about summary refs log tree commit diff
path: root/pkgs/tools
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/tools')
-rw-r--r--pkgs/tools/admin/exoscale-cli/default.nix4
-rw-r--r--pkgs/tools/admin/wander/default.nix4
-rw-r--r--pkgs/tools/backup/gphotos-sync/default.nix2
-rw-r--r--pkgs/tools/backup/rustic-rs/default.nix12
-rw-r--r--pkgs/tools/filesystems/duperemove/default.nix5
-rw-r--r--pkgs/tools/misc/mapcidr/default.nix6
-rw-r--r--pkgs/tools/misc/mcrypt/default.nix4
-rw-r--r--pkgs/tools/misc/mods/default.nix8
-rw-r--r--pkgs/tools/misc/qrscan/default.nix6
-rw-r--r--pkgs/tools/misc/t1utils/default.nix9
-rw-r--r--pkgs/tools/misc/tbls/default.nix4
-rw-r--r--pkgs/tools/misc/trash-cli/default.nix4
-rw-r--r--pkgs/tools/networking/dd-agent/datadog-agent.nix1
-rw-r--r--pkgs/tools/networking/ddns-go/default.nix4
-rw-r--r--pkgs/tools/networking/muffet/default.nix6
-rw-r--r--pkgs/tools/networking/netbird/default.nix2
-rw-r--r--pkgs/tools/networking/ngrep/default.nix10
-rw-r--r--pkgs/tools/networking/ockam/default.nix6
-rw-r--r--pkgs/tools/networking/ooniprobe-cli/default.nix6
-rw-r--r--pkgs/tools/networking/wol/default.nix1
-rw-r--r--pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py4
-rw-r--r--pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py89
-rw-r--r--pkgs/tools/package-management/disnix/DisnixWebService/default.nix23
-rw-r--r--pkgs/tools/package-management/dnf5/default.nix38
-rw-r--r--pkgs/tools/security/certinfo/default.nix29
-rw-r--r--pkgs/tools/security/cfripper/default.nix4
-rw-r--r--pkgs/tools/security/exploitdb/default.nix4
-rw-r--r--pkgs/tools/security/gopass/default.nix6
-rw-r--r--pkgs/tools/security/gopass/git-credential.nix6
-rw-r--r--pkgs/tools/security/gopass/hibp.nix6
-rw-r--r--pkgs/tools/security/gopass/jsonapi.nix6
-rw-r--r--pkgs/tools/security/gopass/summon.nix6
-rw-r--r--pkgs/tools/security/govulncheck/default.nix9
-rw-r--r--pkgs/tools/security/govulncheck/version.patch15
-rw-r--r--pkgs/tools/security/hashcat/default.nix6
-rw-r--r--pkgs/tools/security/iaito/default.nix2
-rw-r--r--pkgs/tools/security/kubesec/default.nix6
-rw-r--r--pkgs/tools/security/pass/wofi-pass.nix65
-rw-r--r--pkgs/tools/security/sigma-cli/default.nix6
-rw-r--r--pkgs/tools/security/zsteg/Gemfile.lock22
-rw-r--r--pkgs/tools/security/zsteg/default.nix3
-rw-r--r--pkgs/tools/security/zsteg/gemset.nix49
-rw-r--r--pkgs/tools/system/augeas/bootstrap.diff15
-rw-r--r--pkgs/tools/system/augeas/default.nix56
-rw-r--r--pkgs/tools/system/osquery/Use-locale.h-instead-of-removed-xlocale.h-header.patch31
-rw-r--r--pkgs/tools/system/osquery/default.nix10
-rw-r--r--pkgs/tools/typesetting/psutils/default.nix5
-rw-r--r--pkgs/tools/video/lux/default.nix6
48 files changed, 483 insertions, 148 deletions
diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
index e7d889e9009c3..f400d7f537c74 100644
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "exoscale-cli";
-  version = "1.74.4";
+  version = "1.75.0";
 
   src = fetchFromGitHub {
     owner = "exoscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-PzjIcdzEmX+0PRurOX5ZQ4LQnBny9Av8eKhPsyiZb6c=";
+    sha256 = "sha256-9BGcP35nTEHccDKLIBNgZbU2xjtFAKtEHLRt8kTlgv0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/tools/admin/wander/default.nix b/pkgs/tools/admin/wander/default.nix
index ae044374874f4..fa7ddbd832e0b 100644
--- a/pkgs/tools/admin/wander/default.nix
+++ b/pkgs/tools/admin/wander/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "wander";
-  version = "0.11.2";
+  version = "0.12.6";
 
   src = fetchFromGitHub {
     owner = "robinovitch61";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zAvPtTUrSHeIMy9MgJviyMvMJ0Ny5Nkx6oLwWPSc9bE=";
+    sha256 = "sha256-DYlbMdh5vgf3PjHVRU7F31upOe4QX5t2D3YdR3e736I=";
   };
 
   vendorHash = "sha256-SqDGXV8MpvEQFAkcE1NWvWjdzYsvbO5vA6k+hpY0js0=";
diff --git a/pkgs/tools/backup/gphotos-sync/default.nix b/pkgs/tools/backup/gphotos-sync/default.nix
index 27caf6df4db00..53db44bb2e11f 100644
--- a/pkgs/tools/backup/gphotos-sync/default.nix
+++ b/pkgs/tools/backup/gphotos-sync/default.nix
@@ -32,6 +32,7 @@ python3.pkgs.buildPythonApplication rec {
   nativeBuildInputs = with python3.pkgs; [
     pythonRelaxDepsHook
     setuptools
+    setuptools-scm
     wheel
   ];
 
@@ -61,7 +62,6 @@ python3.pkgs.buildPythonApplication rec {
   nativeCheckInputs = with python3.pkgs; [
     mock
     pytestCheckHook
-    setuptools-scm
   ];
 
   preCheck = ''
diff --git a/pkgs/tools/backup/rustic-rs/default.nix b/pkgs/tools/backup/rustic-rs/default.nix
index ed4dc0eee42da..c6159a899b048 100644
--- a/pkgs/tools/backup/rustic-rs/default.nix
+++ b/pkgs/tools/backup/rustic-rs/default.nix
@@ -1,4 +1,12 @@
-{ lib, fetchFromGitHub, rustPlatform, stdenv, Security, installShellFiles, nix-update-script }:
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, stdenv
+, Security
+, SystemConfiguration
+, installShellFiles
+, nix-update-script
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "rustic-rs";
@@ -15,7 +23,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
   postInstall = ''
     for shell in {ba,fi,z}sh; do
diff --git a/pkgs/tools/filesystems/duperemove/default.nix b/pkgs/tools/filesystems/duperemove/default.nix
index a22ed2f6f77c6..c1d8602568042 100644
--- a/pkgs/tools/filesystems/duperemove/default.nix
+++ b/pkgs/tools/filesystems/duperemove/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "duperemove";
-  version = "0.14";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "markfasheh";
     repo = "duperemove";
     rev = "v${version}";
-    hash = "sha256-hYBD5XFjM2AEsQm7yKEHkfjwLZmXTxkY/6S3hs1uBPw=";
+    hash = "sha256-iMv80UKktYOhNfVA3mW6kKv8TwLZaP6MQt24t3Rchk4=";
   };
 
   postPatch = ''
@@ -33,7 +33,6 @@ stdenv.mkDerivation rec {
   makeFlags = [
     "PREFIX=${placeholder "out"}"
     "VERSION=v${version}"
-    "CFLAGS=-Wno-error=format-security"
   ];
 
   passthru.tests.version = testers.testVersion {
diff --git a/pkgs/tools/misc/mapcidr/default.nix b/pkgs/tools/misc/mapcidr/default.nix
index 2cb179fac94dd..b998684d2a51f 100644
--- a/pkgs/tools/misc/mapcidr/default.nix
+++ b/pkgs/tools/misc/mapcidr/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "mapcidr";
-  version = "1.1.14";
+  version = "1.1.16";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Vhh/OS61dfArsowXMogr/bu/gg354nte9PuobD9lCaU=";
+    hash = "sha256-O0HVlrLOz4+hxhf/BTSZs0qDCbYokbzmg5KbzUD1UHg=";
   };
 
