about summary refs log tree commit diff
path: root/pkgs/os-specific/linux
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific/linux')
-rw-r--r--pkgs/os-specific/linux/bcc/default.nix4
-rw-r--r--pkgs/os-specific/linux/below/default.nix6
-rw-r--r--pkgs/os-specific/linux/busybox/default.nix2
-rw-r--r--pkgs/os-specific/linux/cpupower-gui/default.nix4
-rw-r--r--pkgs/os-specific/linux/cpupower/default.nix1
-rw-r--r--pkgs/os-specific/linux/cryptsetup/default.nix4
-rw-r--r--pkgs/os-specific/linux/dbus-broker/default.nix4
-rw-r--r--pkgs/os-specific/linux/dbus-broker/disable-test.patch23
-rw-r--r--pkgs/os-specific/linux/device-tree/default.nix2
-rw-r--r--pkgs/os-specific/linux/dmidecode/default.nix6
-rw-r--r--pkgs/os-specific/linux/drbd/driver.nix25
-rw-r--r--pkgs/os-specific/linux/earlyoom/default.nix38
-rw-r--r--pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch11
-rw-r--r--pkgs/os-specific/linux/ell/default.nix6
-rw-r--r--pkgs/os-specific/linux/ethq/default.nix2
-rw-r--r--pkgs/os-specific/linux/evdi/default.nix2
-rw-r--r--pkgs/os-specific/linux/ffado/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-manager/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/default.nix25
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock.json424
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/upgrade-file.patch13
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd-efi/default.nix8
-rw-r--r--pkgs/os-specific/linux/fw-ectool/default.nix33
-rw-r--r--pkgs/os-specific/linux/google-authenticator/default.nix4
-rw-r--r--pkgs/os-specific/linux/guvcview/default.nix4
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/intel-compute-runtime/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix8
-rw-r--r--pkgs/os-specific/linux/iwd/default.nix10
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix52
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json32
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.10.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix9
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix14
-rw-r--r--pkgs/os-specific/linux/kernel/rust-1.77.patch792
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix11
-rw-r--r--pkgs/os-specific/linux/kexec-tools/default.nix4
-rw-r--r--pkgs/os-specific/linux/lenovo-legion/app.nix15
-rw-r--r--pkgs/os-specific/linux/libbpf/default.nix4
-rw-r--r--pkgs/os-specific/linux/libcap-ng/default.nix4
-rw-r--r--pkgs/os-specific/linux/libnvme/default.nix2
-rw-r--r--pkgs/os-specific/linux/libzbc/default.nix2
-rw-r--r--pkgs/os-specific/linux/libzbd/default.nix2
-rw-r--r--pkgs/os-specific/linux/lxc/add-meson-options.patch153
-rw-r--r--pkgs/os-specific/linux/lxc/default.nix94
-rw-r--r--pkgs/os-specific/linux/lxc/docbook-hack.patch21
-rw-r--r--pkgs/os-specific/linux/mwprocapture/default.nix4
-rw-r--r--pkgs/os-specific/linux/nct6687d/default.nix11
-rw-r--r--pkgs/os-specific/linux/nftables/default.nix16
-rw-r--r--pkgs/os-specific/linux/nftables/fix-py-libnftables.patch13
-rw-r--r--pkgs/os-specific/linux/nftables/python.nix26
-rwxr-xr-xpkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh12
-rw-r--r--pkgs/os-specific/linux/nmon/default.nix4
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix18
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/settings.nix4
-rw-r--r--pkgs/os-specific/linux/openvswitch/default.nix4
-rw-r--r--pkgs/os-specific/linux/openvswitch/generic.nix135
-rw-r--r--pkgs/os-specific/linux/openvswitch/lts.nix5
-rw-r--r--pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch12
-rwxr-xr-xpkgs/os-specific/linux/openvswitch/update.nu19
-rw-r--r--pkgs/os-specific/linux/pam/default.nix13
-rw-r--r--pkgs/os-specific/linux/piper/default.nix4
-rw-r--r--pkgs/os-specific/linux/power-profiles-daemon/default.nix9
-rw-r--r--pkgs/os-specific/linux/r8125/default.nix4
-rw-r--r--pkgs/os-specific/linux/restool/default.nix2
-rw-r--r--pkgs/os-specific/linux/rtl8852au/default.nix52
-rw-r--r--pkgs/os-specific/linux/rtl8852bu/default.nix51
-rw-r--r--pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix6
-rw-r--r--pkgs/os-specific/linux/sgx/psw/default.nix10
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch26
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/default.nix48
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch26
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix4
-rw-r--r--pkgs/os-specific/linux/sgx/ssl/default.nix36
-rw-r--r--pkgs/os-specific/linux/sgx/ssl/tests.nix95
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix7
-rw-r--r--pkgs/os-specific/linux/tiscamera/default.nix6
-rw-r--r--pkgs/os-specific/linux/tuna/default.nix4
-rw-r--r--pkgs/os-specific/linux/upower/default.nix9
-rw-r--r--pkgs/os-specific/linux/waydroid/default.nix4
-rw-r--r--pkgs/os-specific/linux/zenmonitor/default.nix4
82 files changed, 1579 insertions, 1030 deletions
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index a0b91f6d778b7..3cf9b26f4fdda 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -20,7 +20,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.29.1";
+  version = "0.30.0";
 
   disabled = !stdenv.isLinux;
 
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "iovisor";
     repo = "bcc";
     rev = "v${version}";
-    hash = "sha256-+HYCweAI5axx0ZNFd/jLRXkUinRLDmKWMpLTk7FrEe0=";
+    hash = "sha256-ngGLGfLv2prnjhgaRPf8ea3oyy4129zGodR0Yz1QtCw=";
   };
   format = "other";
 
diff --git a/pkgs/os-specific/linux/below/default.nix b/pkgs/os-specific/linux/below/default.nix
index 3204bd7dcf277..5efc80357d8f1 100644
--- a/pkgs/os-specific/linux/below/default.nix
+++ b/pkgs/os-specific/linux/below/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "below";
-  version = "0.7.1";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "below";
     rev = "v${version}";
-    sha256 = "sha256-2mZBpvLPY6yrEAvB1YlFuaXJlmmNuZqhu3xWADNHbx0=";
+    sha256 = "sha256-87Fdx3Jqi3dNWM5DZl+UYs031qn2DoiiWd3IysT/glQ=";
   };
 
-  cargoHash = "sha256-cTNxWCd4YH5VuZh0GRfBNtHmLqCQ75uyHqROkv1jbRA=";
+  cargoHash = "sha256-y2fNypA0MrCdUI/K6QrZWw/5mkYafj2s6jrGHU2zGXw=";
 
   prePatch = ''sed -i "s,ExecStart=.*/bin,ExecStart=$out/bin," etc/below.service'';
   postInstall = ''
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index ffeb82d9b41bf..33fa7663f46dd 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -167,6 +167,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ TethysSvensson qyliss ];
     platforms = platforms.linux;
-    priority = 10;
+    priority = 15; # below systemd (halt, init, poweroff, reboot) and coreutils
   };
 }
diff --git a/pkgs/os-specific/linux/cpupower-gui/default.nix b/pkgs/os-specific/linux/cpupower-gui/default.nix
index 02a781d1f0cf0..754f8e1396152 100644
--- a/pkgs/os-specific/linux/cpupower-gui/default.nix
+++ b/pkgs/os-specific/linux/cpupower-gui/default.nix
@@ -19,7 +19,7 @@
 , pygobject3
 , pyxdg
 , systemd
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildPythonApplication rec {
@@ -55,7 +55,7 @@ buildPythonApplication rec {
     meson
     ninja
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
 
     # Python packages
     dbus-python
diff --git a/pkgs/os-specific/linux/cpupower/default.nix b/pkgs/os-specific/linux/cpupower/default.nix
index 13e2fc78b8219..7c1b031d83349 100644
--- a/pkgs/os-specific/linux/cpupower/default.nix
+++ b/pkgs/os-specific/linux/cpupower/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation {
     description = "Tool to examine and tune power saving features";
     homepage = "https://www.kernel.org/";
     license = licenses.gpl2;
+    mainProgram = "cpupower";
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 33edbc0a4f732..0e32966615ac1 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "cryptsetup";
-  version = "2.7.0";
+  version = "2.7.1";
 
   outputs = [ "bin" "out" "dev" "man" ];
   separateDebugInfo = true;
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-lAA6AM1agZRPRejcUp4M/Spv9im9LNIc9eV05GXa95U=";
+    hash = "sha256-2l0UGeKobgGqMv15WCzVTSCIV8tUG8ov1Cal/xqqu8M=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/dbus-broker/default.nix b/pkgs/os-specific/linux/dbus-broker/default.nix
index 5180917623e93..784024f8754d0 100644
--- a/pkgs/os-specific/linux/dbus-broker/default.nix
+++ b/pkgs/os-specific/linux/dbus-broker/default.nix
@@ -40,13 +40,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dbus-broker";
-  version = "35";
+  version = "36";
 
   src = fetchFromGitHub {
     owner = "bus1";
     repo = "dbus-broker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Qwi9X5jXHiQ3TOWefzv/p7x8/JkQW1QgdYji5SpLej0=";
+    hash = "sha256-5dAMKjybqrHG57vArbtWEPR/svSj2ION75JrjvnnpVM=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/dbus-broker/disable-test.patch b/pkgs/os-specific/linux/dbus-broker/disable-test.patch
index 487967aea8406..14faf1907cc20 100644
--- a/pkgs/os-specific/linux/dbus-broker/disable-test.patch
+++ b/pkgs/os-specific/linux/dbus-broker/disable-test.patch
@@ -1,11 +1,14 @@
---- b/src/meson.build
-+++ a/src/meson.build
-@@ -196,9 +195,6 @@
- test_fdlist = executable('test-fdlist', ['util/test-fdlist.c'], dependencies: dep_bus)
- test('Utility File-Desciptor Lists', test_fdlist)
-
--test_fs = executable('test-fs', ['util/test-fs.c'], dependencies: dep_bus)
--test('File System Helpers', test_fs)
+diff --git a/src/meson.build b/src/meson.build
+index 4b9bc71..221ed5c 100644
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -202,9 +202,6 @@ test('Error Handling', test_error, suite: 'unit')
+ test_fdlist = executable('test-fdlist', sources: ['util/test-fdlist.c'], kwargs: test_kwargs)
+ test('Utility File-Desciptor Lists', test_fdlist, suite: 'unit')
+ 
+-test_fs = executable('test-fs', sources: ['util/test-fs.c'], kwargs: test_kwargs)
+-test('File System Helpers', test_fs, suite: 'unit')
 -
- test_match = executable('test-match', ['bus/test-match.c'], dependencies: dep_bus)
- test('D-Bus Match Handling', test_match)
+ test_match = executable('test-match', sources: ['bus/test-match.c'], kwargs: test_kwargs)
+ test('D-Bus Match Handling', test_match, suite: 'unit')
+ 
diff --git a/pkgs/os-specific/linux/device-tree/default.nix b/pkgs/os-specific/linux/device-tree/default.nix
index 1a50d799b4b12..a15a9e32137cd 100644
--- a/pkgs/os-specific/linux/device-tree/default.nix
+++ b/pkgs/os-specific/linux/device-tree/default.nix
@@ -32,7 +32,7 @@ with lib; {
     in ''
       mkdir -p $out
       cd "${base}"
-      find . -type f -name '*.dtb' -print0 \
+      find -L . -type f -name '*.dtb' -print0 \
         | xargs -0 cp -v --no-preserve=mode --target-directory "$out" --parents
 
       for dtb in $(find "$out" -type f -name '*.dtb'); do
diff --git a/pkgs/os-specific/linux/dmidecode/default.nix b/pkgs/os-specific/linux/dmidecode/default.nix
index f09dec758f740..3bfaad303516a 100644
--- a/pkgs/os-specific/linux/dmidecode/default.nix
+++ b/pkgs/os-specific/linux/dmidecode/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dmidecode";
-  version = "3.5";
+  version = "3.6";
 
   src = fetchurl {
     url = "mirror://savannah/dmidecode/dmidecode-${version}.tar.xz";
-    sha256 = "sha256-eddnNe6OJRluKnIpZM+Wg/WglYFQNTeISyVrATicwHM=";
+    sha256 = "sha256-5Axl8+w9r+Ma2DSaTvGpcSLTj2UATtZldeGo1XXdi64=";
   };
 
   makeFlags = [
@@ -19,6 +19,6 @@ stdenv.mkDerivation rec {
     description = "A tool that reads information about your system's hardware from the BIOS according to the SMBIOS/DMI standard";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ delroth ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/drbd/driver.nix b/pkgs/os-specific/linux/drbd/driver.nix
index efc771905e53a..106bcf71cd98c 100644
--- a/pkgs/os-specific/linux/drbd/driver.nix
+++ b/pkgs/os-specific/linux/drbd/driver.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "drbd-${version}-${kernel.version}";
-  version = "9.2.7";
+  version = "9.2.8";
 
   src = fetchurl {
     url = "https://pkg.linbit.com//downloads/drbd/9/drbd-${version}.tar.gz";
-    sha256 = "1355ns10z0fjgqsdpf09qfy01j8lg2n7zy4kclmar3s798n3mh56";
+    hash = "sha256-LqK1lPucab7wKvcB4VKGdvBIq+K9XtuO2m0DP5XtK3M=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -26,12 +26,12 @@ stdenv.mkDerivation rec {
   # 6.4 and newer provide a in-tree version of the handshake module https://www.kernel.org/doc/html/v6.4/networking/tls-handshake.html
   installPhase = ''
     runHook preInstall
-    install -D drbd/drbd.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
-    install -D drbd/drbd_transport_tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
-    install -D drbd/drbd_transport_lb-tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
-    install -D drbd/drbd_transport_rdma.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
+    install -D drbd/drbd.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
+    install -D drbd/drbd_transport_tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
+    install -D drbd/drbd_transport_lb-tcp.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
+    install -D drbd/drbd_transport_rdma.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
     ${lib.optionalString (lib.versionOlder kernel.version "6.4") ''
-      install -D drbd/drbd-kernel-compat/handshake/handshake.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd
+      install -D drbd/drbd-kernel-compat/handshake/handshake.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9
     ''}
     runHook postInstall
   '';
@@ -41,6 +41,16 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace 'SHELL=/bin/bash' 'SHELL=${builtins.getEnv "SHELL"}'
   '';
 
+  # builder.pl had complained about the same file (drbd.ko.xz) provided by two different packages
+  # builder.pl also had complained about different permissions between the files from the two packages
+  # The compression is required because the kernel has the CONFIG_MODULE_COMPRESS_XZ option enabled
+  postFixup = ''
+    for ko in $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/block/drbd9/*.ko; do
+      xz --compress -6 --threads=0 $ko
+      chmod 0444 $ko.xz
+    done
+  '';
+
   enableParallelBuilding = true;
 
   meta = with lib; {
@@ -53,5 +63,6 @@ stdenv.mkDerivation rec {
        DRBD is a software-based, shared-nothing, replicated storage solution
        mirroring the content of block devices (hard disks, partitions, logical volumes, and so on) between hosts.
     '';
+    broken = lib.versionAtLeast kernel.version "6.8"; # wait until next DRBD release for 6.8 support https://github.com/LINBIT/drbd/issues/87#issuecomment-2059323084
   };
 }
diff --git a/pkgs/os-specific/linux/earlyoom/default.nix b/pkgs/os-specific/linux/earlyoom/default.nix
deleted file mode 100644
index d1d95b4d3f959..0000000000000
--- a/pkgs/os-specific/linux/earlyoom/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, pandoc, installShellFiles, withManpage ? false, nixosTests }:
-
-stdenv.mkDerivation rec {
-  pname = "earlyoom";
-  version = "1.7";
-
-  src = fetchFromGitHub {
-    owner = "rfjakob";
-    repo = "earlyoom";
-    rev = "v${version}";
-    sha256 = "sha256-8YcT1TTlAet7F1U9Ginda4IApNqkudegOXqm8rnRGfc=";
-  };
-
-  nativeBuildInputs = lib.optionals withManpage [ pandoc installShellFiles ];
-
-  patches = [ ./fix-dbus-path.patch ];
-
-  makeFlags = [ "VERSION=${version}" ];
-
-  installPhase = ''
-    install -D earlyoom $out/bin/earlyoom
-  '' + lib.optionalString withManpage ''
-    installManPage earlyoom.1
-  '';
-
-  passthru.tests = {
-    inherit (nixosTests) earlyoom;
-  };
-
-  meta = with lib; {
-    description = "Early OOM Daemon for Linux";
-    mainProgram = "earlyoom";
-    homepage = "https://github.com/rfjakob/earlyoom";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [];
-  };
-}
diff --git a/pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch b/pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch
deleted file mode 100644
index e1c10cf82f96e..0000000000000
--- a/pkgs/os-specific/linux/earlyoom/fix-dbus-path.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/kill.c
-+++ b/kill.c
-@@ -55,7 +55,7 @@ static void notify(const char* summary, const char* body)
-     }
-     // Complete command line looks like this:
-     // dbus-send --system / net.nuetzlich.SystemNotifications.Notify 'string:summary text' 'string:and body text'
--    execl("/usr/bin/dbus-send", "dbus-send", "--system", "/", "net.nuetzlich.SystemNotifications.Notify",
-+    execlp("dbus-send", "dbus-send", "--system", "/", "net.nuetzlich.SystemNotifications.Notify",
-         summary2, body2, NULL);
-     warn("notify: exec failed: %s\n", strerror(errno));
-     exit(1);
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index 9175f477bd607..9c16a341a478f 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.63";
+  version = "0.64";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    hash = "sha256-husK3eurfL1NhRHgJUdFP6sYLqeZ4NSHa/tU8PUWmGo=";
+    hash = "sha256-LONfgFgPg8KCDwtw//WTOYQT9RpnIskdHAWcgafOhcg=";
   };
 
   nativeBuildInputs = [
@@ -50,6 +50,6 @@ stdenv.mkDerivation rec {
     changelog = "https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ChangeLog?h=${version}";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ mic92 dtzWill amaxine ];
+    maintainers = with maintainers; [ mic92 dtzWill ];
   };
 }
diff --git a/pkgs/os-specific/linux/ethq/default.nix b/pkgs/os-specific/linux/ethq/default.nix
index 5936447ac9351..581382e4faf2d 100644
--- a/pkgs/os-specific/linux/ethq/default.nix
+++ b/pkgs/os-specific/linux/ethq/default.nix
@@ -28,6 +28,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/isc-projects/ethq";
     license = licenses.mpl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ delroth ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/evdi/default.nix b/pkgs/os-specific/linux/evdi/default.nix
index 2aec4f63229d8..25a82b1806ca5 100644
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = with lib; {
     broken = kernel.kernelOlder "4.19";
-    changelog = "https://github.com/DisplayLink/evdi/releases/tag/v${version}";
+    changelog = "https://github.com/DisplayLink/evdi/releases/tag/v${finalAttrs.version}";
     description = "Extensible Virtual Display Interface";
     homepage = "https://www.displaylink.com/";
     license = with licenses; [ lgpl21Only gpl2Only ];
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index dfa974e3e683c..610f9d31353e2 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -8,7 +8,6 @@
 , fetchurl
 , fetchpatch
 , glibmm
-, kernel
 , libavc1394
 , libconfig
 , libiec61883
@@ -22,7 +21,6 @@
 }:
 
 let
-  inherit (python3.pkgs) pyqt5 dbus-python;
   python = python3.withPackages (pkgs: with pkgs; [ pyqt5 dbus-python ]);
 in
 mkDerivation rec {
@@ -61,7 +59,7 @@ mkDerivation rec {
     pkg-config
     which
     python
-    pyqt5
+    python3.pkgs.pyqt5
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
index af455e7ef61fa..57b4207e383d0 100644
--- a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
@@ -8,7 +8,7 @@
 , openssl
 , udev
 , gtk3
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 stdenv.mkDerivation rec {
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     rustc
     pkg-config
     rustPlatform.cargoSetupHook
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
index 98b9ff5d33881..952139bb35e20 100644
--- a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
@@ -6,10 +6,16 @@
 
 flutter.buildFlutterApplication rec {
   pname = "firmware-updater";
-  version = "unstable-2023-09-17";
+  version = "unstable-2024-18-04";
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
+  patches = [
+    ./upgrade-file.patch
+  ];
+
+  sourceRoot = "./source/packages/firmware_updater";
+
   gitHashes = {
     fwupd = "sha256-l/+HrrJk1mE2Mrau+NmoQ7bu9qhHU6wX68+m++9Hjd4=";
   };
@@ -17,23 +23,10 @@ flutter.buildFlutterApplication rec {
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "firmware-updater";
-    rev = "855999da8d3d0c9930e06f2d296d82b55aeff79e";
-    hash = "sha256-tIeEuHl+sCKd756NYPmxXiV1Sg2m9W0eGUtM/Iskeu8=";
+    rev = "e48bb3f693e5d76656a3e7bbc07be0fcbfa19f23";
+    hash = "sha256-SO3sDIsJCK4Sh51pXO4u6WX4zcFa6jQYu9E+WtVrjDE=";
   };
 
