about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/dart.section.md7
-rw-r--r--doc/languages-frameworks/python.section.md1
-rw-r--r--maintainers/maintainer-list.nix42
-rw-r--r--maintainers/scripts/luarocks-packages.csv1
-rw-r--r--nixos/doc/manual/release-notes/rl-2311.section.md6
-rw-r--r--nixos/lib/test-driver/test_driver/machine.py22
-rw-r--r--nixos/modules/config/fanout.nix49
-rw-r--r--nixos/modules/module-list.nix3
-rw-r--r--nixos/modules/services/games/asf.nix22
-rw-r--r--nixos/modules/services/misc/soft-serve.nix99
-rw-r--r--nixos/modules/services/networking/networkmanager.nix93
-rw-r--r--nixos/modules/services/security/jitterentropy-rngd.nix18
-rw-r--r--nixos/modules/services/web-servers/nginx/default.nix4
-rw-r--r--nixos/modules/services/web-servers/nginx/vhost-options.nix7
-rw-r--r--nixos/modules/system/boot/systemd/initrd.nix2
-rw-r--r--nixos/modules/tasks/filesystems/btrfs.nix17
-rw-r--r--nixos/modules/tasks/filesystems/cifs.nix2
-rw-r--r--nixos/modules/tasks/filesystems/ext.nix2
-rw-r--r--nixos/modules/tasks/filesystems/f2fs.nix2
-rw-r--r--nixos/modules/tasks/filesystems/jfs.nix2
-rw-r--r--nixos/modules/tasks/filesystems/reiserfs.nix2
-rw-r--r--nixos/modules/tasks/filesystems/vfat.nix2
-rw-r--r--nixos/modules/tasks/filesystems/xfs.nix2
-rw-r--r--nixos/modules/tasks/filesystems/zfs.nix10
-rw-r--r--nixos/modules/virtualisation/qemu-vm.nix1
-rw-r--r--nixos/tests/all-tests.nix3
-rw-r--r--nixos/tests/fanout.nix30
-rw-r--r--nixos/tests/installer.nix3
-rw-r--r--nixos/tests/nginx-unix-socket.nix27
-rw-r--r--nixos/tests/soft-serve.nix102
-rw-r--r--nixos/tests/zfs.nix4
-rw-r--r--pkgs/applications/blockchains/trezor-suite/default.nix6
-rw-r--r--pkgs/applications/editors/jetbrains/plugins/plugins.json97
-rw-r--r--pkgs/applications/editors/jetbrains/versions.json96
-rw-r--r--pkgs/applications/editors/pulsar/default.nix9
-rw-r--r--pkgs/applications/editors/texmacs/default.nix42
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix12
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-plugin-names1
-rw-r--r--pkgs/applications/emulators/ryujinx/default.nix6
-rw-r--r--pkgs/applications/file-managers/yazi/default.nix13
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/default.nix5
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/deps.nix21
-rwxr-xr-xpkgs/applications/misc/ArchiSteamFarm/update.sh8
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/web-ui/.gitignore1
-rw-r--r--pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix12
-rwxr-xr-xpkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh16
-rw-r--r--pkgs/applications/misc/albert/default.nix2
-rw-r--r--pkgs/applications/misc/dasel/default.nix6
-rw-r--r--pkgs/applications/misc/nwg-displays/default.nix4
-rw-r--r--pkgs/applications/misc/nwg-panel/default.nix4
-rw-r--r--pkgs/applications/misc/obsidian/default.nix4
-rw-r--r--pkgs/applications/networking/browsers/chromium/common.nix6
-rw-r--r--pkgs/applications/networking/cluster/eks-node-viewer/default.nix6
-rw-r--r--pkgs/applications/networking/cluster/flink/default.nix2
-rw-r--r--pkgs/applications/networking/cluster/terraform-providers/providers.json8
-rw-r--r--pkgs/applications/networking/cluster/terragrunt/default.nix6
-rw-r--r--pkgs/applications/networking/gopher/sacc/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/signal-desktop/default.nix8
-rw-r--r--pkgs/applications/networking/p2p/tremotesf/default.nix4
-rw-r--r--pkgs/applications/networking/sync/rclone/default.nix4
-rw-r--r--pkgs/applications/video/kodi/addons/netflix/default.nix2
-rw-r--r--pkgs/applications/video/kodi/addons/youtube/default.nix15
-rw-r--r--pkgs/build-support/dart/build-dart-application/default.nix111
-rw-r--r--pkgs/build-support/dart/build-dart-application/hooks/dart-config-hook.sh3
-rw-r--r--pkgs/build-support/dart/build-dart-application/hooks/dart-fixup-hook.sh32
-rw-r--r--pkgs/build-support/dart/build-dart-application/hooks/default.nix3
-rw-r--r--pkgs/build-support/dart/fetch-dart-deps/default.nix2
-rw-r--r--pkgs/build-support/flutter/default.nix208
-rw-r--r--pkgs/build-support/kernel/make-initrd-ng/src/main.rs2
-rw-r--r--pkgs/by-name/al/alpine-make-rootfs/package.nix33
-rw-r--r--pkgs/by-name/ar/argagg/package.nix (renamed from pkgs/development/libraries/argagg/default.nix)25
-rw-r--r--pkgs/by-name/ar/argtable/package.nix (renamed from pkgs/development/libraries/argtable/default.nix)22
-rw-r--r--pkgs/by-name/ba/bashly/Gemfile2
-rw-r--r--pkgs/by-name/ba/bashly/Gemfile.lock59
-rw-r--r--pkgs/by-name/ba/bashly/gemset.nix231
-rw-r--r--pkgs/by-name/ba/bashly/package.nix38
-rw-r--r--pkgs/by-name/fi/firewalk/package.nix27
-rw-r--r--pkgs/by-name/fl/flip/package.nix32
-rw-r--r--pkgs/by-name/ji/jitterentropy-rngd/package.nix34
-rw-r--r--pkgs/by-name/ko/konbucase/package.nix52
-rw-r--r--pkgs/by-name/on/onedriver/package.nix64
-rw-r--r--pkgs/by-name/pr/presenterm/package.nix8
-rw-r--r--pkgs/by-name/te/tecoc/package.nix (renamed from pkgs/applications/editors/tecoc/default.nix)2
-rw-r--r--pkgs/by-name/tp/tpm2-totp/package.nix46
-rw-r--r--pkgs/data/themes/nordic/default.nix10
-rw-r--r--pkgs/data/themes/orchis-theme/default.nix4
-rw-r--r--pkgs/development/compilers/dart/package-overrides/default.nix (renamed from pkgs/development/compilers/flutter/package-overrides/default.nix)0
-rw-r--r--pkgs/development/compilers/dart/package-overrides/flutter-secure-storage-linux/default.nix (renamed from pkgs/development/compilers/flutter/package-overrides/flutter-secure-storage-linux/default.nix)0
-rw-r--r--pkgs/development/compilers/dart/package-overrides/handy-window/default.nix (renamed from pkgs/development/compilers/flutter/package-overrides/handy-window/default.nix)0
-rw-r--r--pkgs/development/compilers/dart/package-overrides/matrix/default.nix (renamed from pkgs/development/compilers/flutter/package-overrides/matrix/default.nix)0
-rw-r--r--pkgs/development/compilers/dart/package-overrides/olm/default.nix (renamed from pkgs/development/compilers/flutter/package-overrides/olm/default.nix)0
-rw-r--r--pkgs/development/compilers/mrustc/default.nix6
-rw-r--r--pkgs/development/embedded/stm32/stm32cubemx/default.nix4
-rw-r--r--pkgs/development/libraries/argagg/0001-catch.diff20
-rw-r--r--pkgs/development/libraries/ldb/default.nix4
-rw-r--r--pkgs/development/libraries/libspf2/default.nix18
-rw-r--r--pkgs/development/libraries/libunarr/default.nix4
-rw-r--r--pkgs/development/libraries/openxr-loader/default.nix4
-rw-r--r--pkgs/development/libraries/science/chemistry/tblite/default.nix9
-rw-r--r--pkgs/development/libraries/toml-f/default.nix4
-rw-r--r--pkgs/development/lua-modules/generated-packages.nix24
-rw-r--r--pkgs/development/node-packages/node-packages.json1
-rw-r--r--pkgs/development/node-packages/node-packages.nix359
-rw-r--r--pkgs/development/php-packages/grumphp/composer-json.patch27
-rw-r--r--pkgs/development/php-packages/grumphp/composer-lock.patch24
-rw-r--r--pkgs/development/php-packages/grumphp/default.nix54
-rw-r--r--pkgs/development/python-modules/aioairzone-cloud/default.nix4
-rw-r--r--pkgs/development/python-modules/aioairzone/default.nix4
-rw-r--r--pkgs/development/python-modules/aioesphomeapi/default.nix4
-rw-r--r--pkgs/development/python-modules/asyncwhois/default.nix4
-rw-r--r--pkgs/development/python-modules/bimmer-connected/default.nix4
-rw-r--r--pkgs/development/python-modules/bleak/default.nix12
-rw-r--r--pkgs/development/python-modules/dbus-fast/default.nix4
-rw-r--r--pkgs/development/python-modules/elgato/default.nix21
-rw-r--r--pkgs/development/python-modules/fypp/default.nix4
-rw-r--r--pkgs/development/python-modules/guppy3/default.nix4
-rw-r--r--pkgs/development/python-modules/plugwise/default.nix4
-rw-r--r--pkgs/development/python-modules/pvo/default.nix20
-rw-r--r--pkgs/development/python-modules/py-libzfs/default.nix4
-rw-r--r--pkgs/development/python-modules/pyenphase/default.nix4
-rw-r--r--pkgs/development/python-modules/pyliblo/default.nix11
-rw-r--r--pkgs/development/python-modules/pyscf/default.nix4
-rw-r--r--pkgs/development/python-modules/ratelimiter/default.nix43
-rw-r--r--pkgs/development/python-modules/sensor-state-data/default.nix4
-rw-r--r--pkgs/development/python-modules/trezor/default.nix4
-rw-r--r--pkgs/development/python-modules/twentemilieu/default.nix12
-rw-r--r--pkgs/development/python-modules/velbus-aio/default.nix4
-rw-r--r--pkgs/development/tools/clj-kondo/default.nix4
-rw-r--r--pkgs/development/tools/database/timescaledb-tune/default.nix4
-rw-r--r--pkgs/development/tools/electron/binary/generic.nix2
-rw-r--r--pkgs/development/tools/flyway/default.nix1
-rw-r--r--pkgs/development/tools/golangci-lint/default.nix6
-rw-r--r--pkgs/development/tools/java/dex2jar/default.nix6
-rw-r--r--pkgs/development/tools/misc/dart-sass/default.nix1
-rw-r--r--pkgs/development/tools/misc/dart-sass/deps.json930
-rw-r--r--pkgs/development/tools/protoc-gen-dart/default.nix1
-rw-r--r--pkgs/development/tools/protoc-gen-dart/deps.json549
-rw-r--r--pkgs/development/tools/rust/cargo-codspeed/default.nix6
-rw-r--r--pkgs/development/web/minify/default.nix6
-rw-r--r--pkgs/games/openra/build-engine.nix2
-rw-r--r--pkgs/games/starsector/default.nix8
-rw-r--r--pkgs/games/steam/fhsenv.nix15
-rw-r--r--pkgs/games/unciv/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/zen-kernels.nix10
-rw-r--r--pkgs/os-specific/linux/zfs/generic.nix27
-rw-r--r--pkgs/os-specific/linux/zfs/stable.nix13
-rw-r--r--pkgs/os-specific/linux/zfs/unstable.nix5
-rw-r--r--pkgs/servers/home-assistant/component-packages.nix2
-rw-r--r--pkgs/servers/home-assistant/default.nix6
-rw-r--r--pkgs/servers/home-assistant/stubs.nix4
-rw-r--r--pkgs/servers/http/nginx/generic.nix2
-rw-r--r--pkgs/servers/http/tomcat/tomcat-native.nix4
-rw-r--r--pkgs/servers/samba/4.x.nix4
-rw-r--r--pkgs/servers/soft-serve/default.nix8
-rw-r--r--pkgs/servers/sql/pgbouncer/default.nix1
-rw-r--r--pkgs/shells/nushell/default.nix6
-rw-r--r--pkgs/tools/filesystems/erofs-utils/default.nix1
-rw-r--r--pkgs/tools/misc/codebraid/default.nix8
-rw-r--r--pkgs/tools/misc/domine/default.nix2
-rw-r--r--pkgs/tools/misc/domine/deps.json190
-rw-r--r--pkgs/tools/misc/fd/default.nix6
-rw-r--r--pkgs/tools/misc/lazydocker/default.nix4
-rw-r--r--pkgs/tools/misc/timer/default.nix6
-rw-r--r--pkgs/tools/misc/topgrade/default.nix6
-rw-r--r--pkgs/tools/networking/ddclient/default.nix4
-rw-r--r--pkgs/tools/networking/globalping-cli/default.nix4
-rw-r--r--pkgs/tools/networking/hysteria/default.nix6
-rw-r--r--pkgs/tools/networking/requestly/default.nix4
-rw-r--r--pkgs/tools/networking/tgt/default.nix4
-rw-r--r--pkgs/tools/security/pynitrokey/default.nix4
-rw-r--r--pkgs/tools/security/rekor/default.nix6
-rw-r--r--pkgs/tools/security/sbctl/default.nix6
-rw-r--r--pkgs/tools/security/uncover/default.nix6
-rw-r--r--pkgs/tools/system/netdata/default.nix7
-rw-r--r--pkgs/tools/text/mdhtml/default.nix28
-rw-r--r--pkgs/top-level/all-packages.nix17
-rw-r--r--pkgs/top-level/perl-packages.nix7
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix2
179 files changed, 4037 insertions, 737 deletions
diff --git a/doc/languages-frameworks/dart.section.md b/doc/languages-frameworks/dart.section.md
index b00327b78eb29..8d9c062f4220f 100644
--- a/doc/languages-frameworks/dart.section.md
+++ b/doc/languages-frameworks/dart.section.md
@@ -12,6 +12,8 @@ If you are packaging a Flutter desktop application, use [`buildFlutterApplicatio
 
 If the upstream source is missing a `pubspec.lock` file, you'll have to vendor one and specify it using `pubspecLockFile`. If it is needed, one will be generated for you and printed when attempting to build the derivation.
 
+The `depsListFile` must always be provided when packaging in Nixpkgs. It will be generated and printed if the derivation is attempted to be built without one. Alternatively, `autoDepsList` may be set to `true` only when outside of Nixpkgs, as it relies on import-from-derivation.
+
 The `dart` commands run can be overridden through `pubGetScript` and `dartCompileCommand`, you can also add flags using `dartCompileFlags` or `dartJitFlags`.
 
 Dart supports multiple [outputs types](https://dart.dev/tools/dart-compile#types-of-output), you can choose between them using `dartOutputType` (defaults to `exe`). If you want to override the binaries path or the source path they come from, you can use `dartEntryPoints`. Outputs that require a runtime will automatically be wrapped with the relevant runtime (`dartaotruntime` for `aot-snapshot`, `dart run` for `jit-snapshot` and `kernel`, `node` for `js`), this can be overridden through `dartRuntimeCommand`.
@@ -31,6 +33,7 @@ buildDartApplication rec {
   };
 
   pubspecLockFile = ./pubspec.lock;
+  depsListFile = ./deps.json;
   vendorHash = "sha256-Atm7zfnDambN/BmmUf4BG0yUz/y6xWzf0reDw3Ad41s=";
 }
 ```
@@ -39,9 +42,7 @@ buildDartApplication rec {
 
 The function `buildFlutterApplication` builds Flutter applications.
 
-The deps.json file must always be provided when packaging in Nixpkgs. It will be generated and printed if the derivation is attempted to be built without one. Alternatively, `autoDepsList` may be set to `true` when outside of Nixpkgs, as it relies on import-from-derivation.
-
-A `pubspec.lock` file must be available. See the [Dart documentation](#ssec-dart-applications) for more details.
+See the [Dart documentation](#ssec-dart-applications) for more details on required files and arguments.
 
 ```nix
 {  flutter, fetchFromGitHub }:
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 40236d141d3d2..cdd5c806912e1 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -12,6 +12,7 @@
 | python310  | python3         | CPython 3.10 |
 | python311  |                 | CPython 3.11 |
 | python312  |                 | CPython 3.12 |
+| python313  |                 | CPython 3.13 |
 | pypy27     | pypy2, pypy     | PyPy2.7 |
 | pypy39     | pypy3           | PyPy 3.9 |
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 855357675a8dd..e5b7da9fa36cb 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1274,6 +1274,9 @@
     github = "antonmosich";
     githubId = 27223336;
     name = "Anton Mosich";
+    keys = [ {
+      fingerprint = "F401 287C 324F 0A1C B321  657B 9B96 97B8 FB18 7D14";
+    } ];
   };
   antono = {
     email = "self@antono.info";
@@ -3874,6 +3877,12 @@
     githubId = 50051176;
     name = "Daniel Rolls";
   };
+  danielsidhion = {
+    email = "nixpkgs@sidhion.com";
+    github = "DanielSidhion";
+    githubId = 160084;
+    name = "Daniel Sidhion";
+  };
   daniyalsuri6 = {
     email = "daniyal.suri@gmail.com";
     github = "daniyalsuri6";
@@ -6190,6 +6199,16 @@
     githubId = 45048741;
     name = "Alwanga Oyango";
   };
+  galaxy = {
+    email = "galaxy@dmc.chat";
+    matrix = "@galaxy:mozilla.org";
+    name = "The Galaxy";
+    github = "ga1aksy";
+    githubId = 148551648;
+    keys = [{
+      fingerprint = "48CA 3873 9E9F CA8E 76A0  835A E3DE CF85 4212 E1EA";
+    }];
+  };
   gal_bolle = {
     email = "florent.becker@ens-lyon.org";
     github = "FlorentBecker";
@@ -7225,6 +7244,7 @@
   };
   hubble = {
     name = "Hubble the Wolverine";
+    email = "hubblethewolverine@gmail.com";
     matrix = "@hubofeverything:bark.lgbt";
     github = "the-furry-hubofeverything";
     githubId = 53921912;
@@ -10929,6 +10949,12 @@
     githubId = 29855073;
     name = "Michael Colicchia";
   };
+  massimogengarelli = {
+    email = "massimo.gengarelli@gmail.com";
+    github = "massix";
+    githubId = 585424;
+    name = "Massimo Gengarelli";
+  };
   matejc = {
     email = "cotman.matej@gmail.com";
     github = "matejc";
@@ -13916,6 +13942,12 @@
     githubId = 610615;
     name = "Chih-Mao Chen";
   };
+  pks = {
+    email = "ps@pks.im";
+    github = "pks-t";
+    githubId = 4056630;
+    name = "Patrick Steinhardt";
+  };
   plabadens = {
     name = "Pierre Labadens";
     email = "labadens.pierre+nixpkgs@gmail.com";
@@ -17810,6 +17842,12 @@
     githubId = 858790;
     name = "Tobias Mayer";
   };
+  tochiaha = {
+    email = "tochiahan@proton.me";
+    github = "Tochiaha";
+    githubId = 74688871;
+    name = "Tochukwu Ahanonu";
+  };
   tokudan = {
     email = "git@danielfrank.net";
     github = "tokudan";
@@ -17855,6 +17893,10 @@
     githubId = 13155277;
     name = "Tom Houle";
   };
+  tomkoid = {
+    email = "tomaszierl@outlook.com";
+    name = "Tomkoid";
+  };
   tomodachi94 = {
     email = "tomodachi94+nixpkgs@protonmail.com";
     matrix = "@tomodachi94:matrix.org";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 5897948a9f83d..f03ef4fa09c95 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -16,6 +16,7 @@ cyrussasl,https://github.com/JorjBauer/lua-cyrussasl.git,,,,,
 digestif,https://github.com/astoff/digestif.git,,,0.2-1,5.3,
 dkjson,,,,,,
 fennel,,,,,,misterio77
+ferris.nvim,,,,,,mrcjkb
 fifo,,,,,,
 fluent,,,,,,alerque
 gitsigns.nvim,https://github.com/lewis6991/gitsigns.nvim.git,,,,5.1,
diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 38c89668f84aa..4e7d116e1e474 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -113,6 +113,8 @@
 
 - [virt-manager](https://virt-manager.org/), an UI for managing virtual machines in libvirt, is now available as `programs.virt-manager`.
 
+- [Soft Serve](https://github.com/charmbracelet/soft-serve), a tasty, self-hostable Git server for the command line. Available as [services.soft-serve](#opt-services.soft-serve.enable).
+
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}
 
 - `network-online.target` has been fixed to no longer time out for systems with `networking.useDHCP = true` and `networking.useNetworkd = true`.
@@ -341,6 +343,8 @@
 
 - `jq` was updated to 1.7, its [first release in 5 years](https://github.com/jqlang/jq/releases/tag/jq-1.7).
 
+- `zfs` was updated from 2.1.x to 2.2.0, [enabling newer kernel support and adding new features](https://github.com/openzfs/zfs/releases/tag/zfs-2.2.0).
+
 - A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant.
 
 - DocBook option documentation is no longer supported, all module documentation now uses markdown.
@@ -398,6 +402,8 @@ The module update takes care of the new config syntax and the data itself (user
 
 - Suricata was upgraded from 6.0 to 7.0 and no longer considers HTTP/2 support as experimental, see [upstream release notes](https://forum.suricata.io/t/suricata-7-0-0-released/3715) for more details.
 
+- Cloud support in the `netdata` package is now disabled by default. To enable it use the `netdataCloud` package.
+
 - `networking.nftables` now has the option `networking.nftables.table.<table>` to create tables
   and have them be updated atomically, instead of flushing the ruleset.
 
diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/test_driver/machine.py
index 7ed001a1dfce4..b1688cd3b64f0 100644
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@@ -791,6 +791,28 @@ class Machine:
         with self.nested(f"waiting for TCP port {port} on {addr}"):
             retry(port_is_open, timeout)
 
+    def wait_for_open_unix_socket(
+        self, addr: str, is_datagram: bool = False, timeout: int = 900
+    ) -> None:
+        """
+        Wait until a process is listening on the given UNIX-domain socket
+        (default to a UNIX-domain stream socket).
+        """
+
+        nc_flags = [
+            "-z",
+            "-uU" if is_datagram else "-U",
+        ]
+
+        def socket_is_open(_: Any) -> bool:
+            status, _ = self.execute(f"nc {' '.join(nc_flags)} {addr}")
+            return status == 0
+
+        with self.nested(
+            f"waiting for UNIX-domain {'datagram' if is_datagram else 'stream'} on '{addr}'"
+        ):
+            retry(socket_is_open, timeout)
+
     def wait_for_closed_port(
         self, port: int, addr: str = "localhost", timeout: int = 900
     ) -> None:
diff --git a/nixos/modules/config/fanout.nix b/nixos/modules/config/fanout.nix
new file mode 100644
index 0000000000000..60ee145f19af4
--- /dev/null
+++ b/nixos/modules/config/fanout.nix
@@ -0,0 +1,49 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.fanout;
+  mknodCmds = n: lib.lists.imap0 (i: s:
+    "mknod /dev/fanout${builtins.toString i} c $MAJOR ${builtins.toString i}"
+  ) (lib.lists.replicate n "");
+in
+{
+  options.services.fanout = {
+    enable = lib.mkEnableOption (lib.mdDoc "fanout");
+    fanoutDevices = lib.mkOption {
+      type = lib.types.int;
+      default = 1;
+      description = "Number of /dev/fanout devices";
+    };
+    bufferSize = lib.mkOption {
+      type = lib.types.int;
+      default = 16384;
+      description = "Size of /dev/fanout buffer in bytes";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.extraModulePackages = [ config.boot.kernelPackages.fanout.out ];
+
+    boot.kernelModules = [ "fanout" ];
+
+    boot.extraModprobeConfig = ''
+      options fanout buffersize=${builtins.toString cfg.bufferSize}
+    '';
+
+    systemd.services.fanout = {
+      description = "Bring up /dev/fanout devices";
+      script = ''
+        MAJOR=$(${pkgs.gnugrep}/bin/grep fanout /proc/devices | ${pkgs.gawk}/bin/awk '{print $1}')
+        ${lib.strings.concatLines (mknodCmds cfg.fanoutDevices)}
+      '';
+
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+        RemainAfterExit = "yes";
+        Restart = "no";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 79918f71f7be2..395a638033fe1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -2,6 +2,7 @@
   ./config/appstream.nix
   ./config/console.nix
   ./config/debug-info.nix
+  ./config/fanout.nix
   ./config/fonts/fontconfig.nix
   ./config/fonts/fontdir.nix
   ./config/fonts/ghostscript.nix
@@ -730,6 +731,7 @@
   ./services/misc/signald.nix
   ./services/misc/siproxd.nix
   ./services/misc/snapper.nix
+  ./services/misc/soft-serve.nix
   ./services/misc/sonarr.nix
   ./services/misc/sourcehut
   ./services/misc/spice-vdagentd.nix
@@ -1154,6 +1156,7 @@
   ./services/security/hologram-agent.nix
   ./services/security/hologram-server.nix
   ./services/security/infnoise.nix
+  ./services/security/jitterentropy-rngd.nix
   ./services/security/kanidm.nix
   ./services/security/munge.nix
   ./services/security/nginx-sso.nix
diff --git a/nixos/modules/services/games/asf.nix b/nixos/modules/services/games/asf.nix
index f15d7077d965c..432de6336ce24 100644
--- a/nixos/modules/services/games/asf.nix
+++ b/nixos/modules/services/games/asf.nix
@@ -187,29 +187,41 @@ in
             Group = "asf";
             WorkingDirectory = cfg.dataDir;
             Type = "simple";
-            ExecStart = "${cfg.package}/bin/ArchiSteamFarm --path ${cfg.dataDir} --process-required --no-restart --service --no-config-migrate";
+            ExecStart = "${lib.getExe cfg.package} --no-restart --process-required --service --system-required --path ${cfg.dataDir}";
             Restart = "always";
 
-            # mostly copied from the default systemd service
-            PrivateTmp = true;
+            # copied from the default systemd service at
+            # https://github.com/JustArchiNET/ArchiSteamFarm/blob/main/ArchiSteamFarm/overlay/variant-base/linux/ArchiSteamFarm%40.service
+            CapabilityBoundingSet = "";
+            DevicePolicy = "closed";
             LockPersonality = true;
+            NoNewPrivileges = true;
             PrivateDevices = true;
             PrivateIPC = true;
             PrivateMounts = true;
+            PrivateTmp = true; # instead of rw /tmp
             PrivateUsers = true;
+            ProcSubset = "pid";
             ProtectClock = true;
             ProtectControlGroups = true;
+            ProtectHome = true;
             ProtectHostname = true;
             ProtectKernelLogs = true;
             ProtectKernelModules = true;
             ProtectKernelTunables = true;
             ProtectProc = "invisible";
-            ProtectSystem = "full";
+            ProtectSystem = "strict";
             RemoveIPC = true;
-            RestrictAddressFamilies = "AF_INET AF_INET6";
+            RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK AF_UNIX";
             RestrictNamespaces = true;
             RestrictRealtime = true;
             RestrictSUIDSGID = true;
+            SystemCallArchitectures = "native";
+            UMask = "0077";
+
+            # we luckily already have systemd v247+
+            SecureBits = "noroot-locked";
+            SystemCallFilter = [ "@system-service" "~@privileged" ];
           }
         ];
 
diff --git a/nixos/modules/services/misc/soft-serve.nix b/nixos/modules/services/misc/soft-serve.nix
new file mode 100644
index 0000000000000..0f246493880b9
--- /dev/null
+++ b/nixos/modules/services/misc/soft-serve.nix
@@ -0,0 +1,99 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.soft-serve;
+  configFile = format.generate "config.yaml" cfg.settings;
+  format = pkgs.formats.yaml { };
+  docUrl = "https://charm.sh/blog/self-hosted-soft-serve/";
+  stateDir = "/var/lib/soft-serve";
+in
+{
+  options = {
+    services.soft-serve = {
+      enable = mkEnableOption "Enable soft-serve service";
+
+      package = mkPackageOption pkgs "soft-serve" { };
+
+      settings = mkOption {
+        type = format.type;
+        default = { };
+        description = mdDoc ''
+          The contents of the configuration file.
+
+          See <${docUrl}>.
+        '';
+        example = literalExpression ''
+          {
+            name = "dadada's repos";
+            log_format = "text";
+            ssh = {
+              listen_addr = ":23231";
+              public_url = "ssh://localhost:23231";
+              max_timeout = 30;
+              idle_timeout = 120;
+            };
+            stats.listen_addr = ":23233";
+          }
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.tmpfiles.rules = [
+      # The config file has to be inside the state dir
+      "L+ ${stateDir}/config.yaml - - - - ${configFile}"
+    ];
+
+    systemd.services.soft-serve = {
+      description = "Soft Serve git server";
+      documentation = [ docUrl ];
+      requires = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment.SOFT_SERVE_DATA_PATH = stateDir;
+
+      serviceConfig = {
+        Type = "simple";
+        DynamicUser = true;
+        Restart = "always";
+        ExecStart = "${getExe cfg.package} serve";
+        StateDirectory = "soft-serve";
+        WorkingDirectory = stateDir;
+        RuntimeDirectory = "soft-serve";
+        RuntimeDirectoryMode = "0750";
+        ProcSubset = "pid";
+        ProtectProc = "invisible";
+        UMask = "0027";
+        CapabilityBoundingSet = "";
+        ProtectHome = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        RemoveIPC = true;
+        PrivateMounts = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @setuid @swap"
+        ];
+      };
+    };
+  };
+
+  meta.maintainers = [ maintainers.dadada ];
+}
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 53c847ee3ca28..d32712c8243d7 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -4,6 +4,7 @@ with lib;
 
 let
   cfg = config.networking.networkmanager;
+  ini = pkgs.formats.ini { };
 
   delegateWireless = config.networking.wireless.enable == true && cfg.unmanaged != [ ];
 
@@ -379,6 +380,74 @@ in
           https://modemmanager.org/docs/modemmanager/fcc-unlock/#integration-with-third-party-fcc-unlock-tools.
         '';
       };
+      ensureProfiles = {
+        profiles = with lib.types; mkOption {
+          type = attrsOf (submodule {
+            freeformType = ini.type;
+
+            options = {
+              connection = {
+                id = lib.mkOption {
+                  type = str;
+                  description = "This is the name that will be displayed by NetworkManager and GUIs.";
+                };
+                type = lib.mkOption {
+                  type = str;
+                  description = "The connection type defines the connection kind, like vpn, wireguard, gsm, wifi and more.";
+                  example = "vpn";
+                };
+              };
+            };
+          });
+          apply = (lib.filterAttrsRecursive (n: v: v != { }));
+          default = { };
+          example = {
+            home-wifi = {
+              connection = {
+                id = "home-wifi";
+                type = "wifi";
+                permissions = "";
+              };
+              wifi = {
+                mac-address-blacklist = "";
+                mode = "infrastructure";
+                ssid = "Home Wi-Fi";
+              };
+              wifi-security = {
+                auth-alg = "open";
+                key-mgmt = "wpa-psk";
+                psk = "$HOME_WIFI_PASSWORD";
+              };
+              ipv4 = {
+                dns-search = "";
+                method = "auto";
+              };
+              ipv6 = {
+                addr-gen-mode = "stable-privacy";
+                dns-search = "";
+                method = "auto";
+              };
+            };
+          };
+          description = lib.mdDoc ''
+            Declaratively define NetworkManager profiles. You can find information about the generated file format [here](https://networkmanager.dev/docs/api/latest/nm-settings-keyfile.html) and [here](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/assembly_networkmanager-connection-profiles-in-keyfile-format_configuring-and-managing-networking).
+            You current profiles which are most likely stored in `/etc/NetworkManager/system-connections` and there is [a tool](https://github.com/janik-haag/nm2nix) to convert them to the needed nix code.
+            If you add a new ad-hoc connection via a GUI or nmtui or anything similar it should just work together with the declarative ones.
+            And if you edit a declarative profile NetworkManager will move it to the persistent storage and treat it like a ad-hoc one,
+            but there will be two profiles as soon as the systemd unit from this option runs again which can be confusing since NetworkManager tools will start displaying two profiles with the same name and probably a bit different settings depending on what you edited.
+            A profile won't be deleted even if it's removed from the config until the system reboots because that's when NetworkManager clears it's temp directory.
+          '';
+        };
+        environmentFiles = mkOption {
+          default = [];
+          type = types.listOf types.path;
+          example = [ "/run/secrets/network-manager.env" ];
+          description = lib.mdDoc ''
+            Files to load as environment file. Environment variables from this file
+            will be substituted into the static configuration file using [envsubst](https://github.com/a8m/envsubst).
+          '';
+        };
+      };
     };
   };
 
@@ -507,6 +576,30 @@ in
       aliases = [ "dbus-org.freedesktop.nm-dispatcher.service" ];
     };
 