-  vendorHash = "sha256-wqbAOoRQEE7CDmaH5MRzsSKOdyrxwBY/1wDz3MCfsBc=";
+  vendorHash = "sha256-j/3Z2KxbybJoE6/PXkwMLivzmTnZSi7tgO8IQKCoaEQ=";
 
   modRoot = ".";
   subPackages = [
diff --git a/pkgs/tools/misc/mcrypt/default.nix b/pkgs/tools/misc/mcrypt/default.nix
index ef5b8e56fa0a9..c5013eb46a045 100644
--- a/pkgs/tools/misc/mcrypt/default.nix
+++ b/pkgs/tools/misc/mcrypt/default.nix
@@ -19,6 +19,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libmcrypt libmhash ];
 
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+  };
+
   meta = {
     description = "Replacement for old UNIX crypt(1)";
     longDescription = ''
diff --git a/pkgs/tools/misc/mods/default.nix b/pkgs/tools/misc/mods/default.nix
index ecb306d4aef67..c2700e33b8596 100644
--- a/pkgs/tools/misc/mods/default.nix
+++ b/pkgs/tools/misc/mods/default.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "mods";
-  version = "0.2.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "mods";
     rev = "v${version}";
-    hash = "sha256-jOvXT/KAfSN9E4ZgntCbTu05VJu1jhGtv6gEgLStd98=";
+    hash = "sha256-ZWH3YuN1cmdw96/HVzsp1u70ziUfupUeBjJiNI5a538=";
   };
 
-  vendorHash = "sha256-GNGX8dyTtzRSUznEV/do1H7GEf6nYf0w+CLCZfkktfg=";
+  vendorHash = "sha256-PgaxqfgtwBYnzyL2F/OPJP1rdmLOtBCTKEPhMgvC6XA=";
 
-  ldflags = [ "-s" "-w" "-X=main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
 
   passthru = {
     updateScript = gitUpdater {
diff --git a/pkgs/tools/misc/qrscan/default.nix b/pkgs/tools/misc/qrscan/default.nix
index 91b8cfc18db37..6ac80bb7f746d 100644
--- a/pkgs/tools/misc/qrscan/default.nix
+++ b/pkgs/tools/misc/qrscan/default.nix
@@ -1,4 +1,4 @@
-{ lib, rustPlatform, fetchFromGitHub, stdenv }:
+{ clang_15, lib, rustPlatform, fetchFromGitHub, stdenv }:
 
 rustPlatform.buildRustPackage rec {
   pname = "qrscan";
@@ -12,7 +12,9 @@ rustPlatform.buildRustPackage rec {
   };
 
   nativeBuildInputs = [
-    rustPlatform.bindgenHook
+    (rustPlatform.bindgenHook.overrideAttrs {
+      libclang = clang_15.cc.lib;
+    })
   ];
 
   cargoHash = "sha256-P40IwFRtEQp6BGRgmt1x3UXtAKtWaMjR3kqhYq+p7wQ=";
diff --git a/pkgs/tools/misc/t1utils/default.nix b/pkgs/tools/misc/t1utils/default.nix
index 8e91013521fb3..be9cf659160bd 100644
--- a/pkgs/tools/misc/t1utils/default.nix
+++ b/pkgs/tools/misc/t1utils/default.nix
@@ -20,9 +20,12 @@ stdenv.mkDerivation rec {
       file from a PFA or PFB font.
     '';
     homepage = "https://www.lcdf.org/type/";
-    # README from tarball says "BSD-like" and points to non-existing LICENSE
-    # file...
-    license = "Click"; # MIT with extra clause, https://github.com/kohler/t1utils/blob/master/LICENSE
+    license = {
+      shortName = "Click"; # README.md says BSD-like, see LICENSE
+      url = "https://github.com/kohler/t1utils/blob/master/LICENSE";
+      free = true;
+      redistributable = true;
+    };
     platforms = platforms.all;
     maintainers = [ maintainers.bjornfor ];
   };
diff --git a/pkgs/tools/misc/tbls/default.nix b/pkgs/tools/misc/tbls/default.nix
index f9f334fb1036d..8072b0cb7fe7a 100644
--- a/pkgs/tools/misc/tbls/default.nix
+++ b/pkgs/tools/misc/tbls/default.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "tbls";
-  version = "1.71.0";
+  version = "1.72.0";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     rev = "v${version}";
-    hash = "sha256-cV5t4gNhPODGzJoLZdft6/9gBBVio50BJKYEI24a8qg=";
+    hash = "sha256-FxG8vTbBMgFa+z1/8+ci7UxOfU88JynenZfVBh+0UPM=";
   };
 
   vendorHash = "sha256-1w1pQyHTuEJ1w01lJIZhXuEArFigjoFKGvi0cpFd8m0=";
diff --git a/pkgs/tools/misc/trash-cli/default.nix b/pkgs/tools/misc/trash-cli/default.nix
index 87f36a082b6ad..7b1e286a8ebd3 100644
--- a/pkgs/tools/misc/trash-cli/default.nix
+++ b/pkgs/tools/misc/trash-cli/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "trash-cli";
-  version = "0.23.9.23";
+  version = "0.23.11.10";
 
   src = fetchFromGitHub {
     owner = "andreafrancia";
     repo = "trash-cli";
     rev = version;
-    hash = "sha256-EbW7P9fl7CDA6etOba7qcOtcxB2GkCd+zoi+NW0ZP9c=";
+    hash = "sha256-bP1x+yYAsPQ1vXS3rmHD11UiJ7r/02akb84hr+o8JLs=";
   };
 
   propagatedBuildInputs = with python3Packages; [ psutil six ];
diff --git a/pkgs/tools/networking/dd-agent/datadog-agent.nix b/pkgs/tools/networking/dd-agent/datadog-agent.nix
index 8a40b290ae48b..aac49a7b83b2c 100644
--- a/pkgs/tools/networking/dd-agent/datadog-agent.nix
+++ b/pkgs/tools/networking/dd-agent/datadog-agent.nix
@@ -64,6 +64,7 @@ in buildGoModule rec {
     "process"
     "log"
     "secrets"
+    "zlib"
   ]
   ++ lib.optionals withSystemd [ "systemd" ]
   ++ extraTags;
diff --git a/pkgs/tools/networking/ddns-go/default.nix b/pkgs/tools/networking/ddns-go/default.nix
index fb4adc99fa3c4..84f63e579e62a 100644
--- a/pkgs/tools/networking/ddns-go/default.nix
+++ b/pkgs/tools/networking/ddns-go/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "ddns-go";
-  version = "5.6.4";
+  version = "5.6.6";
 
   src = fetchFromGitHub {
     owner = "jeessy2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-wE4xzAH31yQ8xrA0dI7f961KNwK84gRSit+XNoW37pc=";
+    hash = "sha256-4OBY2Bj23uOBOAHKmOpecFXu0Lr8sLrwiU3/BdHpGOQ=";
   };
 
   vendorHash = "sha256-e4mmUneFZCsteSrxfSeeky/pFc0sgNs0eRVnZQuG1ZI=";
diff --git a/pkgs/tools/networking/muffet/default.nix b/pkgs/tools/networking/muffet/default.nix
index 19458f6461bb8..133eaf3b27ba3 100644
--- a/pkgs/tools/networking/muffet/default.nix
+++ b/pkgs/tools/networking/muffet/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "muffet";
-  version = "2.9.2";
+  version = "2.9.3";
 
   src = fetchFromGitHub {
     owner = "raviqqe";
     repo = "muffet";
     rev = "v${version}";
-    hash = "sha256-M+yId2cNTO1n+E0UmMJK7aLmeDdXnI3McqTxL5EvB+A=";
+    hash = "sha256-w9PoKGxZdP/sKdlTlnWBMqDPDLUvcYubkCyNHUm3AAc=";
   };
 
