about summary refs log tree commit diff
path: root/pkgs
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs')
-rw-r--r--pkgs/applications/audio/mpg123/default.nix4
-rw-r--r--pkgs/applications/editors/neovim/default.nix33
-rw-r--r--pkgs/applications/editors/vim/common.nix28
-rw-r--r--pkgs/applications/editors/vim/default.nix9
-rw-r--r--pkgs/applications/editors/vim/full.nix4
-rw-r--r--pkgs/applications/editors/vim/plugins/overrides.nix13
-rw-r--r--pkgs/applications/graphics/ImageMagick/default.nix4
-rw-r--r--pkgs/applications/misc/mupdf/default.nix5
-rw-r--r--pkgs/applications/networking/go-graft/default.nix2
-rw-r--r--pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch12
-rw-r--r--pkgs/applications/networking/sync/rsync/default.nix2
-rw-r--r--pkgs/applications/version-management/gitsign/default.nix2
-rw-r--r--pkgs/applications/version-management/mercurial/default.nix6
-rw-r--r--pkgs/applications/video/vlc/default.nix4
-rw-r--r--pkgs/build-support/cc-wrapper/default.nix4
-rw-r--r--pkgs/build-support/go/module.nix6
-rw-r--r--pkgs/build-support/go/package.nix6
-rw-r--r--pkgs/by-name/at/athens/package.nix2
-rw-r--r--pkgs/by-name/bl/bluez/package.nix158
-rw-r--r--pkgs/by-name/li/libplacebo_5/package.nix77
-rw-r--r--pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch27
-rw-r--r--pkgs/by-name/me/meson/package.nix7
-rw-r--r--pkgs/by-name/up/uplosi/package.nix2
-rw-r--r--pkgs/by-name/vu/vulkan-volk/package.nix26
-rw-r--r--pkgs/data/misc/iana-etc/default.nix4
-rw-r--r--pkgs/development/compilers/gcc/common/configure-flags.nix2
-rw-r--r--pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch28
-rw-r--r--pkgs/development/compilers/gcc/patches/13/ICE-PR110280.patch60
-rw-r--r--pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch29
-rw-r--r--pkgs/development/compilers/gcc/patches/default.nix1
-rw-r--r--pkgs/development/compilers/glslang/default.nix4
-rw-r--r--pkgs/development/compilers/go/1.21.nix4
-rw-r--r--pkgs/development/compilers/llvm/10/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/10/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/11/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/11/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/12/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/12/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/13/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/13/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/14/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/14/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/15/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/15/libcxx/default.nix8
-rw-r--r--pkgs/development/compilers/llvm/15/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/16/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/16/libcxx/default.nix10
-rw-r--r--pkgs/development/compilers/llvm/16/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/17/libcxx/default.nix13
-rw-r--r--pkgs/development/compilers/llvm/17/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/8/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/8/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/9/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/9/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/llvm/git/default.nix1
-rw-r--r--pkgs/development/compilers/llvm/git/libcxx/default.nix13
-rw-r--r--pkgs/development/compilers/llvm/git/llvm/default.nix2
-rw-r--r--pkgs/development/compilers/spirv-llvm-translator/default.nix9
-rw-r--r--pkgs/development/compilers/zulu/common.nix2
-rw-r--r--pkgs/development/interpreters/ruby/rubygems/default.nix4
-rw-r--r--pkgs/development/libraries/aws-c-auth/default.nix4
-rw-r--r--pkgs/development/libraries/catch2/3.nix4
-rw-r--r--pkgs/development/libraries/dbus/default.nix1
-rw-r--r--pkgs/development/libraries/editline/default.nix8
-rw-r--r--pkgs/development/libraries/enchant/2.x.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg/generic.nix13
-rw-r--r--pkgs/development/libraries/folly/default.nix16
-rw-r--r--pkgs/development/libraries/fontconfig/default.nix15
-rw-r--r--pkgs/development/libraries/fontconfig/make-fonts-conf.nix21
-rw-r--r--pkgs/development/libraries/fontconfig/make-fonts-conf.xsl20
-rw-r--r--pkgs/development/libraries/gd/default.nix4
-rw-r--r--pkgs/development/libraries/gnutls/default.nix4
-rw-r--r--pkgs/development/libraries/gperftools/default.nix4
-rw-r--r--pkgs/development/libraries/kde-frameworks/fetch.sh2
-rw-r--r--pkgs/development/libraries/kde-frameworks/srcs.nix664