+    systemd.services.NetworkManager-ensure-profiles = mkIf (cfg.ensureProfiles.profiles != { }) {
+      description = "Ensure that NetworkManager declarative profiles are created";
+      wantedBy = [ "multi-user.target" ];
+      before = [ "network-online.target" ];
+      script = let
+        path = id: "/run/NetworkManager/system-connections/${id}.nmconnection";
+      in ''
+        mkdir -p /run/NetworkManager/system-connections
+      '' + lib.concatMapStringsSep "\n"
+        (profile: ''
+          ${pkgs.envsubst}/bin/envsubst -i ${ini.generate (lib.escapeShellArg profile.n) profile.v} > ${path (lib.escapeShellArg profile.n)}
+        '') (lib.mapAttrsToList (n: v: { inherit n v; }) cfg.ensureProfiles.profiles)
+      + ''
+        if systemctl is-active --quiet NetworkManager; then
+          ${pkgs.networkmanager}/bin/nmcli connection reload
+        fi
+      '';
+      serviceConfig = {
+        EnvironmentFile = cfg.ensureProfiles.environmentFiles;
+        UMask = "0177";
+        Type = "oneshot";
+      };
+    };
+
     # Turn off NixOS' network management when networking is managed entirely by NetworkManager
     networking = mkMerge [
       (mkIf (!delegateWireless) {
diff --git a/nixos/modules/services/security/jitterentropy-rngd.nix b/nixos/modules/services/security/jitterentropy-rngd.nix
new file mode 100644
index 0000000000000..7bfacb5ddc5de
--- /dev/null
+++ b/nixos/modules/services/security/jitterentropy-rngd.nix
@@ -0,0 +1,18 @@
+{ lib, config, pkgs, ... }:
+let
+  cfg = config.services.jitterentropy-rngd;
+in
+{
+  options.services.jitterentropy-rngd = {
+    enable =
+      lib.mkEnableOption (lib.mdDoc "jitterentropy-rngd service configuration");
+    package = lib.mkPackageOptionMD pkgs "jitterentropy-rngd" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.packages = [ cfg.package ];
+    systemd.services."jitterentropy".wantedBy = [ "basic.target" ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ thillux ];
+}
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 955d6e19064ef..9eebd18855c77 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -329,7 +329,7 @@ let
         listenString = { addr, port, ssl, proxyProtocol ? false, extraParameters ? [], ... }:
           # UDP listener for QUIC transport protocol.
           (optionalString (ssl && vhost.quic) ("
-            listen ${addr}:${toString port} quic "
+            listen ${addr}${optionalString (port != null) ":${toString port}"} quic "
           + optionalString vhost.default "default_server "
           + optionalString vhost.reuseport "reuseport "
           + optionalString (extraParameters != []) (concatStringsSep " "
@@ -338,7 +338,7 @@ let
             in filter isCompatibleParameter extraParameters))
           + ";"))
           + "
-            listen ${addr}:${toString port} "
+            listen ${addr}${optionalString (port != null) ":${toString port}"} "
           + optionalString (ssl && vhost.http2 && oldHTTP2) "http2 "
           + optionalString ssl "ssl "
           + optionalString vhost.default "default_server "
diff --git a/nixos/modules/services/web-servers/nginx/vhost-options.nix b/nixos/modules/services/web-servers/nginx/vhost-options.nix
index 7636c1b26115f..c82f02ecefecd 100644
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@@ -31,12 +31,12 @@ with lib;
         options = {
           addr = mkOption {
             type = str;
-            description = lib.mdDoc "IP address.";
+            description = lib.mdDoc "Listen address.";
           };
           port = mkOption {
-            type = port;
+            type = types.nullOr port;
             description = lib.mdDoc "Port number.";
-            default = 80;
+            default = null;
           };
           ssl = mkOption {
             type = bool;
@@ -60,6 +60,7 @@ with lib;
       example = [
         { addr = "195.154.1.1"; port = 443; ssl = true; }
         { addr = "192.154.1.1"; port = 80; }
+        { addr = "unix:/var/run/nginx.sock"; }
       ];
       description = lib.mdDoc ''
         Listen addresses and ports for this virtual host.
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 61af2768e2959..175e757cbbb6c 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -358,7 +358,7 @@ in {
     ++ lib.optional (cfg.enableTpm2 && !(pkgs.stdenv.hostPlatform.isRiscV64 || pkgs.stdenv.hostPlatform.isArmv7)) "tpm-crb";
 
     boot.initrd.systemd = {
-      initrdBin = [pkgs.bash pkgs.coreutils cfg.package.kmod cfg.package] ++ config.system.fsPackages;
+      initrdBin = [pkgs.bash pkgs.coreutils cfg.package.kmod cfg.package];
       extraBin = {
         less = "${pkgs.less}/bin/less";
         mount = "${cfg.package.util-linux}/bin/mount";
diff --git a/nixos/modules/tasks/filesystems/btrfs.nix b/nixos/modules/tasks/filesystems/btrfs.nix
index 82fdd60587106..87fe326c09740 100644
--- a/nixos/modules/tasks/filesystems/btrfs.nix
+++ b/nixos/modules/tasks/filesystems/btrfs.nix
@@ -52,34 +52,37 @@ in
   config = mkMerge [
     (mkIf enableBtrfs {
       system.fsPackages = [ pkgs.btrfs-progs ];
+    })
 
-      boot.initrd.kernelModules = mkIf inInitrd [ "btrfs" ];
-      boot.initrd.availableKernelModules = mkIf inInitrd (
+    (mkIf inInitrd {
+      boot.initrd.kernelModules = [ "btrfs" ];
+      boot.initrd.availableKernelModules =
         [ "crc32c" ]
         ++ optionals (config.boot.kernelPackages.kernel.kernelAtLeast "5.5") [
           # Needed for mounting filesystems with new checksums
           "xxhash_generic"
           "blake2b_generic"
           "sha256_generic" # Should be baked into our kernel, just to be sure
-        ]
-      );
+        ];
 
-      boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable)
+      boot.initrd.extraUtilsCommands = mkIf (!config.boot.initrd.systemd.enable)
       ''
         copy_bin_and_libs ${pkgs.btrfs-progs}/bin/btrfs
         ln -sv btrfs $out/bin/btrfsck
         ln -sv btrfsck $out/bin/fsck.btrfs
       '';
 
-      boot.initrd.extraUtilsCommandsTest = mkIf (inInitrd && !config.boot.initrd.systemd.enable)
+      boot.initrd.extraUtilsCommandsTest = mkIf (!config.boot.initrd.systemd.enable)
       ''
         $out/bin/btrfs --version
       '';
 
-      boot.initrd.postDeviceCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable)
+      boot.initrd.postDeviceCommands = mkIf (!config.boot.initrd.systemd.enable)
       ''
         btrfs device scan
       '';
+
+      boot.initrd.systemd.initrdBin = [ pkgs.btrfs-progs ];
     })
 
     (mkIf enableAutoScrub {
diff --git a/nixos/modules/tasks/filesystems/cifs.nix b/nixos/modules/tasks/filesystems/cifs.nix
index 0de292a692082..837b9e19bfb9d 100644
--- a/nixos/modules/tasks/filesystems/cifs.nix
+++ b/nixos/modules/tasks/filesystems/cifs.nix
@@ -21,5 +21,7 @@ in
         copy_bin_and_libs ${pkgs.cifs-utils}/sbin/mount.cifs
       '';
 
+    boot.initrd.systemd.extraBin."mount.cifs" = mkIf inInitrd "${pkgs.cifs-utils}/sbin/mount.cifs";
+
   };
 }
diff --git a/nixos/modules/tasks/filesystems/ext.nix b/nixos/modules/tasks/filesystems/ext.nix
index edc0efc552136..1c34ee2c70356 100644
--- a/nixos/modules/tasks/filesystems/ext.nix
+++ b/nixos/modules/tasks/filesystems/ext.nix
@@ -25,5 +25,7 @@ in
         ln -sv e2fsck $out/bin/fsck.ext4
       '';
 
+    boot.initrd.systemd.initrdBin = lib.mkIf inInitrd [ pkgs.e2fsprogs ];
+
   };
 }
diff --git a/nixos/modules/tasks/filesystems/f2fs.nix b/nixos/modules/tasks/filesystems/f2fs.nix
index 035784f43df83..4f99f9a57fa6d 100644
--- a/nixos/modules/tasks/filesystems/f2fs.nix
+++ b/nixos/modules/tasks/filesystems/f2fs.nix
@@ -16,5 +16,7 @@ in
     boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable) ''
       copy_bin_and_libs ${pkgs.f2fs-tools}/sbin/fsck.f2fs
     '';
+
+    boot.initrd.systemd.initrdBin = mkIf inInitrd [ pkgs.f2fs-tools ];
   };
 }
diff --git a/nixos/modules/tasks/filesystems/jfs.nix b/nixos/modules/tasks/filesystems/jfs.nix
index 6d80c4c657da6..b5132b4caa334 100644
--- a/nixos/modules/tasks/filesystems/jfs.nix
+++ b/nixos/modules/tasks/filesystems/jfs.nix
@@ -15,5 +15,7 @@ in
     boot.initrd.extraUtilsCommands = mkIf (inInitrd && !config.boot.initrd.systemd.enable) ''
       copy_bin_and_libs ${pkgs.jfsutils}/sbin/fsck.jfs
     '';
+
+    boot.initrd.systemd.initrdBin = mkIf inInitrd [ pkgs.jfsutils ];
   };
 }
diff --git a/nixos/modules/tasks/filesystems/reiserfs.nix b/nixos/modules/tasks/filesystems/reiserfs.nix
index 7b017a83db848..3c6a0f0cd917f 100644
--- a/nixos/modules/tasks/filesystems/reiserfs.nix
+++ b/nixos/modules/tasks/filesystems/reiserfs.nix
@@ -21,5 +21,7 @@ in
         ln -s reiserfsck $out/bin/fsck.reiserfs
       '';
 
+    boot.initrd.systemd.initrdBin = mkIf inInitrd [ pkgs.reiserfsprogs ];
+
   };
 }
diff --git a/nixos/modules/tasks/filesystems/vfat.nix b/nixos/modules/tasks/filesystems/vfat.nix
index 5421b617b43b9..e535e97759b22 100644
--- a/nixos/modules/tasks/filesystems/vfat.nix
+++ b/nixos/modules/tasks/filesystems/vfat.nix
@@ -21,5 +21,7 @@ in
         ln -sv dosfsck $out/bin/fsck.vfat
       '';
 
+    boot.initrd.systemd.extraBin = mkIf inInitrd [ pkgs.dosfstools ];
+
   };
 }
diff --git a/nixos/modules/tasks/filesystems/xfs.nix b/nixos/modules/tasks/filesystems/xfs.nix
index f81f586465519..76f31e660ad3d 100644
--- a/nixos/modules/tasks/filesystems/xfs.nix
+++ b/nixos/modules/tasks/filesystems/xfs.nix
@@ -26,5 +26,7 @@ in
       ''
         sed -i -e 's,^#!.*,#!'$out/bin/sh, $out/bin/fsck.xfs
       '';
+
+    boot.initrd.systemd.initrdBin = mkIf inInitrd [ pkgs.xfsprogs.bin ];
   };
 }
diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix
index 5cf863c87f27c..082634ec9d010 100644
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@@ -90,12 +90,17 @@ let
 
   getPoolMounts = prefix: pool:
     let
+      poolFSes = getPoolFilesystems pool;
+
       # Remove the "/" suffix because even though most mountpoints
       # won't have it, the "/" mountpoint will, and we can't have the
       # trailing slash in "/sysroot/" in stage 1.
       mountPoint = fs: escapeSystemdPath (prefix + (lib.removeSuffix "/" fs.mountPoint));
+
+      hasUsr = lib.any (fs: fs.mountPoint == "/usr") poolFSes;
     in
-      map (x: "${mountPoint x}.mount") (getPoolFilesystems pool);
+      map (x: "${mountPoint x}.mount") poolFSes
+      ++ lib.optional hasUsr "sysusr-usr.mount";
 
   getKeyLocations = pool: if isBool cfgZfs.requestEncryptionCredentials then {
     hasKeys = cfgZfs.requestEncryptionCredentials;
@@ -632,7 +637,8 @@ in
           targets.zfs-import.wantedBy = [ "zfs.target" ];
           targets.zfs.wantedBy = [ "initrd.target" ];
           extraBin = {
-            # zpool and zfs are already in thanks to fsPackages
+            zpool = "${cfgZfs.package}/sbin/zpool";
+            zfs = "${cfgZfs.package}/sbin/zfs";
             awk = "${pkgs.gawk}/bin/awk";
           };
         };
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index e0004df6f6b2f..737a935711ae6 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -267,6 +267,7 @@ let
   };
 
   storeImage = import ../../lib/make-disk-image.nix {
+    name = "nix-store-image";
     inherit pkgs config lib;
     additionalPaths = [ regInfo ];
     format = "qcow2";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 33f8abf6ccd44..ef98efd7dbcaa 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -272,6 +272,7 @@ in {
   fail2ban = handleTest ./fail2ban.nix { };
   fakeroute = handleTest ./fakeroute.nix {};
   fancontrol = handleTest ./fancontrol.nix {};
+  fanout = handleTest ./fanout.nix {};
   fcitx5 = handleTest ./fcitx5 {};
   fenics = handleTest ./fenics.nix {};
   ferm = handleTest ./ferm.nix {};
@@ -559,6 +560,7 @@ in {
   nginx-sso = handleTest ./nginx-sso.nix {};
   nginx-status-page = handleTest ./nginx-status-page.nix {};
   nginx-tmpdir = handleTest ./nginx-tmpdir.nix {};
+  nginx-unix-socket = handleTest ./nginx-unix-socket.nix {};
   nginx-variants = handleTest ./nginx-variants.nix {};
   nifi = handleTestOn ["x86_64-linux"] ./web-apps/nifi.nix {};
   nitter = handleTest ./nitter.nix {};
@@ -732,6 +734,7 @@ in {
   snapper = handleTest ./snapper.nix {};
   snipe-it = runTest ./web-apps/snipe-it.nix;
   soapui = handleTest ./soapui.nix {};
+  soft-serve = handleTest ./soft-serve.nix {};
   sogo = handleTest ./sogo.nix {};
   solanum = handleTest ./solanum.nix {};
   sonarr = handleTest ./sonarr.nix {};
diff --git a/nixos/tests/fanout.nix b/nixos/tests/fanout.nix
new file mode 100644
index 0000000000000..c36d34dcce0be
--- /dev/null
+++ b/nixos/tests/fanout.nix
@@ -0,0 +1,30 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+}:
+import ./make-test-python.nix ({lib, pkgs, ...}: {
+  name = "fanout";
+  meta.maintainers = [ lib.maintainers.therishidesai ];
+
+  nodes = let
+    cfg = { ... }: {
+      services.fanout = {
+        enable = true;
+        fanoutDevices = 2;
+        bufferSize = 8192;
+      };
+    };
+  in {
+    machine = cfg;
+  };
+
+  testScript = ''
+    start_all()
+
+    # mDNS.
+    machine.wait_for_unit("multi-user.target")
+
+    machine.succeed("test -c /dev/fanout0")
+    machine.succeed("test -c /dev/fanout1")
+  '';
+})
diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 3268a16967d75..5111cedf9256d 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -690,6 +690,9 @@ in {
           "zpool create rpool /dev/vda2",
           "zfs create -o mountpoint=legacy rpool/root",
           "mount -t zfs rpool/root /mnt",
+          "zfs create -o mountpoint=legacy rpool/root/usr",
+          "mkdir /mnt/usr",
+          "mount -t zfs rpool/root/usr /mnt/usr",
           "udevadm settle",
       )
     '';
diff --git a/nixos/tests/nginx-unix-socket.nix b/nixos/tests/nginx-unix-socket.nix
new file mode 100644
index 0000000000000..4640eaa171bdf
--- /dev/null
+++ b/nixos/tests/nginx-unix-socket.nix
@@ -0,0 +1,27 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+let
+  nginxSocketPath = "/var/run/nginx/test.sock";
+in
+{
+  name = "nginx-unix-socket";
+
+  nodes = {
+    webserver = { pkgs, lib, ... }: {
+      services.nginx = {
+        enable = true;
+        virtualHosts.localhost = {
+          serverName = "localhost";
+          listen = [{ addr = "unix:${nginxSocketPath}"; }];
+          locations."/test".return = "200 'foo'";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_open_unix_socket("${nginxSocketPath}")
+
+    webserver.succeed("curl --fail --silent --unix-socket '${nginxSocketPath}' http://localhost/test | grep '^foo$'")
+  '';
+})
diff --git a/nixos/tests/soft-serve.nix b/nixos/tests/soft-serve.nix
new file mode 100644
index 0000000000000..1c4cb4c95819e
--- /dev/null
+++ b/nixos/tests/soft-serve.nix
@@ -0,0 +1,102 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+let
+  inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+  sshPort = 8231;
+  httpPort = 8232;
+  statsPort = 8233;
+  gitPort = 8418;
+in
+{
+  name = "soft-serve";
+  meta.maintainers = with lib.maintainers; [ dadada ];
+  nodes = {
+    client = { pkgs, ... }: {
+      environment.systemPackages = with pkgs; [
+        curl
+        git
+        openssh
+      ];
+      environment.etc.sshKey = {
+        source = snakeOilPrivateKey;
+        mode = "0600";
+      };
+    };
+
+    server =
+      { config, ... }:
+      {
+        services.soft-serve = {
+          enable = true;
+          settings = {
+            name = "TestServer";
+            ssh.listen_addr = ":${toString sshPort}";
+            git.listen_addr = ":${toString gitPort}";
+            http.listen_addr = ":${toString httpPort}";
+            stats.listen_addr = ":${toString statsPort}";
+            initial_admin_keys = [ snakeOilPublicKey ];
+          };
+        };
+        networking.firewall.allowedTCPPorts = [ sshPort httpPort statsPort ];
+      };
+  };
+
+  testScript =
+    { ... }:
+    ''
+      SSH_PORT = ${toString sshPort}
+      HTTP_PORT = ${toString httpPort}
+      STATS_PORT = ${toString statsPort}
+      KEY = "${snakeOilPublicKey}"
+      SSH_KEY = "/etc/sshKey"
+      SSH_COMMAND = f"ssh -p {SSH_PORT} -i {SSH_KEY} -o StrictHostKeyChecking=no"
+      TEST_DIR = "/tmp/test"
+      GIT = f"git -C {TEST_DIR}"
+
+      for machine in client, server:
+          machine.wait_for_unit("network.target")
+
+      server.wait_for_unit("soft-serve.service")
+      server.wait_for_open_port(SSH_PORT)
+
+      with subtest("Get info"):
+          status, test = client.execute(f"{SSH_COMMAND} server info")
+          if status != 0:
+              raise Exception("Failed to get SSH info")
+          key = " ".join(KEY.split(" ")[0:2])
+          if not key in test:
+              raise Exception("Admin key must be configured correctly")
+
+      with subtest("Create user"):
+          client.succeed(f"{SSH_COMMAND} server user create beatrice")
+          client.succeed(f"{SSH_COMMAND} server user info beatrice")
+
+      with subtest("Create repo"):
+          client.succeed(f"git init {TEST_DIR}")
+          client.succeed(f"{GIT} config --global user.email you@example.com")
+          client.succeed(f"touch {TEST_DIR}/foo")
+          client.succeed(f"{GIT} add foo")
+          client.succeed(f"{GIT} commit --allow-empty -m test")
+          client.succeed(f"{GIT} remote add origin git@server:test")
+          client.succeed(f"GIT_SSH_COMMAND='{SSH_COMMAND}' {GIT} push -u origin master")
+          client.execute("rm -r /tmp/test")
+
+      server.wait_for_open_port(HTTP_PORT)
+
+      with subtest("Clone over HTTP"):
+          client.succeed(f"curl --connect-timeout 10 http://server:{HTTP_PORT}/")
+          client.succeed(f"git clone http://server:{HTTP_PORT}/test /tmp/test")
+          client.execute("rm -r /tmp/test")
+
+      with subtest("Clone over SSH"):
+          client.succeed(f"GIT_SSH_COMMAND='{SSH_COMMAND}' git clone git@server:test /tmp/test")
+          client.execute("rm -r /tmp/test")
+
+      with subtest("Get stats over HTTP"):
+          server.wait_for_open_port(STATS_PORT)
+          status, test = client.execute(f"curl --connect-timeout 10 http://server:{STATS_PORT}/metrics")
+          if status != 0:
+              raise Exception("Failed to get metrics from status port")
+          if not "go_gc_duration_seconds_count" in test:
+              raise Exception("Metrics did not contain key 'go_gc_duration_seconds_count'")
+    '';
+})
diff --git a/nixos/tests/zfs.nix b/nixos/tests/zfs.nix
index 800f5e43cd15c..3454fbaf78fe5 100644
--- a/nixos/tests/zfs.nix
+++ b/nixos/tests/zfs.nix
@@ -113,8 +113,6 @@ let
       };
 
       testScript = ''
-        # TODO: Remove this when upgrading stable to zfs 2.2.0
-        unstable = ${if enableUnstable then "True" else "False"};
         machine.wait_for_unit("multi-user.target")
         machine.succeed(
             "zpool status",
@@ -136,8 +134,6 @@ let
             machine.crash()
             machine.wait_for_unit("multi-user.target")
             machine.succeed("zfs set sharesmb=on rpool/shared_smb")
-            if not unstable:
-                machine.succeed("zfs share rpool/shared_smb")
             machine.succeed(
                 "smbclient -gNL localhost | grep rpool_shared_smb",
                 "umount /tmp/mnt",
diff --git a/pkgs/applications/blockchains/trezor-suite/default.nix b/pkgs/applications/blockchains/trezor-suite/default.nix
index c56e6da52f0f3..e5f8963e921c6 100644
--- a/pkgs/applications/blockchains/trezor-suite/default.nix
+++ b/pkgs/applications/blockchains/trezor-suite/default.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "trezor-suite";
-  version = "23.4.2";
+  version = "23.10.1";
   name = "${pname}-${version}";
 
   suffix = {
@@ -19,8 +19,8 @@ let
   src = fetchurl {
     url = "https://github.com/trezor/${pname}/releases/download/v${version}/Trezor-Suite-${version}-${suffix}.AppImage";
     hash = { # curl -Lfs https://github.com/trezor/trezor-suite/releases/latest/download/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-      aarch64-linux = "sha512-+dcogzj0mENWSAVKqUG/xyF+TD/nKpA3UiNyI2M7iiCaW+tpwO5Y0uUmzb1rFRtDsKMflDPZNWe8qMJmrtaIrA==";
-      x86_64-linux  = "sha512-8UyPa3hDmALiYGao451ZBQLxv9H9OLbzzHiANp4zgvjBLGNhZnPFBIYM6KGyKkgRJJiTcgd7VHCgEhPpfm0qzg==";
+      aarch64-linux = "sha512-MR9BYg6R+Oof3zh02KSh48V2m6J7JpsrYpi6gj5kTvKuCU5Ci5AwPEAvnTjHAR6xlappvoNQmeA5nCEoTWaL7A==";
+      x86_64-linux  = "sha512-BqdfhYLG4z+9B7KbJGWGPml7U2fl/RQ1nZK0vdeA/cKhG0SjH0K8er9bemg60RPBXj0AeuK80v/6vMbDtyEnRQ==";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
diff --git a/pkgs/applications/editors/jetbrains/plugins/plugins.json b/pkgs/applications/editors/jetbrains/plugins/plugins.json
index d93a243b0a375..353d4a5d4b0b8 100644
--- a/pkgs/applications/editors/jetbrains/plugins/plugins.json
+++ b/pkgs/applications/editors/jetbrains/plugins/plugins.json
@@ -22,10 +22,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/164/390591/IdeaVim-2.5.1-signed.zip"
       },
       "name": "ideavim"
@@ -61,10 +61,10 @@
         "232.10072.21": null,
         "232.10072.27": null,
         "232.10072.28": null,
+        "232.10072.31": null,
+        "232.10072.32": null,
         "232.9921.42": null,
-        "232.9921.55": null,
         "232.9921.83": null,
-        "232.9921.89": null,
         "233.8264.22": null
       },
       "name": "kotlin"
@@ -87,14 +87,14 @@
       ],
       "builds": {
         "223.8836.1185": null,
-        "232.10072.15": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
-        "232.10072.21": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
-        "232.10072.27": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
-        "232.10072.28": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
+        "232.10072.15": "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip",
+        "232.10072.21": "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip",
+        "232.10072.27": "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip",
+        "232.10072.28": "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/6981/407738/ini-233.8264.9.zip"
       },
       "name": "ini"
@@ -105,8 +105,8 @@
         "phpstorm"
       ],
       "builds": {
-        "232.10072.27": "https://plugins.jetbrains.com/files/7219/408569/Symfony_Plugin-2022.1.258.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/7219/408569/Symfony_Plugin-2022.1.258.zip"
+        "232.10072.27": "https://plugins.jetbrains.com/files/7219/419684/Symfony_Plugin-2022.1.259.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/7219/419684/Symfony_Plugin-2022.1.259.zip"
       },
       "name": "symfony-support"
     },
@@ -117,7 +117,7 @@
       ],
       "builds": {
         "232.10072.27": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip"
+        "232.10072.32": "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip"
       },
       "name": "php-annotations"
     },
@@ -158,10 +158,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
-        "232.9921.83": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip"
+        "232.9921.83": "https://plugins.jetbrains.com/files/8182/395553/intellij-rust-0.4.201.5424-232.zip"
       },
       "name": "-deprecated-rust"
     },
@@ -186,10 +186,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
-        "232.9921.83": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip"
+        "232.9921.83": "https://plugins.jetbrains.com/files/8182/372556/intellij-rust-0.4.200.5420-232-beta.zip"
       },
       "name": "-deprecated-rust-beta"
     },
@@ -207,7 +207,7 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/8554/374977/featuresTrainer-232.9559.6.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/8554/374977/featuresTrainer-232.9559.6.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/8554/374977/featuresTrainer-232.9559.6.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/8554/374977/featuresTrainer-232.9559.6.zip"
+        "232.10072.31": "https://plugins.jetbrains.com/files/8554/374977/featuresTrainer-232.9559.6.zip"
       },
       "name": "ide-features-trainer"
     },
@@ -233,10 +233,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/8607/370632/NixIDEA-0.4.0.10.zip",
         "233.8264.22": null
       },
       "name": "nixidea"
@@ -267,16 +267,16 @@
         "webstorm"
       ],
       "builds": {
-        "223.8836.1185": "https://plugins.jetbrains.com/files/10037/358812/CSVEditor-3.2.1-223.zip",
-        "232.10072.15": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.10072.21": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.10072.27": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.10072.28": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9921.42": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9921.83": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip",
-        "233.8264.22": "https://plugins.jetbrains.com/files/10037/243092/CSV-2.21.0.zip"
+        "223.8836.1185": "https://plugins.jetbrains.com/files/10037/417700/CSVEditor-3.2.2-223.zip",
+        "232.10072.15": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.10072.21": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.10072.27": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.10072.28": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.9921.42": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "232.9921.83": "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip",
+        "233.8264.22": "https://plugins.jetbrains.com/files/10037/417702/CSVEditor-3.2.2-233.zip"
       },
       "name": "csv-editor"
     },
@@ -302,10 +302,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/12062/405118/keymap-vscode-233.8264.3.zip"
       },
       "name": "vscode-keymap"
@@ -332,10 +332,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/12559/405631/keymap-eclipse-233.8264.9.zip"
       },
       "name": "eclipse-keymap"
@@ -362,10 +362,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/13017/364038/keymap-visualStudio-232.8660.88.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/13017/405636/keymap-visualStudio-233.8264.9.zip"
       },
       "name": "visual-studio-keymap"
@@ -392,10 +392,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.10072.27": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.10072.28": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
+        "232.10072.31": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
+        "232.10072.32": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9921.42": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "232.9921.55": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "232.9921.83": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
-        "232.9921.89": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar",
         "233.8264.22": "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar"
       },
       "name": "darcula-pitch-black"
@@ -422,10 +422,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/17718/415524/github-copilot-intellij-1.3.2.3479.zip"
       },
       "name": "github-copilot"
@@ -452,10 +452,10 @@
         "232.10072.21": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.10072.27": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.10072.28": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
+        "232.10072.31": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
+        "232.10072.32": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9921.42": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "232.9921.55": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "232.9921.83": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
-        "232.9921.89": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip",
         "233.8264.22": "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip"
       },
       "name": "netbeans-6-5-keymap"
@@ -475,9 +475,9 @@
     }
   },
   "files": {
-    "https://plugins.jetbrains.com/files/10037/243092/CSV-2.21.0.zip": "sha256-Mfo8z2pjn+Gk1uumw5xpZQwpkqLRVqAu2Z07zjn2N1M=",
-    "https://plugins.jetbrains.com/files/10037/358812/CSVEditor-3.2.1-223.zip": "sha256-l8xq7XXQheZYcP+kdnLXAO7FhfPJYwIh+ZffbttBI9s=",
-    "https://plugins.jetbrains.com/files/10037/358813/CSVEditor-3.2.1-232.zip": "sha256-m9ocJSFWparZLrX1MQA0IlSH5LHodmzzVmGZ6eHml24=",
+    "https://plugins.jetbrains.com/files/10037/417699/CSVEditor-3.2.2-232.zip": "sha256-3bHSRhzvVO07mvuD6tpkiKFXTF66zCK/wpXFVb8IkfY=",
+    "https://plugins.jetbrains.com/files/10037/417700/CSVEditor-3.2.2-223.zip": "sha256-4Y/DZpCWKljaslJFsaqItq1DVJVVRlQjWpM6GLRo8QA=",
+    "https://plugins.jetbrains.com/files/10037/417702/CSVEditor-3.2.2-233.zip": "sha256-n4psF9fFFU8ohtbOndRx6i20EntjEzL3BvMObAZyOOw=",
     "https://plugins.jetbrains.com/files/12062/364117/keymap-vscode-232.8660.88.zip": "sha256-q5i1eAANK+6uBYrtioKLzvJf5ALUB0K4d31Ut0vT/lE=",
     "https://plugins.jetbrains.com/files/12062/405118/keymap-vscode-233.8264.3.zip": "sha256-cB3DTeWhDgAwHlxwYogd0/DuYBzo5DqaRtBvEC/p8I4=",
     "https://plugins.jetbrains.com/files/12559/364124/keymap-eclipse-232.8660.88.zip": "sha256-eRCsivZbDNrc+kesa9jVsOoMFFz+WpYfSMXxPCCjWjw=",
@@ -495,7 +495,8 @@
     "https://plugins.jetbrains.com/files/6954/381727/kotlin-plugin-223-1.9.10-release-459-IJ8836.35.zip": "sha256-gHkNQyWh6jtY1986aI7Qo6ZNrniPy+Yq4XLLA0pKJkA=",
     "https://plugins.jetbrains.com/files/6981/407738/ini-233.8264.9.zip": "sha256-E3xWjwTxtLkOtm9748BbkKGaS4l8SlZOkj3w6VgqlFQ=",
     "https://plugins.jetbrains.com/files/6981/407868/ini-232.9921.89.zip": "sha256-XIdhTQMxl/nJnntfQlHLlcyA79IS3hnGEGrXhKBFgY0=",
-    "https://plugins.jetbrains.com/files/7219/408569/Symfony_Plugin-2022.1.258.zip": "sha256-O4ARifSoeL5kXnFQTs6YoLcJvdg5VHks5LIgnwwUAeQ=",
+    "https://plugins.jetbrains.com/files/6981/418297/ini-232.10072.32.zip": "sha256-eC5Zs6ph/4C3Xf6e07DfyqhBmsG3bAFLnvae1JiFzpE=",
+    "https://plugins.jetbrains.com/files/7219/419684/Symfony_Plugin-2022.1.259.zip": "sha256-3UxSPvEXXhAf3zYg2H/jja4F5fuDFWQ6SWFRvcWJ0Iw=",
     "https://plugins.jetbrains.com/files/7320/346181/PHP_Annotations-9.4.0.zip": "sha256-hT5K4w4lhvNwDzDMDSvsIDGj9lyaRqglfOhlbNdqpWs=",
     "https://plugins.jetbrains.com/files/7322/401058/python-ce-232.9921.77.zip": "sha256-cr4LxSz8xVzC+Zm+6LnWGLbF6aGBVLW56crCIQOawhc=",
     "https://plugins.jetbrains.com/files/7322/405773/python-ce-233.8264.8.zip": "sha256-LjN0BkcnX8mVHh2dPULddVwooi9fcABkrRVhTPA7XSo=",
diff --git a/pkgs/applications/editors/jetbrains/versions.json b/pkgs/applications/editors/jetbrains/versions.json
index c95feebdb674a..5bbbd9dfc7b66 100644
--- a/pkgs/applications/editors/jetbrains/versions.json
+++ b/pkgs/applications/editors/jetbrains/versions.json
@@ -67,27 +67,27 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.tar.gz",
-      "version": "2023.2.2",
-      "sha256": "5e3dd021b82dcad0f51bded677aa87680dcc3f5d843951c48848a9191141bf1d",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2.tar.gz",
-      "build_number": "232.9921.55",
+      "version": "2023.2.3",
+      "sha256": "dd8d771508b277ab2a713b8f546c2ec6dbb261ba8c23072e46ec6ce2ea9ab2a0",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.3.tar.gz",
+      "build_number": "232.10072.32",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}.tar.gz",
-      "version": "2023.2.2",
-      "sha256": "2bb4f73d041b818a7b631feb3fee77036de764543c669efe9cf6766510a68e3f",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.2.tar.gz",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "d59dd88c1eb51cdd756433d415588c573ca944ebf6f08844b8ac8cd2e3d9937b",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.3.tar.gz",
+      "build_number": "232.10072.31"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}.tar.gz",
-      "version": "2023.2.2",
-      "sha256": "f7263b17e2456efcb5efab1eac53aafb6a0be1a7f9fbf25a419c9d7b447f6ded",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.2.tar.gz",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "e625fea80b72c9e12f986a8eb918425c6ef1d3f7b31117b40d122e3ce76046b1",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.3.tar.gz",
+      "build_number": "232.10072.31"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
@@ -190,27 +190,27 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.tar.gz",
-      "version": "2023.2.2",
-      "sha256": "b3067ffa32fab0880ffce8dff000d463b86bef9b30f53fc4d41f5d4e518c7528",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2-aarch64.tar.gz",
-      "build_number": "232.9921.55",
+      "version": "2023.2.3",
+      "sha256": "577bea15c1208e0b842bcdb2ff0f0205144a8800fcadf87f873af7c067e0ce73",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.3-aarch64.tar.gz",
+      "build_number": "232.10072.32",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}-aarch64.tar.gz",
-      "version": "2023.2.2",
-      "sha256": "7d15908f9261ee7905b61d83d4a048fee1e3a2fea9465ada1fc459b2ea0e4d5f",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.2-aarch64.tar.gz",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "6fdc5238ffa4767834b11b52b650107f1c64d6a53d0e2bbc23581b6c90b67ab5",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.3-aarch64.tar.gz",
+      "build_number": "232.10072.31"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}-aarch64.tar.gz",
-      "version": "2023.2.2",
-      "sha256": "2cf259859847f7a979565f31faa60148d571206c78c9309dcdf867b76c16ef25",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.2-aarch64.tar.gz",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "578ecbd059ccb010682cf602e959454b296ec2e741202f236fbdb38897b296dd",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.3-aarch64.tar.gz",
+      "build_number": "232.10072.31"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
@@ -313,27 +313,27 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.dmg",
-      "version": "2023.2.2",
-      "sha256": "99a9bb313a5c141ecd1810306deaca3cf52d338edf206362b3f9d9337a27890e",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2.dmg",
-      "build_number": "232.9921.55",
+      "version": "2023.2.3",
+      "sha256": "7ce4ff6b344ff8ce18ef8a821ba3fd1d222f9222a9b3e65744a796379d92417e",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.3.dmg",
+      "build_number": "232.10072.32",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}.dmg",
-      "version": "2023.2.2",
-      "sha256": "f482b6d451efec897764487b116f7bf09d507a5ebfb841c33e2abd2441c3b3a7",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.2.dmg",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "b914bd3c0018f951bef5da9c04907355a88546ce983dcf4115bbf11556015ec7",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.3.dmg",
+      "build_number": "232.10072.31"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}.dmg",
-      "version": "2023.2.2",
-      "sha256": "830f590d63199b389bbaa955c8602fa027bc1eb25bd8ce5636474eec72745b58",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.2.dmg",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "b33bbd30222363cdc3091aee923ed1c309edba799616a3a681cd9a1ca94e822a",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.3.dmg",
+      "build_number": "232.10072.31"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
@@ -436,27 +436,27 @@
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.dmg",
-      "version": "2023.2.2",
-      "sha256": "a31daeddae532324436b2d11acbd5fb657721883f17c7ef4457ac76a51bd4189",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.2-aarch64.dmg",
-      "build_number": "232.9921.55",
+      "version": "2023.2.3",
+      "sha256": "68d543fb2a79cd0b07ddb94a4c00d8c0c1aca7f604bc838ac92e232e763489b3",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2023.2.3-aarch64.dmg",
+      "build_number": "232.10072.32",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}-aarch64.dmg",
-      "version": "2023.2.2",
-      "sha256": "2bcddf3e58902578745dd1803f17ebd18f4c98dc76bf48b0945afbc7bae45832",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.2-aarch64.dmg",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "08c45adbb0dca219955f511993ca8150dcca235bdba3ac24c67ae035c68ba992",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2023.2.3-aarch64.dmg",
+      "build_number": "232.10072.31"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}-aarch64.dmg",
-      "version": "2023.2.2",
-      "sha256": "5d4292dd0e40db35199ebcd6472d4b46c505d3357d2324690338758355e0f092",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.2-aarch64.dmg",
-      "build_number": "232.9921.89"
+      "version": "2023.2.3",
+      "sha256": "63d68b20963575f76937ca0ce18a8150639c47b8cf8f3d6e96fa3306191cd076",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2023.2.3-aarch64.dmg",
+      "build_number": "232.10072.31"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
diff --git a/pkgs/applications/editors/pulsar/default.nix b/pkgs/applications/editors/pulsar/default.nix
index d2162dc9c9ef1..ef08ac9352dde 100644
--- a/pkgs/applications/editors/pulsar/default.nix
+++ b/pkgs/applications/editors/pulsar/default.nix
@@ -209,5 +209,14 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ colamaroro ];
+    knownVulnerabilities = [
+      "CVE-2023-5217"
+      "CVE-2022-21718"
+      "CVE-2022-29247"
+      "CVE-2022-29257"
+      "CVE-2022-36077"
+      "CVE-2023-29198"
+      "CVE-2023-39956"
+    ];
   };
 }
diff --git a/pkgs/applications/editors/texmacs/default.nix b/pkgs/applications/editors/texmacs/default.nix
index 427d0aa3ace80..00372c1cab8b7 100644
--- a/pkgs/applications/editors/texmacs/default.nix
+++ b/pkgs/applications/editors/texmacs/default.nix
@@ -1,5 +1,5 @@
-{ lib, mkDerivation, callPackage, fetchurl,
-  guile_1_8, qtbase, xmodmap, which, freetype,
+{ lib, stdenv, callPackage, fetchurl,
+  guile_1_8, xmodmap, which, freetype,
   libjpeg,
   sqlite,
   tex ? null,
@@ -8,6 +8,11 @@
   python3 ? null,
   cmake,
   pkg-config,
+  wrapQtAppsHook,
+  xdg-utils,
+  qtbase,
+  qtsvg,
+  qtmacextras,
   ghostscriptX ? null,
   extraFonts ? false,
   chineseFonts ? false,
@@ -15,32 +20,49 @@
   koreanFonts ? false }:
 