-  vendorHash = "sha256-NTQlhLlSPh9+Il08T9I2qc+BqIo9RniOFG9Dgeez1QA=";
+  vendorHash = "sha256-2an4xj1gqQqj9NrSdTAss7hn6SiWoiq3RQ2xxUlSuaE=";
 
   meta = with lib; {
     description = "A website link checker which scrapes and inspects all pages in a website recursively";
diff --git a/pkgs/tools/networking/netbird/default.nix b/pkgs/tools/networking/netbird/default.nix
index 0cd954cca3809..c74d080299868 100644
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@@ -89,7 +89,7 @@ buildGoModule rec {
       '')
       modules) + lib.optionalString (stdenv.isLinux && ui) ''
     mkdir -p $out/share/pixmaps
-    cp $src/client/ui/disconnected.png $out/share/pixmaps/netbird.png
+    cp $src/client/ui/netbird-systemtray-default.png $out/share/pixmaps/netbird.png
 
     mkdir -p $out/share/applications
     cp $src/client/ui/netbird.desktop $out/share/applications/netbird.desktop
diff --git a/pkgs/tools/networking/ngrep/default.nix b/pkgs/tools/networking/ngrep/default.nix
index bee8678d1c93e..c44f6e1eb8328 100644
--- a/pkgs/tools/networking/ngrep/default.nix
+++ b/pkgs/tools/networking/ngrep/default.nix
@@ -44,10 +44,12 @@ stdenv.mkDerivation rec {
       more common packet sniffing tools, such as tcpdump and snoop.
     '';
     homepage = "https://github.com/jpr5/ngrep/";
-    # <ngrep>/doc/README.txt says that ngrep itself is licensed under a
-    # 'BSD-like' license but that the 'regex' library (in the ngrep tarball) is
-    # GPLv2.
-    license = "ngrep";  # Some custom BSD-style, see LICENSE.txt
+    license = {
+      shortName = "ngrep";  # BSD-style, see README.md and LICENSE
+      url = "https://github.com/jpr5/ngrep/blob/master/LICENSE";
+      free = true;
+      redistributable = true;
+    };
     platforms = with platforms; linux ++ darwin;
     maintainers = [ maintainers.bjornfor ];
   };
diff --git a/pkgs/tools/networking/ockam/default.nix b/pkgs/tools/networking/ockam/default.nix
index fe5ba72caf68e..fe0bbf374635d 100644
--- a/pkgs/tools/networking/ockam/default.nix
+++ b/pkgs/tools/networking/ockam/default.nix
@@ -12,7 +12,7 @@
 
 let
   pname = "ockam";
-  version = "0.90.0";
+  version = "0.105.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage {
     owner = "build-trust";
     repo = pname;
     rev = "ockam_v${version}";
-    sha256 = "sha256-IblL87YSSTew4UOZEkbPrQ1Zy9x33mfxGG1kg1atxrs=";
+    sha256 = "sha256-YS98elkf1iIslC1dAf+Os2VoA0pmHmkQN0//PtBRBcM=";
   };
 
-  cargoHash = "sha256-/fKqUOa1Dos01IKyIZIjWwpZNXKh+cVoq4s2TUFWkBw=";
+  cargoHash = "sha256-aW+Pc2C7vohUAByrzBiOaJlBPfSLAv0FrOxRiB1AM9k=";
   nativeBuildInputs = [ git pkg-config ];
   buildInputs = [ openssl dbus ]
     ++ lib.optionals stdenv.isDarwin [ Security ];
diff --git a/pkgs/tools/networking/ooniprobe-cli/default.nix b/pkgs/tools/networking/ooniprobe-cli/default.nix
index baf0ba802c0f2..b677b1d1ca01f 100644
--- a/pkgs/tools/networking/ooniprobe-cli/default.nix
+++ b/pkgs/tools/networking/ooniprobe-cli/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "ooniprobe-cli";
-  version = "3.19.0";
+  version = "3.19.1";
 
   src = fetchFromGitHub {
     owner = "ooni";
     repo = "probe-cli";
     rev = "v${version}";
-    hash = "sha256-W3C4KbZnOdljofnlYZk/F6E77/AXjdNTRoWrtoEVfqg=";
+    hash = "sha256-sYIp5zl49waERfTYPfNjbyzep7p4sRlweDVcuTtWB28=";
   };
 
-  vendorHash = "sha256-wEhh0nMdFH9wLfNSxYvbkbtu69cNEmVpQDk57/gdnw8=";
+  vendorHash = "sha256-6RyK0oy9Lcuh2TXpQqAqmrA+bS9hug6+il7L1z+kYvs=";
 
   subPackages = [ "cmd/ooniprobe" ];
 
diff --git a/pkgs/tools/networking/wol/default.nix b/pkgs/tools/networking/wol/default.nix
index 114a8457d5b2c..14cf48ae0dbdd 100644
--- a/pkgs/tools/networking/wol/default.nix
+++ b/pkgs/tools/networking/wol/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
     homepage = "https://sourceforge.net/projects/wake-on-lan/";
     license = licenses.gpl2;
     maintainers = with maintainers; [ makefu ];
+    mainProgram = "wol";
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
index 85513ef48697f..894daf9ca9c75 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
@@ -365,7 +365,7 @@ def _attr_span_plugin(md: markdown_it.MarkdownIt) -> None:
                 return False
             id, classes = parsed_attrs
 
-            token = state.push("attr_span_begin", "span", 1) # type: ignore[no-untyped-call]
+            token = state.push("attr_span_begin", "span", 1)
             if id:
                 token.attrs['id'] = id
             if classes:
@@ -375,7 +375,7 @@ def _attr_span_plugin(md: markdown_it.MarkdownIt) -> None:
             state.posMax = label_end
             state.md.inline.tokenize(state)
 
-            state.push("attr_span_end", "span", -1) # type: ignore[no-untyped-call]
+            state.push("attr_span_end", "span", -1)
 
         state.pos = label_end + match.end() + 1
         state.posMax = input_end
diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
index 2813ffcf8bc0d..d0229e074c543 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
@@ -8,6 +8,7 @@ import xml.sax.saxutils as xml
 from abc import abstractmethod
 from collections.abc import Mapping, Sequence
 from markdown_it.token import Token
+from pathlib import Path
 from typing import Any, Generic, Optional
 from urllib.parse import quote
 
