
+, poetry-core
+, dramatiq
+, flask
+, requests
+, pytestCheckHook
+, flask-migrate
+, periodiq
+, postgresql
+, postgresqlTestHook
+, psycopg2
+}:
+
+buildPythonPackage {
+  pname = "flask-dramatiq";
+  version = "0.6.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitLab {
+    owner = "bersace";
+    repo = "flask-dramatiq";
+    rev = "840209e9bf582b4dda468e8bba515f248f3f8534";
+    hash = "sha256-qjV1zyVzHPXMt+oUeGBdP9XVlbcSz2MF9Zygj543T4w=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'poetry>=0.12' 'poetry-core' \
+      --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
+
+    patchShebangs --build ./example.py
+
+    sed -i ./tests/unit/pytest.ini \
+      -e 's:--cov=flask_dramatiq::' \
+      -e 's:--cov-report=term-missing::'
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    dramatiq
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    flask
+    requests
+    flask-migrate
+    periodiq
+    postgresql
+    postgresqlTestHook
+    psycopg2
+  ] ++ dramatiq.optional-dependencies.rabbitmq;
+
+  postgresqlTestSetupPost = ''
+    substituteInPlace config.py \
+      --replace 'SQLALCHEMY_DATABASE_URI = f"postgresql://{PGUSER}:{PGPASSWORD}@{PGHOST}/{PGDATABASE}"' \
+        "SQLALCHEMY_DATABASE_URI = \"postgresql://$PGUSER/$PGDATABASE?host=$PGHOST\""
+    python3 ./example.py db upgrade
+  '';
+
+  pytestFlagsArray = [ "-x" "tests/func/" "tests/unit"];
+
+  pythonImportsCheck = [ "flask_dramatiq" ];
+
+  # Does HTTP requests to localhost
+  disabledTests = [
+    "test_fast"
+    "test_other"
+  ];
+
+  meta = with lib; {
+    description = "Adds Dramatiq support to your Flask application";
+    homepage = "https://gitlab.com/bersace/flask-dramatiq";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/fnv-hash-fast/default.nix b/pkgs/development/python-modules/fnv-hash-fast/default.nix
index 7fe9ba92b638c..01e57845d3bb1 100644
--- a/pkgs/development/python-modules/fnv-hash-fast/default.nix
+++ b/pkgs/development/python-modules/fnv-hash-fast/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "fnv-hash-fast";
-  version = "0.4.1";
+  version = "0.5.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "fnv-hash-fast";
     rev = "v${version}";
-    hash = "sha256-vKv3Hfla+U1teYVB+w8ONj0Ur996noanbg6aaJ6S6+I=";
+    hash = "sha256-gAHCssJC6sTR6ftkQHrtF/5Nf9dXE4ykRhVusb0Gu3I=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/fypp/default.nix b/pkgs/development/python-modules/fypp/default.nix
index 9504a5839e733..a75e141361a86 100644
--- a/pkgs/development/python-modules/fypp/default.nix
+++ b/pkgs/development/python-modules/fypp/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "fypp";
-  version = "3.1";
+  version = "3.2";
 
   src = fetchFromGitHub {
     owner = "aradi";
     repo = pname;
     rev = version;
-    hash = "sha256-iog5Gdcd1F230Nl4JDrKoyYr8JualVgNZQzHLzd4xe8=";
+    hash = "sha256-MgGVlOqOIrIVoDfBMVpFLT26mhYndxans2hfo/+jdoA=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/google-cloud-asset/default.nix b/pkgs/development/python-modules/google-cloud-asset/default.nix
index f38a83a2c0872..c430d23c32f6b 100644
--- a/pkgs/development/python-modules/google-cloud-asset/default.nix
+++ b/pkgs/development/python-modules/google-cloud-asset/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-asset";
-  version = "3.19.1";
+  version = "3.20.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Rmd01HHVOThqSwfnoIrTaMjxqHFuGcKAjwKp3hD4S5o=";
+    hash = "sha256-lJLC1igiY0OYLu3eyuOvJ2KmFr9n4su8T7LPgWlUtCk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-automl/default.nix b/pkgs/development/python-modules/google-cloud-automl/default.nix
index fcbddee2fdde0..b12ee489cc29f 100644
--- a/pkgs/development/python-modules/google-cloud-automl/default.nix
+++ b/pkgs/development/python-modules/google-cloud-automl/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-automl";
-  version = "2.11.2";
+  version = "2.11.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-w4kzOe8az6zcMLoNYbfkvC5Aq5zCbSNw6+PHYZkEZqI=";
+    hash = "sha256-VcqQn7w2sTpDHKfniwkwsEXDa8YIV+G1jlbPOu8NVl0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gpaw/default.nix b/pkgs/development/python-modules/gpaw/default.nix
index 913f1616a07d4..e359c78c66f86 100644
--- a/pkgs/development/python-modules/gpaw/default.nix
+++ b/pkgs/development/python-modules/gpaw/default.nix
@@ -74,13 +74,13 @@ let
 
 in buildPythonPackage rec {
   pname = "gpaw";
-  version = "22.8.0";
+  version = "23.9.1";
 
   src = fetchFromGitLab {
     owner = "gpaw";
     repo = pname;
     rev = version;
-    hash = "sha256-Kgf8yuGua7mcGP+jVVmbE8JCsbrfzewRTRt3ihq9YX4=";
+    hash = "sha256-9nnK4ksTFATO6HexnxfMiih/yoY/noyJZXZOaDG/2kc=";
   };
 
   # `inetutils` is required because importing `gpaw`, as part of
diff --git a/pkgs/development/python-modules/guppy3/default.nix b/pkgs/development/python-modules/guppy3/default.nix
index c47fb6a80425c..65d7c2622a8ef 100644
--- a/pkgs/development/python-modules/guppy3/default.nix
+++ b/pkgs/development/python-modules/guppy3/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "guppy3";
-  version = "3.1.3";
+  version = "3.1.4";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "zhuyifei1999";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-i3WqXlNnNhBVw9rdnxnzQISFkZHBpc/gqG+rxOWPiyc=";
+    hash = "sha256-RMWIP4tVSCCEQpr0kZvsN1HwL6rBcLuubfBl175eSNg=";
   };
 
   propagatedBuildInputs = [ tkinter ];
diff --git a/pkgs/development/python-modules/jax/default.nix b/pkgs/development/python-modules/jax/default.nix
index 9453ba1c0c6c5..d9293e0734801 100644
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@@ -27,17 +27,17 @@ let
 in
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.4.18";
+  version = "0.4.19";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "google";
-    repo = pname;
+    repo = "jax";
     # google/jax contains tags for jax and jaxlib. Only use jax tags!
     rev = "refs/tags/${pname}-v${version}";
-    hash = "sha256-rDvWHa8jYCAA9iKbWaFUXdE/9L7AepFiNzmqOcc/090=";
+    hash = "sha256-l5uLPqhg/hqtO9oJSaioow5cH/0jKHDVziGezkfnVcc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix
index 68a1275246aa0..8b673d6040d53 100644
--- a/pkgs/development/python-modules/jaxlib/bin.nix
+++ b/pkgs/development/python-modules/jaxlib/bin.nix
@@ -39,7 +39,7 @@ in
 assert cudaSupport -> lib.versionAtLeast cudatoolkit.version "11.1" && lib.versionAtLeast cudnn.version "8.2" && stdenv.isLinux;
 
 let
-  version = "0.4.18";
+  version = "0.4.19";
 
   inherit (python) pythonVersion;
 
@@ -60,15 +60,15 @@ let
     {
       "x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
-        hash = "sha256-MpNomovvSVx4N6gsowOLksTyEgTK261vSXMGxYqlVOE=";
+        hash = "sha256-ksnY+CPEstact5lKjbSg+ZSPJtSt0Y0NFWEFufBCByk=";
       };
       "aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
-        hash = "sha256-if/5O5DQVHFdsLw9O1creZBx5j8ftE7fsWMMX1NjHP0=";
+        hash = "sha256-O7dHvdKLKfNELGfF4TKy7N5EX6Ca7Zu8OtLXWvFykR8=";
       };
       "x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
-        hash = "sha256-4NeHA/0SGdmHXyDGxpK7oJc7dE1meR4LPjzbIwxloqU=";
+        hash = "sha256-gqKMUZSXrt8sQtTAoQbzAfCzO8gM9Y1/tZpuJVWyN0Y=";
       };
     };
 
@@ -78,7 +78,7 @@ let
   # https://github.com/google/jax/issues/12879 as to why this specific URL is the correct index.
   gpuSrc = fetchurl {
     url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp310-cp310-manylinux2014_x86_64.whl";
-    hash = "sha256-p6BNvhhRzVDQdpEoIRau5JovC+eDjlW3bXrahtsGvmI=";
+    hash = "sha256-zfN0n31+5GohwBkeQrqHus4qOyhM/GEdqG6KUupCZ4o=";
   };
 
 in
diff --git a/pkgs/development/python-modules/jaxlib/default.nix b/pkgs/development/python-modules/jaxlib/default.nix
index 35d56ff1a1eb6..d02cb0aa5dee2 100644
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@@ -54,7 +54,7 @@ let
   inherit (cudaPackages) backendStdenv cudatoolkit cudaFlags cudnn nccl;
 
   pname = "jaxlib";
-  version = "0.4.18";
+  version = "0.4.19";
 
   meta = with lib; {
     description = "JAX is Autograd and XLA, brought together for high-performance machine learning research.";
@@ -151,7 +151,7 @@ let
       repo = "jax";
       # google/jax contains tags for jax and jaxlib. Only use jaxlib tags!
       rev = "refs/tags/${pname}-v${version}";
-      hash = "sha256-rDvWHa8jYCAA9iKbWaFUXdE/9L7AepFiNzmqOcc/090=";
+      hash = "sha256-l5uLPqhg/hqtO9oJSaioow5cH/0jKHDVziGezkfnVcc=";
     };
 
     nativeBuildInputs = [
@@ -264,10 +264,10 @@ let
       ];
 
       sha256 = (if cudaSupport then {
-        x86_64-linux = "sha256-0CfGWlwKsUFP1DHUN6+6wX3cHr5x3TE6NbqYlV5me1E=";
+        x86_64-linux = "sha256-Z5cSgdRxdKxidaz4b1RlUF4rVcQiUTmQ1OorlBWlpt0=";
       } else {
-        x86_64-linux = "sha256-sljmyIligXC7d9fdlpqR32xyMR0UslWs04gXJBD8FTA=";
-        aarch64-linux = "sha256-eJ4KIkHdcA2EVvyBoNum2cOPcHPFoBOtUTAGufO8FJA=";
+        x86_64-linux = "sha256-sn7p8FFHWIVdBWnsLsVj5jLiSaTlRm7s/qj2RqvQ3jU=";
+        aarch64-linux = "sha256-oAYF5AeuPHTlwtpDMs2+tAhRAJH0yeSVnB7Ni7wmzS8=";
       }).${stdenv.system} or (throw "jaxlib: unsupported system: ${stdenv.system}");
     };
 
diff --git a/pkgs/development/python-modules/logilab/common.nix b/pkgs/development/python-modules/logilab/common.nix
index 9467f003c7039..b03fd98eefe80 100644
--- a/pkgs/development/python-modules/logilab/common.nix
+++ b/pkgs/development/python-modules/logilab/common.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "logilab-common";
-  version = "1.10.0";
+  version = "1.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MoXt3tta5OimJUjOkWSMDCmXV0aS8N0W5bcANwAelYY=";
+    hash = "sha256-lWl6654nbOBCec24iJ7GGKEcYy/gYDn9wMil3PPqWkk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/lsprotocol/default.nix b/pkgs/development/python-modules/lsprotocol/default.nix
index a2e17eb400421..5ee4d3ed11260 100644
--- a/pkgs/development/python-modules/lsprotocol/default.nix
+++ b/pkgs/development/python-modules/lsprotocol/default.nix
@@ -4,6 +4,7 @@
 , cattrs
 , fetchFromGitHub
 , flit-core
+, importlib-resources
 , jsonschema
 , nox
 , pyhamcrest
@@ -13,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "lsprotocol";
-  version = "2023.0.0a2";
+  version = "2023.0.0b1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +23,7 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-AEvs2fb8nhWEFMyLvwNv9HoxxxE50/KW3TGZ5pDf4dc=";
+    hash = "sha256-Y/Mp/8MskRB6irNU3CBOKmo2Zt5S69h+GyMg71sQ9Uw=";
   };
 
   nativeBuildInputs = [
@@ -40,6 +41,7 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    importlib-resources
     jsonschema
     pyhamcrest
   ];
diff --git a/pkgs/development/python-modules/num2words/default.nix b/pkgs/development/python-modules/num2words/default.nix
index 82ba5a8cec109..c43cb81eb2fc7 100644
--- a/pkgs/development/python-modules/num2words/default.nix
+++ b/pkgs/development/python-modules/num2words/default.nix
@@ -7,12 +7,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.5.12";
+  version = "0.5.13";
   pname = "num2words";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fnwLDwgEBao6HdnTKxypCzvwO6sXuOVNsF4beDAaCYg=";
+    hash = "sha256-owZHFvu/kNdcRJRQzr+8c6ahPmOyUx0JvezDqxoiCc8=";
   };
 
   propagatedBuildInputs = [ docopt ];
diff --git a/pkgs/development/python-modules/opsdroid_get_image_size/default.nix b/pkgs/development/python-modules/opsdroid-get-image-size/default.nix
index 0f33da44145f3..edd09d2750e2f 100644
--- a/pkgs/development/python-modules/opsdroid_get_image_size/default.nix
+++ b/pkgs/development/python-modules/opsdroid-get-image-size/default.nix
@@ -1,15 +1,24 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
 }:
 
 buildPythonPackage rec {
-  pname = "opsdroid_get_image_size";
+  pname = "opsdroid-get-image-size";
   version = "0.2.2";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "124j2xvfxv09q42qfb8nqlcn55y7f09iayrix3yfyrs2qyzav78a";
+    pname = "opsdroid_get_image_size";
+    inherit version;
+    hash = "sha256-Cp2tvsdCZ+/86DF7FRNwx5diGcUWLYcFwQns7nYXkog=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   # test data not included on pypi
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/optuna/default.nix b/pkgs/development/python-modules/optuna/default.nix
index f3b41af020963..7a3b3cca06b0e 100644
--- a/pkgs/development/python-modules/optuna/default.nix
+++ b/pkgs/development/python-modules/optuna/default.nix
@@ -13,6 +13,7 @@
 , distributed
 , fakeredis
 , fastai
+, google-cloud-storage
 , lightgbm
 , matplotlib
 , mlflow
@@ -43,7 +44,7 @@
 
 buildPythonPackage rec {
   pname = "optuna";
-  version = "3.3.0";
+  version = "3.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -52,7 +53,7 @@ buildPythonPackage rec {
     owner = "optuna";
     repo = "optuna";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uHv8uEJOQO1+AeNSxBtnCt6gDQHLT1RToF4hfolVVX0=";
+    hash = "sha256-WUjO13NxX0FneOPS4nn6aHq48X95r+GJR/Oxir6n8Pk=";
   };
 
   nativeBuildInputs = [
@@ -62,7 +63,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     alembic
-    cmaes
     colorlog
     numpy
     packaging
@@ -96,6 +96,8 @@ buildPythonPackage rec {
     optional = [
       boto3
       botorch
+      cmaes
+      google-cloud-storage
       matplotlib
       pandas
       plotly
diff --git a/pkgs/development/python-modules/osmnx/default.nix b/pkgs/development/python-modules/osmnx/default.nix
index fec12037e20b5..fec12037e20b5 100755..100644
--- a/pkgs/development/python-modules/osmnx/default.nix
+++ b/pkgs/development/python-modules/osmnx/default.nix
diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index 38397535c01f7..33e65661f92e1 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "19.5.4";
+  version = "19.5.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AkVUYUZobQsnSfMfciiSbPwo0HCnlO3NLoUA1+wqBt4=";
+    hash = "sha256-AgJT/VfNHcSuJhypBwqJkgXuvYDBlZ7eQp4nGva4z6U=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/periodiq/default.nix b/pkgs/development/python-modules/periodiq/default.nix
new file mode 100644
index 0000000000000..5ed6a028aa38e
--- /dev/null
+++ b/pkgs/development/python-modules/periodiq/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitLab
+, poetry-core
+, dramatiq
+, pendulum
+, setuptools
+, pytest-mock
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "periodiq";
+  version = "0.12.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.5";
+
+  src = fetchFromGitLab {
+    owner = "bersace";
+    repo = "periodiq";
+    rev = "v${version}";
+    hash = "sha256-Ar0n+Wi1OUtRdhVxrU7Nz4je8ylaHgPZbXE0a30hzU0=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'poetry>=0.12' 'poetry-core' \
+      --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    dramatiq
+    pendulum
+    setuptools
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook pytest-mock ];
+
+  pytestFlagsArray = [ "tests/unit" ];
+
+  pythonImportsCheck = [ "periodiq" ];
+
+  meta = with lib; {
+    description = "Simple Scheduler for Dramatiq Task Queue";
+    homepage = "https://pypi.org/project/periodiq/";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/persim/default.nix b/pkgs/development/python-modules/persim/default.nix
index 09feb66549a46..869fb6146f2e9 100644
--- a/pkgs/development/python-modules/persim/default.nix
+++ b/pkgs/development/python-modules/persim/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "persim";
-  version = "0.3.1";
+  version = "0.3.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7w8KJHrc9hBOysFBF9sLJFgXEOqKjZZIFoBTlXALSXU=";
+    hash = "sha256-p6Vumfr+vRDr0D9PnEZItp9vNlCLIb59HpBg1KdyHGE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 8876eea828afd..22e0a62827620 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.33.1";
+  version = "0.33.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uJBUim5FlS+Jw3rGEKuorksVIgI5tVRAI7tESeYnGUc=";
+    hash = "sha256-WTgv0bEkhLMoRCw6Xh5SlYLxnlQCv603lKTajjCETT4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/polars/default.nix b/pkgs/development/python-modules/polars/default.nix
index b070ae37978fa..ccd6f2b79ba98 100644
--- a/pkgs/development/python-modules/polars/default.nix
+++ b/pkgs/development/python-modules/polars/default.nix
@@ -6,6 +6,7 @@
 , libiconv
 , fetchFromGitHub
 , typing-extensions
+, rust-jemalloc-sys
 , darwin
 }:
 let
@@ -49,7 +50,9 @@ buildPythonPackage {
 
   nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [
+  buildInputs = [
+    rust-jemalloc-sys
+  ] ++ lib.optionals stdenv.isDarwin [
     libiconv
     darwin.apple_sdk.frameworks.Security
   ];
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 47bca9e9311e4..1b0745990ec54 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "0.10.0.20231002";
+  version = "0.10.0.20231020";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qO8/V0UZb9lWvPb0JbUABFCJbGFu5ulRMOFH4vrhDMw=";
+    hash = "sha256-5Woh5xWIVvVvgmp4xtpU51rXSCZDH0ljPpLpkvFmO+8=";
   };
 
   passthru.optional-dependencies = {
diff --git a/pkgs/development/python-modules/pvo/default.nix b/pkgs/development/python-modules/pvo/default.nix
index 6f3f698fe2c74..6963d37000138 100644
--- a/pkgs/development/python-modules/pvo/default.nix
+++ b/pkgs/development/python-modules/pvo/default.nix
@@ -13,18 +13,25 @@
 
 buildPythonPackage rec {
   pname = "pvo";
-  version = "1.0.0";
+  version = "2.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-pvoutput";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6oVACUnK8WVlEx047CUXmSXQ0+M3xnSvyMHw5Wttk7M=";
+    hash = "sha256-SvsrvGwIAlj/8hdk90+rxigVrx6n3YInvF/4eux2H04=";
   };
 
+  postPatch = ''
+    # Upstream doesn't set a version for the pyproject.toml
+    substituteInPlace pyproject.toml \
+      --replace "0.0.0" "${version}" \
+      --replace "--cov" ""
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -41,13 +48,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    # Upstream doesn't set a version for the pyproject.toml
-    substituteInPlace pyproject.toml \
-      --replace "0.0.0" "${version}" \
-      --replace "--cov" ""
-  '';
-
   pythonImportsCheck = [
     "pvo"
   ];
diff --git a/pkgs/development/python-modules/pydiscovergy/default.nix b/pkgs/development/python-modules/pydiscovergy/default.nix
index d5cdb74b76714..3c87b6b6f3a1a 100644
--- a/pkgs/development/python-modules/pydiscovergy/default.nix
+++ b/pkgs/development/python-modules/pydiscovergy/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pydiscovergy";
-  version = "2.0.4";
+  version = "2.0.5";
   format = "pyproject";
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "jpbede";
     repo = "pydiscovergy";
     rev = "refs/tags/${version}";
-    hash = "sha256-yHACEo5481BZVqqEj8WeuIpSWAfBqnmRdOWRPH5RuHQ=";
+    hash = "sha256-u2G+o/vhPri7CPSnekC8rUo/AvuvePpG51MR+FdH2XA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyduotecno/default.nix b/pkgs/development/python-modules/pyduotecno/default.nix
index e61e725a80a1b..17fd2d78885c4 100644
--- a/pkgs/development/python-modules/pyduotecno/default.nix
+++ b/pkgs/development/python-modules/pyduotecno/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyduotecno";
-  version = "2023.10.0";
+  version = "2023.10.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Cereal2nd";
     repo = "pyDuotecno";
     rev = "refs/tags/${version}";
-    hash = "sha256-GxCqWgw4OdhJUMsGzCZnl6KYH7HQpGyV7zXMxbShHlg=";
+    hash = "sha256-fDooQb1i9rgzDZBzZ+lYb0WUYC8JNPEYk5DJ9wtS2Dg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyenphase/default.nix b/pkgs/development/python-modules/pyenphase/default.nix
index 360db91241756..d18160d897d38 100644
--- a/pkgs/development/python-modules/pyenphase/default.nix
+++ b/pkgs/development/python-modules/pyenphase/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pyenphase";
-  version = "1.12.0";
+  version = "1.13.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.11";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "pyenphase";
     repo = "pyenphase";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gqbRz0JAp8hjZpFUzlFzqq86UKgD0TLWSp1Z9rdrk3s=";
+    hash = "sha256-8wGGx7ERYm+lKvLW/NUcJeBTqEXPM0jJNOOlkj/UzYk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyliblo/default.nix b/pkgs/development/python-modules/pyliblo/default.nix
index 52f59cc3fc8d0..e56b1dfa36839 100644
--- a/pkgs/development/python-modules/pyliblo/default.nix
+++ b/pkgs/development/python-modules/pyliblo/default.nix
@@ -10,19 +10,26 @@
 buildPythonPackage rec {
   pname = "pyliblo";
   version = "0.10.0";
-  disabled = isPyPy || pythonAtLeast "3.11";
+  disabled = isPyPy;
 
   src = fetchurl {
     url = "http://das.nasophon.de/download/${pname}-${version}.tar.gz";
     sha256 = "13vry6xhxm7adnbyj28w1kpwrh0kf7nw83cz1yq74wl21faz2rzw";
   };
 
+  patches = [
+    (fetchurl {
+      url = "https://git.alpinelinux.org/aports/plain/community/py3-pyliblo/py3.11.patch?id=a7e1eca5533657ddd7e37c43e67e8126e3447258";
+      hash = "sha256-4yCWNQaE/9FHGTVuvNEimBNuViWZ9aSJMcpTOP0fnM0=";
+    })
+  ];
+
   buildInputs = [ liblo cython ];
 
   meta = with lib; {
     homepage = "https://das.nasophon.de/pyliblo/";
     description = "Python wrapper for the liblo OSC library";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Only;
   };
 
 }
diff --git a/pkgs/development/python-modules/pyscf/default.nix b/pkgs/development/python-modules/pyscf/default.nix
index 29f795560d41b..5089e19c22647 100644
--- a/pkgs/development/python-modules/pyscf/default.nix
+++ b/pkgs/development/python-modules/pyscf/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "pyscf";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "pyscf";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-x693NB0oc9X7SuDZlV3VKOmgnIgKA39O9yswDM0outk=";
+    hash = "sha256-+dZsXiLqqyRWr1eOEVSHZ1KMM760hrDaT07ylZUcGmo=";
   };
 
   # setup.py calls Cmake and passes the arguments in CMAKE_CONFIGURE_ARGS to cmake.
diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix
index dcb41604102f3..06d0dffb24689 100644
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "pytensor";
-  version = "2.17.2";
+  version = "2.17.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "pymc-devs";
     repo = "pytensor";
     rev = "refs/tags/rel-${version}";
-    hash = "sha256-u1CbOjU3rQ6G3SSwYR3UlebymkupGMJWID4RH4v9PIk=";
+    hash = "sha256-FufPCFzSjG8BrHes7t3XsdovX9gqUBG0gMDGKvkRkSA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pymyq/default.nix b/pkgs/development/python-modules/python-myq/default.nix
index 91c691f843a39..f596828e6f9f3 100644
--- a/pkgs/development/python-modules/pymyq/default.nix
+++ b/pkgs/development/python-modules/python-myq/default.nix
@@ -9,7 +9,7 @@
 }:
 
 buildPythonPackage rec {
-  pname = "pymyq";
+  pname = "python-myq";
   version = "3.1.13";
   pyproject = true;
 
diff --git a/pkgs/development/python-modules/pyyardian/default.nix b/pkgs/development/python-modules/pyyardian/default.nix
index 63318cbfcaef2..0216d562faea7 100644
--- a/pkgs/development/python-modules/pyyardian/default.nix
+++ b/pkgs/development/python-modules/pyyardian/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "pyyardian";
-  version = "1.1.1";
+  version = "1.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "h3l1o5";
     repo = "pyyardian";
     rev = "refs/tags/${version}";
-    hash = "sha256-dnHHRGt3TsWJb6tzx+i1gb9hkLJYPVdCt92UGKuO6Mg=";
+    hash = "sha256-JBb62pFDuVcXIGRc6UOp5/ciUtbGm4XnKZjt1icF/jQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ratelimiter/default.nix b/pkgs/development/python-modules/ratelimiter/default.nix
deleted file mode 100644
index 6c01a9e548c94..0000000000000
--- a/pkgs/development/python-modules/ratelimiter/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pytest-asyncio
-, pytestCheckHook
-}:
-
-buildPythonPackage rec {
-  pname = "ratelimiter";
-  version = "1.2.0.post0";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-XDldyr273i5ReO8/ibVoowZkVKbdwiO3ZHPawi+JtPc=";
-  };
-
-  nativeCheckInputs = [
-    pytest-asyncio
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [
-    "ratelimiter"
-  ];
-
-  preCheck = ''
-    # Uses out-dated options
-    rm tests/conftest.py
-  '';
-
-  disabledTests = [
-    # TypeError: object Lock can't be used in 'await' expression
-    "test_alock"
-  ];
-
-  meta = with lib; {
-    description = "Simple python rate limiting object";
-    homepage = "https://github.com/RazerM/ratelimiter";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ helkafen ];
-  };
-}
diff --git a/pkgs/development/python-modules/readmdict/default.nix b/pkgs/development/python-modules/readmdict/default.nix
new file mode 100644
index 0000000000000..b7d61f8c8f57d
--- /dev/null
+++ b/pkgs/development/python-modules/readmdict/default.nix
@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+
+, poetry-core
+, python-lzo
+, tkinter
+
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "readmdict";
+  version = "0.1.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "ffreemt";
+    repo = "readmdict";
+    rev = "v${version}";
+    hash = "sha256-1/f+o2bVscT3EA8XQyS2hWjhimLRzfIBM6u2O7UqwcA=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    python-lzo
+    tkinter
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "readmdict"
+  ];
+
+  meta = with lib; {
+    description = "Read mdx/mdd files (repacking of readmdict from mdict-analysis)";
+    homepage = "https://github.com/ffreemt/readmdict";
+    license = licenses.mit;
+    maintainers = with maintainers; [ paveloom ];
+  };
+}
diff --git a/pkgs/development/python-modules/recaptcha_client/default.nix b/pkgs/development/python-modules/recaptcha_client/default.nix
deleted file mode 100644
index dce24cfa7a8f9..0000000000000
--- a/pkgs/development/python-modules/recaptcha_client/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pythonAtLeast
-}:
-
-buildPythonPackage rec {
-  pname = "recaptcha-client";
-  version = "1.0.6";
-  disabled = pythonAtLeast "3.5";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "28c6853c1d13d365b7dc71a6b05e5ffb56471f70a850de318af50d3d7c0dea2f";
-  };
-
-  meta = with lib; {
-    description = "A CAPTCHA for Python using the reCAPTCHA service";
-    homepage = "http://recaptcha.net/";
-    license = licenses.mit;
-  };
-
-}
diff --git a/pkgs/development/python-modules/rtree/default.nix b/pkgs/development/python-modules/rtree/default.nix
index 7d4e141963146..0de516ec85f03 100644
--- a/pkgs/development/python-modules/rtree/default.nix
+++ b/pkgs/development/python-modules/rtree/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "rtree";
-  version = "1.0.1";
+  version = "1.1.0";
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     pname = "Rtree";
     inherit version;
-    hash = "sha256-IiEhaZwwOmQGXYSb9wOLHsq8N7Zcf6NAvts47w6AVCk=";
+    hash = "sha256-b47lBN3l0AWyWwiq9b4LNASvOtX+zm4d3N41kIp5ipU=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sensor-state-data/default.nix b/pkgs/development/python-modules/sensor-state-data/default.nix
index 7316256cd8aac..7802340cedef2 100644
--- a/pkgs/development/python-modules/sensor-state-data/default.nix
+++ b/pkgs/development/python-modules/sensor-state-data/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "sensor-state-data";
-  version = "2.17.1";
+  version = "2.18.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-zfgkTBdE8UWwk+G3bLBThVjgU+m2QoPf1fzORyznEgs=";
+    hash = "sha256-wYYSS4lABCbIhmUU3z3Wh0+4zwpEzXl8Kk9gi6LBrbQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinx_pypi_upload/default.nix b/pkgs/development/python-modules/sphinx_pypi_upload/default.nix
deleted file mode 100644
index d2c20e980e7a9..0000000000000
--- a/pkgs/development/python-modules/sphinx_pypi_upload/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-}:
-
-buildPythonPackage rec {
-  pname = "Sphinx-PyPI-upload";
-  version = "0.2.1";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "5f919a47ce7a7e6028dba809de81ae1297ac192347cf6fc54efca919d4865159";
-  };
-
-  meta = with lib; {
-    description = "Setuptools command for uploading Sphinx documentation to PyPI";
-    homepage = "https://bitbucket.org/jezdez/sphinx-pypi-upload/";
-    license = licenses.bsd0;
-  };
-
-}
diff --git a/pkgs/development/python-modules/staticmap/default.nix b/pkgs/development/python-modules/staticmap/default.nix
new file mode 100644
index 0000000000000..bb3eac8655bdf
--- /dev/null
+++ b/pkgs/development/python-modules/staticmap/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pillow
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "staticmap";
+  version = "0.5.7";
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-x6lrkCumEpLoGMILCBBhnWuBps21C8wauS1QrE2yCn8=";
+  };
+
+  propagatedBuildInputs = [ requests pillow ];
+
+  pythonImportsCheck = [ "staticmap" ];
+
+  # Tests seem to be broken
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A small, python-based library for creating map images with lines and markers";
+    homepage = "https://pypi.org/project/staticmap/";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/streamlit/default.nix b/pkgs/development/python-modules/streamlit/default.nix
index b764d95734513..b764d95734513 100755..100644
--- a/pkgs/development/python-modules/streamlit/default.nix
+++ b/pkgs/development/python-modules/streamlit/default.nix
diff --git a/pkgs/development/python-modules/textparser/default.nix b/pkgs/development/python-modules/textparser/default.nix
new file mode 100644
index 0000000000000..86c436ac21f99
--- /dev/null
+++ b/pkgs/development/python-modules/textparser/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "textparser";
+  version = "0.24.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-VvcI51qp0AKtt22CO6bvFm1+zsHj5MpMHKED+BdWgzU=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "textparser"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/eerimoq/textparser";
+    description = "A text parser";
+    license = licenses.mit;
+    maintainers = with maintainers; [ gray-heron ];
+  };
+}
diff --git a/pkgs/development/python-modules/toonapi/default.nix b/pkgs/development/python-modules/toonapi/default.nix
index 8df8fa89a2ca3..ac51cae1c805d 100644
--- a/pkgs/development/python-modules/toonapi/default.nix
+++ b/pkgs/development/python-modules/toonapi/default.nix
@@ -3,18 +3,22 @@
 , backoff
 , buildPythonPackage
 , fetchFromGitHub
+, pythonOlder
 , yarl
 }:
 