 let
-  pname = "TeXmacs";
-  version = "2.1";
+  pname = "texmacs";
+  version = "2.1.2";
   common = callPackage ./common.nix {
     inherit tex extraFonts chineseFonts japaneseFonts koreanFonts;
   };
 in
-mkDerivation {
+stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://www.texmacs.org/Download/ftp/tmftp/source/TeXmacs-${version}-src.tar.gz";
-    sha256 = "1gl6k1bwrk1y7hjyl4xvlqvmk5crl4jvsk8wrfp7ynbdin6n2i48";
+    hash = "sha256-Ds9gxOwMYSttEWrawgxLHGxHyMBvt8WmyPIwBP2g/CM=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  postPatch = common.postPatch + ''
+    substituteInPlace configure \
+      --replace "-mfpmath=sse -msse2" ""
+  '';
+
+  nativeBuildInputs = [
+    guile_1_8
+    pkg-config
+    wrapQtAppsHook
+    xdg-utils
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    cmake
+  ];
+
   buildInputs = [
     guile_1_8
     qtbase
+    qtsvg
     ghostscriptX
     freetype
     libjpeg
     sqlite
     git
     python3
+  ] ++ lib.optionals stdenv.isDarwin [
+    qtmacextras
   ];
-  NIX_LDFLAGS = "-lz";
+
+  env.NIX_LDFLAGS = "-lz";
 
   qtWrapperArgs = [
     "--suffix" "PATH" ":" (lib.makeBinPath [
@@ -58,10 +80,8 @@ mkDerivation {
     wrapQtApp $out/bin/texmacs
   '';
 
-  inherit (common) postPatch;
-
   meta = common.meta // {
     maintainers = [ lib.maintainers.roconnor ];
-    platforms = lib.platforms.gnu ++ lib.platforms.linux;  # arbitrary choice
+    platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ecd22ae6102bf..a38f9c137edc4 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -3333,6 +3333,18 @@ final: prev:
     meta.homepage = "https://github.com/wincent/ferret/";
   };
 
+  ferris-nvim = buildNeovimPlugin {
+    pname = "ferris.nvim";
+    version = "2023-11-21";
+    src = fetchFromGitHub {
+      owner = "mrcjkb";
+      repo = "ferris.nvim";
+      rev = "54943eaeb0d4534988d2378936052655c988c3c2";
+      sha256 = "o4yY4IHYBCnanfy7dx/wGdiPFMLMKZsYrG2SqlPRvdI=";
+    };
+    meta.homepage = "https://github.com/mrcjkb/ferris.nvim/";
+  };
+
   fidget-nvim = buildVimPlugin {
     pname = "fidget.nvim";
     version = "2023-06-10";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index ab353da48e241..8284657644081 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -277,6 +277,7 @@ https://github.com/freddiehaddad/feline.nvim/,,
 https://github.com/bakpakin/fennel.vim/,,
 https://github.com/lambdalisue/fern.vim/,,
 https://github.com/wincent/ferret/,,
+https://github.com/mrcjkb/ferris.nvim/,HEAD,
 https://github.com/j-hui/fidget.nvim/,legacy,
 https://github.com/bogado/file-line/,,
 https://github.com/glacambre/firenvim/,HEAD,
diff --git a/pkgs/applications/emulators/ryujinx/default.nix b/pkgs/applications/emulators/ryujinx/default.nix
index 892e6faaa94c4..f4fe6f467abf8 100644
--- a/pkgs/applications/emulators/ryujinx/default.nix
+++ b/pkgs/applications/emulators/ryujinx/default.nix
@@ -28,13 +28,13 @@
 
 buildDotnetModule rec {
   pname = "ryujinx";
-  version = "1.1.1044"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.1053"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
 
   src = fetchFromGitHub {
     owner = "Ryujinx";
     repo = "Ryujinx";
-    rev = "7afae8c69947f7a5fa9a55cee36381aef372dfba";
-    sha256 = "1kf95sbb4p50b6bah75sd95660kk2a7cbjwgvqv4c4cal6c126g7";
+    rev = "28dd7d80af56701887dbb538b56aa58edaf39d91";
+    sha256 = "09h4423z18q8r8fqcd5kv34iwmy9gkmpgw8an8myrhhvkmxi3zwg";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_7_0;
diff --git a/pkgs/applications/file-managers/yazi/default.nix b/pkgs/applications/file-managers/yazi/default.nix
index 7757a1322b15a..cd0476c1e00d6 100644
--- a/pkgs/applications/file-managers/yazi/default.nix
+++ b/pkgs/applications/file-managers/yazi/default.nix
@@ -3,6 +3,7 @@
 , lib
 
 , makeWrapper
+, installShellFiles
 , stdenv
 , Foundation
 
@@ -30,18 +31,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yazi";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "sxyazi";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ARpludMVQlZtCRAfW0cNYVmT3m9t9lunMIW24peYX6Y=";
+    hash = "sha256-FhKrq4N32uJRHGc0qRl+CIVNRW597jACcTFEgj8hiSE=";
   };
 
-  cargoHash = "sha256-dhdk5aGKv6tY8x7MmA0hWcmJBiXOXC92DlQTd/1AKtQ=";
+  cargoHash = "sha256-YUymZhDp1Pjm+W6m8Vmh2AgMCdaNt6TQQpiJwSg/gPw=";
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ Foundation ];
 
   postInstall = with lib;
@@ -60,6 +61,10 @@ rustPlatform.buildRustPackage rec {
     ''
       wrapProgram $out/bin/yazi \
          --prefix PATH : "${makeBinPath runtimePaths}"
+      installShellCompletion --cmd yazi \
+        --bash ./config/completions/yazi.bash \
+        --fish ./config/completions/yazi.fish \
+        --zsh  ./config/completions/_yazi
     '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/applications/misc/ArchiSteamFarm/default.nix b/pkgs/applications/misc/ArchiSteamFarm/default.nix
index 60b835c719b57..1a0e90546bec7 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@@ -11,13 +11,13 @@
 buildDotnetModule rec {
   pname = "ArchiSteamFarm";
   # nixpkgs-update: no auto update
-  version = "5.4.9.3";
+  version = "5.4.12.5";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
     repo = "ArchiSteamFarm";
     rev = version;
-    hash = "sha256-Yp8hnMIeV+ZHY6yISJdFd1yAQipQsU5vcXgxFDvkGnA=";
+    hash = "sha256-iIYA9BnHUfsB4J7VbSLKaRdJHMW/xULJxKfv8atfAd8=";
   };
 
   dotnet-runtime = dotnetCorePackages.aspnetcore_7_0;
@@ -77,6 +77,7 @@ buildDotnetModule rec {
     homepage = "https://github.com/JustArchiNET/ArchiSteamFarm";
     license = licenses.asl20;
     platforms = [ "x86_64-linux" "aarch64-linux" ];
+    mainProgram = "ArchiSteamFarm";
     maintainers = with maintainers; [ SuperSandro2000 lom ];
   };
 }
diff --git a/pkgs/applications/misc/ArchiSteamFarm/deps.nix b/pkgs/applications/misc/ArchiSteamFarm/deps.nix
index 5d353bfdf6b89..6154d1ca6e2d9 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/deps.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/deps.nix
@@ -57,11 +57,11 @@
   (fetchNuGet { pname = "Humanizer.Core.zh-Hans"; version = "2.14.1"; sha256 = "0zn99311zfn602phxyskfjq9vly0w5712z6fly8r4q0h94qa8c85"; })
   (fetchNuGet { pname = "Humanizer.Core.zh-Hant"; version = "2.14.1"; sha256 = "0qxjnbdj645l5sd6y3100yyrq1jy5misswg6xcch06x8jv7zaw1p"; })
   (fetchNuGet { pname = "JetBrains.Annotations"; version = "2023.2.0"; sha256 = "0nx7nrzbg9gk9skdc9x330cbr5xbsly6z9gzxm46vywf55yp8vaj"; })
-  (fetchNuGet { pname = "Markdig.Signed"; version = "0.32.0"; sha256 = "0rc1d8pwypq44pr15wn8g52zbqz70swdrdmjlzccf6zvwy1vyqkc"; })
+  (fetchNuGet { pname = "Markdig.Signed"; version = "0.33.0"; sha256 = "0816lmn0varxwhdklhh5hdqp0xnfz3nlrvaf2wpkk5v1mq86216h"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.JsonPatch"; version = "7.0.0"; sha256 = "1f13vsfs1rp9bmdp3khk4mk2fif932d72yxm2wszpsr239x4s2bf"; })
   (fetchNuGet { pname = "Microsoft.AspNetCore.Mvc.NewtonsoftJson"; version = "7.0.0"; sha256 = "1w49rg0n5wb1m5wnays2mmym7qy7bsi2b1zxz97af2rkbw3s3hbd"; })
   (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; sha256 = "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"; })
-  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.7.0"; sha256 = "12m9fay2d7jvj00hfpws37vflpqvz4dy4gcm25bjycg1zyfpzvly"; })
+  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.7.2"; sha256 = "09mf5kpxn1a1m8ciwklhh6ascx0yqpcs5r2hvmfj80j44n3qrwhm"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.7.0"; sha256 = "0gd67zlw554j098kabg887b5a6pq9kzavpa3jjy5w53ccjzjfy8j"; })
   (fetchNuGet { pname = "Microsoft.Extensions.ApiDescription.Server"; version = "6.0.5"; sha256 = "1pi2bm3cm0a7jzqzmfc2r7bpcdkmk3hhjfvb2c81j7wl7xdw3624"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "6.0.0"; sha256 = "0w6wwxv12nbc3sghvr68847wc9skkdgsicrz3fx4chgng1i3xy0j"; })
@@ -71,11 +71,15 @@
   (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "6.0.0"; sha256 = "0b75fmins171zi6bfdcq1kcvyrirs8n91mknjnxy4c3ygi1rrnj0"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "6.0.0"; sha256 = "008pnk2p50i594ahz308v81a41mbjz9mwcarqhmrjpl2d20c868g"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "6.0.0"; sha256 = "1kjiw6s4yfz9gm7mx3wkhp06ghnbs95icj9hi505shz9rjrg42q2"; })
-  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.7.0"; sha256 = "1srhqqmnf9pxdbpffr7dh0bihhf09d0iq5g6gh8ql7brfrh99lvb"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.0.3"; sha256 = "0njmg2lygnirnfjv9gck2f5lq4ly5rgws9cpf8qj3kwcwxfp0b9s"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.0.3"; sha256 = "1ayh85xqdq8rqjk2iqcn7iaczcl7d8qg6bxk0b4rgx59fmsmbqj7"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.0.3"; sha256 = "13cjqmf59k895q6gkd5ycl89mnpalckda7rhsdl11jdyr32hsfnv"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.0.3"; sha256 = "1pmhd0imh9wlhvbvvwjrpjsqvzagi2ly22nddwr4r0pi234khyz1"; })
+  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.7.2"; sha256 = "08g9dpp766racnh90s1sy3ncl291majgq6v2604hfw1f6zkmbjqh"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "5.0.0"; sha256 = "0mwpwdflidzgzfx2dlpkvvnkgkr2ayaf0s80737h4wa35gaj11rc"; })
   (fetchNuGet { pname = "Microsoft.OpenApi"; version = "1.2.3"; sha256 = "07b19k89whj69j87afkz86gp9b3iybw8jqwvlgcn43m7fb2y99rr"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.7.0"; sha256 = "1sqmk99644fx66zk2qa2ims1zl6741i3wl4rjh4z6jakd4xbc28i"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.7.0"; sha256 = "1s8ap0ljqssbqp1ilgsidjr948b9szf1cbl3fgl6smxig9im4zrl"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.7.2"; sha256 = "0xdjkdnrvnaxqgg38y5w1l3jbppigg68cc8q9jn0p21vn48bgrxq"; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.7.2"; sha256 = "1szsg1iy77f0caxzkk0ihpp4ifbfnbdbn8k0wbbhbdprxj8pr356"; })
   (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "5.0.0"; sha256 = "102hvhq2gmlcbq8y2cb7hdr2dnmjzfp2k3asr1ycwrfacwyaak7n"; })
   (fetchNuGet { pname = "MSTest.TestAdapter"; version = "3.1.1"; sha256 = "0y3ic8jv5jhld6gan2qfa2wyk4z57f7y4y5a47njr0jvxxnarg2c"; })
   (fetchNuGet { pname = "MSTest.TestFramework"; version = "3.1.1"; sha256 = "1lbgkrbrkmw4c54g61cwbmwc4zl8hyqmp283ymvj93lq7chbxasn"; })
@@ -86,9 +90,9 @@
   (fetchNuGet { pname = "Nito.AsyncEx.Tasks"; version = "5.1.2"; sha256 = "11wp47kc69sjdxrbg5pgx0wlffqlp0x5kr54ggnz2v19kmjz362v"; })
   (fetchNuGet { pname = "Nito.Collections.Deque"; version = "1.1.1"; sha256 = "152564q3s0n5swfv5p5rx0ghn2sm0g2xsnbd7gv8vb9yfklv7yg8"; })
   (fetchNuGet { pname = "Nito.Disposables"; version = "2.2.1"; sha256 = "1hx5k8497j34kxxgh060bvij0vfnraw90dmm3h9bmamcdi8wp80l"; })
-  (fetchNuGet { pname = "NLog"; version = "5.2.3"; sha256 = "0srai3s2kk9y2jimdvw1xw86nch38q6nza598dpr81dghx3s6j6w"; })
-  (fetchNuGet { pname = "NLog.Extensions.Logging"; version = "5.3.3"; sha256 = "0j19fljxbcc0bysmj7i0fmiax6sp5kjapf2llkimv7dh63rj9ckg"; })
-  (fetchNuGet { pname = "NLog.Web.AspNetCore"; version = "5.3.3"; sha256 = "0rhha2lwrzwlx0q1a8w9ph9xwayl3kmmy200ygsghcd02srlazkj"; })
+  (fetchNuGet { pname = "NLog"; version = "5.2.5"; sha256 = "02fybqi9d7czz3jmhmgb8wia2hpjj5hmcnij6zsgs69rkv6hf9j0"; })
+  (fetchNuGet { pname = "NLog.Extensions.Logging"; version = "5.3.5"; sha256 = "0jzfqa12l5vvxd2j684cnm29w19v386cpm11pw8h6prpf57affaj"; })
+  (fetchNuGet { pname = "NLog.Web.AspNetCore"; version = "5.3.5"; sha256 = "0li0sw04w0a4zms5jjv1ga45wxiqlcvaw8gi0wbhiifrdzz5yckb"; })
   (fetchNuGet { pname = "NuGet.Frameworks"; version = "6.5.0"; sha256 = "0s37d1p4md0k6d4cy6sq36f2dgkd9qfbzapxhkvi8awwh0vrynhj"; })
   (fetchNuGet { pname = "protobuf-net"; version = "3.2.16"; sha256 = "0pwlqlq2p8my2sr8b0cvdav5cm8wpwf3s4gy7s1ba701ac2zyb9y"; })
   (fetchNuGet { pname = "protobuf-net.Core"; version = "3.2.16"; sha256 = "00znhikq7valr3jaxg66cwli9hf75wkmmpf6rf8p790hf8lxq0c5"; })
@@ -108,6 +112,7 @@
   (fetchNuGet { pname = "System.Composition.Runtime"; version = "7.0.0"; sha256 = "1p9xpqzx42s8cdizv6nh15hcjvl2km0rwby66nfkj4cb472l339s"; })
   (fetchNuGet { pname = "System.Composition.TypedParts"; version = "7.0.0"; sha256 = "0syz7y6wgnxxgjvfqgymn9mnaa5fjy1qp06qnsvh3agr9mvcv779"; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "6.0.0"; sha256 = "0rrihs9lnb1h6x4h0hn6kgfnh58qq7hx8qq99gh6fayx4dcnx3s5"; })
+  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "7.0.3"; sha256 = "1fls88ffq34j1gr6zay1crm27v3sjs5fa4mvj9akqjq05bxanlhk"; })
   (fetchNuGet { pname = "System.Linq.Async"; version = "6.0.1"; sha256 = "10ira8hmv0i54yp9ggrrdm1c06j538sijfjpn1kmnh9j2xk5yzmq"; })
   (fetchNuGet { pname = "System.Reflection.Metadata"; version = "1.6.0"; sha256 = "1wdbavrrkajy7qbdblpbpbalbdl48q3h34cchz24gvdgyrlf15r4"; })
   (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
diff --git a/pkgs/applications/misc/ArchiSteamFarm/update.sh b/pkgs/applications/misc/ArchiSteamFarm/update.sh
index 9af9acb69835b..53d3ee6641912 100755
--- a/pkgs/applications/misc/ArchiSteamFarm/update.sh
+++ b/pkgs/applications/misc/ArchiSteamFarm/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p curl gnused jq common-updater-scripts nix-prefetch prefetch-npm-deps
+#!nix-shell -I nixpkgs=./. -i bash -p curl gnused jq common-updater-scripts
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
@@ -14,7 +14,7 @@ if [[ "$new_version" == "$old_version" ]]; then
 fi
 
 asf_path=$PWD
-pushd ../../../..
+cd ../../../..
 
 if [[ "${1:-}" != "--deps-only" ]]; then
     update-source-version ArchiSteamFarm "$new_version"
@@ -22,5 +22,5 @@ fi
 
 $(nix-build -A ArchiSteamFarm.fetch-deps --no-out-link)
 
-popd
-"$asf_path/web-ui/update.sh"
+cd "$asf_path/web-ui"
+./update.sh
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/.gitignore b/pkgs/applications/misc/ArchiSteamFarm/web-ui/.gitignore
new file mode 100644
index 0000000000000..d8b83df9cdb66
--- /dev/null
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/.gitignore
@@ -0,0 +1 @@
+package-lock.json
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
index 77f4e9c6e299b..4dad0b1f5b6b5 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
@@ -1,19 +1,19 @@
-{ lib, fetchFromGitHub, buildNpmPackage, nodePackages, ArchiSteamFarm }:
+{ lib, fetchFromGitHub, buildNpmPackage, ArchiSteamFarm }:
 
-buildNpmPackage {
+buildNpmPackage rec {
   pname = "asf-ui";
-  inherit (ArchiSteamFarm) version;
+  version = "fceb2fb828cfa420c77dc5cde433fd519a6717d4";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
     repo = "ASF-ui";
     # updated by the update script
     # this is always the commit that should be used with asf-ui from the latest asf version
-    rev = "0b812a7ab0d2f01a675d27f80008ad7b6972b4aa";
-    hash = "sha256-ut0x/qT3DyDASW4QbNT+BF6eXHCIbTol5E+3+tirFDA=";
+    rev = version;
+    hash = "sha256-gMQWly7HN5rIV9r72Qa+gHuBuQMs9sh09od4ja4sRGU=";
   };
 
-  npmDepsHash = "sha256-HpBEoAIGejpHJnUciz4iWILcXdgpw7X1xFuXmx9Z9dw=";
+  npmDepsHash = "sha256-UDCQTRpcPDcuvPzlqTu315EkGr5G0+z7qMSsPgYQacA=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh b/pkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh
index 7f026383383df..6fa8e67a1217a 100755
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/update.sh
@@ -1,23 +1,19 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=../../../.. -i bash -p nodePackages.node2nix gnused jq curl
+#! nix-shell -I nixpkgs=../../../../.. -i bash -p curl gnused jq common-updater-scripts prefetch-npm-deps
 set -eou pipefail
 
-cd "$(dirname "$0")"
-pushd ../../../../..
+cd "$(dirname "$0")"/../../../../..
 version=$(nix-instantiate --strict --eval -A ArchiSteamFarm.version | jq -r)
-popd
-pushd "$(dirname "$0")"
+cd -
 ui=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/JustArchiNET/ArchiSteamFarm/contents/ASF-ui?ref=$version" | jq -r .sha)
 
 curl "https://raw.githubusercontent.com/JustArchiNET/ASF-ui/$ui/package-lock.json" -o package-lock.json
 
-# update-source-version doesn't work for some reason
-sed -i "s/rev\\s*=\\s*.*/rev = \"$ui\";/" default.nix
-sed -i "s/hash\\s*=\\s*.*/hash = \"$(nix-prefetch fetchurl --url "https://github.com/JustArchiNET/ASF-ui/archive/$ui.tar.gz")\";/" default.nix
+cd -
+update-source-version ArchiSteamFarm.ui "$ui"
+cd -
 
 npmDepsHash=$(prefetch-npm-deps ./package-lock.json)
 sed -E 's#\bnpmDepsHash = ".*?"#npmDepsHash = "'"$npmDepsHash"'"#' -i default.nix
 
 rm package-lock.json
-
-popd
diff --git a/pkgs/applications/misc/albert/default.nix b/pkgs/applications/misc/albert/default.nix
index a9008283dd285..ceb74f7b0a323 100644
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@@ -10,6 +10,7 @@
 , qtscxml
 , qtsvg
 , qtdeclarative
+, qtwayland
 , qt5compat
 , wrapQtAppsHook
 , nix-update-script
@@ -42,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     qtscxml
     qtsvg
     qtdeclarative
+    qtwayland
     qt5compat
   ] ++ (with python3Packages; [ python pybind11 ]);
 
diff --git a/pkgs/applications/misc/dasel/default.nix b/pkgs/applications/misc/dasel/default.nix
index 04804732edc49..14a8f6013f2be 100644
--- a/pkgs/applications/misc/dasel/default.nix
+++ b/pkgs/applications/misc/dasel/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "dasel";
-  version = "2.3.6";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = "dasel";
     rev = "v${version}";
-    sha256 = "sha256-k+I4n05IbQT7tGzkJ0aPW6kLT1mGqwQOwoKDyal8L3w=";
+    sha256 = "sha256-zxTT/CkSbH40R7itXAx0zD+haHOoMep/W4KfalJQ/8w=";
   };
 
-  vendorHash = "sha256-Gueo8aZS5N1rLqZweXjXv7BLrtShxGDSGfbkYXhy4DQ=";
+  vendorHash = "sha256-CbR0uHtha2OoHW9mcB1I2lGJbjerbZARVN/mTstv/Y0=";
 
   ldflags = [
     "-s" "-w" "-X github.com/tomwright/dasel/v2/internal.Version=${version}"
diff --git a/pkgs/applications/misc/nwg-displays/default.nix b/pkgs/applications/misc/nwg-displays/default.nix
index f0fc2b1bb368d..18ba079088af7 100644
--- a/pkgs/applications/misc/nwg-displays/default.nix
+++ b/pkgs/applications/misc/nwg-displays/default.nix
@@ -14,13 +14,13 @@
 
 python310Packages.buildPythonApplication rec {
   pname = "nwg-displays";
-  version = "0.3.7";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-displays";
     rev = "v${version}";
-    hash = "sha256-Y405ZeOSpc1aPKEzFdvlgJgpGAi9HUR+Hvx63uYdp88=";
+    hash = "sha256-9v5TQTliUEnynoGDf1UXsQ9Ym7x2gPmx4QiRJH5BId4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/nwg-panel/default.nix b/pkgs/applications/misc/nwg-panel/default.nix
index a4d333e594c31..90864dee69ba4 100644
--- a/pkgs/applications/misc/nwg-panel/default.nix
+++ b/pkgs/applications/misc/nwg-panel/default.nix
@@ -15,13 +15,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-panel";
-  version = "0.9.13";
+  version = "0.9.14";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     rev = "v${version}";
-    hash = "sha256-dP/FbMrjPextwedQeLJHM6f/a+EuZ+hQSLrH/rF2XOg=";
+    hash = "sha256-ThcB/BhnJbBHUoRh120iqN6LMGOnkekzALTTgd8uUx4=";
   };
 
   # No tests
diff --git a/pkgs/applications/misc/obsidian/default.nix b/pkgs/applications/misc/obsidian/default.nix
index 78967c55a5d72..43ea198d62c9b 100644
--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@@ -12,7 +12,7 @@
 let
   inherit (stdenv.hostPlatform) system;
   pname = "obsidian";
-  version = "1.4.14";
+  version = "1.4.16";
   appname = "Obsidian";
   meta = with lib; {
     description = "A powerful knowledge base that works on top of a local folder of plain text Markdown files";
@@ -25,7 +25,7 @@ let
   filename = if stdenv.isDarwin then "Obsidian-${version}-universal.dmg" else "obsidian-${version}.tar.gz";
   src = fetchurl {
     url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
-    hash = if stdenv.isDarwin then "sha256-5cVKlZJDtXOkil+RohijCcqyJVTrysmqyTvJR0dDAuc=" else "sha256-qFSQer37Nkh3A3oVAFP/0qXzPWJ7SqY2GYA6b1iaYmE=";
+    hash = if stdenv.isDarwin then "sha256-ydLWr+Snkza9G+R7HbPuUdoZsL25Uj+KDos67Mq/urY=" else "sha256-PBKLGs3MZyarSMiWnjqY7d9bQrKu2uLAvLUufpHLxcw=";
   };
 
   icon = fetchurl {
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 22d71e8975f80..72ae7ae6aa413 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -315,9 +315,6 @@ let
       sed -i -e '/lib_loader.*Load/s!"\(libudev\.so\)!"${lib.getLib systemd}/lib/\1!' \
         device/udev_linux/udev?_loader.cc
     '' + ''
-      sed -i -e '/libpci_loader.*Load/s!"\(libpci\.so\)!"${pciutils}/lib/\1!' \
-        gpu/config/gpu_info_collector_linux.cc
-
       # Allow to put extensions into the system-path.
       sed -i -e 's,/usr,/run/current-system/sw,' chrome/common/chrome_paths.cc
 
@@ -479,9 +476,10 @@ let
 
     postFixup = ''
       # Make sure that libGLESv2 and libvulkan are found by dlopen.
+      # libpci (from pciutils) is needed by dlopen in angle/src/gpu_info_util/SystemInfo_libpci.cpp
       chromiumBinary="$libExecPath/$packageName"
       origRpath="$(patchelf --print-rpath "$chromiumBinary")"
-      patchelf --set-rpath "${lib.makeLibraryPath [ libGL vulkan-loader ]}:$origRpath" "$chromiumBinary"
+      patchelf --set-rpath "${lib.makeLibraryPath [ libGL vulkan-loader pciutils ]}:$origRpath" "$chromiumBinary"
     '';
 
     passthru = {
diff --git a/pkgs/applications/networking/cluster/eks-node-viewer/default.nix b/pkgs/applications/networking/cluster/eks-node-viewer/default.nix
index b4f9ce722e79e..80538f0f111c4 100644
--- a/pkgs/applications/networking/cluster/eks-node-viewer/default.nix
+++ b/pkgs/applications/networking/cluster/eks-node-viewer/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "eks-node-viewer";
-  version = "0.4.3";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-570wOLUtKKzDDLLDrAOPAnAUpZeAqrwKsQWoHCBjKKk=";
+    sha256 = "sha256-kfX9BzARDWUOBIu67j60K38uwkRELxd/gXtEHOHAXS8=";
   };
 