-  postPatch = ''
-    rm -f pubspec.lock
-    ln -s "${writeText "${pname}-overrides.yaml" (builtins.toJSON {
-      dependency_overrides = {
-        yaru = "^1.1.0";
-        yaru_icons = "^2.2.1";
-        yaru_widgets = "^3.1.0";
-        mockito = "^5.4.2";
-        test_api = "^0.6.1";
-      };
-    })}" pubspec_overrides.yaml
-  '';
-
   meta = with lib; {
     description = "Firmware Updater for Linux";
     mainProgram = "firmware-updater";
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock.json b/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock.json
index 0ad3deb2394eb..2212f02278688 100644
--- a/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock.json
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock.json
@@ -20,25 +20,15 @@
       "source": "hosted",
       "version": "5.13.0"
     },
-    "ansi_styles": {
-      "dependency": "transitive",
-      "description": {
-        "name": "ansi_styles",
-        "sha256": "9c656cc12b3c27b17dd982b2cc5c0cfdfbdabd7bc8f3ae5e8542d9867b47ce8a",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.3.2+1"
-    },
     "args": {
       "dependency": "transitive",
       "description": {
         "name": "args",
-        "sha256": "eef6c46b622e0494a36c5a12d10d77fb4e855501a91c1b9ef9339326e58f0596",
+        "sha256": "7cf60b9f0cc88203c5a190b4cd62a99feea42759a7fa695010eb5de1c0b2252a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.2"
+      "version": "2.5.0"
     },
     "async": {
       "dependency": "transitive",
@@ -84,31 +74,31 @@
       "dependency": "transitive",
       "description": {
         "name": "build_daemon",
-        "sha256": "5f02d73eb2ba16483e693f80bee4f088563a820e47d1027d4cdfe62b5bb43e65",
+        "sha256": "0343061a33da9c5810b2d6cee51945127d8f4c060b7fbdd9d54917f0a3feaaa1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.0"
+      "version": "4.0.1"
     },
     "build_resolvers": {
       "dependency": "transitive",
       "description": {
         "name": "build_resolvers",
-        "sha256": "6c4dd11d05d056e76320b828a1db0fc01ccd376922526f8e9d6c796a5adbac20",
+        "sha256": "339086358431fa15d7eca8b6a36e5d783728cf025e559b834f4609a1fcfb7b0a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.1"
+      "version": "2.4.2"
     },
     "build_runner": {
       "dependency": "direct dev",
       "description": {
         "name": "build_runner",
-        "sha256": "10c6bcdbf9d049a0b666702cf1cee4ddfdc38f02a19d35ae392863b47519848b",
+        "sha256": "3ac61a79bfb6f6cc11f693591063a7f19a7af628dc52f141743edac5c16e8c22",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.6"
+      "version": "2.4.9"
     },
     "build_runner_core": {
       "dependency": "transitive",
@@ -134,11 +124,11 @@
       "dependency": "transitive",
       "description": {
         "name": "built_value",
-        "sha256": "ff627b645b28fb8bdb69e645f910c2458fd6b65f6585c3a53e0626024897dedf",
+        "sha256": "c7913a9737ee4007efedaffc968c049fd0f3d0e49109e778edc10de9426005cb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.6.2"
+      "version": "8.9.2"
     },
     "characters": {
       "dependency": "transitive",
@@ -150,16 +140,6 @@
       "source": "hosted",
       "version": "1.3.0"
     },
-    "charcode": {
-      "dependency": "transitive",
-      "description": {
-        "name": "charcode",
-        "sha256": "fb98c0f6d12c920a02ee2d998da788bca066ca5f148492b7085ee23372b12306",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.3.1"
-    },
     "checked_yaml": {
       "dependency": "transitive",
       "description": {
@@ -170,26 +150,6 @@
       "source": "hosted",
       "version": "2.0.3"
     },
-    "cli_launcher": {
-      "dependency": "transitive",
-      "description": {
-        "name": "cli_launcher",
-        "sha256": "5e7e0282b79e8642edd6510ee468ae2976d847a0a29b3916e85f5fa1bfe24005",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.3.1"
-    },
-    "cli_util": {
-      "dependency": "transitive",
-      "description": {
-        "name": "cli_util",
-        "sha256": "b8db3080e59b2503ca9e7922c3df2072cf13992354d5e944074ffa836fba43b7",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.4.0"
-    },
     "clock": {
       "dependency": "transitive",
       "description": {
@@ -204,31 +164,21 @@
       "dependency": "transitive",
       "description": {
         "name": "code_builder",
-        "sha256": "4ad01d6e56db961d29661561effde45e519939fdaeb46c351275b182eac70189",
+        "sha256": "f692079e25e7869c14132d39f223f8eec9830eb76131925143b2129c4bb01b37",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.5.0"
+      "version": "4.10.0"
     },
     "collection": {
       "dependency": "direct main",
       "description": {
         "name": "collection",
-        "sha256": "f092b211a4319e98e5ff58223576de6c2803db36221657b46c82574721240687",
+        "sha256": "ee67cb0715911d28db6bf4af1026078bd6f0128b07a5f66fb2ed94ec6783c09a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.17.2"
-    },
-    "conventional_commit": {
-      "dependency": "transitive",
-      "description": {
-        "name": "conventional_commit",
-        "sha256": "dec15ad1118f029c618651a4359eb9135d8b88f761aa24e4016d061cd45948f2",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.6.0+1"
+      "version": "1.18.0"
     },
     "convert": {
       "dependency": "transitive",
@@ -274,31 +224,31 @@
       "dependency": "direct main",
       "description": {
         "name": "dbus",
-        "sha256": "6f07cba3f7b3448d42d015bfd3d53fe12e5b36da2423f23838efc1d5fb31a263",
+        "sha256": "365c771ac3b0e58845f39ec6deebc76e3276aa9922b0cc60840712094d9047ac",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.8"
+      "version": "0.7.10"
     },
     "diacritic": {
       "dependency": "transitive",
       "description": {
         "name": "diacritic",
-        "sha256": "a84e03ec2779375fb86430dbe9d8fba62c68376f2499097a5f6e75556babe706",
+        "sha256": "96db5db6149cbe4aa3cfcbfd170aca9b7648639be7e48025f9d458517f807fe4",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.4"
+      "version": "0.1.5"
     },
     "dio": {
       "dependency": "direct main",
       "description": {
         "name": "dio",
-        "sha256": "7d328c4d898a61efc3cd93655a0955858e29a0aa647f0f9e02d59b3bb275e2e8",
+        "sha256": "11e40df547d418cc0c4900a9318b26304e665da6fa4755399a9ff9efd09034b5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.6"
+      "version": "5.4.3+1"
     },
     "fake_async": {
       "dependency": "transitive",
@@ -314,21 +264,21 @@
       "dependency": "transitive",
       "description": {
         "name": "ffi",
-        "sha256": "7bf0adc28a23d395f19f3f1eb21dd7cfd1dd9f8e1c50051c069122e6853bc878",
+        "sha256": "493f37e7df1804778ff3a53bd691d8692ddf69702cf4c1c1096a2e41b4779e21",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.0"
+      "version": "2.1.2"
     },
     "file": {
       "dependency": "direct main",
       "description": {
         "name": "file",
-        "sha256": "1b92bec4fc2a72f59a8e15af5f52cd441e4a7860b49499d69dfa817af20e925d",
+        "sha256": "5fc22d7c25582e38ad9a8515372cd9a93834027aacf1801cf01164dac0ffa08c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.1.4"
+      "version": "7.0.0"
     },
     "fixnum": {
       "dependency": "transitive",
@@ -363,14 +313,14 @@
       "version": "3.0.0-beta.2"
     },
     "flutter_lints": {
-      "dependency": "direct dev",
+      "dependency": "transitive",
       "description": {
         "name": "flutter_lints",
-        "sha256": "2118df84ef0c3ca93f96123a616ae8540879991b8b57af2f81b76a7ada49b2a4",
+        "sha256": "9e8c3858111da373efc5aa341de011d9bd23e2c5c5e0c62bccf32438e192d7b1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.2"
+      "version": "3.0.2"
     },
     "flutter_localizations": {
       "dependency": "direct main",
@@ -382,21 +332,21 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_markdown",
-        "sha256": "2b206d397dd7836ea60035b2d43825c8a303a76a5098e66f42d55a753e18d431",
+        "sha256": "04c4722cc36ec5af38acc38ece70d22d3c2123c61305d555750a091517bbe504",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.17+1"
+      "version": "0.6.23"
     },
     "flutter_svg": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_svg",
-        "sha256": "8c5d68a82add3ca76d792f058b186a0599414f279f00ece4830b9b231b570338",
+        "sha256": "7b4ca6cf3304575fe9c8ec64813c8d02ee41d2afe60bcfe0678bcb5375d596a2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.7"
+      "version": "2.0.10+1"
     },
     "flutter_test": {
       "dependency": "direct dev",
@@ -414,11 +364,11 @@
       "dependency": "direct dev",
       "description": {
         "name": "freezed",
-        "sha256": "2df89855fe181baae3b6d714dc3c4317acf4fccd495a6f36e5e00f24144c6c3b",
+        "sha256": "a434911f643466d78462625df76fd9eb13e57348ff43fe1f77bbe909522c67a1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.1"
+      "version": "2.5.2"
     },
     "freezed_annotation": {
       "dependency": "direct main",
@@ -434,11 +384,11 @@
       "dependency": "transitive",
       "description": {
         "name": "frontend_server_client",
-        "sha256": "408e3ca148b31c20282ad6f37ebfa6f4bdc8fede5b74bc2f08d9d92b55db3612",
+        "sha256": "f64a0333a82f30b0cca061bc3d143813a486dc086b574bfb233b7c1372427694",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.0"
+      "version": "4.0.0"
     },
     "fuchsia_remote_debug_protocol": {
       "dependency": "transitive",
@@ -461,11 +411,11 @@
       "dependency": "transitive",
       "description": {
         "name": "get_it",
-        "sha256": "529de303c739fca98cd7ece5fca500d8ff89649f1bb4b4e94fb20954abcd7468",
+        "sha256": "d85128a5dae4ea777324730dc65edd9c9f43155c109d5cc0a69cab74139fbac1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.6.0"
+      "version": "7.7.0"
     },
     "glob": {
       "dependency": "transitive",
@@ -521,11 +471,11 @@
       "dependency": "transitive",
       "description": {
         "name": "http",
-        "sha256": "759d1a329847dd0f39226c688d3e06a6b8679668e350e2891a6474f8b4bb8525",
+        "sha256": "761a297c042deedc1ffbb156d6e2af13886bb305c2a343a4d972504cd67dd938",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.0"
+      "version": "1.2.1"
     },
     "http_multi_server": {
       "dependency": "transitive",
@@ -577,31 +527,61 @@
       "dependency": "transitive",
       "description": {
         "name": "js",
-        "sha256": "f2c445dce49627136094980615a031419f7f3eb393237e4ecd97ac15dea343f3",
+        "sha256": "c1b2e9b5ea78c45e1a0788d29606ba27dc5f71f019f32ca5140f61ef071838cf",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.7"
+      "version": "0.7.1"
     },
     "json_annotation": {
       "dependency": "transitive",
       "description": {
         "name": "json_annotation",
-        "sha256": "b10a7b2ff83d83c777edba3c6a0f97045ddadd56c944e1a23a3fdf43a1bf4467",
+        "sha256": "1ce844379ca14835a50d2f019a3099f419082cfdd231cd86a142af94dd5c6bb1",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "4.9.0"
+    },
+    "leak_tracker": {
+      "dependency": "transitive",
+      "description": {
+        "name": "leak_tracker",
+        "sha256": "78eb209deea09858f5269f5a5b02be4049535f568c07b275096836f01ea323fa",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "10.0.0"
+    },
+    "leak_tracker_flutter_testing": {
+      "dependency": "transitive",
+      "description": {
+        "name": "leak_tracker_flutter_testing",
+        "sha256": "b46c5e37c19120a8a01918cfaf293547f47269f7cb4b0058f21531c2465d6ef0",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.1"
+    },
+    "leak_tracker_testing": {
+      "dependency": "transitive",
+      "description": {
+        "name": "leak_tracker_testing",
+        "sha256": "a597f72a664dbd293f3bfc51f9ba69816f84dcd403cdac7066cb3f6003f3ab47",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.8.1"
+      "version": "2.0.1"
     },
     "lints": {
       "dependency": "transitive",
       "description": {
         "name": "lints",
-        "sha256": "0a217c6c989d21039f1498c3ed9f3ed71b354e69873f13a8dfc3c9fe76f1b452",
+        "sha256": "cbf8d4b858bb0134ef3ef87841abdf8d63bfc255c266b7bf6b39daa1085c4290",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.1"
+      "version": "3.0.0"
     },
     "list_counter": {
       "dependency": "transitive",
@@ -637,61 +617,51 @@
       "dependency": "transitive",
       "description": {
         "name": "markdown",
-        "sha256": "acf35edccc0463a9d7384e437c015a3535772e09714cf60e07eeef3a15870dcd",
+        "sha256": "ef2a1298144e3f985cc736b22e0ccdaf188b5b3970648f2d9dc13efd1d9df051",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.1.1"
+      "version": "7.2.2"
     },
     "matcher": {
       "dependency": "transitive",
       "description": {
         "name": "matcher",
-        "sha256": "1803e76e6653768d64ed8ff2e1e67bea3ad4b923eb5c56a295c3e634bad5960e",
+        "sha256": "d2323aa2060500f906aa31a895b4030b6da3ebdcc5619d14ce1aada65cd161cb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.12.16"
+      "version": "0.12.16+1"
     },
     "material_color_utilities": {
       "dependency": "transitive",
       "description": {
         "name": "material_color_utilities",
-        "sha256": "9528f2f296073ff54cb9fee677df673ace1218163c3bc7628093e7eed5203d41",
+        "sha256": "0e0a020085b65b6083975e499759762399b4475f766c21668c4ecca34ea74e5a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.0"
-    },
-    "melos": {
-      "dependency": "direct dev",
-      "description": {
-        "name": "melos",
-        "sha256": "3f22f6cc629d72acf3acc8a7f8563384550290fa30790efa328c9cf606aa17d7",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "3.1.1"
+      "version": "0.8.0"
     },
     "meta": {
       "dependency": "direct main",
       "description": {
         "name": "meta",
-        "sha256": "3c74dbf8763d36539f114c799d8a2d87343b5067e9d796ca22b5eb8437090ee3",
+        "sha256": "d584fa6707a52763a52446f02cc621b077888fb63b93bbcb1143a7be5a0c0c04",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.9.1"
+      "version": "1.11.0"
     },
     "mime": {
       "dependency": "transitive",
       "description": {
         "name": "mime",
-        "sha256": "e4ff8e8564c03f255408decd16e7899da1733852a9110a58fe6d1b817684a63e",
+        "sha256": "2e123074287cc9fd6c09de8336dae606d1ddb88d9ac47358826db698c176a1f2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.4"
+      "version": "1.0.5"
     },
     "mockito": {
       "dependency": "direct dev",
@@ -703,16 +673,6 @@
       "source": "hosted",
       "version": "5.4.2"
     },
-    "mustache_template": {
-      "dependency": "transitive",
-      "description": {
-        "name": "mustache_template",
-        "sha256": "a46e26f91445bfb0b60519be280555b06792460b27b19e2b19ad5b9740df5d1c",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "2.0.0"
-    },
     "nested": {
       "dependency": "transitive",
       "description": {
@@ -737,11 +697,11 @@
       "dependency": "direct main",
       "description": {
         "name": "path",
-        "sha256": "8829d8a55c13fc0e37127c29fedf290c102f4e40ae94ada574091fe0ff96c917",
+        "sha256": "087ce49c3f0dc39180befefc60fdb4acd8f8620e5682fe2476afd0b3688bb4af",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.8.3"
+      "version": "1.9.0"
     },
     "path_parsing": {
       "dependency": "transitive",
@@ -757,31 +717,31 @@
       "dependency": "transitive",
       "description": {
         "name": "petitparser",
-        "sha256": "cb3798bef7fc021ac45b308f4b51208a152792445cce0448c9a4ba5879dd8750",
+        "sha256": "c15605cd28af66339f8eb6fbe0e541bfe2d1b72d5825efc6598f3e0a31b9ad27",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.4.0"
+      "version": "6.0.2"
     },
     "platform": {
       "dependency": "transitive",
       "description": {
         "name": "platform",
-        "sha256": "4a451831508d7d6ca779f7ac6e212b4023dd5a7d08a27a63da33756410e32b76",
+        "sha256": "12220bb4b65720483f8fa9450b4332347737cf8213dd2840d8b2c823e47243ec",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.0"
+      "version": "3.1.4"
     },
     "plugin_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "plugin_platform_interface",
-        "sha256": "43798d895c929056255600343db8f049921cbec94d31ec87f1dc5c16c01935dd",
+        "sha256": "4820fbfdb9478b1ebae27888254d445073732dae3d6ea81f0b7e06d5dedc3f02",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.5"
+      "version": "2.1.8"
     },
     "pool": {
       "dependency": "transitive",
@@ -797,31 +757,21 @@
       "dependency": "transitive",
       "description": {
         "name": "process",
-        "sha256": "53fd8db9cec1d37b0574e12f07520d582019cb6c44abf5479a01505099a34a09",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "4.2.4"
-    },
-    "prompts": {
-      "dependency": "transitive",
-      "description": {
-        "name": "prompts",
-        "sha256": "3773b845e85a849f01e793c4fc18a45d52d7783b4cb6c0569fad19f9d0a774a1",
+        "sha256": "21e54fd2faf1b5bdd5102afd25012184a6793927648ea81eea80552ac9405b32",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.0"
+      "version": "5.0.2"
     },
     "provider": {
       "dependency": "direct main",
       "description": {
         "name": "provider",
-        "sha256": "cdbe7530b12ecd9eb455bdaa2fcb8d4dad22e80b8afb4798b41479d5ce26847f",
+        "sha256": "c8a055ee5ce3fd98d6fc872478b03823ffdb448699c6ebdbbc71d59b596fd48c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.0.5"
+      "version": "6.1.2"
     },
     "pub_semver": {
       "dependency": "transitive",
@@ -833,26 +783,6 @@
       "source": "hosted",
       "version": "2.1.4"
     },
-    "pub_updater": {
-      "dependency": "transitive",
-      "description": {
-        "name": "pub_updater",
-        "sha256": "b06600619c8c219065a548f8f7c192b3e080beff95488ed692780f48f69c0625",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.3.1"
-    },
-    "pubspec": {
-      "dependency": "transitive",
-      "description": {
-        "name": "pubspec",
-        "sha256": "f534a50a2b4d48dc3bc0ec147c8bd7c304280fff23b153f3f11803c4d49d927e",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "2.3.0"
-    },
     "pubspec_parse": {
       "dependency": "transitive",
       "description": {
@@ -863,25 +793,15 @@
       "source": "hosted",
       "version": "1.2.3"
     },
-    "quiver": {
-      "dependency": "transitive",
-      "description": {
-        "name": "quiver",
-        "sha256": "b1c1ac5ce6688d77f65f3375a9abb9319b3cb32486bdc7a1e0fdf004d7ba4e47",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "3.2.1"
-    },
     "safe_change_notifier": {
       "dependency": "direct main",
       "description": {
         "name": "safe_change_notifier",
-        "sha256": "e69034655ea33aa7dce3c5bb33cf12fc7c07a0ce7d59b7291fd030b70d059570",
+        "sha256": "8d0645ec2706f580912c38de488439ddb491be48247826927b7bc2e54ea8f7af",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.0"
+      "version": "0.3.2"
     },
     "screen_retriever": {
       "dependency": "transitive",
@@ -923,11 +843,11 @@
       "dependency": "transitive",
       "description": {
         "name": "source_gen",
-        "sha256": "fc0da689e5302edb6177fdd964efcb7f58912f43c28c2047a808f5bfff643d16",
+        "sha256": "14658ba5f669685cd3d63701d01b31ea748310f7ab854e471962670abcf57832",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.4.0"
+      "version": "1.5.0"
     },
     "source_span": {
       "dependency": "transitive",
@@ -943,21 +863,31 @@
       "dependency": "transitive",
       "description": {
         "name": "stack_trace",
-        "sha256": "c3c7d8edb15bee7f0f74debd4b9c5f3c2ea86766fe4178eb2a18eb30a0bdaed5",
+        "sha256": "73713990125a6d93122541237550ee3352a2d84baad52d375a4cad2eb9b7ce0b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.11.0"
+      "version": "1.11.1"
+    },
+    "state_notifier": {
+      "dependency": "transitive",
+      "description": {
+        "name": "state_notifier",
+        "sha256": "b8677376aa54f2d7c58280d5a007f9e8774f1968d1fb1c096adcb4792fba29bb",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.0"
     },
     "stream_channel": {
       "dependency": "transitive",
       "description": {
         "name": "stream_channel",
-        "sha256": "83615bee9045c1d322bbbd1ba209b7a749c2cbcdcb3fdd1df8eb488b3279c1c8",
+        "sha256": "ba2aa5d8cc609d96bbb2899c28934f9e1af5cddbd60a827822ea467161eb54e7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.1"
+      "version": "2.1.2"
     },
     "stream_transform": {
       "dependency": "transitive",
@@ -1000,7 +930,7 @@
       "version": "1.2.1"
     },
     "test_api": {
-      "dependency": "direct overridden",
+      "dependency": "transitive",
       "description": {
         "name": "test_api",
         "sha256": "5c2f730018264d276c20e4f1503fd1308dfbbae39ec8ee63c5236311ac06954b",
@@ -1029,55 +959,55 @@
       "source": "hosted",
       "version": "1.3.2"
     },
+    "ubuntu_lints": {
+      "dependency": "direct dev",
+      "description": {
+        "name": "ubuntu_lints",
+        "sha256": "1c9fd31f3b3e24969f4c5e5ccf19e1665df3e27ce9ff22ca000e4f687c4772c4",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.3.0"
+    },
     "ubuntu_localizations": {
       "dependency": "transitive",
       "description": {
         "name": "ubuntu_localizations",
-        "sha256": "a75e87b9f1c3dc678f69a943eb4cee8ccbd5b0db64d491750325950e311adab0",
+        "sha256": "eca4f43453339acca16b4b23a70b93315ab92b1500f98156a8f95af5e5078def",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.4"
+      "version": "0.3.6"
     },
     "ubuntu_logger": {
       "dependency": "direct main",
       "description": {
         "name": "ubuntu_logger",
-        "sha256": "f6d663e5b9c33e90a7a77a2f15b7f76e90be1dd98a94b6640d7bd74db262060f",
+        "sha256": "90de0c496c2c35757e0d6a32d2e3555cb37e9c2d4aab356bad589f64234bcdcc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.0.3"
+      "version": "0.1.1"
     },
     "ubuntu_service": {
       "dependency": "direct main",
       "description": {
         "name": "ubuntu_service",
-        "sha256": "f6ad4dfb099af41e750c59aad00d67a96e22df00f4962d2e25d56ae3db78be49",
+        "sha256": "b9845f972bcc919df79381b0eb42cceee1834b3232b3f444c0e4943d66d01901",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.2.4"
-    },
-    "ubuntu_session": {
-      "dependency": "direct main",
-      "description": {
-        "name": "ubuntu_session",
-        "sha256": "ce79fdd31faf7982b061b2e4a1cdd0815baf3b6b976e9c16c72609749511f3a1",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "0.0.4"
+      "version": "0.3.2"
     },
     "ubuntu_test": {
       "dependency": "direct main",
       "description": {
         "name": "ubuntu_test",
-        "sha256": "2361b741808a11d95c64a50666151d536133e75cade17b8feccca1e67364be88",
+        "sha256": "ed8e277575e74057e59363eced7c86b5c9cb172b560b7590ab911eed738e32e5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.0-beta.6"
+      "version": "0.1.0-beta.9"
     },
     "upower": {
       "dependency": "direct main",
@@ -1089,45 +1019,35 @@
       "source": "hosted",
       "version": "0.7.0"
     },
-    "uri": {
-      "dependency": "transitive",
-      "description": {
-        "name": "uri",
-        "sha256": "889eea21e953187c6099802b7b4cf5219ba8f3518f604a1033064d45b1b8268a",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.0.0"
-    },
     "vector_graphics": {
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics",
-        "sha256": "670f6e07aca990b4a2bcdc08a784193c4ccdd1932620244c3a86bb72a0eac67f",
+        "sha256": "32c3c684e02f9bc0afb0ae0aa653337a2fe022e8ab064bcd7ffda27a74e288e3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.7"
+      "version": "1.1.11+1"
     },
     "vector_graphics_codec": {
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics_codec",
-        "sha256": "7451721781d967db9933b63f5733b1c4533022c0ba373a01bdd79d1a5457f69f",
+        "sha256": "c86987475f162fadff579e7320c7ddda04cd2fdeffbe1129227a85d9ac9e03da",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.7"
+      "version": "1.1.11+1"
     },
     "vector_graphics_compiler": {
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics_compiler",
-        "sha256": "80a13c613c8bde758b1464a1755a7b3a8f2b6cec61fbf0f5a53c94c30f03ba2e",
+        "sha256": "12faff3f73b1741a36ca7e31b292ddeb629af819ca9efe9953b70bd63fc8cd81",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.7"
+      "version": "1.1.11+1"
     },
     "vector_math": {
       "dependency": "transitive",
@@ -1143,11 +1063,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vm_service",
-        "sha256": "c620a6f783fa22436da68e42db7ebbf18b8c44b9a46ab911f666ff09ffd9153f",
+        "sha256": "b3d56ff4341b8f182b96aceb2fa20e3dcb336b9f867bc0eafc0de10f1048e957",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.7.1"
+      "version": "13.0.0"
     },
     "watcher": {
       "dependency": "transitive",
@@ -1163,54 +1083,54 @@
       "dependency": "transitive",
       "description": {
         "name": "web",
-        "sha256": "dc8ccd225a2005c1be616fe02951e2e342092edf968cf0844220383757ef8f10",
+        "sha256": "97da13628db363c635202ad97068d47c5b8aa555808e7a9411963c533b449b27",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.4-beta"
+      "version": "0.5.1"
     },
     "web_socket_channel": {
       "dependency": "transitive",
       "description": {
         "name": "web_socket_channel",
-        "sha256": "d88238e5eac9a42bb43ca4e721edba3c08c6354d4a53063afaa568516217621b",
+        "sha256": "58c6666b342a38816b2e7e50ed0f1e261959630becd4c879c4f26bfa14aa5a42",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.0"
+      "version": "2.4.5"
     },
     "webdriver": {
       "dependency": "transitive",
       "description": {
         "name": "webdriver",
-        "sha256": "3c923e918918feeb90c4c9fdf1fe39220fa4c0e8e2c0fffaded174498ef86c49",
+        "sha256": "003d7da9519e1e5f329422b36c4dcdf18d7d2978d1ba099ea4e45ba490ed845e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.2"
+      "version": "3.0.3"
     },
     "window_manager": {
       "dependency": "transitive",
       "description": {
         "name": "window_manager",
-        "sha256": "6ee795be9124f90660ea9d05e581a466de19e1c89ee74fc4bf528f60c8600edd",
+        "sha256": "b3c895bdf936c77b83c5254bec2e6b3f066710c1f89c38b20b8acc382b525494",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.6"
+      "version": "0.3.8"
     },
     "xml": {
       "dependency": "transitive",
       "description": {
         "name": "xml",
-        "sha256": "5bc72e1e45e941d825fd7468b9b4cc3b9327942649aeb6fc5cdbf135f0a86e84",
+        "sha256": "b015a8ad1c488f66851d762d3090a21c600e479dc75e68328c52774040cf9226",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.0"
+      "version": "6.5.0"
     },
     "yaml": {
-      "dependency": "transitive",
+      "dependency": "direct main",
       "description": {
         "name": "yaml",
         "sha256": "75769501ea3489fca56601ff33454fe45507ea3bfb014161abc3b43ae25989d5",
@@ -1219,25 +1139,15 @@
       "source": "hosted",
       "version": "3.1.2"
     },
-    "yaml_edit": {
-      "dependency": "transitive",
-      "description": {
-        "name": "yaml_edit",
-        "sha256": "1579d4a0340a83cf9e4d580ea51a16329c916973bffd5bd4b45e911b25d46bfd",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "2.1.1"
-    },
     "yaru": {
       "dependency": "direct main",
       "description": {
         "name": "yaru",
-        "sha256": "24047f0de452784840a326874192d26cb5ebd8cf5eac7864086e5bc9272a28db",
+        "sha256": "e9ccb22cb283ecf3f6b21d64dee9764d4abff65a44f48ce21aa13b9eae3e3be5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.0"
+      "version": "1.2.2"
     },
     "yaru_color_generator": {
       "dependency": "transitive",
@@ -1263,51 +1173,51 @@
       "dependency": "direct main",
       "description": {
         "name": "yaru_icons",
-        "sha256": "cbb0b5945f407116fd8a1fbe7265e7ffa0d568249d496343a69cb5c55360bba1",
+        "sha256": "2dff89ee31c2dd888e1ce146f0faef1c8de4ffbc90cb6466aacd55c3a9ad0674",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.1"
+      "version": "2.4.0"
     },
     "yaru_test": {
       "dependency": "transitive",
       "description": {
         "name": "yaru_test",
-        "sha256": "9396269fbe026bb9c398b9d4308c76982090ddeca102e4846bd4ba595333ff0a",
+        "sha256": "a62539bd03465065e4067e1c88472d5789a7215bd4a0873f051abb7896ff0934",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.4"
+      "version": "0.1.5"
     },
     "yaru_widgets": {
       "dependency": "direct main",
       "description": {
         "name": "yaru_widgets",
-        "sha256": "482a71ef5566c6cb4135272f0041bf8a9c35729bf9079b0d304eedfa2fa0cc0c",
+        "sha256": "0bade922090f25eedcc88cdc15b8a6adbaba4e4b56d793e999224b22c95a19d2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.0"
+      "version": "3.6.0"
     },
     "yaru_window": {
       "dependency": "transitive",
       "description": {
         "name": "yaru_window",
-        "sha256": "55c8f039d13aaa1b211a8cf0b7731ae2fdcac9b1be1e0994eb14ad1d17fecaf7",
+        "sha256": "c9d16f78962652ad71aa160ab0a1e2e5924359439303394f980fd00eefc905eb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.3"
+      "version": "0.2.1"
     },
     "yaru_window_linux": {
       "dependency": "transitive",
       "description": {
         "name": "yaru_window_linux",
-        "sha256": "c45606cf75880ae6427bbe176dc5313356f16c876c7013a19aeee782882c40c2",
+        "sha256": "3676355492eba0461f03acf1b7420f7885982d1bffe113fccdca9415fbe39f5d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.3"
+      "version": "0.2.0"
     },
     "yaru_window_manager": {
       "dependency": "transitive",
@@ -1341,7 +1251,7 @@
     }
   },
   "sdks": {
-    "dart": ">=3.1.0-185.0.dev <4.0.0",
-    "flutter": ">=3.10.0"
+    "dart": ">=3.3.0 <4.0.0",
+    "flutter": ">=3.19.0"
   }
 }
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/upgrade-file.patch b/pkgs/os-specific/linux/firmware/firmware-updater/upgrade-file.patch
new file mode 100644
index 0000000000000..2c82fa8bbaf94
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/upgrade-file.patch
@@ -0,0 +1,13 @@
+diff --git a/pubspec.yaml b/pubspec.yaml
+index e9dfa1f..ec9f2f2 100644
+--- a/pubspec.yaml
++++ b/pubspec.yaml
+@@ -10,7 +10,7 @@ dependencies:
+   collection: ^1.17.2
+   dbus: ^0.7.8
+   dio: ^5.3.3
+-  file: ^6.1.4
++  file: ^7.0.0
+   flutter:
+     sdk: flutter
+   flutter_html: ^3.0.0-beta.2
diff --git a/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix b/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
index acbc0d556224c..d89c4a7b140a5 100644
--- a/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fwupd-efi";
-  version = "1.5";
+  version = "1.6";
 