@@ -287,18 +288,27 @@ class ManpageConverter(BaseConverter[OptionsManpageRenderer]):
     _links_in_last_description: Optional[list[str]] = None
 
     def __init__(self, revision: str,
+                 header: list[str] | None,
+                 footer: list[str] | None,
                  *,
                  # only for parallel rendering
                  _options_by_id: Optional[dict[str, str]] = None):
         super().__init__(revision)
         self._options_by_id = _options_by_id or {}
         self._renderer = OptionsManpageRenderer({}, self._options_by_id)
+        self._header = header
+        self._footer = footer
 
     def _parallel_render_prepare(self) -> Any:
-        return (self._revision, { '_options_by_id': self._options_by_id })
+        return (
+            self._revision,
+            self._header,
+            self._footer,
+            { '_options_by_id': self._options_by_id },
+        )
     @classmethod
     def _parallel_render_init_worker(cls, a: Any) -> ManpageConverter:
-        return cls(a[0], **a[1])
+        return cls(a[0], a[1], a[2], **a[3])
 
     def _render_option(self, name: str, option: dict[str, Any]) -> RenderedOption:
         links = self._renderer.link_footnotes = []
@@ -342,26 +352,29 @@ class ManpageConverter(BaseConverter[OptionsManpageRenderer]):
     def finalize(self) -> str:
         result = []
 
-        result += [
-            r'''.TH "CONFIGURATION\&.NIX" "5" "01/01/1980" "NixOS" "NixOS Reference Pages"''',
-            r'''.\" disable hyphenation''',
-            r'''.nh''',
-            r'''.\" disable justification (adjust text to left margin only)''',
-            r'''.ad l''',
-            r'''.\" enable line breaks after slashes''',
-            r'''.cflags 4 /''',
-            r'''.SH "NAME"''',
-            self._render('{file}`configuration.nix` - NixOS system configuration specification'),
-            r'''.SH "DESCRIPTION"''',
-            r'''.PP''',
-            self._render('The file {file}`/etc/nixos/configuration.nix` contains the '
-                        'declarative specification of your NixOS system configuration. '
-                        'The command {command}`nixos-rebuild` takes this file and '
-                        'realises the system configuration specified therein.'),
-            r'''.SH "OPTIONS"''',
-            r'''.PP''',
-            self._render('You can use the following options in {file}`configuration.nix`.'),
-        ]
+        if self._header is not None:
+            result += self._header
+        else:
+            result += [
+                r'''.TH "CONFIGURATION\&.NIX" "5" "01/01/1980" "NixOS" "NixOS Reference Pages"''',
+                r'''.\" disable hyphenation''',
+                r'''.nh''',
+                r'''.\" disable justification (adjust text to left margin only)''',
+                r'''.ad l''',
+                r'''.\" enable line breaks after slashes''',
+                r'''.cflags 4 /''',
+                r'''.SH "NAME"''',
+                self._render('{file}`configuration.nix` - NixOS system configuration specification'),
+                r'''.SH "DESCRIPTION"''',
+                r'''.PP''',
+                self._render('The file {file}`/etc/nixos/configuration.nix` contains the '
+                            'declarative specification of your NixOS system configuration. '
+                            'The command {command}`nixos-rebuild` takes this file and '
+                            'realises the system configuration specified therein.'),
+                r'''.SH "OPTIONS"''',
+                r'''.PP''',
+                self._render('You can use the following options in {file}`configuration.nix`.'),
+            ]
 
         for (name, opt) in self._sorted_options():
             result += [
@@ -383,11 +396,14 @@ class ManpageConverter(BaseConverter[OptionsManpageRenderer]):
 
             result.append(".RE")
 
-        result += [
-            r'''.SH "AUTHORS"''',
-            r'''.PP''',
-            r'''Eelco Dolstra and the Nixpkgs/NixOS contributors''',
-        ]
+        if self._footer is not None:
+            result += self._footer
+        else:
+            result += [
+                r'''.SH "AUTHORS"''',
+                r'''.PP''',
+                r'''Eelco Dolstra and the Nixpkgs/NixOS contributors''',
+            ]
 
         return "\n".join(result)
 
@@ -573,6 +589,8 @@ def _build_cli_db(p: argparse.ArgumentParser) -> None:
 
 def _build_cli_manpage(p: argparse.ArgumentParser) -> None:
     p.add_argument('--revision', required=True)
+    p.add_argument("--header", type=Path)
+    p.add_argument("--footer", type=Path)
     p.add_argument("infile")
     p.add_argument("outfile")
 
@@ -603,7 +621,22 @@ def _run_cli_db(args: argparse.Namespace) -> None:
             f.write(md.finalize())
 
 def _run_cli_manpage(args: argparse.Namespace) -> None:
-    md = ManpageConverter(revision = args.revision)
+    header = None
+    footer = None
+
+    if args.header is not None:
+        with args.header.open() as f:
+            header = f.read().splitlines()
+
+    if args.footer is not None:
+        with args.footer.open() as f:
+            footer = f.read().splitlines()
+
+    md = ManpageConverter(
+        revision = args.revision,
+        header = header,
+        footer = footer,
+    )
 
     with open(args.infile, 'r') as f:
         md.add_options(json.load(f))
diff --git a/pkgs/tools/package-management/disnix/DisnixWebService/default.nix b/pkgs/tools/package-management/disnix/DisnixWebService/default.nix
index 9fd10a3aba081..461c0cacc06a6 100644
--- a/pkgs/tools/package-management/disnix/DisnixWebService/default.nix
+++ b/pkgs/tools/package-management/disnix/DisnixWebService/default.nix
@@ -1,12 +1,25 @@
-{lib, stdenv, fetchurl, apacheAnt, jdk, axis2, dbus_java }:
+{lib, stdenv, fetchFromGitHub, fetchpatch, apacheAnt, jdk, axis2, dbus_java }:
 
 stdenv.mkDerivation rec {
   pname = "DisnixWebService";
   version = "0.10.1";
-  src = fetchurl {
-    url = "https://github.com/svanderburg/DisnixWebService/releases/download/DisnixWebService-${version}/DisnixWebService-${version}.tar.gz";
-    sha256 = "02jxbgn9a0c9cr6knzp78bp9wiywzczy89wav7yxhg79vff8a1gr";
+
+  src = fetchFromGitHub {
+    owner = "svanderburg";
+    repo = "DisnixWebService";
+    rev = "refs/tags/DisnixWebService-${version}";
+    hash = "sha256-zcYr2Ytx4pevSthTQLpnQ330wDxN9dWsZA20jbO6PxQ=";
   };
+
+  patches = [
+    # Correct the DisnixWebService build for compatibility with Axis2 1.8.1
+    # See https://github.com/svanderburg/DisnixWebService/pull/2
+    (fetchpatch {
+      url = "https://github.com/svanderburg/DisnixWebService/commit/cee99c6af744b5dda16728a70ebd2800f61871a0.patch";
+      hash = "sha256-4rSEN8AwivUXUCIUYFBRIoE19jVDv+Vpgakmy8fR06A=";
+    })
+  ];
+
   buildInputs = [ apacheAnt jdk ];
   PREFIX = "\${env.out}";
   AXIS2_LIB = "${axis2}/lib";
@@ -22,6 +35,8 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "A SOAP interface and client for Disnix";
+    homepage = "https://github.com/svanderburg/DisnixWebService";
+    changelog = "https://github.com/svanderburg/DisnixWebService/blob/DisnixWebService-${version}/NEWS.txt";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.sander ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/tools/package-management/dnf5/default.nix b/pkgs/tools/package-management/dnf5/default.nix
index 97c9ba29b6a73..0476da3d5fbd6 100644
--- a/pkgs/tools/package-management/dnf5/default.nix
+++ b/pkgs/tools/package-management/dnf5/default.nix
@@ -3,9 +3,11 @@
 , fetchFromGitHub
 , cmake
 , createrepo_c
+, doxygen
 , gettext
 , help2man
 , pkg-config
+, python3Packages
 , cppunit
 , fmt
 , json_c
@@ -14,27 +16,45 @@
 , libsmartcols
 , libsolv
 , libxml2
+, libyaml
 , pcre2
 , rpm
 , sdbus-cpp
+, sphinx
 , sqlite
 , systemd
+, testers
 , toml11
 , zchunk
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dnf5";
-  version = "5.1.7";
+  version = "5.1.8";
+
+  outputs = [ "out" "man" ];
 
   src = fetchFromGitHub {
     owner = "rpm-software-management";
     repo = "dnf5";
     rev = finalAttrs.version;
-    hash = "sha256-SXgl4YFWl1A3N2/IkDftvBl6Rwhnymxe8AqqaekGHTc=";
+    hash = "sha256-4ht2KraWKL774QPfZz1OgAuFtPVsMis9WiDS+QFP8JY=";
   };
 