-  vendorHash = "sha256-kRRUaA/psQDmcM1ZhzdZE3eyw8DWZpesJVA2zVfORGk=";
+  vendorHash = "sha256-7axI7R8cTntc1IcOwVPmPj8MHeIvhbnkYKQdqu5fZOU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/networking/cluster/flink/default.nix b/pkgs/applications/networking/cluster/flink/default.nix
index f0547dcf56097..70c70d9ead43c 100644
--- a/pkgs/applications/networking/cluster/flink/default.nix
+++ b/pkgs/applications/networking/cluster/flink/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
       --prefix PATH : ${jre}/bin
 
     cat <<EOF >> $out/opt/flink/conf/flink-conf.yaml
-    env.java.home: ${jre}"
+    env.java.home: ${jre}
     env.log.dir: /tmp/flink-logs
     EOF
   '';
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 32f29dea87cab..efd18b33da1e9 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -953,11 +953,11 @@
     "vendorHash": null
   },
   "project": {
-    "hash": "sha256-D+UBv6JEbJKGfwTJU7/W5N6otOLW2lq6+euUKpoJ+To=",
+    "hash": "sha256-UO9GBBoOzA1stMq8naXWtxomme6CVdlngVCLQlbZDv0=",
     "homepage": "https://registry.terraform.io/providers/jfrog/project",
     "owner": "jfrog",
     "repo": "terraform-provider-project",
-    "rev": "v1.3.2",
+    "rev": "v1.3.3",
     "spdx": "Apache-2.0",
     "vendorHash": "sha256-Tj+NefCIacwpPS9rNPPxV2lLeKsXJMZhf9Xo+Rzz6gI="
   },
@@ -1279,11 +1279,11 @@
     "vendorHash": "sha256-4ulRYzb4bzk0TztT04CwqlnMGw8tp7YnoCm2/NqGN7Y="
   },
   "vultr": {
-    "hash": "sha256-65QWogqHR5RYUXBYjM50PNQSuVWYGtqtULTGNy1ivag=",
+    "hash": "sha256-8pj+udTNTjT/tXggOaIOThRQkYoI3v68rEssSUojM2A=",
     "homepage": "https://registry.terraform.io/providers/vultr/vultr",
     "owner": "vultr",
     "repo": "terraform-provider-vultr",
-    "rev": "v2.16.3",
+    "rev": "v2.16.4",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/cluster/terragrunt/default.nix b/pkgs/applications/networking/cluster/terragrunt/default.nix
index 1e6c86915acd4..65cddcbc34d4b 100644
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.52.1";
+  version = "0.52.3";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-t1GAcOZAYdfrI0lsyKUEBbnJaGzuFP0+Mz3Yrv4Bmik=";
+    hash = "sha256-o/4L7TBdFFHuPOKAO/wP0IBixQtZHGr1GSNlsEpq710=";
   };
 
-  vendorHash = "sha256-NSrZVLQ3Qbnp94qCV7NbrEav/7LCRbTov+B2vzbuvdM=";
+  vendorHash = "sha256-RmzSKt5qt9Qb4GDrfs4dJEhGQW/jFbXPn+AOLzEyo6c=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/gopher/sacc/default.nix b/pkgs/applications/networking/gopher/sacc/default.nix
index 9944238703983..686f671e13a52 100644
--- a/pkgs/applications/networking/gopher/sacc/default.nix
+++ b/pkgs/applications/networking/gopher/sacc/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sacc";
-  version = "1.06";
+  version = "1.07";
 
   src = fetchurl {
     url = "ftp://bitreich.org/releases/sacc/sacc-${version}.tar.gz";
-    hash = "sha512-eoleQy4dKLfZsrsqUybKMjUIdqLIDTncbBnnU0fXKkhH8apP8R8H6Kmt6hTqcbhNcIkNzBcP9s4Ld54dZYa0+g==";
+    hash = "sha256-LdEeZH+JWb7iEEzikAXaxG0N5GMPxjgTId4THLgdU2w=";
   };
 
   inherit patches;
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index 7ae6a8a11abe0..d6118db16f3c5 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -1,12 +1,12 @@
 { callPackage }: builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; })) {
   signal-desktop = {
     dir = "Signal";
-    version = "6.32.0";
-    hash = "sha256-FZ2wG3nkgIndeoUfXag/9jftXGDSY/MNpT8mqSZpJzA=";
+    version = "6.34.1";
+    hash = "sha256-1kffRXPQmtxIsLZVOgPXDnxUmY59q+1umy25cditRhw=";
   };
   signal-desktop-beta = {
     dir = "Signal Beta";
-    version = "6.33.0-beta.1";
-    hash = "sha256-FLCZvRYUysiE8BLMJVnn0hOkA3km0z383AjN6JvOyWI=";
+    version = "6.35.0-beta.2";
+    hash = "sha256-TgzqKGt3ojkjq+mIu0EtqXfnnZ/xulWjiuS5/0dlwIM=";
   };
 }
diff --git a/pkgs/applications/networking/p2p/tremotesf/default.nix b/pkgs/applications/networking/p2p/tremotesf/default.nix
index 6880d8472167d..4cd7358d2b77c 100644
--- a/pkgs/applications/networking/p2p/tremotesf/default.nix
+++ b/pkgs/applications/networking/p2p/tremotesf/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tremotesf";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "equeim";
     repo = "tremotesf2";
     rev = finalAttrs.version;
-    hash = "sha256-TKtBgMpCWIUl1bohAKCbTcZX2uaPmzeWut/OeNs/rME=";
+    hash = "sha256-mxk2BRUuet3XSNaKt2Dnnxe5dliazd1ArRSnKyoAp1s=";
     # We need this for src/libtremotesf
     fetchSubmodules = true;
   };
diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index 2e6dd8fa7fde5..cad0829b9c2bb 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -41,6 +41,10 @@ buildGoModule rec {
         ${rcloneBin}/bin/rclone genautocomplete $shell rclone.$shell
         installShellCompletion rclone.$shell
       done
+
+      # filesystem helpers
+      ln -s $out/bin/rclone $out/bin/rclonefs
+      ln -s $out/bin/rclone $out/bin/mount.rclone
     '' + lib.optionalString (enableCmount && !stdenv.isDarwin)
       # use --suffix here to ensure we don't shadow /run/wrappers/bin/fusermount,
       # as the setuid wrapper is required as non-root on NixOS.
diff --git a/pkgs/applications/video/kodi/addons/netflix/default.nix b/pkgs/applications/video/kodi/addons/netflix/default.nix
index 5a3089d1936d4..3352ae4c63d30 100644
--- a/pkgs/applications/video/kodi/addons/netflix/default.nix
+++ b/pkgs/applications/video/kodi/addons/netflix/default.nix
@@ -24,6 +24,6 @@ buildKodiAddon rec {
     homepage = "https://github.com/CastagnaIT/plugin.video.netflix";
     description = "Netflix VOD Services Add-on";
     license = licenses.mit;
-    maintainers = teams.kodi.members;
+    maintainers = teams.kodi.members ++ [ maintainers.pks ];
   };
 }
diff --git a/pkgs/applications/video/kodi/addons/youtube/default.nix b/pkgs/applications/video/kodi/addons/youtube/default.nix
index bdc4be3a23faa..3d3683ed87760 100644
--- a/pkgs/applications/video/kodi/addons/youtube/default.nix
+++ b/pkgs/applications/video/kodi/addons/youtube/default.nix
@@ -1,13 +1,15 @@
-{ lib, buildKodiAddon, fetchzip, addonUpdateScript, six, requests, infotagger, inputstreamhelper }:
+{ lib, buildKodiAddon, fetchFromGitHub, six, requests, infotagger, inputstreamhelper }:
 
 buildKodiAddon rec {
   pname = "youtube";
   namespace = "plugin.video.youtube";
-  version = "7.0.1";
+  version = "7.0.2.2";
 
-  src = fetchzip {
-    url = "https://mirrors.kodi.tv/addons/nexus/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-Wdju7d2kFX0V1J1TB75qEVq0UWN2xYYFNlD8UTt1New=";
+  src = fetchFromGitHub {
+    owner = "anxdpanic";
+    repo = "plugin.video.youtube";
+    rev = "v${version}";
+    hash = "sha256-BUeE/8oQYBiq4XgIp4nv0hjEQz3nnkDWCnAf4kpptwk=";
   };
 
   propagatedBuildInputs = [
@@ -19,9 +21,6 @@ buildKodiAddon rec {
 
   passthru = {
     pythonPath = "resources/lib";
-    updateScript = addonUpdateScript {
-      attrPath = "kodi.packages.youtube";
-    };
   };
 
   meta = with lib; {
diff --git a/pkgs/build-support/dart/build-dart-application/default.nix b/pkgs/build-support/dart/build-dart-application/default.nix
index be1fd72776711..76328e5645f6b 100644
--- a/pkgs/build-support/dart/build-dart-application/default.nix
+++ b/pkgs/build-support/dart/build-dart-application/default.nix
@@ -1,6 +1,7 @@
-{ lib, stdenv, fetchDartDeps, runCommand, writeText, dartHooks, makeWrapper, dart, cacert, nodejs, darwin }:
+{ lib, stdenv, callPackage, fetchDartDeps, runCommand, writeText, dartHooks, makeWrapper, dart, cacert, nodejs, darwin, jq }:
 
-{ pubGetScript ? "dart pub get"
+{ sdkSetupScript ? ""
+, pubGetScript ? "dart pub get"
 
   # Output type to produce. Can be any kind supported by dart
   # https://dart.dev/tools/dart-compile#types-of-output
@@ -18,12 +19,16 @@
 , dartEntryPoints ? null
   # Used when wrapping aot, jit, kernel, and js builds.
   # Set to null to disable wrapping.
-, dartRuntimeCommand ?
-    if dartOutputType == "aot-snapshot" then "${dart}/bin/dartaotruntime"
-    else if (dartOutputType == "jit-snapshot" || dartOutputType == "kernel") then "${dart}/bin/dart"
-    else if dartOutputType == "js" then "${nodejs}/bin/node"
-    else null
+, dartRuntimeCommand ? if dartOutputType == "aot-snapshot" then "${dart}/bin/dartaotruntime"
+  else if (dartOutputType == "jit-snapshot" || dartOutputType == "kernel") then "${dart}/bin/dart"
+  else if dartOutputType == "js" then "${nodejs}/bin/node"
+  else null
 
+, runtimeDependencies ? [ ]
+, extraWrapProgramArgs ? ""
+, customPackageOverrides ? { }
+, autoDepsList ? false
+, depsListFile ? null
 , pubspecLockFile ? null
 , vendorHash ? ""
 , ...
@@ -38,37 +43,81 @@ let
     '';
   }) {
     buildDrvArgs = args;
-    inherit pubGetScript vendorHash pubspecLockFile;
+    inherit sdkSetupScript pubGetScript vendorHash pubspecLockFile;
   };
-  inherit (dartHooks.override { inherit dart; }) dartConfigHook dartBuildHook dartInstallHook;
-in
-assert !(builtins.isString dartOutputType && dartOutputType != "") ->
-  throw "dartOutputType must be a non-empty string";
-stdenv.mkDerivation (args // {
-  inherit pubGetScript dartCompileCommand dartOutputType dartRuntimeCommand
-    dartCompileFlags dartJitFlags;
+  inherit (dartHooks.override { inherit dart; }) dartConfigHook dartBuildHook dartInstallHook dartFixupHook;
+
+  baseDerivation = stdenv.mkDerivation (finalAttrs: args // {
+    inherit sdkSetupScript pubGetScript dartCompileCommand dartOutputType
+      dartRuntimeCommand dartCompileFlags dartJitFlags runtimeDependencies;
 
     dartEntryPoints =
       if (dartEntryPoints != null)
       then writeText "entrypoints.json" (builtins.toJSON dartEntryPoints)
       else null;
 
-  nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [
-    dart
-    dartDeps
-    dartConfigHook
-    dartBuildHook
-    dartInstallHook
-    makeWrapper
-  ] ++ lib.optionals stdenv.isDarwin [
-    darwin.sigtool
-  ];
+    runtimeDependencyLibraryPath = lib.makeLibraryPath finalAttrs.runtimeDependencies;
 
-  # When stripping, it seems some ELF information is lost and the dart VM cli
-  # runs instead of the expected program. Don't strip if it's an exe output.
-  dontStrip = args.dontStrip or (dartOutputType == "exe");
+    nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [
+      dart
+      dartDeps
+      dartConfigHook
+      dartBuildHook
+      dartInstallHook
+      dartFixupHook
+      makeWrapper
+      jq
+    ] ++ lib.optionals stdenv.isDarwin [
+      darwin.sigtool
+    ];
+
+    preUnpack = ''
+      ${lib.optionalString (!autoDepsList) ''
+        if ! { [ '${lib.boolToString (depsListFile != null)}' = 'true' ] ${lib.optionalString (depsListFile != null) "&& cmp -s <(jq -Sc . '${depsListFile}') <(jq -Sc . '${finalAttrs.passthru.dartDeps.depsListFile}')"}; }; then
+          echo 1>&2 -e '\nThe dependency list file was either not given or differs from the expected result.' \
+                      '\nPlease choose one of the following solutions:' \
+                      '\n - Duplicate the following file and pass it to the depsListFile argument.' \
+                      '\n   ${finalAttrs.passthru.dartDeps.depsListFile}' \
+                      '\n - Set autoDepsList to true (not supported by Hydra or permitted in Nixpkgs)'.
+          exit 1
+        fi
+      ''}
+      ${args.preUnpack or ""}
+    '';
 
-  passthru = { inherit dartDeps; } // (args.passthru or { });
+    # When stripping, it seems some ELF information is lost and the dart VM cli
+    # runs instead of the expected program. Don't strip if it's an exe output.
+    dontStrip = args.dontStrip or (dartOutputType == "exe");
 
-  meta = (args.meta or { }) // { platforms = args.meta.platforms or dart.meta.platforms; };
-})
+    passthru = { inherit dartDeps; } // (args.passthru or { });
+
+    meta = (args.meta or { }) // { platforms = args.meta.platforms or dart.meta.platforms; };
+  });
+
+  packageOverrideRepository = (callPackage ../../../development/compilers/dart/package-overrides { }) // customPackageOverrides;
+  productPackages = builtins.filter (package: package.kind != "dev")
+    (if autoDepsList
+    then lib.importJSON dartDeps.depsListFile
+    else
+      if depsListFile == null
+      then [ ]
+      else lib.importJSON depsListFile);
+in
+assert !(builtins.isString dartOutputType && dartOutputType != "") ->
+throw "dartOutputType must be a non-empty string";
+builtins.foldl'
+  (prev: package:
+  if packageOverrideRepository ? ${package.name}
+  then
+    prev.overrideAttrs
+      (packageOverrideRepository.${package.name} {
+        inherit (package)
+          name
+          version
+          kind
+          source
+          dependencies;
+      })
+  else prev)
+  baseDerivation
+  productPackages
diff --git a/pkgs/build-support/dart/build-dart-application/hooks/dart-config-hook.sh b/pkgs/build-support/dart/build-dart-application/hooks/dart-config-hook.sh
index 3e901995237d9..f22d7d2ce64d4 100644
--- a/pkgs/build-support/dart/build-dart-application/hooks/dart-config-hook.sh
+++ b/pkgs/build-support/dart/build-dart-application/hooks/dart-config-hook.sh
@@ -3,6 +3,9 @@
 dartConfigHook() {
     echo "Executing dartConfigHook"
 
+    echo "Setting up SDK"
+    eval "$sdkSetupScript"
+
     echo "Installing dependencies"
     eval doPubGet "$pubGetScript" --offline
 
diff --git a/pkgs/build-support/dart/build-dart-application/hooks/dart-fixup-hook.sh b/pkgs/build-support/dart/build-dart-application/hooks/dart-fixup-hook.sh
new file mode 100644
index 0000000000000..c5a9bedd0665a
--- /dev/null
+++ b/pkgs/build-support/dart/build-dart-application/hooks/dart-fixup-hook.sh
@@ -0,0 +1,32 @@
+# shellcheck shell=bash
+
+dartFixupHook() {
+    echo "Executing dartFixupHook"
+
+    declare -a wrapProgramArgs
+
+    # Add runtime library dependencies to the LD_LIBRARY_PATH.
+    # For some reason, the RUNPATH of the executable is not used to load dynamic libraries in dart:ffi with DynamicLibrary.open().
+    #
+    # This could alternatively be fixed with patchelf --add-needed, but this would cause all the libraries to be opened immediately,
+    # which is not what application authors expect.
+    echo "$runtimeDependencyLibraryPath"
+    if [[ ! -z "$runtimeDependencyLibraryPath" ]]; then
+        wrapProgramArgs+=(--suffix LD_LIBRARY_PATH : \"$runtimeDependencyLibraryPath\")
+    fi
+
+    if [[ ! -z "$extraWrapProgramArgs" ]]; then
+        wrapProgramArgs+=("$extraWrapProgramArgs")
+    fi
+
+    if [ ${#wrapProgramArgs[@]} -ne 0 ]; then
+        for f in "$out"/bin/*; do
+            echo "Wrapping $f..."
+            eval "wrapProgram \"$f\" ${wrapProgramArgs[@]}"
+        done
+    fi
+
+    echo "Finished dartFixupHook"
+}
+
+postFixupHooks+=(dartFixupHook)
diff --git a/pkgs/build-support/dart/build-dart-application/hooks/default.nix b/pkgs/build-support/dart/build-dart-application/hooks/default.nix
index 463061c54a8dd..134989426d96b 100644
--- a/pkgs/build-support/dart/build-dart-application/hooks/default.nix
+++ b/pkgs/build-support/dart/build-dart-application/hooks/default.nix
@@ -12,4 +12,7 @@
   dartInstallHook = makeSetupHook {
     name = "dart-install-hook";
   } ./dart-install-hook.sh;
+  dartFixupHook = makeSetupHook {
+    name = "dart-fixup-hook";
+  } ./dart-fixup-hook.sh;
 }
diff --git a/pkgs/build-support/dart/fetch-dart-deps/default.nix b/pkgs/build-support/dart/fetch-dart-deps/default.nix
index e523b60797eb1..51052cae18f48 100644
--- a/pkgs/build-support/dart/fetch-dart-deps/default.nix
+++ b/pkgs/build-support/dart/fetch-dart-deps/default.nix
@@ -169,6 +169,8 @@ let
       dart pub deps --json | jq .packages > $out
       runHook postBuild
     '';
+
+    dontInstall = true;
   } // (removeAttrs buildDrvInheritArgs [ "name" "pname" ]));
 
   # As of Dart 3.0.0, Pub checks the revision of cached Git-sourced packages.
diff --git a/pkgs/build-support/flutter/default.nix b/pkgs/build-support/flutter/default.nix
index a0ed1211ed812..3e136211655b8 100644
--- a/pkgs/build-support/flutter/default.nix
+++ b/pkgs/build-support/flutter/default.nix
@@ -1,34 +1,28 @@
 { lib
 , callPackage
-, stdenvNoCC
 , runCommand
 , makeWrapper
 , wrapGAppsHook
-, llvmPackages_13
+, fetchDartDeps
+, buildDartApplication
 , cacert
 , glib
 , flutter
-, jq
 }:
 
 # absolutely no mac support for now
 
 { pubGetScript ? "flutter pub get"
 , flutterBuildFlags ? [ ]
-, runtimeDependencies ? [ ]
-, customPackageOverrides ? { }
-, autoDepsList ? false
-, depsListFile ? null
-, vendorHash ? ""
-, pubspecLockFile ? null
-, nativeBuildInputs ? [ ]
-, preUnpack ? ""
-, postFixup ? ""
 , extraWrapProgramArgs ? ""
 , ...
 }@args:
-let
-  flutterSetupScript = ''
+
+(buildDartApplication.override {
+  dart = flutter;
+  fetchDartDeps = fetchDartDeps.override { dart = flutter; };
+}) (args // {
+  sdkSetupScript = ''
     # Pub needs SSL certificates. Dart normally looks in a hardcoded path.
     # https://github.com/dart-lang/sdk/blob/3.1.0/runtime/bin/security_context_linux.cc#L48
     #
@@ -54,136 +48,56 @@ let
     flutter config --enable-linux-desktop >/dev/null
   '';
 
-  deps = callPackage ../dart/fetch-dart-deps { dart = flutter; } {
-    sdkSetupScript = flutterSetupScript;
-    inherit pubGetScript vendorHash pubspecLockFile;
-    buildDrvArgs = args;
-  };
-
-  baseDerivation = llvmPackages_13.stdenv.mkDerivation (finalAttrs: args // {
-    inherit flutterBuildFlags runtimeDependencies;
-
-    outputs = [ "out" "debug" ];
-
-    nativeBuildInputs = [
-      makeWrapper
-      deps
-      flutter
-      jq
-      glib
-      wrapGAppsHook
-    ] ++ nativeBuildInputs;
-
-    dontWrapGApps = true;
-
-    preUnpack = ''
-      ${lib.optionalString (!autoDepsList) ''
-        if ! { [ '${lib.boolToString (depsListFile != null)}' = 'true' ] ${lib.optionalString (depsListFile != null) "&& cmp -s <(jq -Sc . '${depsListFile}') <(jq -Sc . '${finalAttrs.passthru.depsListFile}')"}; }; then
-          echo 1>&2 -e '\nThe dependency list file was either not given or differs from the expected result.' \
-                      '\nPlease choose one of the following solutions:' \
-                      '\n - Duplicate the following file and pass it to the depsListFile argument.' \
-                      '\n   ${finalAttrs.passthru.depsListFile}' \
-                      '\n - Set autoDepsList to true (not supported by Hydra or permitted in Nixpkgs)'.
-          exit 1
-        fi
-      ''}
-
-      ${preUnpack}
-    '';
-
-    configurePhase = ''
-      runHook preConfigure
-
-      ${flutterSetupScript}
-
-      runHook postConfigure
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-
-      mkdir -p build/flutter_assets/fonts
-
-      doPubGet flutter pub get --offline -v
-      flutter build linux -v --release --split-debug-info="$debug" ${builtins.concatStringsSep " " (map (flag: "\"${flag}\"") finalAttrs.flutterBuildFlags)}
-
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      built=build/linux/*/release/bundle
-
-      mkdir -p $out/bin
-      mv $built $out/app
-
-      for f in $(find $out/app -iname "*.desktop" -type f); do
-        install -D $f $out/share/applications/$(basename $f)
-      done
-
-      for f in $(find $out/app -maxdepth 1 -type f); do
-        ln -s $f $out/bin/$(basename $f)
-      done
-
-      # make *.so executable
-      find $out/app -iname "*.so" -type f -exec chmod +x {} +
-
-      # remove stuff like /build/source/packages/ubuntu_desktop_installer/linux/flutter/ephemeral
-      for f in $(find $out/app -executable -type f); do
-        if patchelf --print-rpath "$f" | grep /build; then # this ignores static libs (e,g. libapp.so) also
-          echo "strip RPath of $f"
-          newrp=$(patchelf --print-rpath $f | sed -r "s|/build.*ephemeral:||g" | sed -r "s|/build.*profile:||g")
-          patchelf --set-rpath "$newrp" "$f"
-        fi
-      done
-
-      runHook postInstall
-    '';
-
-    postFixup = ''
-      # Add runtime library dependencies to the LD_LIBRARY_PATH.
-      # For some reason, the RUNPATH of the executable is not used to load dynamic libraries in dart:ffi with DynamicLibrary.open().
-      #
-      # This could alternatively be fixed with patchelf --add-needed, but this would cause all the libraries to be opened immediately,
-      # which is not what application authors expect.
-      for f in "$out"/bin/*; do
-        wrapProgram "$f" \
-          --suffix LD_LIBRARY_PATH : '${lib.makeLibraryPath finalAttrs.runtimeDependencies}' \
-          ''${gappsWrapperArgs[@]} \
-          ${extraWrapProgramArgs}
-      done
-
-      ${postFixup}
-    '';
-
-    passthru = (args.passthru or {}) // {
-      inherit (deps) depsListFile;
-    };
-  });
-
-  packageOverrideRepository = (callPackage ../../development/compilers/flutter/package-overrides { }) // customPackageOverrides;
-  productPackages = builtins.filter (package: package.kind != "dev")
-    (if autoDepsList
-    then lib.importJSON deps.depsListFile
-    else
-      if depsListFile == null
-      then [ ]
-      else lib.importJSON depsListFile);
-in
-builtins.foldl'
-  (prev: package:
-  if packageOverrideRepository ? ${package.name}
-  then
-    prev.overrideAttrs
-      (packageOverrideRepository.${package.name} {
-        inherit (package)
-          name
-          version
-          kind
-          source
-          dependencies;
-      })
-  else prev)
-  baseDerivation
-  productPackages
+  nativeBuildInputs = (args.nativeBuildInputs or [ ]) ++ [ wrapGAppsHook ];
+  buildInputs = (args.buildInputs or [ ]) ++ [ glib ];
+
+  dontDartBuild = true;
+  buildPhase = args.buildPhase or ''
+    runHook preBuild
+
+    mkdir -p build/flutter_assets/fonts
+
+    doPubGet flutter pub get --offline -v
+    flutter build linux -v --release --split-debug-info="$debug" ${builtins.concatStringsSep " " (map (flag: "\"${flag}\"") flutterBuildFlags)}
+
+    runHook postBuild
+  '';
+
+  dontDartInstall = true;
+  installPhase = args.installPhase or ''
+    runHook preInstall
+
+    built=build/linux/*/release/bundle
+
+    mkdir -p $out/bin
+    mv $built $out/app
+
+    for f in $(find $out/app -iname "*.desktop" -type f); do
+      install -D $f $out/share/applications/$(basename $f)
+    done
+
+    for f in $(find $out/app -maxdepth 1 -type f); do
+      ln -s $f $out/bin/$(basename $f)
+    done
+
+    # make *.so executable
+    find $out/app -iname "*.so" -type f -exec chmod +x {} +
+
+    # remove stuff like /build/source/packages/ubuntu_desktop_installer/linux/flutter/ephemeral
+    for f in $(find $out/app -executable -type f); do
+      if patchelf --print-rpath "$f" | grep /build; then # this ignores static libs (e,g. libapp.so) also
+        echo "strip RPath of $f"
+        newrp=$(patchelf --print-rpath $f | sed -r "s|/build.*ephemeral:||g" | sed -r "s|/build.*profile:||g")
+        patchelf --set-rpath "$newrp" "$f"
+      fi
+    done
+
+    runHook postInstall
+  '';
+
+  dontWrapGApps = true;
+  extraWrapProgramArgs = ''
+    ''${gappsWrapperArgs[@]} \
+    ${extraWrapProgramArgs}
+  '';
+})
diff --git a/pkgs/build-support/kernel/make-initrd-ng/src/main.rs b/pkgs/build-support/kernel/make-initrd-ng/src/main.rs
index 53096a842329c..daa688976c6c8 100644
--- a/pkgs/build-support/kernel/make-initrd-ng/src/main.rs
+++ b/pkgs/build-support/kernel/make-initrd-ng/src/main.rs
@@ -195,7 +195,7 @@ fn handle_path(
                         .wrap_err_with(|| format!("failed to resolve symlink of {:?}", source))?;
 
                     // Create the link, then push its target to the queue
-                    if !target.exists() {
+                    if !target.exists() && !target.is_symlink() {
                         unix::fs::symlink(&link_target, &target).wrap_err_with(|| {
                             format!("failed to symlink {:?} to {:?}", link_target, target)
                         })?;
diff --git a/pkgs/by-name/al/alpine-make-rootfs/package.nix b/pkgs/by-name/al/alpine-make-rootfs/package.nix
new file mode 100644
index 0000000000000..1fcfc23710a5a
--- /dev/null
+++ b/pkgs/by-name/al/alpine-make-rootfs/package.nix
@@ -0,0 +1,33 @@
+{ stdenvNoCC, lib, fetchFromGitHub, makeWrapper, apk-tools, coreutils, findutils, gnugrep, gnused, gnutar, gzip, rsync, util-linux, wget
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "alpine-make-rootfs";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "alpinelinux";
+    repo = "alpine-make-rootfs";
+    rev = "v${version}";
+    hash = "sha256-B5qYQ6ah4hFZfb3S5vwgevh7aEHI3YGLoA+IyipaDck=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontBuild = true;
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  postInstall = ''
+    wrapProgram $out/bin/alpine-make-rootfs --set PATH ${lib.makeBinPath [
+      apk-tools coreutils findutils gnugrep gnused gnutar gzip rsync util-linux wget
+    ]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/alpinelinux/alpine-make-rootfs";
+    description = "Make customized Alpine Linux rootfs (base image) for containers";
+    mainProgram = "alpine-make-rootfs";
+    maintainers = with maintainers; [ danielsidhion ];
+    license = licenses.mit;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/libraries/argagg/default.nix b/pkgs/by-name/ar/argagg/package.nix
index 7ff9eaac1e3e6..bb8507abbe977 100644
--- a/pkgs/development/libraries/argagg/default.nix
+++ b/pkgs/by-name/ar/argagg/package.nix
@@ -4,27 +4,22 @@
 , cmake
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "argagg";
-  version = "0.4.6";
+  version = "0.4.7";
 
   src = fetchFromGitHub {
     owner = "vietjtnguyen";
-    repo = pname;
-    rev = version;
-    hash = "sha256-MCtlAPfwdJpgfS8IH+zlcgaaxZ5AsP4hJvbZAFtOa4o=";
+    repo = "argagg";
+    rev = finalAttrs.version;
+    hash = "sha256-G0PzoKpUyb1MaziLvHgasq98jPODUu4EgPzywRjuIN8=";
   };
 