   src = fetchurl {
-    url = "https://people.freedesktop.org/~hughsient/releases/${pname}-${version}.tar.xz";
-    sha256 = "sha256-RdKneTGzYkFt7CY22r9O/w0doQvBzMoayYDoMv7buhI=";
+    url = "https://github.com/fwupd/fwupd-efi/releases/download/${version}/fwupd-efi-${version}.tar.xz";
+    hash = "sha256-r9CAWirQgafK/y71vABM46AUe1OAFejsqWY0FxaxJg4=";
   };
 
   nativeBuildInputs = [
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://fwupd.org/";
-    maintainers = with maintainers; [ amaxine ];
+    maintainers = with maintainers; [ ];
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/fw-ectool/default.nix b/pkgs/os-specific/linux/fw-ectool/default.nix
index 1d23411f3eefc..a73cc1896ecdc 100644
--- a/pkgs/os-specific/linux/fw-ectool/default.nix
+++ b/pkgs/os-specific/linux/fw-ectool/default.nix
@@ -1,43 +1,38 @@
 { stdenv
 , lib
-, fetchFromGitLab
-, cmake
+, fetchFromGitHub
 , pkg-config
-, libusb1
-, libftdi1
+, hostname
 }:
 
 stdenv.mkDerivation {
   pname = "fw-ectool";
-  version = "0-unstable-2023-12-15";
+  version = "unstable-2022-12-03";
 
-  src = fetchFromGitLab {
-    domain = "gitlab.howett.net";
+  src = fetchFromGitHub {
     owner = "DHowett";
-    repo = "ectool";
-    rev = "3ebe7b8b713b2ebfe2ce92d48fd8d044276b2879";
-    hash = "sha256-s6PrFPAL+XJAENqLw5oJqFmAf11tHOJ8h3F5l3pOlZ4=";
+    repo = "fw-ectool";
+    rev = "54c140399bbc3e6a3dce6c9f842727c4128367be";
+    hash = "sha256-2teJFz4zcA+USpbVPXMEIHLdmMLem8ik7YrmrSxr/n0=";
   };
 
   nativeBuildInputs = [
-    cmake
     pkg-config
+    hostname
   ];
 
-  buildInputs = [
-    libusb1
-    libftdi1
-  ];
+  buildPhase = ''
+    patchShebangs util
+    make out=out utils
+  '';
 
   installPhase = ''
-    runHook preInstall
-    install -Dm555 src/ectool "$out/bin/ectool"
-    runHook postInstall
+    install -D out/util/ectool $out/bin/ectool
   '';
 
   meta = with lib; {
     description = "EC-Tool adjusted for usage with framework embedded controller";
-    homepage = "https://gitlab.howett.net/DHowett/ectool";
+    homepage = "https://github.com/DHowett/framework-ec";
     license = licenses.bsd3;
     maintainers = [ maintainers.mkg20001 ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/google-authenticator/default.nix b/pkgs/os-specific/linux/google-authenticator/default.nix
index 02ca3d30d238c..11791a664c8bb 100644
--- a/pkgs/os-specific/linux/google-authenticator/default.nix
+++ b/pkgs/os-specific/linux/google-authenticator/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "google-authenticator-libpam";
-  version = "1.09";
+  version = "1.10";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "google-authenticator-libpam";
     rev = version;
-    hash = "sha256-DS0h6FWMNKnSSj039bH6iyWrERa5M7LBSkbyig6pyxY=";
+    hash = "sha256-KEfwQeJIuRF+S3gPn+maDb8Fu0FRXLs2/Nlbjj2d3AE=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/os-specific/linux/guvcview/default.nix b/pkgs/os-specific/linux/guvcview/default.nix
index e082038730111..d274c375fb42c 100644
--- a/pkgs/os-specific/linux/guvcview/default.nix
+++ b/pkgs/os-specific/linux/guvcview/default.nix
@@ -21,7 +21,7 @@
 # can be turned off if used as a library
 , useGtk ? true
 , gtk3 ? null
-, wrapGAppsHook ? null
+, wrapGAppsHook3 ? null
 }:
 
 assert pulseaudioSupport -> libpulseaudio != null;
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     intltool
     pkg-config
   ]
-    ++ lib.optionals (useGtk) [ wrapGAppsHook ]
+    ++ lib.optionals (useGtk) [ wrapGAppsHook3 ]
     ++ lib.optionals (useQt) [ wrapQtAppsHook ]
   ;
 
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index f7303b182ec74..83519d7f2a7ac 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.380";
+  version = "0.381";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-Ioa0tUiwgOZO3qrtwAr9A/yGfYTBk83OON8Sr47J9Mg=";
+    hash = "sha256-FD1p4qyO+ZsBdMXRa9u6CpO07RewWH8OxULLxcYAsyk=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index f4a250d4a84c8..e686e06804197 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "24.09.28717.12";
+  version = "24.13.29138.7";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    hash = "sha256-RzXV6icenMcQxmOfKA8Tpb6FigLXz3ZyoL0n16+jFRc=";
+    hash = "sha256-AMIuA1AMrSX0xpdGSfye8iUJTk5s9HDiRy9Yy3kZss8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index e2e4384908a8c..67914b0c4e276 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl
 , buildPackages, bison, flex, pkg-config
-, db, iptables, libelf, libmnl
+, db, iptables, elfutils, libmnl
 , gitUpdater
 }:
 
@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
+  configureFlags = [
+    "--color" "auto"
+  ];
+
   makeFlags = [
     "PREFIX=$(out)"
     "SBINDIR=$(out)/sbin"
@@ -46,7 +50,7 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ]; # netem requires $HOSTCC
   nativeBuildInputs = [ bison flex pkg-config ];
-  buildInputs = [ db iptables libelf libmnl ];
+  buildInputs = [ db iptables elfutils libmnl ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index a15d21f2c3a1b..5c1d153b83fc9 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "2.16";
+  version = "2.17";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    hash = "sha256-YWtiI2HkGyIdUeBXerQtN5UvgaMaUs9eoG88ZUQRrDg=";
+    hash = "sha256-o/Q8vUtB4Yiz1x+/6+8LUKUQNtiAmwcdh++/tTUN4mM=";
   };
 
   outputs = [ "out" "man" "doc" ]
@@ -81,9 +81,9 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     substituteInPlace $out/share/dbus-1/system-services/net.connman.ead.service \
-      --replace /bin/false ${coreutils}/bin/false
+      --replace-fail /bin/false ${coreutils}/bin/false
     substituteInPlace $out/share/dbus-1/system-services/net.connman.iwd.service \
-      --replace /bin/false ${coreutils}/bin/false
+      --replace-fail /bin/false ${coreutils}/bin/false
   '';
 
   enableParallelBuilding = true;
@@ -98,6 +98,6 @@ stdenv.mkDerivation rec {
     description = "Wireless daemon for Linux";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ dtzWill fpletz amaxine ];
+    maintainers = with maintainers; [ dtzWill fpletz ];
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 77c6ee031956d..37c138402d006 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -12,9 +12,13 @@
 , rustc
 , rustPlatform
 , rust-bindgen
+# testing
+, emptyFile
+, nixos
 , nixosTests
 }@args':
 
+let overridableKernel =
 lib.makeOverridable ({ # The kernel source tarball.
   src
 
@@ -211,11 +215,15 @@ let
   }; # end of configfile derivation
 
   kernel = (callPackage ./manual-config.nix { inherit lib stdenv buildPackages; }) (basicArgs // {
-    inherit kernelPatches randstructSeed extraMakeFlags extraMeta configfile;
+    inherit kernelPatches randstructSeed extraMakeFlags extraMeta configfile modDirVersion;
     pos = builtins.unsafeGetAttrPos "version" args;
 
-    config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; } // lib.optionalAttrs withRust { CONFIG_RUST = "y"; };
-  } // lib.optionalAttrs (modDirVersion != null) { inherit modDirVersion; });
+    config = {
+      CONFIG_MODULES = "y";
+      CONFIG_FW_LOADER = "m";
+      CONFIG_RUST = if withRust then "y" else "n";
+    };
+  });
 
 in
 kernel.overrideAttrs (finalAttrs: previousAttrs: {
@@ -241,7 +249,41 @@ kernel.overrideAttrs (finalAttrs: previousAttrs: {
             + toString (lib.attrNames (lib.toFunction args { }))
           ) overridableKernel;
       };
-    in [ (nixosTests.kernel-generic.passthru.testsForKernel overridableKernel) ] ++ kernelTests;
+      /* Certain arguments must be evaluated lazily; so that only the output(s) depend on them.
+         Original reproducer / simplified use case:
+       */
+      versionDoesNotDependOnPatchesEtcNixOS =
+        builtins.seq
+          (nixos ({ config, pkgs, ... }: {
+              boot.kernelPatches = [
+                (builtins.seq config.boot.kernelPackages.kernel.version { patch = pkgs.emptyFile; })
+              ];
+          })).config.boot.kernelPackages.kernel.outPath
+          emptyFile;
+      versionDoesNotDependOnPatchesEtc =
+        builtins.seq
+          (import ./generic.nix args' (args // (
+          let explain = attrName:
+            ''
+              The ${attrName} attribute must be able to access the kernel.version attribute without an infinite recursion.
+              That means that the kernel attrset (attrNames) and the kernel.version attribute must not depend on the ${attrName} argument.
+              The fact that this exception is raised shows that such a dependency does exist.
+              This is a problem for the configurability of ${attrName} in version-aware logic such as that in NixOS.
+              Strictness can creep in through optional attributes, or assertions and warnings that run as part of code that shouldn't access what is checked.
+            '';
+          in {
+            kernelPatches = throw (explain "kernelPatches");
+            structuredExtraConfig = throw (explain "structuredExtraConfig");
+            modDirVersion = throw (explain "modDirVersion");
+          }))).version
+          emptyFile;
+    in [
+      (nixosTests.kernel-generic.passthru.testsForKernel overridableKernel)
+      versionDoesNotDependOnPatchesEtc
+      # Disabled by default, because the infinite recursion is hard to understand. The other test's error is better and produces a shorter trace.
+      # versionDoesNotDependOnPatchesEtcNixOS
+    ] ++ kernelTests;
   };
 