-rw-r--r--pkgs/development/libraries/libcamera/default.nix4
-rw-r--r--pkgs/development/libraries/libdrm/default.nix4
-rw-r--r--pkgs/development/libraries/libjxl/default.nix4
-rw-r--r--pkgs/development/libraries/libmbim/default.nix23
-rw-r--r--pkgs/development/libraries/libplacebo/default.nix24
-rw-r--r--pkgs/development/libraries/libqmi/default.nix4
-rw-r--r--pkgs/development/libraries/libraw/default.nix13
-rw-r--r--pkgs/development/libraries/libunwind/default.nix22
-rw-r--r--pkgs/development/libraries/libxmlb/default.nix4
-rw-r--r--pkgs/development/libraries/libxslt/default.nix2
-rw-r--r--pkgs/development/libraries/libzip/default.nix10
-rw-r--r--pkgs/development/libraries/openexr/default.nix7
-rw-r--r--pkgs/development/libraries/openexr/gcc-13.patch46
-rw-r--r--pkgs/development/libraries/pipewire/default.nix4
-rw-r--r--pkgs/development/libraries/pixman/default.nix34
-rw-r--r--pkgs/development/libraries/qrencode/default.nix15
-rw-r--r--pkgs/development/libraries/qt-5/5.15/default.nix2
-rw-r--r--pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch33
-rw-r--r--pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh2
-rw-r--r--pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh2
-rw-r--r--pkgs/development/libraries/qt-6/modules/qtdeclarative.nix2
-rw-r--r--pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch12
-rw-r--r--pkgs/development/libraries/rapidfuzz-cpp/default.nix4
-rw-r--r--pkgs/development/libraries/readline/readline-8.2-patches.nix3
-rw-r--r--pkgs/development/libraries/science/math/liblapack/default.nix4
-rw-r--r--pkgs/development/libraries/spirv-headers/default.nix4
-rw-r--r--pkgs/development/libraries/srt/default.nix4
-rw-r--r--pkgs/development/libraries/tiledb/default.nix3
-rw-r--r--pkgs/development/libraries/vulkan-headers/default.nix4
-rwxr-xr-xpkgs/development/libraries/vulkan-headers/update.sh1
-rw-r--r--pkgs/development/libraries/vulkan-loader/default.nix4
-rw-r--r--pkgs/development/libraries/vulkan-utility-libraries/default.nix6
-rw-r--r--pkgs/development/libraries/xapian/default.nix7
-rw-r--r--pkgs/development/libraries/xsimd/default.nix2
-rw-r--r--pkgs/development/libraries/zxing-cpp/default.nix4
-rw-r--r--pkgs/development/python-modules/acme/default.nix4
-rw-r--r--pkgs/development/python-modules/awslambdaric/default.nix4
-rw-r--r--pkgs/development/python-modules/certbot/default.nix4
-rw-r--r--pkgs/development/python-modules/fonttools/default.nix2
-rw-r--r--pkgs/development/python-modules/img2pdf/default.nix4
-rw-r--r--pkgs/development/python-modules/jinja2/default.nix82
-rw-r--r--pkgs/development/python-modules/matplotlib/default.nix19
-rw-r--r--pkgs/development/python-modules/meson-python/default.nix2
-rw-r--r--pkgs/development/python-modules/ocrmypdf/default.nix8
-rw-r--r--pkgs/development/python-modules/pikepdf/default.nix12
-rw-r--r--pkgs/development/python-modules/pikepdf/paths.patch10
-rw-r--r--pkgs/development/python-modules/pycryptodome/default.nix4
-rw-r--r--pkgs/development/python-modules/pycurl/default.nix1
-rw-r--r--pkgs/development/python-modules/pymemcache/default.nix7
-rw-r--r--pkgs/development/python-modules/pyrfc3339/default.nix5
-rw-r--r--pkgs/development/python-modules/python-memcached/default.nix12
-rw-r--r--pkgs/development/python-modules/pythran/default.nix14
-rw-r--r--pkgs/development/python-modules/rapidfuzz/default.nix6
-rw-r--r--pkgs/development/python-modules/scipy/default.nix55
-rw-r--r--pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix6
-rw-r--r--pkgs/development/ruby-modules/bundler/default.nix4
-rw-r--r--pkgs/development/ruby-modules/gem/default.nix2
-rw-r--r--pkgs/development/tools/documentation/doxygen/default.nix16
-rw-r--r--pkgs/development/tools/gocode/default.nix43
-rw-r--r--pkgs/development/tools/gocode/deps.nix12
-rw-r--r--pkgs/development/tools/gofumpt/default.nix6
-rw-r--r--pkgs/development/tools/kind/default.nix2
-rw-r--r--pkgs/development/tools/misc/autoconf/2.71.nix69
-rw-r--r--pkgs/development/tools/misc/autoconf/default.nix9
-rw-r--r--pkgs/development/tools/misc/lttng-ust/default.nix4
-rw-r--r--pkgs/development/tools/misc/ycmd/default.nix5
-rw-r--r--pkgs/development/tools/rust/maturin/default.nix6
-rw-r--r--pkgs/development/tools/spirv-tools/default.nix4
-rw-r--r--pkgs/development/tools/vulkan-validation-layers/default.nix4
-rw-r--r--pkgs/development/web/nodejs/v20.nix4
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix164
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix10