 buildPythonPackage rec {
   pname = "toonapi";
-  version = "0.2.1";
+  version = "0.3.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-toonapi";
-    rev = "v${version}";
-    sha256 = "10jh6p0ww51cb9f8amd9jq3lmvby6n2k08qwcr2n8ijbbgyp0ibf";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-RaN9ppqJbTik1/vNX0/YLoBawrqjyQWU6+FLTspIxug=";
   };
 
   propagatedBuildInputs = [
@@ -25,11 +29,15 @@ buildPythonPackage rec {
 
   # Project has no tests
   doCheck = false;
-  pythonImportsCheck = [ "toonapi" ];
+
+  pythonImportsCheck = [
+    "toonapi"
+  ];
 
   meta = with lib; {
     description = "Python client for the Quby ToonAPI";
     homepage = "https://github.com/frenck/python-toonapi";
+    changelog = "https://github.com/frenck/python-toonapi/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/trezor/default.nix b/pkgs/development/python-modules/trezor/default.nix
index 109f48d1f71b0..23af30faefbab 100644
--- a/pkgs/development/python-modules/trezor/default.nix
+++ b/pkgs/development/python-modules/trezor/default.nix
@@ -24,13 +24,13 @@
 
 buildPythonPackage rec {
   pname = "trezor";
-  version = "0.13.7";
+  version = "0.13.8";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dodeWIYBfclPUbu0Efkn8QO9nj7L8HVNXkSjU4mBSeA=";
+    hash = "sha256-Y01O3fNWAyV8MhYY2FSMajWyc4Rle2XjsL261jWlfP8=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/python-modules/twentemilieu/default.nix b/pkgs/development/python-modules/twentemilieu/default.nix
index aa91f01686c71..e52f70753f327 100644
--- a/pkgs/development/python-modules/twentemilieu/default.nix
+++ b/pkgs/development/python-modules/twentemilieu/default.nix
@@ -12,16 +12,16 @@
 
 buildPythonPackage rec {
   pname = "twentemilieu";
-  version = "1.0.0";
+  version = "2.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-twentemilieu";
-    rev = "v${version}";
-    hash = "sha256-MTAVa5gP5e8TIE/i1DjfmwKm1zDVC/WEcYKxZSV/+Ug=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-r0LZS8TXux1mzzXBTSu+x5sxUZOCzW7poKG3dQ2A6No=";
   };
 
   postPatch = ''
@@ -45,7 +45,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "twentemilieu" ];
+  pythonImportsCheck = [
+    "twentemilieu"
+  ];
 
   meta = with lib; {
     description = "Python client for Twente Milieu";
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index d342c3d330c68..e12271c48645f 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "8.9.1";
+  version = "8.10.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "twilio";
     repo = "twilio-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-F+0nYZIvZVH0QuEkuiV2lwA62r6T/amWFWg7rfBqddU=";
+    hash = "sha256-1y9kETu2E7dN7fmE0qP6yAVwMcVGCYnyPQYzIIApKjU=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-click/default.nix b/pkgs/development/python-modules/types-click/default.nix
new file mode 100644
index 0000000000000..78c99fe42808a
--- /dev/null
+++ b/pkgs/development/python-modules/types-click/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+}:
+
+let
+  pname = "types-click";
+  version = "7.1.8";
+in
+buildPythonPackage {
+  inherit pname version;
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-tmBJaL5kAdxRYxHKUHCKCii6p6DLhA79dBLw27/04JI=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+
+  meta = with lib; {
+    description = "Collection of library stubs for Python, with static types";
+    homepage = "https://github.com/python/typeshed";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jfvillablanca ];
+  };
+}
diff --git a/pkgs/development/python-modules/universal-pathlib/default.nix b/pkgs/development/python-modules/universal-pathlib/default.nix
index 966e9c459d868..23667d02c2835 100644
--- a/pkgs/development/python-modules/universal-pathlib/default.nix
+++ b/pkgs/development/python-modules/universal-pathlib/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "universal-pathlib";
-  version = "0.1.3";
+  version = "0.1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "universal_pathlib";
     inherit version;
-    hash = "sha256-GgUqteBRcwHfZr5lF+n+Y82fwAgT5c5xpzcBRBrCtcg=";
+    hash = "sha256-guXYbRaifg6hrcfYisvLqdAtWkVIgWMXT5bZrCidsuQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/vehicle/default.nix b/pkgs/development/python-modules/vehicle/default.nix
index e1d4531719b4d..a233b51773ac1 100644
--- a/pkgs/development/python-modules/vehicle/default.nix
+++ b/pkgs/development/python-modules/vehicle/default.nix
@@ -13,16 +13,16 @@
 
 buildPythonPackage rec {
   pname = "vehicle";
-  version = "1.0.1";
+  version = "2.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-vehicle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nN7efkN59FCCjCk3svYCTGGdvr2RSM5VektuUkHy3Vo=";
+    hash = "sha256-EbjrAfbqVY336RHBWq81KM+oHixen+38aUTnWZQ+nCs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/velbus-aio/default.nix b/pkgs/development/python-modules/velbus-aio/default.nix
index dda198ff95ccc..03c44ef031c00 100644
--- a/pkgs/development/python-modules/velbus-aio/default.nix
+++ b/pkgs/development/python-modules/velbus-aio/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "velbus-aio";
-  version = "2023.10.0";
+  version = "2023.10.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Cereal2nd";
     repo = pname;
     rev = version;
-    hash = "sha256-xVELkmucrw1QazSR2XN6ldmzdTya/rWsQd1mRsLTcbU=";
+    hash = "sha256-v2B+tDqvQTm+K+cvTRM8LnfaFp5CTsI8/B5clBDNE08=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/wallbox/default.nix b/pkgs/development/python-modules/wallbox/default.nix
index 4fe26418ef830..a53344a76fd17 100644
--- a/pkgs/development/python-modules/wallbox/default.nix
+++ b/pkgs/development/python-modules/wallbox/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "wallbox";
-  version = "0.4.14";
+  version = "0.5.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-HKlq5DPG3HD9i9LLTJdlzEFim+2hBdSfKl43BojhEf8=";
+    hash = "sha256-EDEB7/CkrfYSNcSh55Itrj6rThsNKeuj8lHLAY+Qml4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/watchdog-gevent/default.nix b/pkgs/development/python-modules/watchdog-gevent/default.nix
new file mode 100644
index 0000000000000..e1b812b9612f1
--- /dev/null
+++ b/pkgs/development/python-modules/watchdog-gevent/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, gevent
+, pytestCheckHook
+, watchdog
+}:
+
+buildPythonPackage rec {
+  pname = "watchdog-gevent";
+  version = "0.1.1";
+  format = "setuptools";
+
+  # Need to fetch from github because tests are not present in pypi
+  src = fetchFromGitHub {
+    owner = "Bogdanp";
+    repo = "watchdog_gevent";
+    rev = "v${version}";
+    hash = "sha256-FESm3fNuLmOg2ilI/x8U9LuAimHLnahcTHYzW/nzOVY=";
+  };
+
+  propagatedBuildInputs = [ watchdog gevent ];
+
+  postPatch = ''
+    sed -i setup.cfg \
+      -e 's:--cov watchdog_gevent::' \
+      -e 's:--cov-report html::'
+  '';
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "watchdog_gevent" ];
+
+  meta = with lib; {
+    description = "A gevent-based observer for watchdog";
+    homepage = "https://github.com/Bogdanp/watchdog_gevent";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/development/python-modules/zope-lifecycleevent/default.nix b/pkgs/development/python-modules/zope-lifecycleevent/default.nix
new file mode 100644
index 0000000000000..fc6b0005ffacc
--- /dev/null
+++ b/pkgs/development/python-modules/zope-lifecycleevent/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, setuptools
+, zope_event
+, zope_interface
+}:
+
+buildPythonPackage rec {
+  pname = "zope-lifecycleevent";
+  version = "5.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    pname = "zope.lifecycleevent";
+    inherit version;
+    hash = "sha256-6tP7SW52FPm1adFtrUt4BSsKwhh1utjWbKNQNS2bb50=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [ zope_event zope_interface ];
+
+  # namespace colides with local directory
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "zope.lifecycleevent"
+    "zope.interface"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/zopefoundation/zope.lifecycleevent";
+    description = "Object life-cycle events";
+    changelog = "https://github.com/zopefoundation/zope.lifecycleevent/blob/${version}/CHANGES.rst";
+    license = licenses.zpl21;
+    maintainers = with maintainers; [ goibhniu ];
+  };
+}
diff --git a/pkgs/development/python-modules/zope_lifecycleevent/default.nix b/pkgs/development/python-modules/zope_lifecycleevent/default.nix
deleted file mode 100644
index 807deb097feb8..0000000000000
--- a/pkgs/development/python-modules/zope_lifecycleevent/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, isPy3k
-, zope_event
-, zope-component
-}:
-
-buildPythonPackage rec {
-  pname = "zope.lifecycleevent";
-  version = "4.4";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-9ahU6J/5fe6ke/vqN4u77yeJ0uDMkKHB2lfZChzmfLU=";
-  };
-
-  propagatedBuildInputs = [ zope_event zope-component ];
-
-  # namespace colides with local directory
-  doCheck = false;
-
-  # zope uses pep 420 namespaces for python3, doesn't work with nix + python2
-  pythonImportsCheck = lib.optionals isPy3k [
-    "zope.lifecycleevent"
-    "zope.interface"
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/zopefoundation/zope.lifecycleevent";
-    description = "Object life-cycle events";
-    license = licenses.zpl20;
-    maintainers = with maintainers; [ goibhniu ];
-  };
-
-}
diff --git a/pkgs/development/python-modules/zstandard/default.nix b/pkgs/development/python-modules/zstandard/default.nix
index 2da5ae524bb39..2da5ae524bb39 100755..100644
--- a/pkgs/development/python-modules/zstandard/default.nix
+++ b/pkgs/development/python-modules/zstandard/default.nix
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index f9655b201746e..34bb4303724b0 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -22,14 +22,14 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.5.14";
+  version = "2.5.15";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-4F8cGcQJy8cbCE0wxM6B4qGjuc+SjeL7DMr6RdSkXBM=";
+    hash = "sha256-PVx66Ipvf+rISkuu9dw2ecFXXmuzITg2PogqRktFh5M=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/analysis/rizin/default.nix b/pkgs/development/tools/analysis/rizin/default.nix
index e6b20bd5e1595..d4bd1e84b112f 100644
--- a/pkgs/development/tools/analysis/rizin/default.nix
+++ b/pkgs/development/tools/analysis/rizin/default.nix
@@ -25,11 +25,11 @@
 
 let rizin = stdenv.mkDerivation rec {
   pname = "rizin";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchurl {
     url = "https://github.com/rizinorg/rizin/releases/download/v${version}/rizin-src-v${version}.tar.xz";
-    hash = "sha256-4poAo+IgBL3RAUbShrHM4OBhltQarkcpqvydeDIf+Gs=";
+    hash = "sha256-lfZMarnm2qnp+lY0OY649s206/LoFNouTLlp0x9FCcI=";
   };
 
   mesonFlags = [
diff --git a/pkgs/development/tools/buildkit/default.nix b/pkgs/development/tools/buildkit/default.nix
index 6787ca6b07dd8..41843024a5150 100644
--- a/pkgs/development/tools/buildkit/default.nix
+++ b/pkgs/development/tools/buildkit/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "buildkit";
-  version = "0.12.2";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "moby";
     repo = "buildkit";
     rev = "v${version}";
-    hash = "sha256-u85Yrg3aMG6Tx8onivSy1p7yB4lZxsBWF4bxnwO68EE=";
+    hash = "sha256-ph44J90g5zOTi/+FVbdnDDJp1gXcxPt7coA1rvhsQSQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/development/tools/clj-kondo/default.nix b/pkgs/development/tools/clj-kondo/default.nix
index 20f905a50ec99..dc78761cc256d 100644
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "clj-kondo";
-  version = "2023.09.07";
+  version = "2023.10.20";
 
   src = fetchurl {
     url = "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-F7ePdITYKkGB6nsR3EFJ7zLDCUoT0g3i+AAjXzBd624=";
+    sha256 = "sha256-f9u/pk3CEEmiLgnS2biaUHpsMHjVEwZL2jyB/1PiZUY=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/development/tools/continuous-integration/jenkins/default.nix b/pkgs/development/tools/continuous-integration/jenkins/default.nix
index c90845ddcd73f..aa4de161d9ce2 100644
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jenkins";
-  version = "2.414.2";
+  version = "2.414.3";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${version}/jenkins.war";
-    hash = "sha256-kiu/Ymn92tYUu2VAJB7QzlUjpKUyginhX157t//VZbg=";
+    hash = "sha256-LZMlS8GG3zSbxK0GtrHddXxJMZDwVY0RHb2pUXqEe1k=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/database/timescaledb-tune/default.nix b/pkgs/development/tools/database/timescaledb-tune/default.nix
index 1fa12861d9213..0236a5f51f3d5 100644
--- a/pkgs/development/tools/database/timescaledb-tune/default.nix
+++ b/pkgs/development/tools/database/timescaledb-tune/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "timescaledb-tune";
-  version = "0.14.3";
+  version = "0.14.4";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MQi8A7eWOShP/VhxuX4Uhz1ueLtKvOi1x4E7aFXEsQo=";
+    sha256 = "sha256-lCbxGW6+/r5AnsSXvrE7jYL1ZywcTlb4RK3MurL1JWg=";
   };
 
   vendorHash = "sha256-yXWeINubvfZ2S+3gVFsrzeVO3XXIiZ14qfK+9Bj3SV4=";
diff --git a/pkgs/development/tools/electron/binary/generic.nix b/pkgs/development/tools/electron/binary/generic.nix
index f7e8f6461a4cf..6e1493528e2b5 100644
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@@ -24,6 +24,7 @@
 , xorg
 , pango
 , systemd
+, pciutils
 }:
 
 version: hashes:
@@ -39,7 +40,7 @@ let
       ++ optionals (versionAtLeast version "11.0.0") [ "aarch64-darwin" ]
       ++ optionals (versionOlder version "19.0.0") [ "i686-linux" ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    knownVulnerabilities = optional (versionOlder version "22.0.0" || versions.major version == "23") "Electron version ${version} is EOL";
+    knownVulnerabilities = optional (versionOlder version "25.0.0") "Electron version ${version} is EOL";
   };
 
   fetcher = vers: tag: hash: fetchurl {
@@ -92,6 +93,7 @@ let
     xorg.libXrandr
     xorg.libxkbfile
     pango
+    pciutils
     stdenv.cc.cc.lib
     systemd
   ]
diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index 5bfb0996e6604..62aaf9973c8be 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.54.2";
+  version = "1.55.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-7nbgiUrp7S7sXt7uFXX8NHYbIRLZZQcg+18IdwAZBfE=";
+    hash = "sha256-77bhXeABkV6WZCzoGnRS447pEVcJyj4AF+wihJe62fc=";
   };
 
-  vendorHash = "sha256-IyH5lG2a4zjsg/MUonCUiAgMl4xx8zSflRyzNgk8MR0=";
+  vendorHash = "sha256-3aHLilu+AZ6376bn9eS8kmSfo6fXikOFJKDRCYu+4a0=";
 
   subPackages = [ "cmd/golangci-lint" ];
 
diff --git a/pkgs/development/tools/java/dex2jar/default.nix b/pkgs/development/tools/java/dex2jar/default.nix
index 97fa2298b051c..e0ce19dc8d2f8 100644
--- a/pkgs/development/tools/java/dex2jar/default.nix
+++ b/pkgs/development/tools/java/dex2jar/default.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dex2jar";
-  version  = "2.1";
+  version  = "2.4";
 
   src = fetchurl {
-    url = "https://github.com/pxb1988/dex2jar/releases/download/v${finalAttrs.version}/dex2jar-${finalAttrs.version}.zip";
-    hash = "sha256-epvfhD1D3k0elOwue29VglAXsMSn7jn/gmYOJJOkbwg=";
+    url = "https://github.com/pxb1988/dex2jar/releases/download/v${finalAttrs.version}/dex-tools-v${finalAttrs.version}.zip";
+    hash = "sha256-7nxF6zwdJHSmFF2NRH5lGnNqItlmS209O+WlqBfdojo=";
   };
 
   nativeBuildInputs = [ makeWrapper unzip ];
diff --git a/pkgs/development/tools/kustomize/default.nix b/pkgs/development/tools/kustomize/default.nix
index 6f62f7d86c924..a8e90fc7b036a 100644
--- a/pkgs/development/tools/kustomize/default.nix
+++ b/pkgs/development/tools/kustomize/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "kustomize";
-  version = "5.1.1";
+  version = "5.2.1";
 
   ldflags = let t = "sigs.k8s.io/kustomize/api/provenance"; in
     [
@@ -15,13 +15,13 @@ buildGoModule rec {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "kustomize/v${version}";
-    hash = "sha256-XtpMws2o3h19PsRJXKg+y5/Zk3bc6mJ4O1LLZ40ioTM=";
+    hash = "sha256-NuDg9Vtfxddosi8J7p6+WI2jDM2k16gbWsQcZF27vJo=";
   };
 
   # avoid finding test and development commands
   modRoot = "kustomize";
   proxyVendor = true;
-  vendorHash = "sha256-/XyxZHhlxD0CpaDAuJbLkOHysLXo1+ThTcexqtNdVIs=";
+  vendorHash = "sha256-pA0B4CA5RXyo2GTyk9Xa/unpU46gnLI6ulCY5vTLTvA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/tools/misc/runme/default.nix b/pkgs/development/tools/misc/runme/default.nix
index 67a69db814264..3795476c3e163 100644
--- a/pkgs/development/tools/misc/runme/default.nix
+++ b/pkgs/development/tools/misc/runme/default.nix
@@ -12,7 +12,7 @@
 
 buildGo121Module rec {
   pname = "runme";
-  version = "1.7.7";
+  version = "1.7.8";
 
   src = fetchFromGitHub {
     owner = "stateful";
diff --git a/pkgs/development/tools/misc/slint-lsp/default.nix b/pkgs/development/tools/misc/slint-lsp/default.nix
index 028f2f8d50292..0eb55d14c0055 100644
--- a/pkgs/development/tools/misc/slint-lsp/default.nix
+++ b/pkgs/development/tools/misc/slint-lsp/default.nix
@@ -25,14 +25,14 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "slint-lsp";
-  version = "1.1.1";
+  version = "1.2.2";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-ENv17Az6yzUwD39HDfoD7Bmvs6LHjVp85PaYkTw6jW0=";
+    sha256 = "sha256-+1nuezax7aV9b+L11zzIouA8QEWduqBzPiT6jvCGMac=";
   };
 
-  cargoHash = "sha256-wL46QhY3Cq2KFLETPRhUWb77o1vNrRA2w1NBAtBc0yo=";
+  cargoHash = "sha256-o7HDhNtjA0/JybJCiEejR8PcRIdJim+/wq4q8xj9A5Q=";
 
   nativeBuildInputs = [ cmake pkg-config fontconfig ];
   buildInputs = rpathLibs ++ [ xorg.libxcb.dev ]
diff --git a/pkgs/development/tools/misc/texlab/default.nix b/pkgs/development/tools/misc/texlab/default.nix
index e33a288286ee2..9bc36338ff2e3 100644
--- a/pkgs/development/tools/misc/texlab/default.nix
+++ b/pkgs/development/tools/misc/texlab/default.nix
@@ -15,16 +15,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "texlab";
-  version = "5.10.0";
+  version = "5.10.1";
 
   src = fetchFromGitHub {
     owner = "latex-lsp";
     repo = "texlab";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MTWaGgDIDo3CaRHyHWqliKsPdbU/TZPsyfF7SoHTnhk=";
+    hash = "sha256-ACdiFkV138jDIrRe+baYo+r9vCO4cyRyO2ck7OKakFY=";
   };
 
-  cargoHash = "sha256-8Vrp4d5luf91pKpUC4wWn4otsanqopCHwCjcnfTzyLk=";
+  cargoHash = "sha256-bEeQOOucXd4HNTR6SmidAfDkZ1tT7ORmUxrNx+3FNRw=";
 
   outputs = [ "out" ] ++ lib.optional (!isCross) "man";
 
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage rec {
   # generate the man page
   postInstall = lib.optionalString (!isCross) ''
     # TexLab builds man page separately in CI:
-    # https://github.com/latex-lsp/texlab/blob/v5.9.2/.github/workflows/publish.yml#L117-L121
+    # https://github.com/latex-lsp/texlab/blob/v5.10.1/.github/workflows/publish.yml#L117-L121
     help2man --no-info "$out/bin/texlab" > texlab.1
     installManPage texlab.1
   '';
diff --git a/pkgs/development/tools/mold/default.nix b/pkgs/development/tools/mold/default.nix
index 2cbc016a2933c..fadbe57a5690b 100644
--- a/pkgs/development/tools/mold/default.nix
+++ b/pkgs/development/tools/mold/default.nix
@@ -11,6 +11,8 @@
 , zstd
 
 , buildPackages
+, clangStdenv
+, gccStdenv
 , hello
 , mold
 , mold-wrapped
@@ -21,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mold";
-  version = "2.2.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = "mold";
     rev = "v${version}";
-    hash = "sha256-ePX80hzzIzSJdGUX96GyxYWcdbXxXyuyNQqj5RDSkKU=";
+    hash = "sha256-SahpgmkeGVXqQebtw36IjFwHcbvi0JeiEWkNV3hk3lM=";
   };
 
   nativeBuildInputs = [
@@ -89,11 +91,13 @@ stdenv.mkDerivation rec {
       in
       {
         version = testers.testVersion { package = mold; };
+      } // lib.optionalAttrs stdenv.isLinux {
+        adapter-gcc = helloTest "adapter-gcc" (hello.override (old: { stdenv = useMoldLinker gccStdenv; }));
+        adapter-llvm = helloTest "adapter-llvm" (hello.override (old: { stdenv = useMoldLinker clangStdenv; }));
         wrapped = helloTest "wrapped" (hello.overrideAttrs (previousAttrs: {
           nativeBuildInputs = (previousAttrs.nativeBuildInputs or [ ]) ++ [ mold-wrapped ];
           NIX_CFLAGS_LINK = toString (previousAttrs.NIX_CFLAGS_LINK or "") + " -fuse-ld=mold";
         }));
-        adapter = helloTest "adapter" (hello.override (old: { stdenv = useMoldLinker old.stdenv; }));
       };
   };
 
diff --git a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
index 04174d1c43540..2e859c6ddbf54 100644
--- a/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
+++ b/pkgs/development/tools/poetry2nix/poetry2nix/overrides/build-systems.json
@@ -2732,6 +2732,9 @@
   "certbot-dns-inwx": [
     "setuptools"
   ],
+  "certbot-dns-ovh": [
+    "setuptools"
+  ],
   "certbot-dns-rfc2136": [
     "setuptools"
   ],
diff --git a/pkgs/development/tools/railway/default.nix b/pkgs/development/tools/railway/default.nix
index 1d075250a4157..688a475a1403f 100644
--- a/pkgs/development/tools/railway/default.nix
+++ b/pkgs/development/tools/railway/default.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "railway";
-  version = "3.4.0";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-pydnIUqUBMLHonEGcvB+K+48QQYQuFfZxbAETJjU+3o=";
+    hash = "sha256-I32DC0hzVM/LCSqS878sZd+UYZ0NfBuzBgd9Aed/Sq0=";
   };
 
-  cargoHash = "sha256-VgLQfUk1xeAwr9KUo1Vz4Ndw0FAnYGw3af0v3ueNPuA=";
+  cargoHash = "sha256-CYy0YEWK9sHAr0yFIH9yzxPnzG6x/EcE8ZLkueYgSiE=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index b7c5ab87a6443..8b42bfbe85c55 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -4,6 +4,7 @@
 , installShellFiles
 , stdenv
 , darwin
+, rust-jemalloc-sys
   # tests
 , ruff-lsp
 }:
@@ -31,19 +32,15 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [
+  buildInputs = [
+    rust-jemalloc-sys
+  ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices
   ];
 
   cargoBuildFlags = [ "--package=ruff_cli" ];
   cargoTestFlags = cargoBuildFlags;
 
-  preBuild = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
-    # See https://github.com/jemalloc/jemalloc/issues/1997
-    # Using a value of 48 should work on both emulated and native x86_64-darwin.
-    export JEMALLOC_SYS_WITH_LG_VADDR=48
-  '';
-
   # tests expect no colors
   preCheck = ''
     export NO_COLOR=1
diff --git a/pkgs/development/tools/rust/cargo-codspeed/default.nix b/pkgs/development/tools/rust/cargo-codspeed/default.nix
index f2a9376e2fa3a..d27f17bfac2fc 100644
--- a/pkgs/development/tools/rust/cargo-codspeed/default.nix
+++ b/pkgs/development/tools/rust/cargo-codspeed/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-codspeed";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "CodSpeedHQ";
     repo = "codspeed-rust";
     rev = "v${version}";
-    hash = "sha256-AGbo38weLBPxkaXgJpi+FXGuhPh7nyZcJOhw6BCDYOc=";
+    hash = "sha256-oI6IfKvX+Zn3tYPXQVxHRQymVz4bBvXfg3mcrjClbY4=";
   };
 
-  cargoHash = "sha256-NR+Z5oMaReEOZrLk7d/pB1F37k8tE7FXh4HdVnh+YFc=";
+  cargoHash = "sha256-ZZhYmyWoqZ8SbRpXCA5XsKCdeqAKAcE1NdNlrHhBiYI=";
 
   nativeBuildInputs = [
     curl
diff --git a/pkgs/development/tools/symfony-cli/default.nix b/pkgs/development/tools/symfony-cli/default.nix
index d626027ee1862..4f7dd010b844c 100644
--- a/pkgs/development/tools/symfony-cli/default.nix
+++ b/pkgs/development/tools/symfony-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.5.10";
-  vendorHash = "sha256-eeVi/O4p7bF4CPqJBCpLfx1Yc5vZZ3b8RV5ERcIL8H4=";
+  version = "5.6.0";
+  vendorHash = "sha256-1BqgnWFMk8hWwra75a5o6Rwbj5wiCUIdSnsAcB+7Mno=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    hash = "sha256-n0R+J41lJYxswMnknYAAEKwwIqOremZF73cRBYfD3CE=";
+    hash = "sha256-AtHRuzpKXp+WlFser0J5MR63rbO0xO4N/L3U0Q3iax8=";
   };
 
   ldflags = [
diff --git a/pkgs/development/web/minify/default.nix b/pkgs/development/web/minify/default.nix
index 1c832bb456db4..86ef8a4759f2f 100644
--- a/pkgs/development/web/minify/default.nix
+++ b/pkgs/development/web/minify/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "minify";
-  version = "2.12.9";
+  version = "2.19.10";
 
   src = fetchFromGitHub {
     owner = "tdewolff";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+NBYn+gEsoclROnq2msNB4knviGn/XA9vNAuB0JZNek=";
+    hash = "sha256-/OfNHhWbRZI7nRhBnjXfxL4Gf011ydlwEMDadCptFJY=";
   };
 
-  vendorHash = "sha256-/Pw7fHVXWsovxfyzkWfb6UiRDBmiua82667N4Scl5+A=";
+  vendorHash = "sha256-ZtQbhhdt9mGRbTpgm6O4wnSPoKF9bAEswppmK+Urqhs=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/web/nodejs/v21.nix b/pkgs/development/web/nodejs/v21.nix
new file mode 100644
index 0000000000000..6d59e20dfa5f8
--- /dev/null
+++ b/pkgs/development/web/nodejs/v21.nix
@@ -0,0 +1,19 @@
+{ callPackage, openssl, python3, enableNpm ? true }:
+
+let
+  buildNodejs = callPackage ./nodejs.nix {
+    inherit openssl;
+    python = python3;
+  };
+in
+buildNodejs {
+  inherit enableNpm;
+  version = "21.0.0";
+  sha256 = "sha256-vFYZK5Ua0YNQbcqaz3pNDAJZEUC3/I8lZhN1GZJm8/I=";
+  patches = [
+    ./revert-arm64-pointer-auth.patch
+    ./disable-darwin-v8-system-instrumentation-node19.patch
+    ./bypass-darwin-xcrun-node16.patch
+    ./node-npm-build-npm-package-logic.patch
+  ];
+}
diff --git a/pkgs/games/openra/build-engine.nix b/pkgs/games/openra/build-engine.nix
index 664a4c0735b3a..10e8b49392155 100644
--- a/pkgs/games/openra/build-engine.nix
+++ b/pkgs/games/openra/build-engine.nix
@@ -36,7 +36,7 @@ buildDotnetModule rec {
   dontDotnetFixup = true;
 
   preBuild = ''
-    make VERSION=${version} version
+    make VERSION=${engine.build}-${version} version
   '';
 
   postInstall = ''
diff --git a/pkgs/games/starsector/default.nix b/pkgs/games/starsector/default.nix
index 3951f36f83bf7..e1bc4a8dbbcfe 100644
--- a/pkgs/games/starsector/default.nix
+++ b/pkgs/games/starsector/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "starsector";
-  version = "0.96a-RC8";
+  version = "0.96a-RC10";
 
   src = fetchzip {
-    url = "https://s3.amazonaws.com/fractalsoftworks/starsector/starsector_linux-${version}.zip";
-    sha256 = "sha256-RDXqFqiWpBG3kasofzbOl7Zp0a9LiMpJKsHcFaJtm2Y=";
+    url = "https://f005.backblazeb2.com/file/fractalsoftworks/release/starsector_linux-${version}.zip";
+    sha256 = "sha256-RBSnms+QlKgTOhm3t2hDfv7OcMrQCk1rfkz9GaM74WM=";
   };
 
   nativeBuildInputs = [ copyDesktopItems makeWrapper ];
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
     #!/usr/bin/env nix-shell
     #!nix-shell -i bash -p curl gnugrep common-updater-scripts
     set -eou pipefail;
-    version=$(curl -s https://fractalsoftworks.com/preorder/ | grep -oP "https://s3.amazonaws.com/fractalsoftworks/starsector/starsector_linux-\K.*?(?=\.zip)" | head -1)
+    version=$(curl -s https://fractalsoftworks.com/preorder/ | grep -oP "https://f005.backblazeb2.com/file/fractalsoftworks/release/starsector_linux-\K.*?(?=\.zip)" | head -1)
     update-source-version ${pname} "$version" --file=./pkgs/games/starsector/default.nix
   '';
 }
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index a6734b640638e..78c669614c07d 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -3,6 +3,7 @@
 , extraPkgs ? pkgs: [ ] # extra packages to add to targetPkgs
 , extraLibraries ? pkgs: [ ] # extra packages to add to multiPkgs
 , extraProfile ? "" # string to append to profile
+, extraBwrapArgs ? [ ] # extra arguments to pass to bubblewrap
 , extraArgs ? "" # arguments to always pass to steam
 , extraEnv ? { } # Environment variables to pass to Steam
 , withGameSpecificLibraries ? true # include game specific libraries
@@ -277,6 +278,8 @@ in buildFHSEnv rec {
     exec steam ${extraArgs} "$@"
   '';
 
+  inherit extraBwrapArgs;
+
   meta =
     if steam != null
     then
@@ -287,21 +290,11 @@ in buildFHSEnv rec {
       description = "Steam dependencies (dummy package, do not use)";
     };
 