-}))
+}));
+in overridableKernel
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 50e6512b15e69..b69c0f9c6003d 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,34 +1,34 @@
 {
     "testing": {
-        "version": "6.9-rc4",
-        "hash": "sha256:11wpak03nv9cg00jiyfrk21p7mzka553ih2c2dxr0ridig6mj8b3"
+        "version": "6.9-rc6",
+        "hash": "sha256:075l5vhk8zmwln4jks7gr5n5k67s65qvs07l2rpbc7a75fdp6c14"
     },
     "6.1": {
-        "version": "6.1.87",
-        "hash": "sha256:092iv5w5d6kwgiyzs7zajmhdxc1w03sinvvr1dwy9bp8f9mg2ypw"
+        "version": "6.1.90",
+        "hash": "sha256:07cfg0chssvpc4mqls3aln6s4lqjp6k4x2n63wndmkjgfqpdg8w3"
     },
     "5.15": {
-        "version": "5.15.156",
-        "hash": "sha256:0y3p7sqr8hsn0v9ybqlcmn1z150zc13yckgrymb10sck9k8na14z"
+        "version": "5.15.158",
+        "hash": "sha256:1inmdpif3qf1blmvjj4i7y42bylvhv0wyj3b0apq12zxlj1iq1zr"
     },
     "5.10": {
-        "version": "5.10.215",
-        "hash": "sha256:1af6h86flx96pszg006agpak2f9dkk2jqaazfykd7aafqdcs3747"
+        "version": "5.10.216",
+        "hash": "sha256:0lg1zfb9y4ps86q85mlnyalb3s90zix003z62jb9bw139f65h473"
     },
     "5.4": {
-        "version": "5.4.274",
-        "hash": "sha256:1m4yyyv48mfkzhqms88dv1jf39zsfp88az5zpqynmm1wlhhv9iza"
+        "version": "5.4.275",
+        "hash": "sha256:0k1hyknx854k8z27j4rq1gcp8l0xc0bspmrhc41a033gjilb1lns"
     },
     "4.19": {
-        "version": "4.19.312",
-        "hash": "sha256:0jppa4p73pssd7m3jpc7i6rgnj9gawjcgk4wmqyy87ijzrgzm553"
+        "version": "4.19.313",
+        "hash": "sha256:1j1r4mrdh1ray468jr5i8d2afiswb653bhq0ck8bcdw4rwp5w558"
     },
     "6.6": {
-        "version": "6.6.28",
-        "hash": "sha256:151kdpp25fcl5qki138jxl90h9iyk5rk0kp2xamadnz72gnid1w1"
+        "version": "6.6.30",
+        "hash": "sha256:1ilwmgpgvddwkd9nx5999cb6z18scjyq7jklid26k1hg7f35nsmn"
     },
     "6.8": {
-        "version": "6.8.7",
-        "hash": "sha256:1bigq9my88d9xh647hgsy8gzval7p06hhacpxaqb71sfmwgil799"
+        "version": "6.8.9",
+        "hash": "sha256:1dn9bgmf03bdfbmgq98d043702g808rjikxs2i9yia57iqiz21gr"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 92f71e6496ab7..3344808ca2789 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19536";
-    sha256 = "1lwg4340nga0sn5jcsqrmqskf2cf4vvjhkbdl0h54bj3lcnbxaw4";
+    rev = "19546";
+    sha256 = "1yyj7pbfs02fki1rdxfj9gcrxdrl26igisy4fji7czcc9xbw03qm";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 337594115fa6f..b013c7f1bf181 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.213-rt105"; # updated by ./update-rt.sh
+  version = "5.10.215-rt107"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "105df7w6m5a3fngi6ajqs5qblaq4lbxsgcppllrk7v1r68i31kw4";
+    sha256 = "1af6h86flx96pszg006agpak2f9dkk2jqaazfykd7aafqdcs3747";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1q5kz3mfvwb4fd5i2mbklsa6gifb8g3wbq0wi2478q097dvmb6gi";
+      sha256 = "0lnnpnfmypafzfzhcmaxqqc18nna4fr236v6hrcyabnxmxam79xj";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 5b222c4b45eff..cab04ad0c7d80 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -26,7 +26,7 @@ in lib.makeOverridable ({
   extraMakeFlags ? [],
   # The name of the kernel module directory
   # Needs to be X.Y.Z[-extra], so pad with zeros if needed.
-  modDirVersion ? lib.versions.pad 3 version,
+  modDirVersion ? null /* derive from version */,
   # The kernel source (tarball, git checkout, etc.)
   src,
   # a list of { name=..., patch=..., extraConfig=...} patches
@@ -54,6 +54,13 @@ in lib.makeOverridable ({
 }:
 
