about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--CONTRIBUTING.md2
-rw-r--r--maintainers/maintainer-list.nix6
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md7
-rw-r--r--nixos/lib/eval-config.nix1
-rw-r--r--nixos/modules/image/repart-image.nix36
-rw-r--r--nixos/modules/image/repart.nix76
-rw-r--r--nixos/modules/misc/version.nix34
-rw-r--r--nixos/modules/services/audio/gmediarender.nix1
-rw-r--r--nixos/modules/services/audio/jmusicbot.nix1
-rw-r--r--nixos/modules/services/audio/spotifyd.nix1
-rw-r--r--nixos/modules/services/audio/ympd.nix1
-rw-r--r--nixos/modules/services/continuous-integration/buildbot/master.nix1
-rw-r--r--nixos/modules/services/continuous-integration/gitea-actions-runner.nix1
-rw-r--r--nixos/modules/services/continuous-integration/hydra/default.nix1
-rw-r--r--nixos/modules/services/databases/lldap.nix1
-rw-r--r--nixos/modules/services/databases/openldap.nix1
-rw-r--r--nixos/modules/services/desktops/geoclue2.nix2
-rw-r--r--nixos/modules/services/home-automation/evcc.nix1
-rw-r--r--nixos/modules/services/home-automation/home-assistant.nix1
-rw-r--r--nixos/modules/services/logging/journaldriver.nix1
-rw-r--r--nixos/modules/services/mail/roundcube.nix1
-rw-r--r--nixos/modules/services/mail/sympa.nix2
-rw-r--r--nixos/modules/services/matrix/synapse.nix2
-rw-r--r--nixos/modules/services/misc/amazon-ssm-agent.nix1
-rw-r--r--nixos/modules/services/misc/bcg.nix2
-rw-r--r--nixos/modules/services/misc/domoticz.nix1
-rw-r--r--nixos/modules/services/misc/etesync-dav.nix1
-rw-r--r--nixos/modules/services/misc/mediatomb.nix1
-rw-r--r--nixos/modules/services/misc/metabase.nix1
-rw-r--r--nixos/modules/services/misc/paperless.nix1
-rw-r--r--nixos/modules/services/monitoring/mackerel-agent.nix1
-rw-r--r--nixos/modules/services/monitoring/prometheus/alertmanager.nix1
-rw-r--r--nixos/modules/services/monitoring/teamviewer.nix1
-rw-r--r--nixos/modules/services/monitoring/telegraf.nix1
-rw-r--r--nixos/modules/services/network-filesystems/openafs/client.nix1
-rw-r--r--nixos/modules/services/network-filesystems/samba.nix2
-rw-r--r--nixos/modules/services/networking/bitcoind.nix1
-rw-r--r--nixos/modules/services/networking/dante.nix1
-rw-r--r--nixos/modules/services/networking/ergo.nix1
-rw-r--r--nixos/modules/services/networking/expressvpn.nix1
-rw-r--r--nixos/modules/services/networking/headscale.nix1
-rw-r--r--nixos/modules/services/networking/ircd-hybrid/default.nix3
-rw-r--r--nixos/modules/services/networking/ivpn.nix2
-rw-r--r--nixos/modules/services/networking/kea.nix7
-rw-r--r--nixos/modules/services/networking/mosquitto.nix1
-rw-r--r--nixos/modules/services/networking/mullvad-vpn.nix2
-rw-r--r--nixos/modules/services/networking/nbd.nix1
-rw-r--r--nixos/modules/services/networking/ocserv.nix1
-rw-r--r--nixos/modules/services/networking/pleroma.nix1
-rw-r--r--nixos/modules/services/networking/rosenpass.nix1
-rw-r--r--nixos/modules/services/networking/rxe.nix2
-rw-r--r--nixos/modules/services/networking/soju.nix1
-rw-r--r--nixos/modules/services/networking/strongswan-swanctl/module.nix1
-rw-r--r--nixos/modules/services/networking/strongswan.nix1
-rw-r--r--nixos/modules/services/networking/syncplay.nix1
-rw-r--r--nixos/modules/services/networking/wasabibackend.nix1
-rw-r--r--nixos/modules/services/networking/znc/default.nix1
-rw-r--r--nixos/modules/services/security/certmgr.nix1
-rw-r--r--nixos/modules/services/security/oauth2_proxy.nix1
-rw-r--r--nixos/modules/services/system/cachix-agent/default.nix1
-rw-r--r--nixos/modules/services/system/cachix-watch-store.nix1
-rw-r--r--nixos/modules/services/video/go2rtc/default.nix1
-rw-r--r--nixos/modules/services/web-apps/akkoma.nix2
-rw-r--r--nixos/modules/services/web-apps/alps.nix1
-rw-r--r--nixos/modules/services/web-apps/c2fmzq-server.nix1
-rw-r--r--nixos/modules/services/web-apps/code-server.nix1
-rw-r--r--nixos/modules/services/web-apps/healthchecks.nix1
-rw-r--r--nixos/modules/services/web-apps/netbox.nix1
-rw-r--r--nixos/modules/services/web-apps/openvscode-server.nix1
-rw-r--r--nixos/modules/services/web-apps/peering-manager.nix1
-rw-r--r--nixos/modules/services/web-apps/wordpress.nix10
-rw-r--r--nixos/modules/services/web-servers/agate.nix1
-rw-r--r--nixos/modules/services/web-servers/mighttpd2.nix1
-rw-r--r--nixos/modules/services/web-servers/minio.nix1
-rw-r--r--nixos/modules/services/web-servers/traefik.nix1
-rw-r--r--nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix6
-rw-r--r--nixos/modules/system/boot/systemd.nix46
-rw-r--r--nixos/modules/virtualisation/amazon-image.nix1
-rw-r--r--nixos/modules/virtualisation/oci-containers.nix1
-rw-r--r--nixos/tests/3proxy.nix1
-rw-r--r--nixos/tests/acme.nix1
-rw-r--r--nixos/tests/adguardhome.nix1
-rw-r--r--nixos/tests/appliance-repart-image.nix12
-rw-r--r--nixos/tests/babeld.nix4
-rw-r--r--nixos/tests/bittorrent.nix4
-rw-r--r--nixos/tests/buildbot.nix2
-rw-r--r--nixos/tests/corerad.nix2
-rw-r--r--nixos/tests/curl-impersonate.nix2
-rw-r--r--nixos/tests/ferm.nix2
-rw-r--r--nixos/tests/gitdaemon.nix3
-rw-r--r--nixos/tests/guix/publish.nix1
-rw-r--r--nixos/tests/hostname.nix1
-rw-r--r--nixos/tests/installer.nix3
-rw-r--r--nixos/tests/kanidm.nix1
-rw-r--r--nixos/tests/lemmy.nix2
-rw-r--r--nixos/tests/networking.nix3
-rw-r--r--nixos/tests/nfs/kerberos.nix1
-rw-r--r--nixos/tests/opensmtpd-rspamd.nix1
-rw-r--r--nixos/tests/opensmtpd.nix1
-rw-r--r--nixos/tests/owncast.nix2
-rw-r--r--nixos/tests/postgis.nix1
-rw-r--r--nixos/tests/qemu-vm-restrictnetwork.nix2
-rw-r--r--nixos/tests/rss2email.nix1
-rw-r--r--nixos/tests/ssh-audit.nix1
-rw-r--r--nixos/tests/systemd-networkd-dhcpserver.nix3
-rw-r--r--nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix8
-rw-r--r--nixos/tests/systemd-nspawn.nix1
-rw-r--r--nixos/tests/tayga.nix2
-rw-r--r--nixos/tests/trafficserver.nix1
-rw-r--r--nixos/tests/ulogd/ulogd.py1
-rw-r--r--nixos/tests/upnp.nix2
-rw-r--r--nixos/tests/uptermd.nix1
-rw-r--r--nixos/tests/zrepl.nix1
-rw-r--r--pkgs/applications/audio/hydrogen/default.nix4
-rw-r--r--pkgs/applications/audio/picard/default.nix2
-rw-r--r--pkgs/applications/audio/quodlibet/default.nix2
-rw-r--r--pkgs/applications/audio/spotify-cli-linux/default.nix4
-rw-r--r--pkgs/applications/editors/retext/default.nix6
-rw-r--r--pkgs/applications/editors/vscode/extensions/default.nix36
-rw-r--r--pkgs/applications/graphics/identity/default.nix2
-rw-r--r--pkgs/applications/misc/ausweisapp/default.nix4
-rw-r--r--pkgs/applications/misc/electrum/default.nix3
-rw-r--r--pkgs/applications/misc/remarkable/rmview/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/brave/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix6
-rw-r--r--pkgs/applications/networking/cluster/tftui/default.nix54
-rw-r--r--pkgs/applications/networking/dnscontrol/default.nix6
-rw-r--r--pkgs/applications/networking/gnome-network-displays/default.nix10
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix4
-rw-r--r--pkgs/applications/networking/p2p/qbittorrent/default.nix2
-rw-r--r--pkgs/applications/networking/remote/xrdp/default.nix4
-rw-r--r--pkgs/applications/networking/sniffers/wireshark/default.nix2
-rw-r--r--pkgs/applications/radio/freedv/default.nix4
-rw-r--r--pkgs/applications/version-management/gut/default.nix2
-rw-r--r--pkgs/applications/version-management/subversion/default.nix4
-rw-r--r--pkgs/applications/video/mpv/scripts/occivink.nix6
-rw-r--r--pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix2
-rw-r--r--pkgs/applications/video/obs-studio/plugins/obs-teleport/default.nix2
-rw-r--r--pkgs/applications/video/subtitleedit/default.nix2
-rw-r--r--pkgs/by-name/ae/aeacus/package.nix35
-rw-r--r--pkgs/by-name/ap/approxmc/package.nix43
-rw-r--r--pkgs/by-name/ar/arjun-cnf/fix-red-clause.patch28
-rw-r--r--pkgs/by-name/ar/arjun-cnf/package.nix48
-rw-r--r--pkgs/by-name/au/audiobookshelf/package.nix (renamed from pkgs/servers/audiobookshelf/default.nix)21
-rw-r--r--pkgs/by-name/au/audiobookshelf/source.json9
-rwxr-xr-xpkgs/by-name/au/audiobookshelf/update.nu30
-rw-r--r--pkgs/by-name/au/audiobookshelf/wrapper.nix (renamed from pkgs/servers/audiobookshelf/wrapper.nix)0
-rw-r--r--pkgs/by-name/fi/fira-math/package.nix49
-rw-r--r--pkgs/by-name/lo/louvain-community/package.nix27
-rw-r--r--pkgs/by-name/ma/manticoresearch/package.nix (renamed from pkgs/servers/search/manticoresearch/default.nix)26
-rw-r--r--pkgs/by-name/ml/mlx42/package.nix16
-rw-r--r--pkgs/by-name/mo/morewaita-icon-theme/package.nix4
-rw-r--r--pkgs/by-name/pa/passdetective/package.nix35
-rw-r--r--pkgs/by-name/py/pyspread/package.nix4
-rw-r--r--pkgs/by-name/rm/rmg/package.nix4
-rw-r--r--pkgs/by-name/sh/show-midi/package.nix83
-rw-r--r--pkgs/by-name/te/terrapin-scanner/package.nix4
-rw-r--r--pkgs/by-name/ti/tigerbeetle/package.nix15
-rw-r--r--pkgs/by-name/uc/uchecker/package.nix49
-rw-r--r--pkgs/by-name/ux/uxn/package.nix6
-rw-r--r--pkgs/data/fonts/kode-mono/default.nix4
-rw-r--r--pkgs/data/misc/clash-geoip/default.nix4
-rw-r--r--pkgs/data/themes/alacritty-theme/default.nix6
-rw-r--r--pkgs/development/compilers/blueprint/default.nix2
-rw-r--r--pkgs/development/compilers/codon/default.nix2
-rw-r--r--pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix18
-rw-r--r--pkgs/development/coq-modules/coqeal/default.nix2
-rw-r--r--pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix2
-rw-r--r--pkgs/development/coq-modules/mathcomp-finmap/default.nix4
-rw-r--r--pkgs/development/coq-modules/multinomials/default.nix4
-rw-r--r--pkgs/development/interpreters/php/8.2.nix4
-rw-r--r--pkgs/development/libraries/draco/default.nix4
-rw-r--r--pkgs/development/libraries/functionalplus/default.nix4
-rw-r--r--pkgs/development/libraries/itk/generic.nix10
-rw-r--r--pkgs/development/libraries/libremidi/default.nix2
-rw-r--r--pkgs/development/libraries/p11-kit/default.nix4
-rw-r--r--pkgs/development/libraries/qtkeychain/default.nix4
-rw-r--r--pkgs/development/libraries/science/math/mongoose/default.nix6
-rw-r--r--pkgs/development/php-packages/castor/default.nix6
-rw-r--r--pkgs/development/php-packages/spx/default.nix4
-rw-r--r--pkgs/development/python-modules/aioswitcher/default.nix9
-rw-r--r--pkgs/development/python-modules/anywidget/default.nix4
-rw-r--r--pkgs/development/python-modules/birch/default.nix14
-rw-r--r--pkgs/development/python-modules/bthome-ble/default.nix4
-rw-r--r--pkgs/development/python-modules/darkdetect/default.nix2
-rw-r--r--pkgs/development/python-modules/ducc0/default.nix4
-rw-r--r--pkgs/development/python-modules/dvc-gdrive/default.nix49
-rw-r--r--pkgs/development/python-modules/dvc-hdfs/default.nix49
-rw-r--r--pkgs/development/python-modules/dvc/default.nix29
-rw-r--r--pkgs/development/python-modules/mobi/default.nix2
-rw-r--r--pkgs/development/python-modules/msoffcrypto-tool/default.nix4
-rw-r--r--pkgs/development/python-modules/pulp/default.nix4
-rw-r--r--pkgs/development/python-modules/pyaudio/default.nix4
-rw-r--r--pkgs/development/python-modules/pydrive2/default.nix27
-rw-r--r--pkgs/development/python-modules/pyosohotwaterapi/default.nix63
-rw-r--r--pkgs/development/python-modules/pyprusalink/default.nix4
-rw-r--r--pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix6
-rw-r--r--pkgs/development/python-modules/pytest-ansible/default.nix4
-rw-r--r--pkgs/development/python-modules/readmdict/default.nix2
-rw-r--r--pkgs/development/python-modules/sentence-splitter/default.nix2
-rw-r--r--pkgs/development/python-modules/simplemma/default.nix2
-rw-r--r--pkgs/development/python-modules/slpp/default.nix2
-rw-r--r--pkgs/development/python-modules/sphinx-comments/default.nix5
-rw-r--r--pkgs/development/python-modules/strct/default.nix14
-rw-r--r--pkgs/development/python-modules/telegram-text/default.nix8
-rw-r--r--pkgs/development/python-modules/trimesh/default.nix4
-rw-r--r--pkgs/development/python-modules/withings-sync/default.nix6
-rw-r--r--pkgs/development/tools/analysis/checkov/default.nix4
-rw-r--r--pkgs/development/tools/analysis/snyk/default.nix6
-rw-r--r--pkgs/development/tools/bearer/default.nix6
-rw-r--r--pkgs/development/tools/cddl/Gemfile.lock32
-rw-r--r--pkgs/development/tools/cddl/default.nix31
-rw-r--r--pkgs/development/tools/cddl/gemset.nix88
-rw-r--r--pkgs/development/tools/eask/default.nix6
-rw-r--r--pkgs/development/tools/infisical/default.nix2
-rw-r--r--pkgs/development/tools/infisical/hashes.json8
-rw-r--r--pkgs/development/tools/misc/runme/default.nix4
-rw-r--r--pkgs/development/tools/rojo/default.nix12
-rw-r--r--pkgs/development/tools/rust/cargo-dist/default.nix9
-rw-r--r--pkgs/development/tools/rust/cargo-llvm-cov/default.nix8
-rw-r--r--pkgs/development/tools/ttfb/default.nix25
-rw-r--r--pkgs/development/tools/xc/default.nix6
-rw-r--r--pkgs/games/anki/default.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix34
-rw-r--r--pkgs/os-specific/linux/nixos-rebuild/default.nix4
-rwxr-xr-xpkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh2
-rw-r--r--pkgs/os-specific/linux/nixos-rebuild/test/repl.nix146
-rw-r--r--pkgs/servers/matrix-synapse/matrix-hookshot/package.json81
-rw-r--r--pkgs/servers/matrix-synapse/matrix-hookshot/pin.json8
-rw-r--r--pkgs/servers/nextcloud/notify_push.nix8
-rw-r--r--pkgs/servers/nextcloud/packages/26.json30
-rw-r--r--pkgs/servers/nextcloud/packages/27.json36
-rw-r--r--pkgs/servers/nextcloud/packages/28.json36
-rw-r--r--pkgs/servers/readarr/default.nix8
-rw-r--r--pkgs/servers/sql/postgresql/ext/postgis.nix6
-rw-r--r--pkgs/tools/X11/screen-message/default.nix12
-rw-r--r--pkgs/tools/admin/wander/default.nix4
-rw-r--r--pkgs/tools/audio/beets/builtin-plugins.nix1
-rw-r--r--pkgs/tools/graphics/vips/default.nix4
-rw-r--r--pkgs/tools/misc/fastfetch/default.nix4
-rw-r--r--pkgs/tools/networking/i2pd/default.nix4
-rw-r--r--pkgs/tools/security/nuclei/default.nix6
-rw-r--r--pkgs/tools/security/sudo/default.nix4
-rw-r--r--pkgs/tools/system/kanata/default.nix15
-rw-r--r--pkgs/tools/text/autocorrect/Cargo.lock733
-rw-r--r--pkgs/tools/text/autocorrect/default.nix8
-rw-r--r--pkgs/tools/text/crowdin-cli/default.nix4
-rw-r--r--pkgs/tools/text/fanficfare/default.nix12
-rw-r--r--pkgs/tools/text/mecab/default.nix2
-rw-r--r--pkgs/tools/virtualization/govc/default.nix4
-rw-r--r--pkgs/top-level/all-packages.nix20
-rw-r--r--pkgs/top-level/python-packages.nix6
252 files changed, 2189 insertions, 827 deletions
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3cc123be431e5..55232e9c3a545 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -378,7 +378,7 @@ The staging workflow exists to batch Hydra builds of many packages together.
 It works by directing commits that cause [mass rebuilds][mass-rebuild] to a separate `staging` branch that isn't directly built by Hydra.
 Regularly, the `staging` branch is _manually_ merged into a `staging-next` branch to be built by Hydra using the [`nixpkgs:staging-next` jobset](https://hydra.nixos.org/jobset/nixpkgs/staging-next).
 The `staging-next` branch should then only receive direct commits in order to fix Hydra builds.
-Once it is verified that there are no major regressions, it is merged into `master` using [a pull requests](https://github.com/NixOS/nixpkgs/pulls?q=head%3Astaging-next).
+Once it is verified that there are no major regressions, it is merged into `master` using [a pull request](https://github.com/NixOS/nixpkgs/pulls?q=head%3Astaging-next).
 This is done manually in order to ensure it's a good use of Hydra's computing resources.
 By keeping the `staging-next` branch separate from `staging`, this batching does not block developers from merging changes into `staging`.
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 81c7b6dbc8a36..4ab9e817ada68 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2553,6 +2553,12 @@
     githubId = 52386117;
     name = "Blusk";
   };
+  bmanuel = {
+    name = "Benjamin Manuel";
+    email = "ben@benmanuel.com";
+    github = "bmanuel";
+    githubId = 3662307;
+  };
   bmilanov = {
     name = "Biser Milanov";
     email = "bmilanov11+nixpkgs@gmail.com";
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 9e8ef49783cab..c53a1dcce3201 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -112,6 +112,13 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `services.avahi.nssmdns` got split into `services.avahi.nssmdns4` and `services.avahi.nssmdns6` which enable the mDNS NSS switch for IPv4 and IPv6 respectively.
   Since most mDNS responders only register IPv4 addresses, most users want to keep the IPv6 support disabled to avoid long timeouts.
 
+- `multi-user.target` no longer depends on `network-online.target`.
+  This will potentially break services that assumed this was the case in the past.
+  This was changed for consistency with other distributions as well as improved boot times.
+
+  We have added a warning for services that are
+  `after = [ "network-online.target" ]` but do not depend on it (e.g. using `wants`).
+
 - `networking.iproute2.enable` now does not set `environment.etc."iproute2/rt_tables".text`.
 
   Setting `environment.etc."iproute2/{CONFIG_FILE_NAME}".text` will override the whole configuration file instead of appending it to the upstream configuration file.
diff --git a/nixos/lib/eval-config.nix b/nixos/lib/eval-config.nix
index da099f86aa2ce..8bab3752073ff 100644
--- a/nixos/lib/eval-config.nix
+++ b/nixos/lib/eval-config.nix
@@ -110,6 +110,7 @@ let
   withExtraAttrs = configuration: configuration // {
     inherit extraArgs;
     inherit (configuration._module.args) pkgs;
+    inherit lib;
     extendModules = args: withExtraAttrs (configuration.extendModules args);
   };
 in
diff --git a/nixos/modules/image/repart-image.nix b/nixos/modules/image/repart-image.nix
index b4a1dfe51ff3a..a12b4fb14fb16 100644
--- a/nixos/modules/image/repart-image.nix
+++ b/nixos/modules/image/repart-image.nix
@@ -10,6 +10,8 @@
 , systemd
 , fakeroot
 , util-linux
+
+  # filesystem tools
 , dosfstools
 , mtools
 , e2fsprogs
@@ -18,8 +20,13 @@
 , btrfs-progs
 , xfsprogs
 
+  # compression tools
+, zstd
+, xz
+
   # arguments
-, name
+, imageFileBasename
+, compression
 , fileSystems
 , partitions
 , split
@@ -52,14 +59,25 @@ let
   };
 
   fileSystemTools = builtins.concatMap (f: fileSystemToolMapping."${f}") fileSystems;
+
+  compressionPkg = {
+    "zstd" = zstd;
+    "xz" = xz;
+  }."${compression.algorithm}";
+
+  compressionCommand = {
+    "zstd" = "zstd --no-progress --threads=0 -${toString compression.level}";
+    "xz" = "xz --keep --verbose --threads=0 -${toString compression.level}";
+  }."${compression.algorithm}";
 in
 
-runCommand name
+runCommand imageFileBasename
 {
   nativeBuildInputs = [
     systemd
     fakeroot
     util-linux
+    compressionPkg
   ] ++ fileSystemTools;
 } ''
   amendedRepartDefinitions=$(${amendRepartDefinitions} ${partitions} ${definitionsDirectory})
@@ -67,6 +85,7 @@ runCommand name
   mkdir -p $out
   cd $out
 
+  echo "Building image with systemd-repart..."
   unshare --map-root-user fakeroot systemd-repart \
     --dry-run=no \
     --empty=create \
@@ -75,6 +94,17 @@ runCommand name
     --definitions="$amendedRepartDefinitions" \
     --split="${lib.boolToString split}" \
     --json=pretty \
-    image.raw \
+    ${imageFileBasename}.raw \
     | tee repart-output.json
+
+  # Compression is implemented in the same derivation as opposed to in a
+  # separate derivation to allow users to save disk space. Disk images are
+  # already very space intensive so we want to allow users to mitigate this.
+  if ${lib.boolToString compression.enable}; then
+    for f in ${imageFileBasename}*; do
+      echo "Compressing $f with ${compression.algorithm}..."
+      # Keep the original file when compressing and only delete it afterwards
+      ${compressionCommand} $f && rm $f
+    done
+  fi
 ''
diff --git a/nixos/modules/image/repart.nix b/nixos/modules/image/repart.nix
index da4f45d9a6392..ed584d9bf997b 100644
--- a/nixos/modules/image/repart.nix
+++ b/nixos/modules/image/repart.nix
@@ -66,7 +66,53 @@ in
 
     name = lib.mkOption {
       type = lib.types.str;
-      description = lib.mdDoc "The name of the image.";
+      description = lib.mdDoc ''
+        Name of the image.
+
+        If this option is unset but config.system.image.id is set,
+        config.system.image.id is used as the default value.
+      '';
+    };
+
+    version = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = config.system.image.version;
+      defaultText = lib.literalExpression "config.system.image.version";
+      description = lib.mdDoc "Version of the image";
+    };
+
+    imageFileBasename = lib.mkOption {
+      type = lib.types.str;
+      readOnly = true;
+      description = lib.mdDoc ''
+        Basename of the image filename without any extension (e.g. `image_1`).
+      '';
+    };
+
+    imageFile = lib.mkOption {
+      type = lib.types.str;
+      readOnly = true;
+      description = lib.mdDoc ''
+        Filename of the image including all extensions (e.g `image_1.raw` or
+        `image_1.raw.zst`).
+      '';
+    };
+
+    compression = {
+      enable = lib.mkEnableOption (lib.mdDoc "Image compression");
+
+      algorithm = lib.mkOption {
+        type = lib.types.enum [ "zstd" "xz" ];
+        default = "zstd";
+        description = lib.mdDoc "Compression algorithm";
+      };
+
+      level = lib.mkOption {
+        type = lib.types.int;
+        description = lib.mdDoc ''
+          Compression level. The available range depends on the used algorithm.
+        '';
+      };
     };
 
     seed = lib.mkOption {
@@ -131,6 +177,32 @@ in
 
   config = {
 
+    image.repart =
+      let
+        version = config.image.repart.version;
+        versionInfix = if version != null then "_${version}" else "";
+        compressionSuffix = lib.optionalString cfg.compression.enable
+          {
+            "zstd" = ".zst";
+            "xz" = ".xz";
+          }."${cfg.compression.algorithm}";
+      in
+      {
+        name = lib.mkIf (config.system.image.id != null) (lib.mkOptionDefault config.system.image.id);
+        imageFileBasename = cfg.name + versionInfix;
+        imageFile = cfg.imageFileBasename + ".raw" + compressionSuffix;
+
+        compression = {
+          # Generally default to slightly faster than default compression
+          # levels under the assumption that most of the building will be done
+          # for development and release builds will be customized.
+          level = lib.mkOptionDefault {
+            "zstd" = 3;
+            "xz" = 3;
+          }."${cfg.compression.algorithm}";
+        };
+      };
+
     system.build.image =
       let
         fileSystems = lib.filter
@@ -160,7 +232,7 @@ in
       in
       pkgs.callPackage ./repart-image.nix {
         systemd = cfg.package;
-        inherit (cfg) name split seed;
+        inherit (cfg) imageFileBasename compression split seed;
         inherit fileSystems definitionsDirectory partitions;
       };
 
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index 45dbf45b3ae70..c929c3b37285b 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -28,6 +28,8 @@ let
     DOCUMENTATION_URL = lib.optionalString (cfg.distroId == "nixos") "https://nixos.org/learn.html";
     SUPPORT_URL = lib.optionalString (cfg.distroId == "nixos") "https://nixos.org/community.html";
     BUG_REPORT_URL = lib.optionalString (cfg.distroId == "nixos") "https://github.com/NixOS/nixpkgs/issues";
+    IMAGE_ID = lib.optionalString (config.system.image.id != null) config.system.image.id;
+    IMAGE_VERSION = lib.optionalString (config.system.image.version != null) config.system.image.version;
   } // lib.optionalAttrs (cfg.variant_id != null) {
     VARIANT_ID = cfg.variant_id;
   };
@@ -110,6 +112,38 @@ in
       example = "installer";
     };
 
+    image = {
+
+      id = lib.mkOption {
+        type = types.nullOr (types.strMatching "^[a-z0-9._-]+$");
+        default = null;
+        description = lib.mdDoc ''
+          Image identifier.
+
+          This corresponds to the IMAGE_ID field in os-release. See the
+          upstream docs for more details on valid characters for this field:
+          https://www.freedesktop.org/software/systemd/man/latest/os-release.html#IMAGE_ID=
+
+          You would only want to set this option if you're build NixOS appliance images.
+        '';
+      };
+
+      version = lib.mkOption {
+        type = types.nullOr (types.strMatching "^[a-z0-9._-]+$");
+        default = null;
+        description = lib.mdDoc ''
+          Image version.
+
+          This corresponds to the IMAGE_VERSION field in os-release. See the
+          upstream docs for more details on valid characters for this field:
+          https://www.freedesktop.org/software/systemd/man/latest/os-release.html#IMAGE_VERSION=
+
+          You would only want to set this option if you're build NixOS appliance images.
+        '';
+      };
+
+    };
+
     stateVersion = mkOption {
       type = types.str;
       # TODO Remove this and drop the default of the option so people are forced to set it.
diff --git a/nixos/modules/services/audio/gmediarender.nix b/nixos/modules/services/audio/gmediarender.nix
index 545f2b1a2b60d..a4cb89098db7a 100644
--- a/nixos/modules/services/audio/gmediarender.nix
+++ b/nixos/modules/services/audio/gmediarender.nix
@@ -64,6 +64,7 @@ in
   config = mkIf cfg.enable {
     systemd = {
       services.gmediarender = {
+        wants = [ "network-online.target" ];
         after = [ "network-online.target" ];
         wantedBy = [ "multi-user.target" ];
         description = "gmediarender server daemon";
diff --git a/nixos/modules/services/audio/jmusicbot.nix b/nixos/modules/services/audio/jmusicbot.nix
index fd1d4da192843..e7803677d0fd9 100644
--- a/nixos/modules/services/audio/jmusicbot.nix
+++ b/nixos/modules/services/audio/jmusicbot.nix
@@ -26,6 +26,7 @@ in
   config = mkIf cfg.enable {
     systemd.services.jmusicbot = {
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       description = "Discord music bot that's easy to set up and run yourself!";
       serviceConfig = mkMerge [{
diff --git a/nixos/modules/services/audio/spotifyd.nix b/nixos/modules/services/audio/spotifyd.nix
index 975be5a87cba9..1194b6f200d70 100644
--- a/nixos/modules/services/audio/spotifyd.nix
+++ b/nixos/modules/services/audio/spotifyd.nix
@@ -50,6 +50,7 @@ in
 
     systemd.services.spotifyd = {
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" "sound.target" ];
       description = "spotifyd, a Spotify playing daemon";
       environment.SHELL = "/bin/sh";
diff --git a/nixos/modules/services/audio/ympd.nix b/nixos/modules/services/audio/ympd.nix
index b74cc3f9c0b41..6e8d22dab3c80 100644
--- a/nixos/modules/services/audio/ympd.nix
+++ b/nixos/modules/services/audio/ympd.nix
@@ -50,6 +50,7 @@ in {
       description = "Standalone MPD Web GUI written in C";
 
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
 
       serviceConfig = {
diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix
index 446d19b8fd5a0..c86cb81e5df47 100644
--- a/nixos/modules/services/continuous-integration/buildbot/master.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/master.nix
@@ -268,6 +268,7 @@ in {
     systemd.services.buildbot-master = {
       description = "Buildbot Continuous Integration Server.";
       after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       path = cfg.packages ++ cfg.pythonPackages python.pkgs;
       environment.PYTHONPATH = "${python.withPackages (self: cfg.pythonPackages self ++ [ package ])}/${python.sitePackages}";
diff --git a/nixos/modules/services/continuous-integration/gitea-actions-runner.nix b/nixos/modules/services/continuous-integration/gitea-actions-runner.nix
index 3f2be9464849f..06f0da3451a6c 100644
--- a/nixos/modules/services/continuous-integration/gitea-actions-runner.nix
+++ b/nixos/modules/services/continuous-integration/gitea-actions-runner.nix
@@ -188,6 +188,7 @@ in
         nameValuePair "gitea-runner-${escapeSystemdPath name}" {
           inherit (instance) enable;
           description = "Gitea Actions Runner";
+          wants = [ "network-online.target" ];
           after = [
             "network-online.target"
           ] ++ optionals (wantsDocker) [
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index 46b03bba37be7..54bbe69703f95 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -393,6 +393,7 @@ in
     systemd.services.hydra-evaluator =
       { wantedBy = [ "multi-user.target" ];
         requires = [ "hydra-init.service" ];
+        wants = [ "network-online.target" ];
         after = [ "hydra-init.service" "network.target" "network-online.target" ];
         path = with pkgs; [ hydra-package nettools jq ];
         restartTriggers = [ hydraConf ];
diff --git a/nixos/modules/services/databases/lldap.nix b/nixos/modules/services/databases/lldap.nix
index d1574c98fe67f..e821da8e58aa3 100644
--- a/nixos/modules/services/databases/lldap.nix
+++ b/nixos/modules/services/databases/lldap.nix
@@ -104,6 +104,7 @@ in
   config = lib.mkIf cfg.enable {
     systemd.services.lldap = {
       description = "Lightweight LDAP server (lldap)";
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
diff --git a/nixos/modules/services/databases/openldap.nix b/nixos/modules/services/databases/openldap.nix
index a7a0909f55e1b..df36e37976a44 100644
--- a/nixos/modules/services/databases/openldap.nix
+++ b/nixos/modules/services/databases/openldap.nix
@@ -294,6 +294,7 @@ in {
         "man:slapd-mdb"
       ];
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       serviceConfig = {
         User = cfg.user;
diff --git a/nixos/modules/services/desktops/geoclue2.nix b/nixos/modules/services/desktops/geoclue2.nix
index b04f46c26a568..2a68bb0b55f3a 100644
--- a/nixos/modules/services/desktops/geoclue2.nix
+++ b/nixos/modules/services/desktops/geoclue2.nix
@@ -200,6 +200,7 @@ in
     };
 
     systemd.services.geoclue = {
+      wants = lib.optionals cfg.enableWifi [ "network-online.target" ];
       after = lib.optionals cfg.enableWifi [ "network-online.target" ];
       # restart geoclue service when the configuration changes
       restartTriggers = [
@@ -217,6 +218,7 @@ in
         # we can't be part of a system service, and the agent should
         # be okay with the main service coming and going
         wantedBy = [ "default.target" ];
+        wants = lib.optionals cfg.enableWifi [ "network-online.target" ];
         after = lib.optionals cfg.enableWifi [ "network-online.target" ];
         unitConfig.ConditionUser = "!@system";
         serviceConfig = {
diff --git a/nixos/modules/services/home-automation/evcc.nix b/nixos/modules/services/home-automation/evcc.nix
index d0ce3fb4a1ce6..f360f525b04b9 100644
--- a/nixos/modules/services/home-automation/evcc.nix
+++ b/nixos/modules/services/home-automation/evcc.nix
@@ -41,6 +41,7 @@ in
 
   config = mkIf cfg.enable {
     systemd.services.evcc = {
+      wants = [ "network-online.target" ];
       after = [
         "network-online.target"
         "mosquitto.target"
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index bc470576b759b..a01628968966e 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -435,6 +435,7 @@ in {
 
     systemd.services.home-assistant = {
       description = "Home Assistant";
+      wants = [ "network-online.target" ];
       after = [
         "network-online.target"
 
diff --git a/nixos/modules/services/logging/journaldriver.nix b/nixos/modules/services/logging/journaldriver.nix
index 59eedff90d60e..4d21464018aac 100644
--- a/nixos/modules/services/logging/journaldriver.nix
+++ b/nixos/modules/services/logging/journaldriver.nix
@@ -84,6 +84,7 @@ in {
     systemd.services.journaldriver = {
       description = "Stackdriver Logging journal forwarder";
       script      = "${pkgs.journaldriver}/bin/journaldriver";
+      wants       = [ "network-online.target" ];
       after       = [ "network-online.target" ];
       wantedBy    = [ "multi-user.target" ];
 