-  # allows for some gui applications to share IPC
-  # this fixes certain issues where they don't render correctly
-  unshareIpc = false;
-
-  # Some applications such as Natron need access to MIT-SHM or other
-  # shared memory mechanisms. Unsharing the pid namespace
-  # breaks the ability for application to reference shared memory.
-  unsharePid = false;
-
   passthru.run = buildFHSEnv {
     name = "steam-run";
 
     targetPkgs = commonTargetPkgs;
-    inherit multiArch multiPkgs profile extraInstallCommands;
-    inherit unshareIpc unsharePid;
+    inherit multiArch multiPkgs profile extraInstallCommands extraBwrapArgs;
 
     runScript = writeShellScript "steam-run" ''
       run="$1"
diff --git a/pkgs/misc/uq/default.nix b/pkgs/misc/uq/default.nix
index 81c09685be8b6..81c09685be8b6 100755..100644
--- a/pkgs/misc/uq/default.nix
+++ b/pkgs/misc/uq/default.nix
diff --git a/pkgs/misc/vencord/default.nix b/pkgs/misc/vencord/default.nix
index d26e13e95d7bb..287799bcf1e0d 100644
--- a/pkgs/misc/vencord/default.nix
+++ b/pkgs/misc/vencord/default.nix
@@ -6,8 +6,8 @@
 , buildWebExtension ? false
 }:
 let
-  version = "1.5.6";
-  gitHash = "925d709";
+  version = "1.5.7";
+  gitHash = "5d7ede3";
 in
 buildNpmPackage rec {
   pname = "vencord";
@@ -17,7 +17,7 @@ buildNpmPackage rec {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${version}";
-    hash = "sha256-0vYnhDy7J+JFg6uMtwK+uQsHtxoXi8QskIqyQm1HsqM=";
+    hash = "sha256-/LrM9lBxuM5+KQJqRlP/lBV+krwZIV2GjMi33N/s+V0=";
   };
 
   ESBUILD_BINARY_PATH = lib.getExe (esbuild.override {
@@ -37,7 +37,7 @@ buildNpmPackage rec {
   npmRebuildFlags = [ "|| true" ];
 
   makeCacheWritable = true;
-  npmDepsHash = "sha256-/oMQHIigAY7Jdy6S1lRXjzOnxYrvpzbyvP4z+s+k9Lw=";
+  npmDepsHash = "sha256-Moy7VlAgl31H8QO+aOVano92C4L/wclHhj+JTnbRM6c=";
   npmFlags = [ "--legacy-peer-deps" ];
   npmBuildScript = if buildWebExtension then "buildWeb" else "build";
   npmBuildFlags = [ "--" "--standalone" "--disable-updater" ];
diff --git a/pkgs/misc/vencord/package-lock.json b/pkgs/misc/vencord/package-lock.json
index 26b54c655b081..eb01a29cb26c8 100644
--- a/pkgs/misc/vencord/package-lock.json
+++ b/pkgs/misc/vencord/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "vencord",
-    "version": "1.5.6",
+    "version": "1.5.7",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "vencord",
-            "version": "1.5.6",
+            "version": "1.5.7",
             "license": "GPL-3.0-or-later",
             "dependencies": {
                 "@sapphi-red/web-noise-suppressor": "0.3.3",
diff --git a/pkgs/os-specific/linux/cpufrequtils/default.nix b/pkgs/os-specific/linux/cpufrequtils/default.nix
index d64996c4961ed..f62d8463714e7 100644
--- a/pkgs/os-specific/linux/cpufrequtils/default.nix
+++ b/pkgs/os-specific/linux/cpufrequtils/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://ftp.be.debian.org/pub/linux/utils/kernel/cpufreq/cpufrequtils-${version}.tar.gz";
-    sha256 = "127i38d4w1hv2dzdy756gmbhq25q3k34nqb2s0xlhsfhhdqs0lq0";
+    hash = "sha256-AFOgcYPQaUg70GJhS8YcuAgMV32mHN9+ExsGThoa8Yg=";
   };
 
   patches = [
@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     homepage = "http://ftp.be.debian.org/pub/linux/utils/kernel/cpufreq/cpufrequtils.html";
     license = licenses.gpl2Only;
     platforms = [ "x86_64-linux" ];
+    mainProgram = "cpufreq-set";
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 038a3105a1826..ceb34fe0c76fa 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -146,7 +146,7 @@ let
     scheduler = {
       IOSCHED_CFQ = whenOlder "5.0" yes; # Removed in 5.0-RC1
       BLK_CGROUP  = yes; # required by CFQ"
-      BLK_CGROUP_IOLATENCY = whenAtLeast "4.19" yes;
+      BLK_CGROUP_IOLATENCY = yes;
       BLK_CGROUP_IOCOST = whenAtLeast "5.4" yes;
       IOSCHED_DEADLINE = whenOlder "5.0" yes; # Removed in 5.0-RC1
       MQ_IOSCHED_DEADLINE = yes;
@@ -183,8 +183,8 @@ let
       BPF_JIT            = whenPlatformHasEBPFJit yes;
       BPF_JIT_ALWAYS_ON  = whenPlatformHasEBPFJit no; # whenPlatformHasEBPFJit yes; # see https://github.com/NixOS/nixpkgs/issues/79304
       HAVE_EBPF_JIT      = whenPlatformHasEBPFJit yes;
-      BPF_STREAM_PARSER  = whenAtLeast "4.19" yes;
-      XDP_SOCKETS        = whenAtLeast "4.19" yes;
+      BPF_STREAM_PARSER  = yes;
+      XDP_SOCKETS        = yes;
       XDP_SOCKETS_DIAG   = whenAtLeast "5.1" yes;
       WAN                = yes;
       TCP_CONG_ADVANCED  = yes;
@@ -208,7 +208,7 @@ let
       IPV6_FOU_TUNNEL             = module;
       IPV6_SEG6_LWTUNNEL          = yes;
       IPV6_SEG6_HMAC              = yes;
-      IPV6_SEG6_BPF               = whenAtLeast "4.18" yes;
+      IPV6_SEG6_BPF               = yes;
       NET_CLS_BPF                 = module;
       NET_ACT_BPF                 = module;
       NET_SCHED                   = yes;
@@ -237,22 +237,17 @@ let
       NF_CONNTRACK_TIMEOUT        = yes;
       NF_CONNTRACK_TIMESTAMP      = yes;
       NETFILTER_NETLINK_GLUE_CT   = yes;
-      NF_TABLES_INET              = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
-      NF_TABLES_NETDEV            = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
+      NF_TABLES_INET              = yes;
+      NF_TABLES_NETDEV            = yes;
       NFT_REJECT_NETDEV           = whenAtLeast "5.11" module;
 
       # IP: Netfilter Configuration
-      NF_TABLES_IPV4              = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
-      NF_TABLES_ARP               = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
+      NF_TABLES_IPV4              = yes;
+      NF_TABLES_ARP               = yes;
       # IPv6: Netfilter Configuration
-      NF_TABLES_IPV6              = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
+      NF_TABLES_IPV6              = yes;
       # Bridge Netfilter Configuration
-      NF_TABLES_BRIDGE            = mkMerge [ (whenBetween "4.19" "5.3" yes)
+      NF_TABLES_BRIDGE            = mkMerge [ (whenOlder "5.3" yes)
                                               (whenAtLeast "5.3" module) ];
 
       # needed for `dropwatch`
@@ -274,7 +269,7 @@ let
 
       # Kernel TLS
       TLS         = module;
-      TLS_DEVICE  = whenAtLeast "4.18" yes;
+      TLS_DEVICE  = yes;
 
       # infiniband
       INFINIBAND = module;
@@ -323,7 +318,7 @@ let
       FB_3DFX_ACCEL       = yes;
       FB_VESA             = yes;
       FRAMEBUFFER_CONSOLE = yes;
-      FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = whenAtLeast "4.19" yes;
+      FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = yes;
       FRAMEBUFFER_CONSOLE_ROTATION = yes;
       FB_GEODE            = mkIf (stdenv.hostPlatform.system == "i686-linux") yes;
       # On 5.14 this conflicts with FB_SIMPLE.
@@ -357,8 +352,7 @@ let
       # Allow device firmware updates
       DRM_DP_AUX_CHARDEV = yes;
       # amdgpu display core (DC) support
-      DRM_AMD_DC_DCN1_0 = whenBetween "4.15" "5.6" yes;
-      DRM_AMD_DC_PRE_VEGA = whenBetween "4.15" "4.18" yes;
+      DRM_AMD_DC_DCN1_0 = whenOlder "5.6" yes;
       DRM_AMD_DC_DCN2_0 = whenBetween "5.3" "5.6" yes;
       DRM_AMD_DC_DCN2_1 = whenBetween "5.4" "5.6" yes;
       DRM_AMD_DC_DCN3_0 = whenBetween "5.9" "5.11" yes;
@@ -368,8 +362,8 @@ let
       DRM_AMD_DC_SI = whenAtLeast "5.10" yes;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
       # Intel GVT-g graphics virtualization supports 64-bit only
-      DRM_I915_GVT = whenAtLeast "4.16" yes;
-      DRM_I915_GVT_KVMGT = whenAtLeast "4.16" module;
+      DRM_I915_GVT = yes;
+      DRM_I915_GVT_KVMGT = module;
       # Enable Hyper-V Synthetic DRM Driver
       DRM_HYPERV = whenAtLeast "5.14" module;
     } // optionalAttrs (stdenv.hostPlatform.system == "aarch64-linux") {
@@ -425,25 +419,9 @@ let
 
     usb-serial = {
       USB_SERIAL_GENERIC          = yes; # USB Generic Serial Driver
-    } // optionalAttrs (versionOlder version "4.16") {
-      # Include firmware for various USB serial devices.
-      # Only applicable for kernels below 4.16, after that no firmware is shipped in the kernel tree.
-      USB_SERIAL_KEYSPAN_MPR      = yes;
-      USB_SERIAL_KEYSPAN_USA28    = yes;
-      USB_SERIAL_KEYSPAN_USA28X   = yes;
-      USB_SERIAL_KEYSPAN_USA28XA  = yes;
-      USB_SERIAL_KEYSPAN_USA28XB  = yes;
-      USB_SERIAL_KEYSPAN_USA19    = yes;
-      USB_SERIAL_KEYSPAN_USA18X   = yes;
-      USB_SERIAL_KEYSPAN_USA19W   = yes;
-      USB_SERIAL_KEYSPAN_USA19QW  = yes;
-      USB_SERIAL_KEYSPAN_USA19QI  = yes;
-      USB_SERIAL_KEYSPAN_USA49W   = yes;
-      USB_SERIAL_KEYSPAN_USA49WLC = yes;
     };
 
     usb = {
-      USB_DEBUG = { optional = true; tristate = whenOlder "4.18" "n";};
       USB_EHCI_ROOT_HUB_TT = yes; # Root Hub Transaction Translators
       USB_EHCI_TT_NEWSCHED = yes; # Improved transaction translator scheduling
       USB_HIDDEV = yes; # USB Raw HID Devices (like monitor controls and Uninterruptable Power Supplies)
@@ -514,7 +492,6 @@ let
       CIFS_XATTR        = yes;
       CIFS_POSIX        = option yes;
       CIFS_FSCACHE      = yes;
-      CIFS_STATS        = whenOlder "4.19" yes;
       CIFS_WEAK_PW_HASH = whenOlder "5.15" yes;
       CIFS_UPCALL       = yes;
       CIFS_ACL          = whenOlder "5.3" yes;
@@ -569,7 +546,7 @@ let
       SECURITY_APPARMOR                = yes;
       DEFAULT_SECURITY_APPARMOR        = yes;
 
-      RANDOM_TRUST_CPU                 = whenOlder "6.2" (whenAtLeast "4.19" yes); # allow RDRAND to seed the RNG
+      RANDOM_TRUST_CPU                 = whenOlder "6.2" yes; # allow RDRAND to seed the RNG
       RANDOM_TRUST_BOOTLOADER          = whenOlder "6.2" (whenAtLeast "5.4" yes); # allow the bootloader to seed the RNG
 
       MODULE_SIG            = no; # r13y, generates a random key during build and bakes it in
@@ -581,10 +558,6 @@ let
       PERSISTENT_KEYRINGS              = yes;
       # enable temporary caching of the last request_key() result
       KEYS_REQUEST_CACHE               = whenAtLeast "5.3" yes;
-    } // optionalAttrs (!stdenv.hostPlatform.isAarch32) {
-
-      # Detect buffer overflows on the stack
-      CC_STACKPROTECTOR_REGULAR = {optional = true; tristate = whenOlder "4.18" "y";};
     } // optionalAttrs stdenv.hostPlatform.isx86_64 {
       # Enable Intel SGX
       X86_SGX     = whenAtLeast "5.11" yes;
@@ -596,7 +569,7 @@ let
       # AMD SME
       AMD_MEM_ENCRYPT = yes;
       # AMD SEV and AMD SEV-SE
-      KVM_AMD_SEV     = whenAtLeast "4.16" yes;
+      KVM_AMD_SEV     = yes;
       # AMD SEV-SNP
       SEV_GUEST       = whenAtLeast "5.19" module;
     };
@@ -702,7 +675,6 @@ let
       XEN_PVH                     = option yes;
       XEN_PVHVM                   = option yes;
       XEN_SAVE_RESTORE            = option yes;
-      XEN_SCRUB_PAGES             = whenOlder "4.19" yes;
       XEN_SELFBALLOONING          = whenOlder "5.3" yes;
 
       # Enable device detection on virtio-mmio hypervisors
@@ -756,40 +728,11 @@ let
     tests = {
       # This menu disables all/most of them on >= 4.16
       RUNTIME_TESTING_MENU = option no;
-    } // optionalAttrs (versionOlder version "4.16") {
-      # For older kernels, painstakingly disable each symbol.
-      ARM_KPROBES_TEST    = option no;
-      ASYNC_RAID6_TEST    = option no;
-      ATOMIC64_SELFTEST   = option no;
-      BACKTRACE_SELF_TEST = option no;
-      INTERVAL_TREE_TEST  = option no;
-      PERCPU_TEST         = option no;
-      RBTREE_TEST         = option no;
-      TEST_BITMAP         = option no;
-      TEST_BPF            = option no;
-      TEST_FIRMWARE       = option no;
-      TEST_HASH           = option no;
-      TEST_HEXDUMP        = option no;
-      TEST_KMOD           = option no;
-      TEST_KSTRTOX        = option no;
-      TEST_LIST_SORT      = option no;
-      TEST_LKM            = option no;
-      TEST_PARMAN         = option no;
-      TEST_PRINTF         = option no;
-      TEST_RHASHTABLE     = option no;
-      TEST_SORT           = option no;
-      TEST_STATIC_KEYS    = option no;
-      TEST_STRING_HELPERS = option no;
-      TEST_UDELAY         = option no;
-      TEST_USER_COPY      = option no;
-      TEST_UUID           = option no;
     } // {
       CRC32_SELFTEST           = option no;
       CRYPTO_TEST              = option no;
       EFI_TEST                 = option no;
       GLOB_SELFTEST            = option no;
-      DRM_DEBUG_MM_SELFTEST    = { optional = true; tristate = whenOlder "4.18" "n";};
-      LNET_SELFTEST            = { optional = true; tristate = whenOlder "4.18" "n";};
       LOCK_TORTURE_TEST        = option no;
       MTD_TESTS                = option no;
       NOTIFIER_ERROR_INJECTION = option no;
@@ -801,23 +744,11 @@ let
       XZ_DEC_TEST              = option no;
     };
 
-    criu = if (versionAtLeast version "4.19") then {
+    criu = {
       # Unconditionally enabled, because it is required for CRIU and
       # it provides the kcmp() system call that Mesa depends on.
       CHECKPOINT_RESTORE  = yes;
-    } else optionalAttrs (features.criu or false) ({
-      # For older kernels, CHECKPOINT_RESTORE is hidden behind EXPERT.
-      EXPERT              = yes;
-      CHECKPOINT_RESTORE  = yes;
-    } // optionalAttrs (features.criu_revert_expert or true) {
-      RFKILL_INPUT          = option yes;
-      HID_PICOLCD_FB        = option yes;
-      HID_PICOLCD_BACKLIGHT = option yes;
-      HID_PICOLCD_LCD       = option yes;
-      HID_PICOLCD_LEDS      = option yes;
-      HID_PICOLCD_CIR       = option yes;
-      DEBUG_MEMORY_INIT     = option yes;
-    });
+    };
 
     misc = let
       # Use zstd for kernel compression if 64-bit and newer than 5.9, otherwise xz.
@@ -861,7 +792,6 @@ let
       PM_TRACE_RTC         = no; # Disable some expensive (?) features.
       ACCESSIBILITY        = yes; # Accessibility support
       AUXDISPLAY           = yes; # Auxiliary Display support
-      DONGLE               = whenOlder "4.17" yes; # Serial dongle support
       HIPPI                = yes;
       MTD_COMPLEX_MAPPINGS = yes; # needed for many devices
 
@@ -917,7 +847,6 @@ let
       FUSION              = yes; # Fusion MPT device support
       IDE                 = whenOlder "5.14" no; # deprecated IDE support, removed in 5.14
       IDLE_PAGE_TRACKING  = yes;
-      IRDA_ULTRA          = whenOlder "4.17" yes; # Ultra (connectionless) protocol
 
       JOYSTICK_IFORCE_232 = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force Serial joysticks and wheels
       JOYSTICK_IFORCE_USB = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force USB joysticks and wheels
@@ -939,7 +868,7 @@ let
 
       MLX5_CORE_EN       = option yes;
 
-      NVME_MULTIPATH = whenAtLeast "4.15" yes;
+      NVME_MULTIPATH = yes;
 
       PSI = whenAtLeast "4.20" yes;
 
@@ -1014,7 +943,7 @@ let
       X86_PLATFORM_DRIVERS_DELL = whenAtLeast "5.12" yes;
       X86_PLATFORM_DRIVERS_HP = whenAtLeast "6.1" yes;
 
-      LIRC = mkMerge [ (whenOlder "4.16" module) (whenAtLeast "4.17" yes) ];
+      LIRC = yes;
 
       SCHED_CORE = whenAtLeast "5.14" yes;
 
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 1981ad96b5514..cadef31334df9 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -52,12 +52,12 @@
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.57-hardened1.patch",
-            "sha256": "0cjcjphl2val9kl9vn37yvgd1k02pn2qm6g7dnfpzph4mxg17ap4",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.57-hardened1/linux-hardened-6.1.57-hardened1.patch"
+            "name": "linux-hardened-6.1.58-hardened1.patch",
+            "sha256": "0xca1pf6hkipci7blly111cchfw58cj22b73nr38dks0xvyb4rx6",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.58-hardened1/linux-hardened-6.1.58-hardened1.patch"
         },
-        "sha256": "1ccidrxswblxw9yaa45y6ds16pc7647f6fz36xxxhljivhyzxszr",
-        "version": "6.1.57"
+        "sha256": "1b913ina3rcw4dx2s7n37kynv8rqsmrqa2ialsib6h7nsb9px66f",
+        "version": "6.1.58"
     },
     "6.5": {
         "patch": {
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index b4772aa242711..94c383ff8dbdd 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -4,20 +4,20 @@
         "hash": "sha256:1yzzf0bswqqarmbkw17vqcrkghivin7ca84x919aa2i8z7fyg2hw"
     },
     "6.5": {
-        "version": "6.5.7",
-        "hash": "sha256:135v3y2vgc83dca4xi7q52wqi4dkfal74k1y73jwzj85h12fl28d"
+        "version": "6.5.8",
+        "hash": "sha256:05zpdh4dxaadq52hlczdmwb7bsqfm3q45v7bdqbsmplhgn4wm719"
     },
     "6.4": {
         "version": "6.4.16",
         "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
     },
     "6.1": {
-        "version": "6.1.58",
-        "hash": "sha256:1b913ina3rcw4dx2s7n37kynv8rqsmrqa2ialsib6h7nsb9px66f"
+        "version": "6.1.59",
+        "hash": "sha256:1860r1aan258yi2jq68bp1kdbcyy7ygc7d8g54wnc0vmqqj7fzv2"
     },
     "5.15": {
-        "version": "5.15.135",
-        "hash": "sha256:0w3i8jvzqvfnlarcvg89k1144ln96fszv16lzrn16zr3kri5x0ql"
+        "version": "5.15.136",
+        "hash": "sha256:1f5cxrair8qycjcc931kcdsarbrph32ypdyhrws8sw74gvzbj966"
     },
     "5.10": {
         "version": "5.10.198",
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 716a45820ca52..f978cb429df5f 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.5.7"; #zen
-    suffix = "zen2"; #zen
-    sha256 = "0qy3xn7kr16crm7iw1zhm3kpgxpmn66xc4g1yalvghwn6si0n81l"; #zen
+    version = "6.5.8"; #zen
+    suffix = "zen1"; #zen
+    sha256 = "0pg5q5alsxrbbf8hzbcgmwsyirs86715qijdzaldyw9sf74h4z1l"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.5.7"; #lqx
+    version = "6.5.8"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "1c4093xhfnzx6h8frqcigdlikgy1n0vv34ajs0237v3w7psw99d7"; #lqx
+    sha256 = "1f10p7mriwjrgmdfz10vs48xiipdk9ljj884fsj63r5n1g7pz4bf"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
index eb4fe9bcf993f..9d7480d239f21 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
@@ -6,7 +6,7 @@
 , gnupatch
 }:
 let
-  pname = "coreutils";
+  pname = "bootstrap-coreutils";
   version = "5.0";
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
index dece020a5e795..14584e0a7e6d6 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
@@ -12,7 +12,7 @@
 , gzip
 }:
 let
-  pname = "coreutils";
+  pname = "bootstrap-coreutils-musl";
   version = "9.4";
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
index a0663c9dbe4f9..715d261eea4f5 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
@@ -1,4 +1,4 @@
-{
+{ hostPlatform
 }:
 
 rec {
@@ -65,7 +65,7 @@ rec {
   */
   minimal-bootstrap-sources = derivation {
     inherit name;
-    system = builtins.currentSystem;
+    system = hostPlatform.system;
     outputHashMode = "recursive";
     inherit outputHashAlgo outputHash;
 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
index 381902cd2c129..6cc7cddb82af4 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
@@ -12,12 +12,13 @@
 #
 
 { lib
+, hostPlatform
 , fetchFromGitHub
 , fetchpatch
 }:
 
 let
-  expected = import ./bootstrap-sources.nix { };
+  expected = import ./bootstrap-sources.nix { inherit hostPlatform; };
 in
 
 fetchFromGitHub {
diff --git a/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix b/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
index 40ef0796dfa1e..61a27bd51f029 100644
--- a/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
+++ b/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
@@ -10,12 +10,12 @@
 
 buildGoModule rec {
   pname = "oci-seccomp-bpf-hook";
-  version = "1.2.9";
+  version = "1.2.10";
   src = fetchFromGitHub {
     owner = "containers";
     repo = "oci-seccomp-bpf-hook";
     rev = "v${version}";
-    sha256 = "sha256-KPO9xqLgPML6smoO7P50yP81b4iCvRFIR74ciUiva7o=";
+    sha256 = "sha256-bWlm+JYNf7+faKSQfW5fhxoH/D2I8ujjakswH+1r49o=";
   };
   vendorHash = null;
 
diff --git a/pkgs/os-specific/linux/ryzenadj/default.nix b/pkgs/os-specific/linux/ryzenadj/default.nix
index efdb9f3ed39b7..0744ed2896fff 100644
--- a/pkgs/os-specific/linux/ryzenadj/default.nix
+++ b/pkgs/os-specific/linux/ryzenadj/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     description = "Adjust power management settings for Ryzen Mobile Processors.";
     homepage = "https://github.com/FlyGoat/RyzenAdj";
     license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ rhendric ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/servers/computing/slurm/default.nix b/pkgs/servers/computing/slurm/default.nix
index 321e988af7f5e..226755b14c9ef 100644
--- a/pkgs/servers/computing/slurm/default.nix
+++ b/pkgs/servers/computing/slurm/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "slurm";
-  version = "23.02.5.1";
+  version = "23.02.6.1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "${pname}-${builtins.replaceStrings ["."] ["-"] version}";
-    sha256 = "sha256-9VvZ8xySYFyBa5tZzf5WCShbEDpqE1/5t76jXX6t+bc=";
+    sha256 = "sha256-azgGM4qfS0xtUaiGfXtu8MNYdgpZRUfx+zBgAAlmt6g=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/servers/geospatial/fit-trackee/default.nix b/pkgs/servers/geospatial/fit-trackee/default.nix
new file mode 100644
index 0000000000000..c7bc7fbc2e5b6
--- /dev/null
+++ b/pkgs/servers/geospatial/fit-trackee/default.nix
@@ -0,0 +1,105 @@
+{ lib
+, python3
+, fetchFromGitHub
+, fetchPypi
+, postgresql
+, postgresqlTestHook
+}:
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+        version = "1.4.49";
+        src = fetchPypi {
+          pname = "SQLAlchemy";
+          inherit version;
+          hash = "sha256-Bv8ly64ww5bEt3N0ZPKn/Deme32kCZk7GCsCTOyArtk=";
+        };
+        # Remove "test/typing" that does not exist
+        disabledTestPaths = [
+          "test/aaa_profiling"
+          "test/ext/mypy"
+        ];
+      });
+    };
+  };
+
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "fit-trackee";
+  version = "0.7.22";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "SamR1";
+    repo = "FitTrackee";
+    rev = "v${version}";
+    hash = "sha256-aPQ8jLssN9nx0Bpd/44E3sQi2w0cR8ecG76DJjreeHA=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace psycopg2-binary psycopg2 \
+      --replace 'poetry>=0.12' 'poetry-core' \
+      --replace 'poetry.masonry.api' 'poetry.core.masonry.api'
+  '';
+
+  nativeBuildInputs = [
+    python3.pkgs.poetry-core
+  ];
+
+  propagatedBuildInputs = with python.pkgs; [
+    authlib
+    babel
+    dramatiq
+    flask
+    flask-bcrypt
+    flask-dramatiq
+    flask-limiter
+    flask-migrate
+    gpxpy
+    gunicorn
+    humanize
+    psycopg2
+    pyjwt
+    pyopenssl
+    pytz
+    shortuuid
+    sqlalchemy
+    staticmap
+    ua-parser
+  ] ++ dramatiq.optional-dependencies.redis;
+
+  pythonImportsCheck = [ "fittrackee" ];
+
+  nativeCheckInputs = with python.pkgs; [
+    pytestCheckHook
+    freezegun
+    postgresqlTestHook
+    postgresql
+  ];
+
+  pytestFlagsArray = [
+    "fittrackee"
+  ];
+
+  postgresqlTestSetupPost = ''
+    export DATABASE_TEST_URL=postgresql://$PGUSER/$PGDATABAS?host=$PGHOST
+  '';
+
+  postInstall = ''
+    mkdir -p $out/var/share/fittrackee-instance
+  '';
+
+  preCheck = ''
+    export TMP=$(mktemp -d)
+  '';
+
+  meta = with lib; {
+    description = "Self-hosted outdoor activity tracker :bicyclist";
+    homepage = "https://github.com/SamR1/FitTrackee";
+    changelog = "https://github.com/SamR1/FitTrackee/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ traxys ];
+  };
+}
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 128f20777fe2c..7f9efafdfe9a4 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2023.10.3";
+  version = "2023.10.4";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
@@ -2771,7 +2771,8 @@
       sqlalchemy
     ];
     "myq" = ps: with ps; [
-    ]; # missing inputs: python-myq
+      python-myq
+    ];
     "mysensors" = ps: with ps; [
       aiohttp-cors
       janus
@@ -5405,6 +5406,7 @@
     "mullvad"
     "mutesync"
     "my"
+    "myq"
     "mysensors"
     "mystrom"
     "mythicbeastsdns"
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 9bc35bd882c95..593099d264afa 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -296,7 +296,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.10.3";
+  hassVersion = "2023.10.4";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -312,7 +312,7 @@ in python.pkgs.buildPythonApplication rec {
   # Primary source is the pypi sdist, because it contains translations
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7Eg6Ik8eiPPUTXyRedQLixaCnHDg9Dmikmhcq55+458=";
+    hash = "sha256-HG8Uyk52Bj9CpQ+dn+dbsXVBKakXDlRktG4KSkVVVmE=";
   };
 
   # Secondary source is git for tests
@@ -320,7 +320,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-4J1BBC6PvfbN4fKD+zUpW19sMvoKALilitNJlwB0ZTk=";
+    hash = "sha256-m3MjJHFq9S0dogFijIlpryqGQoHpLqkqgkWLuIxLHa8=";
   };
 
   nativeBuildInputs = with python.pkgs; [
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index adc7089741e9a..a0146829bf2cc 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2023.10.1";
+  version = "2023.10.4";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-4TPjYBTyrJtnYVZ+F/Bxf6m0lZn6fQR3ai0+CDTqwVc=";
+    hash = "sha256-iehGVXom5Wjw7A0PC4wfzed+w1h1/g9SKIuCuVRtIAs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index 98a00afc519d4..c6e7ad1f56616 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-httpd";
-  version = "2.4.57";
+  version = "2.4.58";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    sha256 = "sha256-28y4Su6V4JXt+7geXrkmzNJOatpV3Ng8rssmLlz5TSo=";
+    sha256 = "sha256-+hbXKgeCEKVMR91b7y+Lm4oB2UkJpRRTlWs+xkQupMU=";
   };
 
   # FIXME: -dev depends on -doc
diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index b0bb720c21cdd..0c83c2e750a03 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -15,26 +15,15 @@
 
 stdenv.mkDerivation rec {
   pname = "lighttpd";
-  version = "1.4.71";
+  version = "1.4.72";
 
   src = fetchurl {
     url = "https://download.lighttpd.net/lighttpd/releases-${lib.versions.majorMinor version}.x/${pname}-${version}.tar.xz";
-    sha256 = "sha256-uLaRXaIDlv3DVN8zJNXkQBabLl6nhZ46d1IThBMlr6w=";
+    sha256 = "sha256-98reTWm3VKB0jAFGPDPNi0VsqcwDuwnoWnG8vNVOVew=";
   };
 
-  patches = [
-    # disable tests for des/md5, which we don't support any more
-    ./disable-legacy-crypt-tests.patch
-  ];
-
   postPatch = ''
     patchShebangs tests
-    # Linux sandbox has an empty hostname and not /etc/hosts, which fails some tests
-    sed -ire '/[$]self->{HOSTNAME} *=/i     if(length($name)==0) { $name = "127.0.0.1" }' tests/LightyTest.pm
-    # it's difficult to prevent this test from trying to use /var/tmp (which
-    # the sandbox doesn't have) so until libredirect has support for mkstemp
-    # calls it's easiest to disable it
-    sed -i '/test_mod_ssi/d' src/t/test_mod.c
   '';
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch b/pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch
deleted file mode 100644
index 4a411c0b98aed..0000000000000
--- a/pkgs/servers/http/lighttpd/disable-legacy-crypt-tests.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-diff -uNr lighttpd-1.4.71.orig/tests/mod-fastcgi.t lighttpd-1.4.71.new/tests/mod-fastcgi.t
---- lighttpd-1.4.71.orig/tests/mod-fastcgi.t	2023-05-27 21:56:16.000000000 +0200
-+++ lighttpd-1.4.71.new/tests/mod-fastcgi.t	2023-06-01 07:01:59.789873512 +0200
-@@ -79,7 +79,7 @@
- 	ok($tf->handle_http($t) == 0, 'FastCGI + bin-copy-environment');
- 
- SKIP: {
--	skip "no crypt-des under openbsd or MS Visual Studio", 2 if $^O eq 'openbsd' || $tf->{'win32native'};
-+	skip "no crypt-des", 2;
- 
- 	$t->{REQUEST}  = ( <<EOF
- GET /get-server-env.php?env=REMOTE_USER HTTP/1.0
-diff -uNr lighttpd-1.4.71.orig/tests/request.t lighttpd-1.4.71.new/tests/request.t
---- lighttpd-1.4.71.orig/tests/request.t	2023-05-27 21:56:16.000000000 +0200
-+++ lighttpd-1.4.71.new/tests/request.t	2023-06-01 07:02:39.855940048 +0200
-@@ -1106,7 +1106,7 @@
- ok($tf->handle_http($t) == 0, 'Basic-Auth: Valid Auth-token - plain');
- 
- SKIP: {
--	skip "no crypt-des under openbsd or MS Visual Studio", 2 if $^O eq 'openbsd' || $tf->{'win32native'};
-+	skip "no crypt-des", 2;
- $t->{REQUEST}  = ( <<EOF
- GET /server-config HTTP/1.0
- Host: auth-htpasswd.example.org
-@@ -1163,9 +1163,7 @@
- ok($tf->handle_http($t) == 0, 'Basic-Auth: Valid Auth-token - htpasswd (apr-md5, wrong password)');
- 
- SKIP: {
--	skip "no crypt-md5 under cygwin", 1 if $^O eq 'cygwin';
--	skip "no crypt-md5 under darwin", 1 if $^O eq 'darwin';
--	skip "no crypt-md5 under openbsd",1 if $^O eq 'openbsd';
-+	skip "no crypt-md5", 1;
- $t->{REQUEST}  = ( <<EOF
- GET /server-config HTTP/1.0
- Host: auth-htpasswd.example.org
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 3db19396bee94..8f90adab101b1 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -2,7 +2,7 @@ outer@{ lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt
 , nginx-doc
 