-  patches = [
-    # Fix compilation of macro catch statement
-    ./0001-catch.diff
-  ];
-
   nativeBuildInputs = [
     cmake
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/vietjtnguyen/argagg";
     description = "Argument Aggregator";
     longDescription = ''
@@ -38,9 +33,9 @@ stdenv.mkDerivation rec {
       types until you access them, so the result structures end up just being
       pointers into the original command line argument C-strings.
     '';
-    license = licenses.mit;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = with platforms; all;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.all;
     badPlatforms = [ "aarch64-darwin" ];
   };
-}
+})
diff --git a/pkgs/development/libraries/argtable/default.nix b/pkgs/by-name/ar/argtable/package.nix
index 9752b9600397c..18206202691c7 100644
--- a/pkgs/development/libraries/argtable/default.nix
+++ b/pkgs/by-name/ar/argtable/package.nix
@@ -4,29 +4,29 @@
 , cmake
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "argtable";
-  version = "3.2.1";
-  srcVersion = "v${version}.52f24e5";
+  version = "3.2.2";
+  srcVersion = "v${finalAttrs.version}.f25c624";
 
   src = fetchFromGitHub {
     owner = "argtable";
     repo = "argtable3";
-    rev = srcVersion;
-    hash = "sha256-HFsk91uJXQ0wpvAQxP4/yZwRQx9kLH7KgB3Y/+zcZC0=";
+    rev = finalAttrs.srcVersion;
+    hash = "sha256-X89xFLDs6NEgjzzwy8kplvTgukQd/CV3Xa9A3JXecf4=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=ON"
+    (lib.cmakeBool "BUILD_SHARED_LIBS" true)
   ];
 
   postPatch = ''
     patchShebangs tools/build
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/argtable/argtable3";
     description = "A single-file, ANSI C command-line parsing library";
     longDescription = ''
@@ -37,11 +37,11 @@ stdenv.mkDerivation rec {
       handling logic and textual descriptions of the command line syntax, which
       are essential but tedious to implement for a robust CLI program.
     '';
-    license = with licenses; bsd3;
-    maintainers = with maintainers; [ AndersonTorres artuuge ];
-    platforms = with platforms; all;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ AndersonTorres artuuge ];
+    platforms = lib.platforms.all;
   };
-}
+})
 # TODO: a NixOS test suite
 # TODO: multiple outputs
 # TODO: documentation
diff --git a/pkgs/by-name/ba/bashly/Gemfile b/pkgs/by-name/ba/bashly/Gemfile
new file mode 100644
index 0000000000000..b5d29f5f4c593
--- /dev/null
+++ b/pkgs/by-name/ba/bashly/Gemfile
@@ -0,0 +1,2 @@
+source 'https://rubygems.org'
+gem 'bashly'
diff --git a/pkgs/by-name/ba/bashly/Gemfile.lock b/pkgs/by-name/ba/bashly/Gemfile.lock
new file mode 100644
index 0000000000000..0021014b37284
--- /dev/null
+++ b/pkgs/by-name/ba/bashly/Gemfile.lock
@@ -0,0 +1,59 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    bashly (1.1.1)
+      colsole (>= 0.8.1, < 2)
+      completely (~> 0.6.1)
+      filewatcher (~> 2.0)
+      gtx (~> 0.1)
+      lp (~> 0.2)
+      mister_bin (~> 0.7)
+      psych (>= 3.3.2, < 7)
+      tty-markdown (~> 0.7)
+    colsole (1.0.0)
+    completely (0.6.1)
+      colsole (>= 0.8.1, < 2)
+      mister_bin (~> 0.7)
+    docopt_ng (0.7.1)
+    filewatcher (2.1.0)
+      module_methods (~> 0.1.0)
+    gtx (0.1.0)
+    kramdown (2.4.0)
+      rexml
+    lp (0.2.1)
+    mister_bin (0.7.6)
+      colsole (>= 0.8.1, < 2)
+      docopt_ng (~> 0.7, >= 0.7.1)
+    module_methods (0.1.0)
+    pastel (0.8.0)
+      tty-color (~> 0.5)
+    psych (5.1.1.1)
+      stringio
+    rexml (3.2.6)
+    rouge (4.1.3)
+    stringio (3.0.8)
+    strings (0.2.1)
+      strings-ansi (~> 0.2)
+      unicode-display_width (>= 1.5, < 3.0)
+      unicode_utils (~> 1.4)
+    strings-ansi (0.2.0)
+    tty-color (0.6.0)
+    tty-markdown (0.7.2)
+      kramdown (>= 1.16.2, < 3.0)
+      pastel (~> 0.8)
+      rouge (>= 3.14, < 5.0)
+      strings (~> 0.2.0)
+      tty-color (~> 0.5)
+      tty-screen (~> 0.8)
+    tty-screen (0.8.1)
+    unicode-display_width (2.5.0)
+    unicode_utils (1.4.0)
+
+PLATFORMS
+  x86_64-linux
+
+DEPENDENCIES
+  bashly
+
+BUNDLED WITH
+   2.3.26
diff --git a/pkgs/by-name/ba/bashly/gemset.nix b/pkgs/by-name/ba/bashly/gemset.nix
new file mode 100644
index 0000000000000..e24c0b3483d76
--- /dev/null
+++ b/pkgs/by-name/ba/bashly/gemset.nix
@@ -0,0 +1,231 @@
+{
+  bashly = {
+    dependencies = ["colsole" "completely" "filewatcher" "gtx" "lp" "mister_bin" "psych" "tty-markdown"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1rhzbpv8j5qcm5a84m4vzrryb0j8z90q6djbpid4ay2fr492kvkq";
+      type = "gem";
+    };
+    version = "1.1.1";
+  };
+  colsole = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fvf6dz2wsvjk7q24z0dm8lajq3p2l6i5ywf3mxj683rmhwq49bg";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  completely = {
+    dependencies = ["colsole" "mister_bin"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01nk1cigb09z6rjy41qrhqf58cgpqm43xwjdkz33mfmwrnz04cw1";
+      type = "gem";
+    };
+    version = "0.6.1";
+  };
+  docopt_ng = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rsnl5s7k2s1gl4n4dg68ssg577kf11sl4a4l2lb2fpswj718950";
+      type = "gem";
+    };
+    version = "0.7.1";
+  };
+  filewatcher = {
+    dependencies = ["module_methods"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "03f9v57c5zag09mi10yjhdx7y0vv2w5wrnwzbij9hhkwh43rk077";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  gtx = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "10hfhicvv371gy1i16x6vry1xglvxl0zh7qr6f14pqsx32qih6ff";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
+  kramdown = {
+    dependencies = ["rexml"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ic14hdcqxn821dvzki99zhmcy130yhv5fqfffkcf87asv5mnbmn";
+      type = "gem";
+    };
+    version = "2.4.0";
+  };
+  lp = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ns1aza32n929w7smg1dsn4g6qlfi7k1jrvssyn35cicmwn0gyyr";
+      type = "gem";
+    };
+    version = "0.2.1";
+  };
+  mister_bin = {
+    dependencies = ["colsole" "docopt_ng"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xx8cxvzcn47zsnshcllf477x4rbssrchvp76929qnsg5k9q7fas";
+      type = "gem";
+    };
+    version = "0.7.6";
+  };
+  module_methods = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1886wjscfripgzlmyvcd0jmlzwr6hxvklm2a5rm32dw5bf7bvjki";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
+  pastel = {
+    dependencies = ["tty-color"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xash2gj08dfjvq4hy6l1z22s5v30fhizwgs10d6nviggpxsj7a8";
+      type = "gem";
+    };
+    version = "0.8.0";
+  };
+  psych = {
+    dependencies = ["stringio"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0wjzrkssjfjpynij5dpycyflhqbjvi1gc2j73xgq3b196s1d3c24";
+      type = "gem";
+    };
+    version = "5.1.1.1";
+  };
+  rexml = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "05i8518ay14kjbma550mv0jm8a6di8yp5phzrd8rj44z9qnrlrp0";
+      type = "gem";
+    };
+    version = "3.2.6";
+  };
+  rouge = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19drl3x8fw65v3mpy7fk3cf3dfrywz5alv98n2rm4pp04vdn71lw";
+      type = "gem";
+    };
+    version = "4.1.3";
+  };
+  stringio = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ix96dxbjqlpymdigb4diwrifr0bq7qhsrng95fkkp18av326nqk";
+      type = "gem";
+    };
+    version = "3.0.8";
+  };
+  strings = {
+    dependencies = ["strings-ansi" "unicode-display_width" "unicode_utils"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1yynb0qhhhplmpzavfrrlwdnd1rh7rkwzcs4xf0mpy2wr6rr6clk";
+      type = "gem";
+    };
+    version = "0.2.1";
+  };
+  strings-ansi = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "120wa6yjc63b84lprglc52f40hx3fx920n4dmv14rad41rv2s9lh";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  tty-color = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0aik4kmhwwrmkysha7qibi2nyzb4c8kp42bd5vxnf8sf7b53g73g";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
+  tty-markdown = {
+    dependencies = ["kramdown" "pastel" "rouge" "strings" "tty-color" "tty-screen"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "04f599zn5rfndq4d9l0acllfpc041bzdkkz2h6x0dl18f2wivn0y";
+      type = "gem";
+    };
+    version = "0.7.2";
+  };
+  tty-screen = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "18jr6s1cg8yb26wzkqa6874q0z93rq0y5aw092kdqazk71y6a235";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
+  unicode-display_width = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1d0azx233nags5jx3fqyr23qa2rhgzbhv8pxp46dgbg1mpf82xky";
+      type = "gem";
+    };
+    version = "2.5.0";
+  };
+  unicode_utils = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0h1a5yvrxzlf0lxxa1ya31jcizslf774arnsd89vgdhk4g7x08mr";
+      type = "gem";
+    };
+    version = "1.4.0";
+  };
+}
diff --git a/pkgs/by-name/ba/bashly/package.nix b/pkgs/by-name/ba/bashly/package.nix
new file mode 100644
index 0000000000000..5a3d6661caa2d
--- /dev/null
+++ b/pkgs/by-name/ba/bashly/package.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenvNoCC
+, bundlerApp
+}:
+
+let
+  bashlyBundlerApp = bundlerApp {
+    pname = "bashly";
+    gemdir = ./.;
+    exes = [ "bashly" ];
+  };
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  name = "bashly";
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out;
+    cd $out;
+
+    mkdir bin; pushd bin;
+    ln -vs ${bashlyBundlerApp}/bin/bashly;
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Bash command line framework and CLI generator";
+    homepage = "https://github.com/DannyBen/bashly";
+    license = lib.licenses.mit;
+    mainProgram = "bashly";
+    maintainers = with lib.maintainers; [ drupol ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fi/firewalk/package.nix b/pkgs/by-name/fi/firewalk/package.nix
new file mode 100644
index 0000000000000..8909a61062c77
--- /dev/null
+++ b/pkgs/by-name/fi/firewalk/package.nix
@@ -0,0 +1,27 @@
+{ lib
+, stdenv
+, fetchurl
+, libnet
+, libpcap
+, libdnet
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "firewalk";
+  version = "5.0";
+
+  src = fetchurl {
+    url = "https://salsa.debian.org/pkg-security-team/firewalk/-/archive/upstream/${finalAttrs.version}/firewalk-upstream-${finalAttrs.version}.tar.gz";
+    hash = "sha256-f0sHzcH3faeg7epfpWXbgaHrRWaWBKMEqLdy38+svGo=";
+  };
+
+  buildInputs = [ libnet libpcap libdnet ];
+
+  meta = with lib; {
+    description = "Gateway ACL scanner";
+    homepage = "http://packetfactory.openwall.net/projects/firewalk/";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ tochiaha ];
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/fl/flip/package.nix b/pkgs/by-name/fl/flip/package.nix
new file mode 100644
index 0000000000000..f7957c0990b00
--- /dev/null
+++ b/pkgs/by-name/fl/flip/package.nix
@@ -0,0 +1,32 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  cmake
+}:
+
+stdenv.mkDerivation {
+  pname = "flip";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "NVlabs";
+    repo = "flip";
+    rev = "8303adb2060d69423d040453995f4ad1a030a1cc";
+    hash = "sha256-jSB79qOtnW/cjApIDcLRqGabnzCIwS7saA+aF1TcyV0=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "A tool for visualizing and communicating the errors in rendered images.";
+    license = licenses.bsd3;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ zmitchell ];
+    mainProgram = "flip";
+  };
+}
diff --git a/pkgs/by-name/ji/jitterentropy-rngd/package.nix b/pkgs/by-name/ji/jitterentropy-rngd/package.nix
new file mode 100644
index 0000000000000..feb7d1e2fb126
--- /dev/null
+++ b/pkgs/by-name/ji/jitterentropy-rngd/package.nix
@@ -0,0 +1,34 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "jitterentropy-rngd";
+  version = "1.2.8";
+
+  src = fetchFromGitHub {
+    owner = "smuellerDD";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-LDym636ss3B1G/vrqatu9g5vbVEeDX0JQcxZ/IxGeY0=";
+  };
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    make install DESTDIR= PREFIX=$out UNITDIR=$out/lib/systemd/system
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = ''A random number generator, which injects entropy to the kernel'';
+    homepage = "https://github.com/smuellerDD/jitterentropy-rngd";
+    changelog = "https://github.com/smuellerDD/jitterentropy-rngd/releases/tag/v${version}";
+    license = [ licenses.gpl2Only licenses.bsd3 ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ thillux ];
+    mainProgram = "jitterentropy-rngd";
+  };
+}
diff --git a/pkgs/by-name/ko/konbucase/package.nix b/pkgs/by-name/ko/konbucase/package.nix
new file mode 100644
index 0000000000000..75876d990661e
--- /dev/null
+++ b/pkgs/by-name/ko/konbucase/package.nix
@@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, vala
+, pkg-config
+, wrapGAppsHook
+, pantheon
+, gtksourceview5
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "konbucase";
+  version = "4.1.1";
+
+  src = fetchFromGitHub {
+    owner = "ryonakano";
+    repo = "konbucase";
+    rev = finalAttrs.version;
+    hash = "sha256-g3EDa9EXymi6c8dRHFZYGEAT7k8M2TXUAzZVKTnLzyk=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    vala
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    pantheon.granite7
+    gtksourceview5
+  ];
+
+  postInstall = ''
+    mv $out/bin/com.github.ryonakano.konbucase $out/bin/konbucase
+    substituteInPlace $out/share/applications/com.github.ryonakano.konbucase.desktop \
+      --replace 'Exec=com.github.ryonakano.konbucase' 'Exec=${placeholder "out"}/bin/konbucase'
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/ryonakano/konbucase";
+    description = "A case converting app suitable for coding or typing";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ galaxy ];
+    platforms = platforms.linux;
+    mainProgram = "konbucase";
+  };
+})
diff --git a/pkgs/by-name/on/onedriver/package.nix b/pkgs/by-name/on/onedriver/package.nix
new file mode 100644
index 0000000000000..f4087401ea92d
--- /dev/null
+++ b/pkgs/by-name/on/onedriver/package.nix
@@ -0,0 +1,64 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+, pkg-config
+, webkitgtk
+, glib
+, fuse
+, installShellFiles
+}:
+let
+  pname = "onedriver";
+  version = "0.13.0-2";
+
+  src = fetchFromGitHub {
+    owner = "jstaf";
+    repo = "onedriver";
+    rev = "v${version}";
+    hash = "sha256-Bcjgmx9a4pTRhkzR3tbOB6InjvuH71qomv4t+nRNc+w=";
+  };
+in
+buildGoModule {
+  inherit pname version src;
+  vendorHash = "sha256-OOiiKtKb+BiFkoSBUQQfqm4dMfDW3Is+30Kwcdg8LNA=";
+
+  nativeBuildInputs = [ pkg-config installShellFiles ];
+  buildInputs = [ webkitgtk glib fuse ];
+
+  ldflags = [ "-X github.com/jstaf/onedriver/cmd/common.commit=v${version}" ];
+
+  subPackages = [
+    "cmd/onedriver"
+    "cmd/onedriver-launcher"
+  ];
+
+  postInstall = ''
+    echo "Running postInstall"
+    install -Dm644 ./resources/onedriver.svg $out/share/icons/onedriver/onedriver.svg
+    install -Dm644 ./resources/onedriver.png $out/share/icons/onedriver/onedriver.png
+    install -Dm644 ./resources/onedriver-128.png $out/share/icons/onedriver/onedriver-128.png
+
+    install -Dm644 ./resources/onedriver.desktop $out/share/applications/onedriver.desktop
+
+    mkdir -p $out/share/man/man1
+    installManPage ./resources/onedriver.1
+
+    substituteInPlace $out/share/applications/onedriver.desktop \
+      --replace "/usr/bin/onedriver-launcher" "$out/bin/onedriver-launcher" \
+      --replace "/usr/share/icons" "$out/share/icons"
+  '';
+
+  meta = with lib; {
+    description = "A network filesystem for Linux";
+    longDescription = ''
+      onedriver is a network filesystem that gives your computer direct access to your files on Microsoft OneDrive.
+      This is not a sync client. Instead of syncing files, onedriver performs an on-demand download of files when
+      your computer attempts to use them. onedriver allows you to use files on OneDrive as if they were files on
+      your local computer.
+    '';
+    inherit (src.meta) homepage;
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.massimogengarelli ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/pr/presenterm/package.nix b/pkgs/by-name/pr/presenterm/package.nix
index e3c42056a2759..6e09e86f2059f 100644
--- a/pkgs/by-name/pr/presenterm/package.nix
+++ b/pkgs/by-name/pr/presenterm/package.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "presenterm";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "mfontanini";
     repo = "presenterm";
-    rev = version;
-    hash = "sha256-mNWnUUezKIffh5gMgMMdvApNZZTxxB8XrL0jFLyBxuk=";
+    rev = "v${version}";
+    hash = "sha256-sXVMVU34gxZKGNye6hoyv07a7N7f6UbivA6thbSOeZA=";
   };
 
-  cargoHash = "sha256-JLPJLhWN/yXpPIHa+FJ2aQ/GDUFKtZ7t+/8rvR8WNKM=";
+  cargoHash = "sha256-PsDaXMws/8hEvAZwClQ4okGuryg1iKg0IBr7Xp2QYBE=";
 
   meta = with lib; {
     description = "A terminal based slideshow tool";
diff --git a/pkgs/applications/editors/tecoc/default.nix b/pkgs/by-name/te/tecoc/package.nix
index 778115dfbfa78..a5531b3aa874b 100644
--- a/pkgs/applications/editors/tecoc/default.nix
+++ b/pkgs/by-name/te/tecoc/package.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
       TECOC is a portable C implementation of TECO-11.
     '';
     license = {
-      url = "https://github.com/blakemcbride/TECOC/tree/master/doc/readme-1st.txt";
+      url = "https://github.com/blakemcbride/TECOC/blob/${finalAttrs.src.rev}/doc/readme-1st.txt";
     };
     maintainers = [ lib.maintainers.AndersonTorres ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/tp/tpm2-totp/package.nix b/pkgs/by-name/tp/tpm2-totp/package.nix
new file mode 100644
index 0000000000000..766c6e138af64
--- /dev/null
+++ b/pkgs/by-name/tp/tpm2-totp/package.nix
@@ -0,0 +1,46 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, tpm2-tss
+, autoreconfHook
+, autoconf-archive
+, pkg-config
+, qrencode
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tpm2-totp";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "tpm2-software";
+    repo = "tpm2-totp";
+    rev = "v${version}";
+    hash = "sha256-aeWhI2GQcWa0xAqlmHfcbCMg78UqcD6eanLlEVNVnRM=";
+  };
+
+  preConfigure = ''
+    echo '0.3.0' > VERSION
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    autoconf-archive
+    pkg-config
+  ];
+
+  buildInputs = [
+    tpm2-tss
+    qrencode
+  ];
+
+  meta = with lib; {
+    description = "Attest the trustworthiness of a device against a human using time-based one-time passwords";
+    homepage = "https://github.com/tpm2-software/tpm2-totp";
+    changelog = "https://github.com/tpm2-software/tpm2-totp/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.bsd3;
+    mainProgram = "tpm2-totp";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/data/themes/nordic/default.nix b/pkgs/data/themes/nordic/default.nix
index 8d977671fe7da..c8e956c3f83db 100644
--- a/pkgs/data/themes/nordic/default.nix
+++ b/pkgs/data/themes/nordic/default.nix
@@ -3,6 +3,7 @@
 , fetchFromGitHub
 , gtk-engine-murrine
 , jdupes
+, libsForQt5
 }:
 
 stdenv.mkDerivation rec {
@@ -79,6 +80,15 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ jdupes ];
 
+  buildInputs = with libsForQt5; [
+    plasma-framework
+    qtgraphicaleffects
+    plasma-workspace
+    breeze-icons
+  ];
+
+  dontWrapQtApps = true;
+
   propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
   installPhase = ''
diff --git a/pkgs/data/themes/orchis-theme/default.nix b/pkgs/data/themes/orchis-theme/default.nix
index 2d07ac3ae380d..351c1c22207cd 100644
--- a/pkgs/data/themes/orchis-theme/default.nix
+++ b/pkgs/data/themes/orchis-theme/default.nix
@@ -26,13 +26,13 @@ lib.checkListOfEnum "${pname}: theme tweaks" validTweaks tweaks
 stdenvNoCC.mkDerivation
 rec {
   inherit pname;
-  version = "2023-05-27";
+  version = "2023-10-20";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    hash = "sha256-I1a8y9dAJqFgnhyMqfupSdGvbbScf6tSYKlAhAzY4Dk=";
+    hash = "sha256-GhSzTtbuvbAuXxKNm29sJX5kXE2s2jMDB6Ww6Q7GNSo=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];
diff --git a/pkgs/development/compilers/flutter/package-overrides/default.nix b/pkgs/development/compilers/dart/package-overrides/default.nix
index c162929e336a5..c162929e336a5 100644
--- a/pkgs/development/compilers/flutter/package-overrides/default.nix
+++ b/pkgs/development/compilers/dart/package-overrides/default.nix
diff --git a/pkgs/development/compilers/flutter/package-overrides/flutter-secure-storage-linux/default.nix b/pkgs/development/compilers/dart/package-overrides/flutter-secure-storage-linux/default.nix
index 91a61cb6c603f..91a61cb6c603f 100644
--- a/pkgs/development/compilers/flutter/package-overrides/flutter-secure-storage-linux/default.nix
+++ b/pkgs/development/compilers/dart/package-overrides/flutter-secure-storage-linux/default.nix
diff --git a/pkgs/development/compilers/flutter/package-overrides/handy-window/default.nix b/pkgs/development/compilers/dart/package-overrides/handy-window/default.nix
index 49b5d47487e88..49b5d47487e88 100644
--- a/pkgs/development/compilers/flutter/package-overrides/handy-window/default.nix
+++ b/pkgs/development/compilers/dart/package-overrides/handy-window/default.nix
diff --git a/pkgs/development/compilers/flutter/package-overrides/matrix/default.nix b/pkgs/development/compilers/dart/package-overrides/matrix/default.nix
index fb1adafa3208a..fb1adafa3208a 100644
--- a/pkgs/development/compilers/flutter/package-overrides/matrix/default.nix
+++ b/pkgs/development/compilers/dart/package-overrides/matrix/default.nix
diff --git a/pkgs/development/compilers/flutter/package-overrides/olm/default.nix b/pkgs/development/compilers/dart/package-overrides/olm/default.nix
index e91e8f393ca7f..e91e8f393ca7f 100644
--- a/pkgs/development/compilers/flutter/package-overrides/olm/default.nix
+++ b/pkgs/development/compilers/dart/package-overrides/olm/default.nix
diff --git a/pkgs/development/compilers/mrustc/default.nix b/pkgs/development/compilers/mrustc/default.nix
index 6570199f8523b..eae17cbce91fa 100644
--- a/pkgs/development/compilers/mrustc/default.nix
+++ b/pkgs/development/compilers/mrustc/default.nix
@@ -4,9 +4,9 @@
 }:
 
 let
-  version = "0.10";
+  version = "0.10.1";
   tag = "v${version}";
-  rev = "b364724f15fd6fce8234ad8add68107c23a22151";
+  rev = "b6754f574f8846eb842feba4ccbeeecb10bdfacc";
 in
 
 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     owner = "thepowersgang";
     repo = "mrustc";
     rev = tag;
-    sha256 = "0f7kh4n2663sn0z3xib8gzw0s97qpvwag40g2vs3bfjlrbpgi9z0";
+    hash = "sha256-sYnx5dUTaQbK4ugnSzAJwIUwZKPUhThmNA+WlY+LEWc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/embedded/stm32/stm32cubemx/default.nix b/pkgs/development/embedded/stm32/stm32cubemx/default.nix
index a9384d9b2b8b3..e3e0f2672cf25 100644
--- a/pkgs/development/embedded/stm32/stm32cubemx/default.nix
+++ b/pkgs/development/embedded/stm32/stm32cubemx/default.nix
@@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "stm32cubemx";
-  version = "6.9.1";
+  version = "6.9.2";
 
   src = fetchzip {
     url = "https://sw-center.st.com/packs/resource/library/stm32cube_mx_v${builtins.replaceStrings ["."] [""] version}-lin.zip";
-    sha256 = "sha256-KTbIRj7DkWoC2h/TLKjVduvsKVSue28kGOL34JqBVx4=";
+    sha256 = "sha256-x3ZRMtTvFGz2/0gJMx4zOx9rSnrSkCEl3pj5raeyVHg=";
     stripRoot = false;
   };
 
diff --git a/pkgs/development/libraries/argagg/0001-catch.diff b/pkgs/development/libraries/argagg/0001-catch.diff
deleted file mode 100644
index f99649d568124..0000000000000
--- a/pkgs/development/libraries/argagg/0001-catch.diff
+++ /dev/null
@@ -1,20 +0,0 @@
---- old/test/doctest.h	2019-03-05 18:04:06.143740733 +0300
-+++ new/test/doctest.h	2019-03-05 18:04:43.577284916 +0300
-@@ -1307,7 +1307,7 @@
-                                                        __FILE__, __LINE__, #expr, #as);            \
-             try {                                                                                  \
-                 expr;                                                                              \
--            } catch(as) {                                                                          \
-+            } catch(as e) {                                                                          \
-                 _DOCTEST_RB.m_threw    = true;                                                     \
-                 _DOCTEST_RB.m_threw_as = true;                                                     \
-             } catch(...) { _DOCTEST_RB.m_threw = true; }                                           \
-@@ -1332,7 +1332,7 @@
- #define DOCTEST_REQUIRE_THROWS(expr) DOCTEST_ASSERT_THROWS(expr, DT_REQUIRE_THROWS)
- 
- #define DOCTEST_WARN_THROWS_AS(expr, ex) DOCTEST_ASSERT_THROWS_AS(expr, ex, DT_WARN_THROWS_AS)
--#define DOCTEST_CHECK_THROWS_AS(expr, ex) DOCTEST_ASSERT_THROWS_AS(expr, ex, DT_CHECK_THROWS_AS)
-+#define DOCTEST_CHECK_THROWS_AS(expr, ex) DOCTEST_ASSERT_THROWS_AS(expr, const ex &, DT_CHECK_THROWS_AS)
- #define DOCTEST_REQUIRE_THROWS_AS(expr, ex) DOCTEST_ASSERT_THROWS_AS(expr, ex, DT_REQUIRE_THROWS_AS)
- 
- #define DOCTEST_WARN_NOTHROW(expr) DOCTEST_ASSERT_NOTHROW(expr, DT_WARN_NOTHROW)
diff --git a/pkgs/development/libraries/ldb/default.nix b/pkgs/development/libraries/ldb/default.nix
index 95547fb6382a3..de1af1f447e81 100644
--- a/pkgs/development/libraries/ldb/default.nix
+++ b/pkgs/development/libraries/ldb/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ldb";
-  version = "2.7.2";
+  version = "2.8.0";
 
   src = fetchurl {
     url = "mirror://samba/ldb/${pname}-${version}.tar.gz";
-    hash = "sha256-Ju5y1keFTmYtmWQ+srLTQWVavzH0mQg41mUPtc+SCcg=";
+    hash = "sha256-NY3KEPzScgeshXoNf0NaRtvGzR98ENu4QMGTG/GWXwg=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libspf2/default.nix b/pkgs/development/libraries/libspf2/default.nix
index b7bef29735232..997e89b82397c 100644
--- a/pkgs/development/libraries/libspf2/default.nix
+++ b/pkgs/development/libraries/libspf2/default.nix
@@ -1,23 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, fetchpatch }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   pname = "libspf2";
-  version = "2.2.12";
+  version = "2.2.13";
 
   src = fetchFromGitHub {
     owner = "helsinki-systems";
     repo = "libspf2";
     rev = "v${version}";
-    sha256 = "03iiaafdcwh220pqignk407h6klrakwz0zkb8iwk6nkwipkwvhsx";
+    hash = "sha256-tkCHP3B1sBb0+scHBjX5lCvaeSrZryfaGKye02LFlYs=";
   };
 
-  patches = [
-    # glibc-2.34 compat
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/gentoo/gentoo/dbb8a5c9f749cc11e61cfe558f164b165cbc30cb/mail-filter/libspf2/files/libspf2-1.2.11-undefined-dn_.patch";
-      sha256 = "sha256-6JVVkVGCcFJsNeBdVTPcLhW4KoHLY4ai/KXDMliXgPA=";
-    })
-  ];
+  nativeBuildInputs = [ autoreconfHook ];
+  strictDeps = true;
 
   postPatch = ''
     # disable static bins compilation
@@ -28,9 +23,6 @@ stdenv.mkDerivation rec {
       -e '/bin_PROGRAMS/s/spf_example_static//' src/spf_example/Makefile.am
   '';
 
-  # autoreconf necessary because we modified automake files
-  nativeBuildInputs = [ autoreconfHook ];
-
   doCheck = true;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libunarr/default.nix b/pkgs/development/libraries/libunarr/default.nix
index 1feafabfd4df9..c1e0881bf3ff2 100644
--- a/pkgs/development/libraries/libunarr/default.nix
+++ b/pkgs/development/libraries/libunarr/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libunarr";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchurl {
     url = "https://github.com/selmf/unarr/releases/download/v${version}/unarr-${version}.tar.xz";
-    hash = "sha256-5wCnhjoj+GTmaeDTCrUnm1Wt9SsWAbQcPSYM//FNeOA=";
+    hash = "sha256-Mo76BOqZbdOJFrEkeozxdqwpuFyvkhdONNMZmN5BdNI=";
   };
 
   postPatch = lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/libraries/openxr-loader/default.nix b/pkgs/development/libraries/openxr-loader/default.nix
index 1abc8a2633c69..53bfa41a8e253 100644
--- a/pkgs/development/libraries/openxr-loader/default.nix
+++ b/pkgs/development/libraries/openxr-loader/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openxr-loader";
-  version = "1.0.30";
+  version = "1.0.31";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenXR-SDK-Source";
     rev = "release-${version}";
-    sha256 = "sha256-lF8Pauyi+zSNVnpHqq86J3SGUTM6AhFmnT48eyFoYco=";
+    sha256 = "sha256-qK8l/v6nLuMAitz7DfVDjJyVjEmkeD2jgJkG5qOMCcQ=";
   };
 
   nativeBuildInputs = [ cmake python3 pkg-config ];
diff --git a/pkgs/development/libraries/science/chemistry/tblite/default.nix b/pkgs/development/libraries/science/chemistry/tblite/default.nix
index 0f05315b9d88c..7cc64937dc131 100644
--- a/pkgs/development/libraries/science/chemistry/tblite/default.nix
+++ b/pkgs/development/libraries/science/chemistry/tblite/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , gfortran
 , blas
@@ -26,6 +27,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-R7CAFG/x55k5Ieslxeq+DWq1wPip4cI+Yvn1cBbeVNs=";
   };
 
+  patches = [
+    # toml-f 0.4 compatibility
+    (fetchpatch {
+      url = "https://github.com/tblite/tblite/commit/da759fd02b8fbf470a5c6d3df9657cca6b1d0a9a.diff";
+      hash = "sha256-VaeA2VyK+Eas432HMSpJ0lXxHBBNGpfkUO1eHeWpYl0=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake gfortran ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/toml-f/default.nix b/pkgs/development/libraries/toml-f/default.nix
index d28447c400467..696e41ac71cc4 100644
--- a/pkgs/development/libraries/toml-f/default.nix
+++ b/pkgs/development/libraries/toml-f/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "toml-f";
-  version = "0.3.1";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-8FbnUkeJUP4fiuJCroAVDo6U2M7ZkFLpG2OYrapMYtU=";
+    hash = "sha256-sCU0uMdcXIA5O964hlK37cOrLTlk1CJeTcWD9FhevOs=";
   };
 
   nativeBuildInputs = [ gfortran cmake ];
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 636c411acca4d..f344bd9485153 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -478,6 +478,30 @@ buildLuarocksPackage {
   };
 }) {};
 