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index c883c143e5234..3f1a695ab91ae 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -250,6 +250,7 @@ in
         path = [ config.services.postgresql.package ];
       })
       {
+        wants = [ "network-online.target" ];
         after = [ "network-online.target" ];
         wantedBy = [ "multi-user.target" ];
         script = let
diff --git a/nixos/modules/services/mail/sympa.nix b/nixos/modules/services/mail/sympa.nix
index 04ae46f66eeaf..13fc8656a2b5a 100644
--- a/nixos/modules/services/mail/sympa.nix
+++ b/nixos/modules/services/mail/sympa.nix
@@ -435,7 +435,7 @@ in
 
       wantedBy = [ "multi-user.target" ];
       after = [ "network-online.target" ];
-      wants = sympaSubServices;
+      wants = sympaSubServices ++ [ "network-online.target" ];
       before = sympaSubServices;
       serviceConfig = sympaServiceConfig "sympa_msg";
 
diff --git a/nixos/modules/services/matrix/synapse.nix b/nixos/modules/services/matrix/synapse.nix
index 50019d2a25cb5..4c1c396eac056 100644
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@@ -1056,6 +1056,7 @@ in {
 
     systemd.targets.matrix-synapse = lib.mkIf hasWorkers {
       description = "Synapse Matrix parent target";
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
       wantedBy = [ "multi-user.target" ];
     };
@@ -1071,6 +1072,7 @@ in {
             requires = optional hasLocalPostgresDB "postgresql.service";
           }
           else {
+            wants = [ "network-online.target" ];
             after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
             requires = optional hasLocalPostgresDB "postgresql.service";
             wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/misc/amazon-ssm-agent.nix b/nixos/modules/services/misc/amazon-ssm-agent.nix
index 20b836abe164f..89a1c07665106 100644
--- a/nixos/modules/services/misc/amazon-ssm-agent.nix
+++ b/nixos/modules/services/misc/amazon-ssm-agent.nix
@@ -41,6 +41,7 @@ in {
     # See https://github.com/aws/amazon-ssm-agent/blob/mainline/packaging/linux/amazon-ssm-agent.service
     systemd.services.amazon-ssm-agent = {
       inherit (cfg.package.meta) description;
+      wants    = [ "network-online.target" ];
       after    = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
diff --git a/nixos/modules/services/misc/bcg.nix b/nixos/modules/services/misc/bcg.nix
index 9da4a879cdd00..ad0b9c871342f 100644
--- a/nixos/modules/services/misc/bcg.nix
+++ b/nixos/modules/services/misc/bcg.nix
@@ -154,7 +154,7 @@ in
     in {
       description = "BigClown Gateway";
       wantedBy = [ "multi-user.target" ];
-      wants = mkIf config.services.mosquitto.enable [ "mosquitto.service" ];
+      wants = [ "network-online.target" ] ++ lib.optional config.services.mosquitto.enable "mosquitto.service";
       after = [ "network-online.target" ];
       preStart = ''
         umask 077
diff --git a/nixos/modules/services/misc/domoticz.nix b/nixos/modules/services/misc/domoticz.nix
index fd9fcf0b78eb5..315092f933514 100644
--- a/nixos/modules/services/misc/domoticz.nix
+++ b/nixos/modules/services/misc/domoticz.nix
@@ -35,6 +35,7 @@ in {
     systemd.services."domoticz" = {
       description = pkgDesc;
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       serviceConfig = {
         DynamicUser = true;
diff --git a/nixos/modules/services/misc/etesync-dav.nix b/nixos/modules/services/misc/etesync-dav.nix
index 9d99d548d95b0..ae2b5ad043433 100644
--- a/nixos/modules/services/misc/etesync-dav.nix
+++ b/nixos/modules/services/misc/etesync-dav.nix
@@ -59,6 +59,7 @@ in
 
       systemd.services.etesync-dav = {
         description = "etesync-dav - A CalDAV and CardDAV adapter for EteSync";
+        wants = [ "network-online.target" ];
         after = [ "network-online.target" ];
         wantedBy = [ "multi-user.target" ];
         path = [ pkgs.etesync-dav ];
diff --git a/nixos/modules/services/misc/mediatomb.nix b/nixos/modules/services/misc/mediatomb.nix
index d421d74c53ad7..03235e9a12655 100644
--- a/nixos/modules/services/misc/mediatomb.nix
+++ b/nixos/modules/services/misc/mediatomb.nix
@@ -357,6 +357,7 @@ in {
       description = "${cfg.serverName} media Server";
       # Gerbera might fail if the network interface is not available on startup
       # https://github.com/gerbera/gerbera/issues/1324
+      wants = [ "network-online.target" ];
       after = [ "network.target" "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig.ExecStart = "${binaryCommand} --port ${toString cfg.port} ${interfaceFlag} ${configFlag} --home ${cfg.dataDir}";
diff --git a/nixos/modules/services/misc/metabase.nix b/nixos/modules/services/misc/metabase.nix
index 883fa0b959116..5fc18e27eaae4 100644
--- a/nixos/modules/services/misc/metabase.nix
+++ b/nixos/modules/services/misc/metabase.nix
@@ -77,6 +77,7 @@ in {
     systemd.services.metabase = {
       description = "Metabase server";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       environment = {
         MB_PLUGINS_DIR = "${dataDir}/plugins";
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 3c6832958f59a..ca34a327dbdfa 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -297,6 +297,7 @@ in
       wantedBy = [ "paperless-scheduler.service" ];
       before = [ "paperless-scheduler.service" ];
       after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
       serviceConfig = defaultServiceConfig // {
         User = cfg.user;
         Type = "oneshot";
diff --git a/nixos/modules/services/monitoring/mackerel-agent.nix b/nixos/modules/services/monitoring/mackerel-agent.nix
index 62a7858500f24..5915634ed26fe 100644
--- a/nixos/modules/services/monitoring/mackerel-agent.nix
+++ b/nixos/modules/services/monitoring/mackerel-agent.nix
@@ -84,6 +84,7 @@ in {
     # upstream service file in https://git.io/JUt4Q
     systemd.services.mackerel-agent = {
       description = "mackerel.io agent";
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" "nss-lookup.target" ];
       wantedBy = [ "multi-user.target" ];
       environment = {
diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager.nix b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
index 4fd630015f35a..bb426d8b7beb0 100644
--- a/nixos/modules/services/monitoring/prometheus/alertmanager.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
@@ -174,6 +174,7 @@ in {
 
       systemd.services.alertmanager = {
         wantedBy = [ "multi-user.target" ];
+        wants    = [ "network-online.target" ];
         after    = [ "network-online.target" ];
         preStart = ''
            ${lib.getBin pkgs.envsubst}/bin/envsubst -o "/tmp/alert-manager-substituted.yaml" \
diff --git a/nixos/modules/services/monitoring/teamviewer.nix b/nixos/modules/services/monitoring/teamviewer.nix
index 9b1278317943d..7c45247aa6d5a 100644
--- a/nixos/modules/services/monitoring/teamviewer.nix
+++ b/nixos/modules/services/monitoring/teamviewer.nix
@@ -30,6 +30,7 @@ in
       description = "TeamViewer remote control daemon";
 
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" "network.target" "dbus.service" ];
       requires = [ "dbus.service" ];
       preStart = "mkdir -pv /var/lib/teamviewer /var/log/teamviewer";
diff --git a/nixos/modules/services/monitoring/telegraf.nix b/nixos/modules/services/monitoring/telegraf.nix
index ee28ee03adf33..3bab8aba7bd60 100644
--- a/nixos/modules/services/monitoring/telegraf.nix
+++ b/nixos/modules/services/monitoring/telegraf.nix
@@ -59,6 +59,7 @@ in {
     in {
       description = "Telegraf Agent";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       path = lib.optional (config.services.telegraf.extraConfig.inputs ? procstat) pkgs.procps;
       serviceConfig = {
diff --git a/nixos/modules/services/network-filesystems/openafs/client.nix b/nixos/modules/services/network-filesystems/openafs/client.nix
index bb0fee087e62e..02c3482ec657b 100644
--- a/nixos/modules/services/network-filesystems/openafs/client.nix
+++ b/nixos/modules/services/network-filesystems/openafs/client.nix
@@ -215,6 +215,7 @@ in
     systemd.services.afsd = {
       description = "AFS client";
       wantedBy = [ "multi-user.target" ];
+      wants = lib.optional (!cfg.startDisconnected) "network-online.target";
       after = singleton (if cfg.startDisconnected then  "network.target" else "network-online.target");
       serviceConfig = { RemainAfterExit = true; };
       restartIfChanged = false;
diff --git a/nixos/modules/services/network-filesystems/samba.nix b/nixos/modules/services/network-filesystems/samba.nix
index 5d02eac8e9f1a..ef368ddbeefd5 100644
--- a/nixos/modules/services/network-filesystems/samba.nix
+++ b/nixos/modules/services/network-filesystems/samba.nix
@@ -154,7 +154,7 @@ in
       };
 
       securityType = mkOption {
-        type = types.str;
+        type = types.enum [ "auto" "user" "domain" "ads" ];
         default = "user";
         description = lib.mdDoc "Samba security type";
       };
diff --git a/nixos/modules/services/networking/bitcoind.nix b/nixos/modules/services/networking/bitcoind.nix
index 4512e666ba5ba..59722e31c62ab 100644
--- a/nixos/modules/services/networking/bitcoind.nix
+++ b/nixos/modules/services/networking/bitcoind.nix
@@ -198,6 +198,7 @@ in
         '';
       in {
         description = "Bitcoin daemon";
+        wants = [ "network-online.target" ];
         after = [ "network-online.target" ];
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
diff --git a/nixos/modules/services/networking/dante.nix b/nixos/modules/services/networking/dante.nix
index 605f2d74f8275..f0d1d6305c54d 100644
--- a/nixos/modules/services/networking/dante.nix
+++ b/nixos/modules/services/networking/dante.nix
@@ -47,6 +47,7 @@ in
 
     systemd.services.dante = {
       description   = "Dante SOCKS v4 and v5 compatible proxy server";
+      wants         = [ "network-online.target" ];
       after         = [ "network-online.target" ];
       wantedBy      = [ "multi-user.target" ];
 
diff --git a/nixos/modules/services/networking/ergo.nix b/nixos/modules/services/networking/ergo.nix
index 033d4d9caf8a8..1bee0f43f988a 100644
--- a/nixos/modules/services/networking/ergo.nix
+++ b/nixos/modules/services/networking/ergo.nix
@@ -114,6 +114,7 @@ in {
     systemd.services.ergo = {
       description = "ergo server";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       serviceConfig = {
         User = cfg.user;
diff --git a/nixos/modules/services/networking/expressvpn.nix b/nixos/modules/services/networking/expressvpn.nix
index 30de6987d31fe..05c24d8bccffc 100644
--- a/nixos/modules/services/networking/expressvpn.nix
+++ b/nixos/modules/services/networking/expressvpn.nix
@@ -21,6 +21,7 @@ with lib;
         RestartSec = 5;
       };
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network.target" "network-online.target" ];
     };
   };
diff --git a/nixos/modules/services/networking/headscale.nix b/nixos/modules/services/networking/headscale.nix
index 4224a0578cc30..95b5fcf6ebde8 100644
--- a/nixos/modules/services/networking/headscale.nix
+++ b/nixos/modules/services/networking/headscale.nix
@@ -460,6 +460,7 @@ in {
 
     systemd.services.headscale = {
       description = "headscale coordination server for Tailscale";
+      wants = [ "network-online.target" ];
       after = ["network-online.target"];
       wantedBy = ["multi-user.target"];
       restartTriggers = [configFile];
diff --git a/nixos/modules/services/networking/ircd-hybrid/default.nix b/nixos/modules/services/networking/ircd-hybrid/default.nix
index 554b0f7bb8b44..64a34cc52d25a 100644
--- a/nixos/modules/services/networking/ircd-hybrid/default.nix
+++ b/nixos/modules/services/networking/ircd-hybrid/default.nix
@@ -125,7 +125,8 @@ in
 
     systemd.services.ircd-hybrid = {
       description = "IRCD Hybrid server";
-      after = [ "started networking" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       script = "${ircdService}/bin/control start";
     };
diff --git a/nixos/modules/services/networking/ivpn.nix b/nixos/modules/services/networking/ivpn.nix
index 6df630c1f1947..6c9ae599e670f 100644
--- a/nixos/modules/services/networking/ivpn.nix
+++ b/nixos/modules/services/networking/ivpn.nix
@@ -27,7 +27,7 @@ with lib;
     systemd.services.ivpn-service = {
       description = "iVPN daemon";
       wantedBy = [ "multi-user.target" ];
-      wants = [ "network.target" ];
+      wants = [ "network.target" "network-online.target" ];
       after = [
         "network-online.target"
         "NetworkManager.service"
diff --git a/nixos/modules/services/networking/kea.nix b/nixos/modules/services/networking/kea.nix
index 5ca705976c413..656ddd41fd12b 100644
--- a/nixos/modules/services/networking/kea.nix
+++ b/nixos/modules/services/networking/kea.nix
@@ -325,6 +325,9 @@ in
         "network-online.target"
         "time-sync.target"
       ];
+      wants = [
+        "network-online.target"
+      ];
       wantedBy = [
         "multi-user.target"
       ];
@@ -372,6 +375,9 @@ in
         "network-online.target"
         "time-sync.target"
       ];
+      wants = [
+        "network-online.target"
+      ];
       wantedBy = [
         "multi-user.target"
       ];
@@ -413,6 +419,7 @@ in
         "https://kea.readthedocs.io/en/kea-${package.version}/arm/ddns.html"
       ];
 
+      wants = [ "network-online.target" ];
       after = [
         "network-online.target"
         "time-sync.target"
diff --git a/nixos/modules/services/networking/mosquitto.nix b/nixos/modules/services/networking/mosquitto.nix
index f2b158b989427..ad9eefb422525 100644
--- a/nixos/modules/services/networking/mosquitto.nix
+++ b/nixos/modules/services/networking/mosquitto.nix
@@ -596,6 +596,7 @@ in
     systemd.services.mosquitto = {
       description = "Mosquitto MQTT Broker Daemon";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       serviceConfig = {
         Type = "notify";
diff --git a/nixos/modules/services/networking/mullvad-vpn.nix b/nixos/modules/services/networking/mullvad-vpn.nix
index 446c71f40764d..5da4ca1d1d803 100644
--- a/nixos/modules/services/networking/mullvad-vpn.nix
+++ b/nixos/modules/services/networking/mullvad-vpn.nix
@@ -53,7 +53,7 @@ with lib;
     systemd.services.mullvad-daemon = {
       description = "Mullvad VPN daemon";
       wantedBy = [ "multi-user.target" ];
-      wants = [ "network.target" ];
+      wants = [ "network.target" "network-online.target" ];
       after = [
         "network-online.target"
         "NetworkManager.service"
diff --git a/nixos/modules/services/networking/nbd.nix b/nixos/modules/services/networking/nbd.nix
index 454380aa3154c..b4bf7ede84632 100644
--- a/nixos/modules/services/networking/nbd.nix
+++ b/nixos/modules/services/networking/nbd.nix
@@ -117,6 +117,7 @@ in
     boot.kernelModules = [ "nbd" ];
 
     systemd.services.nbd-server = {
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       before = [ "multi-user.target" ];
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/networking/ocserv.nix b/nixos/modules/services/networking/ocserv.nix
index 9548fd92dbda3..3c61d56b893e9 100644
--- a/nixos/modules/services/networking/ocserv.nix
+++ b/nixos/modules/services/networking/ocserv.nix
@@ -85,6 +85,7 @@ in
     systemd.services.ocserv = {
       description = "OpenConnect SSL VPN server";
       documentation = [ "man:ocserv(8)" ];
+      wants = [ "network-online.target" ];
       after = [ "dbus.service" "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
diff --git a/nixos/modules/services/networking/pleroma.nix b/nixos/modules/services/networking/pleroma.nix
index db0a61b834699..8470f5e9cbc0c 100644
--- a/nixos/modules/services/networking/pleroma.nix
+++ b/nixos/modules/services/networking/pleroma.nix
@@ -92,6 +92,7 @@ in {
 
     systemd.services.pleroma = {
       description = "Pleroma social network";
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" "postgresql.service" ];
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ config.environment.etc."/pleroma/config.exs".source ];
diff --git a/nixos/modules/services/networking/rosenpass.nix b/nixos/modules/services/networking/rosenpass.nix
index d2a264b83d677..487cb6f601429 100644
--- a/nixos/modules/services/networking/rosenpass.nix
+++ b/nixos/modules/services/networking/rosenpass.nix
@@ -208,6 +208,7 @@ in
       in
       rec {
         wantedBy = [ "multi-user.target" ];
+        wants = [ "network-online.target" ];
         after = [ "network-online.target" ];
         path = [ cfg.package pkgs.wireguard-tools ];
 
diff --git a/nixos/modules/services/networking/rxe.nix b/nixos/modules/services/networking/rxe.nix
index 7dbb4823b4bcd..07437ed71195b 100644
--- a/nixos/modules/services/networking/rxe.nix
+++ b/nixos/modules/services/networking/rxe.nix
@@ -33,7 +33,7 @@ in {
 
       wantedBy = [ "multi-user.target" ];
       after = [ "systemd-modules-load.service" "network-online.target" ];
-      wants = [ "network-pre.target" ];
+      wants = [ "network-pre.target" "network-online.target" ];
 
       serviceConfig = {
         Type = "oneshot";
diff --git a/nixos/modules/services/networking/soju.nix b/nixos/modules/services/networking/soju.nix
index 7f0ac3e3b8e69..d69ec08ca13a0 100644
--- a/nixos/modules/services/networking/soju.nix
+++ b/nixos/modules/services/networking/soju.nix
@@ -110,6 +110,7 @@ in
     systemd.services.soju = {
       description = "soju IRC bouncer";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       serviceConfig = {
         DynamicUser = true;
diff --git a/nixos/modules/services/networking/strongswan-swanctl/module.nix b/nixos/modules/services/networking/strongswan-swanctl/module.nix
index c8832ed4defb6..a988509239558 100644
--- a/nixos/modules/services/networking/strongswan-swanctl/module.nix
+++ b/nixos/modules/services/networking/strongswan-swanctl/module.nix
@@ -55,6 +55,7 @@ in  {
     systemd.services.strongswan-swanctl = {
       description = "strongSwan IPsec IKEv1/IKEv2 daemon using swanctl";
       wantedBy = [ "multi-user.target" ];
+      wants    = [ "network-online.target" ];
       after    = [ "network-online.target" ];
       path     = with pkgs; [ kmod iproute2 iptables util-linux ];
       environment = {
diff --git a/nixos/modules/services/networking/strongswan.nix b/nixos/modules/services/networking/strongswan.nix
index e58526814d1ad..dcf04d2a1917c 100644
--- a/nixos/modules/services/networking/strongswan.nix
+++ b/nixos/modules/services/networking/strongswan.nix
@@ -153,6 +153,7 @@ in
       description = "strongSwan IPSec Service";
       wantedBy = [ "multi-user.target" ];
       path = with pkgs; [ kmod iproute2 iptables util-linux ]; # XXX Linux
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       environment = {
         STRONGSWAN_CONF = strongswanConf { inherit setup connections ca secretsFile managePlugins enabledPlugins; };
diff --git a/nixos/modules/services/networking/syncplay.nix b/nixos/modules/services/networking/syncplay.nix
index 0a66d93bf153a..151259b6d4ad2 100644
--- a/nixos/modules/services/networking/syncplay.nix
+++ b/nixos/modules/services/networking/syncplay.nix
@@ -107,6 +107,7 @@ in
     systemd.services.syncplay = {
       description = "Syncplay Service";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
 
       serviceConfig = {
diff --git a/nixos/modules/services/networking/wasabibackend.nix b/nixos/modules/services/networking/wasabibackend.nix
index 938145b35ee88..e3a48afd2a2c5 100644
--- a/nixos/modules/services/networking/wasabibackend.nix
+++ b/nixos/modules/services/networking/wasabibackend.nix
@@ -119,6 +119,7 @@ in {
     systemd.services.wasabibackend = {
       description = "wasabibackend server";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       environment = {
         DOTNET_PRINT_TELEMETRY_MESSAGE = "false";
diff --git a/nixos/modules/services/networking/znc/default.nix b/nixos/modules/services/networking/znc/default.nix
index d3ba4a524197d..e15233293cf25 100644
--- a/nixos/modules/services/networking/znc/default.nix
+++ b/nixos/modules/services/networking/znc/default.nix
@@ -243,6 +243,7 @@ in
     systemd.services.znc = {
       description = "ZNC Server";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       serviceConfig = {
         User = cfg.user;
diff --git a/nixos/modules/services/security/certmgr.nix b/nixos/modules/services/security/certmgr.nix
index db80e943973dc..02cb7afe87bad 100644
--- a/nixos/modules/services/security/certmgr.nix
+++ b/nixos/modules/services/security/certmgr.nix
@@ -182,6 +182,7 @@ in
     systemd.services.certmgr = {
       description = "certmgr";
       path = mkIf (cfg.svcManager == "command") [ pkgs.bash ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       inherit preStart;
diff --git a/nixos/modules/services/security/oauth2_proxy.nix b/nixos/modules/services/security/oauth2_proxy.nix
index 78916c907279a..d1dc37d549d2d 100644
--- a/nixos/modules/services/security/oauth2_proxy.nix
+++ b/nixos/modules/services/security/oauth2_proxy.nix
@@ -572,6 +572,7 @@ in
       description = "OAuth2 Proxy";
       path = [ cfg.package ];
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
 
       serviceConfig = {
diff --git a/nixos/modules/services/system/cachix-agent/default.nix b/nixos/modules/services/system/cachix-agent/default.nix
index 196d3291d5555..f8020fe970f1b 100644
--- a/nixos/modules/services/system/cachix-agent/default.nix
+++ b/nixos/modules/services/system/cachix-agent/default.nix
@@ -49,6 +49,7 @@ in {
   config = mkIf cfg.enable {
     systemd.services.cachix-agent = {
       description = "Cachix Deploy Agent";
+      wants = [ "network-online.target" ];
       after = ["network-online.target"];
       path = [ config.nix.package ];
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/system/cachix-watch-store.nix b/nixos/modules/services/system/cachix-watch-store.nix
index 8aa5f0358fa97..d48af29465aa5 100644
--- a/nixos/modules/services/system/cachix-watch-store.nix
+++ b/nixos/modules/services/system/cachix-watch-store.nix
@@ -61,6 +61,7 @@ in
   config = mkIf cfg.enable {
     systemd.services.cachix-watch-store-agent = {
       description = "Cachix watch store Agent";
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       path = [ config.nix.package ];
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/video/go2rtc/default.nix b/nixos/modules/services/video/go2rtc/default.nix
index 13851fa0306f6..9dddbb60baa80 100644
--- a/nixos/modules/services/video/go2rtc/default.nix
+++ b/nixos/modules/services/video/go2rtc/default.nix
@@ -94,6 +94,7 @@ in
 
   config = lib.mkIf cfg.enable {
     systemd.services.go2rtc = {
+      wants = [ "network-online.target" ];
       after = [
         "network-online.target"
       ];
diff --git a/nixos/modules/services/web-apps/akkoma.nix b/nixos/modules/services/web-apps/akkoma.nix
index 8980556ab0142..4cd9e26643787 100644
--- a/nixos/modules/services/web-apps/akkoma.nix
+++ b/nixos/modules/services/web-apps/akkoma.nix
@@ -974,7 +974,7 @@ in {
       # This service depends on network-online.target and is sequenced after
       # it because it requires access to the Internet to function properly.
       bindsTo = [ "akkoma-config.service" ];
-      wants = [ "network-online.service" ];
+      wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       after = [
         "akkoma-config.target"
diff --git a/nixos/modules/services/web-apps/alps.nix b/nixos/modules/services/web-apps/alps.nix
index 05fb676102df4..81c6b8ad30b5f 100644
--- a/nixos/modules/services/web-apps/alps.nix
+++ b/nixos/modules/services/web-apps/alps.nix
@@ -94,6 +94,7 @@ in {
       description = "alps is a simple and extensible webmail.";
       documentation = [ "https://git.sr.ht/~migadu/alps" ];
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network.target" "network-online.target" ];
 
       serviceConfig = {
diff --git a/nixos/modules/services/web-apps/c2fmzq-server.nix b/nixos/modules/services/web-apps/c2fmzq-server.nix
index 87938fe160e14..dee131182de16 100644
--- a/nixos/modules/services/web-apps/c2fmzq-server.nix
+++ b/nixos/modules/services/web-apps/c2fmzq-server.nix
@@ -80,6 +80,7 @@ in {
       description = "c2FmZQ-server";
       documentation = [ "https://github.com/c2FmZQ/c2FmZQ/blob/main/README.md" ];
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network.target" "network-online.target" ];
 
       serviceConfig = {
diff --git a/nixos/modules/services/web-apps/code-server.nix b/nixos/modules/services/web-apps/code-server.nix
index 11601f6c30449..d087deb7848d0 100644
--- a/nixos/modules/services/web-apps/code-server.nix
+++ b/nixos/modules/services/web-apps/code-server.nix
@@ -205,6 +205,7 @@ in {
     systemd.services.code-server = {
       description = "Code server";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       path = cfg.extraPackages;
       environment = {
diff --git a/nixos/modules/services/web-apps/healthchecks.nix b/nixos/modules/services/web-apps/healthchecks.nix
index e5e425a29d54c..1d439f162313b 100644
--- a/nixos/modules/services/web-apps/healthchecks.nix
+++ b/nixos/modules/services/web-apps/healthchecks.nix
@@ -176,6 +176,7 @@ in
     systemd.targets.healthchecks = {
       description = "Target for all Healthchecks services";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network.target" "network-online.target" ];
     };
 
diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index 88d40b3abc529..72ec578146a76 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -267,6 +267,7 @@ in {
     systemd.targets.netbox = {
       description = "Target for all NetBox services";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" "redis-netbox.service" ];
     };
 
diff --git a/nixos/modules/services/web-apps/openvscode-server.nix b/nixos/modules/services/web-apps/openvscode-server.nix
index 76a19dccae165..81b9d1f3b4c8c 100644
--- a/nixos/modules/services/web-apps/openvscode-server.nix
+++ b/nixos/modules/services/web-apps/openvscode-server.nix
@@ -159,6 +159,7 @@ in
     systemd.services.openvscode-server = {
       description = "OpenVSCode server";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       path = cfg.extraPackages;
       environment = cfg.extraEnvironment;
diff --git a/nixos/modules/services/web-apps/peering-manager.nix b/nixos/modules/services/web-apps/peering-manager.nix
index d6f6077268d46..0382ce7174738 100644
--- a/nixos/modules/services/web-apps/peering-manager.nix
+++ b/nixos/modules/services/web-apps/peering-manager.nix
@@ -196,6 +196,7 @@ in {
     systemd.targets.peering-manager = {
       description = "Target for all Peering Manager services";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" "redis-peering-manager.service" ];
     };
 
diff --git a/nixos/modules/services/web-apps/wordpress.nix b/nixos/modules/services/web-apps/wordpress.nix
index 002d6683b2ed5..2f7306309d694 100644
--- a/nixos/modules/services/web-apps/wordpress.nix
+++ b/nixos/modules/services/web-apps/wordpress.nix
@@ -174,22 +174,22 @@ let
             List of path(s) to respective language(s) which are copied from the 'languages' directory.
           '';
           example = literalExpression ''
-            [(
+            [
               # Let's package the German language.
               # For other languages try to replace language and country code in the download URL with your desired one.
               # Reference https://translate.wordpress.org for available translations and
               # codes.
-              language-de = pkgs.stdenv.mkDerivation {
+              (pkgs.stdenv.mkDerivation {
                 name = "language-de";
                 src = pkgs.fetchurl {
                   url = "https://de.wordpress.org/wordpress-''${pkgs.wordpress.version}-de_DE.tar.gz";
                   # Name is required to invalidate the hash when wordpress is updated
-                  name = "wordpress-''${pkgs.wordpress.version}-language-de"
+                  name = "wordpress-''${pkgs.wordpress.version}-language-de";
                   sha256 = "sha256-dlas0rXTSV4JAl8f/UyMbig57yURRYRhTMtJwF9g8h0=";
                 };
                 installPhase = "mkdir -p $out; cp -r ./wp-content/languages/* $out/";
-              };
-            )];
+              })
+            ];
           '';
         };
 
diff --git a/nixos/modules/services/web-servers/agate.nix b/nixos/modules/services/web-servers/agate.nix
index dce425035ff72..e03174c87945b 100644
--- a/nixos/modules/services/web-servers/agate.nix
+++ b/nixos/modules/services/web-servers/agate.nix
@@ -71,6 +71,7 @@ in
     systemd.services.agate = {
       description = "Agate";
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = [ "network.target" "network-online.target" ];
 
       script =
diff --git a/nixos/modules/services/web-servers/mighttpd2.nix b/nixos/modules/services/web-servers/mighttpd2.nix
index bdd6d8b62aa36..bb75dc4f2ff47 100644
--- a/nixos/modules/services/web-servers/mighttpd2.nix
+++ b/nixos/modules/services/web-servers/mighttpd2.nix
@@ -101,6 +101,7 @@ in {
       ];
     systemd.services.mighttpd2 = {
       description = "Mighttpd2 web server";
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
diff --git a/nixos/modules/services/web-servers/minio.nix b/nixos/modules/services/web-servers/minio.nix
index 6431db250476b..be6946657e23d 100644
--- a/nixos/modules/services/web-servers/minio.nix
+++ b/nixos/modules/services/web-servers/minio.nix
@@ -98,6 +98,7 @@ in
 
       services.minio = {
         description = "Minio Object Storage";
+        wants = [ "network-online.target" ];
         after = [ "network-online.target" ];
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
diff --git a/nixos/modules/services/web-servers/traefik.nix b/nixos/modules/services/web-servers/traefik.nix
index cc2c680b33424..fc9eb504ebf81 100644
--- a/nixos/modules/services/web-servers/traefik.nix
+++ b/nixos/modules/services/web-servers/traefik.nix
@@ -144,6 +144,7 @@ in {
 
     systemd.services.traefik = {
       description = "Traefik web server";
+      wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       startLimitIntervalSec = 86400;
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
index 9d55c21077d13..3b140726c2d6a 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@@ -81,7 +81,11 @@ in {
 
       type = types.bool;
 
-      description = lib.mdDoc "Whether to enable the systemd-boot (formerly gummiboot) EFI boot manager";
+      description = lib.mdDoc ''
+        Whether to enable the systemd-boot (formerly gummiboot) EFI boot manager.
+        For more information about systemd-boot:
+        https://www.freedesktop.org/wiki/Software/systemd/systemd-boot/
+      '';
     };
 
     editor = mkOption {
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 46c3f66f02dcf..331ca5103ba61 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -451,20 +451,37 @@ in
         cfg.services
     );
 
-    assertions = concatLists (
-      mapAttrsToList
-        (name: service:
-          map (message: {
-            assertion = false;
-            inherit message;
-          }) (concatLists [
-            (optional ((builtins.elem "network-interfaces.target" service.after) || (builtins.elem "network-interfaces.target" service.wants))
-              "Service '${name}.service' is using the deprecated target network-interfaces.target, which no longer exists. Using network.target is recommended instead."
-            )
-          ])
-        )
-        cfg.services
-    );
+    assertions = let
+      mkOneAssert = typeStr: name: def: {
+        assertion = lib.elem "network-online.target" def.after -> lib.elem "network-online.target" (def.wants ++ def.requires ++ def.bindsTo);
+        message = "${name}.${typeStr} is ordered after 'network-online.target' but doesn't depend on it";
+      };
+      mkAsserts = typeStr: lib.mapAttrsToList (mkOneAssert typeStr);
+      mkMountAsserts = typeStr: map (m: mkOneAssert typeStr m.what m);
+    in mkMerge [
+      (concatLists (
+        mapAttrsToList
+          (name: service:
+            map (message: {
+              assertion = false;
+              inherit message;
+            }) (concatLists [
+              (optional ((builtins.elem "network-interfaces.target" service.after) || (builtins.elem "network-interfaces.target" service.wants))
+                "Service '${name}.service' is using the deprecated target network-interfaces.target, which no longer exists. Using network.target is recommended instead."
+              )
+            ])
+          )
+          cfg.services
+      ))
+      (mkAsserts "target" cfg.targets)
+      (mkAsserts "service" cfg.services)
+      (mkAsserts "socket" cfg.sockets)
+      (mkAsserts "timer" cfg.timers)
+      (mkAsserts "path" cfg.paths)
+      (mkMountAsserts "mount" cfg.mounts)
+      (mkMountAsserts "automount" cfg.automounts)
+      (mkAsserts "slice" cfg.slices)
+    ];
 
     system.build.units = cfg.units;
 
@@ -641,7 +658,6 @@ in
     systemd.services.systemd-udev-settle.restartIfChanged = false; # Causes long delays in nixos-rebuild
     systemd.targets.local-fs.unitConfig.X-StopOnReconfiguration = true;
     systemd.targets.remote-fs.unitConfig.X-StopOnReconfiguration = true;
-    systemd.targets.network-online.wantedBy = [ "multi-user.target" ];
     systemd.services.systemd-importd.environment = proxy_env;
     systemd.services.systemd-pstore.wantedBy = [ "sysinit.target" ]; # see #81138
 
diff --git a/nixos/modules/virtualisation/amazon-image.nix b/nixos/modules/virtualisation/amazon-image.nix
index aa44f26426970..f0d9b95f81f6b 100644
--- a/nixos/modules/virtualisation/amazon-image.nix
+++ b/nixos/modules/virtualisation/amazon-image.nix
@@ -71,6 +71,7 @@ in
 
     systemd.services.fetch-ec2-metadata = {
       wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
       after = ["network-online.target"];
       path = [ pkgs.curl ];
       script = builtins.readFile ./ec2-metadata-fetcher.sh;
diff --git a/nixos/modules/virtualisation/oci-containers.nix b/nixos/modules/virtualisation/oci-containers.nix
index a4a40346f093b..07ed08ab2f84d 100644
--- a/nixos/modules/virtualisation/oci-containers.nix
+++ b/nixos/modules/virtualisation/oci-containers.nix
@@ -267,6 +267,7 @@ let
     };
   in {
     wantedBy = [] ++ optional (container.autoStart) "multi-user.target";
+    wants = lib.optional (container.imageFile == null)  "network-online.target";
     after = lib.optionals (cfg.backend == "docker") [ "docker.service" "docker.socket" ]
             # if imageFile is not set, the service needs the network to download the image from the registry
             ++ lib.optionals (container.imageFile == null) [ "network-online.target" ]
diff --git a/nixos/tests/3proxy.nix b/nixos/tests/3proxy.nix
index 83d39de018a39..b80b4e166d481 100644
--- a/nixos/tests/3proxy.nix
+++ b/nixos/tests/3proxy.nix
@@ -134,6 +134,7 @@
   testScript = ''
     start_all()
 
+    peer0.systemctl("start network-online.target")
     peer0.wait_for_unit("network-online.target")
 
     peer1.wait_for_unit("3proxy.service")
diff --git a/nixos/tests/acme.nix b/nixos/tests/acme.nix
index e5f2d4c7934a1..272782dc2f621 100644
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@@ -522,6 +522,7 @@ in {
           'curl --data \'{"host": "${caDomain}", "addresses": ["${nodes.acme.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'
       )
 
+      acme.systemctl("start network-online.target")
       acme.wait_for_unit("network-online.target")
       acme.wait_for_unit("pebble.service")
 
diff --git a/nixos/tests/adguardhome.nix b/nixos/tests/adguardhome.nix
index a6f790b83f5fc..80613ce825340 100644
--- a/nixos/tests/adguardhome.nix
+++ b/nixos/tests/adguardhome.nix
@@ -126,6 +126,7 @@
 
     with subtest("Testing successful DHCP start"):
         dhcpConf.wait_for_unit("adguardhome.service")
+        client.systemctl("start network-online.target")
         client.wait_for_unit("network-online.target")
         # Test IP assignment via DHCP
         dhcpConf.wait_until_succeeds("ping -c 5 10.0.10.100")
diff --git a/nixos/tests/appliance-repart-image.nix b/nixos/tests/appliance-repart-image.nix
index 3f256db846214..1c4495baba131 100644
--- a/nixos/tests/appliance-repart-image.nix
+++ b/nixos/tests/appliance-repart-image.nix
@@ -8,6 +8,9 @@
 let
   rootPartitionLabel = "root";
 
+  imageId = "nixos-appliance";
+  imageVersion = "1-rc1";
+
   bootLoaderConfigPath = "/loader/entries/nixos.conf";
   kernelPath = "/EFI/nixos/kernel.efi";
   initrdPath = "/EFI/nixos/initrd.efi";
@@ -29,6 +32,9 @@ in
     # TODO(raitobezarius): revisit this when #244907 lands
     boot.loader.grub.enable = false;
 
+    system.image.id = imageId;
+    system.image.version = imageVersion;
+
     virtualisation.fileSystems = lib.mkForce {
       "/" = {
         device = "/dev/disk/by-partlabel/${rootPartitionLabel}";
@@ -99,7 +105,7 @@ in
       "-f",
       "qcow2",
       "-b",
-      "${nodes.machine.system.build.image}/image.raw",
+      "${nodes.machine.system.build.image}/${nodes.machine.image.repart.imageFile}",
       "-F",
       "raw",
       tmp_disk_image.name,
@@ -108,6 +114,10 @@ in
     # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
     os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
 