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix13
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix43
-rw-r--r--pkgs/os-specific/linux/libcap-ng/default.nix4
-rw-r--r--pkgs/os-specific/linux/lvm2/2_03.nix4
-rw-r--r--pkgs/os-specific/linux/lvm2/common.nix4
-rw-r--r--pkgs/os-specific/linux/lvm2/fix-static.patch28
-rw-r--r--pkgs/os-specific/linux/lvm2/no-shared.patch46
-rw-r--r--pkgs/os-specific/linux/pam/default.nix9
-rw-r--r--pkgs/os-specific/linux/rust-out-of-tree-module/default.nix28
-rw-r--r--pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch6
-rw-r--r--pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch27
-rw-r--r--pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch4
-rw-r--r--pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch12
-rw-r--r--pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch (renamed from pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch)26
-rw-r--r--pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch24
-rw-r--r--pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch (renamed from pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch)2
-rw-r--r--pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch (renamed from pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch)16
-rw-r--r--pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch23
-rw-r--r--pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch (renamed from pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch)4
-rw-r--r--pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch (renamed from pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch)4
-rw-r--r--pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch (renamed from pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch)20
-rw-r--r--pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch (renamed from pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch)4
-rw-r--r--pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch (renamed from pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch)15
-rw-r--r--pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch30
-rw-r--r--pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch (renamed from pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch)6
-rw-r--r--pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch (renamed from pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch)4
-rw-r--r--pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch21
-rw-r--r--pkgs/os-specific/linux/systemd/0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch (renamed from pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch)0
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix323
-rw-r--r--pkgs/servers/firebird/default.nix4
-rw-r--r--pkgs/servers/nosql/redis/default.nix15
-rw-r--r--pkgs/stdenv/generic/setup.sh27
-rw-r--r--pkgs/tools/graphics/spirv-cross/default.nix4
-rw-r--r--pkgs/tools/graphics/vulkan-extension-layer/default.nix4
-rw-r--r--pkgs/tools/graphics/vulkan-tools-lunarg/default.nix4
-rw-r--r--pkgs/tools/graphics/vulkan-tools/default.nix6
-rw-r--r--pkgs/tools/inputmethods/m17n-lib/default.nix4
-rw-r--r--pkgs/tools/networking/curl/default.nix6
-rw-r--r--pkgs/tools/networking/inetutils/default.nix10
-rw-r--r--pkgs/tools/networking/modemmanager/default.nix4
-rw-r--r--pkgs/tools/networking/tun2socks/default.nix2
-rw-r--r--pkgs/tools/networking/v2ray/default.nix2
-rw-r--r--pkgs/tools/networking/xray/default.nix2
-rw-r--r--pkgs/tools/security/gnupg/24-revert-rfc4880bis-defaults.patch200
-rw-r--r--pkgs/tools/security/gnupg/24.nix5
-rw-r--r--pkgs/tools/security/slsa-verifier/default.nix1
-rw-r--r--pkgs/tools/security/step-ca/default.nix4
-rw-r--r--pkgs/tools/text/groff/site.tmac21
-rw-r--r--pkgs/tools/video/rav1e/default.nix8
-rw-r--r--pkgs/tools/virtualization/mkosi/default.nix15
-rw-r--r--pkgs/top-level/aliases.nix66
-rw-r--r--pkgs/top-level/all-packages.nix29
-rw-r--r--pkgs/top-level/linux-kernels.nix2
-rw-r--r--pkgs/top-level/python-aliases.nix1
-rw-r--r--pkgs/top-level/python-packages.nix6
-rw-r--r--pkgs/top-level/unixtools.nix4
206 files changed, 2080 insertions, 1538 deletions
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index 94ee6ad53e69f..e1d2e8d35d521 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.3";
+  version = "1.32.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-LZkTpX1O6PSXoYLG6CWCYCQJeCpPtIHpif7r9ENYZ7Q=";
+    hash = "sha256-WplmQzj7L3UbZi9A7iWATQydtrV13LXOdBxtxkIkoIo=";
   };
 