-  nativeBuildInputs = [ cmake createrepo_c gettext help2man pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    createrepo_c
+    doxygen
+    gettext
+    help2man
+    pkg-config
+    sphinx
+  ] ++ (with python3Packages; [
+    breathe
+    sphinx-autoapi
+    sphinx-rtd-theme
+  ]);
+
   buildInputs = [
     cppunit
     fmt
@@ -44,6 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
     libsmartcols
     libsolv
     libxml2
+    libyaml
     pcre2.dev
     rpm
     sdbus-cpp
@@ -60,9 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-DWITH_PERL5=OFF"
     "-DWITH_PYTHON3=OFF"
     "-DWITH_RUBY=OFF"
-    "-DWITH_TESTS=OFF"
-    # TODO: fix man installation paths
-    "-DWITH_MAN=OFF"
     "-DWITH_PLUGIN_RHSM=OFF" # Red Hat Subscription Manager plugin
     # the cmake package does not handle absolute CMAKE_INSTALL_INCLUDEDIR correctly
     # (setting it to an absolute path causes include files to go to $out/$out/include,
@@ -71,6 +89,10 @@ stdenv.mkDerivation (finalAttrs: {
     "-DCMAKE_INSTALL_LIBDIR=lib"
   ];
 
+  postBuild = ''
+    make doc
+  '';
+
   prePatch = ''
     substituteInPlace dnf5daemon-server/dbus/CMakeLists.txt \
       --replace '/etc' "$out/etc" \
@@ -83,6 +105,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontFixCmake = true;
 
+  passthru.tests = {
+    version = testers.testVersion { package = finalAttrs.finalPackage; };
+  };
+
   meta = with lib; {
     description = "Next-generation RPM package management system";
     homepage = "https://github.com/rpm-software-management/dnf5";
diff --git a/pkgs/tools/security/certinfo/default.nix b/pkgs/tools/security/certinfo/default.nix
new file mode 100644
index 0000000000000..e0d2a3998a25c
--- /dev/null
+++ b/pkgs/tools/security/certinfo/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, lib, buildGoModule, fetchFromGitHub, libX11, darwin }:
+
+buildGoModule rec {
+  pname = "certinfo";
+  version = "1.0.21";
+
+  src = fetchFromGitHub {
+    owner = "pete911";
+    repo = "certinfo";
+    rev = "v${version}";
+    sha256 = "acAjX4M/egAhGVOeEKw5r2wteA/UsWf9fGR/HnhUr/w=";
+  };
+
+  # clipboard functionality not working on Darwin
+  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
+
+  buildInputs = [ ]
+    ++ lib.optionals stdenv.isLinux [ libX11 ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ];
+
+  vendorHash = null;
+
+  meta = with lib; {
+    description = "Print x509 certificate info";
+    homepage = "https://github.com/pete911/certinfo";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jakuzure ];
+  };
+}
diff --git a/pkgs/tools/security/cfripper/default.nix b/pkgs/tools/security/cfripper/default.nix
index df514d7e2ca5f..440ca40ec68df 100644
--- a/pkgs/tools/security/cfripper/default.nix
+++ b/pkgs/tools/security/cfripper/default.nix
@@ -5,13 +5,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cfripper";
-  version = "1.15.0";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-PXdeep4BYJDLLFnuiBF4YOKHvp6jWr2bDOOUXbbHHR8=";
+    hash = "sha256-Gtg4zoMTOW/nrFm7PF4/96VGcMALg2msVZ3E7lGm5KA=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index f25a2b4c5b708..105a01960d0bd 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-11-21";
+  version = "2023-11-25";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-kRw9djRYFC88EG3bf+sY0ERUBEnqUvXudatG1nuHREg=";
+    hash = "sha256-pgHi2DoQ9xjj/hlQIhXijTWqYPYClL6rWtEl2WsCVDE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/gopass/default.nix b/pkgs/tools/security/gopass/default.nix
index 92c0992c86e6f..10efc22d4a1b8 100644
--- a/pkgs/tools/security/gopass/default.nix
+++ b/pkgs/tools/security/gopass/default.nix
@@ -13,7 +13,7 @@
 
 buildGoModule rec {
   pname = "gopass";
-  version = "1.15.8";
+  version = "1.15.10";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
@@ -21,10 +21,10 @@ buildGoModule rec {
     owner = "gopasspw";
     repo = "gopass";
     rev = "v${version}";
-    hash = "sha256-l8Ce0ioMnSlet+PMrQCMvyH3IvmQaE1MQSJR9myyLB8=";
+    hash = "sha256-6s4rg2+oC+RB2gE4FQIY2MPmFSh+RxiZxaIuMI/T8hE=";
   };
 
-  vendorHash = "sha256-xyQTlbTPAC2iG8XQ4oEHBXjfXauwuBhaTbsew23nlVw=";
+  vendorHash = "sha256-tbZpNraGVC+p6O1MOh4vPmcwUgW5ykg7rGTNOWKFk0M=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/gopass/git-credential.nix b/pkgs/tools/security/gopass/git-credential.nix
index 5c38ed942233e..038cdaf84167b 100644
--- a/pkgs/tools/security/gopass/git-credential.nix
+++ b/pkgs/tools/security/gopass/git-credential.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "git-credential-gopass";
-  version = "1.15.9";
+  version = "1.15.10";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "git-credential-gopass";
     rev = "v${version}";
-    hash = "sha256-8gHOWi4Xa5McbKVWborclgFqOpuQApUDW9wV849855I=";
+    hash = "sha256-DQPjnCwpFOKN0ObPXPbwy7GK1VsPSj+pcLKjfSPPPRo=";
   };
 
-  vendorHash = "sha256-znmBV6sLx0g7zKkkv3S4TfVQu79ch5epq8l2uImF/Go=";
+  vendorHash = "sha256-gvnBlf0JfdrHSHTF+OQxBHFER5F910mruzCa/prvIYA=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/gopass/hibp.nix b/pkgs/tools/security/gopass/hibp.nix
index c114f541c7204..79a72bf891f81 100644
--- a/pkgs/tools/security/gopass/hibp.nix
+++ b/pkgs/tools/security/gopass/hibp.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gopass-hibp";
-  version = "1.15.9";
+  version = "1.15.10";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-hibp";
     rev = "v${version}";
-    hash = "sha256-ngLtxzRupvQF5BERdHhq+Ywf8F2rBpBSx/eH/JgA+IY=";
+    hash = "sha256-v3FtWBi5H9LiFN/mowufonABr+aV3Z8MWBKiIUoy0NE=";
   };
 