+    os_release = machine.succeed("cat /etc/os-release")
+    assert 'IMAGE_ID="${imageId}"' in os_release
+    assert 'IMAGE_VERSION="${imageVersion}"' in os_release
+
     bootctl_status = machine.succeed("bootctl status")
     assert "${bootLoaderConfigPath}" in bootctl_status
     assert "${kernelPath}" in bootctl_status
diff --git a/nixos/tests/babeld.nix b/nixos/tests/babeld.nix
index d4df6f86d089d..e497aa5b64e15 100644
--- a/nixos/tests/babeld.nix
+++ b/nixos/tests/babeld.nix
@@ -120,10 +120,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
     ''
       start_all()
 
-      client.wait_for_unit("network-online.target")
-      local_router.wait_for_unit("network-online.target")
-      remote_router.wait_for_unit("network-online.target")
-
       local_router.wait_for_unit("babeld.service")
       remote_router.wait_for_unit("babeld.service")
 
diff --git a/nixos/tests/bittorrent.nix b/nixos/tests/bittorrent.nix
index 4a73fea6a09d0..473b05d4c98e8 100644
--- a/nixos/tests/bittorrent.nix
+++ b/nixos/tests/bittorrent.nix
@@ -115,6 +115,7 @@ in
       start_all()
 
       # Wait for network and miniupnpd.
+      router.systemctl("start network-online.target")
       router.wait_for_unit("network-online.target")
       router.wait_for_unit("miniupnpd")
 
@@ -129,6 +130,7 @@ in
       tracker.succeed("chmod 644 /tmp/test.torrent")
 
       # Start the tracker.  !!! use a less crappy tracker
+      tracker.systemctl("start network-online.target")
       tracker.wait_for_unit("network-online.target")
       tracker.wait_for_unit("opentracker.service")
       tracker.wait_for_open_port(6969)
@@ -140,6 +142,7 @@ in
 
       # Now we should be able to download from the client behind the NAT.
       tracker.wait_for_unit("httpd")
+      client1.systemctl("start network-online.target")
       client1.wait_for_unit("network-online.target")
       client1.succeed("transmission-remote --add http://${externalTrackerAddress}/test.torrent >&2 &")
       client1.wait_for_file("${download-dir}/test.tar.bz2")
@@ -152,6 +155,7 @@ in
 
       # Now download from the second client.  This can only succeed if
       # the first client created a NAT hole in the router.
+      client2.systemctl("start network-online.target")
       client2.wait_for_unit("network-online.target")
       client2.succeed(
           "transmission-remote --add http://${externalTrackerAddress}/test.torrent --no-portmap --no-dht >&2 &"
diff --git a/nixos/tests/buildbot.nix b/nixos/tests/buildbot.nix
index 2f6926313b7cd..149d73bba09c5 100644
--- a/nixos/tests/buildbot.nix
+++ b/nixos/tests/buildbot.nix
@@ -71,6 +71,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     gitrepo.wait_for_unit("multi-user.target")
 
     with subtest("Repo is accessible via git daemon"):
+        bbmaster.systemctl("start network-online.target")
         bbmaster.wait_for_unit("network-online.target")
         bbmaster.succeed("rm -rfv /tmp/fakerepo")
         bbmaster.succeed("git clone git://gitrepo/fakerepo /tmp/fakerepo")
@@ -78,6 +79,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     with subtest("Master service and worker successfully connect"):
         bbmaster.wait_for_unit("buildbot-master.service")
         bbmaster.wait_until_succeeds("curl --fail -s --head http://bbmaster:8010")
+        bbworker.systemctl("start network-online.target")
         bbworker.wait_for_unit("network-online.target")
         bbworker.succeed("nc -z bbmaster 8010")
         bbworker.succeed("nc -z bbmaster 9989")
diff --git a/nixos/tests/corerad.nix b/nixos/tests/corerad.nix
index b6f5d7fc6f75b..dd2bec794a1a0 100644
--- a/nixos/tests/corerad.nix
+++ b/nixos/tests/corerad.nix
@@ -56,6 +56,8 @@ import ./make-test-python.nix (
 
       with subtest("Wait for CoreRAD and network ready"):
           # Ensure networking is online and CoreRAD is ready.
+          router.systemctl("start network-online.target")
+          client.systemctl("start network-online.target")
           router.wait_for_unit("network-online.target")
           client.wait_for_unit("network-online.target")
           router.wait_for_unit("corerad.service")
diff --git a/nixos/tests/curl-impersonate.nix b/nixos/tests/curl-impersonate.nix
index 7954e9e5584c4..33b10da1dfd0f 100644
--- a/nixos/tests/curl-impersonate.nix
+++ b/nixos/tests/curl-impersonate.nix
@@ -144,6 +144,8 @@ in {
     start_all()
 
     with subtest("Wait for network"):
+        web.systemctl("start network-online.target")
+        curl.systemctl("start network-online.target")
         web.wait_for_unit("network-online.target")
         curl.wait_for_unit("network-online.target")
 
diff --git a/nixos/tests/ferm.nix b/nixos/tests/ferm.nix
index be43877445ebf..87c67ac623479 100644
--- a/nixos/tests/ferm.nix
+++ b/nixos/tests/ferm.nix
@@ -55,6 +55,8 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     ''
       start_all()
 
+      client.systemctl("start network-online.target")
+      server.systemctl("start network-online.target")
       client.wait_for_unit("network-online.target")
       server.wait_for_unit("network-online.target")
       server.wait_for_unit("ferm.service")
diff --git a/nixos/tests/gitdaemon.nix b/nixos/tests/gitdaemon.nix
index bb07b6e97b7fb..052fa902b4504 100644
--- a/nixos/tests/gitdaemon.nix
+++ b/nixos/tests/gitdaemon.nix
@@ -59,6 +59,9 @@ in {
     with subtest("git daemon starts"):
         server.wait_for_unit("git-daemon.service")
 
+
+    server.systemctl("start network-online.target")
+    client.systemctl("start network-online.target")
     server.wait_for_unit("network-online.target")
     client.wait_for_unit("network-online.target")
 
diff --git a/nixos/tests/guix/publish.nix b/nixos/tests/guix/publish.nix
index a15e00b0fa981..eb56fc97478cc 100644
--- a/nixos/tests/guix/publish.nix
+++ b/nixos/tests/guix/publish.nix
@@ -80,6 +80,7 @@ in {
 
     # Now it's the client turn to make use of it.
     substitute_server = "http://server.local:${toString publishPort}"
+    client.systemctl("start network-online.target")
     client.wait_for_unit("network-online.target")
     response = client.succeed(f"curl {substitute_server}")
     assert "Guix Substitute Server" in response
diff --git a/nixos/tests/hostname.nix b/nixos/tests/hostname.nix
index 6122e2ffeb83a..dffec956bc0b6 100644
--- a/nixos/tests/hostname.nix
+++ b/nixos/tests/hostname.nix
@@ -34,6 +34,7 @@ let
 
         machine = ${hostName}
 
+        machine.systemctl("start network-online.target")
         machine.wait_for_unit("network-online.target")
 
         # Test if NixOS computes the correct FQDN (either a FQDN or an error/null):
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 21d5e1470d8e0..7576fae41f83b 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -158,7 +158,9 @@ let
       start_all()
       ${optionalString clevisTest ''
       tang.wait_for_unit("sockets.target")
+      tang.systemctl("start network-online.target")
       tang.wait_for_unit("network-online.target")
+      machine.systemctl("start network-online.target")
       machine.wait_for_unit("network-online.target")
       ''}
       machine.wait_for_unit("multi-user.target")
@@ -187,6 +189,7 @@ let
 
       ${optionalString clevisTest ''
         with subtest("Create the Clevis secret with Tang"):
+             machine.systemctl("start network-online.target")
              machine.wait_for_unit("network-online.target")
              machine.succeed('echo -n password | clevis encrypt sss \'{"t": 2, "pins": {"tpm2": {}, "tang": {"url": "http://192.168.1.2"}}}\' -y > /mnt/etc/nixos/clevis-secret.jwe')''}
 
diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix
index 3f5bca397740e..fa24d4a8a5e13 100644
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@@ -67,6 +67,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
       ''
         start_all()
         server.wait_for_unit("kanidm.service")
+        client.systemctl("start network-online.target")
         client.wait_for_unit("network-online.target")
 
         with subtest("Test HTTP interface"):
diff --git a/nixos/tests/lemmy.nix b/nixos/tests/lemmy.nix
index de2c4938fe231..e8d747f89a9e7 100644
--- a/nixos/tests/lemmy.nix
+++ b/nixos/tests/lemmy.nix
@@ -59,6 +59,7 @@ in
         server.succeed("curl --fail localhost:${toString uiPort}")
 
     with subtest("Lemmy-UI responds through the caddy reverse proxy"):
+        server.systemctl("start network-online.target")
         server.wait_for_unit("network-online.target")
         server.wait_for_unit("caddy.service")
         server.wait_for_open_port(80)
@@ -66,6 +67,7 @@ in
         assert "Lemmy" in body, f"String Lemmy not found in response for ${lemmyNodeName}: \n{body}"
 
     with subtest("the server is exposed externally"):
+        client.systemctl("start network-online.target")
         client.wait_for_unit("network-online.target")
         client.succeed("curl -v --fail ${lemmyNodeName}")
 
diff --git a/nixos/tests/networking.nix b/nixos/tests/networking.nix
index 768d0cfa2238c..6bd89902eedb3 100644
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@@ -130,6 +130,7 @@ let
           start_all()
 
           client.wait_for_unit("network.target")
+          router.systemctl("start network-online.target")
           router.wait_for_unit("network-online.target")
 
           with subtest("Make sure DHCP server is not started"):
@@ -222,6 +223,7 @@ let
           start_all()
 
           client.wait_for_unit("network.target")
+          router.systemctl("start network-online.target")
           router.wait_for_unit("network-online.target")
 
           with subtest("Wait until we have an ip address on each interface"):
@@ -849,6 +851,7 @@ let
 
           client.wait_for_unit("network.target")
           client_with_privacy.wait_for_unit("network.target")
+          router.systemctl("start network-online.target")
           router.wait_for_unit("network-online.target")
 
           with subtest("Wait until we have an ip address"):
diff --git a/nixos/tests/nfs/kerberos.nix b/nixos/tests/nfs/kerberos.nix
index 1bace4058be59..5944b53319a0b 100644
--- a/nixos/tests/nfs/kerberos.nix
+++ b/nixos/tests/nfs/kerberos.nix
@@ -105,6 +105,7 @@ in
       server.wait_for_unit("rpc-gssd.service")
       server.wait_for_unit("rpc-svcgssd.service")
 
+      client.systemctl("start network-online.target")
       client.wait_for_unit("network-online.target")
 
       # add principals to client keytab
diff --git a/nixos/tests/opensmtpd-rspamd.nix b/nixos/tests/opensmtpd-rspamd.nix
index 19969a7b47ddd..e413a2050bd61 100644
--- a/nixos/tests/opensmtpd-rspamd.nix
+++ b/nixos/tests/opensmtpd-rspamd.nix
@@ -119,6 +119,7 @@ import ./make-test-python.nix {
   testScript = ''
     start_all()
 
+    client.systemctl("start network-online.target")
     client.wait_for_unit("network-online.target")
     smtp1.wait_for_unit("opensmtpd")
     smtp2.wait_for_unit("opensmtpd")
diff --git a/nixos/tests/opensmtpd.nix b/nixos/tests/opensmtpd.nix
index 17c1a569ba0d9..d32f82ed33b8c 100644
--- a/nixos/tests/opensmtpd.nix
+++ b/nixos/tests/opensmtpd.nix
@@ -104,6 +104,7 @@ import ./make-test-python.nix {
   testScript = ''
     start_all()
 
+    client.systemctl("start network-online.target")
     client.wait_for_unit("network-online.target")
     smtp1.wait_for_unit("opensmtpd")
     smtp2.wait_for_unit("opensmtpd")
diff --git a/nixos/tests/owncast.nix b/nixos/tests/owncast.nix
index debb34f5009dc..73aac4e704751 100644
--- a/nixos/tests/owncast.nix
+++ b/nixos/tests/owncast.nix
@@ -31,6 +31,8 @@ import ./make-test-python.nix ({ pkgs, ... }: {
   testScript = ''
     start_all()
 
+    client.systemctl("start network-online.target")
+    server.systemctl("start network-online.target")
     client.wait_for_unit("network-online.target")
     server.wait_for_unit("network-online.target")
     server.wait_for_unit("owncast.service")
diff --git a/nixos/tests/postgis.nix b/nixos/tests/postgis.nix
index 09c738b938ba8..dacf4e576c071 100644
--- a/nixos/tests/postgis.nix
+++ b/nixos/tests/postgis.nix
@@ -24,6 +24,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     master.wait_for_unit("postgresql")
     master.sleep(10)  # Hopefully this is long enough!!
     master.succeed("sudo -u postgres psql -c 'CREATE EXTENSION postgis;'")
+    master.succeed("sudo -u postgres psql -c 'CREATE EXTENSION postgis_raster;'")
     master.succeed("sudo -u postgres psql -c 'CREATE EXTENSION postgis_topology;'")
   '';
 })
diff --git a/nixos/tests/qemu-vm-restrictnetwork.nix b/nixos/tests/qemu-vm-restrictnetwork.nix
index 49a105ef10767..49aefcc099bda 100644
--- a/nixos/tests/qemu-vm-restrictnetwork.nix
+++ b/nixos/tests/qemu-vm-restrictnetwork.nix
@@ -21,6 +21,8 @@ import ./make-test-python.nix ({
 
     else:
       start_all()
+      unrestricted.systemctl("start network-online.target")
+      restricted.systemctl("start network-online.target")
       unrestricted.wait_for_unit("network-online.target")
       restricted.wait_for_unit("network-online.target")
 
diff --git a/nixos/tests/rss2email.nix b/nixos/tests/rss2email.nix
index f32326feb50fb..60b27b95fabe4 100644
--- a/nixos/tests/rss2email.nix
+++ b/nixos/tests/rss2email.nix
@@ -55,6 +55,7 @@ import ./make-test-python.nix {
   testScript = ''
     start_all()
 
+    server.systemctl("start network-online.target")
     server.wait_for_unit("network-online.target")
     server.wait_for_unit("opensmtpd")
     server.wait_for_unit("dovecot2")
diff --git a/nixos/tests/ssh-audit.nix b/nixos/tests/ssh-audit.nix
index bd6255b8044d9..25772aba3ea08 100644
--- a/nixos/tests/ssh-audit.nix
+++ b/nixos/tests/ssh-audit.nix
@@ -70,6 +70,7 @@ import ./make-test-python.nix (
       ${serverName}.succeed("${pkgs.ssh-audit}/bin/ssh-audit 127.0.0.1")
 
       # Wait for client to be able to connect to the server
+      ${clientName}.systemctl("start network-online.target")
       ${clientName}.wait_for_unit("network-online.target")
 
       # Set up trusted private key
diff --git a/nixos/tests/systemd-networkd-dhcpserver.nix b/nixos/tests/systemd-networkd-dhcpserver.nix
index cf0ccb7442118..665d8b5a05291 100644
--- a/nixos/tests/systemd-networkd-dhcpserver.nix
+++ b/nixos/tests/systemd-networkd-dhcpserver.nix
@@ -101,6 +101,9 @@ import ./make-test-python.nix ({pkgs, ...}: {
   };
   testScript = { ... }: ''
     start_all()
+
+    router.systemctl("start network-online.target")
+    client.systemctl("start network-online.target")
     router.wait_for_unit("systemd-networkd-wait-online.service")
     client.wait_for_unit("systemd-networkd-wait-online.service")
     client.wait_until_succeeds("ping -c 5 10.0.2.1")
diff --git a/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix b/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix
index 54f371e6c070f..1e55341657bdb 100644
--- a/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix
+++ b/nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix
@@ -263,9 +263,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
           };
         };
       };
-
-      # make the network-online target a requirement, we wait for it in our test script
-      systemd.targets.network-online.wantedBy = [ "multi-user.target" ];
     };
 
     # This is the client behind the router. We should be receiving router
@@ -278,9 +275,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
         useNetworkd = true;
         useDHCP = false;
       };
-
-      # make the network-online target a requirement, we wait for it in our test script
-      systemd.targets.network-online.wantedBy = [ "multi-user.target" ];
     };
   };
 
@@ -294,6 +288,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     # Since we only care about IPv6 that should not involve waiting for legacy
     # IP leases.
     client.start()
+    client.systemctl("start network-online.target")
     client.wait_for_unit("network-online.target")
 
     # the static address on the router should not be reachable
@@ -312,6 +307,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     isp.wait_for_unit("multi-user.target")
 
     # wait until the uplink interface has a good status
+    router.systemctl("start network-online.target")
     router.wait_for_unit("network-online.target")
     router.wait_until_succeeds("ping -6 -c1 2001:DB8::1")
 
diff --git a/nixos/tests/systemd-nspawn.nix b/nixos/tests/systemd-nspawn.nix
index 1a4251ef069e8..b86762233d183 100644
--- a/nixos/tests/systemd-nspawn.nix
+++ b/nixos/tests/systemd-nspawn.nix
@@ -38,6 +38,7 @@ in {
     start_all()
 
     server.wait_for_unit("nginx.service")
+    client.systemctl("start network-online.target")
     client.wait_for_unit("network-online.target")
     client.succeed("machinectl pull-raw --verify=signature http://server/testimage.raw")
     client.succeed(
diff --git a/nixos/tests/tayga.nix b/nixos/tests/tayga.nix
index 44974f6efea83..4aade67d74d0d 100644
--- a/nixos/tests/tayga.nix
+++ b/nixos/tests/tayga.nix
@@ -206,6 +206,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
   testScript = ''
     # start client and server
     for machine in client, server:
+      machine.systemctl("start network-online.target")
       machine.wait_for_unit("network-online.target")
       machine.log(machine.execute("ip addr")[1])
       machine.log(machine.execute("ip route")[1])
@@ -214,6 +215,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
     # test systemd-networkd and nixos-scripts based router
     for router in router_systemd, router_nixos:
       router.start()
+      router.systemctl("start network-online.target")
       router.wait_for_unit("network-online.target")
       router.wait_for_unit("tayga.service")
       router.log(machine.execute("ip addr")[1])
diff --git a/nixos/tests/trafficserver.nix b/nixos/tests/trafficserver.nix
index e4557c6c50e54..94d0e4dd926e9 100644
--- a/nixos/tests/trafficserver.nix
+++ b/nixos/tests/trafficserver.nix
@@ -104,6 +104,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     ats.wait_for_open_port(80)
     httpbin.wait_for_unit("httpbin")
     httpbin.wait_for_open_port(80)
+    client.systemctl("start network-online.target")
     client.wait_for_unit("network-online.target")
 
     with subtest("Traffic Server is running"):
diff --git a/nixos/tests/ulogd/ulogd.py b/nixos/tests/ulogd/ulogd.py
index d20daa4d733a2..76a8d0c6e24a3 100644
--- a/nixos/tests/ulogd/ulogd.py
+++ b/nixos/tests/ulogd/ulogd.py
@@ -1,5 +1,6 @@
 start_all()
 machine.wait_for_unit("ulogd.service")
+machine.systemctl("start network-online.target")
 machine.wait_for_unit("network-online.target")
 
 with subtest("Ulogd is running"):
diff --git a/nixos/tests/upnp.nix b/nixos/tests/upnp.nix
index 5e135267403bd..93bc08f752ce3 100644
--- a/nixos/tests/upnp.nix
+++ b/nixos/tests/upnp.nix
@@ -81,11 +81,13 @@ in
       start_all()
 
       # Wait for network and miniupnpd.
+      router.systemctl("start network-online.target")
       router.wait_for_unit("network-online.target")
       # $router.wait_for_unit("nat")
       router.wait_for_unit("${if useNftables then "nftables" else "firewall"}.service")
       router.wait_for_unit("miniupnpd")
 
+      client1.systemctl("start network-online.target")
       client1.wait_for_unit("network-online.target")
 
       client1.succeed("upnpc -a ${internalClient1Address} 9000 9000 TCP")
diff --git a/nixos/tests/uptermd.nix b/nixos/tests/uptermd.nix
index 429e3c9dd5ff3..469aa5047c27c 100644
--- a/nixos/tests/uptermd.nix
+++ b/nixos/tests/uptermd.nix
@@ -28,6 +28,7 @@ in
     start_all()
 
     server.wait_for_unit("uptermd.service")
+    server.systemctl("start network-online.target")
     server.wait_for_unit("network-online.target")
 
     # wait for upterm port to be reachable
diff --git a/nixos/tests/zrepl.nix b/nixos/tests/zrepl.nix
index b16c7eddc7aec..bdf11122c73f6 100644
--- a/nixos/tests/zrepl.nix
+++ b/nixos/tests/zrepl.nix
@@ -42,6 +42,7 @@ import ./make-test-python.nix (
       start_all()
 
       with subtest("Wait for zrepl and network ready"):
+          host.systemctl("start network-online.target")
           host.wait_for_unit("network-online.target")
           host.wait_for_unit("zrepl.service")
 
diff --git a/pkgs/applications/audio/hydrogen/default.nix b/pkgs/applications/audio/hydrogen/default.nix
index 0bea741e19d81..1460a78d9a9b7 100644
--- a/pkgs/applications/audio/hydrogen/default.nix
+++ b/pkgs/applications/audio/hydrogen/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hydrogen";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "hydrogen-music";
     repo = pname;
     rev = version;
-    sha256 = "sha256-A9mLiPh7ZMWJ11PcVP07IxZ8WdV2HkkKLix77egbC0M=";
+    sha256 = "sha256-7dgckFscyms+HW3xrsr3+lMua/H82U2jLkm/OKw3YWE=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
diff --git a/pkgs/applications/audio/picard/default.nix b/pkgs/applications/audio/picard/default.nix
index 065018448364f..d8671af6e8c4c 100644
--- a/pkgs/applications/audio/picard/default.nix
+++ b/pkgs/applications/audio/picard/default.nix
@@ -77,7 +77,7 @@ pythonPackages.buildPythonApplication rec {
     homepage = "https://picard.musicbrainz.org";
     changelog = "https://picard.musicbrainz.org/changelog";
     description = "The official MusicBrainz tagger";
-    maintainers = with maintainers; [ ehmry paveloom ];
+    maintainers = with maintainers; [ ehmry ];
     license = licenses.gpl2Plus;
     platforms = platforms.all;
   };
diff --git a/pkgs/applications/audio/quodlibet/default.nix b/pkgs/applications/audio/quodlibet/default.nix
index 67a597b623881..f7baad9c53a07 100644
--- a/pkgs/applications/audio/quodlibet/default.nix
+++ b/pkgs/applications/audio/quodlibet/default.nix
@@ -171,6 +171,6 @@ python3.pkgs.buildPythonApplication rec {
     '';
     homepage = "https://quodlibet.readthedocs.io/en/latest";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ coroa paveloom pbogdan ];
+    maintainers = with maintainers; [ coroa pbogdan ];
   };
 }
diff --git a/pkgs/applications/audio/spotify-cli-linux/default.nix b/pkgs/applications/audio/spotify-cli-linux/default.nix
index c3717cd49938a..82aa5c366ab68 100644
--- a/pkgs/applications/audio/spotify-cli-linux/default.nix
+++ b/pkgs/applications/audio/spotify-cli-linux/default.nix
@@ -1,11 +1,11 @@
 { lib, python3Packages, fetchPypi, dbus }:
 python3Packages.buildPythonApplication rec {
   pname = "spotify-cli-linux";
-  version = "1.6.0";
+  version = "1.8.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0slyc3jfrj3rwq8rv6p5aqkw487aw7a87kmf1fb6n4vnvcf08v7w";
+    sha256 = "sha256-XJMkiQR1FoeIPfAuJT22kfYJdc/ABuxExELh0EEev8k=";
   };
 
   preBuild = ''
diff --git a/pkgs/applications/editors/retext/default.nix b/pkgs/applications/editors/retext/default.nix
index feb42d9a99a93..db85170f5be16 100644
--- a/pkgs/applications/editors/retext/default.nix
+++ b/pkgs/applications/editors/retext/default.nix
@@ -15,14 +15,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "retext";
-  version = "8.0.0";
+  version = "8.0.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "retext-project";
     repo = pname;
-    rev = version;
-    hash = "sha256-22yqNwIehgTfeElqhN5Jzye7LbcAiseTeoMgenpmsL0=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-7zNEmFf0FZCzaNq9EMfGCje66/v5T/QvI5DTftLhi7g=";
   };
 
   toolbarIcons = fetchzip {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index dd94ae1086c58..16720b4de8463 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -591,8 +591,8 @@ let
         mktplcRef = {
           name = "vscode-intelephense-client";
           publisher = "bmewburn";
-          version = "1.10.1";
-          sha256 = "sha256-VZQ3dpwj4RWZuyMba8DM7+JcIBSYB8zimZOkP5mJbms=";
+          version = "1.10.2";
+          sha256 = "sha256-he/aPcsxfqYWI/RJ51d5V0reaTPTATci34xPm93qxGs=";
         };
         meta = {
           description = "PHP code intelligence for Visual Studio Code";
@@ -1101,6 +1101,12 @@ let
       };
 
       donjayamanne.githistory = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "githistory";
+          publisher = "donjayamanne";
+          version = "0.6.20";
+          sha256 = "sha256-nEdYS9/cMS4dcbFje23a47QBZr9eDK3dvtkFWqA+OHU=";
+        };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/donjayamanne.githistory/changelog";
           description = "View git log, file history, compare branches or commits";
@@ -1109,12 +1115,6 @@ let
           license = lib.licenses.mit;
           maintainers = [ ];
         };
-        mktplcRef = {
-          name = "githistory";
-          publisher = "donjayamanne";
-          version = "0.6.20";
-          sha256 = "sha256-nEdYS9/cMS4dcbFje23a47QBZr9eDK3dvtkFWqA+OHU=";
-        };
       };
 
       dotenv.dotenv-vscode = buildVscodeMarketplaceExtension {
@@ -1580,8 +1580,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "copilot";
-          version = "1.143.601";
-          sha256 = "sha256-Ge/q1fAfhI5EuJFLHZqZyuPahHSgES7G0ns9FbS9vzA=";
+          version = "1.151.659";
+          sha256 = "sha256-6jz7Nb9SGON7AXL4KJwC4H03la9JqLCX+AyBEvxD4HA=";
         };
 
         meta = {
@@ -1597,8 +1597,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "copilot-chat";
-          version = "0.11.2023111001";
-          sha256 = "sha256-sBDvqqyq0R0ZyS81G61fI9Vd860RIjhNzCqY0bdz1mg=";
+          version = "0.11.2023120102";
+          sha256 = "sha256-EUegM4sVP/vDikNr4LwnWzhDBSgfxYe6mxnrhSdXhIQ=";
         };
         meta = {
           description = "GitHub Copilot Chat is a companion extension to GitHub Copilot that houses experimental chat features";
@@ -1630,8 +1630,8 @@ let
         mktplcRef = {
           name = "vscode-github-actions";
           publisher = "github";
-          version = "0.25.6";
-          sha256 = "sha256-HRj/AQI9E6HDkZ2ok/h/+c9HHq1wVXQPAt5mb/Ij+BI=";
+          version = "0.26.2";
+          sha256 = "sha256-sEc6Fbn4XpK8vNK32R4fjnx/R+1xYOwcuhKlo7sPd5o=";
         };
         meta = {
           description = "A Visual Studio Code extension for GitHub Actions workflows and runs for github.com hosted repositories";
@@ -1651,8 +1651,8 @@ let
           # the VSCode Marketplace and use a calver scheme. We should avoid
           # using preview versions, because they can require insider versions
           # of VS Code
-          version = "0.75.2023101209";
-          sha256 = "1saz4brd5k1wyy7pz1h3jcl4kq35f78s2q8drjd7v2k97jhy8la1";
+          version = "0.78.1";
+          sha256 = "sha256-T9oW6o4ItZfR8E1qrcH3nhMvVB6ihi4kpiDz7YGHOcI=";
         };
         meta = { license = lib.licenses.mit; };
       };
@@ -2376,8 +2376,8 @@ let
         mktplcRef = {
           name = "direnv";
           publisher = "mkhl";
-          version = "0.15.2";
-          sha256 = "06lp4qgnksklgc6nvx1l9z38y7apbx0a6v886nd15aq9rq8my0ka";
+          version = "0.16.0";
+          sha256 = "sha256-u2AFjvhm3zio1ygW9yD9ZwbywLrEssd0O7/0AtfCvMo=";
         };
 
         meta = {
diff --git a/pkgs/applications/graphics/identity/default.nix b/pkgs/applications/graphics/identity/default.nix
index 55e13d7016fa1..a17ecf7a6fb20 100644
--- a/pkgs/applications/graphics/identity/default.nix
+++ b/pkgs/applications/graphics/identity/default.nix
@@ -72,6 +72,6 @@ stdenv.mkDerivation rec {
     homepage = "https://gitlab.gnome.org/YaLTeR/identity";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ paveloom ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/misc/ausweisapp/default.nix b/pkgs/applications/misc/ausweisapp/default.nix
index d6f863576a27a..25599f383819a 100644
--- a/pkgs/applications/misc/ausweisapp/default.nix
+++ b/pkgs/applications/misc/ausweisapp/default.nix
@@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ausweisapp";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "Governikus";
     repo = "AusweisApp2";
     rev = finalAttrs.version;
-    hash = "sha256-m+GZkaJyuqErsvkUXi+uAsrMXHyQg9Vd77ZkfGxMqg4=";
+    hash = "sha256-pnGtlNXwYNG+m3mmo815dqp2i098I/i7EKdLrDm/Su8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index be66116abaf79..91820ce964dd2 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -54,7 +54,7 @@ python3.pkgs.buildPythonApplication {
   '';
 
   nativeBuildInputs = lib.optionals enableQt [ wrapQtAppsHook ];
-  buildInputs = lib.optional stdenv.isLinux qtwayland;
+  buildInputs = lib.optional (stdenv.isLinux && enableQt) qtwayland;
 
   propagatedBuildInputs = with python3.pkgs; [
     aiohttp
@@ -137,5 +137,6 @@ python3.pkgs.buildPythonApplication {
     license = licenses.mit;
     platforms = platforms.all;
     maintainers = with maintainers; [ joachifm np prusnak ];
+    mainProgram = "electrum";
   };
 }
diff --git a/pkgs/applications/misc/remarkable/rmview/default.nix b/pkgs/applications/misc/remarkable/rmview/default.nix
index e3fd00d8cdc4d..24627025ca9ff 100644
--- a/pkgs/applications/misc/remarkable/rmview/default.nix
+++ b/pkgs/applications/misc/remarkable/rmview/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "rmview";
-  version = "3.1.2";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "bordaigorl";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-oCF37WQqNIXut2k+xr528twGxwPoH/sQ2leThagQJAU=";
+    sha256 = "sha256-V26zmu8cQkLs0IMR7eFO8x34McnT3xYyzlZfntApYkk=";
   };
 
   nativeBuildInputs = with python3Packages; [ pyqt5 wrapQtAppsHook ];
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 153e208d69589..f4ce22c6f7a8c 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -92,11 +92,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.61.114";
+  version = "1.61.120";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    hash = "sha256-AVL08Npg1nuvFJrd3rC2rCZeoLnPuQsgpvf2R623c6Y=";
+    hash = "sha256-pi33Zkp1CMaoQI9xgcsTo/VNxemHhjzLeQctq/qm5po=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
index ec5a4eb4f35e9..3ed94a3a621c8 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helm-diff";
-  version = "3.8.1";
+  version = "3.9.2";
 
   src = fetchFromGitHub {
     owner = "databus23";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-x3tTHiuw0CtvsOCB7oPd9EB+B5T1m6Hn7O1CriYahuA=";
+    sha256 = "sha256-4EjvjvW8aal/ekGV0ePevPf30NarrWIh6id30n1r2dE=";
   };
 
-  vendorHash = "sha256-2tiBFS3gvSbnyighSorg/ar058ZJmiQviaT13zOS8KA=";
+  vendorHash = "sha256-RPb5+tZkOsubOl0YlSXsybmlOtKVbJ97c+f/wiz/gmE=";
 
   ldflags = [ "-s" "-w" "-X github.com/databus23/helm-diff/v3/cmd.Version=${version}" ];
 
diff --git a/pkgs/applications/networking/cluster/tftui/default.nix b/pkgs/applications/networking/cluster/tftui/default.nix
new file mode 100644
index 0000000000000..3a9d657dbdd2b
--- /dev/null
+++ b/pkgs/applications/networking/cluster/tftui/default.nix
@@ -0,0 +1,54 @@
+{ lib
+, buildPythonApplication
+, fetchPypi
+, makeWrapper
+, poetry-core
+, posthog
+, pyperclip
+, requests
+, rich
+, textual
+, enableUsageTracking ? false
+}:
+
+buildPythonApplication rec {
+  pname = "tftui";
+  version = "0.12.4";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-E4Y0qA7SooMlHh+oSFUl1hfblpirr/Jdb1C2fqU43t0=";
+  };
+
+  propagatedBuildInputs = [
+    posthog
+    pyperclip
+    requests
+    rich
+    textual
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    poetry-core
+  ];
+
+  pythonImportsCheck = [
+    "tftui"
+  ];
+
+  postInstall = lib.optionalString (!enableUsageTracking) ''
+    wrapProgram $out/bin/tftui \
+      --add-flags "--disable-usage-tracking"
+  '';
+
+  meta = with lib; {
+    description = "Textual UI to view and interact with Terraform state";
+    homepage = "https://github.com/idoavrah/terraform-tui";
+    changelog = "https://github.com/idoavrah/terraform-tui/releases";
+    license = licenses.asl20;
+    maintainers = with maintainers; teams.bitnomial.members;
+    mainProgram = "tftui";
+  };
+}
diff --git a/pkgs/applications/networking/dnscontrol/default.nix b/pkgs/applications/networking/dnscontrol/default.nix
index e233d02a4c89d..cf227f6ce0f73 100644
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "4.7.3";
+  version = "4.8.1";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = "dnscontrol";
     rev = "v${version}";
-    hash = "sha256-xxcoh7x6OvziVNCaCLnjqTfJCn2JOR0n23lfNUbZ2cg=";
+    hash = "sha256-vH+BHTDQNFZTZjTvxV8ItGkTDj6G5q1t2YC/1LVYXUs=";
   };
 
-  vendorHash = "sha256-fRK2ZFoqugZ9lb6VxZZHBQjTa2ZQs5NFBx6Z6NX3eWw=";
+  vendorHash = "sha256-InLafJxxOVKGW0bhithJV7qYFjsgDEDGeTBwGvPVG4E=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/gnome-network-displays/default.nix b/pkgs/applications/networking/gnome-network-displays/default.nix
index e7bfde8a5192f..392f98c4fb6c3 100644
--- a/pkgs/applications/networking/gnome-network-displays/default.nix
+++ b/pkgs/applications/networking/gnome-network-displays/default.nix
@@ -29,16 +29,6 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-2SBVQK4fJeK8Y2UrrL0g5vQIerDdGE1nhFc6ke4oIpI=";
   };
 
-  patches = [
-    # Undeclared dependency on gio-unix-2.0, see:
-    # https://github.com/NixOS/nixpkgs/issues/36468 and
-    # https://gitlab.gnome.org/GNOME/gnome-network-displays/-/merge_requests/147
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-network-displays/-/commit/ef3f3ff565acd8238da46de604a1e750d4f02f07.diff";
-      sha256 = "1ljiwgqia6am4lansg70qnwkch9mp1fr6bga98s5fwyiaw6b6f4p";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
index 21d97e3c9a4ce..1ea1b673920db 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@@ -64,14 +64,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "4.14.4";
+  version = "4.14.8";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-kApiPJN9hdOv9WLRiqIO94Pd3Stuv+wrV4RM6x8Ak9M=";
+    hash = "sha256-ACpY8SsbuZRCF3arBtEIYjdQRy/2xkP1/g5caxmmSo4=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/p2p/qbittorrent/default.nix b/pkgs/applications/networking/p2p/qbittorrent/default.nix
index 37e27a884d5d2..dcf3c64f66fda 100644
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@@ -95,6 +95,6 @@ stdenv.mkDerivation rec {
     changelog = "https://github.com/qbittorrent/qBittorrent/blob/release-${version}/Changelog";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ Anton-Latukha kashw2 paveloom ];
+    maintainers = with maintainers; [ Anton-Latukha kashw2 ];
   };
 }
diff --git a/pkgs/applications/networking/remote/xrdp/default.nix b/pkgs/applications/networking/remote/xrdp/default.nix
index c90ec78c9aa4d..c9f679d9e1247 100644
--- a/pkgs/applications/networking/remote/xrdp/default.nix
+++ b/pkgs/applications/networking/remote/xrdp/default.nix
@@ -22,7 +22,7 @@
 }:
 
 let
-  version = "0.9.23.1";
+  version = "0.9.24";
   patchedXrdpSrc = applyPatches {
     patches = [ ./dynamic_config.patch ];
     name = "xrdp-patched-${version}";
@@ -31,7 +31,7 @@ let
       repo = "xrdp";
       rev = "v${version}";
       fetchSubmodules = true;
-      hash = "sha256-fJKSEHB5X5QydKgRPjIMJzNaAy1EVJifHETSGmlJttQ=";
+      hash = "sha256-Kvj72l+jmoad6VgmCYW2KtQAbJMJ8AZjNIYJ5lUNzRM=";
     };
   };
 