   outputs = [ "out" "dev" "man" ] ++ lib.optional withConplay "conplay";
diff --git a/pkgs/applications/editors/neovim/default.nix b/pkgs/applications/editors/neovim/default.nix
index 60035e3f1b588..aa5b007c4d1b3 100644
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@@ -12,11 +12,10 @@
 
 # now defaults to false because some tests can be flaky (clipboard etc), see
 # also: https://github.com/neovim/neovim/issues/16233
-, doCheck ? false
 , nodejs ? null, fish ? null, python3 ? null
 }:
-
-let
+stdenv.mkDerivation (finalAttrs:
+  let
   nvim-lpeg-dylib = luapkgs: if stdenv.isDarwin
     then (luapkgs.lpeg.overrideAttrs (oa: {
       preConfigure = ''
@@ -42,7 +41,7 @@ let
     (nvim-lpeg-dylib ps)
     luabitop
     mpack
-  ] ++ lib.optionals doCheck [
+  ] ++ lib.optionals finalAttrs.doCheck [
     luv
     coxpcall
     busted
@@ -64,17 +63,17 @@ let
         in deterministicLuajit.withPackages(ps: [ ps.mpack (nvim-lpeg-dylib ps) ])
       else lua.luaOnBuild;
 
-  pyEnv = python3.withPackages(ps: with ps; [ pynvim msgpack ]);
 
-in
-  stdenv.mkDerivation rec {
+in {
     pname = "neovim-unwrapped";
     version = "0.9.5";
 
+    __structuredAttrs = true;
+
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "neovim";
-      rev = "v${version}";
+      rev = "v${finalAttrs.version}";
       hash = "sha256-CcaBqA0yFCffNPmXOJTo8c9v1jrEBiqAl8CG5Dj5YxE=";
     };
 
@@ -87,7 +86,7 @@ in
 
     dontFixCmake = true;
 
-    inherit lua;
+    inherit lua treesitter-parsers;
 
     buildInputs = [
       gperf
@@ -105,15 +104,17 @@ in
       tree-sitter
       unibilium
     ] ++ lib.optionals stdenv.isDarwin [ libiconv CoreServices ]
-      ++ lib.optionals doCheck [ glibcLocales procps ]
+      ++ lib.optionals finalAttrs.doCheck [ glibcLocales procps ]
     ;
 