-  vendorHash = "sha256-yvimjsDaEXXLBUHtCovNSz4GUQ9TlvAogMgw+HSX0Mg=";
+  vendorHash = "sha256-c4kk1RrvB+c+8IfbIsLRvG7O3cy+u9l+pDZ52XX1AhI=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/gopass/jsonapi.nix b/pkgs/tools/security/gopass/jsonapi.nix
index 9301b2cf6d13d..21345240a6475 100644
--- a/pkgs/tools/security/gopass/jsonapi.nix
+++ b/pkgs/tools/security/gopass/jsonapi.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "gopass-jsonapi";
-  version = "1.15.9";
+  version = "1.15.10";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-jsonapi";
     rev = "v${version}";
-    hash = "sha256-p1z1jFk+Fmh7kMyMI5kMCkmp62q/CC8BqsbHHpfGWaI=";
+    hash = "sha256-3E55MNS9QBLeae+Dc7NqbVMGie6NUKMBMGvkMqKeWoE=";
   };
 
-  vendorHash = "sha256-bFHm2mSWI00lVAfFK8DSjt0hgM52IycpHGRADk0QSoQ=";
+  vendorHash = "sha256-sarNWeBi93oXL9v2EkP/z2+Bd4TyNy+z6576hOCf1/Q=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/gopass/summon.nix b/pkgs/tools/security/gopass/summon.nix
index 25e41df7437da..48740f91954c5 100644
--- a/pkgs/tools/security/gopass/summon.nix
+++ b/pkgs/tools/security/gopass/summon.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gopass-summon-provider";
-  version = "1.15.9";
+  version = "1.15.10";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-summon-provider";
     rev = "v${version}";
-    hash = "sha256-Ob/G1xDAgPlh2aM+TwbpycqhTodHNs97pvBpCWTYxXE=";
+    hash = "sha256-S4BPUl7KuRakHr2fvNobChfevFw1UAbAdpFUkwXcmxs=";
   };
 
-  vendorHash = "sha256-znmBV6sLx0g7zKkkv3S4TfVQu79ch5epq8l2uImF/Go=";
+  vendorHash = "sha256-gvnBlf0JfdrHSHTF+OQxBHFER5F910mruzCa/prvIYA=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/govulncheck/default.nix b/pkgs/tools/security/govulncheck/default.nix
index 61249d354df19..1b7ee6cf015da 100644
--- a/pkgs/tools/security/govulncheck/default.nix
+++ b/pkgs/tools/security/govulncheck/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, substituteAll
 }:
 
 buildGoModule rec {
@@ -14,6 +15,14 @@ buildGoModule rec {
     hash = "sha256-cewQ03dK/k3mXevE09M01Yox/3ZWP6IrG0H4QsZMzy8=";
   };
 
+  patches = [
+    # patch in version information
+    (substituteAll {
+      src = ./version.patch;
+      inherit version;
+    })
+  ];
+
   vendorHash = "sha256-r9XshbgVA5rppJF46SFYPad344ZHMLWTHTnL6vbIFH8=";
 
   subPackages = [
diff --git a/pkgs/tools/security/govulncheck/version.patch b/pkgs/tools/security/govulncheck/version.patch
new file mode 100644
index 0000000000000..2a79276fa15aa
--- /dev/null
+++ b/pkgs/tools/security/govulncheck/version.patch
@@ -0,0 +1,15 @@
+diff --git a/internal/scan/run.go b/internal/scan/run.go
+index fa7fe37..216ca43 100644
+--- a/internal/scan/run.go
++++ b/internal/scan/run.go
+@@ -99,8 +99,8 @@ func scannerVersion(cfg *config, bi *debug.BuildInfo) {
+ 	if bi.Path != "" {
+ 		cfg.ScannerName = path.Base(bi.Path)
+ 	}
+-	if bi.Main.Version != "" && bi.Main.Version != "(devel)" {
+-		cfg.ScannerVersion = bi.Main.Version
++	if true {
++		cfg.ScannerVersion = "@version@"
+ 		return
+ 	}
+ 
diff --git a/pkgs/tools/security/hashcat/default.nix b/pkgs/tools/security/hashcat/default.nix
index 5a2304b5fd0bf..2e8370be85fe2 100644
--- a/pkgs/tools/security/hashcat/default.nix
+++ b/pkgs/tools/security/hashcat/default.nix
@@ -21,8 +21,14 @@ stdenv.mkDerivation rec {
   };
 
   postPatch = ''
+     # Select libstdc++ or libc++ based on stdenv
+     # MACOSX_DEPLOYMENT_TARGET is defined by the enviroment
      # Remove hardcoded paths on darwin
     substituteInPlace src/Makefile \
+  '' + lib.optionalString (stdenv.cc.libcxx != null) ''
+      --replace "-lstdc++" "-lc++ -l${stdenv.cc.libcxx.cxxabi.libName}" \
+  '' + ''
+      --replace "export MACOSX_DEPLOYMENT_TARGET" "#export MACOSX_DEPLOYMENT_TARGET" \
       --replace "/usr/bin/ar" "ar" \
       --replace "/usr/bin/sed" "sed" \
       --replace '-i ""' '-i'
diff --git a/pkgs/tools/security/iaito/default.nix b/pkgs/tools/security/iaito/default.nix
index 641f7edf2406d..5812b1e6cfeab 100644
--- a/pkgs/tools/security/iaito/default.nix
+++ b/pkgs/tools/security/iaito/default.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     install -m755 -Dt $out/bin iaito
     install -m644 -Dt $out/share/metainfo ../org.radare.iaito.appdata.xml
     install -m644 -Dt $out/share/applications ../org.radare.iaito.desktop
-    install -m644 -Dt $out/share/pixmaps ../img/iaito-o.svg
+    install -m644 -Dt $out/share/pixmaps ../img/org.radare.iaito.svg
 
     pushd ../../../${translations_src.name}
     make install -j$NIX_BUILD_CORES PREFIX=$out
diff --git a/pkgs/tools/security/kubesec/default.nix b/pkgs/tools/security/kubesec/default.nix
index a2b7078896ac4..4fa9337e1cb5e 100644
--- a/pkgs/tools/security/kubesec/default.nix
+++ b/pkgs/tools/security/kubesec/default.nix
@@ -6,15 +6,15 @@
 