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index 53f4803c7c5b0..deae24ec6547b 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -189,7 +189,7 @@ stdenv.mkDerivation rec {
     changelog = "https://www.wireshark.org/docs/relnotes/wireshark-${version}.html";
     license = licenses.gpl2Plus;
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ bjornfor fpletz paveloom ];
+    maintainers = with maintainers; [ bjornfor fpletz ];
     mainProgram = if withQt then "wireshark" else "tshark";
   };
 }
diff --git a/pkgs/applications/radio/freedv/default.nix b/pkgs/applications/radio/freedv/default.nix
index 245e29fdb58a2..062245224747d 100644
--- a/pkgs/applications/radio/freedv/default.nix
+++ b/pkgs/applications/radio/freedv/default.nix
@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freedv";
-  version = "1.9.6";
+  version = "1.9.7.1";
 
   src = fetchFromGitHub {
     owner = "drowe67";
     repo = "freedv-gui";
     rev = "v${version}";
-    hash = "sha256-2TqlBlbMhBqe8WqoyYLJ9B82sAy3MdoaYvvk+XB5CdQ=";
+    hash = "sha256-cjqemWCjZr/1EOjUTsF4y03tvjQqquBLXxU0DG8OIFU=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/applications/version-management/gut/default.nix b/pkgs/applications/version-management/gut/default.nix
index 3d57ceb03a802..1254de70eb926 100644
--- a/pkgs/applications/version-management/gut/default.nix
+++ b/pkgs/applications/version-management/gut/default.nix
@@ -28,7 +28,7 @@ buildGoModule rec {
     description = "An alternative git CLI";
     homepage = "https://gut-cli.dev";
     license = licenses.mit;
-    maintainers = with maintainers; [ paveloom ];
+    maintainers = with maintainers; [ ];
     mainProgram = "gut";
   };
 }
diff --git a/pkgs/applications/version-management/subversion/default.nix b/pkgs/applications/version-management/subversion/default.nix
index ecb5093f4be17..0c83d080716cc 100644
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@@ -128,7 +128,7 @@ let
 
 in {
   subversion = common {
-    version = "1.14.2";
-    sha256 = "sha256-yRMOjQt1copm8OcDj8dwUuZxgw14W1YWqtU7SBDTzCg=";
+    version = "1.14.3";
+    sha256 = "sha256-lJ79RRoJQ19+hXNXTHHHtxsZTYRIkPpJzWHSJi6hpEA=";
   };
 }
diff --git a/pkgs/applications/video/mpv/scripts/occivink.nix b/pkgs/applications/video/mpv/scripts/occivink.nix
index f4ea27c1c1aae..1f17a27172872 100644
--- a/pkgs/applications/video/mpv/scripts/occivink.nix
+++ b/pkgs/applications/video/mpv/scripts/occivink.nix
@@ -13,12 +13,12 @@ let
   mkScript = name: args:
     let self = rec {
       pname = camelToKebab name;
-      version = "unstable-2023-12-18";
+      version = "unstable-2024-01-11";
       src = fetchFromGitHub {
         owner = "occivink";
         repo = "mpv-scripts";
-        rev = "f0426bd6b107b1f4b124552dae923b62f58ce3b6";
-        hash = "sha256-oag5lcDoezyNXs5EBr0r0UE3ikeftvbfxSzfbxV1Oy0=";
+        rev = "d0390c8e802c2e888ff4a2e1d5e4fb040f855b89";
+        hash = "sha256-pc2aaO7lZaoYMEXv5M0WI7PtmqgkNbdtNiLZZwVzppM=";
       };
       passthru.updateScript = unstableGitUpdater {};
 
diff --git a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
index eb801cda4feda..b776981522d0c 100644
--- a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
@@ -72,6 +72,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/WarmUpTill/SceneSwitcher";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ paveloom ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-teleport/default.nix b/pkgs/applications/video/obs-studio/plugins/obs-teleport/default.nix
index c7ee1d4f2598b..3c0c662b7618c 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-teleport/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-teleport/default.nix
@@ -47,7 +47,7 @@ buildGoModule rec {
   meta = {
     description = "An OBS Studio plugin for an open NDI-like replacement";
     homepage = "https://github.com/fzwoch/obs-teleport";
-    maintainers = [ lib.maintainers.paveloom ];
+    maintainers = [ ];
     license = lib.licenses.gpl2Plus;
     platforms = obs-studio.meta.platforms;
   };
diff --git a/pkgs/applications/video/subtitleedit/default.nix b/pkgs/applications/video/subtitleedit/default.nix
index 88018e5a5612a..e08ac36db3f04 100644
--- a/pkgs/applications/video/subtitleedit/default.nix
+++ b/pkgs/applications/video/subtitleedit/default.nix
@@ -92,6 +92,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     platforms = platforms.all;
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ paveloom ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/by-name/ae/aeacus/package.nix b/pkgs/by-name/ae/aeacus/package.nix
new file mode 100644
index 0000000000000..d172e7c501772
--- /dev/null
+++ b/pkgs/by-name/ae/aeacus/package.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "aeacus";
+  version = "2.1.1";
+
+  src = fetchFromGitHub {
+    owner = "elysium-suite";
+    repo = "aeacus";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LMsfogcz3CoShQDqyshMshb+iz2r0k5I7NDLXevMakI=";
+  };
+
+  vendorHash = "sha256-WOXOM08UYECdGx+e54n4BgLP3cr+st3qKi8iQXebPvk=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  # Tests require network access
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Vulnerability remediation scoring system";
+    homepage = "https://github.com/elysium-suite/aeacus";
+    changelog = "https://github.com/elysium-suite/aeacus/releases/tag/v${version}";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "aeacus";
+  };
+}
diff --git a/pkgs/by-name/ap/approxmc/package.nix b/pkgs/by-name/ap/approxmc/package.nix
new file mode 100644
index 0000000000000..f9222f66d500e
--- /dev/null
+++ b/pkgs/by-name/ap/approxmc/package.nix
@@ -0,0 +1,43 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+, zlib
+, gmp
+, cryptominisat
+, boost
+, arjun-cnf
+, louvain-community
+, lib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "approxmc";
+  version = "4.1.23";
+
+  src = fetchFromGitHub {
+    owner = "meelgroup";
+    repo = "approxmc";
+    rev = finalAttrs.version;
+    hash = "sha256-pE2m6Cc2u53H/5CM+2JuQxZOhjhHUZOi0kn23CJmALM=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    zlib
+    gmp
+    cryptominisat
+    boost
+    arjun-cnf
+    louvain-community
+  ];
+
+  meta = with lib; {
+    description = "Approximate Model Counter";
+    homepage = "https://github.com/meelgroup/approxmc";
+    license = licenses.mit;
+    maintainers = with maintainers; [ t4ccer ];
+    platforms = platforms.linux;
+    mainProgram = "approxmc";
+  };
+})
diff --git a/pkgs/by-name/ar/arjun-cnf/fix-red-clause.patch b/pkgs/by-name/ar/arjun-cnf/fix-red-clause.patch
new file mode 100644
index 0000000000000..a7f4d6755431f
--- /dev/null
+++ b/pkgs/by-name/ar/arjun-cnf/fix-red-clause.patch
@@ -0,0 +1,28 @@
+diff --git a/src/arjun.cpp b/src/arjun.cpp
+index d6ad786..119a267 100644
+--- a/src/arjun.cpp
++++ b/src/arjun.cpp
+@@ -98,6 +98,11 @@ DLL_PUBLIC bool Arjun::add_clause(const vector<CMSat::Lit>& lits)
+     return arjdata->common.solver->add_clause(lits);
+ }
+ 
++DLL_PUBLIC bool Arjun::add_red_clause(const vector<CMSat::Lit>& lits)
++{
++    return arjdata->common.solver->add_red_clause(lits);
++}
++
+ DLL_PUBLIC bool Arjun::add_xor_clause(const vector<uint32_t>& vars, bool rhs)
+ {
+     assert(false && "Funnily enough this does NOT work. The XORs would generate a BVA variable, and that would then not be returned as part of the simplified CNF. We could calculate a smaller independent set, but that's all.");
+diff --git a/src/arjun.h b/src/arjun.h
+index a39070c..907472a 100644
+--- a/src/arjun.h
++++ b/src/arjun.h
+@@ -61,6 +61,7 @@ namespace ArjunNS {
+         void new_var();
+         bool add_xor_clause(const std::vector<uint32_t>& vars, bool rhs);
+         bool add_clause(const std::vector<CMSat::Lit>& lits);
++        bool add_red_clause(const std::vector<CMSat::Lit>& lits);
+         bool add_bnn_clause(
+             const std::vector<CMSat::Lit>& lits,
+             signed cutoff,
diff --git a/pkgs/by-name/ar/arjun-cnf/package.nix b/pkgs/by-name/ar/arjun-cnf/package.nix
new file mode 100644
index 0000000000000..48e18272fda58
--- /dev/null
+++ b/pkgs/by-name/ar/arjun-cnf/package.nix
@@ -0,0 +1,48 @@
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, cryptominisat
+, boost
+, louvain-community
+, lib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "arjun-cnf";
+  version = "2.5.2";
+
+  src = fetchFromGitHub {
+    owner = "meelgroup";
+    repo = "arjun";
+    rev = finalAttrs.version;
+    hash = "sha256-5duc05s654HLjbf+dPgyMn6QUVvB0vLji3M4S2o/QYU=";
+  };
+
+  # Can be removed after next release
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/meelgroup/arjun/commit/34188760f1ab4b1b557c45ccaee8d2b9b6f0b901.patch";
+      hash = "sha256-E/yk2ohHP2BAFg353r8EU01bZCqeEjvpJCrBsxPiOWM=";
+    })
+    # Based on https://github.com/meelgroup/arjun/commit/99c4ed4ad820674632c5d9bbcc98c001f8cac98f
+    ./fix-red-clause.patch
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    boost
+    cryptominisat
+    louvain-community
+  ];
+
+  meta = with lib; {
+    description = "CNF minimizer and minimal independent set calculator";
+    homepage = "https://github.com/meelgroup/arjun";
+    license = licenses.mit;
+    maintainers = with maintainers; [ t4ccer ];
+    platforms = platforms.linux;
+    mainProgram = "arjun";
+  };
+})
diff --git a/pkgs/servers/audiobookshelf/default.nix b/pkgs/by-name/au/audiobookshelf/package.nix
index 52775068fba22..01d49a5fee690 100644
--- a/pkgs/servers/audiobookshelf/default.nix
+++ b/pkgs/by-name/au/audiobookshelf/package.nix
@@ -15,19 +15,19 @@
 let
   nodejs = nodejs_18;
 
+  source = builtins.fromJSON (builtins.readFile ./source.json);
   pname = "audiobookshelf";
-  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "advplyr";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-ROxVAevnxCyND/h1yyXfUeK9v5SEULL8gkR3flTmmW8=";
+    rev = "refs/tags/v${source.version}";
+    inherit (source) hash;
   };
 
   client = buildNpmPackage {
     pname = "${pname}-client";
-    inherit version;
+    inherit (source) version;
 
     src = runCommand "cp-source" {} ''
       cp -r ${src}/client $out
@@ -36,7 +36,7 @@ let
     NODE_OPTIONS = "--openssl-legacy-provider";
 
     npmBuildScript = "generate";
-    npmDepsHash = "sha256-2t/+IpmgTZglh3SSuYZNUvT1RZCDZGVT2gS57KU1mqA=";
+    npmDepsHash = source.clientDepsHash;
   };
 
   wrapper = import ./wrapper.nix {
@@ -44,14 +44,15 @@ let
   };
 
 in buildNpmPackage {
-  inherit pname version src;
+  inherit pname src;
+  inherit (source) version;
 
   buildInputs = [ util-linux ];
   nativeBuildInputs = [ python3 ];
 
   dontNpmBuild = true;
   npmInstallFlags = [ "--only-production" ];
-  npmDepsHash = "sha256-1VVFGc4RPE0FHQX1PeRnvU3cAq9eRYGfJ/0GzMy7Fh4=";
+  npmDepsHash = source.depsHash;
 
   installPhase = ''
     mkdir -p $out/opt/client
@@ -65,12 +66,14 @@ in buildNpmPackage {
     chmod +x $out/bin/${pname}
   '';
 
+  passthru.updateScript = ./update.nu;
+
   meta = with lib; {
     homepage = "https://www.audiobookshelf.org/";
     description = "Self-hosted audiobook and podcast server";
-    changelog = "https://github.com/advplyr/audiobookshelf/releases/tag/v${version}";
+    changelog = "https://github.com/advplyr/audiobookshelf/releases/tag/v${source.version}";
     license = licenses.gpl3;
-    maintainers = [ maintainers.jvanbruegge ];
+    maintainers = [ maintainers.jvanbruegge maintainers.adamcstephens ];
     platforms = platforms.linux;
     mainProgram = "audiobookshelf";
   };
diff --git a/pkgs/by-name/au/audiobookshelf/source.json b/pkgs/by-name/au/audiobookshelf/source.json
new file mode 100644
index 0000000000000..74a3875871706
--- /dev/null
+++ b/pkgs/by-name/au/audiobookshelf/source.json
@@ -0,0 +1,9 @@
+{
+  "owner": "advplyr",
+  "repo": "audiobookshelf",
+  "rev": "90f4833c9e0957f08799af15966d1909516b335e",
+  "hash": "sha256-m+CwUV3Bu9sHvRKCA1vFXYYRx48bxZ8N3BornO1tLQ0=",
+  "version": "2.7.2",
+  "depsHash": "sha256-1623oXtkOp43xQvHI3GbJpEQLvgr5WD5FpfNO+d0RR8=",
+  "clientDepsHash": "sha256-ugf9C/L5aBTO7gCy561kV06Ihb/mg/ZW916NKngIYXI="
+}
diff --git a/pkgs/by-name/au/audiobookshelf/update.nu b/pkgs/by-name/au/audiobookshelf/update.nu
new file mode 100755
index 0000000000000..25166c9cf1d11
--- /dev/null
+++ b/pkgs/by-name/au/audiobookshelf/update.nu
@@ -0,0 +1,30 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i nu -p nushell common-updater-scripts prefetch-npm-deps
+
+def main [] {
+  let sourceFile = $"(pwd)/pkgs/by-name/au/audiobookshelf/source.json"
+  let tags = list-git-tags --url=https://github.com/advplyr/audiobookshelf | lines | sort --natural | str replace v ''
+
+  let latest_tag = $tags | last
+  let current_version = open $sourceFile | get version
+
+  if $latest_tag != $current_version {
+    let source = nix-prefetch-github advplyr audiobookshelf --rev $"v($latest_tag)" | from json | merge { version: $latest_tag, depsHash: "", clientDepsHash: ""}
+    $source | save --force $sourceFile
+
+    let srcPath = nix-build $env.PWD -A audiobookshelf.src | complete | get stdout | lines | first
+
+    print $srcPath
+    ls $srcPath
+
+    $source | merge {
+      depsHash: (prefetch-npm-deps $"($srcPath)/package-lock.json"),
+      clientDepsHash: (prefetch-npm-deps $"($srcPath)/client/package-lock.json")
+    } | save --force $sourceFile
+
+    # appease the editorconfig CI check
+    echo "\n" | save --append $sourceFile
+  }
+
+  {before: $current_version, after: $latest_tag}
+}
diff --git a/pkgs/servers/audiobookshelf/wrapper.nix b/pkgs/by-name/au/audiobookshelf/wrapper.nix
index 787ee5ac49178..787ee5ac49178 100644
--- a/pkgs/servers/audiobookshelf/wrapper.nix
+++ b/pkgs/by-name/au/audiobookshelf/wrapper.nix
diff --git a/pkgs/by-name/fi/fira-math/package.nix b/pkgs/by-name/fi/fira-math/package.nix
new file mode 100644
index 0000000000000..56bcb916d2d40
--- /dev/null
+++ b/pkgs/by-name/fi/fira-math/package.nix
@@ -0,0 +1,49 @@
+{ lib, fetchFromGitHub, fira-math, python3, stdenvNoCC }:
+
+let
+  pname = "fira-math";
+  date = "2023-10-09";
+  version = "0.3.4-unstable-${date}";
+in stdenvNoCC.mkDerivation {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "firamath";
+    repo = "firamath";
+    rev = "4bd85bc943eb6a194cfc090f7e194aa27d8f8419";
+    hash = "sha256-1skakzdvzf7nX2un7b9aCSj1pzBAQuueZEU7B1nARa4=";
+  };
+
+  nativeBuildInputs = [
+    (python3.withPackages (ps: with ps; [
+      fontmake
+      fonttools
+      glyphslib
+      toml
+    ]))
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    python scripts/build.py
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D "build/"*.otf -t "$out/share/fonts/opentype/"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Math font with Unicode math support based on FiraSans and FiraGO";
+    homepage = "https://github.com/firamath/firamath";
+    license = licenses.ofl;
+    maintainers = [ maintainers.loicreynier ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/lo/louvain-community/package.nix b/pkgs/by-name/lo/louvain-community/package.nix
new file mode 100644
index 0000000000000..e9dfdf722efdd
--- /dev/null
+++ b/pkgs/by-name/lo/louvain-community/package.nix
@@ -0,0 +1,27 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+, lib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "louvain-community";
+  version = "unstable-2021-03-18";
+
+  src = fetchFromGitHub {
+    owner = "meelgroup";
+    repo = "louvain-community";
+    rev = "8cc5382d4844af127b1c1257373740d7e6b76f1e";
+    hash = "sha256-0i3wrDdOyleOPv5iVO1YzPfTPnIdljLabCvl3SYEQOs=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "Louvain Community Detection Library";
+    homepage = "https://github.com/meelgroup/louvain-community";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ t4ccer ];
+    platforms = platforms.unix;
+  };
+})
diff --git a/pkgs/servers/search/manticoresearch/default.nix b/pkgs/by-name/ma/manticoresearch/package.nix
index d7fe93a214b13..cf9cf4e596552 100644
--- a/pkgs/servers/search/manticoresearch/default.nix
+++ b/pkgs/by-name/ma/manticoresearch/package.nix
@@ -54,13 +54,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "manticoresearch";
-  version = "6.2.0";
+  version = "6.2.12";
 
   src = fetchFromGitHub {
     owner = "manticoresoftware";
     repo = "manticoresearch";
-    rev = finalAttrs.version;
-    hash = "sha256-KmBIQa5C71Y/1oa3XiPfmb941QDU2rWo7Bl5QlAo+yA=";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-UD/r7rlJ5mR3wg4doKT/nTwTWzlulngUjOPNEjmykB8=";
   };
 
   nativeBuildInputs = [
@@ -95,21 +95,33 @@ stdenv.mkDerivation (finalAttrs: {
     "-DWITH_MYSQL=1"
     "-DMYSQL_INCLUDE_DIR=${mariadb-connector-c.dev}/include/mariadb"
     "-DMYSQL_LIB=${mariadb-connector-c.out}/lib/mariadb/libmysqlclient.a"
+    "-DCONFDIR=${placeholder "out"}/etc"
+    "-DLOGDIR=/var/lib/manticoresearch/log"
+    "-DRUNDIR=/var/run/manticoresearch"
   ];
 
+  postFixup = ''
+    mkdir -p $out/lib/systemd/system
+    cp ${finalAttrs.src}/dist/deb/manticore.service.in $out/lib/systemd/system/manticore.service
+    substituteInPlace $out/lib/systemd/system/manticore.service \
+      --replace "@CMAKE_INSTALL_FULL_RUNSTATEDIR@" "/var/lib/manticore" \
+      --replace "@CMAKE_INSTALL_FULL_BINDIR@" "$out/bin" \
+      --replace "@CMAKE_INSTALL_FULL_SYSCONFDIR@" "$out/etc"
+  '';
+
   passthru.tests.version = testers.testVersion {
     inherit (finalAttrs) version;
     package = manticoresearch;
     command = "searchd --version";
   };
 
-  meta = {
+  meta = with lib; {
     description = "Easy to use open source fast database for search";
     homepage = "https://manticoresearch.com";
     changelog = "https://github.com/manticoresoftware/manticoresearch/releases/tag/${finalAttrs.version}";
-    license = lib.licenses.gpl2;
+    license = licenses.gpl2;
     mainProgram = "searchd";
-    maintainers = [ lib.maintainers.jdelStrother ];
-    platforms = lib.platforms.all;
+    maintainers = [ maintainers.jdelStrother ];
+    platforms = platforms.all;
   };
 })
diff --git a/pkgs/by-name/ml/mlx42/package.nix b/pkgs/by-name/ml/mlx42/package.nix
index ac3aaa2200eb9..3387dec3378d5 100644
--- a/pkgs/by-name/ml/mlx42/package.nix
+++ b/pkgs/by-name/ml/mlx42/package.nix
@@ -11,23 +11,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mlx42";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "codam-coding-college";
     repo = "MLX42";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JCBV8NWibSugqXkbgP0v3gDfaaMNFYztWpBRfHJUG8E=";
+    hash = "sha256-igkTeOnqGYBISzmtDGlDx9cGJjoQ8fzXtVSR9hU4F5E=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "add-cmake-install.patch";
-      url = "https://github.com/codam-coding-college/MLX42/commit/a51ca8e0ec3fb793fa96d710696dcee8a4fe57d6.patch";
-      hash = "sha256-i+0yHZVvfTG19BGVrz7GuEuBw3B7lylCPEvx07il23M=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs ./tools
   ''
@@ -46,10 +38,6 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     mkdir -p $out/lib/pkgconfig
     substituteAll ${./mlx42.pc} $out/lib/pkgconfig/mlx42.pc
-
-    # This file was removed after 2.3.2, so the used patch doesn't copy this file
-    # This line can be removed after the next release
-    cp $src/include/MLX42/MLX42_Input.h $out/include/MLX42
   '';
 
   meta = {
diff --git a/pkgs/by-name/mo/morewaita-icon-theme/package.nix b/pkgs/by-name/mo/morewaita-icon-theme/package.nix
index 0225fab88b45d..be19082d6d292 100644
--- a/pkgs/by-name/mo/morewaita-icon-theme/package.nix
+++ b/pkgs/by-name/mo/morewaita-icon-theme/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "morewaita-icon-theme";
-  version = "43.2";
+  version = "45";
 
   src = fetchFromGitHub {
     owner = "somepaulo";
     repo = "MoreWaita";
     rev = "v${version}";
-    hash = "sha256-efeZEysuWdE1+ws3njFlhWjAjavRlMuIuSL2VT25lUk=";
+    hash = "sha256-UtwigqJjkin53Wg3PU14Rde6V42eKhmP26a3fDpbJ4Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/passdetective/package.nix b/pkgs/by-name/pa/passdetective/package.nix
new file mode 100644
index 0000000000000..2e921beb8c7d6
--- /dev/null
+++ b/pkgs/by-name/pa/passdetective/package.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "passdetective";
+  version = "1.0.7";
+
+  src = fetchFromGitHub {
+    owner = "aydinnyunus";
+    repo = "PassDetective";
+    rev = version;
+    hash = "sha256-ln+nKESCYNQwTB6njNQBNUGmF+NXqgzmM1sb/d6ZBcU=";
+  };
+
+  vendorHash = "sha256-4FF0aQiuVN382RBCYI7SpoB8U8MZoXTomuFEvcbcREg=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-extldflags"
+    "-static"
+    "-X=main.build=${version}"
+  ];
+
+  meta = with lib; {
+    description = "Scans command history to detect mistakenly written passwords, API keys, and secrets";
+    homepage = "https://github.com/aydinnyunus/PassDetective";
+    changelog = "https://github.com/aydinnyunus/PassDetective/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ octodi ];
+    mainProgram = "PassDetective";
+  };
+}
diff --git a/pkgs/by-name/py/pyspread/package.nix b/pkgs/by-name/py/pyspread/package.nix
index 43aa9b304f036..6af2853a80388 100644
--- a/pkgs/by-name/py/pyspread/package.nix
+++ b/pkgs/by-name/py/pyspread/package.nix
@@ -9,10 +9,10 @@
 let
   # get rid of rec
   pname = "pyspread";
-  version = "2.2.2";
+  version = "2.2.3";
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vbBu/dMXQf14F7qWvyHX5T8/AkjeZhaQt1eQ6Nidpsc=";
+    hash = "sha256-oNMDDXpl6Y0N7j+qgboSTJA9SR5KzKxhoMh/44ngjdA=";
   };
   inherit (libsForQt5)
     qtsvg
diff --git a/pkgs/by-name/rm/rmg/package.nix b/pkgs/by-name/rm/rmg/package.nix
index 06e94306c04c9..09a774b1f4821 100644
--- a/pkgs/by-name/rm/rmg/package.nix
+++ b/pkgs/by-name/rm/rmg/package.nix
@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "rmg";
-  version = "0.5.4";
+  version = "0.5.5";
 
   src = fetchFromGitHub {
     owner = "Rosalie241";
     repo = "RMG";
     rev = "v${version}";
-    hash = "sha256-SAQJKfYoouJ2DLVks6oXiyiOI2/kgmyaHqt/FRfqKjI=";
+    hash = "sha256-au5GDyfW9+drkDNBWNbPY5Bgbow/hQmvP5pWJsYKbYs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sh/show-midi/package.nix b/pkgs/by-name/sh/show-midi/package.nix
new file mode 100644
index 0000000000000..e1a433fc8fb49
--- /dev/null
+++ b/pkgs/by-name/sh/show-midi/package.nix
@@ -0,0 +1,83 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, alsa-lib
+, freetype
+, libX11
+, libXrandr
+, libXinerama
+, libXext
+, libXcursor
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "show-midi";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "gbevin";
+    repo = "ShowMIDI";
+    rev = finalAttrs.version;
+    hash = "sha256-BtkfeHZyeSZH6wIojj3dd2nCS5R535dSWsis/hXJbPc=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    alsa-lib
+    freetype
+    libX11
+    libXrandr
+    libXinerama
+    libXext
+    libXcursor
+  ];
+
+  enableParallelBuilding = true;
+
+  makeFlags = [
+    "-C Builds/LinuxMakefile"
+    "CONFIG=Release"
+    # Specify targets by hand, because it tries to build VST by default,
+    # even though it's not supported in JUCE anymore
+    "LV2"
+    "LV2_MANIFEST_HELPER"
+    "Standalone"
+    "VST3"
+    "VST3_MANIFEST_HELPER"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out/share/ShowMIDI/themes Themes/*
+
+    mkdir -p $out/bin $out/lib/lv2 $out/lib/vst3
+    cd Builds/LinuxMakefile/build/
+    cp -r ShowMIDI.lv2 $out/lib/lv2
+    cp -r ShowMIDI.vst3 $out/lib/vst3
+    cp ShowMIDI $out/bin
+
+    runHook postInstall
+  '';
+
+  # JUCE dlopens these, make sure they are in rpath
+  # Otherwise, segfault will happen
+  env.NIX_LDFLAGS = toString [
+    "-lX11"
+    "-lXext"
+    "-lXcursor"
+    "-lXinerama"
+    "-lXrandr"
+  ];
+
+  meta = with lib; {
+    description = "Multi-platform GUI application to effortlessly visualize MIDI activity";
+    homepage = "https://github.com/gbevin/ShowMIDI";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ minijackson ];
+    mainProgram = "ShowMIDI";
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/te/terrapin-scanner/package.nix b/pkgs/by-name/te/terrapin-scanner/package.nix
index df8dd1158c1a9..2bf04dc676de7 100644
--- a/pkgs/by-name/te/terrapin-scanner/package.nix
+++ b/pkgs/by-name/te/terrapin-scanner/package.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "terrapin-scanner";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "RUB-NDS";
     repo = "Terrapin-Scanner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LBcoD/adIcda6ZxlEog8ArW0thr3g14fvEMFfgxiTsI=";
+    hash = "sha256-PmKfHvad+YAwLcdoiDSOBMQFgOKzJ6NbGbt4v570gyI=";
   };
 
   vendorHash = "sha256-x3fzs/TNGRo+u+RufXzzjDCeQayEZIKlgokdEQJRNaI=";
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index 8a3ebbb12bd14..2edb32b891fac 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -6,20 +6,27 @@
 , tigerbeetle
 , nix-update-script
 }:
+let
+  # Read [these comments](pkgs/development/compilers/zig/hook.nix#L12-L30) on the default Zig flags, and the associated links. tigerbeetle stopped exposing the `-Doptimize` build flag, so we can't use the default Nixpkgs zig hook as-is. tigerbeetle only exposes a boolean `-Drelease` flag which we'll add in the tigerbeetle derivation in this file.
+  custom_zig_hook = zig_0_11.hook.overrideAttrs (previousAttrs: {
+    zig_default_flags = builtins.filter (flag: builtins.match "-Doptimize.*" flag == null) previousAttrs.zig_default_flags;
+  });
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.14.171";
+  version = "0.14.175";
 
   src = fetchFromGitHub {
     owner = "tigerbeetle";
     repo = "tigerbeetle";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-MjsNQarRXsrWKJZ2aBi/Wc2HAYm3isLBNw81a75+nhc=";
+    hash = "sha256-MabY6kfK/SZ2ps8RZkI6cDhMdHasc1fk6+PKBfVMRm0=";
   };
 
-  nativeBuildInputs = [ zig_0_11.hook ];
+  nativeBuildInputs = [ custom_zig_hook ];
 
   zigBuildFlags = [
+    "-Drelease"
     "-Dgit-commit=0000000000000000000000000000000000000000"
     "-Dversion=${finalAttrs.version}"
   ];
@@ -37,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "A financial accounting database designed to be distributed and fast";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ danielsidhion ];
-    platforms = lib.platforms.unix;
+    platforms = lib.platforms.linux;
     mainProgram = "tigerbeetle";
   };
 })
diff --git a/pkgs/by-name/uc/uchecker/package.nix b/pkgs/by-name/uc/uchecker/package.nix
new file mode 100644
index 0000000000000..a4746a1e0dfda
--- /dev/null
+++ b/pkgs/by-name/uc/uchecker/package.nix
@@ -0,0 +1,49 @@
+{ lib
+, python3
+, fetchFromGitHub
+, fetchpatch
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "uchecker";
+  version = "0.1.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cloudlinux";
+    repo = "kcare-uchecker";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-SST143oi0O9PcJbw4nxHwHNY6HkIGi1WMBzveUYVhJs=";
+  };
+
+  patches = [
+    # Switch to poetry-core, https://github.com/cloudlinux/kcare-uchecker/pull/52
+    (fetchpatch {
+      name = "switch-poetry-core.patch";
+      url = "https://github.com/cloudlinux/kcare-uchecker/commit/d7d5ab75efa6a355b3dd3190c1edbaba8110c885.patch";
+      hash = "sha256-YPPw6M7MGN8nguAvAwjmz0VEYm0RD98ZkoVIq9SP3sA=";
+    })
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [
+    mock
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "uchecker"
+  ];
+
+  meta = with lib; {
+    description = "A simple tool to detect outdated shared libraries";
+    homepage = "https://github.com/cloudlinux/kcare-uchecker";
+    changelog = "https://github.com/cloudlinux/kcare-uchecker/releases/tag/v${version}";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "uchecker";
+  };
+}
diff --git a/pkgs/by-name/ux/uxn/package.nix b/pkgs/by-name/ux/uxn/package.nix
index e577ebf0b7000..4933591ba3f9d 100644
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uxn";
-  version = "unstable-2024-01-04";
+  version = "unstable-2024-01-15";
 
   src = fetchFromSourcehut {
     owner = "~rabbits";
     repo = "uxn";
-    rev = "7bf469dca2e8c620b53616483bacacea724fb685";
-    hash = "sha256-SISS8qdBYwNLhHhIzMlCkaXprQkfpFsR4y7/xrFQji8=";
+    rev = "8212ca5edb55a28976515a73fcb454f18eb44a09";
+    hash = "sha256-K/qTKSGt/sFHt0lfUbwa/Y2XlWst30q1aKvsm4sjrLc=";
   };
 
   outputs = [ "out" "projects" ];
diff --git a/pkgs/data/fonts/kode-mono/default.nix b/pkgs/data/fonts/kode-mono/default.nix
index 9792590c46d30..b92d4d54015c3 100644
--- a/pkgs/data/fonts/kode-mono/default.nix
+++ b/pkgs/data/fonts/kode-mono/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kode-mono";
-  version = "1.201";
+  version = "1.202";
 
   src = fetchzip {
     url = "https://github.com/isaozler/kode-mono/releases/download/${finalAttrs.version}/kode-mono-fonts.zip";
-    hash = "sha256-ssrs79Rg4izFCI2j6jHkFvBLcMgwIm3NAQzeX7QRMTE=";
+    hash = "sha256-wltprCA73BHAe+WrCWIsLqQ/H+vgVzclEL5voZPmbDU=";
     stripRoot = false;
   };
 
diff --git a/pkgs/data/misc/clash-geoip/default.nix b/pkgs/data/misc/clash-geoip/default.nix
index 7dcb0c63e8de8..cd41a9076bf0e 100644
--- a/pkgs/data/misc/clash-geoip/default.nix
+++ b/pkgs/data/misc/clash-geoip/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "clash-geoip";
-  version = "20231212";
+  version = "20240112";
 
   src = fetchurl {
     url = "https://github.com/Dreamacro/maxmind-geoip/releases/download/${version}/Country.mmdb";
-    sha256 = "sha256-h6EojfOWfDwD5Akvb8NrSvg3xyQZhOUrKhUxlWwio8A=";
+    sha256 = "sha256-RnRPGMHb+gciKxVV0DoK/E/7sI7Zb9yvtqHYtYDC15Q=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/data/themes/alacritty-theme/default.nix b/pkgs/data/themes/alacritty-theme/default.nix
index a60f42107ce43..d7e1ea641bb8e 100644
--- a/pkgs/data/themes/alacritty-theme/default.nix
+++ b/pkgs/data/themes/alacritty-theme/default.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (self: {
   name = "alacritty-theme";
-  version = "unstable-2023-12-28";
+  version = "unstable-2024-01-15";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = "alacritty-theme";
-    rev = "b7a59c92fd54a005893b99479fb0aa466a37a4b7";
-    hash = "sha256-UBWH4Q9MliqcolFq1tZrfRdzCkUO1pRn84qvZEVw8Gg=";
+    rev = "489cb8d014e5e2d6aea8bc8a5680a10b8b13b0c3";
+    hash = "sha256-47F9YwhIDEvPK01zMwwUcAJ3xAetXhWfRHf1cfpuna4=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/development/compilers/blueprint/default.nix b/pkgs/development/compilers/blueprint/default.nix
index f52b43f49a82a..856fcaa5d5abd 100644
--- a/pkgs/development/compilers/blueprint/default.nix
+++ b/pkgs/development/compilers/blueprint/default.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "A markup language for GTK user interface files";
     homepage = "https://gitlab.gnome.org/jwestman/blueprint-compiler";
     license = licenses.lgpl3Plus;
-    maintainers = with maintainers; [ benediktbroich paveloom ranfdev ];
+    maintainers = with maintainers; [ benediktbroich ranfdev ];
     platforms = platforms.unix;
   };
 })
diff --git a/pkgs/development/compilers/codon/default.nix b/pkgs/development/compilers/codon/default.nix
index 70cd16327299d..e9393956e4737 100644
--- a/pkgs/development/compilers/codon/default.nix
+++ b/pkgs/development/compilers/codon/default.nix
@@ -134,7 +134,7 @@ stdenv.mkDerivation {
   meta = {
     description = "A high-performance, zero-overhead, extensible Python compiler using LLVM";
     homepage = "https://docs.exaloop.io/codon";
-    maintainers = [ lib.maintainers.paveloom ];
+    maintainers = [ ];
     license = lib.licenses.bsl11;
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
index c18e7bcba0068..84bb1660f7b53 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
@@ -1,22 +1,22 @@
 # Generated by update.sh script
 {
-  "version" = "23.1.1";
+  "version" = "23.1.2";
   "hashes" = {
     "aarch64-linux" = {
-      sha256 = "1jv9icfh3w8gdch0h3l8mm6q96z3lv89s8zv788wvkkb87zv8w8m";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-23.1.1/graalpy-community-23.1.1-linux-aarch64.tar.gz";
+      sha256 = "0ypzhi22q2d1dfl3qf3yfsaqdsrj8sksc2spa79rdqdr690li4y9";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-23.1.2/graalpy-community-23.1.2-linux-aarch64.tar.gz";
     };
     "x86_64-linux" = {
-      sha256 = "108qdf0ss9l0x6k983v9yg6m5i7aqwfdxjqa5fx62xj027wi5pqk";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-23.1.1/graalpy-community-23.1.1-linux-amd64.tar.gz";
+      sha256 = "1n99hzf1sidacv4qr5j2b3dpwrc6qb71alwfkdxjqx6xv7g7nmr7";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-23.1.2/graalpy-community-23.1.2-linux-amd64.tar.gz";
     };
     "x86_64-darwin" = {
-      sha256 = "019s7vlr8a6x60g0yh36pdf2vvan1v2wmq8z4xrcgpl96zpwwn5h";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-23.1.1/graalpy-community-23.1.1-macos-amd64.tar.gz";
+      sha256 = "0g2xj5hiq8idacdm0jlg5lvvv98f38p6fjb839gfacsb25pmhkg7";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-23.1.2/graalpy-community-23.1.2-macos-amd64.tar.gz";
     };
     "aarch64-darwin" = {
-      sha256 = "0qbanbivkj62cjg2ll4ia23c435i1cvwy7pq19dvj8s204mpl8l2";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-23.1.1/graalpy-community-23.1.1-macos-aarch64.tar.gz";
+      sha256 = "0qinxqkkm9bfnzr43p3yhs3alfnl4pppca6yahsk5bp8ngyzasfj";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-23.1.2/graalpy-community-23.1.2-macos-aarch64.tar.gz";
     };
   };
 }
diff --git a/pkgs/development/coq-modules/coqeal/default.nix b/pkgs/development/coq-modules/coqeal/default.nix
index 89e3411bc332d..60926e712ad7c 100644
--- a/pkgs/development/coq-modules/coqeal/default.nix
+++ b/pkgs/development/coq-modules/coqeal/default.nix
@@ -8,6 +8,7 @@
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
+      { cases = [ (range "8.16" "8.19") (isGe "2.0.0") ]; out = "2.0.1"; }
       { cases = [ (range "8.16" "8.17") (isGe "2.0.0") ]; out = "2.0.0"; }
       { cases = [ (range "8.15" "8.18") (range "1.15.0" "1.18.0") ]; out = "1.1.3"; }
       { cases = [ (range "8.13" "8.17") (range "1.13.0" "1.18.0") ]; out = "1.1.1"; }
@@ -17,6 +18,7 @@
       { cases = [ (isGe "8.7") "1.10.0" ]; out = "1.0.3"; }
     ] null;
 