 , nixosTests
-, substituteAll, removeReferencesTo, gd, geoip, perl
+, installShellFiles, substituteAll, removeReferencesTo, gd, geoip, perl
 , withDebug ? false
 , withKTLS ? false
 , withStream ? true
@@ -51,15 +51,17 @@ assert lib.assertMsg (lib.unique moduleNames == moduleNames)
 stdenv.mkDerivation {
   inherit pname version nginxVersion;
 
-  outputs = ["out" "doc"];
+  outputs = [ "out" "doc" ];
 
   src = if src != null then src else fetchurl {
     url = "https://nginx.org/download/nginx-${version}.tar.gz";
     inherit hash;
   };
 
-  nativeBuildInputs = [ removeReferencesTo ]
-    ++ nativeBuildInputs;
+  nativeBuildInputs = [
+    installShellFiles
+    removeReferencesTo
+  ] ++ nativeBuildInputs;
 
   buildInputs = [ openssl zlib pcre libxml2 libxslt gd geoip perl ]
     ++ buildInputs
@@ -166,6 +168,12 @@ stdenv.mkDerivation {
   preInstall = ''
     mkdir -p $doc
     cp -r ${nginx-doc}/* $doc
+
+    # TODO: make it unconditional when `openresty` and `nginx` are not
+    # sharing this code.
+    if [[ -e man/nginx.8 ]]; then
+      installManPage man/nginx.8
+    fi
   '';
 
   disallowedReferences = map (m: m.src) modules;
@@ -178,7 +186,7 @@ stdenv.mkDerivation {
   passthru = {
     inherit modules;
     tests = {
-      inherit (nixosTests) nginx nginx-auth nginx-etag nginx-globalredirect nginx-http3 nginx-proxyprotocol nginx-pubhtml nginx-sandbox nginx-sso nginx-status-page;
+      inherit (nixosTests) nginx nginx-auth nginx-etag nginx-globalredirect nginx-http3 nginx-proxyprotocol nginx-pubhtml nginx-sandbox nginx-sso nginx-status-page nginx-unix-socket;
       variants = lib.recurseIntoAttrs nixosTests.nginx-variants;
       acme-integration = nixosTests.acme;
     } // passthru.tests;
diff --git a/pkgs/servers/http/tomcat/tomcat-native.nix b/pkgs/servers/http/tomcat/tomcat-native.nix
index 5f9ea8a1665d5..bd05943ac71f9 100644
--- a/pkgs/servers/http/tomcat/tomcat-native.nix
+++ b/pkgs/servers/http/tomcat/tomcat-native.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tomcat-native";
-  version = "2.0.5";
+  version = "2.0.6";
 
   src = fetchurl {
     url = "mirror://apache/tomcat/tomcat-connectors/native/${version}/source/${pname}-${version}-src.tar.gz";
-    hash = "sha256-lY0fEhZRwQxhVW133J0NQfO1OYiiGVRC3krG9MuHg4g=";
+    hash = "sha256-vmF8V26SO2B50LdSBtcG2ifdBDzr9Qv7leOpwKodGjU=";
   };
 
   sourceRoot = "${pname}-${version}-src/native";
diff --git a/pkgs/servers/kanidm/default.nix b/pkgs/servers/kanidm/default.nix
index e6c49b846f4be..65450e0e3eb9e 100644
--- a/pkgs/servers/kanidm/default.nix
+++ b/pkgs/servers/kanidm/default.nix
@@ -11,6 +11,7 @@
 , sqlite
 , pam
 , bashInteractive
+, rust-jemalloc-sys
 }:
 
 let
@@ -59,6 +60,7 @@ rustPlatform.buildRustPackage rec {
     openssl
     sqlite
     pam
+    rust-jemalloc-sys
   ];
 
   # The UI needs to be in place before the tests are run.
diff --git a/pkgs/servers/mail/spamassassin/default.nix b/pkgs/servers/mail/spamassassin/default.nix
index 8e9aee8ad9869..8b6623200eba2 100644
--- a/pkgs/servers/mail/spamassassin/default.nix
+++ b/pkgs/servers/mail/spamassassin/default.nix
@@ -52,6 +52,9 @@ perlPackages.buildPerlPackage rec {
     export HOME=$NIX_BUILD_TOP/home
     mkdir -p $HOME
     mkdir t/log  # pre-create to avoid race conditions
+
+    # https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8068
+    checkFlagsArray+=(TEST_FILES='$(shell find t -name *.t -not -name spamd_ssl_accept_fail.t)')
   '';
 
   postInstall = ''
diff --git a/pkgs/servers/matrix-conduit/default.nix b/pkgs/servers/matrix-conduit/default.nix
index 6cb8f16d203cd..cc162e6373d67 100644
--- a/pkgs/servers/matrix-conduit/default.nix
+++ b/pkgs/servers/matrix-conduit/default.nix
@@ -7,6 +7,7 @@
 , darwin
 , nixosTests
 , rocksdb
+, rust-jemalloc-sys
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -42,7 +43,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs = [ sqlite ] ++ lib.optionals stdenv.isDarwin [
+  buildInputs = [
+    sqlite
+    rust-jemalloc-sys
+  ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
   ];
 
diff --git a/pkgs/servers/monitoring/librenms/default.nix b/pkgs/servers/monitoring/librenms/default.nix
index 79b550e281466..0fab1b334890e 100644
--- a/pkgs/servers/monitoring/librenms/default.nix
+++ b/pkgs/servers/monitoring/librenms/default.nix
@@ -23,7 +23,6 @@
 let
   phpPackage = php82.withExtensions ({ enabled, all }: enabled ++ [ all.memcached ]);
 in phpPackage.buildComposerProject rec {
-  name = pname + "-" + version;
   pname = "librenms";
   version = "23.9.1";
 
diff --git a/pkgs/servers/monitoring/plugins/default.nix b/pkgs/servers/monitoring/plugins/default.nix
index c7823789081bf..2f6122caa69e8 100644
--- a/pkgs/servers/monitoring/plugins/default.nix
+++ b/pkgs/servers/monitoring/plugins/default.nix
@@ -21,6 +21,7 @@
 , openldap
 , procps
 , runtimeShell
+, unixtools
 }:
 
 let
@@ -33,6 +34,7 @@ let
     lm_sensors
     net-snmp
     procps
+    unixtools.ping
   ];
 
   mailq = runCommand "mailq-wrapper" { preferLocalBuild = true; } ''
@@ -58,7 +60,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-yLhHOSrPFRjW701aOL8LPe4OnuJxL6f+dTxNqm0evIg=";
   };
 
-  # TODO: Awful hack. Grrr... this of course only works on NixOS.
+  # TODO: Awful hack. Grrr...
   # Anyway the check that configure performs to figure out the ping
   # syntax is totally impure, because it runs an actual ping to
   # localhost (which won't work for ping6 if IPv6 support isn't
@@ -74,8 +76,8 @@ stdenv.mkDerivation rec {
       -e 's|^DEFAULT_PATH=.*|DEFAULT_PATH=\"${binPath}\"|'
 
     configureFlagsArray+=(
-      --with-ping-command='/run/wrappers/bin/ping -4 -n -U -w %d -c %d %s'
-      --with-ping6-command='/run/wrappers/bin/ping -6 -n -U -w %d -c %d %s'
+      --with-ping-command='ping -4 -n -U -w %d -c %d %s'
+      --with-ping6-command='ping -6 -n -U -w %d -c %d %s'
     )
 
     install -Dm555 ${share} $out/share
diff --git a/pkgs/servers/monitoring/telegraf/default.nix b/pkgs/servers/monitoring/telegraf/default.nix
index 52605250cff6c..ac13d678ff1fc 100644
--- a/pkgs/servers/monitoring/telegraf/default.nix
+++ b/pkgs/servers/monitoring/telegraf/default.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.28.1";
+  version = "1.28.2";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -16,10 +16,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-ag5Hk/LAHS2XDZ0MUAycLfDLr9awMl3T+5NoQGUIl/w=";
+    hash = "sha256-gD4xdKjIx0zLKJySx8UdSKvMIZJaIXtubWQX/mLu+TI=";
   };
 
-  vendorHash = "sha256-3hmYyUDlBPEcoM/1MhH6yoH/Kb21rITrAzy7APQpLqI=";
+  vendorHash = "sha256-OzAAchUHNno58Em2oDnMt9P1B03HtQylFBFEkv4bAkU=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/servers/nosql/redis/default.nix b/pkgs/servers/nosql/redis/default.nix
index 25d8896945045..b1f3bb7adcc3b 100644
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "redis";
-  version = "7.2.1";
+  version = "7.2.2";
 
   src = fetchurl {
     url = "https://download.redis.io/releases/redis-${finalAttrs.version}.tar.gz";
-    hash = "sha256-XHbZkKGxxflJvNHu2Q0Mik9wNpvb3LQCiMVh3fiJZ6Q=";
+    hash = "sha256-ypmb4IgA7cbSZTecTHqvrZLw7kAGkuTi1pgpq0tMPQg=";
   };
 
   patches = lib.optionals useSystemJemalloc [
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index ed8744ef3c626..4665402361d56 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -51,11 +51,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "samba";
-  version = "4.18.6";
+  version = "4.19.1";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
-    hash = "sha256-KEyKmUzpich81oCMOQ/LnQDDayGg3BqKdUdLZ8nnFec=";
+    hash = "sha256-zjt/DRi/kapf1kbouzhaOzU3W3A8blEjsCuFoavIGHk=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/servers/search/qdrant/default.nix b/pkgs/servers/search/qdrant/default.nix
index 005514819820f..6d70b5e4b3dac 100644
--- a/pkgs/servers/search/qdrant/default.nix
+++ b/pkgs/servers/search/qdrant/default.nix
@@ -5,6 +5,7 @@
 , stdenv
 , pkg-config
 , openssl
+, rust-jemalloc-sys
 , nix-update-script
 , Security
 }:
@@ -32,7 +33,10 @@ rustPlatform.buildRustPackage rec {
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = [
+    openssl
+    rust-jemalloc-sys
+  ] ++ lib.optionals stdenv.isDarwin [ Security ];
 
   nativeBuildInputs = [ protobuf rustPlatform.bindgenHook pkg-config ];
 
diff --git a/pkgs/servers/search/quickwit/default.nix b/pkgs/servers/search/quickwit/default.nix
index 9fdcbef3e7129..f4d75be434ecb 100644
--- a/pkgs/servers/search/quickwit/default.nix
+++ b/pkgs/servers/search/quickwit/default.nix
@@ -4,6 +4,7 @@
 , rustPlatform
 , nix-update-script
 , protobuf
+, rust-jemalloc-sys
 , Security
 }:
 
@@ -32,7 +33,9 @@ rustPlatform.buildRustPackage rec {
 
   sourceRoot = "${src.name}/quickwit";
 
-  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = [
+    rust-jemalloc-sys
+  ] ++ lib.optionals stdenv.isDarwin [ Security ];
 
   cargoLock = {
     lockFile = ./Cargo.lock;
diff --git a/pkgs/servers/shairport-sync/default.nix b/pkgs/servers/shairport-sync/default.nix
index 7cd768bd332a2..b1bac49ba9191 100644
--- a/pkgs/servers/shairport-sync/default.nix
+++ b/pkgs/servers/shairport-sync/default.nix
@@ -40,13 +40,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "shairport-sync";
-  version = "4.3.1";
+  version = "4.3.2";
 
   src = fetchFromGitHub {
     repo = "shairport-sync";
     owner = "mikebrady";
     rev = "refs/tags/${version}";
-    hash = "sha256-Yj0SKMKACj2B/ADPkUzO4EvaYZX39erKmjaTsr5UN0s=";
+    hash = "sha256-M7bJO8KVxP2H27aB0qJcsaN9uHADWeOYPdNo8Xfg9gc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/sickbeard/sickgear.nix b/pkgs/servers/sickbeard/sickgear.nix
index 2e723c9b3ea3f..e75dc72a13540 100644
--- a/pkgs/servers/sickbeard/sickgear.nix
+++ b/pkgs/servers/sickbeard/sickgear.nix
@@ -4,13 +4,13 @@ let
   pythonEnv = python3.withPackages(ps: with ps; [ cheetah3 lxml ]);
 in stdenv.mkDerivation rec {
   pname = "sickgear";
-  version = "3.30.0";
+  version = "3.30.4";
 
   src = fetchFromGitHub {
     owner = "SickGear";
     repo = "SickGear";
     rev = "release_${version}";
-    hash = "sha256-Y9FXaDODeuMaXeqmfBCd96JgwrqDe5k6RCtGKvTOMKw=";
+    hash = "sha256-me52Ji+IWPN6IEDWsAlIoGPS45uA22+dxHJjqnYPniE=";
   };
 
   patches = [
diff --git a/pkgs/servers/snac2/default.nix b/pkgs/servers/snac2/default.nix
index b13b6c2b9fcfa..49c2c27890ff0 100644
--- a/pkgs/servers/snac2/default.nix
+++ b/pkgs/servers/snac2/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "snac2";
-  version = "2.41";
+  version = "2.42";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "grunfink";
     repo = pname;
     rev = version;
-    hash = "sha256-WVbGORth3paDo1eK/J7MPUstVQifcU7ksVEb87vknN0=";
+    hash = "sha256-cLSbmEZj5lyMtZMM2vaWqdrXFk1/VPws9yBPhSUka2E=";
   };
 
   buildInputs = [ curl openssl ];
diff --git a/pkgs/servers/soft-serve/default.nix b/pkgs/servers/soft-serve/default.nix
index a3f35d32885ab..2cfd41f7caf8b 100644
--- a/pkgs/servers/soft-serve/default.nix
+++ b/pkgs/servers/soft-serve/default.nix
@@ -1,17 +1,17 @@
-{ lib, buildGoModule, fetchFromGitHub, makeWrapper, git }:
+{ lib, buildGoModule, fetchFromGitHub, makeWrapper, nixosTests, git, bash }:
 
 buildGoModule rec {
   pname = "soft-serve";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "soft-serve";
     rev = "v${version}";
-    hash = "sha256-Xst/eNam3HuHixEmPUl2J7B7cLYaeGVaUnzXIVugBbw=";
+    hash = "sha256-gmgIuQk+8MRkuFZaJq82hHNdUMSqrylwgk6vi/Q0OQ0=";
   };
 
-  vendorHash = "sha256-tzJu2DmbvPU1tPIWP88q66PBtC1XEduQac8cIxwb/sM=";
+  vendorHash = "sha256-7lzdngj6xBpEe2nZdPW1GLbarPBdCHMnf+Dyxuq2Ikw=";
 
   doCheck = false;
 
@@ -20,10 +20,14 @@ buildGoModule rec {
   nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
+    # Soft-serve generates git-hooks at run-time.
+    # The scripts require git and bash inside the path.
     wrapProgram $out/bin/soft \
-      --prefix PATH : "${lib.makeBinPath [ git ]}"
+      --prefix PATH : "${lib.makeBinPath [ git bash ]}"
   '';
 
+  passthru.tests = nixosTests.soft-serve;
+
   meta = with lib; {
     description = "A tasty, self-hosted Git server for the command line";
     homepage = "https://github.com/charmbracelet/soft-serve";
diff --git a/pkgs/servers/sql/pgbouncer/default.nix b/pkgs/servers/sql/pgbouncer/default.nix
index b0f2bcb61626a..dd47de9075761 100644
--- a/pkgs/servers/sql/pgbouncer/default.nix
+++ b/pkgs/servers/sql/pgbouncer/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pgbouncer";
-  version = "1.20.1";
+  version = "1.21.0";
 
   src = fetchurl {
     url = "https://www.pgbouncer.org/downloads/files/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-JJks9VfXNCbXBIaY3/x7AZ5jZNTYdXriz14kcShqIIg=";
+    hash = "sha256-fh3WIMjYWoSQr/JQYdUFXXrvnPPov+LZ53GbjuWRFOI=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://www.pgbouncer.org/";
+    mainProgram = "pgbouncer";
     description = "Lightweight connection pooler for PostgreSQL";
     changelog = "https://github.com/pgbouncer/pgbouncer/releases/tag/pgbouncer_${replaceStrings ["."] ["_"] version}";
     license = licenses.isc;
diff --git a/pkgs/servers/teleport/11/default.nix b/pkgs/servers/teleport/11/default.nix
index 59d788872b887..3a935b630e721 100644
--- a/pkgs/servers/teleport/11/default.nix
+++ b/pkgs/servers/teleport/11/default.nix
@@ -1,7 +1,7 @@
 { callPackage, ... }@args:
 callPackage ../generic.nix ({
-  version = "11.3.25";
-  hash = "sha256-KIbRn90BUJp8Uc8GMHuIMMSn5tJQbxzE0ntngx1ELaE=";
+  version = "11.3.27";
+  hash = "sha256-A3EeFQsDOaggfb5S+eyRCe/vm054MabfRrcHPxhO0So=";
   vendorHash = "sha256-hjMv/H4dlinlv3ku7i1km2/b+6uCdbznHtVOMIjDlUc=";
   yarnHash = "sha256-hip0WQVZpx2qfVDmEy4nk4UFYEjX1Xhj8HsIIQ8PF1Y=";
   cargoLock = {
diff --git a/pkgs/servers/teleport/12/Cargo.lock b/pkgs/servers/teleport/12/Cargo.lock
index 895145e3927f6..c150d003f3ac4 100644
--- a/pkgs/servers/teleport/12/Cargo.lock
+++ b/pkgs/servers/teleport/12/Cargo.lock
@@ -1734,9 +1734,9 @@ dependencies = [
 
 [[package]]
 name = "webpki"
-version = "0.22.0"
+version = "0.22.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd"
+checksum = "07ecc0cd7cac091bf682ec5efa18b1cff79d617b84181f38b3951dbe135f607f"
 dependencies = [
  "ring",
  "untrusted 0.7.1",
diff --git a/pkgs/servers/teleport/12/default.nix b/pkgs/servers/teleport/12/default.nix
index e53fdcce494a4..ee166f5d4721a 100644
--- a/pkgs/servers/teleport/12/default.nix
+++ b/pkgs/servers/teleport/12/default.nix
@@ -1,9 +1,9 @@
 { callPackage, ... }@args:
 callPackage ../generic.nix ({
-  version = "12.4.20";
-  hash = "sha256-Qz+JOS4YPj2865Fkj7eVJMdilHMOGbTD179bQ5wHY7A=";
-  vendorHash = "sha256-cS8ylLujgp9Is+D2JjoK4yGgWRCVRyRw3NPQAAuE2vY=";
-  yarnHash = "sha256-tOdT7X8jM+tl1GZ7lBN2aW8KRiVW/zWK9fZIU7CSHVE=";
+  version = "12.4.22";
+  hash = "sha256-UEiS+GiderYTU34GHsQr4G8XrasV5ewmPcdrec4v5B4=";
+  vendorHash = "sha256-etutgK/5u+e86kx7ha3x+di9np7Tcr7hpGUMKZxJNT4=";
+  yarnHash = "sha256-MBTElkMH5rb33l+AYWH+zguSLQf+ntXpOkHZpjLAx/Q=";
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
diff --git a/pkgs/servers/teleport/13/Cargo.lock b/pkgs/servers/teleport/13/Cargo.lock
index b82c0b0e435f7..d22467c3e7dce 100644
--- a/pkgs/servers/teleport/13/Cargo.lock
+++ b/pkgs/servers/teleport/13/Cargo.lock
@@ -1786,9 +1786,9 @@ dependencies = [
 
 [[package]]
 name = "webpki"
-version = "0.22.0"
+version = "0.22.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd"
+checksum = "07ecc0cd7cac091bf682ec5efa18b1cff79d617b84181f38b3951dbe135f607f"
 dependencies = [
  "ring",
  "untrusted 0.7.1",
diff --git a/pkgs/servers/teleport/13/default.nix b/pkgs/servers/teleport/13/default.nix
index 58d682f52ac2e..65cbed70d9cc2 100644
--- a/pkgs/servers/teleport/13/default.nix
+++ b/pkgs/servers/teleport/13/default.nix
@@ -1,9 +1,9 @@
 { callPackage, ... }@args:
 callPackage ../generic.nix ({
-  version = "13.4.1";
-  hash = "sha256-wgSaek4eq5Jx9SZFenvdRSU1wEtfJHzTz9GdczzUU2w=";
-  vendorHash = "sha256-DesT18nV/SxOsKCC+Nt0hgtH7CRtRL0B5FQhE1J148I=";
-  yarnHash = "sha256-iyMcP9L6dwBhN8JL9eSVEzsXI2EOjfyxjF9Dm4Gs04s=";
+  version = "13.4.3";
+  hash = "sha256-x8G94jKycK3nYwqDA5RPc63GHIk9y4pHfSwSBqGBINk=";
+  vendorHash = "sha256-Pb3eO9zqLgTD7otM7yGRWicQjvpIXg7xKV8Oc4yh8PA=";
+  yarnHash = "sha256-GnoiLqzqGV0UZm5zePCDBUUX63NTIIo1dcxtiWQDPqc=";
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
diff --git a/pkgs/servers/teleport/14/Cargo.lock b/pkgs/servers/teleport/14/Cargo.lock
index 8b18ac74ae704..c9b50a388b0ba 100644
--- a/pkgs/servers/teleport/14/Cargo.lock
+++ b/pkgs/servers/teleport/14/Cargo.lock
@@ -1789,9 +1789,9 @@ dependencies = [
 
 [[package]]
 name = "webpki"
-version = "0.22.0"
+version = "0.22.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd"
+checksum = "07ecc0cd7cac091bf682ec5efa18b1cff79d617b84181f38b3951dbe135f607f"
 dependencies = [
  "ring",
  "untrusted 0.7.1",
diff --git a/pkgs/servers/teleport/14/default.nix b/pkgs/servers/teleport/14/default.nix
index 15a594ef13e65..71036da070ef1 100644
--- a/pkgs/servers/teleport/14/default.nix
+++ b/pkgs/servers/teleport/14/default.nix
@@ -1,9 +1,9 @@
 { callPackage, ... }@args:
 callPackage ../generic.nix ({
-  version = "14.0.1";
-  hash = "sha256-esQwk2PFnk3/REzLr3ExtzEcUs2q4Tn/2KpfFWAx5uU=";
-  vendorHash = "sha256-lzwrkW0dHxCHBSJjzNhXgq3Av8Zj8xEn3kfTRtT/q04=";
-  yarnHash = "sha256-Y2dVxRyKPLD2xjwr0QqrKHf/4gnMCErmDzievu5zTGg=";
+  version = "14.0.3";
+  hash = "sha256-X+vekYmuTE7n22SH/z2GWO3wnBsIef1GEjR7WOJpjc8=";
+  vendorHash = "sha256-+R6f2HrlN/RLec83YutccDFJW6gq6HXbxoJVtxMgdp8=";
+  yarnHash = "sha256-udM4DNaTGiMkqfkllJjmT+Nk6PNbGUzT34ixQOhmScw=";
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
diff --git a/pkgs/servers/unifi-video/default.nix b/pkgs/servers/unifi-video/default.nix
index 45a9b5c6fb61e..45a9b5c6fb61e 100755..100644
--- a/pkgs/servers/unifi-video/default.nix
+++ b/pkgs/servers/unifi-video/default.nix
diff --git a/pkgs/servers/web-apps/lemmy/package.json b/pkgs/servers/web-apps/lemmy/package.json
index f9b990ec203b9..5b7f477f7c296 100644
--- a/pkgs/servers/web-apps/lemmy/package.json
+++ b/pkgs/servers/web-apps/lemmy/package.json
@@ -1,6 +1,6 @@
 {
   "name": "lemmy-ui",
-  "version": "0.18.4",
+  "version": "0.18.5",
   "description": "An isomorphic UI for lemmy",
   "repository": "https://github.com/LemmyNet/lemmy-ui",
   "license": "AGPL-3.0",
diff --git a/pkgs/servers/web-apps/lemmy/pin.json b/pkgs/servers/web-apps/lemmy/pin.json
index a2cd105158331..f7a4d855f406c 100644
--- a/pkgs/servers/web-apps/lemmy/pin.json
+++ b/pkgs/servers/web-apps/lemmy/pin.json
@@ -1,8 +1,8 @@
 {
-  "serverVersion": "0.18.4",
-  "uiVersion": "0.18.4",
-  "serverHash": "sha256-J+kjsirEcLz0th3IGVheSShVLbQma1Eip329/q5/3S8=",
-  "serverCargoHash": "sha256-0UDhHa2QvHoNYJIArpc/o+lkq87tBX/XVgXsr7y/+Rk=",
-  "uiHash": "sha256-E/rSNWVjiZE5Hl0iIocQfkIdOFSeB0zYXQDq9A3h3lI=",
+  "serverVersion": "0.18.5",
+  "uiVersion": "0.18.5",
+  "serverHash": "sha256-tj8zryCzW3r6VGiNGlI5eo0I+rJfhTUOGtb3YieodpQ=",
+  "serverCargoHash": "sha256-80jk1GhnXos+lil3joEtPwJjsE8qSEm/WinCfZ3CF/c=",
+  "uiHash": "sha256-fyXKhVTFc1+gG2TXb9l/YkcwRt/p7DWtB1FO5mpQ3i4=",
   "uiYarnDepsHash": "sha256-rLP1CQd75nVfI6C0sC21TUskzVfbGHm2fblcYr6JcGc="
 }
diff --git a/pkgs/shells/fish/default.nix b/pkgs/shells/fish/default.nix
index 4df95a9ca6fe5..bd816f9a89919 100644
--- a/pkgs/shells/fish/default.nix
+++ b/pkgs/shells/fish/default.nix
@@ -79,7 +79,7 @@ let
     # note that this is required:
     #   1. For all shells, not just login shells (mosh needs this as do some other command-line utilities)
     #   2. Before the shell is initialized, so that config snippets can find the commands they use on the PATH
-    builtin status --is-login
+    builtin status is-login
     or test -z "$__fish_nixos_env_preinit_sourced" -a -z "$ETC_PROFILE_SOURCED" -a -z "$ETC_ZSHENV_SOURCED"
     ${if fishEnvPreInit != null then ''
     and begin
diff --git a/pkgs/shells/fish/plugins/tide.nix b/pkgs/shells/fish/plugins/tide.nix
index 94cbfaa6b8f9f..39afd487afdba 100644
--- a/pkgs/shells/fish/plugins/tide.nix
+++ b/pkgs/shells/fish/plugins/tide.nix
@@ -4,13 +4,13 @@
 # Refer to the following comment to get you setup: https://github.com/NixOS/nixpkgs/pull/201646#issuecomment-1320893716
 buildFishPlugin rec {
   pname = "tide";
-  version = "5.6.0";
+  version = "6.0.1";
 
   src = fetchFromGitHub {
     owner = "IlanCosman";
     repo = "tide";
     rev = "v${version}";
-    hash = "sha256-cCI1FDpvajt1vVPUd/WvsjX/6BJm6X1yFPjqohmo1rI=";
+    hash = "sha256-oLD7gYFCIeIzBeAW1j62z5FnzWAp3xSfxxe7kBtTLgA=";
   };
 
   #buildFishplugin will only move the .fish files, but tide has a tide configure function
diff --git a/pkgs/shells/fish/wrapper.nix b/pkgs/shells/fish/wrapper.nix
index 75213809821f2..62ae03ec9ef99 100644
--- a/pkgs/shells/fish/wrapper.nix
+++ b/pkgs/shells/fish/wrapper.nix
@@ -18,7 +18,7 @@ let
     name = "wrapfish.aliases.fish";
     destination = "/share/fish/vendor_conf.d/aliases.fish";
     text = ''
-      status --is-interactive; and begin
+      status is-interactive; and begin
         # Aliases
         ${aliasesStr}
       end
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index 34b8f9504f8b3..acd7494fd3cc9 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -22,7 +22,7 @@
 }:
 
 let
-  version = "0.85.0";
+  version = "0.86.0";
 in
 
 rustPlatform.buildRustPackage {
@@ -33,10 +33,10 @@ rustPlatform.buildRustPackage {
     owner = "nushell";
     repo = "nushell";
     rev = version;
-    hash = "sha256-/c3JTgIT+T41D0S7irQ0jq2MDzmx3os4pYpVr10cL3E=";
+    hash = "sha256-jUZKqsu0/RO4mc+hzjis1mNrohj1JzM17Z8e2Ggxlfs=";
   };
 
-  cargoHash = "sha256-lBipwX72j0Af3PCat18s9NIjJiKZFZTcU9Utwt+eQzI=";
+  cargoHash = "sha256-WDGhuc2ZGDwfh7X/oRTZLzmKPj1jSnQFL4sy7KYt5Js=";
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optionals (withDefaultFeatures && stdenv.isLinux) [ python3 ]
diff --git a/pkgs/shells/nushell/plugins/default.nix b/pkgs/shells/nushell/plugins/default.nix
index 44b5b05a739f7..dfe2a4062c89a 100644
--- a/pkgs/shells/nushell/plugins/default.nix
+++ b/pkgs/shells/nushell/plugins/default.nix
@@ -4,4 +4,5 @@ lib.makeScope newScope (self: with self; {
   gstat = callPackage ./gstat.nix { inherit Security; };
   formats = callPackage ./formats.nix { inherit IOKit Foundation; };
   query = callPackage ./query.nix { inherit IOKit CoreFoundation; };
+  regex = callPackage ./regex.nix { };
 })
diff --git a/pkgs/shells/nushell/plugins/regex.nix b/pkgs/shells/nushell/plugins/regex.nix
new file mode 100644
index 0000000000000..457c7170a5b3e
--- /dev/null
+++ b/pkgs/shells/nushell/plugins/regex.nix
@@ -0,0 +1,32 @@
+{ stdenv
+, lib
+, rustPlatform
+, fetchFromGitHub
+, nix-update-script
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "nushell_plugin_regex";
+  version = "unstable-2023-10-08";
+
+  src = fetchFromGitHub {
+    owner = "fdncred";
+    repo = "nu_plugin_regex";
+    rev = "e1aa88e703f1f632ede685dd733472d34dd0c8e7";
+    hash = "sha256-GJgnsaeNDJoJjw8RPw6wpEq1mIult18Eh4frl8Plgxc=";
+  };
+
+  cargoHash = "sha256-AACpzSavY6MlYnl1lDYxVlfsEvEpNK0u8SzsoSZbqFc=";
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = with lib; {
+    description = "A Nushell plugin to parse regular expressions";
+    homepage = "https://github.com/fdncred/nu_plugin_regex";
+    license = licenses.mit;
+    maintainers = with maintainers; [ aidalgol ];
+    platforms = with platforms; all;
+  };
+}
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 1024bf2ce4d8d..f7d7053c77a97 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -197,16 +197,10 @@ rec {
       '';
     };
   in stdenv.override (old: {
-    cc = stdenv.cc.override {
-      inherit bintools;
-    };
-    allowedRequisites =
-      (lib.optional (stdenv.allowedRequisites or null != null) stdenv.allowedRequisites)
-        ++ [ bintools pkgs.mold ]
-        # need to `outputSpecified = false` to make getLib work
-        ++ (builtins.map (p: lib.getLib (p // { outputSpecified = false; })) pkgs.mold.buildInputs);
-      # gcc >12.1.0 supports '-fuse-ld=mold'
-      # the wrap ld above in bintools supports gcc <12.1.0 and shouldn't harm >12.1.0
+    allowedRequisites = null;
+    cc = stdenv.cc.override { inherit bintools; };
+    # gcc >12.1.0 supports '-fuse-ld=mold'
+    # the wrap ld above in bintools supports gcc <12.1.0 and shouldn't harm >12.1.0
     # https://github.com/rui314/mold#how-to-use
     } // lib.optionalAttrs (stdenv.cc.isClang || (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12")) {
     mkDerivationFromStdenv = extendMkDerivationArgs old (args: {
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 5c03312cc75f0..35cdb6311df32 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -68,7 +68,7 @@
       mipsel-linux = import ./bootstrap-files/mipsel-unknown-linux-gnu.nix;
       mips64el-linux = import
        (if localSystem.isMips64n32
-        then ./bootstrap-files/mips64el-unknown-linux-gnuabin32.nix.nix
+        then ./bootstrap-files/mips64el-unknown-linux-gnuabin32.nix
         else ./bootstrap-files/mips64el-unknown-linux-gnuabi64.nix);
       powerpc64le-linux = import ./bootstrap-files/powerpc64le-unknown-linux-gnu.nix;
       riscv64-linux = import ./bootstrap-files/riscv64-unknown-linux-gnu.nix;
diff --git a/pkgs/tools/X11/xssstate/default.nix b/pkgs/tools/X11/xssstate/default.nix
index a1ce545a5f133..53fd1138c29dd 100644
--- a/pkgs/tools/X11/xssstate/default.nix
+++ b/pkgs/tools/X11/xssstate/default.nix
@@ -4,29 +4,31 @@
 , libX11
 , libXScrnSaver
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xssstate";
-  #
-  # Use the date of the last commit, since there were bug fixes after the 1.1
-  # release.
-  #
-  version = "unstable-2022-09-24";
+  version = "1.1-unstable-2022-09-24";
+
   src = fetchgit {
     url = "https://git.suckless.org/xssstate/";
     rev = "5d8e9b49ce2970f786f1e5aa12bbaae83900453f";
     hash = "sha256-Aor12tU1I/qNZCdBhZcvNK1FWFh0HYK8CEI29X5yoeA=";
   };
 