-    inherit doCheck;
+    doCheck = false;
 
     # to be exhaustive, one could run
     # make oldtests too
     checkPhase = ''
+      runHook preCheck
       make functionaltest
+      runHook postCheck
     '';
 
     nativeBuildInputs = [
@@ -123,7 +124,9 @@ in
     ];
 
     # extra programs test via `make functionaltest`
-    nativeCheckInputs = [
+    nativeCheckInputs = let
+      pyEnv = python3.withPackages(ps: with ps; [ pynvim msgpack ]);
+    in [
       fish
       nodejs
       pyEnv      # for src/clint.py
@@ -166,11 +169,11 @@ in
         ln -s \
           ${tree-sitter.buildGrammar {
             inherit language src;
-            version = "neovim-${version}";
+            version = "neovim-${finalAttrs.version}";
           }}/parser \
           $out/lib/nvim/parser/${language}.so
       '')
-      treesitter-parsers);
+      finalAttrs.treesitter-parsers);
 
     shellHook=''
       export VIMRUNTIME=$PWD/runtime
@@ -199,4 +202,4 @@ in
       maintainers = with maintainers; [ manveru rvolosatovs ];
       platforms   = platforms.unix;
     };
-  }
+  })
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index b392cc0aa565e..9ebe4d7acd492 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,14 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.2116";
+  version = "9.1.0004";
+
+  outputs = [ "out" "xxd" ];
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-ZKcNg/RrjvEsxpIcTjzQYi1xig3zLeTV+PXaBb4gUuM=";
+    hash = "sha256-Y5ZSJLEFdptEMA0xvstr6H1G4iiaYXpkJGSSFwoTfc0=";
   };
 
   enableParallelBuilding = true;
@@ -14,12 +16,21 @@ rec {
 
   hardeningDisable = [ "fortify" ];
 
-  postPatch =
-    # Use man from $PATH; escape sequences are still problematic.
-    ''
-      substituteInPlace runtime/ftplugin/man.vim \
-        --replace "/usr/bin/man " "man "
-    '';
+  # Use man from $PATH; escape sequences are still problematic.
+  postPatch = ''
+    substituteInPlace runtime/ftplugin/man.vim \
+      --replace "/usr/bin/man " "man "
+  '';
+
+  # man page moving is done in postFixup instead of postInstall otherwise fixupPhase moves it right back where it was
+  postFixup = ''
+    moveToOutput bin/xxd "$xxd"
+    moveToOutput share/man/man1/xxd.1.gz "$xxd"
+    for manFile in $out/share/man/*/man1/xxd.1*; do
+      # moveToOutput does not take full paths or wildcards...
+      moveToOutput "share/man/$(basename "$(dirname "$(dirname "$manFile")")")/man1/xxd.1.gz" "$xxd"
+    done
+  '';
 
   meta = with lib; {
     description = "The most popular clone of the VI editor";
@@ -28,5 +39,6 @@ rec {
     maintainers = with maintainers; [ das_j equirosa ];
     platforms   = platforms.unix;
     mainProgram = "vim";
+    outputsToInstall = [ "out" "xxd" ];
   };
 }
diff --git a/pkgs/applications/editors/vim/default.nix b/pkgs/applications/editors/vim/default.nix
index c5b9a607f20df..d04fa241ba73f 100644
--- a/pkgs/applications/editors/vim/default.nix
+++ b/pkgs/applications/editors/vim/default.nix
@@ -15,7 +15,7 @@ in
 stdenv.mkDerivation {
   pname = "vim";
 
-  inherit (common) version src postPatch hardeningDisable enableParallelBuilding enableParallelInstalling meta;
+  inherit (common) version outputs src postPatch hardeningDisable enableParallelBuilding enableParallelInstalling postFixup meta;
 
   nativeBuildInputs = [ gettext pkg-config ];
   buildInputs = [ ncurses bash gawk ]
@@ -62,11 +62,4 @@ stdenv.mkDerivation {
   '';
 