+  release."2.0.1".sha256 = "sha256-d/IQ4IdS2tpyPewcGobj2S6m2HU+iXQmlvR+ITNIcjI=";
   release."2.0.0".sha256 = "sha256-SG/KVnRJz2P+ZxkWVp1dDOnc/JVgigoexKfRUh1Y0GM";
   release."1.1.3".sha256 = "sha256-xhqWpg86xbU1GbDtXXInNCTArjjPnWZctWiiasq1ScU=";
   release."1.1.1".sha256 = "sha256-ExAdC3WuArNxS+Sa1r4x5aT7ylbCvP/BZXfkdQNAvZ8=";
diff --git a/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix b/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
index a665ea0db30ac..6cf92542dae39 100644
--- a/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
@@ -9,6 +9,7 @@ mkCoqDerivation {
 
   defaultVersion = with lib.versions;
      lib.switch [ coq.coq-version mathcomp-algebra.version ] [
+       { cases = [ (range "8.16" "8.19") (isGe "2.0") ]; out = "1.2.3"; }
        { cases = [ (range "8.16" "8.18") (isGe "2.0") ]; out = "1.2.2"; }
        { cases = [ (range "8.16" "8.18") (isGe "1.15") ]; out = "1.1.1"; }
        { cases = [ (range "8.13" "8.16") (isGe "1.12") ]; out = "1.0.0"; }
@@ -17,6 +18,7 @@ mkCoqDerivation {
   release."1.0.0".sha256 = "sha256-kszARPBizWbxSQ/Iqpf2vLbxYc6AjpUCLnSNlPcNfls=";
   release."1.1.1".sha256 = "sha256-5wItMeeTRoJlRBH3zBNc2VUZn6pkDde60YAvXTx+J3U=";
   release."1.2.2".sha256 = "sha256-EU9RJGV3BvnmsX+mGH+6+MDXiGHgDI7aP5sIYiMUXTs=";
+  release."1.2.3".sha256 = "sha256-6uc1VEfDv+fExEfBR2c0/Q/KjrkX0TbEMCLgeYcpkls=";
 
   propagatedBuildInputs = [ mathcomp-algebra coq-elpi mathcomp-zify ];
 
diff --git a/pkgs/development/coq-modules/mathcomp-finmap/default.nix b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
index 66b50ca66b83e..c2f6ea02133cf 100644
--- a/pkgs/development/coq-modules/mathcomp-finmap/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
@@ -7,7 +7,8 @@ mkCoqDerivation {
   owner = "math-comp";
   inherit version;
   defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
-      { cases = [ (range "8.16" "8.18")  (isGe "2.0") ];          out = "2.0.0"; }
+      { cases = [ (range "8.16" "8.19")  (isGe "2.0") ];          out = "2.1.0"; }
+      { cases = [ (range "8.16" "8.18")  (range "2.0" "2.1") ];   out = "2.0.0"; }
       { cases = [ (range "8.13" "8.19")  (range "1.12" "1.19") ]; out = "1.5.2"; }
       { cases = [ (isGe "8.10")          (range "1.11" "1.17") ]; out = "1.5.1"; }
       { cases = [ (range "8.7" "8.11")   "1.11.0" ];              out = "1.5.0"; }
@@ -18,6 +19,7 @@ mkCoqDerivation {
       { cases = [ (range "8.6" "8.7")    (range "1.6.1" "1.7") ]; out = "1.0.0"; }
     ] null;
   release = {
+    "2.1.0".sha256          = "sha256-gh0cnhdVDyo+D5zdtxLc10kGKQLQ3ITzHnMC45mCtpY=";
     "2.0.0".sha256          = "sha256-0Wr1ZUYVuZH74vawO4EZlZ+K3kq+s1xEz/BfzyKj+wk=";
     "1.5.2".sha256          = "sha256-0KmmSjc2AlUo6BKr9RZ4FjL9wlGISlTGU0X1Eu7l4sw=";
     "1.5.1".sha256          = "0ryfml4pf1dfya16d8ma80favasmrygvspvb923n06kfw9v986j7";
diff --git a/pkgs/development/coq-modules/multinomials/default.nix b/pkgs/development/coq-modules/multinomials/default.nix
index 38cc0139b8e0c..b7551ace4227c 100644
--- a/pkgs/development/coq-modules/multinomials/default.nix
+++ b/pkgs/development/coq-modules/multinomials/default.nix
@@ -9,7 +9,8 @@
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ] [
-      { cases = [ (range "8.16" "8.18") (isGe "2.1.0") ];       out = "2.1.0"; }
+      { cases = [ (range "8.17" "8.19") (isGe "2.1.0") ];       out = "2.2.0"; }
+      { cases = [ (range "8.16" "8.18") "2.1.0" ];              out = "2.1.0"; }
       { cases = [ (range "8.16" "8.18") "2.0.0" ];              out = "2.0.0"; }
       { cases = [ (isGe "8.15") (range "1.15.0" "1.18.0") ];    out = "1.6.0"; }
       { cases = [ (isGe "8.10") (range "1.13.0" "1.17.0") ];    out = "1.5.6"; }
@@ -21,6 +22,7 @@
       { cases = [ "8.6"                 (range "1.6" "1.7") ];  out = "1.1"; }
     ] null;
   release = {
+    "2.2.0".sha256 = "sha256-Cie6paweITwPZy6ej9+qIvHFWknVR382uJPW927t/fo=";
     "2.1.0".sha256 = "sha256-QT91SBJ6DXhyg4j/okTvPP6yj2DnnPbnSlJ/p8pvZbY=";
     "2.0.0".sha256 = "sha256-2zWHzMBsO2j8EjN7CgCmKQcku9Be8aVlme0LD5p4ab8=";
     "1.6.0".sha256 = "sha256-lEM+sjqajIOm1c3lspHqcSIARgMR9RHbTQH4veHLJfU=";
diff --git a/pkgs/development/interpreters/php/8.2.nix b/pkgs/development/interpreters/php/8.2.nix
index b934647d9b8c4..2d2a705c30e57 100644
--- a/pkgs/development/interpreters/php/8.2.nix
+++ b/pkgs/development/interpreters/php/8.2.nix
@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.2.14";
-    hash = "sha256-+HHhMTM9YK5sU3sa3dvCrqVMQ2xWKvmG+4MJwGAEC54=";
+    version = "8.2.15";
+    hash = "sha256-UMPiILeqY6hXFiM8kC60TMCkZn7QuDNXIq4jkbE1Xno=";
   });
 in
 base.withExtensions ({ all, ... }: with all; ([
diff --git a/pkgs/development/libraries/draco/default.nix b/pkgs/development/libraries/draco/default.nix
index ee2c5b8e5b726..c4ed0730cdacf 100644
--- a/pkgs/development/libraries/draco/default.nix
+++ b/pkgs/development/libraries/draco/default.nix
@@ -16,14 +16,14 @@ let
   cmakeBool = b: if b then "ON" else "OFF";
 in
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.5.6";
+  version = "1.5.7";
   pname = "draco";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "draco";
     rev = finalAttrs.version;
-    hash = "sha256-2YQMav0JJMbJ2bvnN/Xv90tjE/OWLbrZDO4WlaOvcfI=";
+    hash = "sha256-p0Mn4kGeBBKL7Hoz4IBgb6Go6MdkgE7WZgxAnt1tE/0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/functionalplus/default.nix b/pkgs/development/libraries/functionalplus/default.nix
index b456dd8873448..af25030ab560f 100644
--- a/pkgs/development/libraries/functionalplus/default.nix
+++ b/pkgs/development/libraries/functionalplus/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "functionalplus";
-  version = "0.2.20-p0";
+  version = "0.2.22";
 
   src = fetchFromGitHub {
     owner = "Dobiasd";
     repo = "FunctionalPlus";
     rev = "v${version}";
-    sha256 = "sha256-PKd3gx63VTxyq1q0v7WaKXVA0oICpZQfVsKsgUml9wk=";
+    sha256 = "sha256-y0IRmgG9lhWO4IR4G9/VP2a3B+ORTnF7MCf4FU5EuMk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/itk/generic.nix b/pkgs/development/libraries/itk/generic.nix
index e2db993707e21..652fce4a67978 100644
--- a/pkgs/development/libraries/itk/generic.nix
+++ b/pkgs/development/libraries/itk/generic.nix
@@ -1,6 +1,6 @@
 { version, rev, sourceSha256 }:
 
-{ lib, stdenv, fetchFromGitHub, cmake
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake
 , expat, fftw, gdcm, hdf5-cpp, libjpeg, libminc, libtiff, libpng
 , libX11, libuuid, xz, vtk, zlib, Cocoa }:
 
@@ -38,6 +38,14 @@ stdenv.mkDerivation {
     sha256 = sourceSha256;
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-gcc13-build";
+      url = "https://github.com/InsightSoftwareConsortium/ITK/commit/9a719a0d2f5f489eeb9351b0ef913c3693147a4f.patch";
+      hash = "sha256-dDyqYOzo91afR8W7k2N64X6l7t6Ws1C9iuRkWHUe0fg=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace CMake/ITKSetStandardCompilerFlags.cmake  \
       --replace "-march=corei7" ""  \
diff --git a/pkgs/development/libraries/libremidi/default.nix b/pkgs/development/libraries/libremidi/default.nix
index d88ebeea3fb5a..753bcef433fd9 100644
--- a/pkgs/development/libraries/libremidi/default.nix
+++ b/pkgs/development/libraries/libremidi/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "A modern C++ MIDI real-time & file I/O library";
     homepage = "https://github.com/jcelerier/libremidi";
-    maintainers = [ lib.maintainers.paveloom ];
+    maintainers = [ ];
     license = lib.licenses.bsd2;
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 1e01ed4a607a8..6127b83813c71 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -39,7 +39,9 @@ stdenv.mkDerivation rec {
     docbook-xsl-nons
     docbook_xml_dtd_43
     gettext
-  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+  ] ++ lib.optionals
+    (!stdenv.buildPlatform.canExecute stdenv.hostPlatform
+      && !stdenv.hostPlatform.isMinGW) [
     mesonEmulatorHook
   ];
 
diff --git a/pkgs/development/libraries/qtkeychain/default.nix b/pkgs/development/libraries/qtkeychain/default.nix
index 1f9ffb373082f..564eb31a71395 100644
--- a/pkgs/development/libraries/qtkeychain/default.nix
+++ b/pkgs/development/libraries/qtkeychain/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtkeychain";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "frankosterfeld";
     repo = "qtkeychain";
     rev = version;
-    sha256 = "sha256-LclYOuIYn+jYCvg69uHFlV3VcZ2KWdr8lFyCSBIB7Kw=";
+    sha256 = "sha256-aRBhg4RwK2jUQWW/OmzNSMUScaFUPdbWbApD37CXPoI=";
   };
 
   dontWrapQtApps = true;
diff --git a/pkgs/development/libraries/science/math/mongoose/default.nix b/pkgs/development/libraries/science/math/mongoose/default.nix
index 728dff9aa3e5f..df645809a4450 100644
--- a/pkgs/development/libraries/science/math/mongoose/default.nix
+++ b/pkgs/development/libraries/science/math/mongoose/default.nix
@@ -7,11 +7,11 @@
 }:
 
 let
-  suitesparseVersion = "7.4.0";
+  suitesparseVersion = "7.5.1";
 in
 stdenv.mkDerivation {
   pname = "mongoose";
-  version = "3.3.0";
+  version = "3.3.1";
 
   outputs = [ "bin" "out" "dev" ];
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
     owner = "DrTimothyAldenDavis";
     repo = "SuiteSparse";
     rev = "v${suitesparseVersion}";
-    hash = "sha256-oR/lISsa+0NGueJJyutswxOEQVl8MmSVgb/q3GMUCn4=";
+    hash = "sha256-6eC26rag9kZ1E4qJ5KY/dLXGld+EHP2OUpyikjXQhQk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/php-packages/castor/default.nix b/pkgs/development/php-packages/castor/default.nix
index 25ce4df5403f0..70d07c1b8c700 100644
--- a/pkgs/development/php-packages/castor/default.nix
+++ b/pkgs/development/php-packages/castor/default.nix
@@ -8,16 +8,16 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "castor";
-  version = "0.10.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "jolicode";
     repo = "castor";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/pUo3Lure5N6vsh8o8cQDqlWj8vgOC0ctenO/93K3zQ=";
+    hash = "sha256-FqFCKvhOEtDERNRLB3613geEiNDOlQuLeCa5uVvoMdM=";
   };
 
-  vendorHash = "sha256-l/paOQmJs8/7YN/XsY6wklojLE3z3GIV3jrgZvyQp/8=";
+  vendorHash = "sha256-+ORwa3+tkVJ9KU+9URg+1lyHoL1swxg6DG5ex8HjigE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/php-packages/spx/default.nix b/pkgs/development/php-packages/spx/default.nix
index 020927ccf4910..b6f7598ffe5ad 100644
--- a/pkgs/development/php-packages/spx/default.nix
+++ b/pkgs/development/php-packages/spx/default.nix
@@ -1,7 +1,7 @@
 { buildPecl, lib, fetchFromGitHub, zlib }:
 
 let
-  version = "0.4.14";
+  version = "0.4.15";
 in buildPecl {
   inherit version;
   pname = "spx";
@@ -10,7 +10,7 @@ in buildPecl {
     owner = "NoiseByNorthwest";
     repo = "php-spx";
     rev = "v${version}";
-    hash = "sha256-LdR3ilknSUuNTAb9wfIpNGdaR3uwd4C47nZYRzfTfx8=";
+    hash = "sha256-gw6wbPt1Qy0vNfT0flq7bxpnGU3SgJvPVhk8H0Imvx4=";
   };
 
   configureFlags = [
diff --git a/pkgs/development/python-modules/aioswitcher/default.nix b/pkgs/development/python-modules/aioswitcher/default.nix
index 7cb513897cb1f..245f9f44a3aeb 100644
--- a/pkgs/development/python-modules/aioswitcher/default.nix
+++ b/pkgs/development/python-modules/aioswitcher/default.nix
@@ -14,8 +14,8 @@
 
 buildPythonPackage rec {
   pname = "aioswitcher";
-  version = "3.4.1";
-  format = "pyproject";
+  version = "3.4.2";
+  pyproject = true;
 
   disabled = pythonOlder "3.9";
 
@@ -23,9 +23,11 @@ buildPythonPackage rec {
     owner = "TomerFi";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-jam0pyVajk8z7s/Uk5yQZfbFQLDiJ2yRKDk7VMJpCKo=";
+    hash = "sha256-UpwIzwOl1yKqK8KxFDXAWoZFkQ+1r1sUcDfx6AxRdNw=";
   };
 
+  __darwinAllowLocalNetworking = true;
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -50,7 +52,6 @@ buildPythonPackage rec {
     "test_schedule_parser_with_a_daily_recurring_enabled_schedule_data"
     "test_schedule_parser_with_a_partial_daily_recurring_enabled_schedule_data"
     "test_schedule_parser_with_a_non_recurring_enabled_schedule_data"
-    "test_hexadecimale_timestamp_to_localtime_with_the_current_timestamp_should_return_a_time_string"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/anywidget/default.nix b/pkgs/development/python-modules/anywidget/default.nix
index 16bf2daaa4a47..ffa3666555c5f 100644
--- a/pkgs/development/python-modules/anywidget/default.nix
+++ b/pkgs/development/python-modules/anywidget/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "anywidget";
-  version = "0.8.0";
+  version = "0.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hHoP7OWOp6MtINzNVKAm3T3Sj3baprTwp0wlPlx8/uw=";
+    hash = "sha256-p2J3cL5FX4mv19WPr/km9F71K1MleuPFlRd9X/mxL9E=";
   };
 
   # We do not need the jupyterlab build dependency, because we do not need to
diff --git a/pkgs/development/python-modules/birch/default.nix b/pkgs/development/python-modules/birch/default.nix
index 3afd6d3df06a9..1dd4848427e52 100644
--- a/pkgs/development/python-modules/birch/default.nix
+++ b/pkgs/development/python-modules/birch/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , setuptools
 , strct
 , pytestCheckHook
@@ -19,11 +20,24 @@ buildPythonPackage rec {
     hash = "sha256-KdQZzQJvJ+logpcLQfaqqEEZJ/9VmNTQX/a4v0oBC98=";
   };
 
+  patches = [
+    # https://github.com/shaypal5/birch/pull/4
+    (fetchpatch {
+      name = "fix-versioneer-on-python312.patch";
+      url = "https://github.com/shaypal5/birch/commit/84d597b2251ebb76fb15fb70fc86c83baa19dc0b.patch";
+      hash = "sha256-xXADCSIhq1ARny2twzrhR1J8LkMFWFl6tmGxrM8RvkU=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pytest.ini \
       --replace  \
         "--cov" \
         "#--cov"
+
+    # configure correct version, which fails due to missing .git
+    substituteInPlace versioneer.py birch/_version.py \
+      --replace '"0+unknown"' '"${version}"'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bthome-ble/default.nix b/pkgs/development/python-modules/bthome-ble/default.nix
index 746c918120ec7..faa8582b6b22e 100644
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "bthome-ble";
-  version = "3.4.1";
+  version = "3.5.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = "bthome-ble";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1Srimb+MfWiX5NdmDQHJsmn6LatWd8nmXaB4uXdHKWY=";
+    hash = "sha256-7/09RasnW4cTUbwf3N+9DxsGG9pCaqAODX2UNWvlxZg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/darkdetect/default.nix b/pkgs/development/python-modules/darkdetect/default.nix
index 534d9a0573ce8..28e3c141a1eee 100644
--- a/pkgs/development/python-modules/darkdetect/default.nix
+++ b/pkgs/development/python-modules/darkdetect/default.nix
@@ -39,6 +39,6 @@ buildPythonPackage rec {
     description = "Detect OS Dark Mode from Python";
     homepage = "https://github.com/albertosottile/darkdetect";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ paveloom ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/ducc0/default.nix b/pkgs/development/python-modules/ducc0/default.nix
index eee41de63bd4e..f655aebf8910c 100644
--- a/pkgs/development/python-modules/ducc0/default.nix
+++ b/pkgs/development/python-modules/ducc0/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonPackage rec {
   pname = "ducc0";
-  version = "0.32.0";
+  version = "0.33.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -12,7 +12,7 @@ buildPythonPackage rec {
     owner = "mtr";
     repo = "ducc";
     rev = "ducc0_${lib.replaceStrings ["."] ["_"] version}";
-    hash = "sha256-D+Gt5RrzljZQHBijaPuCuNsK08VxxJoWhqxSDu4bjH0=";
+    hash = "sha256-MezcqQRitBkK4/1rRQM2c9w+iZb2kIsDdcNd6I8CPoI=";
   };
 
   buildInputs = [ pybind11 ];
diff --git a/pkgs/development/python-modules/dvc-gdrive/default.nix b/pkgs/development/python-modules/dvc-gdrive/default.nix
new file mode 100644
index 0000000000000..e7b2b0d7c499c
--- /dev/null
+++ b/pkgs/development/python-modules/dvc-gdrive/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, dvc
+, fetchFromGitHub
+, pydrive2
+, pythonOlder
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "dvc-gdrive";
+  version = "3.0.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "iterative";
+    repo = "dvc-gdrive";
+    rev = "refs/tags/${version}";
+    hash = "sha256-oqHSMmwfR24ydJlpXGI3cCxIlF0BwNdgje5zKa0c7FA=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dvc
+    pydrive2
+  ];
+
+  # Circular dependency with dvc
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "dvc_gdrive"
+  ];
+
+  meta = with lib; {
+    description = "Google Drive plugin for DVC";
+    homepage = "https://github.com/iterative/dvc-gdrive";
+    changelog = "https://github.com/iterative/dvc-gdrive/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/dvc-hdfs/default.nix b/pkgs/development/python-modules/dvc-hdfs/default.nix
new file mode 100644
index 0000000000000..b532941e42ba5
--- /dev/null
+++ b/pkgs/development/python-modules/dvc-hdfs/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, buildPythonPackage
+, dvc
+, fetchFromGitHub
+, fsspec
+, pythonOlder
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "dvc-hdfs";
+  version = "3.0.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "iterative";
+    repo = "dvc-hdfs";
+    rev = "refs/tags/${version}";
+    hash = "sha256-Bo8+El5GC7iyT8SxaJquWFG29BOeilmEMDtTG+RkDGI=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dvc
+    fsspec
+  ] ++ fsspec.optional-dependencies.arrow;
+
+  # Circular dependency with dvc
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "dvc_hdfs"
+  ];
+
+  meta = with lib; {
+    description = "HDFS/WebHDFS plugin for dvc";
+    homepage = "https://github.com/iterative/dvc-hdfs";
+    changelog = "https://github.com/iterative/dvc-hdfs/releases/tag/${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/dvc/default.nix b/pkgs/development/python-modules/dvc/default.nix
index a0ec57df359f3..33cddb5b0e996 100644
--- a/pkgs/development/python-modules/dvc/default.nix
+++ b/pkgs/development/python-modules/dvc/default.nix
@@ -1,24 +1,23 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, fetchpatch
-, pythonOlder
-, pythonRelaxDepsHook
-, setuptools-scm
 , appdirs
+, buildPythonPackage
 , colorama
 , configobj
 , distro
 , dpath
 , dvc-azure
 , dvc-data
+, dvc-gdrive
 , dvc-gs
+, dvc-hdfs
 , dvc-http
 , dvc-render
 , dvc-s3
 , dvc-ssh
 , dvc-studio-client
 , dvc-task
+, fetchFromGitHub
+, fetchpatch
 , flatten-dict
 , flufl_lock
 , funcy
@@ -36,10 +35,13 @@
 , pydot
 , pygtrie
 , pyparsing
+, pythonOlder
+, pythonRelaxDepsHook
 , requests
 , rich
 , ruamel-yaml
 , scmrepo
+, setuptools-scm
 , shortuuid
 , shtab
 , tabulate
@@ -56,14 +58,16 @@
 
 buildPythonPackage rec {
   pname = "dvc";
-  version = "3.39.0";
+  version = "3.40.1";
   pyproject = true;
 
+  disabled = pythonOlder "3.8";
+
   src = fetchFromGitHub {
     owner = "iterative";
     repo = "dvc";
     rev = "refs/tags/${version}";
-    hash = "sha256-sFrbG9CKt8PaW9qdXBxEa516lnRWzFdTEbdCW6VFUuQ=";
+    hash = "sha256-ik2WVq7cXhOc9kwBep38HELgvj0CGLtpx5EzzdJzAsc=";
   };
 
   pythonRelaxDeps = [
@@ -72,7 +76,8 @@ buildPythonPackage rec {
   ];
 
   postPatch = ''
-    substituteInPlace dvc/analytics.py --replace 'enabled = not os.getenv(DVC_NO_ANALYTICS)' 'enabled = False'
+    substituteInPlace dvc/analytics.py \
+      --replace 'enabled = not os.getenv(DVC_NO_ANALYTICS)' 'enabled = False'
     substituteInPlace dvc/daemon.py \
       --subst-var-by dvc "$out/bin/dcv"
   '';
@@ -135,9 +140,15 @@ buildPythonPackage rec {
     azure = [
       dvc-azure
     ];
+    gdrive = [
+      dvc-gdrive
+    ];
     gs = [
       dvc-gs
     ];
+    hdfs = [
+      dvc-hdfs
+    ];
     s3 = [
       dvc-s3
     ];
diff --git a/pkgs/development/python-modules/mobi/default.nix b/pkgs/development/python-modules/mobi/default.nix
index 262e724a7b531..fae5b97bb1145 100644
--- a/pkgs/development/python-modules/mobi/default.nix
+++ b/pkgs/development/python-modules/mobi/default.nix
@@ -39,6 +39,6 @@ buildPythonPackage rec {
     description = "Library for unpacking unencrypted mobi files";
     homepage = "https://github.com/iscc/mobi";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ paveloom ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/msoffcrypto-tool/default.nix b/pkgs/development/python-modules/msoffcrypto-tool/default.nix
index 4e28e20024527..4bc2e80642e61 100644
--- a/pkgs/development/python-modules/msoffcrypto-tool/default.nix
+++ b/pkgs/development/python-modules/msoffcrypto-tool/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "msoffcrypto-tool";
-  version = "5.2.0";
+  version = "5.3.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "nolze";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-9qhTGf4IE8PtTfshnqu2fcctznA+2bWH4jz0dmKtoOo=";
+    hash = "sha256-aQtEJyG0JGe4eSIRI4OUjJZNDBni6FFyJXXkbeiotSY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pulp/default.nix b/pkgs/development/python-modules/pulp/default.nix
index 6ecd6d4ba8c0d..ab55157ed2074 100644
--- a/pkgs/development/python-modules/pulp/default.nix
+++ b/pkgs/development/python-modules/pulp/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pulp";
-  version = "2.7.0";
+  version = "2.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "coin-or";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-j0f6OiscJyTqPNyLp0qWRjCGLWuT3HdU1S/sxpnsiMo=";
+    hash = "sha256-lpbk1GeC8F/iLGV8G5RPHghnaM9eL82YekUYEt9+mvc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyaudio/default.nix b/pkgs/development/python-modules/pyaudio/default.nix
index 048acc08e43db..2cab06e7c7862 100644
--- a/pkgs/development/python-modules/pyaudio/default.nix
+++ b/pkgs/development/python-modules/pyaudio/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "PyAudio";
-  version = "0.2.13";
+  version = "0.2.14";
   disabled = isPyPy;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JrzMgeQkPRwP9Uh+a0gd5jKfzWXHk2XCZ87zjzY6K1Y=";
+    hash = "sha256-eN//OHm0mU0fT8ZIVkald1XG7jwZZHpJH3kKCJW9L4c=";
   };
 
   buildInputs = [ pkgs.portaudio ];
diff --git a/pkgs/development/python-modules/pydrive2/default.nix b/pkgs/development/python-modules/pydrive2/default.nix
index ad2d80c0a5e89..32bb5d78984f3 100644
--- a/pkgs/development/python-modules/pydrive2/default.nix
+++ b/pkgs/development/python-modules/pydrive2/default.nix
@@ -1,19 +1,25 @@
 { lib
+, appdirs
 , buildPythonPackage
 , fetchPypi
+, fsspec
+, funcy
 , google-api-python-client
 , oauth2client
 , pyopenssl
-, pyyaml
 , pythonOlder
+, pyyaml
+, setuptools
+, setuptools-scm
+, tqdm
 }:
 
 buildPythonPackage rec {
   pname = "pydrive2";
   version = "1.19.0";
-  format = "setuptools";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "PyDrive2";
@@ -21,6 +27,11 @@ buildPythonPackage rec {
     hash = "sha256-Ia6n2idjXCw/cFDgICBhkfOwMFxlUDFebo491Sb4tTE=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
   propagatedBuildInputs = [
     google-api-python-client
     oauth2client
@@ -28,6 +39,16 @@ buildPythonPackage rec {
     pyyaml
   ];
 
+  passthru.optional-dependencies = {
+    fsspec = [
+      appdirs
+      fsspec
+      funcy
+      tqdm
+    ];
+  };
+
+  # Tests require a account and network access
   doCheck = false;
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/pyosohotwaterapi/default.nix b/pkgs/development/python-modules/pyosohotwaterapi/default.nix
new file mode 100644
index 0000000000000..bd2b10976a070
--- /dev/null
+++ b/pkgs/development/python-modules/pyosohotwaterapi/default.nix
@@ -0,0 +1,63 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+, loguru
+, numpy
+, pythonOlder
+, setuptools
+, unasync
+, urllib3
+}:
+
+buildPythonPackage rec {
+  pname = "pyosohotwaterapi";
+  version = "1.1.4";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "osohotwateriot";
+    repo = "apyosohotwaterapi";
+    rev = "refs/tags/${version}";
+    hash = "sha256-7FLGmmndrFqSl4oC8QFIYNlFJPr+xbiZG5ZRt4vx8+s=";
+  };
+
+  postPatch = ''
+    # https://github.com/osohotwateriot/apyosohotwaterapi/pull/3
+    substituteInPlace requirements.txt \
+      --replace "pre-commit" ""
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    unasync
+  ];
+
+  propagatedBuildInputs = [
+    aiohttp
+    loguru
+    numpy
+    urllib3
+  ];
+
+  preBuild = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "apyosoenergyapi"
+  ];
+
+  meta = with lib; {
+    description = "Module for using the OSO Hotwater API";
+    homepage = "https://github.com/osohotwateriot/apyosohotwaterapi";
+    changelog = "https://github.com/osohotwateriot/apyosohotwaterapi/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyprusalink/default.nix b/pkgs/development/python-modules/pyprusalink/default.nix
index 0a1d8afc3bd1c..0356f899594b6 100644
--- a/pkgs/development/python-modules/pyprusalink/default.nix
+++ b/pkgs/development/python-modules/pyprusalink/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyprusalink";
-  version = "2.0.0";
+  version = "2.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "home-assistant-libs";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-wboyISggzC50cZ+J/NC0ytWXwCLBmBpP9/MtPkRb+Zs=";
+    hash = "sha256-wwH4LE8wi8eb7QwT7N1mNtVleoWscDEOu2vrXKDktwU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix b/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix
index e6b55788735a5..a66a8cafce2ba 100644
--- a/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix
@@ -10,8 +10,8 @@
 
 buildPythonPackage rec {
   pname = "pysigma-backend-elasticsearch";
-  version = "1.0.9";
-  format = "pyproject";
+  version = "1.0.10";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "SigmaHQ";
     repo = "pySigma-backend-elasticsearch";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OZaUKEEvgEIukEcAHB9ci/XWCU+h1CvQTU3gwWBOBkY=";
+    hash = "sha256-oH+47J/7zpJDOAVQ27qIOFtlYfNlzIP6OSp7ogrmdpY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytest-ansible/default.nix b/pkgs/development/python-modules/pytest-ansible/default.nix
index 705c578f3bd5f..b73ae05a8cce4 100644
--- a/pkgs/development/python-modules/pytest-ansible/default.nix
+++ b/pkgs/development/python-modules/pytest-ansible/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-ansible";
-  version = "24.1.1";
+  version = "24.1.2";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "ansible";
     repo = "pytest-ansible";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UPQx+CGJgaK4XVNngtzzncSueQN9LWh1gMmH5nGtPNk=";
+    hash = "sha256-NtGk+azpSZZm9PUf6Q1Qipo/zaUH+bed7k3oFnQyKjw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/readmdict/default.nix b/pkgs/development/python-modules/readmdict/default.nix
index b7d61f8c8f57d..d6ef1447a7b84 100644
--- a/pkgs/development/python-modules/readmdict/default.nix
+++ b/pkgs/development/python-modules/readmdict/default.nix
@@ -45,6 +45,6 @@ buildPythonPackage rec {
     description = "Read mdx/mdd files (repacking of readmdict from mdict-analysis)";
     homepage = "https://github.com/ffreemt/readmdict";
     license = licenses.mit;
-    maintainers = with maintainers; [ paveloom ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/sentence-splitter/default.nix b/pkgs/development/python-modules/sentence-splitter/default.nix
index 7e7891433cd7e..38ebc7fd6e2e7 100644
--- a/pkgs/development/python-modules/sentence-splitter/default.nix
+++ b/pkgs/development/python-modules/sentence-splitter/default.nix
@@ -37,6 +37,6 @@ buildPythonPackage rec {
     description = "Text to sentence splitter using heuristic algorithm by Philipp Koehn and Josh Schroeder";
     homepage = "https://github.com/mediacloud/sentence-splitter";
     license = licenses.lgpl3Plus;
-    maintainers = with maintainers; [ paveloom ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/simplemma/default.nix b/pkgs/development/python-modules/simplemma/default.nix
index 4c70b8a8df19e..60cb7438e9fbb 100644
--- a/pkgs/development/python-modules/simplemma/default.nix
+++ b/pkgs/development/python-modules/simplemma/default.nix
@@ -32,6 +32,6 @@ buildPythonPackage rec {
     description = "Simple multilingual lemmatizer for Python, especially useful for speed and efficiency";
     homepage = "https://github.com/adbar/simplemma";
     license = licenses.mit;
-    maintainers = with maintainers; [ paveloom ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/slpp/default.nix b/pkgs/development/python-modules/slpp/default.nix
index d52ac84dad7a4..74dbfcc834cde 100644
--- a/pkgs/development/python-modules/slpp/default.nix
+++ b/pkgs/development/python-modules/slpp/default.nix
@@ -36,6 +36,6 @@ buildPythonPackage rec {
     description = "Simple lua-python parser";
     homepage = "https://github.com/SirAnthony/slpp";
     license = licenses.mit;
-    maintainers = with maintainers; [ paveloom ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/sphinx-comments/default.nix b/pkgs/development/python-modules/sphinx-comments/default.nix
index 2ffed0c091fb3..77f5b79519c1b 100644
--- a/pkgs/development/python-modules/sphinx-comments/default.nix
+++ b/pkgs/development/python-modules/sphinx-comments/default.nix
@@ -1,19 +1,22 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, setuptools
 , sphinx
 }:
 
 buildPythonPackage rec {
   pname = "sphinx-comments";
   version = "0.0.3";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "00170afff27019fad08e421da1ae49c681831fb2759786f07c826e89ac94cf21";
   };
 