-  makeFlags = [ "VERSION=${version}" ];
-
-  installFlags = [ "PREFIX=$(out)" ];
+  buildInputs = [
+    libX11
+    libXScrnSaver
+  ];
 
-  buildInputs = [ libX11 libXScrnSaver ];
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "VERSION=${finalAttrs.version}"
+  ];
 
   meta = with lib; {
     description = "A simple tool to retrieve the X screensaver state";
     license = licenses.mit;
     maintainers = with maintainers; [ onemoresuza ];
     platforms = platforms.linux;
+    mainProgram = "xssstate";
   };
-}
+})
diff --git a/pkgs/tools/admin/chamber/default.nix b/pkgs/tools/admin/chamber/default.nix
index 7f716e3b1fbe1..0dca98037997a 100644
--- a/pkgs/tools/admin/chamber/default.nix
+++ b/pkgs/tools/admin/chamber/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "chamber";
-  version = "2.13.3";
+  version = "2.13.4";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Pte2fOIuezFJ1Hz5MgjRDTIAMJ5r+LO1hKHc3sLu0W4=";
+    sha256 = "sha256-J6sLDalvUl4SgSyr5DK/tW7DyRa/qdKw6zornz1R2ck=";
   };
 
   CGO_ENABLED = 0;
 
-  vendorHash = "sha256-McicBVC2niLvP902monJwPMOrQKSum10zeHNcO32/M8=";
+  vendorHash = "sha256-BkTC6sqitc1OHdQFlA2BtqxHI31ubBj2GRszs3YlWsA=";
 
   ldflags = [ "-s" "-w" "-X main.Version=v${version}" ];
 
diff --git a/pkgs/tools/admin/pgadmin/default.nix b/pkgs/tools/admin/pgadmin/default.nix
index 3040258c0ca7a..beecd6412bcfb 100644
--- a/pkgs/tools/admin/pgadmin/default.nix
+++ b/pkgs/tools/admin/pgadmin/default.nix
@@ -14,14 +14,14 @@
 
 let
   pname = "pgadmin";
-  version = "7.5";
-  yarnSha256 = "sha256-rEKMUZksmR2jPwtXy6drNwAJktK/3Dee6EZVFHPngWs=";
+  version = "7.7";
+  yarnHash = "sha256-8EbbyZHodrYz4a2IYuIWYGutqvrjauSv34o9KFvR/6c=";
 
   src = fetchFromGitHub {
     owner = "pgadmin-org";
     repo = "pgadmin4";
     rev = "REL-${lib.versions.major version}_${lib.versions.minor version}";
-    hash = "sha256-o8jPqp4jLF/lZ0frCzPDCSxCy51Nt0mbdeNB44ZwNHI=";
+    hash = "sha256-+KD05hzghNFpuw2xW3NUVyKwspCUO9fyJgMPzYk1Xt8=";
   };
 
   # keep the scope, as it is used throughout the derivation and tests
@@ -30,7 +30,7 @@ let
 
   offlineCache = fetchYarnDeps {
     yarnLock = ./yarn.lock;
-    hash = yarnSha256;
+    hash = yarnHash;
   };
 
 in
diff --git a/pkgs/tools/admin/pgadmin/expose-setup.py.patch b/pkgs/tools/admin/pgadmin/expose-setup.py.patch
index 13f7d5069c69b..ac68eabd411d6 100644
--- a/pkgs/tools/admin/pgadmin/expose-setup.py.patch
+++ b/pkgs/tools/admin/pgadmin/expose-setup.py.patch
@@ -58,3 +58,31 @@ index 2204ffb..d5fda9f 100644
 +
 +if __name__ == '__main__':
 +    main()
+
+diff --git a/web/pgadmin/model/__init__.py b/web/pgadmin/model/__init__.py
+index 4c36dd1..a492365 100644
+--- a/web/pgadmin/model/__init__.py
++++ b/web/pgadmin/model/__init__.py
+@@ -23,7 +23,6 @@ from flask_sqlalchemy import SQLAlchemy
+ from sqlalchemy.ext.mutable import MutableDict
+ import sqlalchemy.types as types
+ import uuid
+-import config
+
+ ##########################################################################
+ #
+@@ -41,10 +40,12 @@ SCHEMA_VERSION = 35
+ #
+ ##########################################################################
+
++# hardcode poolsize and max_overflow due to a circular import (config imports model,
++# model now tries to import config)
+ db = SQLAlchemy(
+     engine_options={
+-        'pool_size': config.CONFIG_DATABASE_CONNECTION_POOL_SIZE,
+-        'max_overflow': config.CONFIG_DATABASE_CONNECTION_MAX_OVERFLOW})
++        'pool_size': 5,
++        'max_overflow': 100})
+
+
+ USER_ID = 'user.id'
diff --git a/pkgs/tools/admin/pgadmin/update.sh b/pkgs/tools/admin/pgadmin/update.sh
index a819c94ebc980..90b52f18ad513 100755
--- a/pkgs/tools/admin/pgadmin/update.sh
+++ b/pkgs/tools/admin/pgadmin/update.sh
@@ -104,7 +104,7 @@ cp yarn.lock "$nixpkgs/pkgs/tools/admin/pgadmin/"
 printf "Done\n"
 popd
 
-sed -i -E -e "s#yarnSha256 = \".*\"#yarnSha256 = \"$YARN_HASH\"#" ${scriptDir}/default.nix
+sed -i -E -e "s#yarnHash = \".*\"#yarnHash = \"$YARN_HASH\"#" ${scriptDir}/default.nix
 
 update-source-version pgadmin4 "$newest_version" --print-changes
 touch $TMPDIR/.done
diff --git a/pkgs/tools/admin/pgadmin/yarn.lock b/pkgs/tools/admin/pgadmin/yarn.lock
index 04815260d4962..8ced96dcb781f 100644
--- a/pkgs/tools/admin/pgadmin/yarn.lock
+++ b/pkgs/tools/admin/pgadmin/yarn.lock
@@ -1640,16 +1640,31 @@
     rc-resize-observer "^1.3.1"
     rc-util "^5.33.0"
 
+"@react-dnd/asap@^4.0.0":
+  version "4.0.1"
+  resolved "https://registry.npmjs.org/@react-dnd/asap/-/asap-4.0.1.tgz#5291850a6b58ce6f2da25352a64f1b0674871aab"
+  integrity sha512-kLy0PJDDwvwwTXxqTFNAAllPHD73AycE9ypWeln/IguoGBEbvFcPDbCV03G52bEcC5E+YgupBE0VzHGdC8SIXg==
+
 "@react-dnd/asap@^5.0.1":
   version "5.0.2"
   resolved "https://registry.npmjs.org/@react-dnd/asap/-/asap-5.0.2.tgz#1f81f124c1cd6f39511c11a881cfb0f715343488"
   integrity sha512-WLyfoHvxhs0V9U+GTsGilGgf2QsPl6ZZ44fnv0/b8T3nQyvzxidxsg/ZltbWssbsRDlYW8UKSQMTGotuTotZ6A==
 
+"@react-dnd/invariant@^2.0.0":
+  version "2.0.0"
+  resolved "https://registry.npmjs.org/@react-dnd/invariant/-/invariant-2.0.0.tgz#09d2e81cd39e0e767d7da62df9325860f24e517e"
+  integrity sha512-xL4RCQBCBDJ+GRwKTFhGUW8GXa4yoDfJrPbLblc3U09ciS+9ZJXJ3Qrcs/x2IODOdIE5kQxvMmE2UKyqUictUw==
+
 "@react-dnd/invariant@^4.0.1":
   version "4.0.2"
   resolved "https://registry.npmjs.org/@react-dnd/invariant/-/invariant-4.0.2.tgz#b92edffca10a26466643349fac7cdfb8799769df"
   integrity sha512-xKCTqAK/FFauOM9Ta2pswIyT3D8AQlfrYdOi/toTPEhqCuAs1v5tcJ3Y08Izh1cJ5Jchwy9SeAXmMg6zrKs2iw==
 
+"@react-dnd/shallowequal@^2.0.0":
+  version "2.0.0"
+  resolved "https://registry.npmjs.org/@react-dnd/shallowequal/-/shallowequal-2.0.0.tgz#a3031eb54129f2c66b2753f8404266ec7bf67f0a"
+  integrity sha512-Pc/AFTdwZwEKJxFJvlxrSmGe/di+aAOBn60sremrpLo6VI/6cmiUYNNwlI5KNYttg7uypzA3ILPMPgxB2GYZEg==
+
 "@react-dnd/shallowequal@^4.0.1":
   version "4.0.2"
   resolved "https://registry.npmjs.org/@react-dnd/shallowequal/-/shallowequal-4.0.2.tgz#d1b4befa423f692fa4abf1c79209702e7d8ae4b4"
@@ -2635,6 +2650,11 @@ async@^3.2.3:
   resolved "https://registry.npmjs.org/async/-/async-3.2.4.tgz#2d22e00f8cddeb5fde5dd33522b56d1cf569a81c"
   integrity sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ==
 
+asynckit@^0.4.0:
+  version "0.4.0"
+  resolved "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz#c79ed97f7f34cb8f2ba1bc9790bcc366474b4b79"
+  integrity sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==
+
 attr-accept@^2.2.2:
   version "2.2.2"
   resolved "https://registry.npmjs.org/attr-accept/-/attr-accept-2.2.2.tgz#646613809660110749e92f2c10833b70968d929b"
@@ -2665,12 +2685,14 @@ axios-mock-adapter@^1.17.0:
     fast-deep-equal "^3.1.3"
     is-buffer "^2.0.5"
 
-axios@^0.21.1:
-  version "0.21.4"
-  resolved "https://registry.npmjs.org/axios/-/axios-0.21.4.tgz#c67b90dc0568e5c1cf2b0b858c43ba28e2eda575"
-  integrity sha512-ut5vewkiu8jjGBdqpM44XxjuCjq9LAKeHVmoVfHVzy8eHgxxq8SbAVQNovDA8mVi05kP0Ea/n/UzcSHcTJQfNg==
+axios@^1.4.0:
+  version "1.4.0"
+  resolved "https://registry.npmjs.org/axios/-/axios-1.4.0.tgz#38a7bf1224cd308de271146038b551d725f0be1f"
+  integrity sha512-S4XCWMEmzvo64T9GfvQDOXgYRDJ/wsSZc7Jvdgx5u1sd0JwsuPLqb3SYmusag+edF6ziyMensPVqLTSc1PiSEA==
   dependencies:
-    follow-redirects "^1.14.0"
+    follow-redirects "^1.15.0"
+    form-data "^4.0.0"
+    proxy-from-env "^1.1.0"
 
 babel-code-frame@^6.26.0:
   version "6.26.0"
@@ -2906,7 +2928,7 @@ bin-version@^3.0.0:
     execa "^1.0.0"
     find-versions "^3.0.0"
 
-"bin-wrapper@^4.0.0", "bin-wrapper@^4.0.1":
+bin-wrapper@^4.0.0:
   version "4.1.0"
   resolved "https://registry.npmjs.org/bin-wrapper/-/bin-wrapper-4.1.0.tgz#99348f2cf85031e3ef7efce7e5300aeaae960605"
   integrity sha512-hfRmo7hWIXPkbpi0ZltboCMVrU+0ClXR/JgbCKKjlDjQf6igXa7OwdqNcFWQZPZTgiY7ZpzE3+LjjkLiTN2T7Q==
@@ -3546,6 +3568,13 @@ colorette@^2.0.14:
     lodash.memoize "~3.0.3"
     source-map "~0.5.3"
 
+combined-stream@^1.0.8:
+  version "1.0.8"
+  resolved "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz#c3d45a8b34fd730631a110a8a2520682b31d5a7f"
+  integrity sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==
+  dependencies:
+    delayed-stream "~1.0.0"
+
 "commander@^2.19.0", "commander@^2.20.0", "commander@^2.8.1":
   version "2.20.3"
   resolved "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz#fd485e84c03eb4881c20722ba48035e8531aeb33"
@@ -4211,6 +4240,11 @@ defined@^1.0.0:
   resolved "https://registry.npmjs.org/defined/-/defined-1.0.1.tgz#c0b9db27bfaffd95d6f61399419b893df0f91ebf"
   integrity sha512-hsBd2qSVCRE+5PmNdHt1uzyrFu5d3RwmFDKzyNZMFq/EwDNJF7Ee5+D5oEKF0hU6LhtoUF1macFvOe4AskQC1Q==
 
+delayed-stream@~1.0.0:
+  version "1.0.0"
+  resolved "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz#df3ae199acadfb7d440aaae0b29e2272b24ec619"
+  integrity sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==
+
 delegates@^1.0.0:
   version "1.0.0"
   resolved "https://registry.npmjs.org/delegates/-/delegates-1.0.0.tgz#84c6e159b81904fdca59a0ef44cd870d31250f9a"
@@ -4294,6 +4328,15 @@ discontinuous-range@1.0.0:
   resolved "https://registry.npmjs.org/discontinuous-range/-/discontinuous-range-1.0.0.tgz#e38331f0844bba49b9a9cb71c771585aab1bc65a"
   integrity sha512-c68LpLbO+7kP/b1Hr1qs8/BJ09F5khZGTxqxZuhzxpmwJKOgRFHJWIb9/KmqnqHhLdO55aOxFH/EGBvUQbL/RQ==
 
+dnd-core@14.0.1:
+  version "14.0.1"
+  resolved "https://registry.npmjs.org/dnd-core/-/dnd-core-14.0.1.tgz#76d000e41c494983210fb20a48b835f81a203c2e"
+  integrity sha512-+PVS2VPTgKFPYWo3vAFEA8WPbTf7/xo43TifH9G8S1KqnrQu0o77A3unrF5yOugy4mIz7K5wAVFHUcha7wsz6A==
+  dependencies:
+    "@react-dnd/asap" "^4.0.0"
+    "@react-dnd/invariant" "^2.0.0"
+    redux "^4.1.1"
+
 dnd-core@^16.0.1:
   version "16.0.1"
   resolved "https://registry.npmjs.org/dnd-core/-/dnd-core-16.0.1.tgz#a1c213ed08961f6bd1959a28bb76f1a868360d19"
@@ -4368,20 +4411,20 @@ domain-browser@^1.2.0:
   resolved "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz#5c45e8e869952626331d7aab326d01daf65d589d"
   integrity sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==
 
-"domhandler@4.3.1", "domhandler@^4.2.0", "domhandler@^4.2.2", "domhandler@^4.3.1":
-  version "4.3.1"
-  resolved "https://registry.npmjs.org/domhandler/-/domhandler-4.3.1.tgz#8d792033416f59d68bc03a5aa7b018c1ca89279c"
-  integrity sha512-GrwoxYN+uWlzO8uhUXRl0P+kHE4GtVPfYzVLcUxPL7KNdHKj66vvlhiweIHqYYXWlw+T8iLMp42Lm67ghw4WMQ==
-  dependencies:
-    domelementtype "^2.2.0"
-
-"domhandler@^5.0.2", "domhandler@^5.0.3":
+"domhandler@5.0.3", "domhandler@^5.0.2", "domhandler@^5.0.3":
   version "5.0.3"
   resolved "https://registry.npmjs.org/domhandler/-/domhandler-5.0.3.tgz#cc385f7f751f1d1fc650c21374804254538c7d31"
   integrity sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==
   dependencies:
     domelementtype "^2.3.0"
 
+"domhandler@^4.2.0", "domhandler@^4.3.1":
+  version "4.3.1"
+  resolved "https://registry.npmjs.org/domhandler/-/domhandler-4.3.1.tgz#8d792033416f59d68bc03a5aa7b018c1ca89279c"
+  integrity sha512-GrwoxYN+uWlzO8uhUXRl0P+kHE4GtVPfYzVLcUxPL7KNdHKj66vvlhiweIHqYYXWlw+T8iLMp42Lm67ghw4WMQ==
+  dependencies:
+    domelementtype "^2.2.0"
+
 domutils@^2.8.0:
   version "2.8.0"
   resolved "https://registry.npmjs.org/domutils/-/domutils-2.8.0.tgz#4437def5db6e2d1f5d6ee859bd95ca7d02048135"
@@ -4391,7 +4434,7 @@ domutils@^2.8.0:
     domelementtype "^2.2.0"
     domhandler "^4.2.0"
 
-domutils@^3.0.1:
+"domutils@^3.0.1", "domutils@^3.1.0":
   version "3.1.0"
   resolved "https://registry.npmjs.org/domutils/-/domutils-3.1.0.tgz#c47f551278d3dc4b0b1ab8cbb42d751a6f0d824e"
   integrity sha512-H78uMmQtI2AhgDJjWeQmHwJJ2bLPD3GMmO7Zja/ZZh84wkm+4ut+IUnUdRa8uCGX88DiVx1j6FRe1XfxEgjEZA==
@@ -4571,12 +4614,7 @@ entities@^2.0.0:
   resolved "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz#098dc90ebb83d8dffa089d55256b351d34c4da55"
   integrity sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==
 
-entities@^3.0.1:
-  version "3.0.1"
-  resolved "https://registry.npmjs.org/entities/-/entities-3.0.1.tgz#2b887ca62585e96db3903482d336c1006c3001d4"
-  integrity sha512-WiyBqoomrwMdFG1e0kqvASYfnlb0lp8M5o5Fw2OFq1hNZxxcNk8Ik0Xm7LxzBhuidnZB/UtBqVCgUz3kBOP51Q==
-
-"entities@^4.2.0", "entities@^4.4.0":
+"entities@^4.2.0", "entities@^4.4.0", "entities@^4.5.0":
   version "4.5.0"
   resolved "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz#5d268ea5e7113ec74c4d033b79ea5a35a488fb48"
   integrity sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==
@@ -4948,21 +4986,6 @@ execa@^1.0.0:
     signal-exit "^3.0.0"
     strip-eof "^1.0.0"
 
-execa@^4.0.0:
-  version "4.1.0"
-  resolved "https://registry.npmjs.org/execa/-/execa-4.1.0.tgz#4e5491ad1572f2f17a77d388c6c857135b22847a"
-  integrity sha512-j5W0//W7f8UxAn8hXVnwG8tLwdiUy4FJLcSupCg6maBYZDpyBvTApK7KyuI4bKj8KOh1r2YH+6ucuYtJv1bTZA==
-  dependencies:
-    cross-spawn "^7.0.0"
-    get-stream "^5.0.0"
-    human-signals "^1.1.1"
-    is-stream "^2.0.0"
-    merge-stream "^2.0.0"
-    npm-run-path "^4.0.0"
-    onetime "^5.1.0"
-    signal-exit "^3.0.2"
-    strip-final-newline "^2.0.0"
-
 execa@^6.0.0:
   version "6.1.0"
   resolved "https://registry.npmjs.org/execa/-/execa-6.1.0.tgz#cea16dee211ff011246556388effa0818394fb20"
@@ -5221,7 +5244,7 @@ flat-cache@^3.0.4:
   resolved "https://registry.npmjs.org/flatted/-/flatted-3.2.7.tgz#609f39207cb614b89d0765b477cb2d437fbf9787"
   integrity sha512-5nqDSxl8nn5BSNxyR3n4I6eDmbolI6WT+QqR547RwxQapgjQBmtktdP+HTBb/a/zLsbzERTONyUB5pefh5TtjQ==
 
-"follow-redirects@^1.0.0", "follow-redirects@^1.14.0":
+"follow-redirects@^1.0.0", "follow-redirects@^1.15.0":
   version "1.15.2"
   resolved "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz#b460864144ba63f2681096f274c4e57026da2c13"
   integrity sha512-VQLG33o04KaQ8uYi2tVNbdrWp1QWxNNea+nmIB4EVM28v0hmP17z7aG1+wAkNzVq4KeXTq3221ye5qTJP91JwA==
@@ -5241,6 +5264,15 @@ foreground-child@^3.1.0:
     cross-spawn "^7.0.0"
     signal-exit "^4.0.1"
 
+form-data@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz#93919daeaf361ee529584b9b31664dc12c9fa452"
+  integrity sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==
+  dependencies:
+    asynckit "^0.4.0"
+    combined-stream "^1.0.8"
+    mime-types "^2.1.12"
+
 fraction.js@^4.2.0:
   version "4.2.0"
   resolved "https://registry.npmjs.org/fraction.js/-/fraction.js-4.2.0.tgz#448e5109a313a3527f5a3ab2119ec4cf0e0e2950"
@@ -5385,13 +5417,6 @@ get-stream@^4.0.0:
   dependencies:
     pump "^3.0.0"
 
-get-stream@^5.0.0:
-  version "5.2.0"
-  resolved "https://registry.npmjs.org/get-stream/-/get-stream-5.2.0.tgz#4966a1795ee5ace65e706c4b7beb71257d6e22d3"
-  integrity sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==
-  dependencies:
-    pump "^3.0.0"
-
 get-stream@^6.0.1:
   version "6.0.1"
   resolved "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz#a262d8eef67aced57c2852ad6167526a43cbf7b7"
@@ -5726,13 +5751,13 @@ hosted-git-info@^4.0.1:
   dependencies:
     lru-cache "^6.0.0"
 
-html-dom-parser@1.2.0:
-  version "1.2.0"
-  resolved "https://registry.npmjs.org/html-dom-parser/-/html-dom-parser-1.2.0.tgz#8f689b835982ffbf245eda99730e92b8462c111e"
-  integrity sha512-2HIpFMvvffsXHFUFjso0M9LqM+1Lm22BF+Df2ba+7QHJXjk63pWChEnI6YG27eaWqUdfnh5/Vy+OXrNTtepRsg==
+html-dom-parser@4.0.0:
+  version "4.0.0"
+  resolved "https://registry.npmjs.org/html-dom-parser/-/html-dom-parser-4.0.0.tgz#dc382fbbc9306f8c9b5aae4e3f2822e113a48709"
+  integrity sha512-TUa3wIwi80f5NF8CVWzkopBVqVAtlawUzJoLwVLHns0XSJGynss4jiY0mTWpiDOsuyw+afP+ujjMgRh9CoZcXw==
   dependencies:
-    domhandler "4.3.1"
-    htmlparser2 "7.2.0"
+    domhandler "5.0.3"
+    htmlparser2 "9.0.0"
 
 html-element-map@^1.2.0:
   version "1.3.1"
@@ -5747,15 +5772,15 @@ html-escaper@^2.0.0:
   resolved "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz#dfd60027da36a36dfcbe236262c00a5822681453"
   integrity sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==
 
-html-react-parser@^1.2.7:
-  version "1.4.14"
-  resolved "https://registry.npmjs.org/html-react-parser/-/html-react-parser-1.4.14.tgz#577b7a90be0c61eebbbc488d914ad08398c79ef5"
-  integrity sha512-pxhNWGie8Y+DGDpSh8cTa0k3g8PsDcwlfolA+XxYo1AGDeB6e2rdlyv4ptU9bOTiZ2i3fID+6kyqs86MN0FYZQ==
+html-react-parser@^4.2.0:
+  version "4.2.0"
+  resolved "https://registry.npmjs.org/html-react-parser/-/html-react-parser-4.2.0.tgz#9168eda80dbfe0335a87fde3fb3ed6c2e91b1188"
+  integrity sha512-gzU55AS+FI6qD7XaKe5BLuLFM2Xw0/LodfMWZlxV9uOHe7LCD5Lukx/EgYuBI3c0kLu0XlgFXnSzO0qUUn3Vrg==
   dependencies:
-    domhandler "4.3.1"
-    html-dom-parser "1.2.0"
+    domhandler "5.0.3"
+    html-dom-parser "4.0.0"
     react-property "2.0.0"
-    style-to-js "1.1.1"
+    style-to-js "1.1.3"
 
 html2canvas@^1.0.0-rc.7:
   version "1.4.1"
@@ -5770,15 +5795,15 @@ htmlescape@^1.1.0:
   resolved "https://registry.npmjs.org/htmlescape/-/htmlescape-1.1.1.tgz#3a03edc2214bca3b66424a3e7959349509cb0351"
   integrity sha512-eVcrzgbR4tim7c7soKQKtxa/kQM4TzjnlU83rcZ9bHU6t31ehfV7SktN6McWgwPWg+JYMA/O3qpGxBvFq1z2Jg==
 
-htmlparser2@7.2.0:
-  version "7.2.0"
-  resolved "https://registry.npmjs.org/htmlparser2/-/htmlparser2-7.2.0.tgz#8817cdea38bbc324392a90b1990908e81a65f5a5"
-  integrity sha512-H7MImA4MS6cw7nbyURtLPO1Tms7C5H602LRETv95z1MxO/7CP7rDVROehUYeYBUYEON94NXXDEPmZuq+hX4sog==
+htmlparser2@9.0.0:
+  version "9.0.0"
+  resolved "https://registry.npmjs.org/htmlparser2/-/htmlparser2-9.0.0.tgz#e431142b7eeb1d91672742dea48af8ac7140cddb"
+  integrity sha512-uxbSI98wmFT/G4P2zXx4OVx04qWUmyFPrD2/CNepa2Zo3GPNaCaaxElDgwUrwYWkK1nr9fft0Ya8dws8coDLLQ==
   dependencies:
-    domelementtype "^2.0.1"
-    domhandler "^4.2.2"
-    domutils "^2.8.0"
-    entities "^3.0.1"
+    domelementtype "^2.3.0"
+    domhandler "^5.0.3"
+    domutils "^3.1.0"
+    entities "^4.5.0"
 
 htmlparser2@^8.0.1:
   version "8.0.2"
@@ -5842,11 +5867,6 @@ https-proxy-agent@^5.0.0:
     agent-base 6
     debug 4
 
-human-signals@^1.1.1:
-  version "1.1.1"
-  resolved "https://registry.npmjs.org/human-signals/-/human-signals-1.1.1.tgz#c5b1cd14f50aeae09ab6c59fe63ba3395fe4dfa3"
-  integrity sha512-SEQu7vl8KjNL2eoGBLF3+wAjpsNfA9XMlXAYj/3EdaNfAlxKthD1xjEQfGOUhllCGGJVNY34bRr6lPINhNjyZw==
-
 human-signals@^3.0.1:
   version "3.0.1"
   resolved "https://registry.npmjs.org/human-signals/-/human-signals-3.0.1.tgz#c740920859dafa50e5a3222da9d3bf4bb0e5eef5"
@@ -5919,17 +5939,6 @@ imagemin-optipng@^8.0.0:
     is-png "^2.0.0"
     optipng-bin "^7.0.0"
 
-imagemin-pngquant@^9.0.2:
-  version "9.0.2"
-  resolved "https://registry.npmjs.org/imagemin-pngquant/-/imagemin-pngquant-9.0.2.tgz#38155702b0cc4f60f671ba7c2b086ea3805d9567"
-  integrity sha512-cj//bKo8+Frd/DM8l6Pg9pws1pnDUjgb7ae++sUX1kUVdv2nrngPykhiUOgFeE0LGY/LmUbCf4egCHC4YUcZSg==
-  dependencies:
-    execa "^4.0.0"
-    is-png "^2.0.0"
-    is-stream "^2.0.0"
-    ow "^0.17.0"
-    pngquant-bin "^6.0.0"
-
 imagemin@^8.0.1:
   version "8.0.1"
   resolved "https://registry.npmjs.org/imagemin/-/imagemin-8.0.1.tgz#8b29ecb78197d8f0eac6a782f2e6b38fb3780d9e"
@@ -6303,11 +6312,6 @@ is-shared-array-buffer@^1.0.2:
   resolved "https://registry.npmjs.org/is-stream/-/is-stream-1.1.0.tgz#12d4a3dd4e68e0b79ceb8dbc84173ae80d91ca44"
   integrity sha512-uQPm8kcs47jx38atAcWTVxyltQYoPT68y9aWYdV6yWXSyW8mzSat0TL6CiWdZeCdF3KrAvpVtnHbTv4RN+rqdQ==
 
-is-stream@^2.0.0:
-  version "2.0.1"
-  resolved "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz#fac1e3d53b97ad5a9d0ae9cef2389f5810a5c077"
-  integrity sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==
-
 is-stream@^3.0.0:
   version "3.0.0"
   resolved "https://registry.npmjs.org/is-stream/-/is-stream-3.0.0.tgz#e6bfd7aa6bef69f4f472ce9bb681e3e57b4319ac"
@@ -7408,7 +7412,7 @@ miller-rabin@^4.0.0:
   resolved "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz#bbabcdc02859f4987301c856e3387ce5ec43bf70"
   integrity sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==
 
-"mime-types@^2.1.27", "mime-types@~2.1.24", "mime-types@~2.1.34":
+"mime-types@^2.1.12", "mime-types@^2.1.27", "mime-types@~2.1.24", "mime-types@~2.1.34":
   version "2.1.35"
   resolved "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz#381a871b62a734450660ae3deee44813f70d959a"
   integrity sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==
@@ -7420,11 +7424,6 @@ mime@^2.5.2:
   resolved "https://registry.npmjs.org/mime/-/mime-2.6.0.tgz#a2a682a95cd4d0cb1d6257e28f83da7e35800367"
   integrity sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg==
 
-mimic-fn@^2.1.0:
-  version "2.1.0"
-  resolved "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz#7ed2c2ccccaf84d3ffcb7a69b57711fc2083401b"
-  integrity sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==
-
 mimic-fn@^4.0.0:
   version "4.0.0"
   resolved "https://registry.npmjs.org/mimic-fn/-/mimic-fn-4.0.0.tgz#60a90550d5cb0b239cca65d893b1a53b29871ecc"
@@ -7829,13 +7828,6 @@ npm-run-path@^2.0.0:
   dependencies:
     path-key "^2.0.0"
 
-npm-run-path@^4.0.0:
-  version "4.0.1"
-  resolved "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz#b7ecd1e5ed53da8e37a55e1c2269e0b97ed748ea"
-  integrity sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==
-  dependencies:
-    path-key "^3.0.0"
-
 npm-run-path@^5.1.0:
   version "5.1.0"
   resolved "https://registry.npmjs.org/npm-run-path/-/npm-run-path-5.1.0.tgz#bc62f7f3f6952d9894bd08944ba011a6ee7b7e00"
@@ -7949,13 +7941,6 @@ on-finished@~2.3.0:
   dependencies:
     wrappy 1
 