+ferris-nvim = callPackage({ fetchzip, buildLuarocksPackage, lua, luaOlder }:
+buildLuarocksPackage {
+  pname = "ferris.nvim";
+  version = "2.0.0-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/ferris.nvim-2.0.0-1.rockspec";
+    sha256 = "00d3x2hbs8625ky50r2w08c6idcx3bkrk0rks5qd8yh7v61nj53h";
+  }).outPath;
+  src = fetchzip {
+    url    = "https://github.com/mrcjkb/ferris.nvim/archive/2.0.0.zip";
+    sha256 = "1fb18k0ylb06h4ifs9k6lfc42y74xpavzwkqy55lfdkmlbc7jmhy";
+  };
+
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua ];
+
+  meta = {
+    homepage = "https://github.com/mrcjkb/ferris.nvim";
+    description = "Supercharge your Rust experience in Neovim! A heavily modified fork of rust-tools.nvim";
+    maintainers = with lib.maintainers; [ mrcjkb ];
+    license.fullName = "GPL-2.0";
+  };
+}) {};
+
 fifo = callPackage({ fetchzip, lua, buildLuarocksPackage }:
 buildLuarocksPackage {
   pname = "fifo";
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 74801b581eaa7..f0e9b379f4292 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -166,6 +166,7 @@
 , "markdown-link-check"
 , "mastodon-bot"
 , "mathjax"
+, "mathjax-node-cli"
 , "meat"
 , "mocha"
 , "multi-file-swagger"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index 2035839ec0fa7..2686f65e3b21d 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -19057,6 +19057,15 @@ let
         sha512 = "0yayqDxWQbqk3ojkYqUKqaAQ6AfNKeKWRNA8kR0WXzAsdHpP4BIaOmMAG87JGuO6qcobyW4GjxHd9PmhEd+T9w==";
       };
     };
+    "cliui-4.1.0" = {
+      name = "cliui";
+      packageName = "cliui";
+      version = "4.1.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/cliui/-/cliui-4.1.0.tgz";
+        sha512 = "4FG+RSG9DL7uEwRUZXZn3SS34DiDPfzP0VOiEwtUWlE+AR2EIg+hSyvrIgUUfhdgR/UkAeW2QHgeP+hWrXs7jQ==";
+      };
+    };
     "cliui-5.0.0" = {
       name = "cliui";
       packageName = "cliui";
@@ -32416,6 +32425,15 @@ let
         sha512 = "xgs2NH9AE66ucSq4cNG1nhSFghr5l6tdL15Pk+jl46bmmBapgoaY/AacXyaDznAqmGL99TiLSQgO/XazFSKYeQ==";
       };
     };
+    "invert-kv-2.0.0" = {
+      name = "invert-kv";
+      packageName = "invert-kv";
+      version = "2.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/invert-kv/-/invert-kv-2.0.0.tgz";
+        sha512 = "wPVv/y/QQ/Uiirj/vh3oP+1Ww+AWehmi1g5fFWGPF6IpCBCDVrhgHRMvrLfdYcwDh3QJbGXDW4JAuzxElLSqKA==";
+      };
+    };
     "iota-array-1.0.0" = {
       name = "iota-array";
       packageName = "iota-array";
@@ -34720,6 +34738,15 @@ let
         sha512 = "SdRK2C7jjs4k/kT2mwtO07KJN9RnjxtKn03d9JVj6c3j9WwaLcFYsICYDnLAzY0hp+wG2nxl+Cm2jWLiNVYb8g==";
       };
     };
+    "jsdom-11.12.0" = {
+      name = "jsdom";
+      packageName = "jsdom";
+      version = "11.12.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/jsdom/-/jsdom-11.12.0.tgz";
+        sha512 = "y8Px43oyiBM13Zc1z780FrfNLJCXTL40EWlty/LXUtcjykRBNgLlCjWXpfSPBl2iv+N7koQN+dvqszHZgT/Fjw==";
+      };
+    };
     "jsdom-14.1.0" = {
       name = "jsdom";
       packageName = "jsdom";
@@ -35917,6 +35944,15 @@ let
         sha512 = "YiGkH6EnGrDGqLMITnGjXtGmNtjoXw9SVUzcaos8RBi7Ps0VBylkq+vOcY9QE5poLasPCR849ucFUkl0UzUyOw==";
       };
     };
+    "lcid-2.0.0" = {
+      name = "lcid";
+      packageName = "lcid";
+      version = "2.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/lcid/-/lcid-2.0.0.tgz";
+        sha512 = "avPEb8P8EGnwXKClwsNUgryVjllcRqtMYa49NTsbQagYuT1DcXnl1915oxWjoyGrXR6zH/Y0Zc96xWsPcoDKeA==";
+      };
+    };
     "ldap-filter-0.3.3" = {
       name = "ldap-filter";
       packageName = "ldap-filter";
@@ -35971,6 +36007,15 @@ let
         sha512 = "IpSVCk9AYvLHo5ctcIXxOBpMWUe+4TKN3VPWAKUbJikkmsGp0VrSM8IttVc32D6J4WUsiPE6aEFRNmIoF/gdow==";
       };
     };
+    "left-pad-1.3.0" = {
+      name = "left-pad";
+      packageName = "left-pad";
+      version = "1.3.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz";
+        sha512 = "XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA==";
+      };
+    };
     "less-4.2.0" = {
       name = "less";
       packageName = "less";
@@ -38528,6 +38573,33 @@ let
         sha512 = "rUxjysqif/BZQH2yhd5Aaq7vXMSx9NdEsQcyA07uEzIvxgI7zIr33gGsh+RU0/XjmQpCW7RsVof1vlkvQVCK5A==";
       };
     };
+    "mathjax-2.7.9" = {
+      name = "mathjax";
+      packageName = "mathjax";
+      version = "2.7.9";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/mathjax/-/mathjax-2.7.9.tgz";
+        sha512 = "NOGEDTIM9+MrsqnjPEjVGNx4q0GQxqm61yQwSK+/5S59i26wId5IC5gNu9/bu8+CCVl5p9G2IHcAl/wJa+5+BQ==";
+      };
+    };
+    "mathjax-node-2.1.1" = {
+      name = "mathjax-node";
+      packageName = "mathjax-node";
+      version = "2.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/mathjax-node/-/mathjax-node-2.1.1.tgz";
+        sha512 = "i29tvqD8yHPB2WhrGV5rvliYnKwTT8a/TO8SCnuYtatpSHxLGy3aF7lDTVLD6B1bfuVMTFB6McZu2TBxk0XGeg==";
+      };
+    };
+    "mathjax-node-sre-3.0.3" = {
+      name = "mathjax-node-sre";
+      packageName = "mathjax-node-sre";
+      version = "3.0.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/mathjax-node-sre/-/mathjax-node-sre-3.0.3.tgz";
+        sha512 = "SBwqD3DEgdYyPQv7vUBqH/uCr0eOI23PbffzmhelFPY8KdVANZkE2hssJA0Dfl23y7uEefsoVOryckMLEmmzaw==";
+      };
+    };
     "mathml-tag-names-2.1.3" = {
       name = "mathml-tag-names";
       packageName = "mathml-tag-names";
@@ -43272,6 +43344,15 @@ let
         sha512 = "PRT7ZORmwu2MEFt4/fv3Q+mEfN4zetKxufQrkShY2oGvUms9r8otu5HfdyIFHkYXjO7laNsoVGmM2MANfuTA8g==";
       };
     };
+    "os-locale-3.1.0" = {
+      name = "os-locale";
+      packageName = "os-locale";
+      version = "3.1.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/os-locale/-/os-locale-3.1.0.tgz";
+        sha512 = "Z8l3R4wYWM40/52Z+S265okfFj8Kt2cC2MKY+xNi3kFs+XGI7WXu/I309QQQYbRW4ijiZ+yxs9pqEhJh0DqW3Q==";
+      };
+    };
     "os-paths-4.4.0" = {
       name = "os-paths";
       packageName = "os-paths";
@@ -44271,6 +44352,15 @@ let
         sha512 = "rgO9Zg5LLLkfJF9E6CCmXlSE4UVceloys8JrFqCcHloC3usd/kJCyPDwH2SOlzix2j3xaP9sUX3e8+kvkuleAA==";
       };
     };
+    "parse5-4.0.0" = {
+      name = "parse5";
+      packageName = "parse5";
+      version = "4.0.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/parse5/-/parse5-4.0.0.tgz";
+        sha512 = "VrZ7eOd3T1Fk4XWNXMgiGBK/z0MG48BWG2uQNU4I72fkQuKUTZpl+u9k+CxEG0twMVzSmXEEz12z5Fnw1jIQFA==";
+      };
+    };
     "parse5-5.1.0" = {
       name = "parse5";
       packageName = "parse5";
@@ -52254,6 +52344,15 @@ let
         sha512 = "1klA3Gi5PD1Wv9Q0wUoOQN1IWAuPu0D1U03ThXTr0cJ20+/iq2tHSDnK7Kk/0LXJ1ztUB2/1Os0wKmfyNgUQfg==";
       };
     };
+    "speech-rule-engine-2.4.0" = {
+      name = "speech-rule-engine";
+      packageName = "speech-rule-engine";
+      version = "2.4.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/speech-rule-engine/-/speech-rule-engine-2.4.0.tgz";
+        sha512 = "7IXDmpGiQOJWUPVy/rcayqi1aTCrhcQ/bVACu2oyueEuiYzPW8GebYRF4LeyMROL/E0kxkO5U66t0aFWCv0QCQ==";
+      };
+    };
     "speed-limiter-1.0.2" = {
       name = "speed-limiter";
       packageName = "speed-limiter";
@@ -59455,6 +59554,15 @@ let
         sha512 = "saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==";
       };
     };
+    "whatwg-url-6.5.0" = {
+      name = "whatwg-url";
+      packageName = "whatwg-url";
+      version = "6.5.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/whatwg-url/-/whatwg-url-6.5.0.tgz";
+        sha512 = "rhRZRqx/TLJQWUpQ6bmrt2UV4f0HCQ463yQuONJqC6fO2VoEb1pTYddbe59SkYq87aoM5A3bdhMZiUiVws+fzQ==";
+      };
+    };
     "whatwg-url-7.1.0" = {
       name = "whatwg-url";
       packageName = "whatwg-url";
@@ -59590,6 +59698,15 @@ let
         sha512 = "qe9UWWpkeG5yzZ0tNYxDmd7vo58HDBc39mZ0xWWpolAGADdFOzkfamWLDxkOWcvHQKVmdTyQdLD4NOfjLWTKew==";
       };
     };
+    "wicked-good-xpath-1.3.0" = {
+      name = "wicked-good-xpath";
+      packageName = "wicked-good-xpath";
+      version = "1.3.0";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/wicked-good-xpath/-/wicked-good-xpath-1.3.0.tgz";
+        sha512 = "Gd9+TUn5nXdwj/hFsPVx5cuHHiF5Bwuc30jZ4+ronF1qHK5O7HD0sgmXWSEgwKquT3ClLoKPVbO6qGwVwLzvAw==";
+      };
+    };
     "wide-align-1.1.5" = {
       name = "wide-align";
       packageName = "wide-align";
@@ -60094,6 +60211,15 @@ let
         sha512 = "61a+9LgtYZxTq1hAonhX8Xwpo2riK4IOR/BIVxioFbCfc3QFKmpE4x9dLExfLHKtUfVZigYa36tThVhO57erEw==";
       };
     };
+    "ws-5.2.3" = {
+      name = "ws";
+      packageName = "ws";
+      version = "5.2.3";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/ws/-/ws-5.2.3.tgz";
+        sha512 = "jZArVERrMsKUatIdnLzqvcfydI85dvd/Fp1u/VOpfdDWQ4c9qWXe+VIeAbQ5FrDwciAkr+lzofXLz3Kuf26AOA==";
+      };
+    };
     "ws-6.1.4" = {
       name = "ws";
       packageName = "ws";
@@ -60472,6 +60598,15 @@ let
         sha512 = "yS2uJflVQs6n+CyjHoaBmVSqIDevTAWrzMmjG1Gc7h1qQ7uVozNhEPJAwZXWyGQ/Gafo3fCwrcaokezLPupVyQ==";
       };
     };
+    "xmldom-sre-0.1.31" = {
+      name = "xmldom-sre";
+      packageName = "xmldom-sre";
+      version = "0.1.31";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/xmldom-sre/-/xmldom-sre-0.1.31.tgz";
+        sha512 = "f9s+fUkX04BxQf+7mMWAp5zk61pciie+fFLC9hX9UVvCeJQfNHRHXpeo5MPcR0EUf57PYLdt+ZO4f3Ipk2oZUw==";
+      };
+    };
     "xmlhttprequest-https://github.com/LearnBoost/node-XMLHttpRequest/archive/0f36d0b5ebc03d85f860d42a64ae9791e1daa433.tar.gz" = {
       name = "xmlhttprequest";
       packageName = "xmlhttprequest";
@@ -60680,6 +60815,15 @@ let
         sha512 = "C/FsVVhht4iPQYXOInoxUM/1ELSf9EsgKH34FofQOp6hwCPrW4vG4w5++TED3xRUo8gD7l0P1J1dLlDYzODsTQ==";
       };
     };
+    "yargs-12.0.5" = {
+      name = "yargs";
+      packageName = "yargs";
+      version = "12.0.5";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/yargs/-/yargs-12.0.5.tgz";
+        sha512 = "Lhz8TLaYnxq/2ObqHDql8dX8CJi97oHxrjUcYtzKbbykPtVW9WB+poxI+NM2UIzsMgNCZTIf0AQwsjK5yMAqZw==";
+      };
+    };
     "yargs-13.3.2" = {
       name = "yargs";
       packageName = "yargs";
@@ -60788,6 +60932,15 @@ let
         sha512 = "VCIyR1wJoEBZUqk5PA+oOBF6ypbwh5aNB3I50guxAL/quggdfs4TtNHQrSazFA3fYZ+tEqfs0zIGlv0c/rgjbQ==";
       };
     };
+    "yargs-parser-11.1.1" = {
+      name = "yargs-parser";
+      packageName = "yargs-parser";
+      version = "11.1.1";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/yargs-parser/-/yargs-parser-11.1.1.tgz";
+        sha512 = "C6kB/WJDiaxONLJQnF8ccx9SEeoTTLek8RVbaOIsrAUS8VrBEXfmeSnCZxygc+XC2sNMBIwOOnfcxiynjHsVSQ==";
+      };
+    };
     "yargs-parser-13.1.2" = {
       name = "yargs-parser";
       packageName = "yargs-parser";
@@ -86065,6 +86218,212 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
+  mathjax-node-cli = nodeEnv.buildNodePackage {
+    name = "mathjax-node-cli";
+    packageName = "mathjax-node-cli";
+    version = "1.0.1";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/mathjax-node-cli/-/mathjax-node-cli-1.0.1.tgz";
+      sha512 = "p1OB9zalQZkKYumfx+8mSX59MysF2Ox2H88gHSUQpdjpuMISwIPfw0MQmsvcS00hntSX05uEDa3uzo+1SgSk5w==";
+    };
+    dependencies = [
+      sources."abab-2.0.6"
+      sources."acorn-5.7.4"
+      (sources."acorn-globals-4.3.4" // {
+        dependencies = [
+          sources."acorn-6.4.2"
+        ];
+      })
+      sources."acorn-walk-6.2.0"
+      sources."ajv-6.12.6"
+      sources."ansi-regex-3.0.1"
+      sources."ansi-styles-4.3.0"
+      sources."array-equal-1.0.0"
+      sources."asn1-0.2.6"
+      sources."assert-plus-1.0.0"
+      sources."async-limiter-1.0.1"
+      sources."asynckit-0.4.0"
+      sources."aws-sign2-0.7.0"
+      sources."aws4-1.12.0"
+      sources."bcrypt-pbkdf-1.0.2"
+      sources."browser-process-hrtime-1.0.0"
+      sources."camelcase-5.3.1"
+      sources."caseless-0.12.0"
+      sources."cliui-4.1.0"
+      sources."code-point-at-1.1.0"
+      sources."color-convert-2.0.1"
+      sources."color-name-1.1.4"
+      sources."combined-stream-1.0.8"
+      sources."commander-11.0.0"
+      sources."core-util-is-1.0.2"
+      sources."cross-spawn-6.0.5"
+      sources."cssom-0.3.8"
+      sources."cssstyle-1.4.0"
+      sources."dashdash-1.14.1"
+      (sources."data-urls-1.1.0" // {
+        dependencies = [
+          sources."whatwg-url-7.1.0"
+        ];
+      })
+      sources."decamelize-1.2.0"
+      sources."deep-is-0.1.4"
+      sources."delayed-stream-1.0.0"
+      sources."domexception-1.0.1"
+      sources."ecc-jsbn-0.1.2"
+      sources."emoji-regex-8.0.0"
+      sources."end-of-stream-1.4.4"
+      sources."escalade-3.1.1"
+      sources."escodegen-1.14.3"
+      sources."esprima-4.0.1"
+      sources."estraverse-4.3.0"
+      sources."esutils-2.0.3"
+      sources."execa-1.0.0"
+      sources."extend-3.0.2"
+      sources."extsprintf-1.3.0"
+      sources."fast-deep-equal-3.1.3"
+      sources."fast-json-stable-stringify-2.1.0"
+      sources."fast-levenshtein-2.0.6"
+      sources."find-up-3.0.0"
+      sources."forever-agent-0.6.1"
+      sources."form-data-2.3.3"
+      sources."get-caller-file-1.0.3"
+      sources."get-stream-4.1.0"
+      sources."getpass-0.1.7"
+      sources."har-schema-2.0.0"
+      sources."har-validator-5.1.5"
+      sources."html-encoding-sniffer-1.0.2"
+      sources."http-signature-1.2.0"
+      sources."iconv-lite-0.4.24"
+      sources."invert-kv-2.0.0"
+      sources."is-fullwidth-code-point-2.0.0"
+      sources."is-stream-1.1.0"
+      sources."is-typedarray-1.0.0"
+      sources."isexe-2.0.0"
+      sources."isstream-0.1.2"
+      sources."jsbn-0.1.1"
+      sources."jsdom-11.12.0"
+      sources."json-schema-0.4.0"
+      sources."json-schema-traverse-0.4.1"
+      sources."json-stringify-safe-5.0.1"
+      sources."jsprim-1.4.2"
+      sources."lcid-2.0.0"
+      sources."left-pad-1.3.0"
+      sources."levn-0.3.0"
+      sources."locate-path-3.0.0"
+      sources."lodash-4.17.21"
+      sources."lodash.sortby-4.7.0"
+      sources."map-age-cleaner-0.1.3"
+      sources."mathjax-2.7.9"
+      sources."mathjax-node-2.1.1"
+      (sources."mathjax-node-sre-3.0.3" // {
+        dependencies = [
+          sources."yargs-12.0.5"
+        ];
+      })
+      sources."mem-4.3.0"
+      sources."mime-db-1.52.0"
+      sources."mime-types-2.1.35"
+      sources."mimic-fn-2.1.0"
+      sources."nice-try-1.0.5"
+      sources."npm-run-path-2.0.2"
+      sources."number-is-nan-1.0.1"
+      sources."nwsapi-2.2.7"
+      sources."oauth-sign-0.9.0"
+      sources."once-1.4.0"
+      sources."optionator-0.8.3"
+      sources."os-locale-3.1.0"
+      sources."p-defer-1.0.0"
+      sources."p-finally-1.0.0"
+      sources."p-is-promise-2.1.0"
+      sources."p-limit-2.3.0"
+      sources."p-locate-3.0.0"
+      sources."p-try-2.2.0"
+      sources."parse5-4.0.0"
+      sources."path-exists-3.0.0"
+      sources."path-key-2.0.1"
+      sources."performance-now-2.1.0"
+      sources."pn-1.1.0"
+      sources."prelude-ls-1.1.2"
+      sources."psl-1.9.0"
+      sources."pump-3.0.0"
+      sources."punycode-2.3.0"
+      sources."qs-6.5.3"
+      sources."request-2.88.2"
+      sources."request-promise-core-1.1.4"
+      sources."request-promise-native-1.0.9"
+      sources."require-directory-2.1.1"
+      sources."require-main-filename-1.0.1"
+      sources."safe-buffer-5.2.1"
+      sources."safer-buffer-2.1.2"
+      sources."sax-1.3.0"
+      sources."semver-5.7.2"
+      sources."set-blocking-2.0.0"
+      sources."shebang-command-1.2.0"
+      sources."shebang-regex-1.0.0"
+      sources."signal-exit-3.0.7"
+      sources."source-map-0.6.1"
+      sources."speech-rule-engine-2.4.0"
+      sources."sshpk-1.17.0"
+      sources."stealthy-require-1.1.1"
+      sources."string-width-2.1.1"
+      sources."strip-ansi-4.0.0"
+      sources."strip-eof-1.0.0"
+      sources."symbol-tree-3.2.4"
+      sources."tough-cookie-2.5.0"
+      sources."tr46-1.0.1"
+      sources."tunnel-agent-0.6.0"
+      sources."tweetnacl-0.14.5"
+      sources."type-check-0.3.2"
+      sources."uri-js-4.4.1"
+      sources."uuid-3.4.0"
+      sources."verror-1.10.0"
+      sources."w3c-hr-time-1.0.2"
+      sources."webidl-conversions-4.0.2"
+      sources."whatwg-encoding-1.0.5"
+      sources."whatwg-mimetype-2.3.0"
+      sources."whatwg-url-6.5.0"
+      sources."which-1.3.1"
+      sources."which-module-2.0.1"
+      sources."wicked-good-xpath-1.3.0"
+      sources."word-wrap-1.2.5"
+      (sources."wrap-ansi-2.1.0" // {
+        dependencies = [
+          sources."ansi-regex-2.1.1"
+          sources."is-fullwidth-code-point-1.0.0"
+          sources."string-width-1.0.2"
+          sources."strip-ansi-3.0.1"
+        ];
+      })
+      sources."wrappy-1.0.2"
+      sources."ws-5.2.3"
+      sources."xml-name-validator-3.0.0"
+      sources."xmldom-sre-0.1.31"
+      sources."y18n-4.0.3"
+      (sources."yargs-17.7.2" // {
+        dependencies = [
+          sources."ansi-regex-5.0.1"
+          sources."cliui-8.0.1"
+          sources."get-caller-file-2.0.5"
+          sources."is-fullwidth-code-point-3.0.0"
+          sources."string-width-4.2.3"
+          sources."strip-ansi-6.0.1"
+          sources."wrap-ansi-7.0.0"
+          sources."y18n-5.0.8"
+          sources."yargs-parser-21.1.1"
+        ];
+      })
+      sources."yargs-parser-11.1.1"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "CLI tools for calling mathjax-node";
+      homepage = "https://github.com/mathjax/mathjax-node-cli#readme";
+      license = "Apache-2.0";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
   meat = nodeEnv.buildNodePackage {
     name = "meat";
     packageName = "meat";
diff --git a/pkgs/development/php-packages/grumphp/composer-json.patch b/pkgs/development/php-packages/grumphp/composer-json.patch
new file mode 100644
index 0000000000000..7fd7441612cc2
--- /dev/null
+++ b/pkgs/development/php-packages/grumphp/composer-json.patch
@@ -0,0 +1,27 @@
+From 2f53794374e0d32e1f322202c6668655792f745d Mon Sep 17 00:00:00 2001
+From: Pol Dellaiera <pol.dellaiera@protonmail.com>
+Date: Sat, 21 Oct 2023 16:46:59 +0200
+Subject: [PATCH] composer.json
+
+---
+ composer.json | 5 +-
+ 1 file changed, 4 insertion(+), 1 deletion(-)
+
+diff --git i/composer.json w/composer.json
+index 6ac54420..69b75a51 100644
+--- i/composer.json
++++ w/composer.json
+@@ -96,7 +96,10 @@
+         "bin/grumphp"
+     ],
+     "config": {
+-        "sort-packages": true
++        "sort-packages": true,
++        "platform": {
++            "php": "8.1"
++        }
+     },
+     "extra": {
+         "class": "GrumPHP\\Composer\\GrumPHPPlugin"
+--
+2.42.0
diff --git a/pkgs/development/php-packages/grumphp/composer-lock.patch b/pkgs/development/php-packages/grumphp/composer-lock.patch
new file mode 100644
index 0000000000000..2fc801557c4f8
--- /dev/null
+++ b/pkgs/development/php-packages/grumphp/composer-lock.patch
@@ -0,0 +1,24 @@
+From 2f53794374e0d32e1f322202c6668655792f745d Mon Sep 17 00:00:00 2001
+From: Pol Dellaiera <pol.dellaiera@protonmail.com>
+Date: Sat, 21 Oct 2023 16:46:59 +0200
+Subject: [PATCH] composer.lock
+
+---
+ phar.composer.lock | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/phar.composer.lock b/phar.composer.lock
+index 96b692c3..a8cb2a87 100644
+--- a/phar.composer.lock
++++ b/phar.composer.lock
+@@ -4,7 +4,7 @@
+         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
+         "This file is @generated automatically"
+     ],
+-    "content-hash": "8a069c630e6ddbc4475db9a992430539",
++    "content-hash": "0474062650b24a22c63007631cf35f1e",
+     "packages": [
+         {
+             "name": "amphp/amp",
+--
+2.42.0
diff --git a/pkgs/development/php-packages/grumphp/default.nix b/pkgs/development/php-packages/grumphp/default.nix
index c7c2d9fc323e5..6367dd996bf20 100644
--- a/pkgs/development/php-packages/grumphp/default.nix
+++ b/pkgs/development/php-packages/grumphp/default.nix
@@ -1,32 +1,48 @@
-{ mkDerivation, fetchurl, makeWrapper, lib, php }:
+{ fetchFromGitHub, stdenvNoCC, lib, php }:
 
-mkDerivation (finalAttrs: {
+php.buildComposerProject (finalAttrs: {
   pname = "grumphp";
-  version = "1.15.0";
+  version = "2.1.0";
 
-  src = fetchurl {
-    url = "https://github.com/phpro/grumphp/releases/download/v${finalAttrs.version}/grumphp.phar";
-    sha256 = "sha256-EqzJb7DYZb7PnebErLVI/EZLxj0m26cniZlsu1feif0=";
+  src = fetchFromGitHub {
+    owner = "phpro";
+    repo = "grumphp";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-RVgreCspdz+A6mdE2H4i8ajmdH8AZ9BOIw2OqLw7HfI=";
   };
 
-  dontUnpack = true;
+  patches = [
+    ./composer-json.patch
+  ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  composerLock = stdenvNoCC.mkDerivation (finalComposerLockAttrs: {
+    name = "grumphp-composer-lock";
 
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    install -D $src $out/libexec/grumphp/grumphp.phar
-    makeWrapper ${php}/bin/php $out/bin/grumphp \
-      --add-flags "$out/libexec/grumphp/grumphp.phar"
-    runHook postInstall
-  '';
+    src = fetchFromGitHub {
+      owner = "phpro";
+      repo = "grumphp-shim";
+      rev = "v${finalAttrs.version}";
+      hash = "sha256-JxgRd0p/o3ouZ4MPke8cHqvAPuepY8ax0wx4t8+2dME=";
+    };
 
-  meta = with lib; {
+    patches = [
+      ./composer-lock.patch
+    ];
+
+    installPhase = ''
+      runHook preInstall
+      cp phar.composer.lock $out
+      runHook postInstall
+    '';
+  });
+
+  vendorHash = "sha256-yefamPAzIabDCzZ9ghKq9iPH7AoCdgCCQ8PKrUN9ifQ=";
+
+  meta = {
     changelog = "https://github.com/phpro/grumphp/releases/tag/v${finalAttrs.version}";
     description = "A PHP code-quality tool";
     homepage = "https://github.com/phpro/grumphp";
-    license = licenses.mit;
-    maintainers = teams.php.members;
+    license = lib.licenses.mit;
+    maintainers = lib.teams.php.members;
   };
 })
diff --git a/pkgs/development/python-modules/aioairzone-cloud/default.nix b/pkgs/development/python-modules/aioairzone-cloud/default.nix
index bdc21d70892f7..2108555b0d339 100644
--- a/pkgs/development/python-modules/aioairzone-cloud/default.nix
+++ b/pkgs/development/python-modules/aioairzone-cloud/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone-cloud";
-  version = "0.2.4";
+  version = "0.2.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone-cloud";
     rev = "refs/tags/${version}";
-    hash = "sha256-7sjiY20jDUHtEnqAMwEHsBboK9XCH5XjE0sHR82YvEA=";
+    hash = "sha256-v6cK4j16BhTqjdc5J9XQWGFCa1r9f0/dto9teVTNn0c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioairzone/default.nix b/pkgs/development/python-modules/aioairzone/default.nix
index ac094571d087d..39c12ac6e2c08 100644
--- a/pkgs/development/python-modules/aioairzone/default.nix
+++ b/pkgs/development/python-modules/aioairzone/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone";
-  version = "0.6.8";
+  version = "0.6.9";
   format = "pyproject";
 
   disabled = pythonOlder "3.11";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-aCf0IO70t/QMmDmIwBKN3Um1HgHjHn1r6Dze/pWaQ5M=";
+    hash = "sha256-0nbH0pnTYRuSOkzG5Yn/fJmRKtXBMd6ti6Z+AW72j3Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 79ef028fd36ee..c77a4dfadda50 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "17.2.0";
+  version = "18.0.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-+yPHIXJ0vHaFO2X3xN+7WIQUlCvoYlGi1N7W+H/ng/0=";
+    hash = "sha256-Jgu9NEFY74Z0mZ2Cz4uaHG0gfywa2nF/H8G1j9YAyrw=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/asyncwhois/default.nix b/pkgs/development/python-modules/asyncwhois/default.nix
index 25cb21e7e2464..e462a0d0b49c1 100644
--- a/pkgs/development/python-modules/asyncwhois/default.nix
+++ b/pkgs/development/python-modules/asyncwhois/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "asyncwhois";
-  version = "1.0.8";
+  version = "1.0.9";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "pogzyb";
     repo = "asyncwhois";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fYXxoS4bGTat5QT98ETmWk/VKXJmg9mtkUu02SZT4Eo=";
+    hash = "sha256-5T/h4YzODH7zFyQpG8qVZetTK7V+Ii9jc+MQFgMUA8w=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/bimmer-connected/default.nix b/pkgs/development/python-modules/bimmer-connected/default.nix
index 40f7ad7cf8ab4..470eaf376a771 100644
--- a/pkgs/development/python-modules/bimmer-connected/default.nix
+++ b/pkgs/development/python-modules/bimmer-connected/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "bimmer-connected";
-  version = "0.14.1";
+  version = "0.14.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "bimmerconnected";
     repo = "bimmer_connected";
     rev = "refs/tags/${version}";
-    hash = "sha256-Fo30qDBqVxVuD/Ow0jsvN20Hx7Zhvie47CE+1ys1ewU=";
+    hash = "sha256-69H0hB+yVmyzJ5A2Cb7ZcaaoRzMt618U+TUHYQ03/cY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/bleak/default.nix b/pkgs/development/python-modules/bleak/default.nix
index 61a069305d136..f53f614867ec1 100644
--- a/pkgs/development/python-modules/bleak/default.nix
+++ b/pkgs/development/python-modules/bleak/default.nix
@@ -25,6 +25,12 @@ buildPythonPackage rec {
     hash = "sha256-T0im8zKyNLbskAEDeUUFS/daJtvttlHlttjscqP8iSk=";
   };
 
+  postPatch = ''
+    # bleak checks BlueZ's version with a call to `bluetoothctl --version`
+    substituteInPlace bleak/backends/bluezdbus/version.py \
+      --replace \"bluetoothctl\" \"${bluez}/bin/bluetoothctl\"
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -40,12 +46,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    # bleak checks BlueZ's version with a call to `bluetoothctl --version`
-    substituteInPlace bleak/backends/bluezdbus/__init__.py \
-      --replace \"bluetoothctl\" \"${bluez}/bin/bluetoothctl\"
-  '';
-
   pythonImportsCheck = [
     "bleak"
   ];
diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index b5d2ce8eef71d..4394271f7ebd2 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "2.11.1";
+  version = "2.12.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-oYBk+Rko5qK1k2TJdDNiN0rWdx7sdy6UpxMlDynKZ9Y=";
+    hash = "sha256-ZeDQn+/b6WBCodZ7Ow5IlC9XlWieAifCMJtM1yse5P8=";
   };
 
   # The project can build both an optimized cython version and an unoptimized
diff --git a/pkgs/development/python-modules/elgato/default.nix b/pkgs/development/python-modules/elgato/default.nix
index 92b4cad66b5cd..3aeab819b76a5 100644
--- a/pkgs/development/python-modules/elgato/default.nix
+++ b/pkgs/development/python-modules/elgato/default.nix
@@ -13,18 +13,25 @@
 
 buildPythonPackage rec {
   pname = "elgato";
-  version = "4.0.1";
+  version = "5.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-elgato";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kyFnc/lMxgYy8s/gAP5vpEPV8a+dphOummr6G7deGQ4=";
+    hash = "sha256-TI5wu2FYVUMvgDkbktcwPLnTSD8XUSy8qwOCdrsiopk=";
   };
 
+  postPatch = ''
+    # Upstream doesn't set a version for the pyproject.toml
+    substituteInPlace pyproject.toml \
+      --replace "0.0.0" "${version}" \
+      --replace "--cov" ""
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -41,13 +48,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    # Upstream doesn't set a version for the pyproject.toml
-    substituteInPlace pyproject.toml \
-      --replace "0.0.0" "${version}" \
-      --replace "--cov" ""
-  '';
-
   pythonImportsCheck = [
     "elgato"
   ];
@@ -55,6 +55,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python client for Elgato Key Lights";
     homepage = "https://github.com/frenck/python-elgato";
+    changelog = "https://github.com/frenck/python-elgato/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/fypp/default.nix b/pkgs/development/python-modules/fypp/default.nix
index 9504a5839e733..a75e141361a86 100644
--- a/pkgs/development/python-modules/fypp/default.nix
+++ b/pkgs/development/python-modules/fypp/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "fypp";
-  version = "3.1";
+  version = "3.2";
 
   src = fetchFromGitHub {
     owner = "aradi";
     repo = pname;
     rev = version;
-    hash = "sha256-iog5Gdcd1F230Nl4JDrKoyYr8JualVgNZQzHLzd4xe8=";
+    hash = "sha256-MgGVlOqOIrIVoDfBMVpFLT26mhYndxans2hfo/+jdoA=";
   };
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/guppy3/default.nix b/pkgs/development/python-modules/guppy3/default.nix
index c47fb6a80425c..65d7c2622a8ef 100644
--- a/pkgs/development/python-modules/guppy3/default.nix
+++ b/pkgs/development/python-modules/guppy3/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "guppy3";
-  version = "3.1.3";
+  version = "3.1.4";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "zhuyifei1999";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-i3WqXlNnNhBVw9rdnxnzQISFkZHBpc/gqG+rxOWPiyc=";
+    hash = "sha256-RMWIP4tVSCCEQpr0kZvsN1HwL6rBcLuubfBl175eSNg=";
   };
 
   propagatedBuildInputs = [ tkinter ];
diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index 8876eea828afd..22e0a62827620 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "0.33.1";
+  version = "0.33.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-plugwise";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uJBUim5FlS+Jw3rGEKuorksVIgI5tVRAI7tESeYnGUc=";
+    hash = "sha256-WTgv0bEkhLMoRCw6Xh5SlYLxnlQCv603lKTajjCETT4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pvo/default.nix b/pkgs/development/python-modules/pvo/default.nix
index 6f3f698fe2c74..6963d37000138 100644
--- a/pkgs/development/python-modules/pvo/default.nix
+++ b/pkgs/development/python-modules/pvo/default.nix
@@ -13,18 +13,25 @@
 
 buildPythonPackage rec {
   pname = "pvo";
-  version = "1.0.0";
+  version = "2.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-pvoutput";
     rev = "refs/tags/v${version}";
-    hash = "sha256-6oVACUnK8WVlEx047CUXmSXQ0+M3xnSvyMHw5Wttk7M=";
+    hash = "sha256-SvsrvGwIAlj/8hdk90+rxigVrx6n3YInvF/4eux2H04=";
   };
 
+  postPatch = ''
+    # Upstream doesn't set a version for the pyproject.toml
+    substituteInPlace pyproject.toml \
+      --replace "0.0.0" "${version}" \
+      --replace "--cov" ""
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -41,13 +48,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
-    # Upstream doesn't set a version for the pyproject.toml
-    substituteInPlace pyproject.toml \
-      --replace "0.0.0" "${version}" \
-      --replace "--cov" ""
-  '';
-
   pythonImportsCheck = [
     "pvo"
   ];
diff --git a/pkgs/development/python-modules/py-libzfs/default.nix b/pkgs/development/python-modules/py-libzfs/default.nix
index 1eacc39b8ab07..d148e539d3fff 100644
--- a/pkgs/development/python-modules/py-libzfs/default.nix
+++ b/pkgs/development/python-modules/py-libzfs/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "py-libzfs";
-  version = "22.02.4";
+  version = "22.12.4.2";
 
   src = fetchFromGitHub {
     owner = "truenas";
     repo = pname;
     rev = "TS-${version}";
-    hash = "sha256-BJG+cw07Qu4aL99pVKNd7JAgr+w/6Uv2eI46EB615/I=";
+    hash = "sha256-vBLbjP1gQEQNsTLc2W6uRzCFHQXZp+jGiwE0Pe8VTuw=";
   };
 
   nativeBuildInputs = [ cython ];
diff --git a/pkgs/development/python-modules/pyenphase/default.nix b/pkgs/development/python-modules/pyenphase/default.nix
index 360db91241756..d18160d897d38 100644
--- a/pkgs/development/python-modules/pyenphase/default.nix
+++ b/pkgs/development/python-modules/pyenphase/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pyenphase";
-  version = "1.12.0";
+  version = "1.13.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.11";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "pyenphase";
     repo = "pyenphase";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gqbRz0JAp8hjZpFUzlFzqq86UKgD0TLWSp1Z9rdrk3s=";
+    hash = "sha256-8wGGx7ERYm+lKvLW/NUcJeBTqEXPM0jJNOOlkj/UzYk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyliblo/default.nix b/pkgs/development/python-modules/pyliblo/default.nix
index 52f59cc3fc8d0..e56b1dfa36839 100644
--- a/pkgs/development/python-modules/pyliblo/default.nix
+++ b/pkgs/development/python-modules/pyliblo/default.nix
@@ -10,19 +10,26 @@
 buildPythonPackage rec {
   pname = "pyliblo";
   version = "0.10.0";
-  disabled = isPyPy || pythonAtLeast "3.11";
+  disabled = isPyPy;
 
   src = fetchurl {
     url = "http://das.nasophon.de/download/${pname}-${version}.tar.gz";
     sha256 = "13vry6xhxm7adnbyj28w1kpwrh0kf7nw83cz1yq74wl21faz2rzw";
   };
 