+  nativeBuildInputs = [ setuptools ];
+
   propagatedBuildInputs = [ sphinx ];
 
   pythonImportsCheck = [ "sphinx_comments" ];
diff --git a/pkgs/development/python-modules/strct/default.nix b/pkgs/development/python-modules/strct/default.nix
index 7244002d41694..061e2a90c07c8 100644
--- a/pkgs/development/python-modules/strct/default.nix
+++ b/pkgs/development/python-modules/strct/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , buildPythonPackage
 , setuptools
 , pytestCheckHook
@@ -18,11 +19,24 @@ buildPythonPackage rec {
     hash = "sha256-ctafvdfSOdp7tlCUYg7d5XTXR1qBcWvOVtGtNUnhYIw=";
   };
 
+  patches = [
+    # https://github.com/shaypal5/strct/pull/4
+    (fetchpatch {
+      name = "fix-versioneer-on-python312.patch";
+      url = "https://github.com/shaypal5/strct/commit/a1e5b6ca9045b52efdfdbb3c82e12a01e251d41b.patch";
+      hash = "sha256-xXADCSIhq1ARny2twzrhR1J8LkMFWFl6tmGxrM8RvkU=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pytest.ini \
       --replace  \
         "--cov" \
         "#--cov"
+
+    # configure correct version, which fails due to missing .git
+    substituteInPlace versioneer.py strct/_version.py \
+      --replace '"0+unknown"' '"${version}"'
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/telegram-text/default.nix b/pkgs/development/python-modules/telegram-text/default.nix
index b79cd78bf4b90..ca37dde8fb861 100644
--- a/pkgs/development/python-modules/telegram-text/default.nix
+++ b/pkgs/development/python-modules/telegram-text/default.nix
@@ -9,15 +9,15 @@
 
 buildPythonPackage rec {
   pname = "telegram-text";
-  version = "0.1.2";
+  version = "0.2.0";
   pyproject = true;
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "SKY-ALIN";
     repo = "telegram-text";
-    rev = "v${version}";
-    hash = "sha256-p8SVQq7IvkVuOFE8VDugROLY5Wk0L2HmXyacTzFFSP4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-eUy4kyCmM/5Ag/0s9hYW2IIg+OTX2L7EsoOYivhd0pU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index 3199218ef6599..5e104532e2670 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.0.8";
+  version = "4.0.10";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FvMFC1h3gu61jZPSPmxYHQmxnxYKmtYAecc/0IT9E8I=";
+    hash = "sha256-NuM7EUXl1QW0HyUPGAyeVDI5Dht4CMu/ufULKNW0bNw=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/withings-sync/default.nix b/pkgs/development/python-modules/withings-sync/default.nix
index 3f20703baaf33..bf6c2153c7e03 100644
--- a/pkgs/development/python-modules/withings-sync/default.nix
+++ b/pkgs/development/python-modules/withings-sync/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "withings-sync";
-  version = "4.2.2";
+  version = "4.2.4";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "jaroslawhartman";
     repo = "withings-sync";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-p1coGTbMQ+zptFKVLW5qgSdoudo2AggGT8Xu+cSCCs4=";
+    rev = "refs/tags/v.${version}";
+    hash = "sha256-nFYEtQob3x6APWDKCVP5p+qkKmgvXIcmegp/6ZRbDQA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 3d6b7b06ac833..7b35a15a6d80e 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.1.66";
+  version = "3.1.67";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-hvl29/K4qHvDiXM0Ufmi3ExMq+2JXQbSzaFYCCP0OhU=";
+    hash = "sha256-mwXR4KEkbkvWIwqeHuQPgm+8W7EdBtAwcBkFx0YFlhs=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/analysis/snyk/default.nix b/pkgs/development/tools/analysis/snyk/default.nix
index 10175b1cec6fe..3d8a82b59b5b0 100644
--- a/pkgs/development/tools/analysis/snyk/default.nix
+++ b/pkgs/development/tools/analysis/snyk/default.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "snyk";
-  version = "1.1266.0";
+  version = "1.1269.0";
 
   src = fetchFromGitHub {
     owner = "snyk";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-K+62BbiP4GVjxqadIllDBn8pH+cJkbEUVWJTMO7Mn3M=";
+    hash = "sha256-jFaWkit96mIBCIYVOYoa5qNOP+fzmzwoi5bFgpi8JHM=";
   };
 
-  npmDepsHash = "sha256-9FLXsIFrNzH42v5y537GrS3C1X91LLh3qu4sPoprNK4=";
+  npmDepsHash = "sha256-GCWpNFDfvpZrMLy8S7q1V0bzngL0fe0gZeMx+MbHOKU=";
 
   postPatch = ''
     substituteInPlace package.json --replace '"version": "1.0.0-monorepo"' '"version": "${version}"'
diff --git a/pkgs/development/tools/bearer/default.nix b/pkgs/development/tools/bearer/default.nix
index c05f6694a2faa..90ab6d3c820b6 100644
--- a/pkgs/development/tools/bearer/default.nix
+++ b/pkgs/development/tools/bearer/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "bearer";
-  version = "1.34.0";
+  version = "1.35.0";
 
   src = fetchFromGitHub {
     owner = "bearer";
     repo = "bearer";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JNYjBcuA2KDdhd1yF0E7mEhNJ7xQRT+wFlnAnal/P9I=";
+    hash = "sha256-JvmuJ3NNmjL69UGV/r5XOXqbznD0vA4CnhLWx05b3uY=";
   };
 
-  vendorHash = "sha256-DykY1PFKsJ++F8ToAhyss5nAmsTOfXQXJpSo21oEhYc=";
+  vendorHash = "sha256-4oRZLZv4TsdHozGJicLIxKDl1zenwjj4SbbpdVI02xI=";
 
   subPackages = [
     "cmd/bearer"
diff --git a/pkgs/development/tools/cddl/Gemfile.lock b/pkgs/development/tools/cddl/Gemfile.lock
index 796a7743cac5e..24afe0d41838f 100644
--- a/pkgs/development/tools/cddl/Gemfile.lock
+++ b/pkgs/development/tools/cddl/Gemfile.lock
@@ -1,23 +1,33 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    abnc (0.1.0)
-    cbor-diag (0.5.6)
-      json
+    abnc (0.1.1)
+    abnftt (0.2.4)
+    base32 (0.3.4)
+    cbor-canonical (0.1.2)
+    cbor-deterministic (0.1.3)
+    cbor-diag (0.8.7)
+      cbor-canonical
+      cbor-deterministic
+      cbor-packed
+      json_pure
       neatjson
       treetop (~> 1)
-    cddl (0.8.9)
+    cbor-packed (0.1.5)
+    cddl (0.10.3)
       abnc
+      abnftt
+      base32 (~> 0.3)
       cbor-diag
       colorize
-      json
+      json_pure
       regexp-examples
-    colorize (0.8.1)
-    json (2.2.0)
-    neatjson (0.9)
+    colorize (1.1.0)
+    json_pure (2.7.1)
+    neatjson (0.10.5)
     polyglot (0.3.5)
-    regexp-examples (1.5.0)
-    treetop (1.6.10)
+    regexp-examples (1.5.1)
+    treetop (1.6.12)
       polyglot (~> 0.3)
 
 PLATFORMS
@@ -27,4 +37,4 @@ DEPENDENCIES
   cddl
 
 BUNDLED WITH
-   2.1.4
+   2.3.25
diff --git a/pkgs/development/tools/cddl/default.nix b/pkgs/development/tools/cddl/default.nix
index 8fdae4b1c441b..f99e547435ce9 100644
--- a/pkgs/development/tools/cddl/default.nix
+++ b/pkgs/development/tools/cddl/default.nix
@@ -1,18 +1,41 @@
-{ lib, bundlerApp, bundlerUpdateScript }:
+{ lib
+, bundlerApp
+, bundlerUpdateScript
+, makeBinaryWrapper
+}:
 
-bundlerApp {
+bundlerApp rec {
   pname = "cddl";
 
-  gemdir = ./.;
+  gemfile = ./Gemfile;
+  lockfile = ./Gemfile.lock;
+
+  gemset = lib.recursiveUpdate (import ./gemset.nix) ({
+    "cddl" = {
+      dontBuild = false;
+      # setting env vars is not supported by patchShebangs
+      postPatch = ''
+        sed -i 's\#!/usr/bin/env RUBY_THREAD_VM_STACK_SIZE=5000000\#!/usr/bin/env\' bin/cddl
+      '';
+    };
+  });
+
   exes = [ "cddl" ];
 
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  postBuild = ''
+    wrapProgram $out/bin/cddl \
+      --set RUBY_THREAD_VM_STACK_SIZE 5000000
+  '';
+
   passthru.updateScript = bundlerUpdateScript "cddl";
 
   meta = with lib; {
     description = "A parser, generator, and validator for CDDL";
     homepage    = "https://rubygems.org/gems/cddl";
     license     = with licenses; mit;
-    maintainers = with maintainers; [ fdns nicknovitski ];
+    maintainers = with maintainers; [ fdns nicknovitski amesgen ];
     platforms   = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/cddl/gemset.nix b/pkgs/development/tools/cddl/gemset.nix
index c1f1c64495e32..1f19c3920bdf1 100644
--- a/pkgs/development/tools/cddl/gemset.nix
+++ b/pkgs/development/tools/cddl/gemset.nix
@@ -4,62 +4,112 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13nvzrk72nj130fs8bq8q3cfm48939rdzh7l31ncj5c4969hrbig";
+      sha256 = "0yj09gc9w208wsy0d45vzha4zfwxdpsqvkm9vms0chm4lxdwdg9x";
       type = "gem";
     };
-    version = "0.1.0";
+    version = "0.1.1";
+  };
+  abnftt = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1z7ibh0xv9mqk61rvvmz9fnfk6hffvnppqd8fx61vazjhisi9bcs";
+      type = "gem";
+    };
+    version = "0.2.4";
+  };
+  base32 = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fjs0l3c5g9qxwp43kcnhc45slx29yjb6m6jxbb2x1krgjmi166b";
+      type = "gem";
+    };
+    version = "0.3.4";
+  };
+  cbor-canonical = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fhj51s5d9b9spw096sb0p92bgilw9hrsay383563dh913j2jn11";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
+  cbor-deterministic = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1w1mg4mn1dhlxlbijxpzja8m8ggrjs0hzkzvnaazw9zm1ji6dpba";
+      type = "gem";
+    };
+    version = "0.1.3";
   };
   cbor-diag = {
-    dependencies = ["json" "neatjson" "treetop"];
+    dependencies = ["cbor-canonical" "cbor-deterministic" "cbor-packed" "json_pure" "neatjson" "treetop"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rwd88xngbjamgydj9rg3wvgl53pfzhal2n702s9afa1yp8mjm51";
+      type = "gem";
+    };
+    version = "0.8.7";
+  };
+  cbor-packed = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pd0k4malg1l7w3ck5glh9w0hrsvknk8rp32vrir74yww1g6yplv";
+      sha256 = "1dijyj7rivi39h34f32fx7k4xvngldf569i0372n1z6w01nv761l";
       type = "gem";
     };
-    version = "0.5.6";
+    version = "0.1.5";
   };
   cddl = {
-    dependencies = ["abnc" "cbor-diag" "colorize" "json" "regexp-examples"];
+    dependencies = ["abnc" "abnftt" "base32" "cbor-diag" "colorize" "json_pure" "regexp-examples"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16rmcrsxwx33pj25g1si0dhjdl2brfhy2vlpfwdb6qqkaikmzhpz";
+      sha256 = "1qll1qvn3g75r742kr4da7240zdk2qj4vh325965rrjqp8brz23q";
       type = "gem";
     };
-    version = "0.8.9";
+    version = "0.10.3";
   };
   colorize = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "133rqj85n400qk6g3dhf2bmfws34mak1wqihvh3bgy9jhajw580b";
+      sha256 = "0dy8ryhcdzgmbvj7jpa1qq3bhhk1m7a2pz6ip0m6dxh30rzj7d9h";
       type = "gem";
     };
-    version = "0.8.1";
+    version = "1.1.0";
   };
-  json = {
+  json_pure = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0sx97bm9by389rbzv8r1f43h06xcz8vwi3h5jv074gvparql7lcx";
+      sha256 = "09w7f7xlcas9irlaavhz0rnh17cjvjmmqm07drgghx5gwjcrar31";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "2.7.1";
   };
   neatjson = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fa2v7b6433j0iqh5iq9r71v7a5xabgjvqwsbl21vcsac7vf3ncw";
+      sha256 = "0wm1lq8yl6rzysh3wg6fa55w5534k6ppiz0qb7jyvdy582mk5i0s";
       type = "gem";
     };
-    version = "0.9";
+    version = "0.10.5";
   };
   polyglot = {
     groups = ["default"];
@@ -76,10 +126,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08s5d327i9dw5yjwv9vfss3qb7lwasjyc75wvh7vrdi5v4vm1y2k";
+      sha256 = "0wfkwczjn62qq3z96dxk43m0gh6d5cajx9pxkanvk88d3yqnx29v";
       type = "gem";
     };
-    version = "1.5.0";
+    version = "1.5.1";
   };
   treetop = {
     dependencies = ["polyglot"];
@@ -87,9 +137,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g31pijhnv7z960sd09lckmw9h8rs3wmc8g4ihmppszxqm99zpv7";
+      sha256 = "0adc8qblz8ii668r3rksjx83p675iryh52rvdvysimx2hkbasj7d";
       type = "gem";
     };
-    version = "1.6.10";
+    version = "1.6.12";
   };
 }
diff --git a/pkgs/development/tools/eask/default.nix b/pkgs/development/tools/eask/default.nix
index 0c55933f5b212..a130ad9e82c16 100644
--- a/pkgs/development/tools/eask/default.nix
+++ b/pkgs/development/tools/eask/default.nix
@@ -5,16 +5,16 @@
 
 buildNpmPackage rec {
   pname = "eask";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "emacs-eask";
     repo = "cli";
     rev = version;
-    hash = "sha256-LUN2gnvdToVi6NOF5gKXVPG0Al1Y/gI66o8dI8bTIgM=";
+    hash = "sha256-MuNQyd4vpJ8Eu57TGPpXiHjwJfdo3FhMjPZYc0MmHRg=";
   };
 
-  npmDepsHash = "sha256-YNgLEe7voCFspOBefXYJ7NtAtbTc0mRmFUN0856j6KM=";
+  npmDepsHash = "sha256-t/DgLItOeD/tUofRlf9mpZg79pC/ml2ReIyp62izn6Y=";
 
   dontBuild = true;
 
diff --git a/pkgs/development/tools/infisical/default.nix b/pkgs/development/tools/infisical/default.nix
index d007756cacf06..0f0c8e1ef89f7 100644
--- a/pkgs/development/tools/infisical/default.nix
+++ b/pkgs/development/tools/infisical/default.nix
@@ -15,7 +15,7 @@ let
   buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
 
   # the version of infisical
-  version = "0.16.7";
+  version = "0.16.10";
 
   # the platform-specific, statically linked binary
   src =
diff --git a/pkgs/development/tools/infisical/hashes.json b/pkgs/development/tools/infisical/hashes.json
index 11d5f4238f9b4..4b631427a553a 100644
--- a/pkgs/development/tools/infisical/hashes.json
+++ b/pkgs/development/tools/infisical/hashes.json
@@ -1,6 +1,6 @@
 { "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
-, "x86_64-linux": "sha256-wN+NoIDl8B/ANxES2XVkQBpTK3zUL+Xh+4BxKlcSkr0="
-, "x86_64-darwin": "sha256-ZkIGzcQd+MMJjiHPubLnHcc3H7Qpahs5LyJ+ytrYgfo="
-, "aarch64-linux": "sha256-P/AMelaej8D3BlUQBjOxCn8DADkVsU7lBY5dLJ0Wz6I="
-, "aarch64-darwin": "sha256-jQkLwY6Sq9cN/ujz4wlzjTBjaIYzZKMh/J/5CMWuRf8="
+, "x86_64-linux": "sha256-EjAm8toawTRKlnVr/dXXvfZ7IubKgjJh5qkR5lwBga8="
+, "x86_64-darwin": "sha256-W2enmLucQpDLaUzsbSmQ2wq1nU5k5a93iqlAERJ/b/g="
+, "aarch64-linux": "sha256-i5irWQmZVqKuzgAmL1wvo/3V7czEiIG8yANDhdb0tPk="
+, "aarch64-darwin": "sha256-GjG8FBT3eulRYLyy4iiuXuQjiL+Au8Dd/h7buXDNlyQ="
 }
diff --git a/pkgs/development/tools/misc/runme/default.nix b/pkgs/development/tools/misc/runme/default.nix
index 6e6914fbf1561..d0b3e5cfeadfe 100644
--- a/pkgs/development/tools/misc/runme/default.nix
+++ b/pkgs/development/tools/misc/runme/default.nix
@@ -12,13 +12,13 @@
 
 buildGoModule rec {
   pname = "runme";
-  version = "2.0.7";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "stateful";
     repo = "runme";
     rev = "v${version}";
-    hash = "sha256-ip2td0PEMga7Egd/YEGdpoUV4tnNI27BUDPYynpFhhc=";
+    hash = "sha256-6V7OxWJ0EYcbaHmls0P9iJD9tQ9N4GSPzBAKVdShvXg=";
   };
 
   vendorHash = "sha256-PLDsea/o067ifiX0RKFC7gDpORLVEQ0DV6sdBzzQCTs=";
diff --git a/pkgs/development/tools/rojo/default.nix b/pkgs/development/tools/rojo/default.nix
index c15cb643c6ee2..1eaeed08316ac 100644
--- a/pkgs/development/tools/rojo/default.nix
+++ b/pkgs/development/tools/rojo/default.nix
@@ -8,21 +8,21 @@
 }:
 
 let
-  inherit (darwin.apple_sdk.frameworks) CoreServices;
+  inherit (darwin.apple_sdk.frameworks) CoreServices SystemConfiguration;
 in
 rustPlatform.buildRustPackage rec {
   pname = "rojo";
-  version = "7.2.1";
+  version = "7.4.0";
 
   src = fetchFromGitHub {
     owner = "rojo-rbx";
     repo = "rojo";
     rev = "v${version}";
-    sha256 = "sha256-Kmq/lBwayYkFU4mbjExj7M9wpg59OkIiTc+2ZrwpuBc=";
+    sha256 = "sha256-Eh1G0jX9KXVlMZLl8whxULywadblWml232qvcq4JLJ4=";
     fetchSubmodules = true;
   };
 
-  cargoSha256 = "sha256-qx6Ja0DMe4cEmDSpovtY9T3+0nJS9XivR92K3UKgacE=";
+  cargoSha256 = "sha256-aKfgylY9aspL1JpdYa6hOy/6lQoqO54OhZWqSlMPZ8o=";
 
   nativeBuildInputs = [
     pkg-config
@@ -32,8 +32,12 @@ rustPlatform.buildRustPackage rec {
     openssl
   ] ++ lib.optionals stdenv.isDarwin [
     CoreServices
+    SystemConfiguration
   ];
 
+  # reqwest's native-tls-vendored feature flag uses vendored openssl. this disables that
+  OPENSSL_NO_VENDOR = "1";
+
   # tests flaky on darwin on hydra
   doCheck = !stdenv.isDarwin;
 
diff --git a/pkgs/development/tools/rust/cargo-dist/default.nix b/pkgs/development/tools/rust/cargo-dist/default.nix
index b365ae528b591..c7a9532e4b0ad 100644
--- a/pkgs/development/tools/rust/cargo-dist/default.nix
+++ b/pkgs/development/tools/rust/cargo-dist/default.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-dist";
-  version = "0.5.0";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "axodotdev";
     repo = "cargo-dist";
     rev = "v${version}";
-    hash = "sha256-Km/vaEOna+RvckNawIQTSp+FW49P5jx9euKeMaLuOsw=";
+    hash = "sha256-K+pqyH3Ajfp+tPhAuK7XCNfGdXa15oNqfsQcogvmQ8o=";
   };
 
-  cargoHash = "sha256-ccVflBHwEAuG0Y9Mmit1X6FLsM4bbt8Kd7fB6zBwKMc=";
+  cargoHash = "sha256-ZJdVhSznznnF1P28XkwtoeWoeymtPNaAZgOaKby+gnk=";
 
   nativeBuildInputs = [
     pkg-config
@@ -45,9 +45,10 @@ rustPlatform.buildRustPackage rec {
     ZSTD_SYS_USE_PKG_CONFIG = true;
   };
 
-  # remove tests that require internet access
+  # remove tests that require internet access and a git repo
   postPatch = ''
     rm cargo-dist/tests/integration-tests.rs
+    rm cargo-dist/tests/cli-tests.rs
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/rust/cargo-llvm-cov/default.nix b/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
index 6809aef437996..be81bb5ea7882 100644
--- a/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
+++ b/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
@@ -26,7 +26,7 @@
 
 let
   pname = "cargo-llvm-cov";
-  version = "0.6.0";
+  version = "0.6.2";
 
   owner = "taiki-e";
   homepage = "https://github.com/${owner}/${pname}";
@@ -37,7 +37,7 @@ let
   cargoLock = fetchurl {
     name = "Cargo.lock";
     url = "https://crates.io/api/v1/crates/${pname}/${version}/download";
-    sha256 = "sha256-n/LMICQ+38Y9PrzFh9uJ0ljmUrAxfue2l1HculuZ1x8=";
+    sha256 = "sha256-iML16yjSJsyDsr9F3gyp4XTu5Z9petSUQ0jXotU5tmw=";
     downloadToTemp = true;
     postFetch = ''
       tar xzf $downloadedFile ${pname}-${version}/Cargo.lock
@@ -55,7 +55,7 @@ rustPlatform.buildRustPackage {
     inherit owner;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Q1Us7VhvWaCQP9Aik9Fd0rXLP/tuSHmc98+3HoY2YNY=";
+    sha256 = "sha256-1VfWs8f4i3YjH69A7X3/1WPxSIwPRF5osQ/1eqOUB8U=";
     leaveDotGit = true;
   };
 
@@ -64,7 +64,7 @@ rustPlatform.buildRustPackage {
     cp ${cargoLock} source/Cargo.lock
   '';
 
-  cargoSha256 = "sha256-42s/90clkRXkNIZZxZQRwhNxMdCvgiknkCs/hWsofw0=";
+  cargoSha256 = "sha256-9pOfhGnktEgyTbfK4roFU7t3qcgx2yRp17hJVKsvNqw=";
 
   # `cargo-llvm-cov` reads these environment variables to find these binaries,
   # which are needed to run the tests
diff --git a/pkgs/development/tools/ttfb/default.nix b/pkgs/development/tools/ttfb/default.nix
index 550a8f1a87621..f024280c08702 100644
--- a/pkgs/development/tools/ttfb/default.nix
+++ b/pkgs/development/tools/ttfb/default.nix
@@ -1,40 +1,35 @@
 { darwin
 , fetchCrate
 , lib
-, openssl
-, pkg-config
 , rustPlatform
 , stdenv
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "ttfb";
-  version = "1.7.0";
+  version = "1.10.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-GxjG8pyE2rY0h1dpAo+HRUbP31I5Pm4h1fAb6R7V+qU=";
+    hash = "sha256-94gBofb7H7+qU50+cp+rq14Vtbk2vuXFQksNITvICm4=";
   };
 
-  cargoHash = "sha256-YdbVtVKt0bKb1R5IQxf9J/0ZA3ZHH+oZ8ryX6f4cGsY=";
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  cargoHash = "sha256-CUisxtUQXkStqSZikIoAN0GwpUjvQqon7KqI0beHL5U=";
 
   # The bin feature activates all dependencies of the binary. Otherwise,
   # only the library is build.
   buildFeatures = [ "bin" ];
 
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [
-    openssl
-  ] ++ lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = {
     description = "CLI-Tool to measure the TTFB (time to first byte) of HTTP(S) requests";
     longDescription = ''
-      This crate measures the times of DNS lookup, TCP connect, TLS handshake, and HTTP's TTFB
-      for a given IP or domain.
+      ttfb measure the TTFB (time to first byte) of HTTP(S) requests. This includes data
+      of intermediate steps, such as the relative and absolute timings of DNS lookup, TCP
+      connect, and TLS handshake.
     '';
     homepage = "https://github.com/phip1611/ttfb";
     changelog = "https://github.com/phip1611/ttfb/blob/v${version}/CHANGELOG.md";
diff --git a/pkgs/development/tools/xc/default.nix b/pkgs/development/tools/xc/default.nix
index 441c995517f62..0e09b77e453e2 100644
--- a/pkgs/development/tools/xc/default.nix
+++ b/pkgs/development/tools/xc/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "xc";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "joerdav";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ndaffdU+DYuILZzAwsjLTNWFWbq7CrTcAYBA0j3T3gA=";
+    sha256 = "sha256-vTyCS85xbJnAgbasWD6LFxij9EezzlJ1pyvCJptqmOU=";
   };
 
-  vendorHash = "sha256-AwlXX79L69dv6wbFtlbHAeZRuOeDy/r6KSiWwjoIgWw=";
+  vendorHash = "sha256-EbIuktQ2rExa2DawyCamTrKRC1yXXMleRB8/pcKFY5c=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/games/anki/default.nix b/pkgs/games/anki/default.nix
index ca6eaf15ac21a..3cd623c4d6ef2 100644
--- a/pkgs/games/anki/default.nix
+++ b/pkgs/games/anki/default.nix
@@ -292,7 +292,7 @@ python3.pkgs.buildPythonApplication {
     homepage = "https://apps.ankiweb.net";
     license = licenses.agpl3Plus;
     platforms = platforms.mesaPlatforms;
-    maintainers = with maintainers; [ euank oxij paveloom ];
+    maintainers = with maintainers; [ euank oxij ];
     # Reported to crash at launch on darwin (as of 2.1.65)
     broken = stdenv.isDarwin;
   };
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 2aacb88dc87e0..e9aba32aa2253 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -685,23 +685,23 @@ let
       VBOXGUEST = option no;
       DRM_VBOXVIDEO = option no;
 
-      XEN                         = mkIf stdenv.is64bit (option yes);
-      XEN_DOM0                    = mkIf stdenv.is64bit (option yes);
-      PCI_XEN                     = mkIf stdenv.is64bit (option yes);
-      HVC_XEN                     = mkIf stdenv.is64bit (option yes);
-      HVC_XEN_FRONTEND            = mkIf stdenv.is64bit (option yes);
-      XEN_SYS_HYPERVISOR          = mkIf stdenv.is64bit (option yes);
-      SWIOTLB_XEN                 = mkIf stdenv.is64bit (option yes);
-      XEN_BACKEND                 = mkIf stdenv.is64bit (option yes);
-      XEN_BALLOON                 = mkIf stdenv.is64bit (option yes);
-      XEN_BALLOON_MEMORY_HOTPLUG  = mkIf stdenv.is64bit (option yes);
-      XEN_EFI                     = mkIf stdenv.is64bit (option yes);
-      XEN_HAVE_PVMMU              = mkIf stdenv.is64bit (option yes);
-      XEN_MCE_LOG                 = mkIf stdenv.is64bit (option yes);
-      XEN_PVH                     = mkIf stdenv.is64bit (option yes);
-      XEN_PVHVM                   = mkIf stdenv.is64bit (option yes);
-      XEN_SAVE_RESTORE            = mkIf stdenv.is64bit (option yes);
-      XEN_SELFBALLOONING          = mkIf stdenv.is64bit (whenOlder "5.3" yes);
+      XEN                         = option yes;
+      XEN_DOM0                    = option yes;
+      PCI_XEN                     = option yes;
+      HVC_XEN                     = option yes;
+      HVC_XEN_FRONTEND            = option yes;
+      XEN_SYS_HYPERVISOR          = option yes;
+      SWIOTLB_XEN                 = option yes;
+      XEN_BACKEND                 = option yes;
+      XEN_BALLOON                 = option yes;
+      XEN_BALLOON_MEMORY_HOTPLUG  = option yes;
+      XEN_EFI                     = option yes;
+      XEN_HAVE_PVMMU              = option yes;
+      XEN_MCE_LOG                 = option yes;
+      XEN_PVH                     = option yes;
+      XEN_PVHVM                   = option yes;
+      XEN_SAVE_RESTORE            = option yes;
+      XEN_SELFBALLOONING          = whenOlder "5.3" yes;
 
       # Enable device detection on virtio-mmio hypervisors
       VIRTIO_MMIO_CMDLINE_DEVICES = yes;
diff --git a/pkgs/os-specific/linux/nixos-rebuild/default.nix b/pkgs/os-specific/linux/nixos-rebuild/default.nix
index 9a7cca68bfd72..4849ff75c54ab 100644
--- a/pkgs/os-specific/linux/nixos-rebuild/default.nix
+++ b/pkgs/os-specific/linux/nixos-rebuild/default.nix
@@ -1,4 +1,5 @@
-{ substituteAll
+{ callPackage
+, substituteAll
 , runtimeShell
 , coreutils
 , gnused
@@ -36,6 +37,7 @@ substituteAll {
   # run some a simple installer tests to make sure nixos-rebuild still works for them
   passthru.tests = {
     install-bootloader = nixosTests.nixos-rebuild-install-bootloader;
+    repl = callPackage ./test/repl.nix {};
     simple-installer = nixosTests.installer.simple;
     specialisations = nixosTests.nixos-rebuild-specialisations;
     target-host = nixosTests.nixos-rebuild-target-host;
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 006b5db6320c5..bde6ff9d959ba 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -572,6 +572,7 @@ if [ "$action" = repl ]; then
                     - ${blue}config${reset}   All option values
                     - ${blue}options${reset}  Option data and metadata
                     - ${blue}pkgs${reset}     Nixpkgs package set
+                    - ${blue}lib${reset}      Nixpkgs library functions
                     - other module arguments
 
                     - ${blue}flake${reset}    Flake outputs, inputs and source info of $flake
@@ -592,6 +593,7 @@ if [ "$action" = repl ]; then
                 configuration._module.specialArgs //
                 {
                   inherit (configuration) config options;
+                  lib = configuration.lib or configuration.pkgs.lib;
                   inherit flake;
                 };
           in builtins.seq scope builtins.trace motd scope
diff --git a/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix b/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix
new file mode 100644
index 0000000000000..1161ff84664d3
--- /dev/null
+++ b/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix
@@ -0,0 +1,146 @@
+{ lib,
+  expect,
+  nix,
+  nixos-rebuild,
+  path,
+  runCommand,
+  stdenv,
+  writeText,
+}:
+let
+  # Arguably not true, but it holds up for now.
+  escapeExpect = lib.strings.escapeNixString;
+
+  expectSetup = ''
+    set timeout 180
+    proc expect_simple { pattern } {
+      puts "Expecting: $pattern"
+      expect {
+        timeout {
+          puts "\nTimeout waiting for: $pattern\n"
+          exit 1
+        }
+        $pattern
+      }
+    }
+  '';
+
+  # In case we want/need to evaluate packages or the assertions or whatever,
+  # we want to have a linux system.
+  # TODO: make the non-flake test use thise.
+  linuxSystem = lib.replaceStrings ["darwin"] ["linux"] stdenv.hostPlatform.system;
+
+in
+runCommand "test-nixos-rebuild-repl" {
+  nativeBuildInputs = [
+    expect
+    nix
+    nixos-rebuild
+  ];
+  nixpkgs =
+    if builtins.pathExists (path + "/.git")
+    then lib.cleanSource path
+    else path;
+} ''
+  export HOME=$(mktemp -d)
+  export TEST_ROOT=$PWD/test-tmp
+
+  # Prepare for running Nix in sandbox
+  export NIX_BUILD_HOOK=
+  export NIX_CONF_DIR=$TEST_ROOT/etc
+  export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
+  export NIX_LOG_DIR=$TEST_ROOT/var/log/nix
+  export NIX_STATE_DIR=$TEST_ROOT/var/nix
+  export NIX_STORE_DIR=$TEST_ROOT/store
+  export PAGER=cat
+  mkdir -p $TEST_ROOT $NIX_CONF_DIR
+
+  echo General setup
+  ##################
+
+  export NIX_PATH=nixpkgs=$nixpkgs:nixos-config=$HOME/configuration.nix
+  cat >> ~/configuration.nix <<EOF
+  {
+    boot.loader.grub.enable = false;
+    fileSystems."/".device = "x";
+    imports = [ ./hardware-configuration.nix ];
+  }
+  EOF
+
+  echo '{ }' > ~/hardware-configuration.nix
+
+
+  echo Test traditional NixOS configuration
+  #########################################
+
+  expect ${writeText "test-nixos-rebuild-repl-expect" ''
+    ${expectSetup}
+    spawn nixos-rebuild repl --fast
+
+    expect "nix-repl> "
+
+    send "config.networking.hostName\n"
+    expect "\"nixos\""
+  ''}
+
+
+  echo Test flake based NixOS configuration
+  #########################################
+
+  # Switch to flake flavored environment
+  unset NIX_PATH
+  cat > $NIX_CONF_DIR/nix.conf <<EOF
+  experimental-features = nix-command flakes
+  EOF
+
+  # Make the config pure
+  echo '{ nixpkgs.hostPlatform = "${linuxSystem}"; }' > ~/hardware-configuration.nix
+
+  cat >~/flake.nix <<EOF
+  {
+    inputs.nixpkgs.url = "path:$nixpkgs";
+    outputs = { nixpkgs, ... }: {
+      nixosConfigurations.testconf = nixpkgs.lib.nixosSystem {
+        modules = [
+          ./configuration.nix
+          # Let's change it up a bit
+          { networking.hostName = "itsme"; }
+        ];
+      };
+    };
+  }
+  EOF
+
+  # cat -n ~/flake.nix
+
+  expect ${writeText "test-nixos-rebuild-repl-expect" ''
+    ${expectSetup}
+    spawn sh -c "nixos-rebuild repl --fast --flake path:\$HOME#testconf"
+
+    expect_simple "nix-repl>"
+
+    send "config.networking.hostName\n"
+    expect_simple "itsme"
+
+    expect_simple "nix-repl>"
+    send "lib.version\n"
+    expect_simple ${escapeExpect (
+      # The version string is a bit different in the flake lib, so we expect a prefix and ignore the rest
+      # Furthermore, including the revision (suffix) would cause unnecessary rebuilds.
+      # Note that a length of 4 only matches e.g. "24.
+      lib.strings.substring 0 4 (lib.strings.escapeNixString lib.version))}
+
+    # Make sure it's the right lib - should be the flake lib, not Nixpkgs lib.
+    expect_simple "nix-repl>"
+    send "lib?nixosSystem\n"
+    expect_simple "true"
+    expect_simple "nix-repl>"
+    send "lib?nixos\n"
+    expect_simple "true"
+  ''}
+  echo
+
+  #########
+  echo Done
+  touch $out
+''
diff --git a/pkgs/servers/matrix-synapse/matrix-hookshot/package.json b/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
index 0ff87211985ff..8d3204fa2b4f8 100644
--- a/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/package.json
@@ -1,6 +1,6 @@
 {
   "name": "matrix-hookshot",
-  "version": "4.7.0",
+  "version": "5.1.2",
   "description": "A bridge between Matrix and multiple project management services, such as GitHub, GitLab and JIRA.",
   "main": "lib/app.js",
   "repository": "https://github.com/matrix-org/matrix-hookshot",
@@ -10,7 +10,7 @@
     "name": "matrix-hookshot-rs"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "scripts": {
     "build:web": "vite build",
@@ -32,6 +32,7 @@
     "start:matrixsender": "node --require source-map-support/register lib/App/MatrixSenderApp.js",
     "start:resetcrypto": "node --require source-map-support/register lib/App/ResetCryptoStore.js",
     "test": "mocha -r ts-node/register tests/init.ts tests/*.ts  tests/**/*.ts",
+    "test:e2e": "yarn node --experimental-vm-modules $(yarn bin jest)",
     "test:cover": "nyc --reporter=lcov --reporter=text yarn test",
     "lint": "yarn run lint:js && yarn run lint:rs",
     "lint:js": "eslint -c .eslintrc.js 'src/**/*.ts' 'tests/**/*.ts' 'web/**/*.ts' 'web/**/*.tsx'",
@@ -42,71 +43,77 @@
   },
   "dependencies": {
     "@alloc/quick-lru": "^5.2.0",
-    "@octokit/auth-app": "^3.3.0",
-    "@octokit/auth-token": "^2.4.5",
-    "@octokit/rest": "^18.10.0",
-    "@octokit/webhooks": "^9.1.2",
+    "@octokit/auth-app": "^6.0.2",
+    "@octokit/auth-token": "^4.0.0",
+    "@octokit/rest": "^20.0.2",
+    "@octokit/webhooks": "^12.0.10",
     "@sentry/node": "^7.52.1",
+    "@vector-im/compound-design-tokens": "^0.1.0",
+    "@vector-im/compound-web": "^0.9.4",
     "ajv": "^8.11.0",
-    "axios": "^1.6.2",
+    "axios": "^1.6.3",
     "cors": "^2.8.5",
-    "express": "^4.17.3",
+    "express": "^4.18.2",
     "figma-js": "^1.14.0",
     "http-status-codes": "^2.2.0",
     "ioredis": "^5.2.3",
-    "jira-client": "^8.0.0",
-    "markdown-it": "^12.3.2",
+    "jira-client": "^8.2.2",
+    "markdown-it": "^14.0.0",
     "matrix-appservice-bridge": "^9.0.1",
-    "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@^0.6.7-element.1",
-    "matrix-widget-api": "^1.0.0",
-    "micromatch": "^4.0.4",
-    "mime": "^3.0.0",
-    "node-emoji": "^1.11.0",
-    "nyc": "^15.1.0",
+    "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@^0.7.0-specific-device-2",
+    "matrix-widget-api": "^1.6.0",
+    "micromatch": "^4.0.5",
+    "mime": "^4.0.1",
+    "node-emoji": "^2.1.3",
     "p-queue": "^6.6.2",
-    "prom-client": "^14.2.0",
-    "quickjs-emscripten": "^0.23.0",
-    "reflect-metadata": "^0.1.13",
+    "preact-render-to-string": "^6.3.1",
+    "prom-client": "^15.1.0",
+    "quickjs-emscripten": "^0.26.0",
+    "reflect-metadata": "^0.2.1",
     "source-map-support": "^0.5.21",
     "string-argv": "^0.3.1",
     "tiny-typed-emitter": "^2.1.0",
-    "winston": "^3.3.3",
-    "xml2js": "^0.5.0",
-    "yaml": "^2.2.2"
+    "vite-plugin-magical-svg": "^1.1.1",
+    "winston": "^3.11.0",
+    "xml2js": "^0.6.2",
+    "yaml": "^2.3.4"
   },
   "devDependencies": {
     "@codemirror/lang-javascript": "^6.0.2",
     "@napi-rs/cli": "^2.13.2",
     "@preact/preset-vite": "^2.2.0",
-    "@tsconfig/node18": "^2.0.0",
+    "@rollup/plugin-alias": "^5.1.0",
+    "@tsconfig/node18": "^18.2.2",
     "@types/ajv": "^1.0.0",
     "@types/chai": "^4.2.22",
     "@types/cors": "^2.8.12",
     "@types/express": "^4.17.14",
+    "@types/jest": "^29.5.11",
     "@types/jira-client": "^7.1.0",
-    "@types/markdown-it": "^12.2.3",
+    "@types/markdown-it": "^13.0.7",
     "@types/micromatch": "^4.0.1",
-    "@types/mime": "^2.0.3",
-    "@types/mocha": "^9.0.0",
-    "@types/node": "18",
-    "@types/node-emoji": "^1.8.1",
-    "@types/uuid": "^8.3.3",
+    "@types/mime": "^3.0.4",
+    "@types/mocha": "^10.0.6",
+    "@types/node": "20.10.6",
     "@types/xml2js": "^0.4.11",
-    "@typescript-eslint/eslint-plugin": "^6.6.0",
-    "@typescript-eslint/parser": "^6.6.0",
+    "@typescript-eslint/eslint-plugin": "^6.17.0",
+    "@typescript-eslint/parser": "^6.17.0",
     "@uiw/react-codemirror": "^4.12.3",
     "chai": "^4.3.4",
     "eslint": "^8.49.0",
     "eslint-config-preact": "^1.3.0",
     "eslint-plugin-mocha": "^10.1.0",
+    "homerunner-client": "^1.0.0",
+    "jest": "^29.7.0",
     "mini.css": "^3.0.1",
-    "mocha": "^8.2.1",
+    "mocha": "^10.2.0",
+    "nyc": "^15.1.0",
     "preact": "^10.5.15",
-    "rimraf": "^3.0.2",
-    "sass": "^1.51.0",
+    "rimraf": "^5.0.5",
+    "sass": "^1.69.6",
+    "ts-jest": "^29.1.1",
     "ts-node": "^10.9.1",
-    "typescript": "^5.1.3",
-    "vite": "^4.1.5",
-    "vite-svg-loader": "^4.0.0"
+    "typescript": "^5.3.3",
+    "vite": "^5.0.10"
   }
 }
diff --git a/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json b/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
index 64b40c341cc9d..51dab75959ade 100644
--- a/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
+++ b/pkgs/servers/matrix-synapse/matrix-hookshot/pin.json
@@ -1,6 +1,6 @@
 {
-  "version": "4.7.0",
-  "srcHash": "sha256-27PBuLyk/1ER26pus5tbe9CxeYEZgZrYBYy5l3B/19c=",
-  "yarnHash": "05mh3q5zw1aiznvbkhp7spb1bgcv32ncdb4zpyvhhv74pyhjnsn2",
-  "cargoHash": "sha256-cAjsNVQfXfZbM1/MoiEh/Qp0uW/iXsxBVx7cRZY3tN0="
+  "version": "5.1.2",
+  "srcHash": "sha256-dBuk/kpU5/GnwoTDh8FdnetK2hEBBTwrUA3fP/L9mWU=",
+  "yarnHash": "100lfm0pr0l33j1bl9zmw1s7fm4ihrwppyvq6x8ahx1sjrr1m0lp",
+  "cargoHash": "sha256-4cFhV5y7tqUZ4pQWQKIbOZ0qXo0ya5gnMizCNcxYZS0="
 }
diff --git a/pkgs/servers/nextcloud/notify_push.nix b/pkgs/servers/nextcloud/notify_push.nix
index c29547e57563c..9dee1ebe9565e 100644
--- a/pkgs/servers/nextcloud/notify_push.nix
+++ b/pkgs/servers/nextcloud/notify_push.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "notify_push";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "nextcloud";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-9wVH+msUh0t0PKz+5044PhT9lGsbfp4u44gX0O70Pbo=";
+    hash = "sha256-kcdrKrad5kHYOg/1+L72c9Y3GwFA4wS2C9xQ0JOqcOQ=";
   };
 