-onetime@^5.1.0:
-  version "5.1.2"
-  resolved "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz#d0e96ebb56b07476df1dd9c4806e5237985ca45e"
-  integrity sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==
-  dependencies:
-    mimic-fn "^2.1.0"
-
 onetime@^6.0.0:
   version "6.0.0"
   resolved "https://registry.npmjs.org/onetime/-/onetime-6.0.0.tgz#7c24c18ed1fd2e9bca4bd26806a33613c77d34b4"
@@ -8005,13 +7990,6 @@ os-shim@^0.1.3:
   resolved "https://registry.npmjs.org/os-shim/-/os-shim-0.1.3.tgz#6b62c3791cf7909ea35ed46e17658bb417cb3917"
   integrity sha512-jd0cvB8qQ5uVt0lvCIexBaROw1KyKm5sbulg2fWOHjETisuCzWyt+eTZKEMs8v6HwzoGs8xik26jg7eCM6pS+A==
 
-ow@^0.17.0:
-  version "0.17.0"
-  resolved "https://registry.npmjs.org/ow/-/ow-0.17.0.tgz#4f938999fed6264c9048cd6254356e0f1e7f688c"
-  integrity sha512-i3keDzDQP5lWIe4oODyDFey1qVrq2hXKTuTH2VpqwpYtzPiKZt2ziRI4NBQmgW40AnV5Euz17OyWweCb+bNEQA==
-  dependencies:
-    type-fest "^0.11.0"
-
 p-cancelable@^0.3.0:
   version "0.3.0"
   resolved "https://registry.npmjs.org/p-cancelable/-/p-cancelable-0.3.0.tgz#b9e123800bcebb7ac13a479be195b507b98d30fa"
@@ -8212,7 +8190,7 @@ path-exists@^4.0.0:
   resolved "https://registry.npmjs.org/path-key/-/path-key-2.0.1.tgz#411cadb574c5a140d3a4b1910d40d80cc9f40b40"
   integrity sha512-fEHGKCSmUSDPv4uoj8AlD+joPlq3peND+HRYyxFz4KPw4z926S/b8rIuFs2FYJg3BwsxJf6A9/3eIdLaYC+9Dw==
 
-"path-key@^3.0.0", "path-key@^3.1.0":
+path-key@^3.1.0:
   version "3.1.1"
   resolved "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz#581f6ade658cbba65a0d3380de7753295054f375"
   integrity sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==
@@ -8332,15 +8310,6 @@ pinkie@^2.0.0:
   dependencies:
     find-up "^4.0.0"
 
-pngquant-bin@^6.0.0:
-  version "6.0.1"
-  resolved "https://registry.npmjs.org/pngquant-bin/-/pngquant-bin-6.0.1.tgz#2b5789ca219eeb4d8509ab1ae082092801b7f07e"
-  integrity sha512-Q3PUyolfktf+hYio6wsg3SanQzEU/v8aICg/WpzxXcuCMRb7H2Q81okfpcEztbMvw25ILjd3a87doj2N9kvbpQ==
-  dependencies:
-    bin-build "^3.0.0"
-    bin-wrapper "^4.0.1"
-    execa "^4.0.0"
-
 popper.js@1.16.1-lts:
   version "1.16.1-lts"
   resolved "https://registry.npmjs.org/popper.js/-/popper.js-1.16.1-lts.tgz#cf6847b807da3799d80ee3d6d2f90df8a3f50b05"
@@ -8855,6 +8824,11 @@ proto-list@~1.2.1:
   resolved "https://registry.npmjs.org/proto-list/-/proto-list-1.2.4.tgz#212d5bfe1318306a420f6402b8e26ff39647a849"
   integrity sha512-vtK/94akxsTMhe0/cbfpR+syPuszcuwhqVjJq26CuNDgFGj682oRBXOP5MJpv2r7JtE8MsiepGIqvvOTBwn2vA==
 
+proxy-from-env@^1.1.0:
+  version "1.1.0"
+  resolved "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz#e102f16ca355424865755d2c9e8ea4f24d58c3e2"
+  integrity sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==
+
 pseudomap@^1.0.2:
   version "1.0.2"
   resolved "https://registry.npmjs.org/pseudomap/-/pseudomap-1.0.2.tgz#f052a28da70e618917ef0a8ac34c1ae5a68286b3"
@@ -9133,6 +9107,17 @@ re-resizable@6.9.6:
   dependencies:
     fast-memoize "^2.5.1"
 
+react-arborist@^3.2.0:
+  version "3.2.0"
+  resolved "https://registry.npmjs.org/react-arborist/-/react-arborist-3.2.0.tgz#f17d726e7d18fcb1494b83ffadfecc8c9bda5dff"
+  integrity sha512-sjGL1KIRogwkM5uVifpp01yrfTcIHsm62Kbs78kBbPuksrnJPZ13SAqAqZeXVuyvO0Tbd7odExF/KoHtXHIZaQ==
+  dependencies:
+    react-dnd "^14.0.3"
+    react-dnd-html5-backend "^14.0.1"
+    react-window "^1.8.6"
+    redux "^4.1.1"
+    use-sync-external-store "^1.2.0"
+
 react-aspen@^1.1.0:
   version "1.2.0"
   resolved "https://registry.npmjs.org/react-aspen/-/react-aspen-1.2.0.tgz#375fa82a8db627542fc8b9e6e421baa49a65ab95"
@@ -9154,6 +9139,13 @@ react-checkbox-tree@^1.7.2:
     nanoid "^3.0.0"
     prop-types "^15.5.8"
 
+react-dnd-html5-backend@^14.0.1:
+  version "14.1.0"
+  resolved "https://registry.npmjs.org/react-dnd-html5-backend/-/react-dnd-html5-backend-14.1.0.tgz#b35a3a0c16dd3a2bfb5eb7ec62cf0c2cace8b62f"
+  integrity sha512-6ONeqEC3XKVf4eVmMTe0oPds+c5B9Foyj8p/ZKLb7kL2qh9COYxiBHv3szd6gztqi/efkmriywLUVlPotqoJyw==
+  dependencies:
+    dnd-core "14.0.1"
+
 react-dnd-html5-backend@^16.0.1:
   version "16.0.1"
   resolved "https://registry.npmjs.org/react-dnd-html5-backend/-/react-dnd-html5-backend-16.0.1.tgz#87faef15845d512a23b3c08d29ecfd34871688b6"
@@ -9161,6 +9153,17 @@ react-dnd-html5-backend@^16.0.1:
   dependencies:
     dnd-core "^16.0.1"
 
+react-dnd@^14.0.3:
+  version "14.0.5"
+  resolved "https://registry.npmjs.org/react-dnd/-/react-dnd-14.0.5.tgz#ecf264e220ae62e35634d9b941502f3fca0185ed"
+  integrity sha512-9i1jSgbyVw0ELlEVt/NkCUkxy1hmhJOkePoCH713u75vzHGyXhPDm28oLfc2NMSBjZRM1Y+wRjHXJT3sPrTy+A==
+  dependencies:
+    "@react-dnd/invariant" "^2.0.0"
+    "@react-dnd/shallowequal" "^2.0.0"
+    dnd-core "14.0.1"
+    fast-deep-equal "^3.1.3"
+    hoist-non-react-statics "^3.3.2"
+
 react-dnd@^16.0.1:
   version "16.0.1"
   resolved "https://registry.npmjs.org/react-dnd/-/react-dnd-16.0.1.tgz#2442a3ec67892c60d40a1559eef45498ba26fa37"
@@ -9319,7 +9322,7 @@ react-virtualized-auto-sizer@^1.0.6:
   resolved "https://registry.npmjs.org/react-virtualized-auto-sizer/-/react-virtualized-auto-sizer-1.0.20.tgz#d9a907253a7c221c52fa57dc775a6ef40c182645"
   integrity sha512-OdIyHwj4S4wyhbKHOKM1wLSj/UDXm839Z3Cvfg2a9j+He6yDa6i5p0qQvEiCnyQlGO/HyfSnigQwuxvYalaAXA==
 
-"react-window@^1.3.1", "react-window@^1.8.5":
+"react-window@^1.3.1", "react-window@^1.8.5", "react-window@^1.8.6":
   version "1.8.9"
   resolved "https://registry.npmjs.org/react-window/-/react-window-1.8.9.tgz#24bc346be73d0468cdf91998aac94e32bc7fa6a8"
   integrity sha512-+Eqx/fj1Aa5WnhRfj9dJg4VYATGwIUP2ItwItiJ6zboKWA6EX3lYDAXfGF2hyNqplEprhbtjbipiADEcwQ823Q==
@@ -9422,7 +9425,7 @@ redent@^4.0.0:
     indent-string "^5.0.0"
     strip-indent "^4.0.0"
 
-redux@^4.2.0:
+"redux@^4.1.1", "redux@^4.2.0":
   version "4.2.1"
   resolved "https://registry.npmjs.org/redux/-/redux-4.2.1.tgz#c08f4306826c49b5e9dc901dee0452ea8fce6197"
   integrity sha512-LAUYz4lc+Do8/g7aeRa8JkyDErK6ekstQaqWQrNRW//MY1TvCEpMtpTWvlQ+FPbWCx+Xixu/6SHt5N0HR+SB4w==
@@ -9851,7 +9854,7 @@ side-channel@^1.0.4:
     get-intrinsic "^1.0.2"
     object-inspect "^1.9.0"
 
-"signal-exit@^3.0.0", "signal-exit@^3.0.2", "signal-exit@^3.0.7":
+"signal-exit@^3.0.0", "signal-exit@^3.0.7":
   version "3.0.7"
   resolved "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz#a9a1767f8af84155114eaabd73f99273c8f59ad9"
   integrity sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==
@@ -10235,11 +10238,6 @@ strip-eof@^1.0.0:
   resolved "https://registry.npmjs.org/strip-eof/-/strip-eof-1.0.0.tgz#bb43ff5598a6eb05d89b59fcd129c983313606bf"
   integrity sha512-7FCwGGmx8mD5xQd3RPUvnSpUXHM3BWuzjtpD4TXsfcZ9EL4azvVVUscFYwD9nx8Kh+uCBC00XBtAykoMHwTh8Q==
 
-strip-final-newline@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz#89b852fb2fcbe936f6f4b3187afb0a12c1ab58ad"
-  integrity sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==
-
 strip-final-newline@^3.0.0:
   version "3.0.0"
   resolved "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-3.0.0.tgz#52894c313fbff318835280aed60ff71ebf12b8fd"
@@ -10277,17 +10275,17 @@ style-loader@^3.3.2:
   resolved "https://registry.npmjs.org/style-loader/-/style-loader-3.3.3.tgz#bba8daac19930169c0c9c96706749a597ae3acff"
   integrity sha512-53BiGLXAcll9maCYtZi2RCQZKa8NQQai5C4horqKyRmHj9H7QmcUyucrH+4KW/gBQbXM2AsB0axoEcFZPlfPcw==
 
-style-to-js@1.1.1:
-  version "1.1.1"
-  resolved "https://registry.npmjs.org/style-to-js/-/style-to-js-1.1.1.tgz#417786986cda61d4525c80aed9d1123a6a7af9b8"
-  integrity sha512-RJ18Z9t2B02sYhZtfWKQq5uplVctgvjTfLWT7+Eb1zjUjIrWzX5SdlkwLGQozrqarTmEzJJ/YmdNJCUNI47elg==
+style-to-js@1.1.3:
+  version "1.1.3"
+  resolved "https://registry.npmjs.org/style-to-js/-/style-to-js-1.1.3.tgz#2012d75dc89bf400edc29c545ed61c8626b00184"
+  integrity sha512-zKI5gN/zb7LS/Vm0eUwjmjrXWw8IMtyA8aPBJZdYiQTXj4+wQ3IucOLIOnF7zCHxvW8UhIGh/uZh/t9zEHXNTQ==
   dependencies:
-    style-to-object "0.3.0"
+    style-to-object "0.4.1"
 
-style-to-object@0.3.0:
-  version "0.3.0"
-  resolved "https://registry.npmjs.org/style-to-object/-/style-to-object-0.3.0.tgz#b1b790d205991cc783801967214979ee19a76e46"
-  integrity sha512-CzFnRRXhzWIdItT3OmF8SQfWyahHhjq3HwcMNCNLn+N7klOOqPjMeG/4JSu77D7ypZdGvSzvkrbyeTMizz2VrA==
+style-to-object@0.4.1:
+  version "0.4.1"
+  resolved "https://registry.npmjs.org/style-to-object/-/style-to-object-0.4.1.tgz#53cf856f7cf7f172d72939d9679556469ba5de37"
+  integrity sha512-HFpbb5gr2ypci7Qw+IOhnP2zOU7e77b+rzM+wTzXzfi1PrtBCX0E7Pk4wL4iTLnhzZ+JgEGAhX81ebTg/aYjQw==
   dependencies:
     inline-style-parser "0.1.1"
 
@@ -10691,11 +10689,6 @@ tunnel-agent@^0.6.0:
   dependencies:
     prelude-ls "^1.2.1"
 
-type-fest@^0.11.0:
-  version "0.11.0"
-  resolved "https://registry.npmjs.org/type-fest/-/type-fest-0.11.0.tgz#97abf0872310fed88a5c466b25681576145e33f1"
-  integrity sha512-OdjXJxnCN1AvyLSzeKIgXTXxV+99ZuXl3Hpo9XpJAv9MBcHrrJOQ5kV7ypXOuQie+AmWG25hLbiKdwYTifzcfQ==
-
 type-fest@^0.20.2:
   version "0.20.2"
   resolved "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz#1bf207f4b28f91583666cb5fbd327887301cd5f4"
@@ -10905,6 +10898,11 @@ use-isomorphic-layout-effect@^1.1.2:
   resolved "https://registry.npmjs.org/use-isomorphic-layout-effect/-/use-isomorphic-layout-effect-1.1.2.tgz#497cefb13d863d687b08477d9e5a164ad8c1a6fb"
   integrity sha512-49L8yCO3iGT/ZF9QttjwLF/ZD9Iwto5LnH5LmEdk/6cFmXddqi2ulF0edxTwjj+7mqvpVVGQWvbXZdn32wRSHA==
 
+use-sync-external-store@^1.2.0:
+  version "1.2.0"
+  resolved "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.2.0.tgz#7dbefd6ef3fe4e767a0cf5d7287aacfb5846928a"
+  integrity sha512-eEgnFxGQ1Ife9bzYs6VLi8/4X6CObHMw9Qr9tPY43iKwsPw8xE8+EFsf/2cFZ5S3esXgpWgtSCtLNS41F+sKPA==
+
 "util-deprecate@^1.0.1", "util-deprecate@^1.0.2", "util-deprecate@~1.0.1":
   version "1.0.2"
   resolved "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz#450d4dc9fa70de732762fbd2d4a28981419a0ccf"
diff --git a/pkgs/tools/admin/stripe-cli/default.nix b/pkgs/tools/admin/stripe-cli/default.nix
index 45fdbff603213..3fc6a6dba776e 100644
--- a/pkgs/tools/admin/stripe-cli/default.nix
+++ b/pkgs/tools/admin/stripe-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.17.2";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-MzzjrGtqbtZMvfL7dPAsKHF2ZTneSdtDuwHQQcyrQDw=";
+    hash = "sha256-1AdR0PHAhrMbeCD5zNsU9JoXInQD+qUIYfveBD60wR0=";
   };
   vendorHash = "sha256-DYA6cu2KzEBZ4wsT7wjcdY1endQQOZlj2aOwu6iGLew=";
 
diff --git a/pkgs/tools/admin/syft/default.nix b/pkgs/tools/admin/syft/default.nix
index 3f6567b09f0c8..c596c709977c2 100644
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "syft";
-  version = "0.92.0";
+  version = "0.93.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YmzizpcAfE4+Rfq5ydQnDQBo4R+pAyudfi+fqD9EZP0=";
+    hash = "sha256-e8d+CK7rRbyHeRHOjK3tGFIBHuosdV4AMetUQar54E4=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
   };
   # hash mismatch with darwin
   proxyVendor = true;
-  vendorHash = "sha256-siOZWhHqNokkYAPwuXQCs4T1yBiEWUTJzhfbH/Z2uBk=";
+  vendorHash = "sha256-BUCe2v80tHAqMBwa6xae3ZOTOok8msM6hFh6d9D4xZA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/archivers/payload-dumper-go/default.nix b/pkgs/tools/archivers/payload-dumper-go/default.nix
index bb1572e1ceb67..bb1572e1ceb67 100755..100644
--- a/pkgs/tools/archivers/payload-dumper-go/default.nix
+++ b/pkgs/tools/archivers/payload-dumper-go/default.nix
diff --git a/pkgs/tools/audio/openai-whisper-cpp/default.nix b/pkgs/tools/audio/openai-whisper-cpp/default.nix
index f6d83690824fe..f19425201cde2 100644
--- a/pkgs/tools/audio/openai-whisper-cpp/default.nix
+++ b/pkgs/tools/audio/openai-whisper-cpp/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "whisper-cpp";
-  version = "1.4.0";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "whisper.cpp";
     rev = "refs/tags/v${version}" ;
-    hash = "sha256-176MpooVQrq1dXC62h8Yyyhw6IjCA50tp1J4DQPSePQ=";
+    hash = "sha256-Qea9zGLJ41D+l8h1Sg/KJI6Ou02jtbRIxYPGoabM8nY=";
   };
 
   # The upstream download script tries to download the models to the
diff --git a/pkgs/tools/filesystems/erofs-utils/default.nix b/pkgs/tools/filesystems/erofs-utils/default.nix
index d1daee70967f2..e25df7288094a 100644
--- a/pkgs/tools/filesystems/erofs-utils/default.nix
+++ b/pkgs/tools/filesystems/erofs-utils/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional fuseSupport "--enable-fuse";
 
   meta = with lib; {
+    homepage = "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/about/";
     description = "Userspace utilities for linux-erofs file system";
     license = with licenses; [ gpl2Plus ];
     maintainers = with maintainers; [ ehmry nikstur ];
diff --git a/pkgs/tools/graphics/wdisplays/default.nix b/pkgs/tools/graphics/wdisplays/default.nix
index b05aa13ea6010..9c7093b58f85e 100644
--- a/pkgs/tools/graphics/wdisplays/default.nix
+++ b/pkgs/tools/graphics/wdisplays/default.nix
@@ -1,24 +1,20 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, gtk3, libepoxy, wayland, wrapGAppsHook }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "wdisplays";
-  version = "unstable-2021-04-03";
+  version = "1.1.1";
 
   nativeBuildInputs = [ meson ninja pkg-config wrapGAppsHook ];
 
   buildInputs = [ gtk3 libepoxy wayland ];
 
   src = fetchFromGitHub {
-    owner = "luispabon";
+    owner = "artizirk";
     repo = "wdisplays";
-    rev = "7f2eac0d2aa81b5f495da7950fd5a94683f7868e";
-    sha256 = "sha256-cOF3+T34zPro58maWUouGG+vlLm2C5NfcH7PZhSvApE=";
+    rev = finalAttrs.version;
+    sha256 = "sha256-dtvP930ChiDRT60xq6xBDU6k+zHnkrAkxkKz2FxlzRs=";
   };
 
-  patchPhase = ''
-    substituteInPlace ./resources/wdisplays.desktop.in --replace "@app_id@" "wdisplays"
-  '';
-
   meta = with lib; {
     description = "A graphical application for configuring displays in Wayland compositors";
     homepage = "https://github.com/luispabon/wdisplays";
@@ -27,4 +23,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     mainProgram = "wdisplays";
   };
-}
+})
diff --git a/pkgs/tools/inputmethods/evsieve/default.nix b/pkgs/tools/inputmethods/evsieve/default.nix
new file mode 100644
index 0000000000000..4497448cad129
--- /dev/null
+++ b/pkgs/tools/inputmethods/evsieve/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, libevdev
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "evsieve";
+  version = "1.3.1";
+
+  src = fetchFromGitHub {
+    owner = "KarsMulder";
+    repo = "evsieve";
+    rev = "v${version}";
+    hash = "sha256-R/y3iyKGE4dzAyNnDwrMCr8JFshYJwNcgHQ8UbtuRj8=";
+  };
+
+  cargoHash = "sha256-jkm+mAHejCBZFalUbJNaIxtIl2kwnlPR2wsaYlcfSz8=";
+
+  buildInputs = [ libevdev ];
+
+  doCheck = false; # unit tests create uinput devices
+
+  meta = with lib; {
+    description = "A utility for mapping events from Linux event devices";
+    homepage = "https://github.com/KarsMulder/evsieve";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ tsowell ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/tools/misc/ckb-next/default.nix b/pkgs/tools/misc/ckb-next/default.nix
index f9309ecf81ddf..549cb543af192 100644
--- a/pkgs/tools/misc/ckb-next/default.nix
+++ b/pkgs/tools/misc/ckb-next/default.nix
@@ -1,17 +1,17 @@
-{ lib, mkDerivation, fetchFromGitHub, substituteAll, udev, stdenv
+{ lib, wrapQtAppsHook, fetchFromGitHub, substituteAll, udev, stdenv
 , pkg-config, qtbase, cmake, zlib, kmod, libXdmcp, qttools, qtx11extras, libdbusmenu
-, withPulseaudio ? stdenv.isLinux, libpulseaudio
+, withPulseaudio ? stdenv.isLinux, libpulseaudio, quazip
 }:
 
-mkDerivation rec {
-  version = "0.5.0";
+stdenv.mkDerivation rec {
+  version = "0.6.0";
   pname = "ckb-next";
 
   src = fetchFromGitHub {
     owner = "ckb-next";
     repo = "ckb-next";
     rev = "v${version}";
-    sha256 = "sha256-yR1myagAqavAR/7lPdufcrJpPmXW7r4N4pxTMF6NbuE=";
+    hash = "sha256-G0cvET3wMIi4FlBmaTkdTyYtcdVGzK4X0C2HYZr43eg=";
   };
 
   buildInputs = [
@@ -22,9 +22,11 @@ mkDerivation rec {
     qttools
     qtx11extras
     libdbusmenu
+    quazip
   ] ++ lib.optional withPulseaudio libpulseaudio;
 
   nativeBuildInputs = [
+    wrapQtAppsHook
     pkg-config
     cmake
   ];
diff --git a/pkgs/tools/misc/codebraid/default.nix b/pkgs/tools/misc/codebraid/default.nix
index 0ecde80c238d6..f4d8fa4940f00 100644
--- a/pkgs/tools/misc/codebraid/default.nix
+++ b/pkgs/tools/misc/codebraid/default.nix
@@ -2,15 +2,17 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "codebraid";
-  version = "0.5.0-unstable-2020-08-14";
+  version = "0.11.0";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "gpoore";
     repo = pname;
-    rev = "526a223c4fc32c37d6c5c9133524dfa0e1811ca4";
-    sha256 = "0qkqaj49k584qzgx9jlsf5vlv4lq7x403s1kig8v87i0kgh55p56";
+    rev = "v${version}";
+    hash = "sha256-E9vzGK9ZEVwF+UBpSkdM+hm6vINen/A+LgnnPpc77QQ=";
   };
 
+  nativeBuildInputs = with python3Packages; [ setuptools ];
   propagatedBuildInputs = with python3Packages; [ bespon ];
   # unfortunately upstream doesn't contain tests
   checkPhase = ''
diff --git a/pkgs/tools/misc/dooit/default.nix b/pkgs/tools/misc/dooit/default.nix
index ab7db4a2cb7c4..b8aa6c8809ff7 100644
--- a/pkgs/tools/misc/dooit/default.nix
+++ b/pkgs/tools/misc/dooit/default.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dooit";
-  version = "2.0.1";
+  version = "2.1.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "kraanzu";
     repo = "dooit";
     rev = "v${version}";
-    hash = "sha256-iQAGD6zrBBd4fJONaB7to1OJpAJUO0zeA1xhVQZBkMc=";
+    hash = "sha256-ZCEBpaQHaFb09MUlN6acYB3LrfX456uRbhVh9YPz7NU=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/misc/esphome/default.nix b/pkgs/tools/misc/esphome/default.nix
index b791cac21bd48..de7b7d5d03ef7 100644
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@@ -16,14 +16,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2023.9.3";
+  version = "2023.10.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-SyXEiGh1/s9EJ0UPYC8R04JUYkCPhCtNUcGvVCycKGM=";
+    hash = "sha256-XKZYnZYXETv0UXrKtjQvDXyv8lwqfO19jc5Fs3KMhEY=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index 0f78b752de00b..84da1044f1a46 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -1,20 +1,22 @@
-{ lib, rustPlatform, fetchFromGitHub, installShellFiles, testers, fd }:
+{ lib, rustPlatform, fetchFromGitHub, installShellFiles, rust-jemalloc-sys, testers, fd }:
 
 rustPlatform.buildRustPackage rec {
   pname = "fd";
-  version = "8.7.0";
+  version = "8.7.1";
 
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = "fd";
     rev = "v${version}";
-    hash = "sha256-y7IrwMLQnvz1PeKt8BE9hbEBwQBiUXM4geYbiTjMymw=";
+    hash = "sha256-euQiMVPKE1/YG04VKMFUA27OtoGENNhqeE0iiF/X7uc=";
   };
 
-  cargoHash = "sha256-AstE8KGICgPhqRKlJecrE9iPUUWaOvca6ocWf85IzNo=";
+  cargoHash = "sha256-doeZTjFPXmxIPYX3IBtetePoNkIHnl6oPJFtXD1tgZY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
+  buildInputs = [ rust-jemalloc-sys ];
+
   # skip flaky test
   checkFlags = [
     "--skip=test_owner_current_group"
diff --git a/pkgs/tools/misc/fzf/default.nix b/pkgs/tools/misc/fzf/default.nix
index 29f87b4ffdd08..be7992f94af5c 100644
--- a/pkgs/tools/misc/fzf/default.nix
+++ b/pkgs/tools/misc/fzf/default.nix
@@ -79,7 +79,10 @@ buildGoModule rec {
     install -D shell/* -t $out/share/fzf/
     install -D shell/key-bindings.fish $out/share/fish/vendor_functions.d/fzf_key_bindings.fish
     mkdir -p $out/share/fish/vendor_conf.d
-    echo fzf_key_bindings > $out/share/fish/vendor_conf.d/load-fzf-key-bindings.fish
+    cat << EOF > $out/share/fish/vendor_conf.d/load-fzf-key-bindings.fish
+      status is-interactive; or exit 0
+      fzf_key_bindings
+    EOF
 
     cat <<SCRIPT > $out/bin/fzf-share
     #!${runtimeShell}
diff --git a/pkgs/tools/misc/lazydocker/default.nix b/pkgs/tools/misc/lazydocker/default.nix
index 1fdb0ef0d44bc..353402658db92 100644
--- a/pkgs/tools/misc/lazydocker/default.nix
+++ b/pkgs/tools/misc/lazydocker/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lazydocker";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazydocker";
     rev = "v${version}";
-    sha256 = "sha256-BxIv0HCdrR9U9mmJnBdQqiUf/vbK+XEnL8ALPkuap0M=";
+    sha256 = "sha256-nW3eaSisXLqoWZ+5YLLCfC1k4lTXWd5ZqY2xTM/I0PY=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/misc/progress/default.nix b/pkgs/tools/misc/progress/default.nix
index 94eeace1dc2e6..2a8dc99260179 100644
--- a/pkgs/tools/misc/progress/default.nix
+++ b/pkgs/tools/misc/progress/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "progress";
-  version = "0.16";
+  version = "0.17";
 
   src = fetchFromGitHub {
     owner = "Xfennec";
     repo = "progress";
     rev = "v${version}";
-    sha256 = "sha256-kkEyflyBaQ5hUVo646NUuC1u54uzLJJsVFej9pMEwT0=";
+    sha256 = "sha256-riewkageSZIlwDNMjYep9Pb2q1GJ+WMXazokJGbb4bE=";
   };
 
   nativeBuildInputs = [ pkg-config which ];
diff --git a/pkgs/tools/misc/remind/default.nix b/pkgs/tools/misc/remind/default.nix
index 945e592e848a3..97aefe1f8e5c3 100644
--- a/pkgs/tools/misc/remind/default.nix
+++ b/pkgs/tools/misc/remind/default.nix
@@ -15,11 +15,11 @@ let
 in
 tcl.mkTclDerivation rec {
   pname = "remind";
-  version = "04.02.05";
+  version = "04.02.07";
 
   src = fetchurl {
     url = "https://dianne.skoll.ca/projects/remind/download/remind-${version}.tar.gz";
-    sha256 = "sha256-nOEFhVwZvgUod+j/5ifllFgTS7I8+hOAeMSDlRH4+Ag=";
+    sha256 = "sha256-A+EtkNmQOcz3Mb4q7qQGNL6pyCnRus4nqNor485tsZA=";
   };
 
   propagatedBuildInputs = tclLibraries;
diff --git a/pkgs/tools/misc/starfetch/default.nix b/pkgs/tools/misc/starfetch/default.nix
index ba6309c97ecbd..ba6309c97ecbd 100755..100644
--- a/pkgs/tools/misc/starfetch/default.nix
+++ b/pkgs/tools/misc/starfetch/default.nix
diff --git a/pkgs/tools/misc/szyszka/default.nix b/pkgs/tools/misc/szyszka/default.nix
index 58d839acf0785..58d839acf0785 100755..100644
--- a/pkgs/tools/misc/szyszka/default.nix
+++ b/pkgs/tools/misc/szyszka/default.nix
diff --git a/pkgs/tools/misc/tbls/default.nix b/pkgs/tools/misc/tbls/default.nix
index 5b2d160971641..de880c201446d 100644
--- a/pkgs/tools/misc/tbls/default.nix
+++ b/pkgs/tools/misc/tbls/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "tbls";
-  version = "1.68.2";
+  version = "1.70.2";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     rev = "v${version}";
-    hash = "sha256-yDWAKkzRb487iZ+5tmIH1qfuHj0TldOT+tTQwtVyX7s=";
+    hash = "sha256-LSICkg99veFHLmdcQZmnyfTbdqx7k2XI13W7Cjuj3qA=";
   };
 
-  vendorHash = "sha256-V6TF7Q+9XxBeSVXlotu8tUrNCWDr80BZsQcVSBGikl8=";
+  vendorHash = "sha256-84h+LQzk/xy/Gapy7IxB8IPvsVGRsJP7udd9HhLskew=";
 
   CGO_CFLAGS = [ "-Wno-format-security" ];
 
diff --git a/pkgs/tools/misc/timer/default.nix b/pkgs/tools/misc/timer/default.nix
index 29e087c86581f..962ad1a6dd695 100644
--- a/pkgs/tools/misc/timer/default.nix
+++ b/pkgs/tools/misc/timer/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "timer";
-  version = "1.3.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "caarlos0";
     repo = "timer";
     rev = "v${version}";
-    hash = "sha256-9p/L3Hj3VqlNiyY3lfUAhCjwTl1iSTegWxaVEGB4qHM=";
+    hash = "sha256-8BVzijAXsJ8Q8BhDmhzFbEQ23fUEBdmbUsCPxfpXyBA=";
   };
 
-  vendorHash = "sha256-j7Xik0te6GdjfhXHT7DRf+MwM+aKjfgTGvroxnlD3MM=";
+  vendorHash = "sha256-1n5vZKlOWoB2SFdDdv+pPWLybzCIJG/wdBYqLMatjNA=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index f900eafaacd13..757cb69cbb0bd 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "12.0.2";
+  version = "13.0.0";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     rev = "v${version}";
-    hash = "sha256-PfrtTegJULzPAmKUk/6P9rD+ttPJOhaf2505og64C0Y=";
+    hash = "sha256-BuYwLD8HlmFjCpR8043GhrYK3XWffeqEaeEDqWhxZVI=";
   };
 