 let
+  # Provide defaults. Note that we support `null` so that callers don't need to use optionalAttrs,
+  # which can lead to unnecessary strictness and infinite recursions.
+  modDirVersion_ = if modDirVersion == null then lib.versions.pad 3 version else modDirVersion;
+in
+let
+  # Shadow the un-defaulted parameter; don't want null.
+  modDirVersion = modDirVersion_;
   inherit (lib)
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index bce7d7d0dcb3b..20100774395e1 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -79,4 +79,18 @@
       hash = "sha256-q3iNBo8t4b1Rn5k5lau2myqOAqdA/9V9A+ok2jGkLdY=";
     };
   };
+
+  rust_1_77-6_8 = {
+    name = "rust-1.77.patch";
+    patch = fetchurl {
+      name = "rust-1.77.patch";
+      url = "https://lore.kernel.org/rust-for-linux/20240217002717.57507-1-ojeda@kernel.org/raw";
+      hash = "sha256-0KW9nHpJeMSDssCPXWZbrN8kxq5bA434t+XuPfwslUc=";
+    };
+  };
+
+  rust_1_77-6_9 = {
+    name = "rust-1.77.patch";
+    patch = ./rust-1.77.patch;
+  };
 }
diff --git a/pkgs/os-specific/linux/kernel/rust-1.77.patch b/pkgs/os-specific/linux/kernel/rust-1.77.patch
new file mode 100644
index 0000000000000..8bd0a5e337154
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/rust-1.77.patch
@@ -0,0 +1,792 @@
+From d69265b7d756931b2e763a3262f22ba4100895a0 Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Sat, 17 Feb 2024 01:27:17 +0100
+Subject: [PATCH] rust: upgrade to Rust 1.77.0
+
+This is the next upgrade to the Rust toolchain, from 1.76.0 to 1.77.0
+(i.e. the latest) [1].
+
+See the upgrade policy [2] and the comments on the first upgrade in
+commit 3ed03f4da06e ("rust: upgrade to Rust 1.68.2").
+
+The `offset_of` feature (single-field `offset_of!`) that we were using
+got stabilized in Rust 1.77.0 [3].
+
+Therefore, now the only unstable features allowed to be used outside the
+`kernel` crate is `new_uninit`, though other code to be upstreamed may
+increase the list.
+
+Please see [4] for details.
+
+Rust 1.77.0 merged the `unused_tuple_struct_fields` lint into `dead_code`,
+thus upgrading it from `allow` to `warn` [5]. In turn, this makes `rustc`
+complain about the `ThisModule`'s pointer field being never read. Thus
+locally `allow` it for the moment, since we will have users later on
+(e.g. Binder needs a `as_ptr` method [6]).
+
+Rust 1.77.0 introduces the `--check-cfg` feature [7], for which there
+is a Call for Testing going on [8]. We were requested to test it and
+we found it useful [9] -- we will likely enable it in the future.
+
+The vast majority of changes are due to our `alloc` fork being upgraded
+at once.
+
+There are two kinds of changes to be aware of: the ones coming from
+upstream, which we should follow as closely as possible, and the updates
+needed in our added fallible APIs to keep them matching the newer
+infallible APIs coming from upstream.
+
+Instead of taking a look at the diff of this patch, an alternative
+approach is reviewing a diff of the changes between upstream `alloc` and
+the kernel's. This allows to easily inspect the kernel additions only,
+especially to check if the fallible methods we already have still match
+the infallible ones in the new version coming from upstream.
+
+Another approach is reviewing the changes introduced in the additions in
+the kernel fork between the two versions. This is useful to spot
+potentially unintended changes to our additions.
+
+To apply these approaches, one may follow steps similar to the following
+to generate a pair of patches that show the differences between upstream
+Rust and the kernel (for the subset of `alloc` we use) before and after
+applying this patch:
+
+    # Get the difference with respect to the old version.
+    git -C rust checkout $(linux/scripts/min-tool-version.sh rustc)
+    git -C linux ls-tree -r --name-only HEAD -- rust/alloc |
+        cut -d/ -f3- |
+        grep -Fv README.md |
+        xargs -IPATH cp rust/library/alloc/src/PATH linux/rust/alloc/PATH
+    git -C linux diff --patch-with-stat --summary -R > old.patch
+    git -C linux restore rust/alloc
+
+    # Apply this patch.
+    git -C linux am rust-upgrade.patch
+
+    # Get the difference with respect to the new version.
+    git -C rust checkout $(linux/scripts/min-tool-version.sh rustc)
+    git -C linux ls-tree -r --name-only HEAD -- rust/alloc |
+        cut -d/ -f3- |
+        grep -Fv README.md |
+        xargs -IPATH cp rust/library/alloc/src/PATH linux/rust/alloc/PATH
+    git -C linux diff --patch-with-stat --summary -R > new.patch
+    git -C linux restore rust/alloc
+
+Now one may check the `new.patch` to take a look at the additions (first
+approach) or at the difference between those two patches (second
+approach). For the latter, a side-by-side tool is recommended.
+
+Link: https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1770-2024-03-21 [1]
+Link: https://rust-for-linux.com/rust-version-policy [2]
+Link: https://github.com/rust-lang/rust/pull/118799 [3]
+Link: https://github.com/Rust-for-Linux/linux/issues/2 [4]
+Link: https://github.com/rust-lang/rust/pull/118297 [5]
+Link: https://lore.kernel.org/rust-for-linux/20231101-rust-binder-v1-2-08ba9197f637@google.com/#Z31rust:kernel:lib.rs [6]
+Link: https://doc.rust-lang.org/nightly/unstable-book/compiler-flags/check-cfg.html [7]
+Link: https://github.com/rust-lang/rfcs/pull/3013#issuecomment-1936648479 [8]
+Link: https://github.com/rust-lang/rust/issues/82450#issuecomment-1947462977 [9]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Link: https://lore.kernel.org/r/20240217002717.57507-1-ojeda@kernel.org
+Link: https://github.com/Rust-for-Linux/linux/commit/d69265b7d756931b2e763a3262f22ba4100895a0
+Signed-off-by: Alyssa Ross <hi@alyssa.is>
+---
+ Documentation/process/changes.rst |   2 +-
+ rust/alloc/alloc.rs               |   6 +-
+ rust/alloc/boxed.rs               |   4 +-
+ rust/alloc/lib.rs                 |   7 +-
+ rust/alloc/raw_vec.rs             |  13 ++--
+ rust/alloc/slice.rs               |   4 +-
+ rust/alloc/vec/into_iter.rs       | 108 +++++++++++++++++++-----------
+ rust/alloc/vec/mod.rs             | 101 +++++++++++++++++++---------
+ rust/kernel/lib.rs                |   3 +-
+ scripts/Makefile.build            |   2 +-
+ scripts/min-tool-version.sh       |   2 +-
+ 11 files changed, 161 insertions(+), 91 deletions(-)
+
+diff --git a/Documentation/process/changes.rst b/Documentation/process/changes.rst
+index 7ef8de58f7f892..879ee628893ae1 100644
+--- a/Documentation/process/changes.rst
++++ b/Documentation/process/changes.rst
+@@ -31,7 +31,7 @@ you probably needn't concern yourself with pcmciautils.
+ ====================== ===============  ========================================
+ GNU C                  5.1              gcc --version
+ Clang/LLVM (optional)  13.0.1           clang --version
+-Rust (optional)        1.76.0           rustc --version
++Rust (optional)        1.77.0           rustc --version
+ bindgen (optional)     0.65.1           bindgen --version
+ GNU make               3.82             make --version
+ bash                   4.2              bash --version
+diff --git a/rust/alloc/alloc.rs b/rust/alloc/alloc.rs
+index abb791cc23715a..b1204f87227b23 100644
+--- a/rust/alloc/alloc.rs
++++ b/rust/alloc/alloc.rs
+@@ -5,7 +5,7 @@
+ #![stable(feature = "alloc_module", since = "1.28.0")]
+ 
+ #[cfg(not(test))]
+-use core::intrinsics;
++use core::hint;
+ 
+ #[cfg(not(test))]
+ use core::ptr::{self, NonNull};
+@@ -210,7 +210,7 @@ impl Global {
+                 let new_size = new_layout.size();
+ 
+                 // `realloc` probably checks for `new_size >= old_layout.size()` or something similar.
+-                intrinsics::assume(new_size >= old_layout.size());
++                hint::assert_unchecked(new_size >= old_layout.size());
+ 
+                 let raw_ptr = realloc(ptr.as_ptr(), old_layout, new_size);
+                 let ptr = NonNull::new(raw_ptr).ok_or(AllocError)?;
+@@ -301,7 +301,7 @@ unsafe impl Allocator for Global {
+             // SAFETY: `new_size` is non-zero. Other conditions must be upheld by the caller
+             new_size if old_layout.align() == new_layout.align() => unsafe {
+                 // `realloc` probably checks for `new_size <= old_layout.size()` or something similar.
+-                intrinsics::assume(new_size <= old_layout.size());
++                hint::assert_unchecked(new_size <= old_layout.size());
+ 
+                 let raw_ptr = realloc(ptr.as_ptr(), old_layout, new_size);
+                 let ptr = NonNull::new(raw_ptr).ok_or(AllocError)?;
+diff --git a/rust/alloc/boxed.rs b/rust/alloc/boxed.rs
+index c93a22a5c97f14..5fc39dfeb8e7bf 100644
+--- a/rust/alloc/boxed.rs
++++ b/rust/alloc/boxed.rs
+@@ -26,6 +26,7 @@
+ //! Creating a recursive data structure:
+ //!
+ //! ```
++//! ##[allow(dead_code)]
+ //! #[derive(Debug)]
+ //! enum List<T> {
+ //!     Cons(T, Box<List<T>>),
+@@ -194,8 +195,7 @@ mod thin;
+ #[fundamental]
+ #[stable(feature = "rust1", since = "1.0.0")]
+ // The declaration of the `Box` struct must be kept in sync with the
+-// `alloc::alloc::box_free` function or ICEs will happen. See the comment
+-// on `box_free` for more details.
++// compiler or ICEs will happen.
+ pub struct Box<
+     T: ?Sized,
+     #[unstable(feature = "allocator_api", issue = "32838")] A: Allocator = Global,
+diff --git a/rust/alloc/lib.rs b/rust/alloc/lib.rs
+index 36f79c07559338..39afd55ec0749e 100644
+--- a/rust/alloc/lib.rs
++++ b/rust/alloc/lib.rs
+@@ -105,7 +105,6 @@
+ #![feature(allocator_api)]
+ #![feature(array_chunks)]
+ #![feature(array_into_iter_constructors)]
+-#![feature(array_methods)]
+ #![feature(array_windows)]
+ #![feature(ascii_char)]
+ #![feature(assert_matches)]
+@@ -122,7 +121,6 @@
+ #![feature(const_size_of_val)]
+ #![feature(const_waker)]
+ #![feature(core_intrinsics)]
+-#![feature(core_panic)]
+ #![feature(deprecated_suggestion)]
+ #![feature(dispatch_from_dyn)]
+ #![feature(error_generic_member_access)]
+@@ -132,6 +130,7 @@
+ #![feature(fmt_internals)]
+ #![feature(fn_traits)]
+ #![feature(hasher_prefixfree_extras)]
++#![feature(hint_assert_unchecked)]
+ #![feature(inline_const)]
+ #![feature(inplace_iteration)]
+ #![feature(iter_advance_by)]
+@@ -141,6 +140,8 @@
+ #![feature(maybe_uninit_slice)]
+ #![feature(maybe_uninit_uninit_array)]
+ #![feature(maybe_uninit_uninit_array_transpose)]
++#![feature(non_null_convenience)]
++#![feature(panic_internals)]
+ #![feature(pattern)]
+ #![feature(ptr_internals)]
+ #![feature(ptr_metadata)]
+@@ -149,7 +150,6 @@
+ #![feature(set_ptr_value)]
+ #![feature(sized_type_properties)]
+ #![feature(slice_from_ptr_range)]
+-#![feature(slice_group_by)]
+ #![feature(slice_ptr_get)]
+ #![feature(slice_ptr_len)]
+ #![feature(slice_range)]
+@@ -182,6 +182,7 @@
+ #![feature(const_ptr_write)]
+ #![feature(const_trait_impl)]
+ #![feature(const_try)]
++#![feature(decl_macro)]
+ #![feature(dropck_eyepatch)]
+ #![feature(exclusive_range_pattern)]
+ #![feature(fundamental)]
+diff --git a/rust/alloc/raw_vec.rs b/rust/alloc/raw_vec.rs
+index 98b6abf30af6e4..1839d1c8ee7a04 100644
+--- a/rust/alloc/raw_vec.rs
++++ b/rust/alloc/raw_vec.rs
+@@ -4,7 +4,7 @@
+ 
+ use core::alloc::LayoutError;
+ use core::cmp;
+-use core::intrinsics;
++use core::hint;
+ use core::mem::{self, ManuallyDrop, MaybeUninit, SizedTypeProperties};
+ use core::ptr::{self, NonNull, Unique};
+ use core::slice;
+@@ -317,7 +317,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Aborts
+     ///
+@@ -358,7 +358,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+         }
+         unsafe {
+             // Inform the optimizer that the reservation has succeeded or wasn't needed
+-            core::intrinsics::assume(!self.needs_to_grow(len, additional));
++            hint::assert_unchecked(!self.needs_to_grow(len, additional));
+         }
+         Ok(())
+     }
+@@ -381,7 +381,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Aborts
+     ///
+@@ -402,7 +402,7 @@ impl<T, A: Allocator> RawVec<T, A> {
+         }
+         unsafe {
+             // Inform the optimizer that the reservation has succeeded or wasn't needed
+-            core::intrinsics::assume(!self.needs_to_grow(len, additional));
++            hint::assert_unchecked(!self.needs_to_grow(len, additional));
+         }
+         Ok(())
+     }
+@@ -553,7 +553,7 @@ where
+         debug_assert_eq!(old_layout.align(), new_layout.align());
+         unsafe {
+             // The allocator checks for alignment equality
+-            intrinsics::assume(old_layout.align() == new_layout.align());
++            hint::assert_unchecked(old_layout.align() == new_layout.align());
+             alloc.grow(ptr, old_layout, new_layout)
+         }
+     } else {
+@@ -591,7 +591,6 @@ fn handle_reserve(result: Result<(), TryReserveError>) {
+ // `> isize::MAX` bytes will surely fail. On 32-bit and 16-bit we need to add
+ // an extra guard for this in case we're running on a platform which can use
+ // all 4GB in user-space, e.g., PAE or x32.
+-
+ #[inline]
+ fn alloc_guard(alloc_size: usize) -> Result<(), TryReserveError> {
+     if usize::BITS < 64 && alloc_size > isize::MAX as usize {
+diff --git a/rust/alloc/slice.rs b/rust/alloc/slice.rs
+index 1181836da5f462..a36b072c95195f 100644
+--- a/rust/alloc/slice.rs
++++ b/rust/alloc/slice.rs
+@@ -53,14 +53,14 @@ pub use core::slice::{from_mut, from_ref};
+ pub use core::slice::{from_mut_ptr_range, from_ptr_range};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{from_raw_parts, from_raw_parts_mut};
++#[stable(feature = "slice_group_by", since = "1.77.0")]
++pub use core::slice::{ChunkBy, ChunkByMut};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{Chunks, Windows};
+ #[stable(feature = "chunks_exact", since = "1.31.0")]
+ pub use core::slice::{ChunksExact, ChunksExactMut};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{ChunksMut, Split, SplitMut};
+-#[unstable(feature = "slice_group_by", issue = "80552")]
+-pub use core::slice::{GroupBy, GroupByMut};
+ #[stable(feature = "rust1", since = "1.0.0")]
+ pub use core::slice::{Iter, IterMut};
+ #[stable(feature = "rchunks", since = "1.31.0")]
+diff --git a/rust/alloc/vec/into_iter.rs b/rust/alloc/vec/into_iter.rs
+index 136bfe94af6c83..0f11744c44b34c 100644
+--- a/rust/alloc/vec/into_iter.rs
++++ b/rust/alloc/vec/into_iter.rs
+@@ -20,6 +20,17 @@ use core::ops::Deref;
+ use core::ptr::{self, NonNull};
+ use core::slice::{self};
+ 
++macro non_null {
++    (mut $place:expr, $t:ident) => {{
++        #![allow(unused_unsafe)] // we're sometimes used within an unsafe block
++        unsafe { &mut *(ptr::addr_of_mut!($place) as *mut NonNull<$t>) }
++    }},
++    ($place:expr, $t:ident) => {{
++        #![allow(unused_unsafe)] // we're sometimes used within an unsafe block
++        unsafe { *(ptr::addr_of!($place) as *const NonNull<$t>) }
++    }},
++}
++
+ /// An iterator that moves out of a vector.
+ ///
+ /// This `struct` is created by the `into_iter` method on [`Vec`](super::Vec)
+@@ -43,10 +54,12 @@ pub struct IntoIter<
+     // the drop impl reconstructs a RawVec from buf, cap and alloc
+     // to avoid dropping the allocator twice we need to wrap it into ManuallyDrop
+     pub(super) alloc: ManuallyDrop<A>,
+-    pub(super) ptr: *const T,
+-    pub(super) end: *const T, // If T is a ZST, this is actually ptr+len. This encoding is picked so that
+-                              // ptr == end is a quick test for the Iterator being empty, that works
+-                              // for both ZST and non-ZST.
++    pub(super) ptr: NonNull<T>,
++    /// If T is a ZST, this is actually ptr+len. This encoding is picked so that
++    /// ptr == end is a quick test for the Iterator being empty, that works
++    /// for both ZST and non-ZST.
++    /// For non-ZSTs the pointer is treated as `NonNull<T>`
++    pub(super) end: *const T,
+ }
+ 
+ #[stable(feature = "vec_intoiter_debug", since = "1.13.0")]
+@@ -70,7 +83,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+     /// ```
+     #[stable(feature = "vec_into_iter_as_slice", since = "1.15.0")]
+     pub fn as_slice(&self) -> &[T] {
+-        unsafe { slice::from_raw_parts(self.ptr, self.len()) }
++        unsafe { slice::from_raw_parts(self.ptr.as_ptr(), self.len()) }
+     }
+ 
+     /// Returns the remaining items of this iterator as a mutable slice.
+@@ -99,7 +112,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+     }
+ 
+     fn as_raw_mut_slice(&mut self) -> *mut [T] {
+-        ptr::slice_from_raw_parts_mut(self.ptr as *mut T, self.len())
++        ptr::slice_from_raw_parts_mut(self.ptr.as_ptr(), self.len())
+     }
+ 
+     /// Drops remaining elements and relinquishes the backing allocation.
+@@ -126,7 +139,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+         // this creates less assembly
+         self.cap = 0;
+         self.buf = unsafe { NonNull::new_unchecked(RawVec::NEW.ptr()) };
+-        self.ptr = self.buf.as_ptr();
++        self.ptr = self.buf;
+         self.end = self.buf.as_ptr();
+ 
+         // Dropping the remaining elements can panic, so this needs to be
+@@ -138,9 +151,9 @@ impl<T, A: Allocator> IntoIter<T, A> {
+ 
+     /// Forgets to Drop the remaining elements while still allowing the backing allocation to be freed.
+     pub(crate) fn forget_remaining_elements(&mut self) {
+-        // For th ZST case, it is crucial that we mutate `end` here, not `ptr`.
++        // For the ZST case, it is crucial that we mutate `end` here, not `ptr`.
+         // `ptr` must stay aligned, while `end` may be unaligned.
+-        self.end = self.ptr;
++        self.end = self.ptr.as_ptr();
+     }
+ 
+     #[cfg(not(no_global_oom_handling))]
+@@ -162,7 +175,7 @@ impl<T, A: Allocator> IntoIter<T, A> {
+                 // say that they're all at the beginning of the "allocation".
+                 0..this.len()
+             } else {
+-                this.ptr.sub_ptr(buf)..this.end.sub_ptr(buf)
++                this.ptr.sub_ptr(this.buf)..this.end.sub_ptr(buf)
+             };
+             let cap = this.cap;
+             let alloc = ManuallyDrop::take(&mut this.alloc);
+@@ -189,29 +202,35 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+ 
+     #[inline]
+     fn next(&mut self) -> Option<T> {
+-        if self.ptr == self.end {
+-            None
+-        } else if T::IS_ZST {
+-            // `ptr` has to stay where it is to remain aligned, so we reduce the length by 1 by
+-            // reducing the `end`.
+-            self.end = self.end.wrapping_byte_sub(1);
+-
+-            // Make up a value of this ZST.
+-            Some(unsafe { mem::zeroed() })
++        if T::IS_ZST {
++            if self.ptr.as_ptr() == self.end as *mut _ {
++                None
++            } else {
++                // `ptr` has to stay where it is to remain aligned, so we reduce the length by 1 by
++                // reducing the `end`.
++                self.end = self.end.wrapping_byte_sub(1);
++
++                // Make up a value of this ZST.
++                Some(unsafe { mem::zeroed() })
++            }
+         } else {
+-            let old = self.ptr;
+-            self.ptr = unsafe { self.ptr.add(1) };
++            if self.ptr == non_null!(self.end, T) {
++                None
++            } else {
++                let old = self.ptr;
++                self.ptr = unsafe { old.add(1) };
+ 
+-            Some(unsafe { ptr::read(old) })
++                Some(unsafe { ptr::read(old.as_ptr()) })
++            }
+         }
+     }
+ 
+     #[inline]
+     fn size_hint(&self) -> (usize, Option<usize>) {
+         let exact = if T::IS_ZST {
+-            self.end.addr().wrapping_sub(self.ptr.addr())
++            self.end.addr().wrapping_sub(self.ptr.as_ptr().addr())
+         } else {
+-            unsafe { self.end.sub_ptr(self.ptr) }
++            unsafe { non_null!(self.end, T).sub_ptr(self.ptr) }
+         };
+         (exact, Some(exact))
+     }
+@@ -219,7 +238,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+     #[inline]
+     fn advance_by(&mut self, n: usize) -> Result<(), NonZeroUsize> {
+         let step_size = self.len().min(n);
+-        let to_drop = ptr::slice_from_raw_parts_mut(self.ptr as *mut T, step_size);
++        let to_drop = ptr::slice_from_raw_parts_mut(self.ptr.as_ptr(), step_size);
+         if T::IS_ZST {
+             // See `next` for why we sub `end` here.
+             self.end = self.end.wrapping_byte_sub(step_size);
+@@ -261,7 +280,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+             // Safety: `len` indicates that this many elements are available and we just checked that
+             // it fits into the array.
+             unsafe {
+-                ptr::copy_nonoverlapping(self.ptr, raw_ary.as_mut_ptr() as *mut T, len);
++                ptr::copy_nonoverlapping(self.ptr.as_ptr(), raw_ary.as_mut_ptr() as *mut T, len);
+                 self.forget_remaining_elements();
+                 return Err(array::IntoIter::new_unchecked(raw_ary, 0..len));
+             }
+@@ -270,7 +289,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+         // Safety: `len` is larger than the array size. Copy a fixed amount here to fully initialize
+         // the array.
+         return unsafe {
+-            ptr::copy_nonoverlapping(self.ptr, raw_ary.as_mut_ptr() as *mut T, N);
++            ptr::copy_nonoverlapping(self.ptr.as_ptr(), raw_ary.as_mut_ptr() as *mut T, N);
+             self.ptr = self.ptr.add(N);
+             Ok(raw_ary.transpose().assume_init())
+         };
+@@ -288,7 +307,7 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+         // Also note the implementation of `Self: TrustedRandomAccess` requires
+         // that `T: Copy` so reading elements from the buffer doesn't invalidate
+         // them for `Drop`.
+-        unsafe { if T::IS_ZST { mem::zeroed() } else { ptr::read(self.ptr.add(i)) } }
++        unsafe { if T::IS_ZST { mem::zeroed() } else { self.ptr.add(i).read() } }
+     }
+ }
+ 
+@@ -296,18 +315,25 @@ impl<T, A: Allocator> Iterator for IntoIter<T, A> {
+ impl<T, A: Allocator> DoubleEndedIterator for IntoIter<T, A> {
+     #[inline]
+     fn next_back(&mut self) -> Option<T> {
+-        if self.end == self.ptr {
+-            None
+-        } else if T::IS_ZST {
+-            // See above for why 'ptr.offset' isn't used
+-            self.end = self.end.wrapping_byte_sub(1);
+-
+-            // Make up a value of this ZST.
+-            Some(unsafe { mem::zeroed() })
++        if T::IS_ZST {
++            if self.end as *mut _ == self.ptr.as_ptr() {
++                None
++            } else {
++                // See above for why 'ptr.offset' isn't used
++                self.end = self.end.wrapping_byte_sub(1);
++
++                // Make up a value of this ZST.
++                Some(unsafe { mem::zeroed() })
++            }
+         } else {
+-            self.end = unsafe { self.end.sub(1) };
++            if non_null!(self.end, T) == self.ptr {
++                None
++            } else {
++                let new_end = unsafe { non_null!(self.end, T).sub(1) };
++                *non_null!(mut self.end, T) = new_end;
+ 
+-            Some(unsafe { ptr::read(self.end) })
++                Some(unsafe { ptr::read(new_end.as_ptr()) })
++            }
+         }
+     }
+ 
+@@ -333,7 +359,11 @@ impl<T, A: Allocator> DoubleEndedIterator for IntoIter<T, A> {
+ #[stable(feature = "rust1", since = "1.0.0")]
+ impl<T, A: Allocator> ExactSizeIterator for IntoIter<T, A> {
+     fn is_empty(&self) -> bool {
+-        self.ptr == self.end
++        if T::IS_ZST {
++            self.ptr.as_ptr() == self.end as *mut _
++        } else {
++            self.ptr == non_null!(self.end, T)
++        }
+     }
+ }
+ 
+diff --git a/rust/alloc/vec/mod.rs b/rust/alloc/vec/mod.rs
+index 220fb9d6f45b3f..0be27fff4554a1 100644
+--- a/rust/alloc/vec/mod.rs
++++ b/rust/alloc/vec/mod.rs
+@@ -360,7 +360,7 @@ mod spec_extend;
+ ///
+ /// `vec![x; n]`, `vec![a, b, c, d]`, and
+ /// [`Vec::with_capacity(n)`][`Vec::with_capacity`], will all produce a `Vec`
+-/// with exactly the requested capacity. If <code>[len] == [capacity]</code>,
++/// with at least the requested capacity. If <code>[len] == [capacity]</code>,
+ /// (as is the case for the [`vec!`] macro), then a `Vec<T>` can be converted to
+ /// and from a [`Box<[T]>`][owned slice] without reallocating or moving the elements.
+ ///
+@@ -447,7 +447,7 @@ impl<T> Vec<T> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -690,7 +690,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -1013,7 +1013,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -1043,7 +1043,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -1140,8 +1140,11 @@ impl<T, A: Allocator> Vec<T, A> {
+ 
+     /// Shrinks the capacity of the vector as much as possible.
+     ///
+-    /// It will drop down as close as possible to the length but the allocator
+-    /// may still inform the vector that there is space for a few more elements.
++    /// The behavior of this method depends on the allocator, which may either shrink the vector
++    /// in-place or reallocate. The resulting vector might still have some excess capacity, just as
++    /// is the case for [`with_capacity`]. See [`Allocator::shrink`] for more details.
++    ///
++    /// [`with_capacity`]: Vec::with_capacity
+     ///
+     /// # Examples
+     ///
+@@ -1191,10 +1194,10 @@ impl<T, A: Allocator> Vec<T, A> {
+ 
+     /// Converts the vector into [`Box<[T]>`][owned slice].
+     ///
+-    /// If the vector has excess capacity, its items will be moved into a
+-    /// newly-allocated buffer with exactly the right capacity.
++    /// Before doing the conversion, this method discards excess capacity like [`shrink_to_fit`].
+     ///
+     /// [owned slice]: Box
++    /// [`shrink_to_fit`]: Vec::shrink_to_fit
+     ///
+     /// # Examples
+     ///
+@@ -2017,7 +2020,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -2133,7 +2136,7 @@ impl<T, A: Allocator> Vec<T, A> {
+         } else {
+             unsafe {
+                 self.len -= 1;
+-                core::intrinsics::assume(self.len < self.capacity());
++                core::hint::assert_unchecked(self.len < self.capacity());
+                 Some(ptr::read(self.as_ptr().add(self.len())))
+             }
+         }
+@@ -2143,7 +2146,7 @@ impl<T, A: Allocator> Vec<T, A> {
+     ///
+     /// # Panics
+     ///
+-    /// Panics if the new capacity exceeds `isize::MAX` bytes.
++    /// Panics if the new capacity exceeds `isize::MAX` _bytes_.
+     ///
+     /// # Examples
+     ///
+@@ -2315,6 +2318,12 @@ impl<T, A: Allocator> Vec<T, A> {
+     /// `[at, len)`. After the call, the original vector will be left containing
+     /// the elements `[0, at)` with its previous capacity unchanged.
+     ///
++    /// - If you want to take ownership of the entire contents and capacity of
++    ///   the vector, see [`mem::take`] or [`mem::replace`].
++    /// - If you don't need the returned vector at all, see [`Vec::truncate`].
++    /// - If you want to take ownership of an arbitrary subslice, or you don't
++    ///   necessarily want to store the removed items in a vector, see [`Vec::drain`].
++    ///
+     /// # Panics
+     ///
+     /// Panics if `at > len`.
+@@ -2346,14 +2355,6 @@ impl<T, A: Allocator> Vec<T, A> {
+             assert_failed(at, self.len());
+         }
+ 
+-        if at == 0 {
+-            // the new vector can take over the original buffer and avoid the copy
+-            return mem::replace(
+-                self,
+-                Vec::with_capacity_in(self.capacity(), self.allocator().clone()),
+-            );
+-        }
+-
+         let other_len = self.len - at;
+         let mut other = Vec::with_capacity_in(other_len, self.allocator().clone());
+ 
+@@ -3027,6 +3028,50 @@ impl<T, I: SliceIndex<[T]>, A: Allocator> IndexMut<I> for Vec<T, A> {
+     }
+ }
+ 
++/// Collects an iterator into a Vec, commonly called via [`Iterator::collect()`]
++///
++/// # Allocation behavior
++///
++/// In general `Vec` does not guarantee any particular growth or allocation strategy.
++/// That also applies to this trait impl.
++///
++/// **Note:** This section covers implementation details and is therefore exempt from
++/// stability guarantees.
++///
++/// Vec may use any or none of the following strategies,
++/// depending on the supplied iterator:
++///
++/// * preallocate based on [`Iterator::size_hint()`]
++///   * and panic if the number of items is outside the provided lower/upper bounds
++/// * use an amortized growth strategy similar to `pushing` one item at a time
++/// * perform the iteration in-place on the original allocation backing the iterator
++///
++/// The last case warrants some attention. It is an optimization that in many cases reduces peak memory
++/// consumption and improves cache locality. But when big, short-lived allocations are created,
++/// only a small fraction of their items get collected, no further use is made of the spare capacity
++/// and the resulting `Vec` is moved into a longer-lived structure, then this can lead to the large
++/// allocations having their lifetimes unnecessarily extended which can result in increased memory
++/// footprint.
++///
++/// In cases where this is an issue, the excess capacity can be discarded with [`Vec::shrink_to()`],
++/// [`Vec::shrink_to_fit()`] or by collecting into [`Box<[T]>`][owned slice] instead, which additionally reduces
++/// the size of the long-lived struct.
++///
++/// [owned slice]: Box
++///
++/// ```rust
++/// # use std::sync::Mutex;
++/// static LONG_LIVED: Mutex<Vec<Vec<u16>>> = Mutex::new(Vec::new());
++///
++/// for i in 0..10 {
++///     let big_temporary: Vec<u16> = (0..1024).collect();
++///     // discard most items
++///     let mut result: Vec<_> = big_temporary.into_iter().filter(|i| i % 100 == 0).collect();
++///     // without this a lot of unused capacity might be moved into the global
++///     result.shrink_to_fit();
++///     LONG_LIVED.lock().unwrap().push(result);
++/// }
++/// ```
+ #[cfg(not(no_global_oom_handling))]
+ #[stable(feature = "rust1", since = "1.0.0")]
+ impl<T> FromIterator<T> for Vec<T> {
+@@ -3069,14 +3114,8 @@ impl<T, A: Allocator> IntoIterator for Vec<T, A> {
+                 begin.add(me.len()) as *const T
+             };
+             let cap = me.buf.capacity();
+-            IntoIter {
+-                buf: NonNull::new_unchecked(begin),
+-                phantom: PhantomData,
+-                cap,
+-                alloc,
+-                ptr: begin,
+-                end,
+-            }
++            let buf = NonNull::new_unchecked(begin);
++            IntoIter { buf, phantom: PhantomData, cap, alloc, ptr: buf, end }
+         }
+     }
+ }
+@@ -3598,8 +3637,10 @@ impl<T, A: Allocator> From<Box<[T], A>> for Vec<T, A> {
+ impl<T, A: Allocator> From<Vec<T, A>> for Box<[T], A> {
+     /// Convert a vector into a boxed slice.
+     ///
+-    /// If `v` has excess capacity, its items will be moved into a
+-    /// newly-allocated buffer with exactly the right capacity.
++    /// Before doing the conversion, this method discards excess capacity like [`Vec::shrink_to_fit`].
++    ///
++    /// [owned slice]: Box
++    /// [`Vec::shrink_to_fit`]: Vec::shrink_to_fit
+     ///
+     /// # Examples
+     ///
+diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs
+index be68d5e567b1a1..71f95e5aa09abd 100644
+--- a/rust/kernel/lib.rs
++++ b/rust/kernel/lib.rs
+@@ -16,7 +16,6 @@
+ #![feature(coerce_unsized)]
+ #![feature(dispatch_from_dyn)]
+ #![feature(new_uninit)]
+-#![feature(offset_of)]
+ #![feature(receiver_trait)]
+ #![feature(unsize)]
+ 
+@@ -78,7 +77,7 @@ pub trait Module: Sized + Sync {
+ /// Equivalent to `THIS_MODULE` in the C API.
+ ///
+ /// C header: [`include/linux/export.h`](srctree/include/linux/export.h)
+-pub struct ThisModule(*mut bindings::module);
++pub struct ThisModule(#[allow(dead_code)] *mut bindings::module);
+ 
+ // SAFETY: `THIS_MODULE` may be used from all threads within a module.
+ unsafe impl Sync for ThisModule {}
+diff --git a/scripts/Makefile.build b/scripts/Makefile.build
+index baf86c0880b6d7..367cfeea74c5f5 100644
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -263,7 +263,7 @@ $(obj)/%.lst: $(src)/%.c FORCE
+ # Compile Rust sources (.rs)
+ # ---------------------------------------------------------------------------
+ 
+-rust_allowed_features := new_uninit,offset_of
++rust_allowed_features := new_uninit
+ 
+ # `--out-dir` is required to avoid temporaries being created by `rustc` in the
+ # current working directory, which may be not accessible in the out-of-tree
+diff --git a/scripts/min-tool-version.sh b/scripts/min-tool-version.sh
+index 5927cc6b7de338..cc5141b67b4a71 100755
+--- a/scripts/min-tool-version.sh
++++ b/scripts/min-tool-version.sh
+@@ -33,7 +33,7 @@ llvm)
+ 	fi
+ 	;;
+ rustc)
+-	echo 1.76.0
++	echo 1.77.0
+ 	;;
+ bindgen)
+ 	echo 0.65.1
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index c09f5c485e432..b7840b554beee 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -6,14 +6,14 @@ let
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   ltsVariant = {
-    version = "6.6.27";
-    hash = "sha256-MYvt7QWRdUybbhva6B4MOYrwnJfuu/qvMlnaGKcO1Hw=";
+    version = "6.6.29";
+    hash = "sha256-Be2VaW0DQDS0FJUwXM627QaNgrn1B3Hbyq+PiKb7b+k=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.8.6";
-    hash = "sha256-7GsiIl3rcLm/u2zxrjpP6dTxn7w/6at22gaU//mLlzw=";
+    version = "6.8.8";
+    hash = "sha256-6fT9vRjHw775m4ySUAUWU9R0dz/cWYYdZsPCwZjGiXM=";
     variant = "main";
   };
 