-  cargoHash = "sha256-Q4KA+mc48OfmxYY7vDJ2ZU/Wd+101kbimwAw6ag3d+w=";
+  cargoHash = "sha256-jMSPBoLVUe4I+CI8nKOjgTxUUarUa4/KLl+LmehKOzg=";
 
   passthru = rec {
     test_client = rustPlatform.buildRustPackage {
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
 
       buildAndTestSubdir = "test_client";
 
-      cargoHash = "sha256-XiaeCVgVjre7NmH/B+dNw0u2HV0vJwlgDjhLXXgJS+Y=";
+      cargoHash = "sha256-0Vs05DToSeKWQJlTwtETedJV2GQ3LYJYIsxM/xZ6dt4=";
     };
     tests = {
       inherit (nixosTests.nextcloud)
diff --git a/pkgs/servers/nextcloud/packages/26.json b/pkgs/servers/nextcloud/packages/26.json
index 1d0023d86bae2..d6c55c6288ba8 100644
--- a/pkgs/servers/nextcloud/packages/26.json
+++ b/pkgs/servers/nextcloud/packages/26.json
@@ -50,9 +50,9 @@
     ]
   },
   "deck": {
-    "sha256": "1dkvvk7n120hgk3pf03g2ixlylp7nxmi3wh9qsp8b0fimclpd5hz",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.9.5/deck-v1.9.5.tar.gz",
-    "version": "1.9.5",
+    "sha256": "1vf4vmwzfyj5ylb571h1wgh8f3aiivzla11y14ggikg5fj9lgyqi",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.9.6/deck-v1.9.6.tar.gz",
+    "version": "1.9.6",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -100,9 +100,9 @@
     ]
   },
   "gpoddersync": {
-    "sha256": "1b74l6j9w3xnjbb57viz4bfridkpyvq7rq29kfr8cm03jm2nzq3r",
-    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.8.2/gpoddersync.tar.gz",
-    "version": "3.8.2",
+    "sha256": "1lm8lqvs1mvb3i2a8b5j9g7b26f747jfp696b9ima0hgpw8ycbfs",
+    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.8.3/gpoddersync.tar.gz",
+    "version": "3.8.3",
     "description": "Expose GPodder API to sync podcast consumer apps like AntennaPod",
     "homepage": "https://github.com/thrillfall/nextcloud-gpodder",
     "licenses": [
@@ -140,9 +140,9 @@
     ]
   },
   "mail": {
-    "sha256": "1r4vqxmzfzv9g29smqj14a3k97hwxb9dswg7z501wgq901959bx2",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.5.2/mail-v3.5.2.tar.gz",
-    "version": "3.5.2",
+    "sha256": "0brhaqw1sdh3fj5vdj4h8rkgg92ghwy0gyz51n120rppd8fhsch6",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.5.4/mail-v3.5.4.tar.gz",
+    "version": "3.5.4",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -200,9 +200,9 @@
     ]
   },
   "notify_push": {
-    "sha256": "1by9qw9bsf48cyczhfxpz9ifrg2dayvcn26m309dicqgjqkz91hd",
-    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.6/notify_push-v0.6.6.tar.gz",
-    "version": "0.6.6",
+    "sha256": "1h2qa5j31jq2wzpsj69h8knm4jzg9i72p77l92l855n98r4iiws8",
+    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.7/notify_push-v0.6.7.tar.gz",
+    "version": "0.6.7",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
     "homepage": "",
     "licenses": [
@@ -330,9 +330,9 @@
     ]
   },
   "user_saml": {
-    "sha256": "0q189wkh0nh5y4z9j4bpgn4xnwwn8y8m8y34bp5nbzfz05xpgr9f",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v5.2.5/user_saml-v5.2.5.tar.gz",
-    "version": "5.2.5",
+    "sha256": "0rsrbbdvf8kb9l6afz86af33ri0ng9yj7d4xw28j50mfcx3kifg3",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v5.2.6/user_saml-v5.2.6.tar.gz",
+    "version": "5.2.6",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/27.json b/pkgs/servers/nextcloud/packages/27.json
index f39e22e4f09a5..73a4881fd423a 100644
--- a/pkgs/servers/nextcloud/packages/27.json
+++ b/pkgs/servers/nextcloud/packages/27.json
@@ -50,9 +50,9 @@
     ]
   },
   "deck": {
-    "sha256": "0ykxfw9v89k4a3g6lbl75d0hwri85kf6jqx1n5v2jxibfr5n4bcp",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.11.2/deck-v1.11.2.tar.gz",
-    "version": "1.11.2",
+    "sha256": "1bl7x3h91rcjd3xx8lq2rkx8khpw5f3n0kqi8mrs88hw0hin8sdi",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.11.3/deck-v1.11.3.tar.gz",
+    "version": "1.11.3",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -100,9 +100,9 @@
     ]
   },
   "gpoddersync": {
-    "sha256": "1b74l6j9w3xnjbb57viz4bfridkpyvq7rq29kfr8cm03jm2nzq3r",
-    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.8.2/gpoddersync.tar.gz",
-    "version": "3.8.2",
+    "sha256": "1lm8lqvs1mvb3i2a8b5j9g7b26f747jfp696b9ima0hgpw8ycbfs",
+    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.8.3/gpoddersync.tar.gz",
+    "version": "3.8.3",
     "description": "Expose GPodder API to sync podcast consumer apps like AntennaPod",
     "homepage": "https://github.com/thrillfall/nextcloud-gpodder",
     "licenses": [
@@ -110,9 +110,9 @@
     ]
   },
   "groupfolders": {
-    "sha256": "1cxhffm4fav93rrlkw6bqjrqj8qyfx1dkwlpacqjy2k1yknv06ym",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v15.3.2/groupfolders-v15.3.2.tar.gz",
-    "version": "15.3.2",
+    "sha256": "1sihhcai7i7gnkl0adq1injlsvk5ainvy71a2373iqmpmi167pyf",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v15.3.4/groupfolders-v15.3.4.tar.gz",
+    "version": "15.3.4",
     "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.",
     "homepage": "https://github.com/nextcloud/groupfolders",
     "licenses": [
@@ -140,9 +140,9 @@
     ]
   },
   "mail": {
-    "sha256": "1r4vqxmzfzv9g29smqj14a3k97hwxb9dswg7z501wgq901959bx2",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.5.2/mail-v3.5.2.tar.gz",
-    "version": "3.5.2",
+    "sha256": "0brhaqw1sdh3fj5vdj4h8rkgg92ghwy0gyz51n120rppd8fhsch6",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.5.4/mail-v3.5.4.tar.gz",
+    "version": "3.5.4",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -200,9 +200,9 @@
     ]
   },
   "notify_push": {
-    "sha256": "1by9qw9bsf48cyczhfxpz9ifrg2dayvcn26m309dicqgjqkz91hd",
-    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.6/notify_push-v0.6.6.tar.gz",
-    "version": "0.6.6",
+    "sha256": "1h2qa5j31jq2wzpsj69h8knm4jzg9i72p77l92l855n98r4iiws8",
+    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.7/notify_push-v0.6.7.tar.gz",
+    "version": "0.6.7",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
     "homepage": "",
     "licenses": [
@@ -330,9 +330,9 @@
     ]
   },
   "user_saml": {
-    "sha256": "0q189wkh0nh5y4z9j4bpgn4xnwwn8y8m8y34bp5nbzfz05xpgr9f",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v5.2.5/user_saml-v5.2.5.tar.gz",
-    "version": "5.2.5",
+    "sha256": "0rsrbbdvf8kb9l6afz86af33ri0ng9yj7d4xw28j50mfcx3kifg3",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v5.2.6/user_saml-v5.2.6.tar.gz",
+    "version": "5.2.6",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/28.json b/pkgs/servers/nextcloud/packages/28.json
index 03386b681dbb2..479f6c585742d 100644
--- a/pkgs/servers/nextcloud/packages/28.json
+++ b/pkgs/servers/nextcloud/packages/28.json
@@ -50,9 +50,9 @@
     ]
   },
   "deck": {
-    "sha256": "0dkw59pv3yj21fs87sw2y4z1qplsgbfnr0nk9cjsb8vb3xjzd0rx",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.12.0/deck-v1.12.0.tar.gz",
-    "version": "1.12.0",
+    "sha256": "08yxwrf5dx8fh70hcpr54ca5h6f2p2ck2hmjnxz5jymd6pnadsr6",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.12.1/deck-v1.12.1.tar.gz",
+    "version": "1.12.1",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -80,9 +80,9 @@
     ]
   },
   "gpoddersync": {
-    "sha256": "1b74l6j9w3xnjbb57viz4bfridkpyvq7rq29kfr8cm03jm2nzq3r",
-    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.8.2/gpoddersync.tar.gz",
-    "version": "3.8.2",
+    "sha256": "1lm8lqvs1mvb3i2a8b5j9g7b26f747jfp696b9ima0hgpw8ycbfs",
+    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.8.3/gpoddersync.tar.gz",
+    "version": "3.8.3",
     "description": "Expose GPodder API to sync podcast consumer apps like AntennaPod",
     "homepage": "https://github.com/thrillfall/nextcloud-gpodder",
     "licenses": [
@@ -90,9 +90,9 @@
     ]
   },
   "groupfolders": {
-    "sha256": "024qll51hdsky6iad0acf3c00ny9k9mc303r2v4g4h53qx2gksys",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v16.0.1/groupfolders-v16.0.1.tar.gz",
-    "version": "16.0.1",
+    "sha256": "17v57z7fsbp2m3918x78zrm3ywnbm7vsrcb48x44v5pakdhca3gy",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v16.0.3/groupfolders-v16.0.3.tar.gz",
+    "version": "16.0.3",
     "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.",
     "homepage": "https://github.com/nextcloud/groupfolders",
     "licenses": [
@@ -120,9 +120,9 @@
     ]
   },
   "mail": {
-    "sha256": "1r4vqxmzfzv9g29smqj14a3k97hwxb9dswg7z501wgq901959bx2",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.5.2/mail-v3.5.2.tar.gz",
-    "version": "3.5.2",
+    "sha256": "0brhaqw1sdh3fj5vdj4h8rkgg92ghwy0gyz51n120rppd8fhsch6",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.5.4/mail-v3.5.4.tar.gz",
+    "version": "3.5.4",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -160,9 +160,9 @@
     ]
   },
   "notify_push": {
-    "sha256": "1by9qw9bsf48cyczhfxpz9ifrg2dayvcn26m309dicqgjqkz91hd",
-    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.6/notify_push-v0.6.6.tar.gz",
-    "version": "0.6.6",
+    "sha256": "1h2qa5j31jq2wzpsj69h8knm4jzg9i72p77l92l855n98r4iiws8",
+    "url": "https://github.com/nextcloud-releases/notify_push/releases/download/v0.6.7/notify_push-v0.6.7.tar.gz",
+    "version": "0.6.7",
     "description": "Push update support for desktop app.\n\nOnce the app is installed, the push binary needs to be setup. You can either use the setup wizard with `occ notify_push:setup` or see the [README](http://github.com/nextcloud/notify_push) for detailed setup instructions",
     "homepage": "",
     "licenses": [
@@ -280,9 +280,9 @@
     ]
   },
   "user_saml": {
-    "sha256": "0y5l66ig38202mg5zhy6yi72fz8fbsr7410q6qclxivna3gvyzrc",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v6.0.1/user_saml-v6.0.1.tar.gz",
-    "version": "6.0.1",
+    "sha256": "130zp1c3bf0whgsx2jc3yi21qi74phwv4sdlv8bn4s5bfp4pf8yg",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v6.1.0/user_saml-v6.1.0.tar.gz",
+    "version": "6.1.0",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
diff --git a/pkgs/servers/readarr/default.nix b/pkgs/servers/readarr/default.nix
index d828050ba85c6..c7dacb2ced509 100644
--- a/pkgs/servers/readarr/default.nix
+++ b/pkgs/servers/readarr/default.nix
@@ -8,13 +8,13 @@ let
     x86_64-darwin = "x64";
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   hash = {
-    x64-linux_hash = "sha256-WMLxga9U8AhqLmFQ1PYD4J4HMAIZ/jrxZn8S2P6syHM=";
-    arm64-linux_hash = "sha256-wIn10t4Qv2m1JaTtovq8Urup1OMp7w5bizVMn8ve0U0=";
-    x64-osx_hash = "sha256-mQgfxprTHPrJHbZYoijhjmSxJKPWvlMuWAAnW9AyNpU=";
+    x64-linux_hash = "sha256-i5ZlLHTV44hia3Vkm8Ht0vEN5XWjd9KJ4xOVNxrNxVE=";
+    arm64-linux_hash = "sha256-sX2Dn5/PfWdxh2qPDm2UbkqBIVpk+mb5CfuBwdPwloU=";
+    x64-osx_hash = "sha256-pBw0MnzxQ+dmRKARKB/Flr4ILS37Y2TVgIkRkjZyITo=";
   }."${arch}-${os}_hash";
 in stdenv.mkDerivation rec {
   pname = "readarr";
-  version = "0.3.14.2348";
+  version = "0.3.14.2358";
 
   src = fetchurl {
     url = "https://github.com/Readarr/Readarr/releases/download/v${version}/Readarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/sql/postgresql/ext/postgis.nix b/pkgs/servers/sql/postgresql/ext/postgis.nix
index fe6319d44f20b..65541730d296e 100644
--- a/pkgs/servers/sql/postgresql/ext/postgis.nix
+++ b/pkgs/servers/sql/postgresql/ext/postgis.nix
@@ -5,7 +5,7 @@
 , postgresql
 , geos
 , proj
-, gdal
+, gdalMinimal
 , json_c
 , pkg-config
 , file
@@ -14,6 +14,10 @@
 , pcre2
 , nixosTests
 }:
+
+let
+  gdal = gdalMinimal;
+in
 stdenv.mkDerivation rec {
   pname = "postgis";
   version = "3.4.1";
diff --git a/pkgs/tools/X11/screen-message/default.nix b/pkgs/tools/X11/screen-message/default.nix
index 3701684af8d8d..c049c3841ea61 100644
--- a/pkgs/tools/X11/screen-message/default.nix
+++ b/pkgs/tools/X11/screen-message/default.nix
@@ -1,12 +1,14 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, gtk3 }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, gtk3 }:
 
 stdenv.mkDerivation rec {
   pname = "screen-message";
-  version = "0.26";
+  version = "0.28";
 
-  src = fetchurl {
-    url = "mirror://debian/pool/main/s/screen-message/screen-message_${version}.orig.tar.gz";
-    sha256 = "sha256-vBKnuXOEQZDACmlNP9wjJ3NbIdixIx7I72a6Nj6pjzc=";
+  src = fetchFromGitHub {
+    owner = "nomeata";
+    repo = "screen-message";
+    rev = version;
+    hash = "sha256-KHJL1N72Hc1B1m0olxoZxBHIpq/d/T3m2VdS5XC9+tk=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/admin/wander/default.nix b/pkgs/tools/admin/wander/default.nix
index c3b086806ca10..52747f7477fd7 100644
--- a/pkgs/tools/admin/wander/default.nix
+++ b/pkgs/tools/admin/wander/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "wander";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "robinovitch61";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zz9DqRrylCbUCSBl4wspb8BYfmCyQhMmmYwdsbTExbo=";
+    sha256 = "sha256-MriFrYE8d4m6RgeaErunyAfKna8xhtUAnHyIwsVvK/o=";
   };
 
   vendorHash = "sha256-0S8tzP5yNUrH6fp+v7nbUPTMWzYXyGw+ZNcXkSN+tWY=";
diff --git a/pkgs/tools/audio/beets/builtin-plugins.nix b/pkgs/tools/audio/beets/builtin-plugins.nix
index e3bc102104418..ae6b7e17b26dc 100644
--- a/pkgs/tools/audio/beets/builtin-plugins.nix
+++ b/pkgs/tools/audio/beets/builtin-plugins.nix
@@ -14,6 +14,7 @@
   absubmit = {
     enable = lib.elem stdenv.hostPlatform.system essentia-extractor.meta.platforms;
     wrapperBins = [ essentia-extractor ];
+    testPaths = [ ];
   };
   acousticbrainz.propagatedBuildInputs = [ python3Packages.requests ];
   albumtypes = { };
diff --git a/pkgs/tools/graphics/vips/default.nix b/pkgs/tools/graphics/vips/default.nix
index c16ba635f5043..5c59971f955c3 100644
--- a/pkgs/tools/graphics/vips/default.nix
+++ b/pkgs/tools/graphics/vips/default.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vips";
-  version = "8.15.0";
+  version = "8.15.1";
 
   outputs = [ "bin" "out" "man" "dev" ] ++ lib.optionals (!stdenv.isDarwin) [ "devdoc" ];
 
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libvips";
     repo = "libvips";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-WfKq+maLcAXyjk1sq66wSU92ALv4MfRDPKe4Mki0KRQ=";
+    hash = "sha256-0zfYpOawH7XnTH9k8BdNDtZEKpYUlCXp7GY+fdXalsE=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
diff --git a/pkgs/tools/misc/fastfetch/default.nix b/pkgs/tools/misc/fastfetch/default.nix
index 3b0bdf4476db6..a180784b498ae 100644
--- a/pkgs/tools/misc/fastfetch/default.nix
+++ b/pkgs/tools/misc/fastfetch/default.nix
@@ -32,13 +32,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-W/6Ye7IJi46SKPY9gnvHNRYwTwxGCJ6oY3KVPzcFvNM=";
+    hash = "sha256-cjNVN/2N/CiItsysZFJNL0mqXL6B86BihjDJ7IwD1a4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index 9412973404395..ffcf397ea1a17 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "i2pd";
-  version = "2.50.1";
+  version = "2.50.2";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = pname;
     rev = version;
-    sha256 = "sha256-LFr6vqhGu830xHLSp7kHud4gNWhDDYXfJ3PB01JmHjQ=";
+    sha256 = "sha256-6BzY7t+bFYYwKnj+uuX+vWHg0w0BOuMGwgMg1yIF578=";
   };
 
   buildInputs = [ boost zlib openssl ]
diff --git a/pkgs/tools/security/nuclei/default.nix b/pkgs/tools/security/nuclei/default.nix
index 6deca949204fe..17915567d46cc 100644
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "3.1.5";
+  version = "3.1.6";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     rev = "refs/tags/v${version}";
-    hash = "sha256-U6FEVlW7fr2COyPASja42M3hJX6eAo4pH3kyl9APfG0=";
+    hash = "sha256-Xtebrmd1M46slPX/0nQRo2CEA4mGOZiUxhlokXdYReA=";
   };
 
-  vendorHash = "sha256-/Pw1m8cWYDPCS7EcveqDdmRQtP7R3sr3hvLLw/FBftU=";
+  vendorHash = "sha256-x2bx5A09hYtsn7BROXZbB8X8gFN1zI5Jg51HYZPYIno=";
 
   subPackages = [
     "cmd/nuclei/"
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 0f1cc974b4b3b..e7e31b204d470 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sudo";
-  version = "1.9.15p4";
+  version = "1.9.15p5";
 
   src = fetchurl {
     url = "https://www.sudo.ws/dist/${pname}-${version}.tar.gz";
-    hash = "sha256-LiDsmGXu7qExbG9J7GrEZ4hptonU2QtEJDv0iH1t1TI=";
+    hash = "sha256-VY0QuaGZH7O5+n+nsH7EQFt677WzywsIcdvIHjqI5Vg=";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/system/kanata/default.nix b/pkgs/tools/system/kanata/default.nix
index 706382d3dd04e..eab7fb3d4b17c 100644
--- a/pkgs/tools/system/kanata/default.nix
+++ b/pkgs/tools/system/kanata/default.nix
@@ -1,4 +1,6 @@
-{ lib
+{ stdenv
+, lib
+, darwin
 , rustPlatform
 , fetchFromGitHub
 , withCmd ? false
@@ -17,8 +19,15 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-IzgVF6SHJjOB48VehQ5taD5iWQXFKLcVBWTEl3ArkGQ=";
 
+  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.IOKit ];
+
   buildFeatures = lib.optional withCmd "cmd";
 
+  # Workaround for https://github.com/nixos/nixpkgs/issues/166205
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_LDFLAGS = "-l${stdenv.cc.libcxx.cxxabi.libName}";
+  };
+
   postInstall = ''
     install -Dm 444 assets/kanata-icon.svg $out/share/icons/hicolor/scalable/apps/kanata.svg
   '';
@@ -27,8 +36,8 @@ rustPlatform.buildRustPackage rec {
     description = "A tool to improve keyboard comfort and usability with advanced customization";
     homepage = "https://github.com/jtroo/kanata";
     license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ linj ];
-    platforms = platforms.linux;
+    maintainers = with maintainers; [ bmanuel linj ];
+    platforms = platforms.unix;
     mainProgram = "kanata";
   };
 }
diff --git a/pkgs/tools/text/autocorrect/Cargo.lock b/pkgs/tools/text/autocorrect/Cargo.lock
index 82fb056857c2a..5e272adb048d7 100644
--- a/pkgs/tools/text/autocorrect/Cargo.lock
+++ b/pkgs/tools/text/autocorrect/Cargo.lock
@@ -19,9 +19,9 @@ checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "aho-corasick"
-version = "1.0.5"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c378d78423fdad8089616f827526ee33c19f2fddbd5de1629152c9593ba4783"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
  "memchr",
 ]
@@ -34,9 +34,9 @@ checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
 
 [[package]]
 name = "anstream"
-version = "0.5.0"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f58811cfac344940f1a400b6e6231ce35171f614f26439e80f8c1465c5cc0c"
+checksum = "d664a92ecae85fd0a7392615844904654d1d5f5514837f471ddef4a057aba1b6"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -48,36 +48,36 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b84bf0a05bbb2a83e5eb6fa36bb6e87baa08193c35ff52bbf6b38d8af2890e46"
+checksum = "7079075b41f533b8c61d2a4d073c4676e1f8b249ff94a393b0595db304e0dd87"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.1"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "938874ff5980b03a87c5524b3ae5b59cf99b1d6bc836848df7bc5ada9643c333"
+checksum = "c75ac65da39e5fe5ab759307499ddad880d724eed2f6ce5b5e8a26f4f387928c"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.0.0"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca11d4be1bab0c8bc8734a9aa7bf4ee8316d462a08c6ac5052f888fef5b494b"
+checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "2.1.0"
+version = "3.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58f54d10c6dfa51283a066ceab3ec1ab78d13fae00aa49243a45e4571fb79dfd"
+checksum = "1cd54b81ec8d6180e24654d0b371ad22fc3dd083b6ff8ba325b72e00c87660a7"
 dependencies = [
  "anstyle",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -88,7 +88,7 @@ checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
 name = "autocorrect"
-version = "2.8.5"
+version = "2.9.0"
 dependencies = [
  "autocorrect-derive 0.3.0",
  "criterion",
@@ -109,9 +109,9 @@ dependencies = [
 
 [[package]]
 name = "autocorrect"
-version = "2.8.5"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2aa23c243abf88a533e514d8e5455e668daa3a8ca93061d8eb7f22014d7ad1a"
+checksum = "b426e7dbc9997d772eeb5436cbb85e95136fdf7835a8f05085b811e5482ebd49"
 dependencies = [
  "autocorrect-derive 0.3.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "diff",
@@ -129,9 +129,9 @@ dependencies = [
 
 [[package]]
 name = "autocorrect-cli"
-version = "2.8.5"
+version = "2.9.0"
 dependencies = [
- "autocorrect 2.8.5",
+ "autocorrect 2.9.0",
  "clap",
  "ignore",
  "lazy_static",
@@ -166,17 +166,17 @@ dependencies = [
 
 [[package]]
 name = "autocorrect-java"
-version = "2.8.5"
+version = "2.9.0"
 dependencies = [
- "autocorrect 2.8.5",
+ "autocorrect 2.9.0",
  "jni",
 ]
 
 [[package]]
 name = "autocorrect-node"
-version = "2.8.5"
+version = "2.9.0"
 dependencies = [
- "autocorrect 2.8.5",
+ "autocorrect 2.9.0",
  "autocorrect-cli",
  "napi",
  "napi-build",
@@ -185,25 +185,25 @@ dependencies = [
 
 [[package]]
 name = "autocorrect-py"
-version = "2.8.5"
+version = "2.9.0"
 dependencies = [
- "autocorrect 2.8.5",
+ "autocorrect 2.9.0",
  "pyo3",
 ]
 
 [[package]]
 name = "autocorrect-rb"
-version = "2.8.5"
+version = "2.9.0"
 dependencies = [
- "autocorrect 2.8.5 (registry+https://github.com/rust-lang/crates.io-index)",
+ "autocorrect 2.9.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "magnus",
 ]
 
 [[package]]
 name = "autocorrect-wasm"
-version = "2.8.5"
+version = "2.9.0"
 dependencies = [
- "autocorrect 2.8.5",
+ "autocorrect 2.9.0",
  "serde",
  "serde_json",
  "wasm-bindgen",
@@ -226,17 +226,17 @@ dependencies = [
 
 [[package]]
 name = "base64"
-version = "0.21.4"
+version = "0.21.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ba43ea6f343b788c8764558649e08df62f86c6ef251fdaeb1ffd010a9ae50a2"
+checksum = "35636a1494ede3b646cc98f74f8e62c773a38a659ebc777a2cf26b9b74171df9"
 
 [[package]]
 name = "bindgen"
-version = "0.66.1"
+version = "0.69.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2b84e06fc203107bfbad243f4aba2af864eb7db3b1cf46ea0a023b0b433d2a7"
+checksum = "9ffcebc3849946a7170a05992aac39da343a90676ab392c51a4280981d6379c2"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.1",
  "cexpr",
  "clang-sys",
  "lazy_static",
@@ -247,7 +247,7 @@ dependencies = [
  "regex",
  "rustc-hash",
  "shlex",
- "syn 2.0.33",
+ "syn 2.0.40",
 ]
 
 [[package]]
@@ -258,9 +258,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.4.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
 
 [[package]]
 name = "block-buffer"
@@ -273,9 +273,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.6.2"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c2f7349907b712260e64b0afe2f84692af14a454be26187d9df565c7f69266a"
+checksum = "542f33a8835a0884b006a0c3df3dadd99c0c3f296ed26c2fdc8028e01ad6230c"
 dependencies = [
  "memchr",
  "serde",
@@ -364,14 +364,14 @@ checksum = "c688fc74432808e3eb684cae8830a86be1d66a2bd58e1f248ed0960a590baf6f"
 dependencies = [
  "glob",
  "libc",
- "libloading",
+ "libloading 0.7.4",
 ]
 
 [[package]]
 name = "clap"
-version = "4.4.3"
+version = "4.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84ed82781cea27b43c9b106a979fe450a13a31aab0500595fb3fc06616de08e6"
+checksum = "bfaff671f6b22ca62406885ece523383b9b64022e341e53e009a62ebc47a45f2"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -379,9 +379,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.4.2"
+version = "4.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bb9faaa7c2ef94b2743a21f5a29e6f0010dff4caa69ac8e9d6cf8b6fa74da08"
+checksum = "a216b506622bb1d316cd51328dce24e07bdff4a6128a47c7e7fad11878d5adbb"
 dependencies = [
  "anstream",
  "anstyle",
@@ -391,21 +391,21 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.4.2"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0862016ff20d69b84ef8247369fabf5c008a7417002411897d40ee1f4532b873"
+checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.33",
+ "syn 2.0.40",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "0.5.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd7cc57abe963c6d3b9d8be5b06ba7c8957a930305ca90304f24ef040aa6f961"
+checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"
 
 [[package]]
 name = "colorchoice"
@@ -445,10 +445,26 @@ dependencies = [
 ]
 
 [[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
+
+[[package]]
 name = "cpufeatures"
-version = "0.2.9"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
+checksum = "ce420fe07aecd3e67c5f910618fe65e94158f6dcc0adf44e00d69ce2bdfe0fd0"
 dependencies = [
  "libc",
 ]
@@ -499,16 +515,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "crossbeam-channel"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
-]
-
-[[package]]
 name = "crossbeam-deque"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -553,12 +559,12 @@ dependencies = [
 
 [[package]]
 name = "ctor"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f34ba9a9bcb8645379e9de8cb3ecfcf4d1c85ba66d90deb3259206fa5aa193b"
+checksum = "37e366bff8cd32dd8754b0991fb66b279dc48f598c3a18914852a6673deef583"
 dependencies = [
  "quote",
- "syn 2.0.33",
+ "syn 2.0.40",
 ]
 
 [[package]]
@@ -606,48 +612,37 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "136526188508e25c6fef639d7927dfb3e0e3084488bf202267829cf7fc23dbdd"
-dependencies = [
- "errno-dragonfly",
- "libc",
- "windows-sys 0.48.0",
-]
-
-[[package]]
-name = "errno-dragonfly"
-version = "0.1.2"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
 dependencies = [
- "cc",
  "libc",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "fastrand"
-version = "2.0.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6999dc1837253364c2ebb0704ba97994bd874e8f195d665c50b7548f6ea92764"
+checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
 
 [[package]]
 name = "filetime"
-version = "0.2.22"
+version = "0.2.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4029edd3e734da6fe05b6cd7bd2960760a616bd2ddd0d59a0124746d6272af0"
+checksum = "1ee447700ac8aa0b2f2bd7bc4462ad686ba06baa6727ac149a2d6277f0d240fd"
 dependencies = [
  "cfg-if",
  "libc",
  "redox_syscall",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "flate2"
-version = "1.0.27"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6c98ee8095e9d1dcbf2fcc6d95acccb90d1c81db1e44725c6a984b1dbdfb010"
+checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -661,66 +656,54 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "form_urlencoded"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
+checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
 dependencies = [
  "percent-encoding",
 ]
 
 [[package]]
 name = "futures-channel"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2"
+checksum = "ff4dd66668b557604244583e3e1e1eada8c5c2e96a6d0d6653ede395b78bbacb"
 dependencies = [
  "futures-core",
 ]
 