-  cargoHash = "sha256-S6jSI/KuHocYD2dhg3o1NSyA8Q04Xo215TWl8Y1C7g8=";
+  cargoHash = "sha256-+kSvA9AC0peXeFLVjenATRfnIS9qaOr/f1ozPbifiPI=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/misc/turbo/default.nix b/pkgs/tools/misc/turbo/default.nix
index f3fcd8cd0f306..c887fdc131c22 100644
--- a/pkgs/tools/misc/turbo/default.nix
+++ b/pkgs/tools/misc/turbo/default.nix
@@ -12,6 +12,7 @@
 , openssl
 , extra-cmake-modules
 , fontconfig
+, rust-jemalloc-sys
 , testers
 , turbo
 , nix-update-script
@@ -149,6 +150,7 @@ rustPlatform.buildRustPackage {
   buildInputs = [
     openssl
     fontconfig
+    rust-jemalloc-sys
   ] ++ lib.optionals stdenv.isDarwin [
       IOKit
       CoreServices
diff --git a/pkgs/tools/misc/uutils-coreutils/default.nix b/pkgs/tools/misc/uutils-coreutils/default.nix
index 697396f0817ae..45a1c3f8a28ff 100644
--- a/pkgs/tools/misc/uutils-coreutils/default.nix
+++ b/pkgs/tools/misc/uutils-coreutils/default.nix
@@ -12,19 +12,19 @@
 
 stdenv.mkDerivation rec {
   pname = "uutils-coreutils";
-  version = "0.0.20";
+  version = "0.0.22";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
     rev = version;
-    sha256 = "sha256-Xr+RcWvAHyMMaHhcd3ArGeRZzpL76v7fXiHUSSxgj10=";
+    hash = "sha256-aEhU4O4xoj7hrnmNXA9GQYn8nc6XEJCGQIcx/xRtLMc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-3hUEDE+Yup/+u/ACyAWXYTLerOqB/jtOzECdI540Ag0=";
+    hash = "sha256-zQN6EVRyd4FWeNNDXI3NY6XWmJTD+n8c+w7BHtXvs1k=";
   };
 
   nativeBuildInputs = [ rustPlatform.cargoSetupHook sphinx ];
diff --git a/pkgs/tools/misc/vector/default.nix b/pkgs/tools/misc/vector/default.nix
index b1fd29e746734..c50d136d051ea 100644
--- a/pkgs/tools/misc/vector/default.nix
+++ b/pkgs/tools/misc/vector/default.nix
@@ -8,6 +8,7 @@
 , rdkafka
 , oniguruma
 , zstd
+, rust-jemalloc-sys
 , Security
 , libiconv
 , coreutils
@@ -59,7 +60,7 @@ rustPlatform.buildRustPackage {
     };
   };
   nativeBuildInputs = [ pkg-config cmake perl git rustPlatform.bindgenHook ];
-  buildInputs = [ oniguruma openssl protobuf rdkafka zstd ]
+  buildInputs = [ oniguruma openssl protobuf rdkafka zstd rust-jemalloc-sys ]
     ++ lib.optionals stdenv.isDarwin [ Security libiconv coreutils CoreServices ];
 
   # needed for internal protobuf c wrapper library
diff --git a/pkgs/tools/networking/ddclient/default.nix b/pkgs/tools/networking/ddclient/default.nix
new file mode 100644
index 0000000000000..6477c5b185c0e
--- /dev/null
+++ b/pkgs/tools/networking/ddclient/default.nix
@@ -0,0 +1,53 @@
+{ lib, fetchFromGitHub, perlPackages, autoreconfHook, iproute2, perl, curl }:
+
+let
+  myPerl = perl.withPackages (ps: [ ps.JSONPP ]);
+in
+perlPackages.buildPerlPackage rec {
+  pname = "ddclient";
+  version = "3.11.0_1";
+
+  outputs = [ "out" ];
+
+  src = fetchFromGitHub {
+    owner = "ddclient";
+    repo = "ddclient";
+    rev = "v${version}";
+    sha256 = "sha256-pl1kbzY5nUIvx1QiDdL9TP4vKtQnnv3RWklE4gbxXCw=";
+  };
+
+  postPatch = ''
+    touch Makefile.PL
+  '';
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  buildInputs = [ curl myPerl ];
+
+  # Prevent ddclient from picking up build time perl which is implicitly added
+  # by buildPerlPackage.
+  configureFlags = [
+    "--with-perl=${lib.getExe myPerl}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 ddclient $out/bin/ddclient
+    install -Dm644 -t $out/share/doc/ddclient COP* README.* ChangeLog.md
+
+    runHook postInstall
+  '';
+
+  # TODO: run upstream tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Client for updating dynamic DNS service entries";
+    homepage = "https://ddclient.net/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ bjornfor ];
+    mainProgram = "ddclient";
+  };
+}
diff --git a/pkgs/tools/networking/globalping-cli/default.nix b/pkgs/tools/networking/globalping-cli/default.nix
index bc07f20a5b11e..c88688bca71d7 100644
--- a/pkgs/tools/networking/globalping-cli/default.nix
+++ b/pkgs/tools/networking/globalping-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "globalping-cli";
-  version = "1.1.0";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "jsdelivr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-UY+SAmkE8h/K92Em5iikcMiNixkqnDVkhlrKVq1ZkVM=";
+    hash = "sha256-k89tqQpGvX0WiYqEwPj+tDViUKDjLR5MrkA0CQI/A+o=";
   };
 
   vendorHash = "sha256-fUB7WIEAPBot8A2f7WQ5wUDtCrOydZd4nd4qDuy1vzg=";
diff --git a/pkgs/tools/networking/hysteria/default.nix b/pkgs/tools/networking/hysteria/default.nix
index 9885066397b6c..80b12b6d6d67f 100644
--- a/pkgs/tools/networking/hysteria/default.nix
+++ b/pkgs/tools/networking/hysteria/default.nix
@@ -4,16 +4,16 @@
 }:
 buildGo121Module rec {
   pname = "hysteria";
-  version = "2.0.3";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "apernet";
     repo = pname;
     rev = "app/v${version}";
-    hash = "sha256-0ekw92T9yWrKu5MxSssOCXlUFubiVLoH6ZLEMDFkcis=";
+    hash = "sha256-CvhDOtXyGxnTy8m7qN5lmQxOxwkExfW+1ZT3LrLjsmo=";
   };
 
-  vendorHash = "sha256-Hf+Jx/z+hJ6jqWLJHGK7umNgNzNKYgQtCdAosdrqvPg=";
+  vendorHash = "sha256-Io7EN+Cza7drMLB9JF4nRDxq+eVxW5sYj45WWvXtDsY=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/tools/networking/ipfetch/default.nix b/pkgs/tools/networking/ipfetch/default.nix
index b9b675366e56e..b9b675366e56e 100755..100644
--- a/pkgs/tools/networking/ipfetch/default.nix
+++ b/pkgs/tools/networking/ipfetch/default.nix
diff --git a/pkgs/tools/networking/requestly/default.nix b/pkgs/tools/networking/requestly/default.nix
index 33d03140c3984..3a4128c0806de 100644
--- a/pkgs/tools/networking/requestly/default.nix
+++ b/pkgs/tools/networking/requestly/default.nix
@@ -5,11 +5,11 @@
 
 let
   pname = "requestly";
-  version = "1.5.6";
+  version = "1.5.12";
 
   src = fetchurl {
     url = "https://github.com/requestly/requestly-desktop-app/releases/download/v${version}/Requestly-${version}.AppImage";
-    hash = "sha256-Yb90OGIIvExfNPoJPmuZSvtU5OQVuGqh4EmyKltE+is=";
+    hash = "sha256-HM3+j9E67J1bAklnDtSN5/rOK9Wn7N7h+qlPKR/E8Ns=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
diff --git a/pkgs/tools/networking/sish/default.nix b/pkgs/tools/networking/sish/default.nix
index 0bcf6bff9431d..aa64767cc3fe0 100644
--- a/pkgs/tools/networking/sish/default.nix
+++ b/pkgs/tools/networking/sish/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "sish";
-  version = "2.9.2";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "antoniomika";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-6PCZtiXsDQfPZFw3r1n3rwgxigSnWgggHXzZdBT/fxA=";
+    hash = "sha256-dNwSMDEt142A0rP212bWBZSX2zhYgL94EJymOvegTa8=";
   };
 
-  vendorHash = "sha256-RnvkEUvL/bQTTTlg0RF0xjjvVniltequNKRD3z0H3O8=";
+  vendorHash = "sha256-XtN2RgegmKR/RDFBbHn9kpI1BxmF7jfu7LAwPVaAvEk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index e47478b9206b9..4030e3d14ec1a 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tgt";
-  version = "1.0.87";
+  version = "1.0.88";
 
   src = fetchFromGitHub {
     owner = "fujita";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nDYNXQJqCtwlm4HTPTMuUbn6FA8JRYEqxbYUAev2R3o=";
+    sha256 = "sha256-tLc+viPufR6P5texDs9lU8wsOTzrjSK0Qz/r4/L8M5k=";
   };
 
   nativeBuildInputs = [ libxslt docbook_xsl makeWrapper ];
diff --git a/pkgs/tools/networking/voms/default.nix b/pkgs/tools/networking/voms/default.nix
index a16648b9a8337..cafc812032b7a 100644
--- a/pkgs/tools/networking/voms/default.nix
+++ b/pkgs/tools/networking/voms/default.nix
@@ -13,7 +13,8 @@
 , zlib
   # Configuration overridable with .override
   # If not null, the builder will
-  # move "$out/etc" to "$out/etc.orig" and symlink "$out/etc" to externalEtc.
+  # create a new output "etc", move "$out/etc" to "$etc/etc"
+  # and symlink "$out/etc" to externalEtc.
 , externalEtc ? "/etc"
 }:
 
@@ -46,7 +47,8 @@ stdenv.mkDerivation rec{
     zlib
   ];
 
-  outputs = [ "bin" "out" "dev" "man" ];
+  outputs = [ "bin" "out" "dev" "man" ]
+    ++ lib.optional (externalEtc != null) "etc";
 
   preAutoreconf = ''
     mkdir -p aux src/autogen
@@ -65,13 +67,12 @@ stdenv.mkDerivation rec{
 
   configureFlags = [
     "--with-gsoap-wsdl2h=${gsoap}/bin/wsdl2h"
+    "--sysconfdir=${placeholder "out"}/etc"
   ];
 
-  postFixup = ''
-    ${lib.optionalString (externalEtc != null) ''
-      mv "$out"/etc{,.orig}
-      ln -s ${lib.escapeShellArg externalEtc} "$out/etc"
-    ''}
+  postFixup = lib.optionalString (externalEtc != null) ''
+    moveToOutput etc "$etc"
+    ln -s ${lib.escapeShellArg externalEtc} "$out/etc"
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/networking/xrootd/default.nix b/pkgs/tools/networking/xrootd/default.nix
index e5aad1b4ee9bf..e32139fdfcebd 100644
--- a/pkgs/tools/networking/xrootd/default.nix
+++ b/pkgs/tools/networking/xrootd/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , cmake
 , cppunit
+, makeWrapper
 , pkg-config
 , curl
 , fuse
@@ -24,6 +25,9 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
+
+  __structuredAttrs = true;
+
   pname = "xrootd";
   version = "5.5.5";
 
@@ -35,7 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-SLmxv8opN7z4V07S9kLGo8HG7Ql62iZQLtf3zGemwA8=";
   };
 
-  outputs = [ "bin" "out" "dev" "man" ];
+  outputs = [ "bin" "out" "dev" "man" ]
+  ++ lib.optional (externalEtc != null) "etc";
 
   passthru.fetchxrd = callPackage ./fetchxrd.nix { xrootd = finalAttrs.finalPackage; };
   passthru.tests =
@@ -55,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    makeWrapper
     pkg-config
   ];
 
@@ -101,8 +107,19 @@ stdenv.mkDerivation (finalAttrs: {
     "-DENABLE_TESTS=TRUE"
   ];
 
-  postFixup = lib.optionalString (externalEtc != null) ''
-    mv "$out"/etc{,.orig}
+  makeWrapperArgs = [
+    # Workaround the library-not-found issue
+    # happening to binaries compiled with xrootd libraries.
+    # See #169677
+    "--prefix" "${lib.optionalString stdenv.hostPlatform.isDarwin "DY"}LD_LIBRARY_PATH" ":" "${placeholder "out"}/lib"
+  ];
+
+  postFixup = ''
+    while IFS= read -r FILE; do
+      wrapProgram "$FILE" "''${makeWrapperArgs[@]}"
+    done < <(find "$bin/bin" -mindepth 1 -maxdepth 1 -type f,l -perm -a+x)
+  '' + lib.optionalString (externalEtc != null) ''
+    moveToOutput etc "$etc"
     ln -s ${lib.escapeShellArg externalEtc} "$out/etc"
   '';
 
diff --git a/pkgs/tools/networking/xrootd/fetchxrd.nix b/pkgs/tools/networking/xrootd/fetchxrd.nix
index 2d197f8504fec..21d7a2a0386dd 100644
--- a/pkgs/tools/networking/xrootd/fetchxrd.nix
+++ b/pkgs/tools/networking/xrootd/fetchxrd.nix
@@ -21,11 +21,9 @@
     inherit url;
     urls = if urls == [ ] then lib.singleton url else urls;
   }
-  # Set [DY]LD_LIBRARY_PATH to workaround #169677
-  # TODO: Remove the library path after #200830 get merged
   ''
     for u in $urls; do
-      ${lib.optionalString buildPlatform.isDarwin "DY"}LD_LIBRARY_PATH=${lib.makeLibraryPath [ xrootd ]} xrdcp --force "$u" "$out"
+      xrdcp --verbose --force "$u" "$out"
       ret=$?
       (( ret != 0 )) || break
     done
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 9d03c35c1eb54..1aab6b3353ea9 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -167,13 +167,13 @@ in lib.makeExtensible (self: ({
   };
 
   nix_2_15 = common {
-    version = "2.15.2";
-    hash = "sha256-0BxVsvp4JfliYu4EdpZ/zPYOt9Qn5w9Ix5r0sagZZ7o=";
+    version = "2.15.3";
+    hash = "sha256-sfFXbjC5iIdSAbctZIuFozxX0uux/KFBNr9oh33xINs=";
   };
 
   nix_2_16 = common {
-    version = "2.16.1";
-    hash = "sha256-/XCWa2osNFIpPC5MkxlX6qTZf/DaTLwS3LWN0SRFiuU=";
+    version = "2.16.2";
+    hash = "sha256-VXIYCDkvAWeMoU0W2ZI0TeOszCZA1o8trz6YCPFD5ac=";
   };
 
   nix_2_17 = common {
diff --git a/pkgs/tools/package-management/zkg/default.nix b/pkgs/tools/package-management/zkg/default.nix
deleted file mode 100644
index 9d6700469722c..0000000000000
--- a/pkgs/tools/package-management/zkg/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib
-, python3
-, fetchFromGitHub
-, pkgs
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "zkg";
-  version = "2.14.0";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "zeek";
-    repo = "package-manager";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-HdOzxSU3XWz1ZH96woDWrHzKbpJW3/IKkpc2tGfyi9o=";
-  };
-
-  propagatedBuildInputs = with python3.pkgs; [
-    btest
-    gitpython
-    semantic-version
-    sphinx
-    sphinx-rtd-theme
-    pkgs.bash
-  ];
-
-  # No tests available
-  doCheck = false;
-
-  pythonImportsCheck = [
-    "zeekpkg"
-  ];
-
-  meta = with lib; {
-    description = "Package manager for Zeek";
-    homepage = "https://github.com/zeek/package-manager";
-    changelog = "https://github.com/zeek/package-manager/blob/${version}/CHANGES";
-    license = licenses.ncsa;
-    maintainers = with maintainers; [ fab ];
-  };
-}
diff --git a/pkgs/tools/security/aws-iam-authenticator/default.nix b/pkgs/tools/security/aws-iam-authenticator/default.nix
index 4f1dcf318282b..f186c43721f4f 100644
--- a/pkgs/tools/security/aws-iam-authenticator/default.nix
+++ b/pkgs/tools/security/aws-iam-authenticator/default.nix
@@ -1,23 +1,27 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
 
 buildGoModule rec {
   pname = "aws-iam-authenticator";
-  version = "0.6.11";
+  version = "0.6.12";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-4bZnGgf/H2/uLhh8ip8rrA+U0vA+1SO5uhjLK40j3wE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-IIlAsxxEYjR7+wdWExdsQAH0x4yOXZ+bVQWwn7mrhRw=";
   };
 
   vendorHash = "sha256-RcZqnyZtonE4qeu+llL1OPGPG93/Rx8ESWM5wapZ1BM=";
 
   ldflags = let PKG = "sigs.k8s.io/aws-iam-authenticator"; in [
-    "-s" "-w"
-    "-X ${PKG}/pkg.Version=${version}"
-    "-X ${PKG}/pkg.BuildDate=1970-01-01T01:01:01Z"
-    "-X ${PKG}/pkg.CommitID=${version}"
+    "-s"
+    "-w"
+    "-X=${PKG}/pkg.Version=${version}"
+    "-X=${PKG}/pkg.BuildDate=1970-01-01T01:01:01Z"
+    "-X ?${PKG}/pkg.CommitID=${version}"
   ];
 
   subPackages = [ "cmd/aws-iam-authenticator" ];
@@ -25,7 +29,8 @@ buildGoModule rec {
   meta = with lib; {
     homepage = "https://github.com/kubernetes-sigs/aws-iam-authenticator";
     description = "AWS IAM credentials for Kubernetes authentication";
+    changelog = "https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = [ maintainers.srhb ];
+    maintainers = with maintainers; [ srhb ];
   };
 }
diff --git a/pkgs/tools/security/evil-winrm/default.nix b/pkgs/tools/security/evil-winrm/default.nix
index fe10bfaefec0e..30420c7aad685 100644
--- a/pkgs/tools/security/evil-winrm/default.nix
+++ b/pkgs/tools/security/evil-winrm/default.nix
@@ -1,14 +1,19 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, bundlerEnv }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, bundlerEnv
+}:
 
 stdenv.mkDerivation rec {
   pname = "evil-winrm";
-  version = "3.3";
+  version = "3.5";
 
   src = fetchFromGitHub {
     owner = "Hackplayers";
     repo = "evil-winrm";
-    rev = "v${version}";
-    sha256 = "sha256-uWhRkq7I/XRWSUpR8lWRhDImE6x0pX9/B3gKhRIhkf8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-8Lyo7BgypzrHMEcbYlxo/XWwOtBqs2tczYnc3+XEbeA=";
   };
 
   env = bundlerEnv {
@@ -18,8 +23,13 @@ stdenv.mkDerivation rec {
     gemset = ./gemset.nix;
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ env.wrappedRuby ];
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  buildInputs = [
+    env.wrappedRuby
+  ];
 
   installPhase = ''
     mkdir -p $out/bin
@@ -27,9 +37,9 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://github.com/Hackplayers/evil-winrm";
-    changelog = "https://github.com/Hackplayers/evil-winrm/releases/tag/v${version}";
     description = "WinRM shell for hacking/pentesting";
+    homepage = "https://github.com/Hackplayers/evil-winrm";
+    changelog = "https://github.com/Hackplayers/evil-winrm/blob/v${version}/CHANGELOG.md";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ elohmeier ];
   };
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 7f0b22d445819..0762a437dfbed 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-10-14";
+  version = "2023-10-20";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-Hhk7P6mUDxTGeAq1qbtCPV0Npm7ab/F++Q0cL5rJifc=";
+    hash = "sha256-v9myewSoa0U/1EjmBejHj7M2iL8k8xNpFzi74IN4dS0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index 780f1b4dfb0c0..d26429b813de6 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -43,7 +43,7 @@ python3.pkgs.buildPythonApplication rec {
     substituteInPlace setup.py --replace /usr/share/doc/ share/doc/
 
     # see https://github.com/NixOS/nixpkgs/issues/4968
-    ${python3.interpreter} setup.py install_data --install-dir=$out --root=$out
+    ${python3.pythonForBuild.interpreter} setup.py install_data --install-dir=$out --root=$out
   '';
 
   postInstall =
@@ -61,6 +61,11 @@ python3.pkgs.buildPythonApplication rec {
       rm -r "${sitePackages}/etc"
 
       installManPage man/*.[1-9]
+
+      # This is a symlink to the build python version created by `updatePyExec`, seemingly to assure the same python version is used?
+      rm $out/bin/fail2ban-python
+      ln -s ${python3.interpreter} $out/bin/fail2ban-python
+
     '' + lib.optionalString stdenv.isLinux ''
       # see https://github.com/NixOS/nixpkgs/issues/4968
       rm -r "${sitePackages}/usr"
diff --git a/pkgs/tools/security/ldeep/default.nix b/pkgs/tools/security/ldeep/default.nix
index 3ed3d189ec49e..ebc1ca5922e54 100644
--- a/pkgs/tools/security/ldeep/default.nix
+++ b/pkgs/tools/security/ldeep/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ldeep";
-  version = "1.0.41";
+  version = "1.0.42";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "franc-pentest";
     repo = "ldeep";
     rev = "refs/tags/${version}";
-    hash = "sha256-jiOZAoZx5KK/jpW/Cui1WgPhjyf5gglcgWZbzMw65Lw=";
+    hash = "sha256-kXXZU4/nWUKAFJbcp9PFyPUxd+fRXJb6JbS/fybHh3g=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 310fa1b719127..719091e6d9a60 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.37"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.39"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index c44c869c7cd39..d9488beb17809 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,12 +1,12 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 40ba61c644b1529ec4493ecb59dd5a8e4b3f16c1
-  ref: refs/tags/6.3.37
+  revision: 77fb7ae14f17fd7f4851bca87e0c28c704797591
+  ref: refs/tags/6.3.39
   specs:
-    metasploit-framework (6.3.37)
-      actionpack (~> 7.0)
-      activerecord (~> 7.0)
-      activesupport (~> 7.0)
+    metasploit-framework (6.3.39)
+      actionpack (~> 7.0.0)
+      activerecord (~> 7.0.0)
+      activesupport (~> 7.0.0)
       aws-sdk-ec2
       aws-sdk-ec2instanceconnect
       aws-sdk-iam
@@ -28,14 +28,14 @@ GIT
       filesize
       hrr_rb_ssh-ed25519
       http-cookie
-      irb
+      irb (~> 1.7.4)
       jsobfu
       json
       metasm
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 2.0.154)
+      metasploit-payloads (= 2.0.156)
       metasploit_data_models
       metasploit_payloads-mettle (= 1.0.26)
       mqtt
@@ -252,7 +252,7 @@ GEM
       activemodel (~> 7.0)
       activesupport (~> 7.0)
       railties (~> 7.0)
-    metasploit-payloads (2.0.154)
+    metasploit-payloads (2.0.156)
     metasploit_data_models (6.0.2)
       activerecord (~> 7.0)
       activesupport (~> 7.0)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index fdc61c0c87746..d50d8760e21d4 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.3.37";
+  version = "6.3.39";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-veyBJpRycTBuNQocUss6xBOaiImj4EyLv0261UmI7mM=";
+    sha256 = "sha256-EKLzIhrNiTUM3OtezPJL8g70BmR+vEyNcllyme5hH8o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 71dc2b4c8d816..631d9f8c4dd8b 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -654,12 +654,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "40ba61c644b1529ec4493ecb59dd5a8e4b3f16c1";
-      sha256 = "0qzfi14xbfjdpy5lrq53i649l4y47b5m470a6mp30wbjjhk83v5x";
+      rev = "77fb7ae14f17fd7f4851bca87e0c28c704797591";
+      sha256 = "1jhzc7p9jwjrfa6lrg3ych3g83pj9grcqppbvh63b2fd38ig78hh";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.3.37";
+    version = "6.3.39";
   };
   metasploit-model = {
     groups = ["default"];
@@ -676,10 +676,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0s3iii3y6jhmiymylhpxqcksgm8gwmmm3rhqspmd4n9ab4p4l36s";
+      sha256 = "1x2lyyz9n89ii16v1pkw69yrywyjx1mv46rg5z4wa95gbp236mmy";
       type = "gem";
     };
-    version = "2.0.154";
+    version = "2.0.156";
   };
   metasploit_data_models = {
     groups = ["default"];
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 1f6dd8baeeb1e..ae6e1d78f6fa8 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,18 +5,17 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "2.9.15";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-/7013cf9nnDiKqcwFOYZUF1D+wkQKXPBcwz3YhpBUK0=";
+    hash = "sha256-5Z40wc8ihN2UR3DyMCaD0MOKpgbUQX0OJMyZw2gVNYM=";
   };
 
-  vendorHash = "sha256-b5CY66c2vfGaqlFENw2lnK47Cf2+buh/LtbJyPSAbOA=";
+  vendorHash = "sha256-CaeYAw7QU/KySFDSkUr4oHrG3wyPHxty3KCZ6zlPqIk=";
 
-  modRoot = "./v2";
   subPackages = [
     "cmd/nuclei/"
   ];
diff --git a/pkgs/tools/security/pynitrokey/default.nix b/pkgs/tools/security/pynitrokey/default.nix
index 9c36ceb3c841e..690d566c476d8 100644
--- a/pkgs/tools/security/pynitrokey/default.nix
+++ b/pkgs/tools/security/pynitrokey/default.nix
@@ -10,12 +10,12 @@ with python3Packages;
 
 buildPythonApplication rec {
   pname = "pynitrokey";
-  version = "0.4.39";
+  version = "0.4.40";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KXYHeWwV9Tw1ZpO/vASHjDnceeb+1K0yIUohb7EcRAI=";
+    hash = "sha256-Hu+8UooDzv4GhkWt0sCckQQyHjWn4V/zt2ADlVCoHmk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/security/rekor/default.nix b/pkgs/tools/security/rekor/default.nix
index 2820f473c11b9..c27416e29d2ee 100644
--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@@ -4,13 +4,13 @@ let
   generic = { pname, packageToBuild, description }:
     buildGoModule rec {
       inherit pname;
-      version = "1.2.2";
+      version = "1.3.2";
 
       src = fetchFromGitHub {
         owner = "sigstore";
         repo = "rekor";
         rev = "v${version}";
-        hash = "sha256-U7KxkPYVAy3/olXsEgPMX/kzg0KvYMovLO4LWw8guE4=";
+        hash = "sha256-QiK+ixVURf5Fsx9YPgzYCuCy1wYjxTUXGVr4FIn41Xc=";
         # populate values that require us to use git. By doing this in postFetch we
         # can delete .git afterwards and maintain better reproducibility of the src.
         leaveDotGit = true;
@@ -23,7 +23,7 @@ let
         '';
       };
 
-      vendorHash = "sha256-hZyoVlNrPKE6ub94jVEOLGvxWoXKxFYcsEZyRrZuNkQ=";
+      vendorHash = "sha256-0379IX5W51Z48CffK1F2ZCPGLUq0g8lZXIQqaupC5io=";
 
       nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/scrypt/default.nix b/pkgs/tools/security/scrypt/default.nix
index aad2873d4aca0..d2b8228f6511f 100644
--- a/pkgs/tools/security/scrypt/default.nix
+++ b/pkgs/tools/security/scrypt/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "scrypt";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchurl {
     url = "https://www.tarsnap.com/scrypt/${pname}-${version}.tgz";
-    sha256 = "1hnl0r6pmyxiy4dmafmqk1db7wpc0x9rqpzqcwr9d2cmghcj6byz";
+    sha256 = "sha256-1jLBGTQgrG+uv5SC5l4z06VmTszWQ7CaUJ0h0cHym+I=";
   };
 
   outputs = [ "out" "lib" "dev" ];
diff --git a/pkgs/tools/security/sequoia-sqop/default.nix b/pkgs/tools/security/sequoia-sqop/default.nix
index f4cae90b546b8..fdefbdea9e503 100644
--- a/pkgs/tools/security/sequoia-sqop/default.nix
+++ b/pkgs/tools/security/sequoia-sqop/default.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sequoia-sqop";
-  version = "0.28.0";
+  version = "0.30.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage rec {
     # generated etc
     repo = "sequoia-sop";
     rev = "v${version}";
-    hash = "sha256-4A0eZMXzFtojRD5cXQQUVoS32sQ2lWtFll+q6yhnwG4=";
+    hash = "sha256-2fRlHkT2jhUp1dIqKe8r7ktSbgudCmzuiiyF0WcbYIE=";
   };
 
-  cargoHash = "sha256-gH5WM+PmciViD+eFVlp8tzdc0KdYy1WZLQi92UEWVG4=";
+  cargoHash = "sha256-/LLW0AHCgqi2pAOkhZXNGlmNF/+u0TmSstd/B6mDr6M=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/security/sshocker/default.nix b/pkgs/tools/security/sshocker/default.nix
index b42c0a7580c39..bb8177ea38780 100644
--- a/pkgs/tools/security/sshocker/default.nix
+++ b/pkgs/tools/security/sshocker/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "sshocker";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "lima-vm";
     repo = "sshocker";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Z1Dg+AeyfFmUDc3jV8/tOcUrxuyInfwubzo0cLpfFl8=";
+    hash = "sha256-IDbGRQSLQlT4lt2bextGYB4fJfbpLhPx3JF1eYDJ6gw=";
   };
 
-  vendorHash = "sha256-ceQzYByJNXr02IDBKhYuqnKfaTbnX5T03p2US4HRu6I=";
+  vendorHash = "sha256-kee5D80RjCVosts/Jd6WuvtiK/J5+79HsM5ITHs15xc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/security/uncover/default.nix b/pkgs/tools/security/uncover/default.nix
index 1ea2f41447801..f0ee8aa23757f 100644
--- a/pkgs/tools/security/uncover/default.nix
+++ b/pkgs/tools/security/uncover/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "uncover";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-FJtd73z6Cc56+nBderYncjrac3xRydDeoiJqn8xW29U=";
+    hash = "sha256-CJA+rDLubghaQT+yb0zQY3y8hF0/5ISH9YFvIQHwH2Y=";
   };
 
-  vendorHash = "sha256-mpojOzGedkTthD+fHl9Uhul7tOCN1EGIin+7USoaNmE=";
+  vendorHash = "sha256-A7XPsl27Q5CaQXQUEvNB05B2M3mFGz/yZ4sOnOHxhw8=";
 
   meta = with lib; {
     description = "API wrapper to search for exposed hosts";
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 5d9286a1c4d1a..8ca73a4faf8c3 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -2,13 +2,13 @@
 , CoreFoundation, IOKit, libossp_uuid
 , nixosTests
 , netdata-go-plugins
-, bash, curl, jemalloc, libuv, zlib, libyaml
+, bash, curl, jemalloc, json_c, libuv, zlib, libyaml
 , libcap, libuuid, lm_sensors, protobuf
 , withCups ? false, cups
 , withDBengine ? true, lz4
 , withIpmi ? (!stdenv.isDarwin), freeipmi
 , withNetfilter ? (!stdenv.isDarwin), libmnl, libnetfilter_acct
-, withCloud ? (!stdenv.isDarwin), json_c
+, withCloud ? false
 , withCloudUi ? false
 , withConnPubSub ? false, google-cloud-cpp, grpc
 , withConnPrometheus ? false, snappy
@@ -42,14 +42,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkg-config makeWrapper protobuf ];
   # bash is only used to rewrite shebangs
-  buildInputs = [ bash curl jemalloc libuv zlib libyaml ]
+  buildInputs = [ bash curl jemalloc json_c libuv zlib libyaml ]
     ++ lib.optionals stdenv.isDarwin [ CoreFoundation IOKit libossp_uuid ]
     ++ lib.optionals (!stdenv.isDarwin) [ libcap libuuid ]
     ++ lib.optionals withCups [ cups ]
     ++ lib.optionals withDBengine [ lz4 ]
     ++ lib.optionals withIpmi [ freeipmi ]
     ++ lib.optionals withNetfilter [ libmnl libnetfilter_acct ]
-    ++ lib.optionals withCloud [ json_c ]
     ++ lib.optionals withConnPubSub [ google-cloud-cpp grpc ]
     ++ lib.optionals withConnPrometheus [ snappy ]
     ++ lib.optionals (withCloud || withConnPrometheus) [ protobuf ]
diff --git a/pkgs/tools/text/mdhtml/default.nix b/pkgs/tools/text/mdhtml/default.nix
new file mode 100644
index 0000000000000..b5d12e7b3dcf6
--- /dev/null
+++ b/pkgs/tools/text/mdhtml/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildGoModule
+, fetchFromGitea
+}:
+
+buildGoModule rec {
+  pname = "mdhtml";
+  version = "0.2.2";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "Tomkoid";
+    repo = pname;
+    rev = version;
+    hash = "sha256-893pqrrTftzKqPYZgukV/yx2gkukVZWDTgg7ufx1MsY=";
+  };
+
+  vendorHash = null;
+
+  meta = with lib; {
+    description = "Really simple CLI Markdown to HTML converter with styling support";
+    homepage = "https://codeberg.org/Tomkoid/mdhtml";
+    license = licenses.mit;
+    changelog = "https://codeberg.org/Tomkoid/mdhtml/releases";
+    maintainers = with maintainers; [ tomkoid ];
+    mainProgram = "mdhtml";
+  };
+}
diff --git a/pkgs/tools/text/ov/default.nix b/pkgs/tools/text/ov/default.nix
index e988f1c2f204d..2a70d7cdaa54d 100644
--- a/pkgs/tools/text/ov/default.nix
+++ b/pkgs/tools/text/ov/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "ov";
-  version = "0.32.0";
+  version = "0.32.1";
 
   src = fetchFromGitHub {
     owner = "noborus";
     repo = "ov";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mQ1KwElD8RizOT2trHWo4T1QiZ974xwhQCCa5snpnZM=";
+    hash = "sha256-S84CMC02KJ5eevLxVkapCdjZh4PH95u/0AK4tpkOx2k=";
   };
 