   __impureHostDeps = [ "/dev/ptmx" ];
-
-  # To fix the trouble in vim73, that it cannot cross-build with this patch
-  # to bypass a configure script check that cannot be done cross-building.
-  # http://groups.google.com/group/vim_dev/browse_thread/thread/66c02efd1523554b?pli=1
-  # patchPhase = ''
-  #   sed -i -e 's/as_fn_error.*int32.*/:/' src/auto/configure
-  # '';
 }
diff --git a/pkgs/applications/editors/vim/full.nix b/pkgs/applications/editors/vim/full.nix
index cfb8b84560cbd..263f8d2984d0c 100644
--- a/pkgs/applications/editors/vim/full.nix
+++ b/pkgs/applications/editors/vim/full.nix
@@ -66,7 +66,7 @@ in stdenv.mkDerivation {
 
   pname = "vim-full";
 
-  inherit (common) version postPatch hardeningDisable enableParallelBuilding meta;
+  inherit (common) version outputs postPatch hardeningDisable enableParallelBuilding meta;
 
   src = builtins.getAttr source {
     default = common.src; # latest release
@@ -181,7 +181,7 @@ in stdenv.mkDerivation {
     ln -sfn '${nixosRuntimepath}' "$out"/share/vim/vimrc
   '';
 
-  postFixup = lib.optionalString wrapPythonDrv ''
+  postFixup = common.postFixup + lib.optionalString wrapPythonDrv ''
     wrapProgram "$out/bin/vim" --prefix PATH : "${python3}/bin" \
       --set NIX_PYTHONPATH "${python3}/${python3.sitePackages}"
   '';
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 8029960ffcd20..cbd7b6a3cce1d 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -97,7 +97,6 @@
 , errcheck
 , go-motion
 , go-tools
-, gocode
 , gocode-gomod
 , godef
 , gogetdoc
@@ -110,6 +109,7 @@
 , iferr
 , impl
 , reftools
+, revive
 , # hurl dependencies
   hurl
 , # must be lua51Packages
@@ -1530,13 +1530,11 @@
   vim-go =
     let
       binPath = lib.makeBinPath [
-        # TODO: package commented packages
         asmfmt
         delve
         errcheck
         go-motion
-        go-tools # contains staticcheck
-        gocode
+        go-tools # contains staticcheck, keyify
         gocode-gomod
         godef
         gogetdoc
@@ -1544,15 +1542,12 @@
         golangci-lint
         gomodifytags
         gopls
-        # gorename
         gotags
-        gotools
-        # guru
+        gotools # contains guru, gorename
         iferr
         impl
-        # keyify
         reftools
-        # revive
+        revive
       ];
     in
     super.vim-go.overrideAttrs {
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 8ac0496488895..b2d5dacb20fc4 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -49,13 +49,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-25";
+  version = "7.1.1-26";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-HKDeeh8DNj0y7wS4DqctXhmNaOqZ02JeBXRFrEpH0M4=";
+    hash = "sha256-diJhCRDT0SbAYZdBPoxZJWlrUW2Nz4/d7H0Nnybw0Yw=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index 7e172f279d44b..b2c2335db0b29 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -98,9 +98,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ]
     ++ lib.optional (enableGL || enableX11) copyDesktopItems
+    ++ lib.optional (stdenv.isDarwin && (enableGL || enableX11)) desktopToDarwinBundle
     ++ lib.optionals (enableCxx || enablePython) [ python3 python3.pkgs.setuptools python3.pkgs.libclang ]
     ++ lib.optionals (enablePython) [ which swig ]
-    ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle fixDarwinDylibNames xcbuild ];
+    ++ lib.optionals stdenv.isDarwin [ fixDarwinDylibNames xcbuild ];
 
   buildInputs = [ freetype harfbuzz openjpeg jbig2dec libjpeg gumbo ]
     ++ lib.optionals enableX11 [ libX11 libXext libXi libXrandr ]
@@ -126,7 +127,7 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  desktopItems = [
+  desktopItems = lib.optionals (enableGL || enableX11) [
     (makeDesktopItem {
       name = pname;
       desktopName = pname;
diff --git a/pkgs/applications/networking/go-graft/default.nix b/pkgs/applications/networking/go-graft/default.nix
index ec9ca385e1ef8..14dbcea6277ba 100644
--- a/pkgs/applications/networking/go-graft/default.nix
+++ b/pkgs/applications/networking/go-graft/default.nix
@@ -13,7 +13,7 @@ buildGoModule rec {
 