 [[package]]
 name = "futures-core"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bca583b7e26f571124fe5b7561d49cb2868d79116cfa0eefce955557c6fee8c"
+checksum = "eb1d22c66e66d9d72e1758f0bd7d4fd0bee04cad842ee34587d68c07e45d088c"
 
 [[package]]
 name = "futures-io"
-version = "0.3.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fff74096e71ed47f8e023204cfd0aa1289cd54ae5430a9523be060cdb849964"
-
-[[package]]
-name = "futures-macro"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.33",
-]
+checksum = "8bf34a163b5c4c52d0478a4d757da8fb65cabef42ba90515efee0f6f9fa45aaa"
 
 [[package]]
 name = "futures-sink"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f43be4fe21a13b9781a69afa4985b0f6ee0e1afab2c6f454a8cf30e2b2237b6e"
+checksum = "e36d3378ee38c2a36ad710c5d30c2911d752cb941c00c72dbabfb786a7970817"
 
 [[package]]
 name = "futures-task"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76d3d132be6c0e6aa1534069c705a74a5997a356c0dc2f86a47765e5617c5b65"
+checksum = "efd193069b0ddadc69c46389b740bbccdd97203899b48d09c5f7969591d6bae2"
 
 [[package]]
 name = "futures-util"
-version = "0.3.28"
+version = "0.3.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b01e40b772d54cf6c6d721c1d1abd0647a0106a12ecaa1c186273392a69533"
+checksum = "a19526d624e703a3179b3d322efec918b6246ea0fa51d41124525f00f1cc8104"
 dependencies = [
  "futures-core",
  "futures-io",
- "futures-macro",
  "futures-task",
  "memchr",
  "pin-project-lite",
@@ -739,10 +722,21 @@ dependencies = [
 ]
 
 [[package]]
+name = "getrandom"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe9006bed769170c11f845cf00c7c1e9092aeb3f268e007c3e760ac68008070f"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
 name = "gimli"
-version = "0.28.0"
+version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fb8d784f27acf97159b40fc4db5ecd8aa23b9ad5ef69cdd136d3bc80665f0c0"
+checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 
 [[package]]
 name = "glob"
@@ -752,22 +746,22 @@ checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
 
 [[package]]
 name = "globset"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "759c97c1e17c55525b57192c06a267cda0ac5210b222d6b82189a2338fa1c13d"
+checksum = "57da3b9b5b85bd66f31093f8c408b90a74431672542466497dcbdfdc02034be1"
 dependencies = [
  "aho-corasick",
  "bstr",
- "fnv",
  "log",
- "regex",
+ "regex-automata",
+ "regex-syntax",
 ]
 
 [[package]]
 name = "h2"
-version = "0.3.21"
+version = "0.3.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91fc23aa11be92976ef4729127f1a74adf36d8436f7816b185d18df956790833"
+checksum = "4d6250322ef6e60f93f9a2162799302cd6f68f79f6e5d85c8c16f14d1d958178"
 dependencies = [
  "bytes",
  "fnv",
@@ -775,7 +769,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http",
- "indexmap 1.9.3",
+ "indexmap",
  "slab",
  "tokio",
  "tokio-util",
@@ -790,15 +784,9 @@ checksum = "eabb4a44450da02c90444cf74558da904edde8fb4e9035a9a6a4e15445af0bd7"
 
 [[package]]
 name = "hashbrown"
-version = "0.12.3"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
-[[package]]
-name = "hashbrown"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
+checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
 
 [[package]]
 name = "heck"
@@ -808,15 +796,15 @@ checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
 
 [[package]]
 name = "hermit-abi"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "443144c8cdadd93ebf52ddb4056d257f5b52c04d3c804e657d19eb73fc33668b"
+checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
 
 [[package]]
 name = "http"
-version = "0.2.9"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd6effc99afb63425aff9b05836f029929e345a6148a14b7ecd5ab67af944482"
+checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
 dependencies = [
  "bytes",
  "fnv",
@@ -825,9 +813,9 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
 dependencies = [
  "bytes",
  "http",
@@ -863,7 +851,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2 0.4.9",
+ "socket2 0.4.10",
  "tokio",
  "tower-service",
  "tracing",
@@ -872,9 +860,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.24.1"
+version = "0.24.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d78e1e73ec14cf7375674f74d7dde185c8206fd9dea6fb6295e8a98098aaa97"
+checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
 dependencies = [
  "futures-util",
  "http",
@@ -886,9 +874,9 @@ dependencies = [
 
 [[package]]
 name = "idna"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
 dependencies = [
  "unicode-bidi",
  "unicode-normalization",
@@ -896,39 +884,28 @@ dependencies = [
 
 [[package]]
 name = "ignore"
-version = "0.4.20"
+version = "0.4.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbe7873dab538a9a44ad79ede1faf5f30d49f9a5c883ddbab48bce81b64b7492"
+checksum = "747ad1b4ae841a78e8aba0d63adbfbeaea26b517b63705d47856b73015d27060"
 dependencies = [
+ "crossbeam-deque",
  "globset",
- "lazy_static",
  "log",
  "memchr",
- "regex",
+ "regex-automata",
  "same-file",
- "thread_local",
  "walkdir",
  "winapi-util",
 ]
 
 [[package]]
 name = "indexmap"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
-]
-
-[[package]]
-name = "indexmap"
-version = "2.0.0"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5477fe2230a79769d8dc68e0eabf5437907c0457a5614a9e8dddb67f65eb65d"
+checksum = "d530e1a18b1cb4c484e6e34556a0d948706958449fca0cab753d649f2bce3d1f"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.0",
+ "hashbrown",
 ]
 
 [[package]]
@@ -951,9 +928,9 @@ checksum = "bfa799dd5ed20a7e349f3b4639aa80d74549c81716d9ec4f994c9b5815598306"
 
 [[package]]
 name = "ipnet"
-version = "2.8.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28b29a3cd74f0f4598934efe3aeba42bae0eb4680554128851ebbecb02af14e6"
+checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
 [[package]]
 name = "is-terminal"
@@ -977,9 +954,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+checksum = "b1a46d1a171d865aa5f83f92695765caa047a9b4cbae2cbf37dbd613a793fd4c"
 
 [[package]]
 name = "jni"
@@ -1003,9 +980,9 @@ checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
 
 [[package]]
 name = "js-sys"
-version = "0.3.64"
+version = "0.3.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
+checksum = "cee9c64da59eae3b50095c18d3e74f8b73c0b86d2792824ff01bbce68ba229ca"
 dependencies = [
  "wasm-bindgen",
 ]
@@ -1024,9 +1001,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.148"
+version = "0.2.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdc71e17332e86d2e1d38c1f99edcb6288ee11b815fb1a4b049eaa2114d369b"
+checksum = "302d7ab3130588088d277783b1e2d2e10c9e9e4a16dd9050e6ec93fb3e7048f4"
 
 [[package]]
 name = "libloading"
@@ -1039,16 +1016,26 @@ dependencies = [
 ]
 
 [[package]]
+name = "libloading"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c571b676ddfc9a8c12f1f3d3085a7b163966a8fd8098a90640953ce5f6170161"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
 name = "linux-raw-sys"
-version = "0.4.7"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a9bad9f94746442c783ca431b22403b519cd7fbeed0533fdd6328b2f2212128"
+checksum = "c4cd1a83af159aa67994778be9070f0ae1bd732942279cabb14f86f986a21456"
 
 [[package]]
 name = "lock_api"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+checksum = "3c168f8615b12bc01f9c17e2eb0cc07dcae1940121185446edc3744920e8ef45"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -1084,9 +1071,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.6.3"
+version = "2.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"
+checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
 
 [[package]]
 name = "memoffset"
@@ -1129,9 +1116,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "0.8.8"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "927a765cd3fc26206e66b296465fa9d3e5ab003e651c1b3c060e7956d96b19d2"
+checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
 dependencies = [
  "libc",
  "wasi",
@@ -1140,11 +1127,11 @@ dependencies = [
 
 [[package]]
 name = "napi"
-version = "2.13.3"
+version = "2.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd063c93b900149304e3ba96ce5bf210cd4f81ef5eb80ded0d100df3e85a3ac0"
+checksum = "1133249c46e92da921bafc8aba4912bf84d6c475f7625183772ed2d0844dc3a7"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.1",
  "ctor",
  "napi-derive",
  "napi-sys",
@@ -1154,15 +1141,15 @@ dependencies = [
 
 [[package]]
 name = "napi-build"
-version = "2.0.1"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "882a73d9ef23e8dc2ebbffb6a6ae2ef467c0f18ac10711e4cc59c5485d41df0e"
+checksum = "d4b4532cf86bfef556348ac65e561e3123879f0e7566cca6d43a6ff5326f13df"
 
 [[package]]
 name = "napi-derive"
-version = "2.13.0"
+version = "2.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da1c6a8fa84d549aa8708fcd062372bf8ec6e849de39016ab921067d21bde367"
+checksum = "2b0c0743f6a3f29c20851b8377f01d485a837e2bfa57dd56d519ab7ed98ae2af"
 dependencies = [
  "cfg-if",
  "convert_case",
@@ -1174,9 +1161,9 @@ dependencies = [
 
 [[package]]
 name = "napi-derive-backend"
-version = "1.0.52"
+version = "1.0.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20bbc7c69168d06a848f925ec5f0e0997f98e8c8d4f2cc30157f0da51c009e17"
+checksum = "4869e4d80615fdab57dffe38c36a5bc62fae37352a00a35ee7aca1cea41b1bb3"
 dependencies = [
  "convert_case",
  "once_cell",
@@ -1189,11 +1176,11 @@ dependencies = [
 
 [[package]]
 name = "napi-sys"
-version = "2.2.3"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "166b5ef52a3ab5575047a9fe8d4a030cdd0f63c96f071cd6907674453b07bae3"
+checksum = "2503fa6af34dc83fb74888df8b22afe933b58d37daf7d80424b1c60c68196b8b"
 dependencies = [
- "libloading",
+ "libloading 0.8.1",
 ]
 
 [[package]]
@@ -1208,9 +1195,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
 dependencies = [
  "autocfg",
 ]
@@ -1242,9 +1229,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "oorandom"
@@ -1270,9 +1257,9 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
 dependencies = [
  "cfg-if",
  "libc",
@@ -1289,15 +1276,15 @@ checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
 
 [[package]]
 name = "percent-encoding"
-version = "2.3.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pest"
-version = "2.7.3"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7a4d085fd991ac8d5b05a147b437791b4260b76326baf0fc60cf7c9c27ecd33"
+checksum = "ae9cee2a55a544be8b89dc6848072af97a20f2422603c10865be2a42b580fff5"
 dependencies = [
  "memchr",
  "thiserror",
@@ -1306,9 +1293,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.7.3"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bee7be22ce7918f641a33f08e3f43388c7656772244e2bbb2477f44cc9021a"
+checksum = "81d78524685f5ef2a3b3bd1cafbc9fcabb036253d9b1463e726a91cd16e2dfc2"
 dependencies = [
  "pest",
  "pest_generator",
@@ -1316,22 +1303,22 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.7.3"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1511785c5e98d79a05e8a6bc34b4ac2168a0e3e92161862030ad84daa223141"
+checksum = "68bd1206e71118b5356dae5ddc61c8b11e28b09ef6a31acbd15ea48a28e0c227"
 dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.33",
+ "syn 2.0.40",
 ]
 
 [[package]]
 name = "pest_meta"
-version = "2.7.3"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b42f0394d3123e33353ca5e1e89092e533d2cc490389f2bd6131c43c634ebc5f"
+checksum = "7c747191d4ad9e4a4ab9c8798f1e82a39affe7ef9648390b7e5548d18e099de6"
 dependencies = [
  "once_cell",
  "pest",
@@ -1390,9 +1377,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.67"
+version = "1.0.70"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d433d9f1a3e8c1263d9456598b16fec66f4acc9a74dacffd35c7bb09b3a1328"
+checksum = "39278fbbf5fb4f646ce651690877f89d1c5811a3d4acb27700c1cb3cdb78fd3b"
 dependencies = [
  "unicode-ident",
 ]
@@ -1477,9 +1464,9 @@ dependencies = [
 
 [[package]]
 name = "rayon"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b"
+checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
 dependencies = [
  "either",
  "rayon-core",
@@ -1487,30 +1474,28 @@ dependencies = [
 
 [[package]]
 name = "rayon-core"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d"
+checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
 dependencies = [
- "crossbeam-channel",
  "crossbeam-deque",
  "crossbeam-utils",
- "num_cpus",
 ]
 
 [[package]]
 name = "rb-sys"
-version = "0.9.81"
+version = "0.9.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a57240b308b155b09dce81e32829966a99f52d1088b45957e4283e526c5317a1"
+checksum = "7e5b8d560b60790a3e60e56e73a8c7be88ac14e6af39fc82b5eca72c71753840"
 dependencies = [
  "rb-sys-build",
 ]
 
 [[package]]
 name = "rb-sys-build"
-version = "0.9.81"
+version = "0.9.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f24ce877a4c5d07f06f6aa6fec3ac95e4b357b9f73b0f5445d8cbb7266d410e8"
+checksum = "c2d2bfd00002007d7e9ad93d0397437933040caf452d260c26dbef5fd95ae1a6"
 dependencies = [
  "bindgen",
  "lazy_static",
@@ -1518,7 +1503,7 @@ dependencies = [
  "quote",
  "regex",
  "shell-words",
- "syn 2.0.33",
+ "syn 2.0.40",
 ]
 
 [[package]]
@@ -1529,18 +1514,18 @@ checksum = "a35802679f07360454b418a5d1735c89716bde01d35b1560fc953c1415a0b3bb"
 
 [[package]]
 name = "redox_syscall"
-version = "0.3.5"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+checksum = "4722d768eff46b75989dd134e5c353f0d6296e5aaa3132e776cbdb56be7731aa"
 dependencies = [
  "bitflags 1.3.2",
 ]
 
 [[package]]
 name = "regex"
-version = "1.9.5"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "697061221ea1b4a94a624f67d0ae2bfe4e22b8a17b6a192afb11046542cc8c47"
+checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1550,9 +1535,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.3.8"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2f401f4955220693b56f8ec66ee9c78abffd8d1c4f23dc41a23839eb88f0795"
+checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1561,15 +1546,15 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.5"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "reqwest"
-version = "0.11.20"
+version = "0.11.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e9ad3fe7488d7e34558a2033d45a0c90b72d97b4f80705666fea71472e2e6a1"
+checksum = "046cd98826c46c2ac8ddecae268eb5c2e58628688a5fc7a2643704a73faba95b"
 dependencies = [
  "base64",
  "bytes",
@@ -1593,6 +1578,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
+ "system-configuration",
  "tokio",
  "tokio-rustls",
  "tower-service",
@@ -1606,17 +1592,16 @@ dependencies = [
 
 [[package]]
 name = "ring"
-version = "0.16.20"
+version = "0.17.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+checksum = "688c63d65483050968b2a8937f7995f443e27041a0f7700aa59b0822aedebb74"
 dependencies = [
  "cc",
+ "getrandom",
  "libc",
- "once_cell",
  "spin",
  "untrusted",
- "web-sys",
- "winapi",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -1633,22 +1618,22 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustix"
-version = "0.38.13"
+version = "0.38.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7db8590df6dfcd144d22afd1b83b36c21a18d7cbc1dc4bb5295a8712e9eb662"
+checksum = "72e572a5e8ca657d7366229cdde4bd14c4eb5499a9573d4d366fe1b599daa316"
 dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.4.1",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.48.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.21.7"
+version = "0.21.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd8d6c9f025a446bc4d18ad9632e69aec8f287aa84499ee335599fabd20c3fd8"
+checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
 dependencies = [
  "log",
  "ring",
@@ -1658,18 +1643,18 @@ dependencies = [
 
 [[package]]
 name = "rustls-pemfile"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d3987094b1d07b653b7dfdc3f70ce9a1da9c51ac18c1b06b662e4f9a0e9f4b2"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
 dependencies = [
  "base64",
 ]
 
 [[package]]
 name = "rustls-webpki"
-version = "0.101.5"
+version = "0.101.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45a27e3b59326c16e23d30aeb7a36a24cc0d29e71d68ff611cdfb4a01d013bed"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
 dependencies = [
  "ring",
  "untrusted",
@@ -1677,9 +1662,9 @@ dependencies = [
 
 [[package]]
 name = "ryu"
-version = "1.0.15"
+version = "1.0.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
+checksum = "f98d2aa92eebf49b69786be48e4477826b256916e84a57ff2a4f21923b48eb4c"
 
 [[package]]
 name = "same-file"
@@ -1698,9 +1683,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "sct"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
 dependencies = [
  "ring",
  "untrusted",
@@ -1728,35 +1713,35 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.18"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0293b4b29daaf487284529cc2f5675b8e57c61f70167ba415a463651fd6a918"
+checksum = "836fa6a3e1e547f9a2c4040802ec865b5d85f4014efe00555d7090a3dcaa1090"
 
 [[package]]
 name = "serde"
-version = "1.0.188"
+version = "1.0.193"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
+checksum = "25dd9975e68d0cb5aa1120c288333fc98731bd1dd12f561e468ea4728c042b89"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.188"
+version = "1.0.193"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
+checksum = "43576ca501357b9b071ac53cdc7da8ef0cbd9493d8df094cd821777ea6e894d3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.33",
+ "syn 2.0.40",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.107"
+version = "1.0.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
+checksum = "3d1c7e3eac408d115102c4c24ad393e0821bb3a5df4d506a80f85f7a742a526b"
 dependencies = [
  "itoa",
  "ryu",
@@ -1765,13 +1750,13 @@ dependencies = [
 
 [[package]]
 name = "serde_repr"
-version = "0.1.16"
+version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8725e1dfadb3a50f7e5ce0b1a540466f6ed3fe7a0fca2ac2b8b831d31316bd00"
+checksum = "3081f5ffbb02284dda55132aa26daecedd7372a42417bbbab6f14ab7d6bb9145"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.33",
+ "syn 2.0.40",
 ]
 
 [[package]]
@@ -1788,11 +1773,11 @@ dependencies = [
 
 [[package]]
 name = "serde_yaml"
-version = "0.9.25"
+version = "0.9.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a49e178e4452f45cb61d0cd8cebc1b0fafd3e41929e996cef79aa3aca91f574"
+checksum = "3cc7a1570e38322cfe4154732e5110f887ea57e22b76f4bfd32b5bdd3368666c"
 dependencies = [
- "indexmap 2.0.0",
+ "indexmap",
  "itoa",
  "ryu",
  "serde",
@@ -1801,9 +1786,9 @@ dependencies = [
 
 [[package]]
 name = "sha2"
-version = "0.10.7"
+version = "0.10.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479fb9d862239e610720565ca91403019f2f00410f1864c5aa7479b950a76ed8"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
 dependencies = [
  "cfg-if",
  "cpufeatures",
@@ -1833,15 +1818,15 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.11.0"
+version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb4feee49fdd9f707ef802e22365a35de4b7b299de4763d44bfea899442ff9"
+checksum = "4dccd0940a2dcdf68d092b8cbab7dc0ad8fa938bf95787e1b916b0e3d0e8e970"
 
 [[package]]
 name = "socket2"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64a4a911eed85daf18834cfaa86a79b7d266ff93ff5ba14005426219480ed662"
+checksum = "9f7916fc008ca5542385b89a3d3ce689953c143e9304a9bf8beec1de48994c0d"
 dependencies = [
  "libc",
  "winapi",
@@ -1849,9 +1834,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.5.4"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4031e820eb552adee9295814c0ced9e5cf38ddf1e8b7d566d6de8e2538ea989e"
+checksum = "7b5fac59a5cb5dd637972e5fca70daf0523c9067fcdc4842f053dae04a18f8e9"
 dependencies = [
  "libc",
  "windows-sys 0.48.0",
@@ -1859,9 +1844,9 @@ dependencies = [
 
 [[package]]
 name = "spin"
-version = "0.5.2"
+version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
 [[package]]
 name = "strsim"
@@ -1892,9 +1877,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.33"
+version = "2.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9caece70c63bfba29ec2fed841a09851b14a235c60010fa4de58089b6c025668"
+checksum = "13fa70a4ee923979ffb522cacce59d34421ebdea5625e1073c4326ef9d2dd42e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1902,6 +1887,27 @@ dependencies = [
 ]
 
 [[package]]
+name = "system-configuration"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
 name = "tar"
 version = "0.4.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1914,15 +1920,15 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.11"
+version = "0.12.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d0e916b1148c8e263850e1ebcbd046f333e0683c724876bb0da63ea4373dc8a"
+checksum = "14c39fd04924ca3a864207c66fc2cd7d22d7c016007f9ce846cbb9326331930a"
 
 [[package]]
 name = "tempfile"
-version = "3.8.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
+checksum = "7ef1adac450ad7f4b3c28589471ade84f25f731a7a0fe30d71dfa9f60fd808e5"
 dependencies = [
  "cfg-if",
  "fastrand",
@@ -1933,32 +1939,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.48"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d6d7a740b8a666a7e828dd00da9c0dc290dff53154ea77ac109281de90589b7"
+checksum = "f9a7210f5c9a7156bb50aa36aed4c95afb51df0df00713949448cf9e97d382d2"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.48"
+version = "1.0.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49922ecae66cc8a249b77e68d1d0623c1b2c514f0060c27cdc68bd62a1219d35"
+checksum = "266b2e40bc00e5a6c09c3584011e08b06f123c00362c92b975ba9843aaaa14b8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.33",
-]
-
-[[package]]
-name = "thread_local"
-version = "1.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdd6f064ccff2d6567adcb3873ca630700f00b5ad3f060c25b5dcfd9a4ce152"
-dependencies = [
- "cfg-if",
- "once_cell",
+ "syn 2.0.40",
 ]
 
 [[package]]
@@ -1997,9 +1993,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.32.0"
+version = "1.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17ed6077ed6cd6c74735e21f37eb16dc3935f96878b1fe961074089cc80893f9"
+checksum = "841d45b238a16291a4e1584e61820b8ae57d696cc5015c459c229ccc6990cc1c"
 dependencies = [
  "backtrace",
  "bytes",
@@ -2007,20 +2003,20 @@ dependencies = [
  "mio",
  "num_cpus",
  "pin-project-lite",
- "socket2 0.5.4",
+ "socket2 0.5.5",
  "tokio-macros",
  "windows-sys 0.48.0",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.1.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630bdcf245f78637c13ec01ffae6187cca34625e8c63150d424b59e55af2675e"
+checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.33",
+ "syn 2.0.40",
 ]
 
 [[package]]
@@ -2035,9 +2031,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.8"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "806fe8c2c87eccc8b3267cbae29ed3ab2d0bd37fca70ab622e46aaa9375ddb7d"
+checksum = "5419f34732d9eb6ee4c3578b7989078579b7f039cbbb9ca2c4da015749371e15"
 dependencies = [
  "bytes",
  "futures-core",
@@ -2055,35 +2051,34 @@ checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
 
 [[package]]
 name = "tracing"
-version = "0.1.37"
+version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
- "cfg-if",
  "pin-project-lite",
  "tracing-core",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.31"
+version = "0.1.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0955b8137a1df6f1a2e9a37d8a6656291ff0297c1a97c24e0d8425fe2312f79a"
+checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
 dependencies = [
  "once_cell",
 ]
 
 [[package]]
 name = "try-lock"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "typenum"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
 name = "ucd-trie"
@@ -2093,9 +2088,9 @@ checksum = "ed646292ffc8188ef8ea4d1e0e0150fb15a5c2e12ad9b8fc191ae7a8a7f3c4b9"
 
 [[package]]
 name = "unicode-bidi"
-version = "0.3.13"
+version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
+checksum = "6f2528f27a9eb2b21e69c95319b30bd0efd85d09c379741b0f78ea1d86be2416"
 
 [[package]]
 name = "unicode-ident"
@@ -2132,15 +2127,15 @@ checksum = "f28467d3e1d3c6586d8f25fa243f544f5800fec42d97032474e17222c2b75cfa"
 
 [[package]]
 name = "untrusted"
-version = "0.7.1"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "143b538f18257fac9cad154828a57c6bf5157e1aa604d4816b5995bf6de87ae5"
+checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -2186,9 +2181,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.87"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
+checksum = "0ed0d4f68a3015cc185aff4db9506a015f4b96f95303897bfa23f846db54064e"
 dependencies = [
  "cfg-if",
  "serde",
@@ -2198,24 +2193,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.87"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
+checksum = "1b56f625e64f3a1084ded111c4d5f477df9f8c92df113852fa5a374dbda78826"
 dependencies = [
  "bumpalo",
  "log",
  "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.33",
+ "syn 2.0.40",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.37"
+version = "0.4.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c02dbc21516f9f1f04f187958890d7e6026df8d16540b7ad9492bc34a67cea03"
+checksum = "ac36a15a220124ac510204aec1c3e5db8a22ab06fd6706d881dc6149f8ed9a12"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -2225,9 +2220,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.87"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
+checksum = "0162dbf37223cd2afce98f3d0785506dcb8d266223983e4b5b525859e6e182b2"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2235,28 +2230,28 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.87"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
+checksum = "f0eb82fcb7930ae6219a7ecfd55b217f5f0893484b7a13022ebb2b2bf20b5283"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.33",
+ "syn 2.0.40",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.87"
+version = "0.2.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
+checksum = "7ab9b36309365056cd639da3134bf87fa8f3d86008abf99e612384a6eecd459f"
 
 [[package]]
 name = "web-sys"
-version = "0.3.64"
+version = "0.3.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b85cbef8c220a6abc02aefd892dfc0fc23afb1c6a426316ec33253a3877249b"
+checksum = "50c24a44ec86bb68fbecd1b3efed7e85ea5621b39b35ef2766b66cd984f8010f"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -2264,9 +2259,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-roots"
-version = "0.25.2"
+version = "0.25.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14247bb57be4f377dfb94c72830b8ce8fc6beac03cf4bf7b9732eadd414123fc"
+checksum = "1778a42e8b3b90bff8d0f5032bf22250792889a5cdc752aa0020c84abe3aaf10"
 
 [[package]]
 name = "winapi"
@@ -2286,9 +2281,9 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
 dependencies = [
  "winapi",
 ]
@@ -2318,6 +2313,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.0",
+]
+
+[[package]]
 name = "windows-targets"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2348,6 +2352,21 @@ dependencies = [
 ]
 
 [[package]]
+name = "windows-targets"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a18201040b24831fbb9e4eb208f8892e1f50a37feb53cc7ff887feb8f50e7cd"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.0",
+ "windows_aarch64_msvc 0.52.0",
+ "windows_i686_gnu 0.52.0",
+ "windows_i686_msvc 0.52.0",
+ "windows_x86_64_gnu 0.52.0",
+ "windows_x86_64_gnullvm 0.52.0",
+ "windows_x86_64_msvc 0.52.0",
+]
+
+[[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2360,6 +2379,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 
 [[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7764e35d4db8a7921e09562a0304bf2f93e0a51bfccee0bd0bb0b666b015ea"
+
+[[package]]
 name = "windows_aarch64_msvc"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2372,6 +2397,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbaa0368d4f1d2aaefc55b6fcfee13f41544ddf36801e793edbbfd7d7df075ef"
+
+[[package]]
 name = "windows_i686_gnu"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2384,6 +2415,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
+name = "windows_i686_gnu"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a28637cb1fa3560a16915793afb20081aba2c92ee8af57b4d5f28e4b3e7df313"
+
+[[package]]
 name = "windows_i686_msvc"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2396,6 +2433,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
+name = "windows_i686_msvc"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffe5e8e31046ce6230cc7215707b816e339ff4d4d67c65dffa206fd0f7aa7b9a"
+
+[[package]]
 name = "windows_x86_64_gnu"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2408,6 +2451,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 
 [[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d6fa32db2bc4a2f5abeacf2b69f7992cd09dca97498da74a151a3132c26befd"
+
+[[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2420,6 +2469,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a657e1e9d3f514745a572a6846d3c7aa7dbe1658c056ed9c3344c4109a6949e"
+
+[[package]]
 name = "windows_x86_64_msvc"
 version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2432,6 +2487,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"
+
+[[package]]
 name = "winreg"
 version = "0.50.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2443,11 +2504,13 @@ dependencies = [
 
 [[package]]
 name = "xattr"
-version = "1.0.1"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4686009f71ff3e5c4dbcf1a282d0a44db3f021ba69350cd42086b3e5f1c6985"
+checksum = "d367426ae76bdfce3d8eaea6e94422afd6def7d46f9c89e2980309115b3c2c41"
 dependencies = [
  "libc",
+ "linux-raw-sys",
+ "rustix",
 ]
 
 [[package]]
diff --git a/pkgs/tools/text/autocorrect/default.nix b/pkgs/tools/text/autocorrect/default.nix
index fa1214762b296..676eec70076ce 100644
--- a/pkgs/tools/text/autocorrect/default.nix
+++ b/pkgs/tools/text/autocorrect/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, Security }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, Security, SystemConfiguration }:
 
 rustPlatform.buildRustPackage rec {
   pname = "autocorrect";
-  version = "2.8.5";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "huacnlee";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-j59yCGGV6yiT6o+VKM1FPh87T4QG0qAeKgcKIAqpx+8=";
+    sha256 = "sha256-NCDJoKOH4ZaXtGXZ7bgOXrjgrY8Edui+EOOI8/yfW08=";
   };
 
   cargoLock = {
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
     cp ${./Cargo.lock} Cargo.lock
   '';
 
-  buildInputs = lib.optional stdenv.isDarwin Security;
+  buildInputs = lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
   cargoBuildFlags = [ "-p" "autocorrect-cli" ];
   cargoTestFlags = [ "-p" "autocorrect-cli" ];
diff --git a/pkgs/tools/text/crowdin-cli/default.nix b/pkgs/tools/text/crowdin-cli/default.nix
index c02021790ca0b..2d7821156cadc 100644
--- a/pkgs/tools/text/crowdin-cli/default.nix
+++ b/pkgs/tools/text/crowdin-cli/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "crowdin-cli";
-  version = "3.16.0";
+  version = "3.16.1";
 
   src = fetchurl {
     url = "https://github.com/crowdin/${pname}/releases/download/${version}/${pname}.zip";
-    hash = "sha256-/K9K82ioF/fczDY3kaNXUm0TdA9Y6xaUUYUIiRgWKvo=";
+    hash = "sha256-B68pCNQYly/0OQJkSjztP08bQGaGQeE+AAOiu5VbszY=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper unzip ];
diff --git a/pkgs/tools/text/fanficfare/default.nix b/pkgs/tools/text/fanficfare/default.nix
index 7d27a45b56fd1..f60832e29bc2e 100644
--- a/pkgs/tools/text/fanficfare/default.nix
+++ b/pkgs/tools/text/fanficfare/default.nix
@@ -2,20 +2,28 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "FanFicFare";
-  version = "4.25.0";
+  version = "4.29.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ky6N/AcfoXJahW7tw++WtnpTnpRv4ZUraMTWjVXDjEE=";
+    hash = "sha256-dfPb/PWguUIUAR3EdriPygs5sozc69WZmN9bcqrNPFM=";
   };
 
+  nativeBuildInputs = with python3Packages; [
+    setuptools
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     beautifulsoup4
+    brotli
     chardet
     cloudscraper
     html5lib
     html2text
+    requests
     requests-file
+    urllib3
   ];
 
   doCheck = false; # no tests exist
diff --git a/pkgs/tools/text/mecab/default.nix b/pkgs/tools/text/mecab/default.nix
index 8d11343515d0a..f1f9fc6503c81 100644
--- a/pkgs/tools/text/mecab/default.nix
+++ b/pkgs/tools/text/mecab/default.nix
@@ -17,6 +17,6 @@ stdenv.mkDerivation (finalAttrs: ((mecab-base finalAttrs) // {
     license = licenses.bsd3;
     platforms = platforms.unix;
     mainProgram = "mecab";
-    maintainers = with maintainers; [ auntie paveloom ];
+    maintainers = with maintainers; [ auntie ];
   };
 }))
diff --git a/pkgs/tools/virtualization/govc/default.nix b/pkgs/tools/virtualization/govc/default.nix
index 9c9fb8f2c8fba..e3fd16538e4d3 100644
--- a/pkgs/tools/virtualization/govc/default.nix
+++ b/pkgs/tools/virtualization/govc/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "govc";
-  version = "0.34.1";
+  version = "0.34.2";
 
   subPackages = [ "govc" ];
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "sha256-c31omDUjd5VywvYNLTjk5FQlqNRnFPLJ0eVEJLdF6N0=";
+    sha256 = "sha256-UrGHuzUZvXWZRy4VJ1HlMBs2C8MuaUYhM6dlYIoG7vE=";
   };
 
   vendorHash = "sha256-1Y2Q2Ep3aqhUCSWey+sD4m7CgVEjlPt6ri3OKV8eERU=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 73c9a39e52478..7b9608b5dac95 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1721,8 +1721,6 @@ with pkgs;
 
   audible-cli = callPackage ../tools/misc/audible-cli { };
 
-  audiobookshelf = callPackage ../servers/audiobookshelf { };
-
   auditwheel = with python3Packages; toPythonApplication auditwheel;
 
   amidst = callPackage ../tools/games/minecraft/amidst { };
@@ -6880,7 +6878,7 @@ with pkgs;
 
   cirrusgo = callPackage ../tools/security/cirrusgo { };
 
-  inherit (callPackages ../applications/networking/remote/citrix-workspace { })
+  inherit (callPackage ../applications/networking/remote/citrix-workspace { })
     citrix_workspace_23_02_0
     citrix_workspace_23_07_0
     citrix_workspace_23_09_0
@@ -11136,12 +11134,16 @@ with pkgs;
 
   netbootxyz-efi = callPackage ../tools/misc/netbootxyz-efi { };
 
-  inherit (callPackages ../servers/web-apps/netbox { })
+  inherit (callPackage ../servers/web-apps/netbox { })
     netbox netbox_3_5 netbox_3_6;
 
   netbox2netshot = callPackage ../tools/admin/netbox2netshot { };
 
-  netcat = libressl.nc;
+  netcat = libressl.nc.overrideAttrs (old: {
+    meta = old.meta // {
+      mainProgram = "nc";
+    };
+  });
 
   netcat-gnu = callPackage ../tools/networking/netcat { };
 
@@ -12142,7 +12144,7 @@ with pkgs;
 
   plujain-ramp = callPackage ../applications/audio/plujain-ramp { };
 
-  inherit (callPackages ../servers/plik { })
+  inherit (callPackage ../servers/plik { })
     plik plikd;
 
   plex = callPackage ../servers/plex { };
@@ -15515,7 +15517,7 @@ with pkgs;
   asciigraph = callPackage ../tools/text/asciigraph { };
 
   autocorrect = callPackage ../tools/text/autocorrect {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
   as31 = callPackage ../development/compilers/as31 { };
@@ -23857,8 +23859,6 @@ with pkgs;
     };
   };
 
-  manticoresearch = callPackage ../servers/search/manticoresearch { };
-
   marisa = callPackage ../development/libraries/marisa { };
 
   mathgl = callPackage ../development/libraries/mathgl { };
@@ -41143,6 +41143,8 @@ with pkgs;
 
   tfswitch = callPackage ../applications/networking/cluster/tfswitch { };
 
+  tftui = python3Packages.callPackage ../applications/networking/cluster/tftui { };
+
   tfupdate = callPackage ../applications/networking/cluster/tfupdate { };
 
   tgswitch = callPackage ../applications/networking/cluster/tgswitch { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index cbbe4a9074f15..f5fe41e588784 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3474,8 +3474,12 @@ self: super: with self; {
 
   dvc-data = callPackage ../development/python-modules/dvc-data {  };
 
+  dvc-gdrive = callPackage ../development/python-modules/dvc-gdrive {  };
+
   dvc-gs = callPackage ../development/python-modules/dvc-gs { };
 
+  dvc-hdfs = callPackage ../development/python-modules/dvc-hdfs {  };
+
   dvc-http = callPackage ../development/python-modules/dvc-http {  };
 
   dvc-objects = callPackage ../development/python-modules/dvc-objects {  };
@@ -10928,6 +10932,8 @@ self: super: with self; {
     inherit (pkgs) lz4;
   };
 
+  pyosohotwaterapi = callPackage ../development/python-modules/pyosohotwaterapi { };
+
   pyotgw = callPackage ../development/python-modules/pyotgw { };
 
   pyotp = callPackage ../development/python-modules/pyotp { };