-  vendorHash = "sha256-XACdtJdACMKQ5gSJcjGAPNGPFL1Tbt6QOovl15mvFGI=";
+  vendorHash = "sha256-1NdvUdPPr0Twx0hyve4/vvDR2cU+mGyws3UIf8jHfbw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/text/rsbkb/default.nix b/pkgs/tools/text/rsbkb/default.nix
index fd02babac0b02..1510a63b050f6 100644
--- a/pkgs/tools/text/rsbkb/default.nix
+++ b/pkgs/tools/text/rsbkb/default.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rsbkb";
-  version = "1.2";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "trou";
     repo = "rsbkb";
     rev = "release-${version}";
-    hash = "sha256-Y6YTjEbefNUPcl6rNYWVZLGZYTUPr5pvfLabS+zDWqA=";
+    hash = "sha256-+plf7BoYpEFPRsGKNrvLF8TAU3Z7nyx6Td6uRBoNGiE=";
   };
 
-  cargoHash = "sha256-RMX+ZdPaqtqRJvhHFJJrPZnBGwQwZSCXNg1oNo+v2+8=";
+  cargoHash = "sha256-HyosR/5tZCRU2CNnnGITEuESW30Zq3s33UFNcLmEWIA=";
 
   # Setup symlinks for all the utilities,
   # busybox style
diff --git a/pkgs/tools/typesetting/sile/default.nix b/pkgs/tools/typesetting/sile/default.nix
index 7c436ac419b2f..6b5498656b0eb 100644
--- a/pkgs/tools/typesetting/sile/default.nix
+++ b/pkgs/tools/typesetting/sile/default.nix
@@ -46,11 +46,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sile";
-  version = "0.14.11";
+  version = "0.14.12";
 
   src = fetchurl {
     url = "https://github.com/sile-typesetter/sile/releases/download/v${finalAttrs.version}/sile-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-JXlgiK1XyZZSe5QXz06zwEAnVYhiIZhhIaBmfxAgRS4=";
+    sha256 = "sha256-iyxNi4Y2zaeR6HUf/IVW1M7mB0WhM2yxOqDkb1oAkHg=";
   };
 
   configureFlags = [
diff --git a/pkgs/tools/wayland/swaykbdd/default.nix b/pkgs/tools/wayland/swaykbdd/default.nix
index cb46519ac345c..c6e59cec2a81c 100644
--- a/pkgs/tools/wayland/swaykbdd/default.nix
+++ b/pkgs/tools/wayland/swaykbdd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "swaykbdd";
-  version = "1.1";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "artemsen";
     repo = "swaykbdd";
     rev = "v${version}";
-    sha256 = "sha256-umYPVkkYeu6TyVkjDsVBsRZLYh8WyseCPdih85kTz6A=";
+    sha256 = "sha256-QHNUIFJb5XYjUC07NQo96oD57nU8jd8sUW32iJSW+SU=";
   };
 
   strictDeps = true;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 9d2e755ca144a..c1d23ad8fba7b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -92,7 +92,6 @@ mapAliases ({
   bird2 = bird; # Added 2022-02-21
   bitwig-studio1 = throw "bitwig-studio1 has been removed, you can upgrade to 'bitwig-studio'"; # Added 2023-01-03
   bitwig-studio2 = throw "bitwig-studio2 has been removed, you can upgrade to 'bitwig-studio'"; # Added 2023-01-03
-  ddclient = throw "ddclient has been removed on the request of the upstream maintainer because it is unmaintained and has bugs. Please switch to a different software like `inadyn` or `knsupdate`."; # Added 2023-07-04
   bluezFull = throw "'bluezFull' has been renamed to/replaced by 'bluez'"; # Converted to throw 2023-09-10
   boost168 = throw "boost168 has been deprecated in favor of the latest version"; # Added 2023-06-08
   boost169 = throw "boost169 has been deprecated in favor of the latest version"; # Added 2023-06-08
@@ -973,6 +972,7 @@ mapAliases ({
   ### Z ###
 
   zinc = zincsearch; # Added 2023-05-28
+  zkg = throw "'zkg' has been replaced by 'zeek'";
   zq = zed.overrideAttrs (old: { meta = old.meta // { mainProgram = "zq"; }; }); # Added 2023-02-06
 
   ### UNSORTED ###
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 34d9d153a4378..6909a953e36fb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2112,7 +2112,10 @@ with pkgs;
 
   xpaste = callPackage ../tools/text/xpaste { };
 
-  xrootd = callPackage ../tools/networking/xrootd { };
+  xrootd = callPackage ../tools/networking/xrootd {
+    # Workaround systemd static build breakage
+    systemd = if systemd.meta.broken then null else systemd;
+  };
 
   yabridge = callPackage ../tools/audio/yabridge {
     wine = wineWowPackages.staging;
@@ -3264,10 +3267,6 @@ with pkgs;
 
   apitrace = libsForQt5.callPackage ../applications/graphics/apitrace { };
 
-  argagg = callPackage ../development/libraries/argagg { };
-
-  argtable = callPackage ../development/libraries/argtable { };
-
   arguments = callPackage ../development/libraries/arguments { };
 
   argus = callPackage ../tools/networking/argus { };
@@ -6974,6 +6973,8 @@ with pkgs;
 
   evdevremapkeys = callPackage ../tools/inputmethods/evdevremapkeys { };
 
+  evsieve = callPackage ../tools/inputmethods/evsieve { };
+
   eyedropper = callPackage ../applications/graphics/eyedropper { };
 
   persistent-evdev = python3Packages.callPackage ../servers/persistent-evdev { };
@@ -7241,7 +7242,11 @@ with pkgs;
   cpcfs = callPackage ../tools/filesystems/cpcfs { };
 
   coreutils =  callPackage ../tools/misc/coreutils { };
-  coreutils-full = coreutils.override { minimal = false; };
+
+  # The coreutils above are built with dependencies from
+  # bootstrapping. We cannot override it here, because that pulls in
+  # openssl from the previous stage as well.
+  coreutils-full = callPackage ../tools/misc/coreutils { minimal = false; };
   coreutils-prefixed = coreutils.override { withPrefix = true; singleBinary = false; };
 
   corkscrew = callPackage ../tools/networking/corkscrew { };
@@ -7418,6 +7423,8 @@ with pkgs;
 
   ddcutil = callPackage ../tools/misc/ddcutil { };
 
+  ddclient = callPackage ../tools/networking/ddclient { };
+
   dd_rescue = callPackage ../tools/system/dd_rescue { };
 
   ddh = callPackage ../tools/system/ddh { };
@@ -10252,6 +10259,10 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreFoundation IOKit;
     protobuf = protobuf3_21;
   };
+  netdataCloud = netdata.override {
+    withCloud = !stdenv.isDarwin;
+    withCloudUi = true;
+  };
   # Exposed here so the bots can auto-upgrade it
   netdata-go-plugins = callPackage ../tools/system/netdata/go.d.plugin.nix { };
 
@@ -10301,10 +10312,14 @@ with pkgs;
   nodejs-slim_20 = callPackage ../development/web/nodejs/v20.nix { enableNpm = false; };
   corepack_20 = hiPrio (callPackage ../development/web/nodejs/corepack.nix { nodejs = nodejs_20; });
 
+  nodejs_21 = callPackage ../development/web/nodejs/v21.nix { };
+  nodejs-slim_21 = callPackage ../development/web/nodejs/v21.nix { enableNpm = false; };
+  corepack_21 = hiPrio (callPackage ../development/web/nodejs/corepack.nix { nodejs = nodejs_21; });
+
   # Update this when adding the newest nodejs major version!
-  nodejs_latest = nodejs_20;
-  nodejs-slim_latest = nodejs-slim_20;
-  corepack_latest = hiPrio corepack_20;
+  nodejs_latest = nodejs_21;
+  nodejs-slim_latest = nodejs-slim_21;
+  corepack_latest = hiPrio corepack_21;
 
   buildNpmPackage = callPackage ../build-support/node/build-npm-package { };
 
@@ -12649,7 +12664,7 @@ with pkgs;
 
   rewrk = callPackage ../tools/networking/rewrk { };
 
-  inherit (callPackage ../tools/security/rekor { })
+  inherit (callPackage ../tools/security/rekor { buildGoModule = buildGo121Module; })
     rekor-cli
     rekor-server;
 
@@ -13817,6 +13832,7 @@ with pkgs;
   tewisay = callPackage ../tools/misc/tewisay { };
 
   texmacs = libsForQt5.callPackage ../applications/editors/texmacs {
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
     tex = texlive.combined.scheme-small;
     extraFonts = true;
   };
@@ -20829,6 +20845,8 @@ with pkgs;
 
   certbot-full = certbot.withPlugins (cp: with cp; [
     certbot-dns-cloudflare
+    certbot-dns-google
+    certbot-dns-ovh
     certbot-dns-rfc2136
     certbot-dns-route53
   ]);
@@ -22272,6 +22290,9 @@ with pkgs;
 
   jemalloc = callPackage ../development/libraries/jemalloc { };
 
+  rust-jemalloc-sys = callPackage ../development/libraries/jemalloc/rust.nix { };
+  rust-jemalloc-sys-unprefixed = rust-jemalloc-sys.override { unprefixed = true; };
+
   jose = callPackage ../development/libraries/jose { };
 
   jpcre2 = callPackage ../development/libraries/jpcre2 { };
@@ -24729,6 +24750,8 @@ with pkgs;
 
   readline82 = callPackage ../development/libraries/readline/8.2.nix { };
 
+  readmdict = with python3Packages; toPythonApplication readmdict;
+
   readosm = callPackage ../development/libraries/readosm { };
 
   recastnavigation = callPackage ../development/libraries/recastnavigation { };
@@ -27557,6 +27580,8 @@ with pkgs;
 
   ### SERVERS / GEOSPATIAL
 
+  fit-trackee = callPackage ../servers/geospatial/fit-trackee { };
+
   geoserver = callPackage ../servers/geospatial/geoserver { };
 
   mapcache = callPackage ../servers/geospatial/mapcache { };
@@ -28302,7 +28327,9 @@ with pkgs;
     checkMeta = callPackage ../stdenv/generic/check-meta.nix { };
   });
   minimal-bootstrap-sources = callPackage ../os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix { };
-  make-minimal-bootstrap-sources = callPackage ../os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix { };
+  make-minimal-bootstrap-sources = callPackage ../os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix {
+    inherit (stdenv) hostPlatform;
+  };
 
   mingetty = callPackage ../os-specific/linux/mingetty { };
 
@@ -28427,7 +28454,9 @@ with pkgs;
 
   golint = callPackage ../development/tools/golint { };
 
-  golangci-lint = callPackage ../development/tools/golangci-lint { };
+  golangci-lint = callPackage ../development/tools/golangci-lint {
+    buildGoModule = buildGo121Module;
+  };
 
   golangci-lint-langserver = callPackage ../development/tools/golangci-lint-langserver { };
 
@@ -29735,7 +29764,9 @@ with pkgs;
 
   nuclear = callPackage ../applications/audio/nuclear { };
 
-  nuclei = callPackage ../tools/security/nuclei { };
+  nuclei = callPackage ../tools/security/nuclei {
+    buildGoModule = buildGo121Module;
+  };
 
   nullmailer = callPackage ../servers/mail/nullmailer {
     stdenv = gccStdenv;
@@ -34438,7 +34469,7 @@ with pkgs;
   wrapOBS = callPackage ../applications/video/obs-studio/wrapper.nix { };
 
   obsidian = callPackage ../applications/misc/obsidian {
-    electron = electron_24;
+    electron = electron_25;
   };
 
   octoprint = callPackage ../applications/misc/octoprint { };
@@ -35355,8 +35386,6 @@ with pkgs;
 
   tart = callPackage ../applications/virtualization/tart { };
 
-  tecoc = callPackage ../applications/editors/tecoc { };
-
   viber = callPackage ../applications/networking/instant-messengers/viber { };
 
   wavebox = libsForQt5.callPackage ../applications/networking/instant-messengers/wavebox { };
@@ -36483,7 +36512,7 @@ with pkgs;
 
   windowlab = callPackage ../applications/window-managers/windowlab { };
 
-  dockapps = callPackage ../by-name/wi/windowmaker/dockapps { };
+  inherit (windowmaker) dockapps;
 
   wily = callPackage ../applications/editors/wily { };
 
@@ -38872,6 +38901,8 @@ with pkgs;
 
   bftools = callPackage ../applications/science/biology/bftools { };
 
+  bioawk = callPackage ../applications/science/biology/bioawk { };
+
   blast = callPackage ../applications/science/biology/blast {
     inherit (darwin.apple_sdk.frameworks) ApplicationServices;
   };
@@ -41470,8 +41501,6 @@ with pkgs;
 
   xbps = callPackage ../tools/package-management/xbps { };
 
-  zkg = callPackage ../tools/package-management/zkg { };
-
   xcftools = callPackage ../tools/graphics/xcftools { };
 
   xhyve = callPackage ../applications/virtualization/xhyve {
@@ -42101,4 +42130,6 @@ with pkgs;
   };
 
   code-maat = callPackage ../development/tools/code-maat {};
+
+  mdhtml = callPackage ../tools/text/mdhtml { };
 }
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 67f2c91beabd0..ea65b3a702688 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4758,6 +4758,19 @@ with self; {
     };
   };
 
+  CryptBcrypt = buildPerlPackage {
+    pname = "Crypt-Bcrypt";
+    version = "0.011";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Bcrypt-0.011.tar.gz";
+      hash = "sha256-Z/ymiwUm5zTi2VvGsyutAcMZ5Yer9j5M80Itpmu+o6A=";
+    };
+    meta = {
+      description = "modern bcrypt implementation";
+      license = with lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   CryptBlowfish = buildPerlPackage {
     pname = "Crypt-Blowfish";
     version = "2.14";
@@ -4934,6 +4947,31 @@ with self; {
     };
   };
 
+  CryptHSXKPasswd = buildPerlPackage {
+    pname = "Crypt-HSXKPasswd";
+    version = "3.6";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/B/BA/BARTB/Crypt-HSXKPasswd-v3.6.tar.gz";
+      hash = "sha256-lZ3MX58BG/ALha0i31ZrerK/XqHTYrDeD7WuKfvEWLM=";
+    };
+    nativeBuildInputs = lib.optional stdenv.isDarwin shortenPerlShebang;
+    propagatedBuildInputs = [ Clone DateTime FileHomeDir FileShare FileShareDir GetoptLong JSON ListMoreUtils MathRound Readonly TextUnidecode TypeTiny ];
+    postInstall = lib.optionalString stdenv.isDarwin ''
+      shortenPerlShebang $out/bin/hsxkpasswd
+    '';
+
+    meta = {
+      description = "A secure memorable password generator";
+      homepage = "http://www.bartb.ie/hsxkpasswd";
+      license = with lib.licenses; [ bsd2 ];
+      maintainers = [ maintainers.dannixon ];
+      mainProgram = "hsxkpasswd";
+    };
+    # Two tests fail as a result of https://github.com/bbusschots/hsxkpasswd/issues/42
+    # (also see https://github.com/bbusschots/hsxkpasswd/issues/43)
+    doCheck = false;
+  };
+
   CryptIDEA = buildPerlPackage {
     pname = "Crypt-IDEA";
     version = "1.10";
@@ -4963,11 +5001,12 @@ with self; {
 
   CryptPassphrase = buildPerlPackage {
     pname = "Crypt-Passphrase";
-    version = "0.003";
+    version = "0.016";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-0.003.tar.gz";
-      hash = "sha256-aFqgkPgXmobWiWISzPjM/eennM6FcZm7FOInehDSQK0=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-0.016.tar.gz";
+      hash = "sha256-TOtPi1SsM/PYHJq0euTPoejDbzhJ76ghcDycMH46T8c=";
     };
+    propagatedBuildInputs = [ CryptURandom ];
     meta = {
       description = "A module for managing passwords in a cryptographically agile manner";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
@@ -4990,12 +5029,12 @@ with self; {
 
   CryptPassphraseBcrypt = buildPerlPackage {
     pname = "Crypt-Passphrase-Bcrypt";
-    version = "0.001";
+    version = "0.007";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-Bcrypt-0.001.tar.gz";
-      hash = "sha256-M44nA4RH/eAjznyaC1dPR+4zeQRKDAgxrJRx8UMNxMU=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Passphrase-Bcrypt-0.007.tar.gz";
+      hash = "sha256-/k1NHTm9TxODQaJZUFzhE3EnCnZ8nndH90H7dGH9sA8=";
     };
-    propagatedBuildInputs = [ CryptEksblowfish CryptPassphrase ];
+    propagatedBuildInputs = [ CryptBcrypt CryptPassphrase ];
     meta = {
       description = "A bcrypt encoder for Crypt::Passphrase";
       homepage = "https://github.com/Leont/crypt-passphrase-bcrypt";
@@ -9715,10 +9754,10 @@ with self; {
 
   FileReadBackwards = buildPerlPackage {
     pname = "File-ReadBackwards";
-    version = "1.05";
+    version = "1.06";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/U/UR/URI/File-ReadBackwards-1.05.tar.gz";
-      hash = "sha256-grJhr4dQfMPn5miZxFcQTryNHAn7hcU/Z8H5D3DxjW4=";
+      url = "mirror://cpan/authors/id/P/PL/PLICEASE/File-ReadBackwards-1.06.tar.gz";
+      hash = "sha256-MrKgVJOJqviIde8D1+u//y1ZeeyoW3yBL2tLsQ0QL2I=";
     };
     meta = {
       description = "Read a file backwards by lines";
@@ -10115,12 +10154,12 @@ with self; {
 
   Future = buildPerlModule {
     pname = "Future";
-    version = "0.48";
+    version = "0.50";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-0.48.tar.gz";
-      hash = "sha256-D+ixXBQvKjBKMXGKIKEFA6m0TMASw69eN7i34koHUqM=";
+      url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-0.50.tar.gz";
+      hash = "sha256-wDXj2eaaOvFEszrINN7p5lrTYPKlHbnxWNw0Ls3dX0Q=";
     };
-    buildInputs = [ TestFatal TestIdentity TestRefcount ];
+    buildInputs = [ Test2Suite ];
     meta = {
       description = "Represent an operation awaiting completion";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
@@ -10129,12 +10168,12 @@ with self; {
 
   FutureAsyncAwait = buildPerlModule rec {
     pname = "Future-AsyncAwait";
-    version = "0.58";
+    version = "0.66";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-AsyncAwait-0.58.tar.gz";
-      hash = "sha256-OLtJ9jabBUrAUuaNomR/4i0Io605rgNuJ6KRELtOQi4=";
+      url = "mirror://cpan/authors/id/P/PE/PEVANS/Future-AsyncAwait-0.66.tar.gz";
+      hash = "sha256-xqD03kYr8yS1usoXddGZ7DJGo1jBPbm2Ssv82+bl7CE=";
     };
-    buildInputs = [ TestRefcount TestFatal ];
+    buildInputs = [ Test2Suite ];
     propagatedBuildInputs = [ Future XSParseKeyword XSParseSublike ];
     perlPreHook = lib.optionalString stdenv.isDarwin "export LD=$CC";
     meta = {
@@ -12986,13 +13025,13 @@ with self; {
 
   JSONValidator = buildPerlPackage {
     pname = "JSON-Validator";
-    version = "5.08";
+    version = "5.14";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JH/JHTHORSEN/JSON-Validator-5.08.tar.gz";
-      hash = "sha256-QPaWjtcfxv1Ij6Q1Ityhk5NDhUCSth/eZgHwcWZHeFg=";
+      url = "mirror://cpan/authors/id/J/JH/JHTHORSEN/JSON-Validator-5.14.tar.gz";
+      hash = "sha256-YISl1AdeQhqTj/su6XuFBPqjXoZtD3tbWBETr17ijhs=";
     };
     buildInputs = [ TestDeep ];
-    propagatedBuildInputs = [ DataValidateDomain DataValidateIP Mojolicious NetIDNEncode YAMLLibYAML ];
+    propagatedBuildInputs = [ Mojolicious YAMLLibYAML ];
     meta = {
       description = "Validate data against a JSON schema";
       homepage = "https://github.com/mojolicious/json-validator";
@@ -16168,12 +16207,12 @@ with self; {
 
   MojoliciousPluginOpenAPI = buildPerlPackage {
     pname = "Mojolicious-Plugin-OpenAPI";
-    version = "5.05";
+    version = "5.09";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/J/JH/JHTHORSEN/Mojolicious-Plugin-OpenAPI-5.05.tar.gz";
-      hash = "sha256-xH+I0c434/YT9uizV9grenEEX/wKSXOVUS67zahlYV0=";
+      url = "mirror://cpan/authors/id/J/JH/JHTHORSEN/Mojolicious-Plugin-OpenAPI-5.09.tar.gz";
+      hash = "sha256-BIJdfOIe20G80Ujrz6Gu+Ek258QOhKOdvyeGcdSaMQY=";
     };
-    propagatedBuildInputs = [ JSONValidator ];
+    propagatedBuildInputs = [ JSONValidator Mojolicious ];
     meta = {
       description = "OpenAPI / Swagger plugin for Mojolicious";
       homepage = "https://github.com/jhthorsen/mojolicious-plugin-openapi";
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 6d28fd6dc2f10..164475b96eb81 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -244,6 +244,7 @@ mapAliases ({
   notifymuch = throw "notifymuch has been promoted to a top-level attribute"; # added 2022-10-02
   Nuitka = nuitka; # added 2023-02-19
   ntlm-auth = throw "ntlm-auth has been removed, because it relies on the md4 implementation provided by openssl. Use pyspnego instead.";
+  opsdroid_get_image_size = opsdroid-get-image-size; # added 2023-10-16
   ordereddict = throw "ordereddict has been removed because it is only useful on unsupported python versions."; # added 2022-05-28
   pafy = throw "pafy has been removed because it is unmaintained and only a dependency of mps-youtube, itself superseded by yewtube"; # Added 2023-01-19
   pam = python-pam; # added 2020-09-07.
@@ -289,6 +290,7 @@ mapAliases ({
   pymc3 = pymc; # added 2022-06-05, module was rename starting with 4.0.0
   pymssql = throw "pymssql has been abandoned upstream."; # added 2020-05-04
   PyMVGLive = pymvglive; # added 2023-02-19
+  pymyq = python-myq; # added 2023-10-20
   pyqt4 = throw "pyqt4 has been removed, because it depended on the long EOL qt4"; # added 2022-06-09
   pyramid_beaker = pyramid-beaker; # added 2023-08-23
   pyramid_chameleon = pyramid-chameleon; # added 2023-08-23
@@ -352,7 +354,9 @@ mapAliases ({
   Quandl = quandl; # added 2023-02-19
   qiskit-aqua = throw "qiskit-aqua has been removed due to deprecation, with its functionality moved to different qiskit packages";
   rabbitpy = throw "rabbitpy has been removed, since it is unmaintained and broken"; # added 2023-07-01
+  ratelimiter = throw "ratelimiter has been removed, since it is unmaintained and broken"; # added 2023-10-21
   rdflib-jsonld = throw "rdflib-jsonld is not compatible with rdflib 6"; # added 2021-11-05
+  recaptcha_client = throw "recaptcha_client has been removed since it is no longer maintained"; # added 2023-10-20
   rednose = throw "rednose is no longer maintained (since February 2018)"; # added 2023-08-06
   retworkx = rustworkx; # added 2023-05-14
   repeated_test = repeated-test; # added 2022-11-15
@@ -381,6 +385,7 @@ mapAliases ({
   somecomfort = throw "somecomfort was removed because Home Assistant switched to aiosomecomfort"; # added 2023-02-01
   SPARQLWrapper = sparqlwrapper;
   sphinx-jquery = sphinxcontrib-jquery; # added 2023-02-24
+  sphinx_pypi_upload = throw "sphinx_pypi_upload has been removed since it is abandoned."; # added 2023-10-11
   sphinx_rtd_theme = sphinx-rtd-theme; # added 2022-08-03
   sphinxcontrib-autoapi = sphinx-autoapi; # added 2023-02=28
   sphinxcontrib_plantuml = sphinxcontrib-plantuml; # added 2021-08-02
@@ -432,5 +437,6 @@ mapAliases ({
   zope_contenttype = zope-contenttype; # added 2023-10-11
   zope_deprecation = zope-deprecation; # added 2023-10-07
   zope_i18nmessageid = zope-i18nmessageid; # added 2023-07-29
+  zope_lifecycleevent = zope-lifecycleevent; # added 2023-10-11
   zope_proxy = zope-proxy; # added 2023-10-07
 })
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 67123ec5a10da..57c9a0eb33df4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -198,6 +198,8 @@ self: super: with self; {
 
   aioecowitt = callPackage ../development/python-modules/aioecowitt { };
 
+  aioelectricitymaps = callPackage ../development/python-modules/aioelectricitymaps { };
+
   aioemonitor = callPackage ../development/python-modules/aioemonitor { };
 
   aioesphomeapi = callPackage ../development/python-modules/aioesphomeapi { };
@@ -1775,6 +1777,8 @@ self: super: with self; {
 
   canopen = callPackage ../development/python-modules/canopen { };
 
+  cantools = callPackage ../development/python-modules/cantools { };
+
   camelot = callPackage ../development/python-modules/camelot { };
 
   capstone = callPackage ../development/python-modules/capstone {
@@ -1876,11 +1880,13 @@ self: super: with self; {
 
   certbot-dns-cloudflare = callPackage ../development/python-modules/certbot-dns-cloudflare { };
 
+  certbot-dns-google = callPackage ../development/python-modules/certbot-dns-google { };
+
   certbot-dns-inwx = callPackage ../development/python-modules/certbot-dns-inwx { };
 
-  certbot-dns-rfc2136 = callPackage ../development/python-modules/certbot-dns-rfc2136 { };
+  certbot-dns-ovh = callPackage ../development/python-modules/certbot-dns-ovh { };
 
-  certbot-dns-google = callPackage ../development/python-modules/certbot-dns-google { };
+  certbot-dns-rfc2136 = callPackage ../development/python-modules/certbot-dns-rfc2136 { };
 
   certbot-dns-route53 = callPackage ../development/python-modules/certbot-dns-route53 { };
 
@@ -2730,6 +2736,8 @@ self: super: with self; {
 
   derpconf = callPackage ../development/python-modules/derpconf { };
 
+  desktop-entry-lib = callPackage ../development/python-modules/desktop-entry-lib { };
+
   desktop-notifier = callPackage ../development/python-modules/desktop-notifier { };
 
   detect-secrets = callPackage ../development/python-modules/detect-secrets { };
@@ -3267,6 +3275,8 @@ self: super: with self; {
 
   dragonfly = callPackage ../development/python-modules/dragonfly { };
 
+  dramatiq = callPackage ../development/python-modules/dramatiq { };
+
   drawille = callPackage ../development/python-modules/drawille { };
 
   drawilleplot = callPackage ../development/python-modules/drawilleplot { };
@@ -3964,6 +3974,8 @@ self: super: with self; {
 
   flask-cors = callPackage ../development/python-modules/flask-cors { };
 
+  flask-dramatiq = callPackage ../development/python-modules/flask-dramatiq { };
+
   flask-elastic = callPackage ../development/python-modules/flask-elastic { };
 
   flask-expects-json = callPackage ../development/python-modules/flask-expects-json { };
@@ -8510,7 +8522,7 @@ self: super: with self; {
 
   opower = callPackage ../development/python-modules/opower { };
 
-  opsdroid_get_image_size = callPackage ../development/python-modules/opsdroid_get_image_size { };
+  opsdroid-get-image-size = callPackage ../development/python-modules/opsdroid-get-image-size { };
 
   opt-einsum = callPackage ../development/python-modules/opt-einsum { };
 
@@ -8846,6 +8858,8 @@ self: super: with self; {
 
   periodictable = callPackage ../development/python-modules/periodictable { };
 
+  periodiq = callPackage ../development/python-modules/periodiq { };
+
   permissionedforms = callPackage ../development/python-modules/permissionedforms { };
 
   persim = callPackage ../development/python-modules/persim { };
@@ -10442,7 +10456,7 @@ self: super: with self; {
 
   pymvglive = callPackage ../development/python-modules/pymvglive { };
 
-  pymyq = callPackage ../development/python-modules/pymyq { };
+  python-myq = callPackage ../development/python-modules/python-myq { };
 
   pymysensors = callPackage ../development/python-modules/pymysensors { };
 
@@ -11981,8 +11995,6 @@ self: super: with self; {
 
   ratelimit = callPackage ../development/python-modules/ratelimit { };
 
-  ratelimiter = callPackage ../development/python-modules/ratelimiter { };
-
   rauth = callPackage ../development/python-modules/rauth { };
 
   raven = callPackage ../development/python-modules/raven { };
@@ -12016,6 +12028,8 @@ self: super: with self; {
 
   readlike = callPackage ../development/python-modules/readlike { };
 
+  readmdict = callPackage ../development/python-modules/readmdict { };
+
   readme = callPackage ../development/python-modules/readme { };
 
   readme_renderer = callPackage ../development/python-modules/readme_renderer { };
@@ -12026,8 +12040,6 @@ self: super: with self; {
 
   rebulk = callPackage ../development/python-modules/rebulk { };
 
-  recaptcha_client = callPackage ../development/python-modules/recaptcha_client { };
-
   recipe-scrapers = callPackage ../development/python-modules/recipe-scrapers { };
 
   recline = callPackage ../development/python-modules/recline { };
@@ -13222,8 +13234,6 @@ self: super: with self; {
 
   sphinx-mdinclude = callPackage ../development/python-modules/sphinx-mdinclude { };
 
-  sphinx_pypi_upload = callPackage ../development/python-modules/sphinx_pypi_upload { };
-
   sphinx-rtd-theme = callPackage ../development/python-modules/sphinx-rtd-theme { };
 
   sphinx-serve = callPackage ../development/python-modules/sphinx-serve { };
@@ -13342,6 +13352,8 @@ self: super: with self; {
 
   static3 = callPackage ../development/python-modules/static3 { };
 
+  staticmap = callPackage ../development/python-modules/staticmap { };
+
   staticjinja = callPackage ../development/python-modules/staticjinja { };
 
   statistics = callPackage ../development/python-modules/statistics { };
@@ -13714,6 +13726,8 @@ self: super: with self; {
 
   textile = callPackage ../development/python-modules/textile { };
 
+  textparser = callPackage ../development/python-modules/textparser { };
+
   textual = callPackage ../development/python-modules/textual { };
 
   textual-universal-directorytree = callPackage ../development/python-modules/textual-universal-directorytree { };
@@ -14935,6 +14949,8 @@ self: super: with self; {
 
   types-beautifulsoup4 = callPackage ../development/python-modules/types-beautifulsoup4 { };
 
+  types-click = callPackage ../development/python-modules/types-click { };
+
   types-colorama = callPackage ../development/python-modules/types-colorama { };
 
   types-dateutil = callPackage ../development/python-modules/types-dateutil { };
@@ -15419,6 +15435,8 @@ self: super: with self; {
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
   };
 
+  watchdog-gevent = callPackage ../development/python-modules/watchdog-gevent { };
+
   watchfiles = callPackage ../development/python-modules/watchfiles {
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
   };
@@ -15957,7 +15975,7 @@ self: super: with self; {
 
   zope_interface = callPackage ../development/python-modules/zope_interface { };
 
-  zope_lifecycleevent = callPackage ../development/python-modules/zope_lifecycleevent { };
+  zope-lifecycleevent = callPackage ../development/python-modules/zope-lifecycleevent { };
 
   zope_location = callPackage ../development/python-modules/zope_location { };