+  patches = [
+    (fetchurl {
+      url = "https://git.alpinelinux.org/aports/plain/community/py3-pyliblo/py3.11.patch?id=a7e1eca5533657ddd7e37c43e67e8126e3447258";
+      hash = "sha256-4yCWNQaE/9FHGTVuvNEimBNuViWZ9aSJMcpTOP0fnM0=";
+    })
+  ];
+
   buildInputs = [ liblo cython ];
 
   meta = with lib; {
     homepage = "https://das.nasophon.de/pyliblo/";
     description = "Python wrapper for the liblo OSC library";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Only;
   };
 
 }
diff --git a/pkgs/development/python-modules/pyscf/default.nix b/pkgs/development/python-modules/pyscf/default.nix
index 29f795560d41b..5089e19c22647 100644
--- a/pkgs/development/python-modules/pyscf/default.nix
+++ b/pkgs/development/python-modules/pyscf/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "pyscf";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "pyscf";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-x693NB0oc9X7SuDZlV3VKOmgnIgKA39O9yswDM0outk=";
+    hash = "sha256-+dZsXiLqqyRWr1eOEVSHZ1KMM760hrDaT07ylZUcGmo=";
   };
 
   # setup.py calls Cmake and passes the arguments in CMAKE_CONFIGURE_ARGS to cmake.
diff --git a/pkgs/development/python-modules/ratelimiter/default.nix b/pkgs/development/python-modules/ratelimiter/default.nix
deleted file mode 100644
index 6c01a9e548c94..0000000000000
--- a/pkgs/development/python-modules/ratelimiter/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pytest-asyncio
-, pytestCheckHook
-}:
-
-buildPythonPackage rec {
-  pname = "ratelimiter";
-  version = "1.2.0.post0";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-XDldyr273i5ReO8/ibVoowZkVKbdwiO3ZHPawi+JtPc=";
-  };
-
-  nativeCheckInputs = [
-    pytest-asyncio
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [
-    "ratelimiter"
-  ];
-
-  preCheck = ''
-    # Uses out-dated options
-    rm tests/conftest.py
-  '';
-
-  disabledTests = [
-    # TypeError: object Lock can't be used in 'await' expression
-    "test_alock"
-  ];
-
-  meta = with lib; {
-    description = "Simple python rate limiting object";
-    homepage = "https://github.com/RazerM/ratelimiter";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ helkafen ];
-  };
-}
diff --git a/pkgs/development/python-modules/sensor-state-data/default.nix b/pkgs/development/python-modules/sensor-state-data/default.nix
index 7316256cd8aac..7802340cedef2 100644
--- a/pkgs/development/python-modules/sensor-state-data/default.nix
+++ b/pkgs/development/python-modules/sensor-state-data/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "sensor-state-data";
-  version = "2.17.1";
+  version = "2.18.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-zfgkTBdE8UWwk+G3bLBThVjgU+m2QoPf1fzORyznEgs=";
+    hash = "sha256-wYYSS4lABCbIhmUU3z3Wh0+4zwpEzXl8Kk9gi6LBrbQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/trezor/default.nix b/pkgs/development/python-modules/trezor/default.nix
index 109f48d1f71b0..23af30faefbab 100644
--- a/pkgs/development/python-modules/trezor/default.nix
+++ b/pkgs/development/python-modules/trezor/default.nix
@@ -24,13 +24,13 @@
 
 buildPythonPackage rec {
   pname = "trezor";
-  version = "0.13.7";
+  version = "0.13.8";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dodeWIYBfclPUbu0Efkn8QO9nj7L8HVNXkSjU4mBSeA=";
+    hash = "sha256-Y01O3fNWAyV8MhYY2FSMajWyc4Rle2XjsL261jWlfP8=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/python-modules/twentemilieu/default.nix b/pkgs/development/python-modules/twentemilieu/default.nix
index aa91f01686c71..e52f70753f327 100644
--- a/pkgs/development/python-modules/twentemilieu/default.nix
+++ b/pkgs/development/python-modules/twentemilieu/default.nix
@@ -12,16 +12,16 @@
 
 buildPythonPackage rec {
   pname = "twentemilieu";
-  version = "1.0.0";
+  version = "2.0.0";
   format = "pyproject";
 
-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-twentemilieu";
-    rev = "v${version}";
-    hash = "sha256-MTAVa5gP5e8TIE/i1DjfmwKm1zDVC/WEcYKxZSV/+Ug=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-r0LZS8TXux1mzzXBTSu+x5sxUZOCzW7poKG3dQ2A6No=";
   };
 
   postPatch = ''
@@ -45,7 +45,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "twentemilieu" ];
+  pythonImportsCheck = [
+    "twentemilieu"
+  ];
 
   meta = with lib; {
     description = "Python client for Twente Milieu";
diff --git a/pkgs/development/python-modules/velbus-aio/default.nix b/pkgs/development/python-modules/velbus-aio/default.nix
index dda198ff95ccc..03c44ef031c00 100644
--- a/pkgs/development/python-modules/velbus-aio/default.nix
+++ b/pkgs/development/python-modules/velbus-aio/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "velbus-aio";
-  version = "2023.10.0";
+  version = "2023.10.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Cereal2nd";
     repo = pname;
     rev = version;
-    hash = "sha256-xVELkmucrw1QazSR2XN6ldmzdTya/rWsQd1mRsLTcbU=";
+    hash = "sha256-v2B+tDqvQTm+K+cvTRM8LnfaFp5CTsI8/B5clBDNE08=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/tools/clj-kondo/default.nix b/pkgs/development/tools/clj-kondo/default.nix
index 20f905a50ec99..dc78761cc256d 100644
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "clj-kondo";
-  version = "2023.09.07";
+  version = "2023.10.20";
 
   src = fetchurl {
     url = "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-F7ePdITYKkGB6nsR3EFJ7zLDCUoT0g3i+AAjXzBd624=";
+    sha256 = "sha256-f9u/pk3CEEmiLgnS2biaUHpsMHjVEwZL2jyB/1PiZUY=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/development/tools/database/timescaledb-tune/default.nix b/pkgs/development/tools/database/timescaledb-tune/default.nix
index 1fa12861d9213..0236a5f51f3d5 100644
--- a/pkgs/development/tools/database/timescaledb-tune/default.nix
+++ b/pkgs/development/tools/database/timescaledb-tune/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "timescaledb-tune";
-  version = "0.14.3";
+  version = "0.14.4";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MQi8A7eWOShP/VhxuX4Uhz1ueLtKvOi1x4E7aFXEsQo=";
+    sha256 = "sha256-lCbxGW6+/r5AnsSXvrE7jYL1ZywcTlb4RK3MurL1JWg=";
   };
 
   vendorHash = "sha256-yXWeINubvfZ2S+3gVFsrzeVO3XXIiZ14qfK+9Bj3SV4=";
diff --git a/pkgs/development/tools/electron/binary/generic.nix b/pkgs/development/tools/electron/binary/generic.nix
index cbd9080989655..6e1493528e2b5 100644
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@@ -40,7 +40,7 @@ let
       ++ optionals (versionAtLeast version "11.0.0") [ "aarch64-darwin" ]
       ++ optionals (versionOlder version "19.0.0") [ "i686-linux" ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    knownVulnerabilities = optional (versionOlder version "22.0.0" || versions.major version == "23") "Electron version ${version} is EOL";
+    knownVulnerabilities = optional (versionOlder version "25.0.0") "Electron version ${version} is EOL";
   };
 
   fetcher = vers: tag: hash: fetchurl {
diff --git a/pkgs/development/tools/flyway/default.nix b/pkgs/development/tools/flyway/default.nix
index d9cffc192506d..cd42388f0f829 100644
--- a/pkgs/development/tools/flyway/default.nix
+++ b/pkgs/development/tools/flyway/default.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
       This package is only the Community Edition of the Flyway command-line tool.
     '';
+    mainProgram = "flyway";
     downloadPage = "https://github.com/flyway/flyway";
     homepage = "https://flywaydb.org/";
     changelog = "https://documentation.red-gate.com/fd/release-notes-for-flyway-engine-179732572.html";
diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index 5bfb0996e6604..62aaf9973c8be 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.54.2";
+  version = "1.55.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-7nbgiUrp7S7sXt7uFXX8NHYbIRLZZQcg+18IdwAZBfE=";
+    hash = "sha256-77bhXeABkV6WZCzoGnRS447pEVcJyj4AF+wihJe62fc=";
   };
 
-  vendorHash = "sha256-IyH5lG2a4zjsg/MUonCUiAgMl4xx8zSflRyzNgk8MR0=";
+  vendorHash = "sha256-3aHLilu+AZ6376bn9eS8kmSfo6fXikOFJKDRCYu+4a0=";
 
   subPackages = [ "cmd/golangci-lint" ];
 
diff --git a/pkgs/development/tools/java/dex2jar/default.nix b/pkgs/development/tools/java/dex2jar/default.nix
index 97fa2298b051c..e0ce19dc8d2f8 100644
--- a/pkgs/development/tools/java/dex2jar/default.nix
+++ b/pkgs/development/tools/java/dex2jar/default.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dex2jar";
-  version  = "2.1";
+  version  = "2.4";
 
   src = fetchurl {
-    url = "https://github.com/pxb1988/dex2jar/releases/download/v${finalAttrs.version}/dex2jar-${finalAttrs.version}.zip";
-    hash = "sha256-epvfhD1D3k0elOwue29VglAXsMSn7jn/gmYOJJOkbwg=";
+    url = "https://github.com/pxb1988/dex2jar/releases/download/v${finalAttrs.version}/dex-tools-v${finalAttrs.version}.zip";
+    hash = "sha256-7nxF6zwdJHSmFF2NRH5lGnNqItlmS209O+WlqBfdojo=";
   };
 
   nativeBuildInputs = [ makeWrapper unzip ];
diff --git a/pkgs/development/tools/misc/dart-sass/default.nix b/pkgs/development/tools/misc/dart-sass/default.nix
index a137f5b21ba6e..6737e791f952c 100644
--- a/pkgs/development/tools/misc/dart-sass/default.nix
+++ b/pkgs/development/tools/misc/dart-sass/default.nix
@@ -29,6 +29,7 @@ buildDartApplication rec {
   };
 
   pubspecLockFile = ./pubspec.lock;
+  depsListFile = ./deps.json;
   vendorHash = "sha256-PQvY+qFXovSXH5wuc60wCrt5RiooKcaGKYzbjKSvqso=";
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/misc/dart-sass/deps.json b/pkgs/development/tools/misc/dart-sass/deps.json
new file mode 100644
index 0000000000000..75548f50d9003
--- /dev/null
+++ b/pkgs/development/tools/misc/dart-sass/deps.json
@@ -0,0 +1,930 @@
+[
+  {
+    "name": "sass",
+    "version": "1.69.0",
+    "kind": "root",
+    "source": "root",
+    "dependencies": [
+      "args",
+      "async",
+      "charcode",
+      "cli_pkg",
+      "cli_repl",
+      "collection",
+      "http",
+      "js",
+      "meta",
+      "native_synchronization",
+      "node_interop",
+      "package_config",
+      "path",
+      "pool",
+      "protobuf",
+      "pub_semver",
+      "source_maps",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "stream_transform",
+      "string_scanner",
+      "term_glyph",
+      "typed_data",
+      "watcher",
+      "analyzer",
+      "archive",
+      "crypto",
+      "dart_style",
+      "dartdoc",
+      "grinder",
+      "node_preamble",
+      "lints",
+      "protoc_plugin",
+      "pub_api_client",
+      "pubspec_parse",
+      "test",
+      "test_descriptor",
+      "test_process",
+      "yaml",
+      "cli_util"
+    ]
+  },
+  {
+    "name": "cli_util",
+    "version": "0.4.0",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "path",
+    "version": "1.8.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "meta",
+    "version": "1.10.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "yaml",
+    "version": "3.1.2",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "string_scanner",
+    "version": "1.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_span",
+    "version": "1.10.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "path",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "term_glyph",
+    "version": "1.2.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "collection",
+    "version": "1.18.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "test_process",
+    "version": "2.1.0",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "meta",
+      "path",
+      "test"
+    ]
+  },
+  {
+    "name": "test",
+    "version": "1.24.6",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "boolean_selector",
+      "collection",
+      "coverage",
+      "http_multi_server",
+      "io",
+      "js",
+      "matcher",
+      "node_preamble",
+      "package_config",
+      "path",
+      "pool",
+      "shelf",
+      "shelf_packages_handler",
+      "shelf_static",
+      "shelf_web_socket",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "test_api",
+      "test_core",
+      "typed_data",
+      "web_socket_channel",
+      "webkit_inspection_protocol",
+      "yaml"
+    ]
+  },
+  {
+    "name": "webkit_inspection_protocol",
+    "version": "1.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "logging"
+    ]
+  },
+  {
+    "name": "logging",
+    "version": "1.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "web_socket_channel",
+    "version": "2.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "crypto",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "stream_channel",
+    "version": "2.1.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "async",
+    "version": "2.11.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "crypto",
+    "version": "3.0.3",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "typed_data",
+    "version": "1.3.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "test_core",
+    "version": "0.5.6",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "args",
+      "async",
+      "boolean_selector",
+      "collection",
+      "coverage",
+      "frontend_server_client",
+      "glob",
+      "io",
+      "meta",
+      "package_config",
+      "path",
+      "pool",
+      "source_map_stack_trace",
+      "source_maps",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "test_api",
+      "vm_service",
+      "yaml"
+    ]
+  },
+  {
+    "name": "vm_service",
+    "version": "11.10.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "test_api",
+    "version": "0.6.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "boolean_selector",
+      "collection",
+      "meta",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "stack_trace",
+    "version": "1.11.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "boolean_selector",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "source_maps",
+    "version": "0.10.12",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_map_stack_trace",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "source_maps",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "pool",
+    "version": "1.5.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "package_config",
+    "version": "2.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "io",
+    "version": "1.0.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "glob",
+    "version": "2.1.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "file",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "file",
+    "version": "7.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "frontend_server_client",
+    "version": "3.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "coverage",
+    "version": "1.6.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "logging",
+      "package_config",
+      "path",
+      "source_maps",
+      "stack_trace",
+      "vm_service"
+    ]
+  },
+  {
+    "name": "args",
+    "version": "2.4.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "analyzer",
+    "version": "5.13.0",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "_fe_analyzer_shared",
+      "collection",
+      "convert",
+      "crypto",
+      "glob",
+      "meta",
+      "package_config",
+      "path",
+      "pub_semver",
+      "source_span",
+      "watcher",
+      "yaml"
+    ]
+  },
+  {
+    "name": "watcher",
+    "version": "1.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "pub_semver",
+    "version": "2.1.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "convert",
+    "version": "3.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "_fe_analyzer_shared",
+    "version": "61.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "shelf_web_socket",
+    "version": "1.0.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "shelf",
+      "stream_channel",
+      "web_socket_channel"
+    ]
+  },
+  {
+    "name": "shelf",
+    "version": "1.4.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "http_parser",
+      "path",
+      "stack_trace",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "http_parser",
+    "version": "4.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner",
+      "typed_data"
+    ]
+  },
+  {
+    "name": "shelf_static",
+    "version": "1.1.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "convert",
+      "http_parser",
+      "mime",
+      "path",
+      "shelf"
+    ]
+  },
+  {
+    "name": "mime",
+    "version": "1.0.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "shelf_packages_handler",
+    "version": "3.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "shelf",
+      "shelf_static"
+    ]
+  },
+  {
+    "name": "node_preamble",
+    "version": "2.0.2",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "matcher",
+    "version": "0.12.16",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "meta",
+      "stack_trace",
+      "term_glyph",
+      "test_api"
+    ]
+  },
+  {
+    "name": "js",
+    "version": "0.6.7",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "http_multi_server",
+    "version": "3.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "test_descriptor",
+    "version": "2.0.1",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "matcher",
+      "meta",
+      "path",
+      "term_glyph",
+      "test"
+    ]
+  },
+  {
+    "name": "pubspec_parse",
+    "version": "1.2.3",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "checked_yaml",
+      "collection",
+      "json_annotation",
+      "pub_semver",
+      "yaml"
+    ]
+  },
+  {
+    "name": "json_annotation",
+    "version": "4.8.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "checked_yaml",
+    "version": "2.0.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "json_annotation",
+      "source_span",
+      "yaml"
+    ]
+  },
+  {
+    "name": "pub_api_client",
+    "version": "2.6.0",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "http",
+      "oauth2",
+      "path",
+      "pubspec"
+    ]
+  },
+  {
+    "name": "pubspec",
+    "version": "2.3.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "pub_semver",
+      "yaml",
+      "uri"
+    ]
+  },
+  {
+    "name": "uri",
+    "version": "1.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "matcher",
+      "quiver"
+    ]
+  },
+  {
+    "name": "quiver",
+    "version": "3.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "matcher"
+    ]
+  },
+  {
+    "name": "oauth2",
+    "version": "2.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "crypto",
+      "http",
+      "http_parser"
+    ]
+  },
+  {
+    "name": "http",
+    "version": "1.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "http_parser",
+      "meta"
+    ]
+  },
+  {
+    "name": "protoc_plugin",
+    "version": "21.1.1",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "fixnum",
+      "path",
+      "protobuf"
+    ]
+  },
+  {
+    "name": "protobuf",
+    "version": "3.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "fixnum",
+      "meta"
+    ]
+  },
+  {
+    "name": "fixnum",
+    "version": "1.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "lints",
+    "version": "2.1.1",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "grinder",
+    "version": "0.9.4",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "cli_util",
+      "glob",
+      "meta",
+      "path",
+      "collection"
+    ]
+  },
+  {
+    "name": "dartdoc",
+    "version": "6.3.0",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "args",
+      "cli_util",
+      "collection",
+      "crypto",
+      "glob",
+      "html",
+      "logging",
+      "markdown",
+      "meta",
+      "package_config",
+      "path",
+      "pub_semver",
+      "source_span",
+      "yaml"
+    ]
+  },
+  {
+    "name": "markdown",
+    "version": "7.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "meta"
+    ]
+  },
+  {
+    "name": "html",
+    "version": "0.15.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "csslib",
+      "source_span"
+    ]
+  },
+  {
+    "name": "csslib",
+    "version": "1.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "dart_style",
+    "version": "2.3.2",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "args",
+      "path",
+      "pub_semver",
+      "source_span"
+    ]
+  },
+  {
+    "name": "archive",
+    "version": "3.3.9",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "crypto",
+      "path",
+      "pointycastle"
+    ]
+  },
+  {
+    "name": "pointycastle",
+    "version": "3.7.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "convert",
+      "js"
+    ]
+  },
+  {
+    "name": "stream_transform",
+    "version": "2.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "node_interop",
+    "version": "2.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "js"
+    ]
+  },
+  {
+    "name": "native_synchronization",
+    "version": "0.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "ffi"
+    ]
+  },
+  {
+    "name": "ffi",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "cli_repl",
+    "version": "0.2.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "js"
+    ]
+  },
+  {
+    "name": "cli_pkg",
+    "version": "2.5.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "archive",
+      "async",
+      "charcode",
+      "cli_util",
+      "collection",
+      "crypto",
+      "glob",
+      "grinder",
+      "http",
+      "js",
+      "meta",
+      "node_interop",
+      "node_preamble",
+      "package_config",
+      "path",
+      "pool",
+      "pub_semver",
+      "pubspec_parse",
+      "retry",
+      "string_scanner",
+      "test",
+      "test_process",
+      "xml",
+      "yaml"
+    ]
+  },
+  {
+    "name": "xml",
+    "version": "6.4.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta",
+      "petitparser"
+    ]
+  },
+  {
+    "name": "petitparser",
+    "version": "6.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "retry",
+    "version": "3.1.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "charcode",
+    "version": "1.3.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  }
+]
diff --git a/pkgs/development/tools/protoc-gen-dart/default.nix b/pkgs/development/tools/protoc-gen-dart/default.nix
index 29892b954fc78..fa11e1b60e805 100644
--- a/pkgs/development/tools/protoc-gen-dart/default.nix
+++ b/pkgs/development/tools/protoc-gen-dart/default.nix
@@ -16,6 +16,7 @@ buildDartApplication rec {
   sourceRoot = "${src.name}/protoc_plugin";
 
   pubspecLockFile = ./pubspec.lock;
+  depsListFile = ./deps.json;
   vendorHash = "sha256-yNgQLCLDCbA07v9tIwPRks/xPAzLVykNtIk+8C0twYM=";
 
   meta = with lib; {
diff --git a/pkgs/development/tools/protoc-gen-dart/deps.json b/pkgs/development/tools/protoc-gen-dart/deps.json
new file mode 100644
index 0000000000000..c00a66e0d8495
--- /dev/null
+++ b/pkgs/development/tools/protoc-gen-dart/deps.json
@@ -0,0 +1,549 @@
+[
+  {
+    "name": "protoc_plugin",
+    "version": "21.1.0",
+    "kind": "root",
+    "source": "root",
+    "dependencies": [
+      "fixnum",
+      "path",
+      "protobuf",
+      "collection",
+      "dart_flutter_team_lints",
+      "matcher",
+      "test"
+    ]
+  },
+  {
+    "name": "test",
+    "version": "1.24.6",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "boolean_selector",
+      "collection",
+      "coverage",
+      "http_multi_server",
+      "io",
+      "js",
+      "matcher",
+      "node_preamble",
+      "package_config",
+      "path",
+      "pool",
+      "shelf",
+      "shelf_packages_handler",
+      "shelf_static",
+      "shelf_web_socket",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "test_api",
+      "test_core",
+      "typed_data",
+      "web_socket_channel",
+      "webkit_inspection_protocol",
+      "yaml"
+    ]
+  },
+  {
+    "name": "yaml",
+    "version": "3.1.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "string_scanner",
+    "version": "1.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_span",
+    "version": "1.10.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "path",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "term_glyph",
+    "version": "1.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "path",
+    "version": "1.8.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "collection",
+    "version": "1.18.0",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "webkit_inspection_protocol",
+    "version": "1.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "logging"
+    ]
+  },
+  {
+    "name": "logging",
+    "version": "1.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "web_socket_channel",
+    "version": "2.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "crypto",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "stream_channel",
+    "version": "2.1.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "async",
+    "version": "2.11.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "meta",
+    "version": "1.9.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "crypto",
+    "version": "3.0.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "typed_data",
+    "version": "1.3.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "test_core",
+    "version": "0.5.6",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "args",
+      "async",
+      "boolean_selector",
+      "collection",
+      "coverage",
+      "frontend_server_client",
+      "glob",
+      "io",
+      "meta",
+      "package_config",
+      "path",
+      "pool",
+      "source_map_stack_trace",
+      "source_maps",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "test_api",
+      "vm_service",
+      "yaml"
+    ]
+  },
+  {
+    "name": "vm_service",
+    "version": "11.10.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "test_api",
+    "version": "0.6.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "boolean_selector",
+      "collection",
+      "meta",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "stack_trace",
+    "version": "1.11.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "boolean_selector",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "source_maps",
+    "version": "0.10.12",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_map_stack_trace",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "source_maps",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "pool",
+    "version": "1.5.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "package_config",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "io",
+    "version": "1.0.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "glob",
+    "version": "2.1.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "file",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "file",
+    "version": "7.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "frontend_server_client",
+    "version": "3.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "coverage",
+    "version": "1.6.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "logging",
+      "package_config",
+      "path",
+      "source_maps",
+      "stack_trace",
+      "vm_service"
+    ]
+  },
+  {
+    "name": "args",
+    "version": "2.4.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "analyzer",
+    "version": "6.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "_fe_analyzer_shared",
+      "collection",
+      "convert",
+      "crypto",
+      "glob",
+      "meta",
+      "package_config",
+      "path",
+      "pub_semver",
+      "source_span",
+      "watcher",
+      "yaml"
+    ]
+  },
+  {
+    "name": "watcher",
+    "version": "1.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "pub_semver",
+    "version": "2.1.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "convert",
+    "version": "3.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "_fe_analyzer_shared",
+    "version": "64.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "shelf_web_socket",
+    "version": "1.0.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "shelf",
+      "stream_channel",
+      "web_socket_channel"
+    ]
+  },
+  {
+    "name": "shelf",
+    "version": "1.4.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "http_parser",
+      "path",
+      "stack_trace",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "http_parser",
+    "version": "4.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner",
+      "typed_data"
+    ]
+  },
+  {
+    "name": "shelf_static",
+    "version": "1.1.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "convert",
+      "http_parser",
+      "mime",
+      "path",
+      "shelf"
+    ]
+  },
+  {
+    "name": "mime",
+    "version": "1.0.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "shelf_packages_handler",
+    "version": "3.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "shelf",
+      "shelf_static"
+    ]
+  },
+  {
+    "name": "node_preamble",
+    "version": "2.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "matcher",
+    "version": "0.12.16",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "meta",
+      "stack_trace",
+      "term_glyph",
+      "test_api"
+    ]
+  },
+  {
+    "name": "js",
+    "version": "0.6.7",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "http_multi_server",
+    "version": "3.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "dart_flutter_team_lints",
+    "version": "1.0.0",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "lints"
+    ]
+  },
+  {
+    "name": "lints",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "protobuf",
+    "version": "3.1.0",
+    "kind": "direct",
+    "source": "path",
+    "dependencies": [
+      "collection",
+      "fixnum",
+      "meta"
+    ]
+  },
+  {
+    "name": "fixnum",
+    "version": "1.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  }
+]
diff --git a/pkgs/development/tools/rust/cargo-codspeed/default.nix b/pkgs/development/tools/rust/cargo-codspeed/default.nix
index f2a9376e2fa3a..d27f17bfac2fc 100644
--- a/pkgs/development/tools/rust/cargo-codspeed/default.nix
+++ b/pkgs/development/tools/rust/cargo-codspeed/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-codspeed";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "CodSpeedHQ";
     repo = "codspeed-rust";
     rev = "v${version}";
-    hash = "sha256-AGbo38weLBPxkaXgJpi+FXGuhPh7nyZcJOhw6BCDYOc=";
+    hash = "sha256-oI6IfKvX+Zn3tYPXQVxHRQymVz4bBvXfg3mcrjClbY4=";
   };
 
-  cargoHash = "sha256-NR+Z5oMaReEOZrLk7d/pB1F37k8tE7FXh4HdVnh+YFc=";
+  cargoHash = "sha256-ZZhYmyWoqZ8SbRpXCA5XsKCdeqAKAcE1NdNlrHhBiYI=";
 
   nativeBuildInputs = [
     curl
diff --git a/pkgs/development/web/minify/default.nix b/pkgs/development/web/minify/default.nix
index 1c832bb456db4..86ef8a4759f2f 100644
--- a/pkgs/development/web/minify/default.nix
+++ b/pkgs/development/web/minify/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "minify";
-  version = "2.12.9";
+  version = "2.19.10";
 
   src = fetchFromGitHub {
     owner = "tdewolff";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-+NBYn+gEsoclROnq2msNB4knviGn/XA9vNAuB0JZNek=";
+    hash = "sha256-/OfNHhWbRZI7nRhBnjXfxL4Gf011ydlwEMDadCptFJY=";
   };
 
-  vendorHash = "sha256-/Pw7fHVXWsovxfyzkWfb6UiRDBmiua82667N4Scl5+A=";
+  vendorHash = "sha256-ZtQbhhdt9mGRbTpgm6O4wnSPoKF9bAEswppmK+Urqhs=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/games/openra/build-engine.nix b/pkgs/games/openra/build-engine.nix
index 664a4c0735b3a..10e8b49392155 100644
--- a/pkgs/games/openra/build-engine.nix
+++ b/pkgs/games/openra/build-engine.nix
@@ -36,7 +36,7 @@ buildDotnetModule rec {
   dontDotnetFixup = true;
 
   preBuild = ''
-    make VERSION=${version} version
+    make VERSION=${engine.build}-${version} version
   '';
 
   postInstall = ''
diff --git a/pkgs/games/starsector/default.nix b/pkgs/games/starsector/default.nix
index 3951f36f83bf7..e1bc4a8dbbcfe 100644
--- a/pkgs/games/starsector/default.nix
+++ b/pkgs/games/starsector/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "starsector";
-  version = "0.96a-RC8";
+  version = "0.96a-RC10";
 
   src = fetchzip {
-    url = "https://s3.amazonaws.com/fractalsoftworks/starsector/starsector_linux-${version}.zip";
-    sha256 = "sha256-RDXqFqiWpBG3kasofzbOl7Zp0a9LiMpJKsHcFaJtm2Y=";
+    url = "https://f005.backblazeb2.com/file/fractalsoftworks/release/starsector_linux-${version}.zip";
+    sha256 = "sha256-RBSnms+QlKgTOhm3t2hDfv7OcMrQCk1rfkz9GaM74WM=";
   };
 
   nativeBuildInputs = [ copyDesktopItems makeWrapper ];
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
     #!/usr/bin/env nix-shell
     #!nix-shell -i bash -p curl gnugrep common-updater-scripts
     set -eou pipefail;
-    version=$(curl -s https://fractalsoftworks.com/preorder/ | grep -oP "https://s3.amazonaws.com/fractalsoftworks/starsector/starsector_linux-\K.*?(?=\.zip)" | head -1)
+    version=$(curl -s https://fractalsoftworks.com/preorder/ | grep -oP "https://f005.backblazeb2.com/file/fractalsoftworks/release/starsector_linux-\K.*?(?=\.zip)" | head -1)
     update-source-version ${pname} "$version" --file=./pkgs/games/starsector/default.nix
   '';
 }
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index a6734b640638e..78c669614c07d 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -3,6 +3,7 @@
 , extraPkgs ? pkgs: [ ] # extra packages to add to targetPkgs
 , extraLibraries ? pkgs: [ ] # extra packages to add to multiPkgs
 , extraProfile ? "" # string to append to profile
+, extraBwrapArgs ? [ ] # extra arguments to pass to bubblewrap
 , extraArgs ? "" # arguments to always pass to steam
 , extraEnv ? { } # Environment variables to pass to Steam
 , withGameSpecificLibraries ? true # include game specific libraries
@@ -277,6 +278,8 @@ in buildFHSEnv rec {
     exec steam ${extraArgs} "$@"
   '';
 
+  inherit extraBwrapArgs;
+
   meta =
     if steam != null
     then
@@ -287,21 +290,11 @@ in buildFHSEnv rec {
       description = "Steam dependencies (dummy package, do not use)";
     };
 