@@ -45,6 +45,9 @@ let
       HZ = freeform "250";
       HZ_250 = yes;
       HZ_1000 = no;
+
+      # Disable writeback throttling by default
+      BLK_WBT_MQ = lib.mkOverride 60 no;
     };
 
     extraMeta = {
diff --git a/pkgs/os-specific/linux/kexec-tools/default.nix b/pkgs/os-specific/linux/kexec-tools/default.nix
index c62f9047fc60b..530fd767bb909 100644
--- a/pkgs/os-specific/linux/kexec-tools/default.nix
+++ b/pkgs/os-specific/linux/kexec-tools/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "kexec-tools";
-  version = "2.0.26";
+  version = "2.0.28";
 
   src = fetchurl {
     urls = [
       "mirror://kernel/linux/utils/kernel/kexec/${pname}-${version}.tar.xz"
       "http://horms.net/projects/kexec/kexec-tools/${pname}-${version}.tar.xz"
     ];
-    sha256 = "sha256-f+NqBkEBzVxRXkGyvjk9zjyoitzlnW7maOCvfAxFcM0=";
+    sha256 = "sha256-0vDvhy854v5LGwH+tisAATgyByObn4BB+YqVVkFh0FM=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/lenovo-legion/app.nix b/pkgs/os-specific/linux/lenovo-legion/app.nix
index 6d6c604b1c054..eeccf301ee95b 100644
--- a/pkgs/os-specific/linux/lenovo-legion/app.nix
+++ b/pkgs/os-specific/linux/lenovo-legion/app.nix
@@ -2,13 +2,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "lenovo-legion-app";
-  version = "0.0.9";
+  version = "0.0.12";
 
   src = fetchFromGitHub {
     owner = "johnfanv2";
     repo = "LenovoLegionLinux";
     rev = "v${version}-prerelease";
-    hash = "sha256-PQdxfDfW3sn0wWjmsPoAt3HZ43PS3Tyez3/0KEVVZQg=";
+    hash = "sha256-BNrRv9EBmNINQbAw+BzVxKl/XoDgH1tsNZHJxfSpNoU=";
   };
 
   sourceRoot = "${src.name}/python/legion_linux";
@@ -17,6 +17,7 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     pyqt5
+    pyqt6
     argcomplete
     pyyaml
     darkdetect
@@ -26,13 +27,13 @@ python3.pkgs.buildPythonApplication rec {
 
   postPatch = ''
     substituteInPlace ./setup.cfg \
-      --replace "_VERSION" "${version}"
+      --replace-fail "_VERSION" "${version}"
     substituteInPlace ../../extra/service/fancurve-set \
-      --replace "FOLDER=/etc/legion_linux/" "FOLDER=$out/share/legion_linux"
+      --replace-fail "FOLDER=/etc/legion_linux/" "FOLDER=$out/share/legion_linux"
     substituteInPlace ./legion_linux/legion.py \
-      --replace "/etc/legion_linux" "$out/share/legion_linux"
-    substituteInPlace ./legion_linux/legion_gui{,_user}.desktop \
-      --replace "Icon=/usr/share/pixmaps/legion_logo.png" "Icon=legion_logo"
+      --replace-fail "/etc/legion_linux" "$out/share/legion_linux"
+    substituteInPlace ./legion_linux/legion_gui.desktop \
+      --replace-fail "Icon=/usr/share/pixmaps/legion_logo.png" "Icon=legion_logo"
   '';
 
   dontWrapQtApps = true;
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 22c162023e1c9..99454beb41878 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-wVCBLJK9nlS1N9/DrQtogoZmgWW4ECqInSeQTjUFhcY=";
+    sha256 = "sha256-3TCsIlr28vO6Zu9lDaEq6J4J+D5sHP7SSo1O/M0ZzUo=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index 59aa5bbc0e5d0..478b5fa8ac2cc 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libcap-ng";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchurl {
     url = "https://people.redhat.com/sgrubb/libcap-ng/libcap-ng-${version}.tar.gz";
-    sha256 = "sha256-aFgdOzjnVTy29t33gTsfyZ5ShW8hQh97R3zlq9JgWoo=";
+    hash = "sha256-O6UpTRy9+pivqs+8ALavntK4PoohgXGF39hEzIx6xv8=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/os-specific/linux/libnvme/default.nix b/pkgs/os-specific/linux/libnvme/default.nix
index 34c798ca3355a..7346e0d67d391 100644
--- a/pkgs/os-specific/linux/libnvme/default.nix
+++ b/pkgs/os-specific/linux/libnvme/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "C Library for NVM Express on Linux";
     homepage = "https://github.com/linux-nvme/libnvme";
-    maintainers = with maintainers; [ fogti vifino ];
+    maintainers = with maintainers; [ vifino ];
     license = with licenses; [ lgpl21Plus ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/libzbc/default.nix b/pkgs/os-specific/linux/libzbc/default.nix
index 94f5c93f949bb..79a4277a85603 100644
--- a/pkgs/os-specific/linux/libzbc/default.nix
+++ b/pkgs/os-specific/linux/libzbc/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "ZBC device manipulation library";
     homepage = "https://github.com/westerndigitalcorporation/libzbc";
-    maintainers = [ maintainers.fogti ];
+    maintainers = [ ];
     license = with licenses; [ bsd2 lgpl3Plus ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/libzbd/default.nix b/pkgs/os-specific/linux/libzbd/default.nix
index 4675a13837587..3bc48d0657b27 100644
--- a/pkgs/os-specific/linux/libzbd/default.nix
+++ b/pkgs/os-specific/linux/libzbd/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     description = "Zoned block device manipulation library and tools";
     mainProgram = "zbd";
     homepage = "https://github.com/westerndigitalcorporation/libzbd";
-    maintainers = [ maintainers.fogti ];
+    maintainers = [ ];
     license = with licenses; [ lgpl3Plus gpl3Plus ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/lxc/add-meson-options.patch b/pkgs/os-specific/linux/lxc/add-meson-options.patch
deleted file mode 100644
index 01aea4df27473..0000000000000
--- a/pkgs/os-specific/linux/lxc/add-meson-options.patch
+++ /dev/null
@@ -1,153 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 21a8705d0..f12b81442 100644
---- a/meson.build
-+++ b/meson.build
-@@ -50,7 +50,7 @@ rootfsmount = get_option('rootfs-mount-path')
- user_network_db_opt = get_option('usernet-db-path')
- user_network_conf_opt = get_option('usernet-config-path')
- 
--bashcompletiondir = join_paths('/', 'usr', 'share', 'bash-completion', 'completions')
-+bashcompletiondir = join_paths(prefixdir, get_option('datadir'), 'bash-completion', 'completions')
- bindir = join_paths(prefixdir, get_option('bindir'))
- datadir = join_paths(prefixdir, get_option('datadir'))
- mandir = join_paths(prefixdir, get_option('mandir'))
-@@ -123,22 +123,6 @@ conf.set('PACKAGE_VERSION', meson.project_version())
- conf.set('RUNTIME_PATH', runtimepath)
- conf.set('SYSCONFDIR', sysconfdir)
- 
--# Set sysconfdir
--fs = import('fs')
--distrosysconfdir = get_option('distrosysconfdir')
--if distrosysconfdir != ''
--    distrosysconfdir = join_paths(sysconfdir, distrosysconfdir)
--    conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
--elif fs.is_dir('/etc/sysconfig')
--    distrosysconfdir = join_paths(sysconfdir, 'sysconfig')
--    conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
--elif fs.is_dir('/etc/default')
--    distrosysconfdir = join_paths(sysconfdir, 'default')
--    conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
--else
--    error('"distrosysconfdir" is not set')
--endif
--
- # Cross-compile on Android.
- srcconf.set10('IS_BIONIC', host_machine.system() == 'android')
- 
-@@ -148,6 +132,7 @@ coverity = get_option('coverity-build')
- init_script = get_option('init-script')
- sanitize = get_option('b_sanitize')
- want_examples = get_option('examples')
-+want_install_init = get_option('install-init-files')
- want_io_uring = get_option('io-uring-event-loop')
- want_pam_cgroup = get_option('pam-cgroup')
- want_mans = get_option('man')
-@@ -160,10 +145,30 @@ want_openssl = get_option('openssl')
- want_selinux = get_option('selinux')
- want_oss_fuzz = get_option('oss-fuzz')
- want_seccomp = get_option('seccomp')
-+want_spec = get_option('specfile')
-+want_state_dirs = get_option('install-state-dirs')
- want_thread_safety = get_option('thread-safety')
- want_memfd_rexec = get_option('memfd-rexec')
- want_sd_bus = get_option('sd-bus')
- 
-+# Set sysconfdir
-+fs = import('fs')
-+if want_install_init
-+    distrosysconfdir = get_option('distrosysconfdir')
-+    if distrosysconfdir != ''
-+        distrosysconfdir = join_paths(sysconfdir, distrosysconfdir)
-+        conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
-+    elif fs.is_dir('/etc/sysconfig')
-+        distrosysconfdir = join_paths(sysconfdir, 'sysconfig')
-+        conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
-+    elif fs.is_dir('/etc/default')
-+        distrosysconfdir = join_paths(sysconfdir, 'default')
-+        conf.set('LXC_DISTRO_SYSCONF', distrosysconfdir)
-+    else
-+        error('"distrosysconfdir" is not set')
-+    endif
-+endif
-+
- srcconf.set_quoted('DEFAULT_CGROUP_PATTERN', cgrouppattern)
- if coverity
-     srcconf.set('ENABLE_COVERITY_BUILD', 1)
-@@ -926,14 +931,16 @@ if want_apparmor
- endif
- subdir('config/bash')
- subdir('config/etc')
--subdir('config/init/common')
--subdir('config/init/systemd')
--subdir('config/init/sysvinit')
--subdir('config/init/upstart')
-+if want_install_init
-+    subdir('config/init/common')
-+    subdir('config/init/systemd')
-+    subdir('config/init/sysvinit')
-+    subdir('config/init/upstart')
-+    subdir('config/sysconfig')
-+endif
- if want_selinux
-     subdir('config/selinux')
- endif
--subdir('config/sysconfig')
- subdir('config/templates')
- subdir('config/templates/common.conf.d')
- subdir('config/yum')
-@@ -963,21 +970,25 @@ pkg_config_file = pkgconfig.generate(liblxc,
- )
- 
- # Empty dirs.
--install_emptydir(join_paths(localstatedir, 'cache', 'lxc'))
--install_emptydir(join_paths(localstatedir, 'lib', 'lxc'))
-+if want_state_dirs
-+    install_emptydir(join_paths(localstatedir, 'cache', 'lxc'))
-+    install_emptydir(join_paths(localstatedir, 'lib', 'lxc'))
-+endif
- 
- # RPM spec file.
--specconf = configuration_data()
--specconf.set('LXC_VERSION_BASE', meson.project_version())
--specconf.set('LXC_VERSION_BETA', version_data.get('LXC_VERSION_BETA'))
--specconf.set('PACKAGE', meson.project_name())
--specconf.set('LXC_DISTRO_SYSCONF', conf.get('LXC_DISTRO_SYSCONF'))
--
--configure_file(
--    configuration: specconf,
--    input: 'lxc.spec.in',
--    output: 'lxc.spec',
--    install: false)
-+if want_spec
-+    specconf = configuration_data()
-+    specconf.set('LXC_VERSION_BASE', meson.project_version())
-+    specconf.set('LXC_VERSION_BETA', version_data.get('LXC_VERSION_BETA'))
-+    specconf.set('PACKAGE', meson.project_name())
-+    specconf.set('LXC_DISTRO_SYSCONF', conf.get('LXC_DISTRO_SYSCONF'))
-+
-+    configure_file(
-+        configuration: specconf,
-+        input: 'lxc.spec.in',
-+        output: 'lxc.spec',
-+        install: false)
-+endif
- 
- # Build overview.
- status = [
-diff --git a/meson_options.txt b/meson_options.txt
-index 9803473d2..84a6d45b5 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -120,3 +120,12 @@ option('memfd-rexec', type : 'boolean', value : 'true',
- 
- option('distrosysconfdir', type : 'string', value: '',
-        description: 'relative path to sysconfdir for distro default configuration')
-+
-+option('specfile', type : 'boolean', value: true,
-+       description: 'whether to prepare RPM spec')
-+
-+option('install-init-files', type : 'boolean', value: true,
-+       description: 'whether to install init files for local init (e.g. systemd, sysvinit)')
-+
-+option('install-state-dirs', type : 'boolean', value: true,
-+       description: 'whether to create state directories on install')
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
deleted file mode 100644
index 71de8ce3cdcc1..0000000000000
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ /dev/null
@@ -1,94 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  docbook2x,
-  libapparmor,
-  libcap,
-  libseccomp,
-  libselinux,
-  meson,
-  ninja,
-  nix-update-script,
-  nixosTests,
-  openssl,
-  pkg-config,
-  systemd,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "lxc";
-  version = "5.0.3";
-
-  src = fetchFromGitHub {
-    owner = "lxc";
-    repo = "lxc";
-    rev = "refs/tags/lxc-${version}";
-    hash = "sha256-lnLmLgWXt3pI2S+4OeHRlPP5gui7S7ZXXClFt+n/8sY=";
-  };
-
-  nativeBuildInputs = [
-    docbook2x
-    meson
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    libapparmor
-    libcap
-    libseccomp
-    libselinux
-    openssl
-    systemd
-  ];
-
-  patches = [
-     # make build more nix compatible
-    ./add-meson-options.patch
-
-    # fix docbook2man version detection
-    ./docbook-hack.patch
-  ];
-
-  mesonFlags = [
-    "-Dinstall-init-files=false"
-    "-Dinstall-state-dirs=false"
-    "-Dspecfile=false"
-  ];
-
-  enableParallelBuilding = true;
-
-  doCheck = true;
-
-  # https://github.com/NixOS/nixpkgs/issues/300635
-  postInstall = ''chmod -R u-s,g-s "$out"'';
-
-  passthru = {
-    tests = {
-      incus-legacy-init = nixosTests.incus.container-legacy-init;
-      incus-systemd-init = nixosTests.incus.container-systemd-init;
-    };
-    updateScript = nix-update-script {
-      extraArgs = [
-        "-vr"
-        "lxc-(.*)"
-      ];
-    };
-  };
-
-  meta = {
-    homepage = "https://linuxcontainers.org/";
-    description = "Userspace tools for Linux Containers, a lightweight virtualization system";
-    license = lib.licenses.gpl2;
-
-    longDescription = ''
-      LXC containers are often considered as something in the middle between a chroot and a
-      full fledged virtual machine. The goal of LXC is to create an environment as close as
-      possible to a standard Linux installation but without the need for a separate kernel.
-    '';
-
-    platforms = lib.platforms.linux;
-    maintainers = lib.teams.lxc.members;
-  };
-}
diff --git a/pkgs/os-specific/linux/lxc/docbook-hack.patch b/pkgs/os-specific/linux/lxc/docbook-hack.patch
deleted file mode 100644
index f758014efbaa2..0000000000000
--- a/pkgs/os-specific/linux/lxc/docbook-hack.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/meson.build b/meson.build
-index d1527679e..360824994 100644
---- a/meson.build
-+++ b/meson.build
-@@ -320,15 +320,7 @@ docconf.set('LXC_USERNIC_CONF', lxc_user_network_conf)
- docconf.set('LXC_USERNIC_DB', lxc_user_network_db)
- docconf.set('PACKAGE_VERSION', version_data.get('LXC_VERSION'))
- docconf.set('docdtd', '"-//OASIS//DTD DocBook XML" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd"')
--sgml2man = find_program('docbook2X2man', 'docbook2x-man', 'db2x_docbook2man', 'docbook2man', 'docbook-to-man', required: false, version: '>=0.8')
--if not sgml2man.found()
--    sgml2man = find_program('docbook2man', required: false, version: '<0.8')
--    if sgml2man.found()
--        docconf.set('docdtd', '"-//Davenport//DTD DocBook V3.0//EN"')
--    elif want_mans
--        error('missing required docbook2x or docbook-utils dependency')
--    endif
--endif
-+sgml2man = find_program('docbook2X2man', 'docbook2x-man', 'db2x_docbook2man', 'docbook2man', 'docbook-to-man', required: false)
- 
- ## Threads.
- threads = dependency('threads')
diff --git a/pkgs/os-specific/linux/mwprocapture/default.nix b/pkgs/os-specific/linux/mwprocapture/default.nix
index a90a8716cca92..711a14845df76 100644
--- a/pkgs/os-specific/linux/mwprocapture/default.nix
+++ b/pkgs/os-specific/linux/mwprocapture/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://www.magewell.com/files/drivers/ProCaptureForLinux_${subVersion}.tar.gz";
-    sha256 = "sha256-HOVAR9auc8ulENPLoI0scdCMZoSbDYkTaCLgZoFG7eU=";
+    sha256 = "sha256-a2cU7PYQh1KR5eeMhMNx2Sc3HHd7QvCG9+BoJyVPp1Y=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.magewell.com/";
     description = "Linux driver for the Magewell Pro Capture family";
     license = licenses.unfreeRedistributable;
-    maintainers = with maintainers; [ flexiondotorg MP2E ];
+    maintainers = with maintainers; [ flexiondotorg ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/nct6687d/default.nix b/pkgs/os-specific/linux/nct6687d/default.nix
index 493d0e6af101d..35e77c7922dfd 100644
--- a/pkgs/os-specific/linux/nct6687d/default.nix
+++ b/pkgs/os-specific/linux/nct6687d/default.nix
@@ -2,17 +2,18 @@
 , stdenv
 , fetchFromGitHub
 , kernel
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "nct6687d";
-  version = "unstable-2023-09-22";
+  version = "0-unstable-2024-02-23";
 
   src = fetchFromGitHub {
     owner = "Fred78290";
     repo = "nct6687d";
-    rev = "cdfe855342a9383a9c4c918d51576c36d989070d";
-    hash = "sha256-iOLWxj4I6oYkNXFSkmw7meTQEnrIfb4Mw+/LkzgzDxM=";
+    rev = "0ee35ed9541bde22fe219305d1647b51ed010c5e";
+    hash = "sha256-g81U+ngnsOslBDCQP51uDDyHPpCv9T/j+KmFUAQfz/M=";
   };
 
   setSourceRoot = ''
@@ -30,6 +31,10 @@ stdenv.mkDerivation rec {
   installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
   installTargets = [ "modules_install" ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch=main" ];
+  };
+
   meta = with lib; {
     description = "Kernel module for the Nuvoton NCT6687-R chipset found on many B550/B650 motherboards from ASUS and MSI";
     license = with licenses; [ gpl2Only ];
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 3680cd43efb77..95e4183a2fb6b 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -5,7 +5,6 @@
 , autoreconfHook
 , withDebugSymbols ? false
 , withCli ? true, libedit
-, withPython ? false, python3
 , withXtables ? true, iptables
 , nixosTests
 }:
@@ -29,25 +28,12 @@ stdenv.mkDerivation rec {
     libmnl libnftnl libpcap
     gmp jansson
   ] ++ lib.optional withCli libedit
-    ++ lib.optional withXtables iptables
-    ++ lib.optionals withPython [
-      python3
-      python3.pkgs.setuptools
-    ];
-
-  patches = [ ./fix-py-libnftables.patch ];
-
-  postPatch = ''
-    substituteInPlace "py/src/nftables.py" \
-      --subst-var-by "out" "$out"
-  '';
+    ++ lib.optional withXtables iptables;
 
   configureFlags = [
     "--with-json"
     (lib.withFeatureAs withCli "cli" "editline")
   ] ++ lib.optional (!withDebugSymbols) "--disable-debug"
-    ++ lib.optional (!withPython) "--disable-python"
-    ++ lib.optional withPython "--enable-python"
     ++ lib.optional withXtables "--with-xtables";
 
   passthru.tests = {
diff --git a/pkgs/os-specific/linux/nftables/fix-py-libnftables.patch b/pkgs/os-specific/linux/nftables/fix-py-libnftables.patch
deleted file mode 100644
index 3ab1e5363019a..0000000000000
--- a/pkgs/os-specific/linux/nftables/fix-py-libnftables.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/py/src/nftables.py b/py/src/nftables.py
-index f1e43ade..9adcd1be 100644
---- a/py/src/nftables.py
-+++ b/py/src/nftables.py
-@@ -69,7 +69,7 @@ class Nftables:
- 
-     validator = None
- 
--    def __init__(self, sofile="libnftables.so.1"):
-+    def __init__(self, sofile="@out@/lib/libnftables.so.1"):
-         """Instantiate a new Nftables class object.
- 
-         Accepts a shared object file to open, by default standard search path
diff --git a/pkgs/os-specific/linux/nftables/python.nix b/pkgs/os-specific/linux/nftables/python.nix
new file mode 100644
index 0000000000000..5c5770ebed4a5
--- /dev/null
+++ b/pkgs/os-specific/linux/nftables/python.nix
@@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, setuptools
+, nftables
+}:
+
+buildPythonPackage {
+  pname = "nftables";
+  inherit (nftables) version src;
+  pyproject = true;
+
+  postPatch = ''
+    substituteInPlace "py/src/nftables.py" \
+      --replace-fail "libnftables.so.1" "${nftables}/lib/libnftables.so.1"
+  '';
+
+  setSourceRoot = "sourceRoot=$(echo */py)";
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "nftables" ];
+
+  meta = {
+    inherit (nftables.meta) description homepage license platforms maintainers;
+  };
+}
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 30a1e4dd8b6f0..f3ee49a8c395f 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -50,6 +50,10 @@ while [ "$#" -gt 0 ]; do
         ;;
       switch|boot|test|build|edit|repl|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader|list-generations)
         if [ "$i" = dry-run ]; then i=dry-build; fi
+        if [ "$i" = list-generations ]; then
+            buildNix=
+            fast=1
+        fi
         # exactly one action mandatory, bail out if multiple are given
         if [ -n "$action" ]; then showSyntax; fi
         action="$i"
@@ -793,7 +797,13 @@ if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" =
     else
         cmd+=("$pathToConfig/specialisation/$specialisation/bin/switch-to-configuration")
 