   CGO_ENABLED = 0;
 
-  ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" "-buildid=" ];
+  ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" ];
   vendorHash = "sha256-fnM4ycqDyruCdCA1Cr4Ki48xeQiTG4l5dLVuAafEm14=";
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch b/pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch
new file mode 100644
index 0000000000000..3305653d025ff
--- /dev/null
+++ b/pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch
@@ -0,0 +1,12 @@
+diff -rup rsync-3.2.7/configure.sh rsync-3.2.7-fixed/configure.sh
+--- rsync-3.2.7/configure.sh	2022-10-20 17:57:22
++++ rsync-3.2.7-fixed/configure.sh	2024-01-01 19:51:58
+@@ -7706,7 +7706,7 @@ else $as_nop
+ #include <stdlib.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
+-main()
++int main()
+ {
+    if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
+      exit(1);
diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index 1baf1c40eb14b..0d8b3d78ec05d 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     # https://github.com/WayneD/rsync/issues/511#issuecomment-1774612577
     # original source: https://build.opensuse.org/package/view_file/network/rsync/rsync-fortified-strlcpy-fix.patch?expand=1&rev=3f8dd2f4a404c96c0f69176e60893714
     ./rsync-fortified-strlcpy-fix.patch
+    # https://github.com/WayneD/rsync/pull/558
+    ./configure.ac-fix-failing-IPv6-check.patch
   ];
 
   buildInputs = [ libiconv zlib popt ]
diff --git a/pkgs/applications/version-management/gitsign/default.nix b/pkgs/applications/version-management/gitsign/default.nix
index cf804ddfb54c6..87b73391987ed 100644
--- a/pkgs/applications/version-management/gitsign/default.nix
+++ b/pkgs/applications/version-management/gitsign/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  ldflags = [ "-s" "-w" "-buildid=" "-X github.com/sigstore/gitsign/pkg/version.gitVersion=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/sigstore/gitsign/pkg/version.gitVersion=${version}" ];
 
   preCheck = ''
     # test all paths
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 1051dc6da886a..07cc4e7b8f581 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -23,11 +23,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.6.1";
+    version = "6.6.2";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-opRlo/5Ao+jUm6g0MTSsKrooa2g//rg42gz25FIflpU=";
+      sha256 = "sha256-y0lNe+fdwvydMXHIiDCvnAKyHHU+PlET3vrJwDc7S2A=";
     };
 
     format = "other";
@@ -37,7 +37,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-wLV0qdCfMgGpZRxnZik/lRwZHm/66p0sJn/mYVRvRkQ=";
+      sha256 = "sha256-yOysqMrTWDx/ENcJng8Rm338NI9vpuBGH6Yq8B7+MFg=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;
diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
index afa948b00bb58..2b5c86b0efb29 100644
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -44,7 +44,7 @@
 , libmtp
 , liboggz
 , libopus
-, libplacebo
+, libplacebo_5
 , libpulseaudio
 , libraw1394
 , librsvg
@@ -164,7 +164,7 @@ stdenv.mkDerivation (finalAttrs: {
     libmtp
     liboggz
     libopus
-    libplacebo
+    libplacebo_5
     libpulseaudio
     libraw1394
     librsvg
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index af9400a99f161..59aaa41e9c173 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -525,10 +525,10 @@ stdenv.mkDerivation {
     # additional -isystem flags will confuse gfortran (see
     # https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903)
     + optionalString (libcxx == null && isClang && (useGccForLibs && gccForLibs.langCC or false)) ''
-      for dir in ${gccForLibs}${lib.optionalString (hostPlatform != targetPlatform) "/${targetPlatform.config}"}/include/c++/*; do
+      for dir in ${gccForLibs}/include/c++/*; do
         echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
       done
-      for dir in ${gccForLibs}${lib.optionalString (hostPlatform != targetPlatform) "/${targetPlatform.config}"}/include/c++/*/${targetPlatform.config}; do
+      for dir in ${gccForLibs}/include/c++/*/${targetPlatform.config}; do
         echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
       done
     ''
diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 2fb59c6348290..153b675d48aef 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -39,6 +39,8 @@
   # Not needed with buildGoModule
 , goPackagePath ? ""
 