-  # allows for some gui applications to share IPC
-  # this fixes certain issues where they don't render correctly
-  unshareIpc = false;
-
-  # Some applications such as Natron need access to MIT-SHM or other
-  # shared memory mechanisms. Unsharing the pid namespace
-  # breaks the ability for application to reference shared memory.
-  unsharePid = false;
-
   passthru.run = buildFHSEnv {
     name = "steam-run";
 
     targetPkgs = commonTargetPkgs;
-    inherit multiArch multiPkgs profile extraInstallCommands;
-    inherit unshareIpc unsharePid;
+    inherit multiArch multiPkgs profile extraInstallCommands extraBwrapArgs;
 
     runScript = writeShellScript "steam-run" ''
       run="$1"
diff --git a/pkgs/games/unciv/default.nix b/pkgs/games/unciv/default.nix
index f4b350ad38e75..70971fb1ad371 100644
--- a/pkgs/games/unciv/default.nix
+++ b/pkgs/games/unciv/default.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "4.8.9-patch2";
+  version = "4.8.13";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-ek2FDzo7EbgZGbQyZ6mBmVoPRKkJu0JFewbVvsGzZMA=";
+    hash = "sha256-16TpsKNLcm6lbi4exYxDZWfmRsvfAhT1ktP36zC9Psg=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 716a45820ca52..f978cb429df5f 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.5.7"; #zen
-    suffix = "zen2"; #zen
-    sha256 = "0qy3xn7kr16crm7iw1zhm3kpgxpmn66xc4g1yalvghwn6si0n81l"; #zen
+    version = "6.5.8"; #zen
+    suffix = "zen1"; #zen
+    sha256 = "0pg5q5alsxrbbf8hzbcgmwsyirs86715qijdzaldyw9sf74h4z1l"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.5.7"; #lqx
+    version = "6.5.8"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "1c4093xhfnzx6h8frqcigdlikgy1n0vv34ajs0237v3w7psw99d7"; #lqx
+    sha256 = "1f10p7mriwjrgmdfz10vs48xiipdk9ljj884fsj63r5n1g7pz4bf"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/os-specific/linux/zfs/generic.nix b/pkgs/os-specific/linux/zfs/generic.nix
index 81ff2214bcadb..7bb4a1b7496e6 100644
--- a/pkgs/os-specific/linux/zfs/generic.nix
+++ b/pkgs/os-specific/linux/zfs/generic.nix
@@ -76,25 +76,14 @@ stdenv'.mkDerivation {
     substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
     substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d" \
                                                   --replace "/etc/default"            "$out/etc/default"
-    # TODO: drop when upgrading to 2.2.0
-    ${if isUnstable then ''
-      substituteInPlace ./contrib/initramfs/Makefile.am \
-        --replace "/usr/share/initramfs-tools" "$out/usr/share/initramfs-tools"
-      substituteInPlace ./udev/vdev_id \
-        --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
-         "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
-      substituteInPlace ./config/zfs-build.m4 \
-        --replace "bashcompletiondir=/etc/bash_completion.d" \
-          "bashcompletiondir=$out/share/bash-completion/completions"
-    '' else ''
-      substituteInPlace ./etc/zfs/Makefile.am --replace "\$(sysconfdir)/zfs" "$out/etc/zfs"
-
-      find ./contrib/initramfs -name Makefile.am -exec sed -i -e 's|/usr/share/initramfs-tools|'$out'/share/initramfs-tools|g' {} \;
-
-      substituteInPlace ./cmd/vdev_id/vdev_id \
-        --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
-        "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
-    ''}
+    substituteInPlace ./contrib/initramfs/Makefile.am \
+      --replace "/usr/share/initramfs-tools" "$out/usr/share/initramfs-tools"
+    substituteInPlace ./udev/vdev_id \
+      --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
+       "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
+    substituteInPlace ./config/zfs-build.m4 \
+      --replace "bashcompletiondir=/etc/bash_completion.d" \
+        "bashcompletiondir=$out/share/bash-completion/completions"
   '';
 
   nativeBuildInputs = [ autoreconfHook269 nukeReferences ]
diff --git a/pkgs/os-specific/linux/zfs/stable.nix b/pkgs/os-specific/linux/zfs/stable.nix
index 1a77396300ebf..3e53ba902cbd7 100644
--- a/pkgs/os-specific/linux/zfs/stable.nix
+++ b/pkgs/os-specific/linux/zfs/stable.nix
@@ -16,20 +16,13 @@ callPackage ./generic.nix args {
     if stdenv'.isx86_64 || removeLinuxDRM
     then kernel.kernelOlder "6.6"
     else kernel.kernelOlder "6.2";
+
   latestCompatibleLinuxPackages = if stdenv'.isx86_64 || removeLinuxDRM
     then linuxKernel.packages.linux_6_5
     else linuxKernel.packages.linux_6_1;
-  extraPatches = [
-    # applied in version 2.2.x
-    (fetchpatch {
-      name = "musl.patch";
-      url = "https://github.com/openzfs/zfs/commit/1f19826c9ac85835cbde61a7439d9d1fefe43a4a.patch";
-      sha256 = "XEaK227ubfOwlB2s851UvZ6xp/QOtYUWYsKTkEHzmo0=";
-    })
-  ];
 
   # this package should point to the latest release.
-  version = "2.1.13";
+  version = "2.2.0";
 
-  sha256 = "tqUCn/Hf/eEmyWRQthWQdmTJK2sDspnHiiEfn9rz2Kc=";
+  sha256 = "sha256-s1sdXSrLu6uSOmjprbUa4cFsE2Vj7JX5i75e4vRnlvg=";
 }
diff --git a/pkgs/os-specific/linux/zfs/unstable.nix b/pkgs/os-specific/linux/zfs/unstable.nix
index 23882322c0930..9c7e14c31bf38 100644
--- a/pkgs/os-specific/linux/zfs/unstable.nix
+++ b/pkgs/os-specific/linux/zfs/unstable.nix
@@ -23,9 +23,10 @@ callPackage ./generic.nix args {
   # IMPORTANT: Always use a tagged release candidate or commits from the
   # zfs-<version>-staging branch, because this is tested by the OpenZFS
   # maintainers.
-  version = "2.2.0-rc5";
+  version = "2.2.1-unstable-2023-10-21";
+  rev = "95785196f26e92d82cf4445654ba84e4a9671c57";
 
-  sha256 = "sha256-97dTmSneAuhDR7LrJxG7/xPpI1hGv5mDDuq8HRTZKx0=";
+  sha256 = "sha256-s1sdXSrLu6uSOmjprbUa4cFsE2Vj7JX5i75e4vRnlvg=";
 
   isUnstable = true;
 }
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 79195bd7152ea..7f9efafdfe9a4 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2023.10.3";
+  version = "2023.10.4";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 9bc35bd882c95..593099d264afa 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -296,7 +296,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.10.3";
+  hassVersion = "2023.10.4";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -312,7 +312,7 @@ in python.pkgs.buildPythonApplication rec {
   # Primary source is the pypi sdist, because it contains translations
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7Eg6Ik8eiPPUTXyRedQLixaCnHDg9Dmikmhcq55+458=";
+    hash = "sha256-HG8Uyk52Bj9CpQ+dn+dbsXVBKakXDlRktG4KSkVVVmE=";
   };
 
   # Secondary source is git for tests
@@ -320,7 +320,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-4J1BBC6PvfbN4fKD+zUpW19sMvoKALilitNJlwB0ZTk=";
+    hash = "sha256-m3MjJHFq9S0dogFijIlpryqGQoHpLqkqgkWLuIxLHa8=";
   };
 
   nativeBuildInputs = with python.pkgs; [
diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index adc7089741e9a..a0146829bf2cc 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2023.10.1";
+  version = "2023.10.4";
   format = "pyproject";
 
   disabled = python.version != home-assistant.python.version;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-4TPjYBTyrJtnYVZ+F/Bxf6m0lZn6fQR3ai0+CDTqwVc=";
+    hash = "sha256-iehGVXom5Wjw7A0PC4wfzed+w1h1/g9SKIuCuVRtIAs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 1f175c03d8a85..8f90adab101b1 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -186,7 +186,7 @@ stdenv.mkDerivation {
   passthru = {
     inherit modules;
     tests = {
-      inherit (nixosTests) nginx nginx-auth nginx-etag nginx-globalredirect nginx-http3 nginx-proxyprotocol nginx-pubhtml nginx-sandbox nginx-sso nginx-status-page;
+      inherit (nixosTests) nginx nginx-auth nginx-etag nginx-globalredirect nginx-http3 nginx-proxyprotocol nginx-pubhtml nginx-sandbox nginx-sso nginx-status-page nginx-unix-socket;
       variants = lib.recurseIntoAttrs nixosTests.nginx-variants;
       acme-integration = nixosTests.acme;
     } // passthru.tests;
diff --git a/pkgs/servers/http/tomcat/tomcat-native.nix b/pkgs/servers/http/tomcat/tomcat-native.nix
index 5f9ea8a1665d5..bd05943ac71f9 100644
--- a/pkgs/servers/http/tomcat/tomcat-native.nix
+++ b/pkgs/servers/http/tomcat/tomcat-native.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tomcat-native";
-  version = "2.0.5";
+  version = "2.0.6";
 
   src = fetchurl {
     url = "mirror://apache/tomcat/tomcat-connectors/native/${version}/source/${pname}-${version}-src.tar.gz";
-    hash = "sha256-lY0fEhZRwQxhVW133J0NQfO1OYiiGVRC3krG9MuHg4g=";
+    hash = "sha256-vmF8V26SO2B50LdSBtcG2ifdBDzr9Qv7leOpwKodGjU=";
   };
 
   sourceRoot = "${pname}-${version}-src/native";
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index ed8744ef3c626..4665402361d56 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -51,11 +51,11 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "samba";
-  version = "4.18.6";
+  version = "4.19.1";
 
   src = fetchurl {
     url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
-    hash = "sha256-KEyKmUzpich81oCMOQ/LnQDDayGg3BqKdUdLZ8nnFec=";
+    hash = "sha256-zjt/DRi/kapf1kbouzhaOzU3W3A8blEjsCuFoavIGHk=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/servers/soft-serve/default.nix b/pkgs/servers/soft-serve/default.nix
index 5072869c39b67..2cfd41f7caf8b 100644
--- a/pkgs/servers/soft-serve/default.nix
+++ b/pkgs/servers/soft-serve/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, makeWrapper, git }:
+{ lib, buildGoModule, fetchFromGitHub, makeWrapper, nixosTests, git, bash }:
 
 buildGoModule rec {
   pname = "soft-serve";
@@ -20,10 +20,14 @@ buildGoModule rec {
   nativeBuildInputs = [ makeWrapper ];
 
   postInstall = ''
+    # Soft-serve generates git-hooks at run-time.
+    # The scripts require git and bash inside the path.
     wrapProgram $out/bin/soft \
-      --prefix PATH : "${lib.makeBinPath [ git ]}"
+      --prefix PATH : "${lib.makeBinPath [ git bash ]}"
   '';
 
+  passthru.tests = nixosTests.soft-serve;
+
   meta = with lib; {
     description = "A tasty, self-hosted Git server for the command line";
     homepage = "https://github.com/charmbracelet/soft-serve";
diff --git a/pkgs/servers/sql/pgbouncer/default.nix b/pkgs/servers/sql/pgbouncer/default.nix
index 7f6cfa0f898a2..dd47de9075761 100644
--- a/pkgs/servers/sql/pgbouncer/default.nix
+++ b/pkgs/servers/sql/pgbouncer/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://www.pgbouncer.org/";
+    mainProgram = "pgbouncer";
     description = "Lightweight connection pooler for PostgreSQL";
     changelog = "https://github.com/pgbouncer/pgbouncer/releases/tag/pgbouncer_${replaceStrings ["."] ["_"] version}";
     license = licenses.isc;
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index 34b8f9504f8b3..acd7494fd3cc9 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -22,7 +22,7 @@
 }:
 
 let
-  version = "0.85.0";
+  version = "0.86.0";
 in
 
 rustPlatform.buildRustPackage {
@@ -33,10 +33,10 @@ rustPlatform.buildRustPackage {
     owner = "nushell";
     repo = "nushell";
     rev = version;
-    hash = "sha256-/c3JTgIT+T41D0S7irQ0jq2MDzmx3os4pYpVr10cL3E=";
+    hash = "sha256-jUZKqsu0/RO4mc+hzjis1mNrohj1JzM17Z8e2Ggxlfs=";
   };
 
-  cargoHash = "sha256-lBipwX72j0Af3PCat18s9NIjJiKZFZTcU9Utwt+eQzI=";
+  cargoHash = "sha256-WDGhuc2ZGDwfh7X/oRTZLzmKPj1jSnQFL4sy7KYt5Js=";
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optionals (withDefaultFeatures && stdenv.isLinux) [ python3 ]
diff --git a/pkgs/tools/filesystems/erofs-utils/default.nix b/pkgs/tools/filesystems/erofs-utils/default.nix
index d1daee70967f2..e25df7288094a 100644
--- a/pkgs/tools/filesystems/erofs-utils/default.nix
+++ b/pkgs/tools/filesystems/erofs-utils/default.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional fuseSupport "--enable-fuse";
 
   meta = with lib; {
+    homepage = "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/about/";
     description = "Userspace utilities for linux-erofs file system";
     license = with licenses; [ gpl2Plus ];
     maintainers = with maintainers; [ ehmry nikstur ];
diff --git a/pkgs/tools/misc/codebraid/default.nix b/pkgs/tools/misc/codebraid/default.nix
index 0ecde80c238d6..f4d8fa4940f00 100644
--- a/pkgs/tools/misc/codebraid/default.nix
+++ b/pkgs/tools/misc/codebraid/default.nix
@@ -2,15 +2,17 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "codebraid";
-  version = "0.5.0-unstable-2020-08-14";
+  version = "0.11.0";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "gpoore";
     repo = pname;
-    rev = "526a223c4fc32c37d6c5c9133524dfa0e1811ca4";
-    sha256 = "0qkqaj49k584qzgx9jlsf5vlv4lq7x403s1kig8v87i0kgh55p56";
+    rev = "v${version}";
+    hash = "sha256-E9vzGK9ZEVwF+UBpSkdM+hm6vINen/A+LgnnPpc77QQ=";
   };
 
+  nativeBuildInputs = with python3Packages; [ setuptools ];
   propagatedBuildInputs = with python3Packages; [ bespon ];
   # unfortunately upstream doesn't contain tests
   checkPhase = ''
diff --git a/pkgs/tools/misc/domine/default.nix b/pkgs/tools/misc/domine/default.nix
index cd62b9bd1a744..421b49a9d4a45 100644
--- a/pkgs/tools/misc/domine/default.nix
+++ b/pkgs/tools/misc/domine/default.nix
@@ -12,6 +12,6 @@ buildDartApplication rec {
   };
 
   pubspecLockFile = ./pubspec.lock;
-
+  depsListFile = ./deps.json;
   vendorHash = "16z3paq1nxlnzs20qlljnwa2ff6xfhdqzcq8d8izkl7w1j4hyxgn";
 }
diff --git a/pkgs/tools/misc/domine/deps.json b/pkgs/tools/misc/domine/deps.json
new file mode 100644
index 0000000000000..baa466f5e2f2e
--- /dev/null
+++ b/pkgs/tools/misc/domine/deps.json
@@ -0,0 +1,190 @@
+[
+  {
+    "name": "domine",
+    "version": "1.1.0+3",
+    "kind": "root",
+    "source": "root",
+    "dependencies": [
+      "args",
+      "dart_openai",
+      "dio",
+      "dio_smart_retry",
+      "tint",
+      "lints"
+    ]
+  },
+  {
+    "name": "lints",
+    "version": "2.1.1",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "tint",
+    "version": "2.0.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "dio_smart_retry",
+    "version": "5.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "dio",
+      "http_parser",
+      "path"
+    ]
+  },
+  {
+    "name": "path",
+    "version": "1.8.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "http_parser",
+    "version": "4.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner",
+      "typed_data"
+    ]
+  },
+  {
+    "name": "typed_data",
+    "version": "1.3.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "collection",
+    "version": "1.17.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "string_scanner",
+    "version": "1.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_span",
+    "version": "1.10.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "path",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "term_glyph",
+    "version": "1.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "dio",
+    "version": "5.3.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "http_parser",
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "meta",
+    "version": "1.9.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "async",
+    "version": "2.11.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "dart_openai",
+    "version": "4.0.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "http",
+      "meta",
+      "collection",
+      "fetch_client"
+    ]
+  },
+  {
+    "name": "fetch_client",
+    "version": "1.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "fetch_api",
+      "http"
+    ]
+  },
+  {
+    "name": "http",
+    "version": "1.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "http_parser",
+      "meta"
+    ]
+  },
+  {
+    "name": "fetch_api",
+    "version": "1.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "js"
+    ]
+  },
+  {
+    "name": "js",
+    "version": "0.6.7",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "args",
+    "version": "2.4.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  }
+]
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index 23e00e00363ce..84da1044f1a46 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fd";
-  version = "8.7.0";
+  version = "8.7.1";
 
   src = fetchFromGitHub {
     owner = "sharkdp";
     repo = "fd";
     rev = "v${version}";
-    hash = "sha256-y7IrwMLQnvz1PeKt8BE9hbEBwQBiUXM4geYbiTjMymw=";
+    hash = "sha256-euQiMVPKE1/YG04VKMFUA27OtoGENNhqeE0iiF/X7uc=";
   };
 
-  cargoHash = "sha256-AstE8KGICgPhqRKlJecrE9iPUUWaOvca6ocWf85IzNo=";
+  cargoHash = "sha256-doeZTjFPXmxIPYX3IBtetePoNkIHnl6oPJFtXD1tgZY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/misc/lazydocker/default.nix b/pkgs/tools/misc/lazydocker/default.nix
index 1fdb0ef0d44bc..353402658db92 100644
--- a/pkgs/tools/misc/lazydocker/default.nix
+++ b/pkgs/tools/misc/lazydocker/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lazydocker";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazydocker";
     rev = "v${version}";
-    sha256 = "sha256-BxIv0HCdrR9U9mmJnBdQqiUf/vbK+XEnL8ALPkuap0M=";
+    sha256 = "sha256-nW3eaSisXLqoWZ+5YLLCfC1k4lTXWd5ZqY2xTM/I0PY=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/misc/timer/default.nix b/pkgs/tools/misc/timer/default.nix
index 29e087c86581f..962ad1a6dd695 100644
--- a/pkgs/tools/misc/timer/default.nix
+++ b/pkgs/tools/misc/timer/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "timer";
-  version = "1.3.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "caarlos0";
     repo = "timer";
     rev = "v${version}";
-    hash = "sha256-9p/L3Hj3VqlNiyY3lfUAhCjwTl1iSTegWxaVEGB4qHM=";
+    hash = "sha256-8BVzijAXsJ8Q8BhDmhzFbEQ23fUEBdmbUsCPxfpXyBA=";
   };
 
-  vendorHash = "sha256-j7Xik0te6GdjfhXHT7DRf+MwM+aKjfgTGvroxnlD3MM=";
+  vendorHash = "sha256-1n5vZKlOWoB2SFdDdv+pPWLybzCIJG/wdBYqLMatjNA=";
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];
 
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index f900eafaacd13..757cb69cbb0bd 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "topgrade";
-  version = "12.0.2";
+  version = "13.0.0";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     rev = "v${version}";
-    hash = "sha256-PfrtTegJULzPAmKUk/6P9rD+ttPJOhaf2505og64C0Y=";
+    hash = "sha256-BuYwLD8HlmFjCpR8043GhrYK3XWffeqEaeEDqWhxZVI=";
   };
 
-  cargoHash = "sha256-S6jSI/KuHocYD2dhg3o1NSyA8Q04Xo215TWl8Y1C7g8=";
+  cargoHash = "sha256-+kSvA9AC0peXeFLVjenATRfnIS9qaOr/f1ozPbifiPI=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/networking/ddclient/default.nix b/pkgs/tools/networking/ddclient/default.nix
index 6477c5b185c0e..eafba0d4f5274 100644
--- a/pkgs/tools/networking/ddclient/default.nix
+++ b/pkgs/tools/networking/ddclient/default.nix
@@ -5,7 +5,7 @@ let
 in
 perlPackages.buildPerlPackage rec {
   pname = "ddclient";
-  version = "3.11.0_1";
+  version = "3.11.0";
 
   outputs = [ "out" ];
 
@@ -13,7 +13,7 @@ perlPackages.buildPerlPackage rec {
     owner = "ddclient";
     repo = "ddclient";
     rev = "v${version}";
-    sha256 = "sha256-pl1kbzY5nUIvx1QiDdL9TP4vKtQnnv3RWklE4gbxXCw=";
+    sha256 = "sha256-s/gdTvEY4QIVidqNnN7GYrpCsp4nZ0GEH8Jv+LkSr48=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/networking/globalping-cli/default.nix b/pkgs/tools/networking/globalping-cli/default.nix
index bc07f20a5b11e..c88688bca71d7 100644
--- a/pkgs/tools/networking/globalping-cli/default.nix
+++ b/pkgs/tools/networking/globalping-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "globalping-cli";
-  version = "1.1.0";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "jsdelivr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-UY+SAmkE8h/K92Em5iikcMiNixkqnDVkhlrKVq1ZkVM=";
+    hash = "sha256-k89tqQpGvX0WiYqEwPj+tDViUKDjLR5MrkA0CQI/A+o=";
   };
 
   vendorHash = "sha256-fUB7WIEAPBot8A2f7WQ5wUDtCrOydZd4nd4qDuy1vzg=";
diff --git a/pkgs/tools/networking/hysteria/default.nix b/pkgs/tools/networking/hysteria/default.nix
index 9885066397b6c..80b12b6d6d67f 100644
--- a/pkgs/tools/networking/hysteria/default.nix
+++ b/pkgs/tools/networking/hysteria/default.nix
@@ -4,16 +4,16 @@
 }:
 buildGo121Module rec {
   pname = "hysteria";
-  version = "2.0.3";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "apernet";
     repo = pname;
     rev = "app/v${version}";
-    hash = "sha256-0ekw92T9yWrKu5MxSssOCXlUFubiVLoH6ZLEMDFkcis=";
+    hash = "sha256-CvhDOtXyGxnTy8m7qN5lmQxOxwkExfW+1ZT3LrLjsmo=";
   };
 
-  vendorHash = "sha256-Hf+Jx/z+hJ6jqWLJHGK7umNgNzNKYgQtCdAosdrqvPg=";
+  vendorHash = "sha256-Io7EN+Cza7drMLB9JF4nRDxq+eVxW5sYj45WWvXtDsY=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/tools/networking/requestly/default.nix b/pkgs/tools/networking/requestly/default.nix
index 33d03140c3984..3a4128c0806de 100644
--- a/pkgs/tools/networking/requestly/default.nix
+++ b/pkgs/tools/networking/requestly/default.nix
@@ -5,11 +5,11 @@
 
 let
   pname = "requestly";
-  version = "1.5.6";
+  version = "1.5.12";
 
   src = fetchurl {
     url = "https://github.com/requestly/requestly-desktop-app/releases/download/v${version}/Requestly-${version}.AppImage";
-    hash = "sha256-Yb90OGIIvExfNPoJPmuZSvtU5OQVuGqh4EmyKltE+is=";
+    hash = "sha256-HM3+j9E67J1bAklnDtSN5/rOK9Wn7N7h+qlPKR/E8Ns=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
diff --git a/pkgs/tools/networking/tgt/default.nix b/pkgs/tools/networking/tgt/default.nix
index e47478b9206b9..4030e3d14ec1a 100644
--- a/pkgs/tools/networking/tgt/default.nix
+++ b/pkgs/tools/networking/tgt/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tgt";
-  version = "1.0.87";
+  version = "1.0.88";
 
   src = fetchFromGitHub {
     owner = "fujita";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nDYNXQJqCtwlm4HTPTMuUbn6FA8JRYEqxbYUAev2R3o=";
+    sha256 = "sha256-tLc+viPufR6P5texDs9lU8wsOTzrjSK0Qz/r4/L8M5k=";
   };
 
   nativeBuildInputs = [ libxslt docbook_xsl makeWrapper ];
diff --git a/pkgs/tools/security/pynitrokey/default.nix b/pkgs/tools/security/pynitrokey/default.nix
index 9c36ceb3c841e..690d566c476d8 100644
--- a/pkgs/tools/security/pynitrokey/default.nix
+++ b/pkgs/tools/security/pynitrokey/default.nix
@@ -10,12 +10,12 @@ with python3Packages;
 
 buildPythonApplication rec {
   pname = "pynitrokey";
-  version = "0.4.39";
+  version = "0.4.40";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KXYHeWwV9Tw1ZpO/vASHjDnceeb+1K0yIUohb7EcRAI=";
+    hash = "sha256-Hu+8UooDzv4GhkWt0sCckQQyHjWn4V/zt2ADlVCoHmk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/security/rekor/default.nix b/pkgs/tools/security/rekor/default.nix
index 2820f473c11b9..c27416e29d2ee 100644
--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@@ -4,13 +4,13 @@ let
   generic = { pname, packageToBuild, description }:
     buildGoModule rec {
       inherit pname;
-      version = "1.2.2";
+      version = "1.3.2";
 
       src = fetchFromGitHub {
         owner = "sigstore";
         repo = "rekor";
         rev = "v${version}";
-        hash = "sha256-U7KxkPYVAy3/olXsEgPMX/kzg0KvYMovLO4LWw8guE4=";
+        hash = "sha256-QiK+ixVURf5Fsx9YPgzYCuCy1wYjxTUXGVr4FIn41Xc=";
         # populate values that require us to use git. By doing this in postFetch we
         # can delete .git afterwards and maintain better reproducibility of the src.
         leaveDotGit = true;
@@ -23,7 +23,7 @@ let
         '';
       };
 
-      vendorHash = "sha256-hZyoVlNrPKE6ub94jVEOLGvxWoXKxFYcsEZyRrZuNkQ=";
+      vendorHash = "sha256-0379IX5W51Z48CffK1F2ZCPGLUq0g8lZXIQqaupC5io=";
 
       nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/sbctl/default.nix b/pkgs/tools/security/sbctl/default.nix
index 6471425a85814..0778406b40cb5 100644
--- a/pkgs/tools/security/sbctl/default.nix
+++ b/pkgs/tools/security/sbctl/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "sbctl";
-  version = "0.11";
+  version = "0.12";
 
   src = fetchFromGitHub {
     owner = "Foxboron";
     repo = pname;
     rev = version;
-    hash = "sha256-kApPb8X1JCP1XfyVFcoCDd+yrytTKSkNWRHKDA3mGaQ=";
+    hash = "sha256-1dA+a8GS4teaLmclatJNKt+OjhabLO4j/+p4Q95yG/s=";
   };
 
-  vendorHash = "sha256-WbPYTETTOzqWH+q6fzyDgm0wMScbLWlksLxkDjopF4E=";
+  vendorHash = "sha256-kVXzHTONPCE1UeAnUiULjubJeZFD0DAxIk+w8/Dqs6c=";
 
   ldflags = [ "-s" "-w" "-X github.com/foxboron/sbctl.DatabasePath=${databasePath}" ];
 
diff --git a/pkgs/tools/security/uncover/default.nix b/pkgs/tools/security/uncover/default.nix
index 1ea2f41447801..f0ee8aa23757f 100644
--- a/pkgs/tools/security/uncover/default.nix
+++ b/pkgs/tools/security/uncover/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "uncover";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-FJtd73z6Cc56+nBderYncjrac3xRydDeoiJqn8xW29U=";
+    hash = "sha256-CJA+rDLubghaQT+yb0zQY3y8hF0/5ISH9YFvIQHwH2Y=";
   };
 
-  vendorHash = "sha256-mpojOzGedkTthD+fHl9Uhul7tOCN1EGIin+7USoaNmE=";
+  vendorHash = "sha256-A7XPsl27Q5CaQXQUEvNB05B2M3mFGz/yZ4sOnOHxhw8=";
 
   meta = with lib; {
     description = "API wrapper to search for exposed hosts";
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 5d9286a1c4d1a..8ca73a4faf8c3 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -2,13 +2,13 @@
 , CoreFoundation, IOKit, libossp_uuid
 , nixosTests
 , netdata-go-plugins
-, bash, curl, jemalloc, libuv, zlib, libyaml
+, bash, curl, jemalloc, json_c, libuv, zlib, libyaml
 , libcap, libuuid, lm_sensors, protobuf
 , withCups ? false, cups
 , withDBengine ? true, lz4
 , withIpmi ? (!stdenv.isDarwin), freeipmi
 , withNetfilter ? (!stdenv.isDarwin), libmnl, libnetfilter_acct
-, withCloud ? (!stdenv.isDarwin), json_c
+, withCloud ? false
 , withCloudUi ? false
 , withConnPubSub ? false, google-cloud-cpp, grpc
 , withConnPrometheus ? false, snappy
@@ -42,14 +42,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook pkg-config makeWrapper protobuf ];
   # bash is only used to rewrite shebangs
-  buildInputs = [ bash curl jemalloc libuv zlib libyaml ]
+  buildInputs = [ bash curl jemalloc json_c libuv zlib libyaml ]
     ++ lib.optionals stdenv.isDarwin [ CoreFoundation IOKit libossp_uuid ]
     ++ lib.optionals (!stdenv.isDarwin) [ libcap libuuid ]
     ++ lib.optionals withCups [ cups ]
     ++ lib.optionals withDBengine [ lz4 ]
     ++ lib.optionals withIpmi [ freeipmi ]
     ++ lib.optionals withNetfilter [ libmnl libnetfilter_acct ]
-    ++ lib.optionals withCloud [ json_c ]
     ++ lib.optionals withConnPubSub [ google-cloud-cpp grpc ]
     ++ lib.optionals withConnPrometheus [ snappy ]
     ++ lib.optionals (withCloud || withConnPrometheus) [ protobuf ]
diff --git a/pkgs/tools/text/mdhtml/default.nix b/pkgs/tools/text/mdhtml/default.nix
new file mode 100644
index 0000000000000..b5d12e7b3dcf6
--- /dev/null
+++ b/pkgs/tools/text/mdhtml/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, buildGoModule
+, fetchFromGitea
+}:
+
+buildGoModule rec {
+  pname = "mdhtml";
+  version = "0.2.2";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "Tomkoid";
+    repo = pname;
+    rev = version;
+    hash = "sha256-893pqrrTftzKqPYZgukV/yx2gkukVZWDTgg7ufx1MsY=";
+  };
+
+  vendorHash = null;
+
+  meta = with lib; {
+    description = "Really simple CLI Markdown to HTML converter with styling support";
+    homepage = "https://codeberg.org/Tomkoid/mdhtml";
+    license = licenses.mit;
+    changelog = "https://codeberg.org/Tomkoid/mdhtml/releases";
+    maintainers = with maintainers; [ tomkoid ];
+    mainProgram = "mdhtml";
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 384c1415b6b0c..6909a953e36fb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3267,10 +3267,6 @@ with pkgs;
 
   apitrace = libsForQt5.callPackage ../applications/graphics/apitrace { };
 
-  argagg = callPackage ../development/libraries/argagg { };
-
-  argtable = callPackage ../development/libraries/argtable { };
-
   arguments = callPackage ../development/libraries/arguments { };
 
   argus = callPackage ../tools/networking/argus { };
@@ -10263,6 +10259,10 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreFoundation IOKit;
     protobuf = protobuf3_21;
   };
+  netdataCloud = netdata.override {
+    withCloud = !stdenv.isDarwin;
+    withCloudUi = true;
+  };
   # Exposed here so the bots can auto-upgrade it
   netdata-go-plugins = callPackage ../tools/system/netdata/go.d.plugin.nix { };
 
@@ -12664,7 +12664,7 @@ with pkgs;
 
   rewrk = callPackage ../tools/networking/rewrk { };
 
-  inherit (callPackage ../tools/security/rekor { })
+  inherit (callPackage ../tools/security/rekor { buildGoModule = buildGo121Module; })
     rekor-cli
     rekor-server;
 
@@ -13832,6 +13832,7 @@ with pkgs;
   tewisay = callPackage ../tools/misc/tewisay { };
 
   texmacs = libsForQt5.callPackage ../applications/editors/texmacs {
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
     tex = texlive.combined.scheme-small;
     extraFonts = true;
   };
@@ -34468,7 +34469,7 @@ with pkgs;
   wrapOBS = callPackage ../applications/video/obs-studio/wrapper.nix { };
 
   obsidian = callPackage ../applications/misc/obsidian {
-    electron = electron_24;
+    electron = electron_25;
   };
 
   octoprint = callPackage ../applications/misc/octoprint { };
@@ -35385,8 +35386,6 @@ with pkgs;
 
   tart = callPackage ../applications/virtualization/tart { };
 
-  tecoc = callPackage ../applications/editors/tecoc { };
-
   viber = callPackage ../applications/networking/instant-messengers/viber { };
 
   wavebox = libsForQt5.callPackage ../applications/networking/instant-messengers/wavebox { };
@@ -42131,4 +42130,6 @@ with pkgs;
   };
 
   code-maat = callPackage ../development/tools/code-maat {};
+
+  mdhtml = callPackage ../tools/text/mdhtml { };
 }
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 425ece6b7beea..ea65b3a702688 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -4954,7 +4954,12 @@ with self; {
       url = "mirror://cpan/authors/id/B/BA/BARTB/Crypt-HSXKPasswd-v3.6.tar.gz";
       hash = "sha256-lZ3MX58BG/ALha0i31ZrerK/XqHTYrDeD7WuKfvEWLM=";
     };
-    buildInputs = [ Clone DateTime FileHomeDir FileShare FileShareDir GetoptLong JSON ListMoreUtils MathRound Readonly TextUnidecode TypeTiny ];
+    nativeBuildInputs = lib.optional stdenv.isDarwin shortenPerlShebang;
+    propagatedBuildInputs = [ Clone DateTime FileHomeDir FileShare FileShareDir GetoptLong JSON ListMoreUtils MathRound Readonly TextUnidecode TypeTiny ];
+    postInstall = lib.optionalString stdenv.isDarwin ''
+      shortenPerlShebang $out/bin/hsxkpasswd
+    '';
+
     meta = {
       description = "A secure memorable password generator";
       homepage = "http://www.bartb.ie/hsxkpasswd";
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 4e679de15084c..164475b96eb81 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -354,6 +354,7 @@ mapAliases ({
   Quandl = quandl; # added 2023-02-19
   qiskit-aqua = throw "qiskit-aqua has been removed due to deprecation, with its functionality moved to different qiskit packages";
   rabbitpy = throw "rabbitpy has been removed, since it is unmaintained and broken"; # added 2023-07-01
+  ratelimiter = throw "ratelimiter has been removed, since it is unmaintained and broken"; # added 2023-10-21
   rdflib-jsonld = throw "rdflib-jsonld is not compatible with rdflib 6"; # added 2021-11-05
   recaptcha_client = throw "recaptcha_client has been removed since it is no longer maintained"; # added 2023-10-20
   rednose = throw "rednose is no longer maintained (since February 2018)"; # added 2023-08-06
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ac62b89f98822..57c9a0eb33df4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11995,8 +11995,6 @@ self: super: with self; {
 
   ratelimit = callPackage ../development/python-modules/ratelimit { };
 
-  ratelimiter = callPackage ../development/python-modules/ratelimiter { };
-
   rauth = callPackage ../development/python-modules/rauth { };
 
   raven = callPackage ../development/python-modules/raven { };