-        if [[ ! -f "${cmd[-1]}" ]]; then
+        if [ -z "$targetHost" ]; then
+            specialisationExists=$(test -f "${cmd[-1]}")
+        else
+            specialisationExists=$(targetHostCmd test -f "${cmd[-1]}")
+        fi
+
+        if ! $specialisationExists; then
             log "error: specialisation not found: $specialisation"
             exit 1
         fi
diff --git a/pkgs/os-specific/linux/nmon/default.nix b/pkgs/os-specific/linux/nmon/default.nix
index 9e3a6667d7054..3de22bfae6d76 100644
--- a/pkgs/os-specific/linux/nmon/default.nix
+++ b/pkgs/os-specific/linux/nmon/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nmon";
-  version = "16p";
+  version = "16q";
 
   src = fetchurl {
     url = "mirror://sourceforge/nmon/lmon${version}.c";
-    sha256 = "sha256-XcYEX2cl4ySalpkY+uaWY6HWaRYgh3ILq825D86eayo=";
+    sha256 = "sha256-G3ioFnLBkpGz0RpuMZ3ZsjoCKiYtuh786gCNbfUaylE=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 318d2617c838c..777e5b6ca4d94 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -33,12 +33,12 @@ rec {
   stable = if stdenv.hostPlatform.system == "i686-linux" then legacy_390 else latest;
 
   production = generic {
-    version = "550.76";
-    sha256_64bit = "sha256-2/wAmBNiePhX74FsV7j21LnCaubxMC/kAYMmf8kQt1s=";
-    sha256_aarch64 = "sha256-LhiyYCUTFwqzUITK6CKIqxOQp62wG1RuKOuP0fTKoVk=";
-    openSha256 = "sha256-RWaUXIr/yCRmX4yIyUxvBxrKCLKRKSi4lQJAYvrd2Kg=";
-    settingsSha256 = "sha256-Lv95+0ahvU1+X/twzWWVqQH4nqq491ALigH9TVBn+YY=";
-    persistencedSha256 = "sha256-rbgI9kGdVzGlPNEvaoOq2zrAMx+H8D+XEBah2eqZzuI=";
+    version = "550.78";
+    sha256_64bit = "sha256-NAcENFJ+ydV1SD5/EcoHjkZ+c/be/FQ2bs+9z+Sjv3M=";
+    sha256_aarch64 = "sha256-2POG5RWT2H7Rhs0YNfTGHO64Q8u5lJD9l/sQCGVb+AA=";
+    openSha256 = "sha256-cF9omNvfHx6gHUj2u99k6OXrHGJRpDQDcBG3jryf41Y=";
+    settingsSha256 = "sha256-lZiNZw4dJw4DI/6CI0h0AHbreLm825jlufuK9EB08iw=";
+    persistencedSha256 = "sha256-qDGBAcZEN/ueHqWO2Y6UhhXJiW5625Kzo1m/oJhvbj4=";
   };
 
   latest = selectHighestVersion production (generic {
@@ -64,11 +64,11 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "550.40.59";
+    version = "550.40.61";
     persistencedVersion = "550.54.14";
     settingsVersion = "550.54.14";
-    sha256_64bit = "sha256-hVwYC454vkxcK8I9bj1kp6iFS667em0c+Ral243C0J8=";
-    openSha256 = "sha256-/v1iVcmHhdvib54LDktNBHkcmgFxZVwQxwPdWSi0l/U=";
+    sha256_64bit = "sha256-JNVeA5/u5/ictU3QpPnbXIHDKOtwou8wGmMt3We4FJY=";
+    openSha256 = "sha256-kWGTj3eAvwLTJ7zgzRFvyhXmfpxQbUMmyxWxER9i9m0=";
     settingsSha256 = "sha256-m2rNASJp0i0Ez2OuqL+JpgEF0Yd8sYVCyrOoo/ln2a4=";
     persistencedSha256 = "sha256-XaPN8jVTjdag9frLPgBtqvO/goB5zxeGzaTU0CdL6C4=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
diff --git a/pkgs/os-specific/linux/nvidia-x11/settings.nix b/pkgs/os-specific/linux/nvidia-x11/settings.nix
index b11dc06c85ebf..2d9dfd81829eb 100644
--- a/pkgs/os-specific/linux/nvidia-x11/settings.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/settings.nix
@@ -16,7 +16,7 @@ nvidia_x11: sha256:
 , libXxf86vm
 , libvdpau
 , librsvg
-, wrapGAppsHook
+, wrapGAppsHook3
 , addOpenGLRunpath
 , withGtk2 ? false
 , withGtk3 ? true
@@ -96,7 +96,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ pkg-config m4 addOpenGLRunpath ];
 
   buildInputs = [ jansson libXv libXrandr libXext libXxf86vm libvdpau nvidia_x11 gtk2 dbus ]
-    ++ lib.optionals withGtk3 [ gtk3 librsvg wrapGAppsHook ];
+    ++ lib.optionals withGtk3 [ gtk3 librsvg wrapGAppsHook3 ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/os-specific/linux/openvswitch/default.nix b/pkgs/os-specific/linux/openvswitch/default.nix
deleted file mode 100644
index 0ea5b6391605a..0000000000000
--- a/pkgs/os-specific/linux/openvswitch/default.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-import ./generic.nix {
-  version = "3.3.0";
-  hash = "sha256-Gvy4H7lHwL6IWGaZXWwIjmHfQ1YRFXiSBqKzP3vBsF8=";
-}
diff --git a/pkgs/os-specific/linux/openvswitch/generic.nix b/pkgs/os-specific/linux/openvswitch/generic.nix
deleted file mode 100644
index ce800a7ba9923..0000000000000
--- a/pkgs/os-specific/linux/openvswitch/generic.nix
+++ /dev/null
@@ -1,135 +0,0 @@
-{ version
-, hash
-, updateScriptArgs ? ""
-}:
-
-{ lib
-, stdenv
-, fetchurl
-, autoconf
-, automake
-, installShellFiles
-, iproute2
-, kernel ? null
-, libcap_ng
-, libtool
-, openssl
-, perl
-, pkg-config
-, procps
-, python3
-, sphinxHook
-, util-linux
-, which
-, writeScript
-}:
-
-let
-  _kernel = kernel;
-in stdenv.mkDerivation rec {
-  pname = "openvswitch";
-  inherit version;
-
-  kernel = lib.optional (_kernel != null) _kernel.dev;
-
-  src = fetchurl {
-    url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
-    inherit hash;
-  };
-
-  outputs = [
-    "out"
-    "man"
-  ];
-
-  patches = [
-    # 8: vsctl-bashcomp - argument completion FAILED (completion.at:664)
-    ./patches/disable-bash-arg-completion-test.patch
-  ];
-
-  nativeBuildInputs = [
-    autoconf
-    automake
-    installShellFiles
-    libtool
-    pkg-config
-    sphinxHook
-  ];
-
-  sphinxBuilders = [
-    "man"
-  ];
-
-  sphinxRoot = "./Documentation";
-
-  buildInputs = [
-    libcap_ng
-    openssl
-    perl
-    procps
-    python3
-    util-linux
-    which
-  ];
-
-  preConfigure = "./boot.sh";
-
-  configureFlags = [
-    "--localstatedir=/var"
-    "--sharedstatedir=/var"
-    "--sbindir=$(out)/bin"
-  ] ++ (lib.optionals (_kernel != null) ["--with-linux"]);
-
-  # Leave /var out of this!
-  installFlags = [
-    "LOGDIR=$(TMPDIR)/dummy"
-    "RUNDIR=$(TMPDIR)/dummy"
-    "PKIDIR=$(TMPDIR)/dummy"
-  ];
-
-  enableParallelBuilding = true;
-
-  postInstall = ''
-    installShellCompletion --bash utilities/ovs-appctl-bashcomp.bash
-    installShellCompletion --bash utilities/ovs-vsctl-bashcomp.bash
-  '';
-
-  doCheck = true;
-  preCheck = ''
-    export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
-    export RECHECK=yes
-
-    patchShebangs tests/
-  '';
-
-  nativeCheckInputs = [
-    iproute2
-  ] ++ (with python3.pkgs; [
-    netaddr
-    pyparsing
-    pytest
-  ]);
-
-  passthru.updateScript = writeScript "ovs-update.nu" ''
-    ${./update.nu} ${updateScriptArgs}
-  '';
-
-  meta = with lib; {
-    changelog = "https://www.openvswitch.org/releases/NEWS-${version}.txt";
-    description = "A multilayer virtual switch";
-    longDescription = ''
-      Open vSwitch is a production quality, multilayer virtual switch
-      licensed under the open source Apache 2.0 license. It is
-      designed to enable massive network automation through
-      programmatic extension, while still supporting standard
-      management interfaces and protocols (e.g. NetFlow, sFlow, SPAN,
-      RSPAN, CLI, LACP, 802.1ag). In addition, it is designed to
-      support distribution across multiple physical servers similar
-      to VMware's vNetwork distributed vswitch or Cisco's Nexus 1000V.
-    '';
-    homepage = "https://www.openvswitch.org/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ netixx kmcopper ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/openvswitch/lts.nix b/pkgs/os-specific/linux/openvswitch/lts.nix
deleted file mode 100644
index 93ccbfcee95d6..0000000000000
--- a/pkgs/os-specific/linux/openvswitch/lts.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-import ./generic.nix {
-  version = "2.17.9";
-  hash = "sha256-4bP6RyZ2YmhT8i1j+VnlrQYeG/V+G71ETQ7Yj5R++LE=";
-  updateScriptArgs = "--lts=true --regex '2\.17.*'";
-}
diff --git a/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch b/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch
deleted file mode 100644
index 2b45427417632..0000000000000
--- a/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/tests/completion.at b/tests/completion.at
-index b6155af25..6367cb545 100644
---- a/tests/completion.at
-+++ b/tests/completion.at
-@@ -425,6 +425,7 @@ AT_CLEANUP
- 
- 
- AT_SETUP([vsctl-bashcomp - argument completion])
-+AT_SKIP_IF([true])
- AT_SKIP_IF([test -z ${BASH_VERSION+x}])
- AT_SKIP_IF([eval 'test ${BASH_VERSINFO[[0]]} -lt 4'])
- OVS_VSWITCHD_START(
diff --git a/pkgs/os-specific/linux/openvswitch/update.nu b/pkgs/os-specific/linux/openvswitch/update.nu
deleted file mode 100755
index 5d457dda5f3e9..0000000000000
--- a/pkgs/os-specific/linux/openvswitch/update.nu
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i nu -p nushell common-updater-scripts
-
-def main [--lts: bool = false, --regex: string] {
-  let tags = list-git-tags --url=https://github.com/openvswitch/ovs | lines | sort --natural | str replace v ''
-
-  let latest_tag = if $regex == null { $tags } else { $tags | find --regex $regex } | last
-  let current_version = nix eval --raw -f default.nix $"openvswitch(if $lts {"-lts"}).version" | str trim
-
-  if $latest_tag != $current_version {
-    if $lts {
-      update-source-version openvswitch-lts $latest_tag $"--file=(pwd)/pkgs/os-specific/linux/openvswitch/lts.nix"
-    } else {
-      update-source-version openvswitch $latest_tag $"--file=(pwd)/pkgs/os-specific/linux/openvswitch/default.nix"
-    }
-  }
-
-  {"lts?": $lts, before: $current_version, after: $latest_tag}
-}
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index c956dfad4c64f..e5f8fec5acb14 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, buildPackages, fetchurl, fetchpatch
+{ lib, stdenv, buildPackages, fetchurl
 , flex, cracklib, db4, gettext, audit, libxcrypt
 , nixosTests
 , autoreconfHook269, pkg-config-unwrapped
@@ -6,22 +6,15 @@
 
 stdenv.mkDerivation rec {
   pname = "linux-pam";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchurl {
     url = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
-    hash = "sha256-//SjTlu+534ujxmS8nYx4jKby/igVj3etcM4m04xaa0=";
+    hash = "sha256-+JI8dAFZBS1xnb/CovgZQtaN00/K9hxwagLJuA/u744=";
   };
 
   patches = [
     ./suid-wrapper-path.patch
-
-    # Backport fix for missing include breaking musl builds.
-    (fetchpatch {
-      name = "pam_namespace-stdint.h.patch";
-      url = "https://github.com/linux-pam/linux-pam/commit/cc9d40b7cdbd3e15ccaa324a0dda1680ef9dea13.patch";
-      hash = "sha256-tCnH2yPO4dBbJOZA0fP2gm1EavHRMEJyfzB5Vy7YjAA=";
-    })
   ];
 
   # Case-insensitivity workaround for https://github.com/linux-pam/linux-pam/issues/569
diff --git a/pkgs/os-specific/linux/piper/default.nix b/pkgs/os-specific/linux/piper/default.nix
index b1508dcb6a3ed..dcdc7a363e30e 100644
--- a/pkgs/os-specific/linux/piper/default.nix
+++ b/pkgs/os-specific/linux/piper/default.nix
@@ -1,5 +1,5 @@
 { lib, meson, ninja, pkg-config, gettext, fetchFromGitHub, python3
-, wrapGAppsHook, gtk3, glib, desktop-file-utils, appstream-glib, gnome
+, wrapGAppsHook3, gtk3, glib, desktop-file-utils, appstream-glib, gnome
 , gobject-introspection, librsvg }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -15,7 +15,7 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "0jsvfy0ihdcgnqljfgs41lys1nlz18qvsa0a8ndx3pyr41f8w8wf";
   };
 
-  nativeBuildInputs = [ meson ninja gettext pkg-config wrapGAppsHook desktop-file-utils appstream-glib gobject-introspection ];
+  nativeBuildInputs = [ meson ninja gettext pkg-config wrapGAppsHook3 desktop-file-utils appstream-glib gobject-introspection ];
   buildInputs = [
     gtk3 glib gnome.adwaita-icon-theme python3 librsvg
   ];
diff --git a/pkgs/os-specific/linux/power-profiles-daemon/default.nix b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
index 11f26e5013a82..f7145bc02ebe7 100644
--- a/pkgs/os-specific/linux/power-profiles-daemon/default.nix
+++ b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
@@ -11,6 +11,7 @@
 , polkit
 , dbus
 , gobject-introspection
+, wrapGAppsNoGuiHook
 , gettext
 , gtk-doc
 , docbook-xsl-nons
@@ -49,6 +50,7 @@ stdenv.mkDerivation rec {
     libxml2 # for xmllint for stripping GResources
     libxslt # for xsltproc for building docs
     gobject-introspection
+    wrapGAppsNoGuiHook
     # checkInput but cheked for during the configuring
     (python3.pythonOnBuildForHost.withPackages (ps: with ps; [
       pygobject3
@@ -95,6 +97,9 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  # Only need to wrap the Python tool (powerprofilectl)
+  dontWrapGApps = true;
+
   PKG_CONFIG_POLKIT_GOBJECT_1_POLICYDIR = "${placeholder "out"}/share/polkit-1/actions";
 
   postPatch = ''
@@ -106,6 +111,10 @@ stdenv.mkDerivation rec {
       src/powerprofilesctl
   '';
 
+  postFixup = ''
+    wrapGApp "$out/bin/powerprofilesctl"
+  '';
+
   passthru = {
     tests = {
       nixos = nixosTests.power-profiles-daemon;
diff --git a/pkgs/os-specific/linux/r8125/default.nix b/pkgs/os-specific/linux/r8125/default.nix
index 1c261355954ad..9b5210350bdd2 100644
--- a/pkgs/os-specific/linux/r8125/default.nix
+++ b/pkgs/os-specific/linux/r8125/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "r8125";
   # On update please verify (using `diff -r`) that the source matches the
   # realtek version.
-  version = "9.012.03";
+  version = "9.013.02";
 
   # This is a mirror. The original website[1] doesn't allow non-interactive
   # downloads, instead emailing you a download link.
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     owner = "louistakepillz";
     repo = "r8125";
     rev = version;
-    sha256 = "sha256-+CrxvKB96QOcOo87McZOt/XUhriTtTV8jTQgpBG3ejs=";
+    sha256 = "sha256-i45xKF5WVN+nNhpD6HWZHvGgxuaD/YhMHERqW8/bC5Y=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/restool/default.nix b/pkgs/os-specific/linux/restool/default.nix
index 853d9eeb7f3d6..7f7c094007e47 100644
--- a/pkgs/os-specific/linux/restool/default.nix
+++ b/pkgs/os-specific/linux/restool/default.nix
@@ -47,6 +47,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/nxp-qoriq/restool";
     license = licenses.bsd3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ delroth ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/rtl8852au/default.nix b/pkgs/os-specific/linux/rtl8852au/default.nix
new file mode 100644
index 0000000000000..d154fbe86a208
--- /dev/null
+++ b/pkgs/os-specific/linux/rtl8852au/default.nix
@@ -0,0 +1,52 @@
+{ lib, stdenv, fetchFromGitHub, kernel, bc, nukeReferences }:
+
+stdenv.mkDerivation {
+  pname = "rtl8852au";
+  version = "${kernel.version}-unstable-2023-11-24";
+
+  src = fetchFromGitHub {
+    owner = "lwfinger";
+    repo = "rtl8852au";
+    rev = "70bdde265b9ab002daf11d4bea1a42baa8da4325";
+    hash = "sha256-6ARS7/0iKYajpMH+f+jWDxIkPY9ZixJkk864oKom4l4=";
+  };
+
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
+  hardeningDisable = [ "pic" "format" ];
+
+  postPatch = ''
+    substituteInPlace ./Makefile \
+      --replace-fail /sbin/depmod \# \
+      --replace-fail '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/" \
+      --replace-fail '/usr/lib/systemd/system-sleep' "$out/usr/lib/systemd/system-sleep"
+    substituteInPlace ./platform/i386_pc.mk \
+      --replace-fail /lib/modules "${kernel.dev}/lib/modules"
+  '';
+
+  makeFlags = [
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+    ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
+    ("CONFIG_PLATFORM_ARM_RPI=" + (if stdenv.hostPlatform.isAarch then "y" else "n"))
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+  ];
+
+  preInstall = ''
+    mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+    mkdir -p "$out/usr/lib/systemd/system-sleep"
+  '';
+
+  postInstall = ''
+    nuke-refs $out/lib/modules/*/kernel/net/wireless/*.ko
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Driver for Realtek 802.11ac, rtl8852au, provides the 8852au mod";
+    homepage = "https://github.com/lwfinger/rtl8852au";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ lonyelon ];
+  };
+}
diff --git a/pkgs/os-specific/linux/rtl8852bu/default.nix b/pkgs/os-specific/linux/rtl8852bu/default.nix
new file mode 100644
index 0000000000000..cc0f495b8122f
--- /dev/null
+++ b/pkgs/os-specific/linux/rtl8852bu/default.nix
@@ -0,0 +1,51 @@
+{ lib, stdenv, fetchFromGitHub, kernel, bc, nukeReferences }:
+
+stdenv.mkDerivation {
+  pname = "rtl8852bu";
+  version = "${kernel.version}-unstable-2024-03-28";
+
+  src = fetchFromGitHub {
+    owner = "morrownr";
+    repo = "rtl8852bu";
+    rev = "f6aaa3c0094c541d9b0347926c76c1e9cc4a49d1";
+    hash = "sha256-Jbd6nixo873LU74klhhQU1qD3ahxEnywdqcF89LTRxc=";
+  };
+
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
+  hardeningDisable = [ "pic" "format" ];
+
+  postPatch = ''
+    substituteInPlace ./Makefile \
+      --replace-fail /sbin/depmod \# \
+      --replace-fail '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+    substituteInPlace ./platform/i386_pc.mk \
+      --replace-fail /lib/modules "${kernel.dev}/lib/modules"
+  '';
+
+  makeFlags = [
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+    ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
+    ("CONFIG_PLATFORM_ARM_RPI=" + (if stdenv.hostPlatform.isAarch then "y" else "n"))
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+  ];
+
+  preInstall = ''
+    mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+    mkdir -p "$out/usr/lib/systemd/system-sleep"
+  '';
+
+  postInstall = ''
+    nuke-refs $out/lib/modules/*/kernel/net/wireless/*.ko
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Driver for Realtek rtl8852au and rtl8832bu chipsets, provides the 8852au mod";
+    homepage = "https://github.com/morrownr/rtl8852bu";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ lonyelon ];
+  };
+}
diff --git a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
index 0ee191e868957..c21f8ea8a644b 100644
--- a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
+++ b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "azure-dcap-client";
-  version = "1.12.1";
+  version = "1.12.3";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = pname;
     rev = version;
-    hash = "sha256-q0dI4WdA1ue4sw+QfSherh31Ldf9gnhoft66o3E9gnU=";
+    hash = "sha256-zTDaICsSPXctgFRCZBiZwXV9dLk2pFL9kp5a8FkiTZA=";
   };
 
   patches = [
@@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Interfaces between SGX SDKs and the Azure Attestation SGX Certification Cache";
     homepage = "https://github.com/microsoft/azure-dcap-client";
-    maintainers = with maintainers; [ trundle veehaitch ];
+    maintainers = with maintainers; [ phlip9 trundle veehaitch ];
     platforms = [ "x86_64-linux" ];
     license = [ licenses.mit ];
   };
diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix
index 22e52b6ec9fdb..42e00071d8101 100644
--- a/pkgs/os-specific/linux/sgx/psw/default.nix
+++ b/pkgs/os-specific/linux/sgx/psw/default.nix
@@ -14,7 +14,7 @@
 , debug ? false
 }:
 stdenv.mkDerivation rec {
-  inherit (sgx-sdk) version versionTag src;
+  inherit (sgx-sdk) patches src version versionTag;
   pname = "sgx-psw";
 
   postUnpack =
@@ -24,16 +24,16 @@ stdenv.mkDerivation rec {
       # attestation quotes, and do platform certification.
       ae.prebuilt = fetchurl {
         url = "https://download.01.org/intel-sgx/sgx-linux/${versionTag}/prebuilt_ae_${versionTag}.tar.gz";
-        hash = "sha256-IckW4p1XWkWCDCErXyTtnKYKeAUaCrp5iAMsRBMjLX0=";
+        hash = "sha256-IGV9VEwY/cQBV4Vz2sps4JgRweWRl/l08ocb9P4SH8Q=";
       };
       # Also include the Data Center Attestation Primitives (DCAP) platform
       # enclaves.
       dcap = rec {
-        version = "1.18";
+        version = "1.20";
         filename = "prebuilt_dcap_${version}.tar.gz";
         prebuilt = fetchurl {
           url = "https://download.01.org/intel-sgx/sgx-dcap/${version}/linux/${filename}";
-          hash = "sha256-9ceys7ozOEienug+9MTZ6dw3nx7VBfxLNiwhZYv4SzY=";
+          hash = "sha256-nPsI89KSBA3cSNTMWyktZP5dkf+BwL3NZ4MuUf6G98o=";
         };
       };
     in
@@ -181,7 +181,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Intel SGX Architectural Enclave Service Manager";
     homepage = "https://github.com/intel/linux-sgx";
-    maintainers = with maintainers; [ veehaitch citadelcore ];
+    maintainers = with maintainers; [ phlip9 veehaitch citadelcore ];
     platforms = [ "x86_64-linux" ];
     license = with licenses; [ bsd3 ];
   };
diff --git a/pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch b/pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch
new file mode 100644
index 0000000000000..019f58927152a
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/sdk/cppmicroservices-no-mtime.patch
@@ -0,0 +1,26 @@
+diff --git a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
+index aee499e9..13fa89d4 100644
+--- a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
++++ b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
+@@ -105,7 +105,7 @@ bool BundleResourceContainer::GetStat(int index,
+                    const_cast<mz_zip_archive*>(&m_ZipArchive), index)
+                    ? true
+                    : false;
+-    stat.modifiedTime = zipStat.m_time;
++    stat.modifiedTime = 0;
+     stat.crc32 = zipStat.m_crc32;
+     // This will limit the size info from uint64 to uint32 on 32-bit
+     // architectures. We don't care because we assume resources > 2GB
+diff --git a/external/CppMicroServices/third_party/miniz.c b/external/CppMicroServices/third_party/miniz.c
+index 6b0ebd7a..fa2aebca 100644
+--- a/external/CppMicroServices/third_party/miniz.c
++++ b/external/CppMicroServices/third_party/miniz.c
+@@ -170,7 +170,7 @@
+ // If MINIZ_NO_TIME is specified then the ZIP archive functions will not be able to get the current time, or
+ // get/set file times, and the C run-time funcs that get/set times won't be called.
+ // The current downside is the times written to your archives will be from 1979.
+-//#define MINIZ_NO_TIME
++#define MINIZ_NO_TIME
+
+ // Define MINIZ_NO_ARCHIVE_APIS to disable all ZIP archive API's.
+ //#define MINIZ_NO_ARCHIVE_APIS
diff --git a/pkgs/os-specific/linux/sgx/sdk/default.nix b/pkgs/os-specific/linux/sgx/sdk/default.nix
index 2570406a7112e..67489ee3c07c4 100644
--- a/pkgs/os-specific/linux/sgx/sdk/default.nix
+++ b/pkgs/os-specific/linux/sgx/sdk/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoconf
 , automake
 , binutils
@@ -27,15 +26,15 @@
 stdenv.mkDerivation rec {
   pname = "sgx-sdk";
   # Version as given in se_version.h
-  version = "2.21.100.1";
+  version = "2.23.100.2";
   # Version as used in the Git tag
-  versionTag = "2.21";
+  versionTag = "2.23";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-sgx";
     rev = "sgx_${versionTag}";
-    hash = "sha256-Yo2G0H0XUI2p9W7lDRLkFHw2t8X1220brGohQJ0r2WY=";
+    hash = "sha256-i+fE6xKiuljG8LY8TIHgrW15DVpdp46bZdNo/BjgT/I=";
     fetchSubmodules = true;
   };
 