 buildGoModule rec {
   pname = "kubesec";
-  version = "2.13.0";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9WhY1mJawMkSgqM50DO0y9bxGYW89N14gLirO5zVuzc=";
+    sha256 = "sha256-RNLvmoHna5EO0/p24opBagyWzzNbmFkWGzkUXirdWe0=";
   };
-  vendorHash = "sha256-xcIFveR0MwpYGYhHKXwQPHF08620yilEtb+BdKZWrdw=";
+  vendorHash = "sha256-+Y5k9PRxnBR3lqi4T+3DH4Pw+cyHtt9+9OX4aw0CVl0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/security/pass/wofi-pass.nix b/pkgs/tools/security/pass/wofi-pass.nix
new file mode 100644
index 0000000000000..f205d8881e516
--- /dev/null
+++ b/pkgs/tools/security/pass/wofi-pass.nix
@@ -0,0 +1,65 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pass-wayland
+, coreutils
+, gnugrep
+, libnotify
+, pwgen
+, findutils
+, makeWrapper
+, wl-clipboard
+, wtype
+, wofi
+, extensions ? exts: []
+}:
+
+let
+  wrapperPath = lib.makeBinPath [
+    coreutils
+    findutils
+    gnugrep
+    libnotify
+    pwgen
+    wofi
+    wl-clipboard
+    wtype
+    (pass-wayland.withExtensions extensions)
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "wofi-pass";
+  version = "23.1.2";
+
+  src = fetchFromGitHub {
+    owner = "schmidtandreas";
+    repo = "wofi-pass";
+    rev = "v${version}";
+    sha256 = "sha256-Z1a+nfnL6NXhufpCU7VIkwuifoS88Pf9qI8GCuP/Zqc=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    install -Dm755 wofi-pass -t $out/bin
+    install -Dm755 wofi-pass.conf -t $out/share/doc/wofi-pass/wofi-pass.conf
+  '';
+
+  fixupPhase = ''
+    patchShebangs $out/bin
+
+    wrapProgram $out/bin/wofi-pass \
+      --prefix PATH : "${wrapperPath}"
+  '';
+
+  meta = {
+    description = "A script to make wofi work with password-store";
+    homepage = "https://github.com/schmidtandreas/wofi-pass";
+    maintainers = with lib.maintainers; [ akechishiro ];
+    license = lib.licenses.gpl2Plus;
+    platforms = with lib.platforms; linux;
+    mainProgram = "wofi-pass";
+  };
+}
diff --git a/pkgs/tools/security/sigma-cli/default.nix b/pkgs/tools/security/sigma-cli/default.nix
index 30954f4c171b2..d0dc599edd8c1 100644
--- a/pkgs/tools/security/sigma-cli/default.nix
+++ b/pkgs/tools/security/sigma-cli/default.nix
@@ -6,7 +6,7 @@
 python3.pkgs.buildPythonApplication rec {
   pname = "sigma-cli";
   version = "0.7.10";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
@@ -55,6 +55,10 @@ python3.pkgs.buildPythonApplication rec {
     "test_plugin_show_identifier"
     "test_plugin_show_nonexisting"
     "test_plugin_show_uuid"
+    # Tests compare STDOUT results
+    "test_check_valid"
+    "test_check_stdin"
+    "test_check_exclude"
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/tools/security/zsteg/Gemfile.lock b/pkgs/tools/security/zsteg/Gemfile.lock
index b611fb93f5a9d..0cd593f60a0ff 100644
--- a/pkgs/tools/security/zsteg/Gemfile.lock
+++ b/pkgs/tools/security/zsteg/Gemfile.lock
@@ -1,13 +1,19 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    iostruct (0.0.4)
-    rainbow (3.0.0)
-    zpng (0.3.1)
-      rainbow
-    zsteg (0.2.2)
-      iostruct
-      zpng (>= 0.3.1)
+    forwardable (1.3.3)
+    iostruct (0.0.5)
+    prime (0.1.2)
+      forwardable
+      singleton
+    rainbow (3.1.1)
+    singleton (0.2.0)
+    zpng (0.4.5)
+      rainbow (~> 3.1.1)
+    zsteg (0.2.13)
+      iostruct (>= 0.0.5)
+      prime
+      zpng (>= 0.4.5)
 
 PLATFORMS
   ruby
@@ -16,4 +22,4 @@ DEPENDENCIES
   zsteg
 
 BUNDLED WITH
-   2.1.4
+   2.4.13
diff --git a/pkgs/tools/security/zsteg/default.nix b/pkgs/tools/security/zsteg/default.nix
index e47f285de70a7..a2134d468f000 100644
--- a/pkgs/tools/security/zsteg/default.nix
+++ b/pkgs/tools/security/zsteg/default.nix
@@ -11,6 +11,7 @@ bundlerApp {
     description = "Detect stegano-hidden data in PNG & BMP.";
     homepage = "http://zed.0xff.me/";
     license = licenses.mit;
-    maintainers = with maintainers; [ applePrincess ];
+    maintainers = with maintainers; [ applePrincess h7x4 ];
+    mainProgram = "zsteg";
   };
 }
diff --git a/pkgs/tools/security/zsteg/gemset.nix b/pkgs/tools/security/zsteg/gemset.nix
index 4f5bd79ce44c7..5cb55829a6acd 100644
--- a/pkgs/tools/security/zsteg/gemset.nix
+++ b/pkgs/tools/security/zsteg/gemset.nix
@@ -1,23 +1,54 @@
 {
+  forwardable = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1b5g1i3xdvmxxpq4qp0z4v78ivqnazz26w110fh4cvzsdayz8zgi";
+      type = "gem";
+    };
+    version = "1.3.3";
+  };
   iostruct = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kwp6ryis32j3z7myw8g7v1yszwrwyl04g2c7flr42pwxga1afxc";
+      sha256 = "1z3vnb8mhzns3ybf78vlj5cy6lq4pyfm8n40kqba2s33xccs3kl0";
       type = "gem";
     };
-    version = "0.0.4";
+    version = "0.0.5";
+  };
+  prime = {
+    dependencies = ["forwardable" "singleton"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1973kz8lbck6ga5v42f55jk8b8pnbgwp9p67dl1xw15gvz55dsfl";
+      type = "gem";
+    };
+    version = "0.1.2";
   };
   rainbow = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bb2fpjspydr6x0s8pn1pqkzmxszvkfapv0p4627mywl7ky4zkhk";
+      sha256 = "0smwg4mii0fm38pyb5fddbmrdpifwv22zv3d3px2xx497am93503";
+      type = "gem";
+    };
+    version = "3.1.1";
+  };
+  singleton = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qq54imvbksnckzf9hrq9bjzcdb0n8wfv6l5jc0di10n88277jx6";
       type = "gem";
     };
-    version = "3.0.0";
+    version = "0.2.0";
   };
   zpng = {
     dependencies = ["rainbow"];
@@ -25,20 +56,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0ciyab7qxqsxjhfvr6rbpdzg655fi1zygqg9sd9m6wmgc037dj74";
+      sha256 = "0xyr7ipgls7wci1gnsz340idm69jls0gind0q4f63ccjwgzsfkqw";
       type = "gem";
     };
-    version = "0.3.1";
+    version = "0.4.5";
   };
   zsteg = {
-    dependencies = ["iostruct" "zpng"];
+    dependencies = ["iostruct" "prime" "zpng"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mwajlsgs27449n2yf2f9hz8g46qv9bz9f58i9cz1jg58spvpxpk";
+      sha256 = "128kbv9vsi288mj17zwvc45ijpzf3p116vk9kcvkz978hz0n6spm";
       type = "gem";
     };
-    version = "0.2.2";
+    version = "0.2.13";
   };
 }
diff --git a/pkgs/tools/system/augeas/bootstrap.diff b/pkgs/tools/system/augeas/bootstrap.diff
new file mode 100644
index 0000000000000..3740134c54788
--- /dev/null
+++ b/pkgs/tools/system/augeas/bootstrap.diff
@@ -0,0 +1,15 @@
+diff --git a/bootstrap b/bootstrap
+index a84eb39..cac656d 100755
+--- a/bootstrap
++++ b/bootstrap
+@@ -53,9 +53,6 @@ case ${GNULIB_SRCDIR--} in
+     echo "$0: getting gnulib files..."
+     git submodule update || exit $?
+     GNULIB_SRCDIR=.gnulib
+-  else
+-    echo >&2 "$0: invalid gnulib srcdir: $GNULIB_SRCDIR"
+-    exit 1
+   fi
+   ;;
+ esac
+
diff --git a/pkgs/tools/system/augeas/default.nix b/pkgs/tools/system/augeas/default.nix
index bea2edd553d4b..e30de64f5ad17 100644
--- a/pkgs/tools/system/augeas/default.nix
+++ b/pkgs/tools/system/augeas/default.nix
@@ -1,23 +1,65 @@
-{ lib, stdenv, fetchurl, pkg-config, readline, libxml2 }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, bison
+, flex
+, perl # for pod2man
+, pkg-config
+, readline
+, libxml2
+}:
 
 stdenv.mkDerivation rec {
   pname = "augeas";
-  version = "1.12.0";
+  version = "1.14.1";
 