@@ -46,39 +45,28 @@ stdenv.mkDerivation rec {
   '';
 
   patches = [
-    # Fix missing pthread_compat.h, see https://github.com/intel/linux-sgx/pull/784
-    (fetchpatch {
-      url = "https://github.com/intel/linux-sgx/commit/254b58f922a6bd49c308a4f47f05f525305bd760.patch";
-      sha256 = "sha256-sHU++K7NJ+PdITx3y0PwstA9MVh10rj2vrLn01N9F4w=";
-    })
+    # There's a `make preparation` step that downloads some prebuilt binaries
+    # and applies some patches to the in-repo git submodules. This patch removes
+    # the parts that download things, since we can't do that inside the sandbox.
+    ./disable-downloads.patch
+
+    # This patch disable mtime in bundled zip file for reproducible builds.
+    #
+    # Context: The `aesm_service` binary depends on a vendored library called
+    # `CppMicroServices`. At build time, this lib creates and then bundles
+    # service resources into a zip file and then embeds this zip into the
+    # binary. Without changes, the `aesm_service` will be different after every
+    # build because the embedded zip file contents have different modified times.
+    ./cppmicroservices-no-mtime.patch
   ];
 
-  # There's a `make preparation` step that downloads some prebuilt binaries and
-  # applies some patches to the in-repo git submodules. We can't just run it,
-  # since it downloads things, so this step just extracts the patching steps.
   postPatch = ''
     patchShebangs linux/installer/bin/build-installpkg.sh \
       linux/installer/common/sdk/createTarball.sh \
       linux/installer/common/sdk/install.sh \
       external/sgx-emm/create_symlink.sh
 
-    echo "Running 'make preparation' but without download steps"
-
-    # Seems to download something. Build currently uses ipp-crypto and not
-    # sgxssl so probably not an issue.
-    # $ ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
-
-    pushd external/openmp/openmp_code
-      git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 \
-        || git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R
-    popd
-
-    pushd external/protobuf/protobuf_code
-      git apply ../sgx_protobuf.patch >/dev/null 2>&1 \
-        || git apply ../sgx_protobuf.patch --check -R
-    popd
-
-    ./external/sgx-emm/create_symlink.sh
+    make preparation
   '';
 
   # We need `cmake` as a build input but don't use it to kick off the build phase
@@ -300,7 +288,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Intel SGX SDK for Linux built with IPP Crypto Library";
     homepage = "https://github.com/intel/linux-sgx";
-    maintainers = with maintainers; [ sbellem arturcygan veehaitch ];
+    maintainers = with maintainers; [ phlip9 sbellem arturcygan veehaitch ];
     platforms = [ "x86_64-linux" ];
     license = with licenses; [ bsd3 ];
   };
diff --git a/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch b/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch
new file mode 100644
index 0000000000000..bdf9b9f9136e9
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/sdk/disable-downloads.patch
@@ -0,0 +1,26 @@
+diff --git a/Makefile b/Makefile
+index 32433051..2e480efb 100644
+--- a/Makefile
++++ b/Makefile
+@@ -50,8 +50,8 @@ tips:
+ preparation:
+ # As SDK build needs to clone and patch openmp, we cannot support the mode that download the source from github as zip.
+ # Only enable the download from git
+-	git submodule update --init --recursive
+-	./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
++	# git submodule update --init --recursive
++	# ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
+ 	cd external/openmp/openmp_code && git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 ||  git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R
+ 	cd external/protobuf/protobuf_code && git apply ../sgx_protobuf.patch >/dev/null 2>&1 ||  git apply ../sgx_protobuf.patch --check -R
+ 	./external/sgx-emm/create_symlink.sh
+@@ -59,8 +59,8 @@ preparation:
+ 	cd external/cbor && cp -r libcbor sgx_libcbor
+ 	cd external/cbor/libcbor && git apply ../raw_cbor.patch >/dev/null 2>&1 || git apply ../raw_cbor.patch --check -R
+ 	cd external/cbor/sgx_libcbor && git apply ../sgx_cbor.patch >/dev/null 2>&1 || git apply ../sgx_cbor.patch --check -R
+-	./download_prebuilt.sh
+-	./external/dcap_source/QuoteGeneration/download_prebuilt.sh
++	# ./download_prebuilt.sh
++	# ./external/dcap_source/QuoteGeneration/download_prebuilt.sh
+ 
+ psw:
+ 	$(MAKE) -C psw/ USE_OPT_LIBS=$(USE_OPT_LIBS)
diff --git a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
index 5a4c941a22b99..c72a0c5285164 100644
--- a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
+++ b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
@@ -8,13 +8,13 @@
 }:
 gcc11Stdenv.mkDerivation rec {
   pname = "ipp-crypto";
-  version = "2021.9.0";
+  version = "2021.10.0";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ipp-crypto";
     rev = "ippcp_${version}";
-    hash = "sha256-+ITnxyrkDQp4xRa+PVzXdYsSkI5sMNwQGfGU+lFJ6co=";
+    hash = "sha256-DfXsJ+4XqyjCD+79LUD53Cx8D46o1a4fAZa2UxGI1Xg=";
   };
 
   cmakeFlags = [ "-DARCH=intel64" ] ++ extraCmakeFlags;
diff --git a/pkgs/os-specific/linux/sgx/ssl/default.nix b/pkgs/os-specific/linux/sgx/ssl/default.nix
index 9d1905e09d1f7..94d7e20b21c41 100644
--- a/pkgs/os-specific/linux/sgx/ssl/default.nix
+++ b/pkgs/os-specific/linux/sgx/ssl/default.nix
@@ -1,8 +1,8 @@
 { stdenv
+, callPackage
 , fetchFromGitHub
 , fetchurl
 , lib
-, openssl
 , perl
 , sgx-sdk
 , which
@@ -10,7 +10,7 @@
 }:
 let
   sgxVersion = sgx-sdk.versionTag;
-  opensslVersion = "1.1.1u";
+  opensslVersion = "3.0.12";
 in
 stdenv.mkDerivation {
   pname = "sgx-ssl" + lib.optionalString debug "-debug";
@@ -19,15 +19,15 @@ stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "intel";
     repo = "intel-sgx-ssl";
-    rev = "lin_${sgxVersion}_${opensslVersion}";
-    hash = "sha256-zbXEQz72VUPqnGrboX6oXliaLpbcos7tV6K9lX+zleg=";
+    rev = "3.0_Rev2";
+    hash = "sha256-dmLyaG6v+skjSa0KxLAfIfSBOxp9grrI7ds6WdGPe0I=";
   };
 
   postUnpack =
     let
       opensslSourceArchive = fetchurl {
         url = "https://www.openssl.org/source/openssl-${opensslVersion}.tar.gz";
-        hash = "sha256-4vjYS1I+7NBse+diaDA3AwD7zBU4a/UULXJ1j2lj68Y=";
+        hash = "sha256-+Tyejt3l6RZhGd4xdV/Ie0qjSGNmL2fd/LoU0La2m2E=";
       };
     in
     ''
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
   postPatch = ''
     patchShebangs Linux/build_openssl.sh
 
-    # Run the test in the `installCheckPhase`, not the `buildPhase`
+    # Skip the tests. Build and run separately (see below).
     substituteInPlace Linux/sgx/Makefile \
       --replace '$(MAKE) -C $(TEST_DIR) all' \
                 'bash -c "true"'
@@ -46,7 +46,6 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     perl
     sgx-sdk
-    stdenv.cc.libc
     which
   ];
 
@@ -60,21 +59,22 @@ stdenv.mkDerivation {
     "DESTDIR=$(out)"
   ];
 
-  # Build the test app
-  doInstallCheck = true;
-  installCheckTarget = "test";
-  installCheckFlags = [
-    "SGX_MODE=SIM"
-    "-j 1" # Makefile doesn't support multiple jobs
-  ];
-  nativeInstallCheckInputs = [
-    openssl
-  ];
+  # These tests build on any x86_64-linux but BOTH SIM and HW will only _run_ on
+  # real Intel hardware. Split these out so OfBorg doesn't choke on this pkg.
+  #
+  # ```
+  # nix run .#sgx-ssl.tests.HW
+  # nix run .#sgx-ssl.tests.SIM
+  # ```
+  passthru.tests = {
+    HW = callPackage ./tests.nix { sgxMode = "HW"; inherit opensslVersion; };
+    SIM = callPackage ./tests.nix { sgxMode = "SIM"; inherit opensslVersion; };
+  };
 
   meta = with lib; {
     description = "Cryptographic library for Intel SGX enclave applications based on OpenSSL";
     homepage = "https://github.com/intel/intel-sgx-ssl";
-    maintainers = with maintainers; [ trundle veehaitch ];
+    maintainers = with maintainers; [ phlip9 trundle veehaitch ];
     platforms = [ "x86_64-linux" ];
     license = [ licenses.bsd3 licenses.openssl ];
   };
diff --git a/pkgs/os-specific/linux/sgx/ssl/tests.nix b/pkgs/os-specific/linux/sgx/ssl/tests.nix
new file mode 100644
index 0000000000000..d9357ba043102
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/ssl/tests.nix
@@ -0,0 +1,95 @@
+# This package _builds_ (but doesn't run!) the sgx-ssl test enclave + harness.
+# The whole package effectively does:
+#
+# ```
+# SGX_MODE=${sgxMode} make -C Linux/sgx/test_app
+# cp Linux/sgx/{TestApp,TestEnclave.signed.so} $out/bin
+# ```
+#
+# OfBorg fails to run these tests since they require real Intel HW. That
+# includes the simulation mode! The tests appears to do something fancy with
+# cpuid and exception trap handlers that make them very non-portable.
+#
+# These tests are split out from the parent pkg since recompiling the parent
+# takes like 30 min : )
+
+{ lib
+, openssl
+, sgx-psw
+, sgx-sdk
+, sgx-ssl
+, stdenv
+, which
+, opensslVersion ? throw "required parameter"
+, sgxMode ? throw "required parameter" # "SIM" or "HW"
+}:
+stdenv.mkDerivation {
+  inherit (sgx-ssl) postPatch src version;
+  pname = sgx-ssl.pname + "-tests-${sgxMode}";
+
+  postUnpack = sgx-ssl.postUnpack + ''
+    sourceRootAbs=$(readlink -e $sourceRoot)
+    packageDir=$sourceRootAbs/Linux/package
+
+    # Do the inverse of 'make install' and symlink built artifacts back into
+    # '$src/Linux/package/' to avoid work.
+    mkdir $packageDir/lib $packageDir/lib64
+    ln -s ${lib.getLib sgx-ssl}/lib/* $packageDir/lib/
+    ln -s ${lib.getLib sgx-ssl}/lib64/* $packageDir/lib64/
+    ln -sf ${lib.getDev sgx-ssl}/include/* $packageDir/include/
+
+    # test_app needs some internal openssl headers.
+    # See: tail end of 'Linux/build_openssl.sh'
+    tar -C $sourceRootAbs/openssl_source -xf $sourceRootAbs/openssl_source/openssl-${opensslVersion}.tar.gz
+    echo '#define OPENSSL_VERSION_STR "${opensslVersion}"' > $sourceRootAbs/Linux/sgx/osslverstr.h
+    ln -s $sourceRootAbs/openssl_source/openssl-${opensslVersion}/include/crypto $sourceRootAbs/Linux/sgx/test_app/enclave/
+    ln -s $sourceRootAbs/openssl_source/openssl-${opensslVersion}/include/internal $sourceRootAbs/Linux/sgx/test_app/enclave/
+  '';
+
+  nativeBuildInputs = [
+    openssl.bin
+    sgx-sdk
+    which
+  ];
+
+  preBuild = ''
+    # Need to regerate the edl header
+    make -C Linux/sgx/libsgx_tsgxssl sgx_tsgxssl_t.c
+  '';
+
+  makeFlags = [
+    "-C Linux/sgx/test_app"
+    "SGX_MODE=${sgxMode}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    # Enclaves can't be stripped after signing.
+    install -Dm 755 Linux/sgx/test_app/TestEnclave.signed.so -t $TMPDIR/enclaves
+
+    install -Dm 755 Linux/sgx/test_app/TestApp -t $out/bin
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    # Move the enclaves where they actually belong.
+    mv $TMPDIR/enclaves/*.signed.so* $out/bin/
+
+    # HW SGX must runs against sgx-psw, not sgx-sdk.
+    if [[ "${sgxMode}" == "HW" ]]; then
+      patchelf \
+        --set-rpath "$( \
+          patchelf --print-rpath $out/bin/TestApp \
+            | sed 's|${lib.getLib sgx-sdk}|${lib.getLib sgx-psw}|' \
+        )" \
+        $out/bin/TestApp
+    fi
+  '';
+
+  meta = {
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "TestApp";
+  };
+}
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index edd11143ad609..9cdc5dcd9d44d 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -150,6 +150,10 @@
 , withUserDb ? true
 , withUtmp ? !stdenv.hostPlatform.isMusl
 , withVmspawn ? true
+  # kernel-install shouldn't usually be used on NixOS, but can be useful, e.g. for
+  # building disk images for non-NixOS systems. To save users from trying to use it
+  # on their live NixOS system, we disable it by default.
+, withKernelInstall ? false
   # tests assume too much system access for them to be feasible for us right now
 , withTests ? false
   # build only libudev and libsystemd
@@ -628,6 +632,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "efi" withEfi)
     (lib.mesonBool "utmp" withUtmp)
     (lib.mesonBool "log-trace" withLogTrace)
+    (lib.mesonBool "kernel-install" withKernelInstall)
     (lib.mesonBool "quotacheck" false)
     (lib.mesonBool "ldconfig" false)
     (lib.mesonBool "install-sysconfdir" false)
@@ -819,7 +824,7 @@ stdenv.mkDerivation (finalAttrs: {
     done
 
     rm -rf $out/etc/rpm
-
+  '' + lib.optionalString (!withKernelInstall) ''
     # "kernel-install" shouldn't be used on NixOS.
     find $out -name "*kernel-install*" -exec rm {} \;
   '' + lib.optionalString (!withDocumentation) ''
diff --git a/pkgs/os-specific/linux/tiscamera/default.nix b/pkgs/os-specific/linux/tiscamera/default.nix
index 600655c447f7d..8847a83d53d77 100644
--- a/pkgs/os-specific/linux/tiscamera/default.nix
+++ b/pkgs/os-specific/linux/tiscamera/default.nix
@@ -18,7 +18,7 @@
 , glib
 , gobject-introspection
 , gst_all_1
-, wrapGAppsHook
+, wrapGAppsHook3
   # needs pkg_resources
 , withDoc ? false
 , sphinx
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapGAppsHook
+    wrapGAppsHook3
     gobject-introspection
   ] ++ lib.optionals withDoc [
     sphinx
@@ -112,7 +112,7 @@ stdenv.mkDerivation rec {
   # gstreamer tests requires, besides gst-plugins-bad, plugins installed by this expression.
   checkPhase = "ctest --force-new-ctest-process -E gstreamer";
 
-  # wrapGAppsHook: make sure we add ourselves to the introspection
+  # wrapGAppsHook3: make sure we add ourselves to the introspection
   # and gstreamer paths.
   GI_TYPELIB_PATH = "${placeholder "out"}/lib/girepository-1.0";
   GST_PLUGIN_SYSTEM_PATH_1_0 = "${placeholder "out"}/lib/gstreamer-1.0";
diff --git a/pkgs/os-specific/linux/tuna/default.nix b/pkgs/os-specific/linux/tuna/default.nix
index b57169369ca72..3b527c8b534fe 100644
--- a/pkgs/os-specific/linux/tuna/default.nix
+++ b/pkgs/os-specific/linux/tuna/default.nix
@@ -9,7 +9,7 @@
 , gtk3
 , python-linux-procfs
 , python-ethtool
-, wrapGAppsHook
+, wrapGAppsHook3
 }:
 
 buildPythonApplication rec {
@@ -37,7 +37,7 @@ buildPythonApplication rec {
     glib.dev
     gobject-introspection
     gtk3
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   propagatedBuildInputs = [ pygobject3 python-linux-procfs python-ethtool ];
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index 3b08318c965ea..8a1d79a9d7bdd 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , makeWrapper
 , pkg-config
 , libxslt
@@ -33,7 +32,7 @@ assert withDocs -> withIntrospection;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "upower";
-  version = "1.90.2";
+  version = "1.90.4";
 
   outputs = [ "out" "dev" "installedTests" ]
     ++ lib.optionals withDocs [ "devdoc" ];
@@ -43,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upower";
     repo = "upower";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7WzMAJuf1czU8ZalsEU/NwCXYqTGvcqEqxFt5ocgt48=";
+    hash = "sha256-5twHuDLisVF07Y5KYwlqWMi12+p6UpARJvoBN/+tX2o=";
   };
 
   patches = lib.optionals (stdenv.hostPlatform.system == "i686-linux") [
@@ -52,10 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./i686-test-remove-battery-check.patch
   ] ++ [
     ./installed-tests-path.patch
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/upower/upower/-/merge_requests/207.diff";
-      hash = "sha256-ldr1bKbSAdYpwbbe/Iq9i0Q9zQrHWvIvBGym/F3+vxs=";
-    })
   ];
 
   strictDeps = true;
diff --git a/pkgs/os-specific/linux/waydroid/default.nix b/pkgs/os-specific/linux/waydroid/default.nix
index ae42c206280da..5e29b911ca548 100644
--- a/pkgs/os-specific/linux/waydroid/default.nix
+++ b/pkgs/os-specific/linux/waydroid/default.nix
@@ -12,7 +12,7 @@
 , iproute2
 , iptables
 , util-linux
-, wrapGAppsHook
+, wrapGAppsHook3
 , wl-clipboard
 , runtimeShell
 }:
@@ -39,7 +39,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gobject-introspection
-    wrapGAppsHook
+    wrapGAppsHook3
   ];
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/zenmonitor/default.nix b/pkgs/os-specific/linux/zenmonitor/default.nix
index e8fce959c8dc9..8101f47c6a241 100644
--- a/pkgs/os-specific/linux/zenmonitor/default.nix
+++ b/pkgs/os-specific/linux/zenmonitor/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, gtk3, wrapGAppsHook3 }:
 
 stdenv.mkDerivation rec {
   pname = "zenmonitor";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ gtk3 ];
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];