-  src = fetchurl {
-    url = "http://download.augeas.net/${pname}-${version}.tar.gz";
-    sha256 = "11ybhb13wkkilsn7b416a1dn61m1xrq0lbdpkhp5w61jrk4l469j";
+  src = fetchFromGitHub {
+    owner = "hercules-team";
+    repo = "augeas";
+    rev = "release-${version}";
+    fetchSubmodules = true;
+    hash = "sha256-U5tm3LDUeI/idHtL2Zy33BigkyvHunXPjToDC59G9VE=";
   };
-  nativeBuildInputs = [ pkg-config ];
+
+  patches = [
+    # already have the submodules so don't fail when .git doesn't exist.
+    ./bootstrap.diff
+  ];
+
+  postPatch = ''
+    ./bootstrap --gnulib-srcdir=.gnulib
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+    flex
+    perl
+    pkg-config
+  ];
+
   buildInputs = [ readline libxml2 ];
 
   enableParallelBuilding = true;
 
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+    patchShebangs --build gnulib/tests tests
+    make -j $NIX_BUILD_CORES check
+    runHook postCheck
+  '';
+
+  outputs = [ "out" "dev" ];
+
   meta = with lib; {
     description = "Configuration editing tool";
     license = licenses.lgpl21Only;
     homepage = "https://augeas.net/";
-    changelog = "https://augeas.net/news.html";
+    changelog = "https://github.com/hercules-team/augeas/releases/tag/release-${version}";
+    mainProgram = "augtool";
     maintainers = with maintainers; [ offline ];
     platforms = platforms.unix;
   };
diff --git a/pkgs/tools/system/osquery/Use-locale.h-instead-of-removed-xlocale.h-header.patch b/pkgs/tools/system/osquery/Use-locale.h-instead-of-removed-xlocale.h-header.patch
index 63dd5a387f30e..6c67653090533 100644
--- a/pkgs/tools/system/osquery/Use-locale.h-instead-of-removed-xlocale.h-header.patch
+++ b/pkgs/tools/system/osquery/Use-locale.h-instead-of-removed-xlocale.h-header.patch
@@ -1,15 +1,21 @@
-From: Jack Baldry <jack.baldry@grafana.com>
-Date: Tue, 15 Nov 2022 14:34:33 -0400
-Subject: [PATCH] Use locale.h instead of removed xlocale.h header
-
-https://sourceware.org/glibc/wiki/Release/2.26#Removal_of_.27xlocale.h.27
-
-Signed-off-by: Jack Baldry <jack.baldry@grafana.com>
----
- libraries/cmake/source/augeas/gnulib/generated/linux/x86_64/lib/locale.h  | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
+diff --git a/libraries/cmake/source/augeas/gnulib/generated/linux/aarch64/lib/locale.h b/libraries/cmake/source/augeas/gnulib/generated/linux/aarch64/lib/locale.h
+index 4f9baece2..afe947956 100644
+--- a/libraries/cmake/source/augeas/gnulib/generated/linux/aarch64/lib/locale.h
++++ b/libraries/cmake/source/augeas/gnulib/generated/linux/aarch64/lib/locale.h
+@@ -48,9 +48,9 @@
+ /* NetBSD 5.0 mis-defines NULL.  */
+ #include <stddef.h>
+ 
+-/* Mac OS X 10.5 defines the locale_t type in <xlocale.h>.  */
++/* Mac OS X 10.5 defines the locale_t type in <locale.h>.  */
+ #if 1
+-# include <xlocale.h>
++# include <locale.h>
+ #endif
+ 
+ /* The definitions of _GL_FUNCDECL_RPL etc. are copied here.  */
 diff --git a/libraries/cmake/source/augeas/gnulib/generated/linux/x86_64/lib/locale.h b/libraries/cmake/source/augeas/gnulib/generated/linux/x86_64/lib/locale.h
+index 4f9baece2..afe947956 100644
 --- a/libraries/cmake/source/augeas/gnulib/generated/linux/x86_64/lib/locale.h
 +++ b/libraries/cmake/source/augeas/gnulib/generated/linux/x86_64/lib/locale.h
 @@ -48,9 +48,9 @@
@@ -24,6 +30,3 @@ diff --git a/libraries/cmake/source/augeas/gnulib/generated/linux/x86_64/lib/loc
  #endif
  
  /* The definitions of _GL_FUNCDECL_RPL etc. are copied here.  */
--- 
-2.38.1
-
diff --git a/pkgs/tools/system/osquery/default.nix b/pkgs/tools/system/osquery/default.nix
index a7c8f18214fa5..a5d7fa3d44137 100644
--- a/pkgs/tools/system/osquery/default.nix
+++ b/pkgs/tools/system/osquery/default.nix
@@ -1,6 +1,7 @@
 { lib
 , cmake
 , fetchFromGitHub
+, fetchpatch
 , git
 , llvmPackages
 , nixosTests
@@ -32,6 +33,15 @@ buildStdenv.mkDerivation rec {
     ./Remove-circular-definition-of-AUDIT_FILTER_EXCLUDE.patch
     # For current state of compilation against glibc in the clangWithLLVM toolchain, refer to the upstream issue in https://github.com/osquery/osquery/issues/7823.
     ./Remove-system-controls-table.patch
+
+    # osquery uses a vendored boost library that still relies on old standard types (e.g. `std::unary_function`)
+    # which have been removed as of C++17. The patch is already checked in upstream, but there have been no
+    # releases yet. Can likely be removed with versions > 5.10.2.
+    (fetchpatch {
+      name = "fix-build-on-clang-16.patch";
+      url  = "https://github.com/osquery/osquery/commit/222991a15b4ae0a0fb919e4965603616536e1b0a.patch";
+      hash = "sha256-PdzEoeR1LXVri1Cd+7KMhKmDC8yZhAx3f1+9tjLJKyo=";
+    })
   ];
 
 
diff --git a/pkgs/tools/typesetting/psutils/default.nix b/pkgs/tools/typesetting/psutils/default.nix
index 3ff93ad230116..93c7b9f2a23a4 100644
--- a/pkgs/tools/typesetting/psutils/default.nix
+++ b/pkgs/tools/typesetting/psutils/default.nix
@@ -9,9 +9,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-OFPreVhLqPvieoFUJbZan38Vsljg1DoFqFa9t11YiuQ=";
   };
 
+  postPatch = ''
+    sed -i 's/void main/int main/' *.c
+  '';
+
   configurePhase = ''
     sed -e 's,/usr/local/bin/perl,${perl}/bin/perl,' \
       -e "s,/usr/local,$out," \
+      -e "s,CFLAGS =,CFLAGS = -std=c89," \
       Makefile.unix > Makefile
   '';
 
diff --git a/pkgs/tools/video/lux/default.nix b/pkgs/tools/video/lux/default.nix
index 6d1e92af4aca7..fe81c15940e0c 100644
--- a/pkgs/tools/video/lux/default.nix
+++ b/pkgs/tools/video/lux/default.nix
@@ -7,18 +7,18 @@
 
 buildGoModule rec {
   pname = "lux";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "iawia002";
     repo = "lux";
     rev = "v${version}";
-    hash = "sha256-LCYWfF7O8wByCJNDi2BZsI7EU6wJqhcr/sbNOoQ2Src=";
+    hash = "sha256-v74+Ykz9aro1x+9psg2LnuodKE2/pCw9knZop0etQOg=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
-  vendorHash = "sha256-wW/jrsurmyLcDX+58lp0M+snJ2avEs0HciNZ8BgIqrI=";
+  vendorHash = "sha256-1VZFKDoSuSUmYw7g6SwB/dXnFaw7+cGHKfgT96HaI/o=";
 
   ldflags = [
     "-s"