+, ldflags ? [ ]
+
   # needed for buildFlags{,Array} warning
 , buildFlags ? ""
 , buildFlagsArray ? ""
@@ -154,6 +156,9 @@ let
     GOFLAGS = lib.optionals (!proxyVendor) [ "-mod=vendor" ] ++ lib.optionals (!allowGoReference) [ "-trimpath" ];
     inherit CGO_ENABLED enableParallelBuilding GO111MODULE GOTOOLCHAIN;
 
+    # If not set to an explicit value, set the buildid empty for reproducibility.
+    ldflags = ldflags ++ lib.optionals (!lib.any (lib.hasPrefix "-buildid=") ldflags) [ "-buildid=" ];
+
     configurePhase = args.configurePhase or (''
       runHook preConfigure
 
@@ -301,4 +306,5 @@ in
 lib.warnIf (args' ? vendorSha256) "`vendorSha256` is deprecated. Use `vendorHash` instead"
 lib.warnIf (buildFlags != "" || buildFlagsArray != "")
   "Use the `ldflags` and/or `tags` attributes instead of `buildFlags`/`buildFlagsArray`"
+lib.warnIf (builtins.elem "-buildid=" ldflags) "`-buildid=` is set by default as ldflag by buildGoModule"
   package
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index 7e099b76f0b76..8ca5ca0dca011 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -37,6 +37,8 @@
 
 , CGO_ENABLED ? go.CGO_ENABLED
 
+, ldflags ? [ ]
+
 # needed for buildFlags{,Array} warning
 , buildFlags ? ""
 , buildFlagsArray ? ""
@@ -91,6 +93,9 @@ let
 
     GOARM = toString (lib.intersectLists [(stdenv.hostPlatform.parsed.cpu.version or "")] ["5" "6" "7"]);
 
+    # If not set to an explicit value, set the buildid empty for reproducibility.
+    ldflags = ldflags ++ lib.optionals (!lib.any (lib.hasPrefix "-buildid=") ldflags) [ "-buildid=" ];
+
     configurePhase = args.configurePhase or (''
       runHook preConfigure
 
@@ -280,4 +285,5 @@ let
 in
 lib.warnIf (buildFlags != "" || buildFlagsArray != "")
   "Use the `ldflags` and/or `tags` attributes instead of `buildFlags`/`buildFlagsArray`"
+lib.warnIf (builtins.elem "-buildid=" ldflags) "`-buildid=` is set by default as ldflag by buildGoModule"
   package
diff --git a/pkgs/by-name/at/athens/package.nix b/pkgs/by-name/at/athens/package.nix
index e6095f7691a19..c53c571c036f2 100644
--- a/pkgs/by-name/at/athens/package.nix
+++ b/pkgs/by-name/at/athens/package.nix
@@ -18,7 +18,7 @@ buildGoModule rec {
   vendorHash = "sha256-8+PdkanodNZW/xeFf+tDm3Ej7DRSpBBtiT/CqjnWthw=";
 
   CGO_ENABLED = "0";
-  ldflags = [ "-s" "-w" "-buildid=" "-X github.com/gomods/athens/pkg/build.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X github.com/gomods/athens/pkg/build.version=${version}" ];
 
   subPackages = [ "cmd/proxy" ];
 
diff --git a/pkgs/by-name/bl/bluez/package.nix b/pkgs/by-name/bl/bluez/package.nix
new file mode 100644
index 0000000000000..e8b649db3939e
--- /dev/null
+++ b/pkgs/by-name/bl/bluez/package.nix
@@ -0,0 +1,158 @@
+{ lib
+, stdenv
+, alsa-lib
+, dbus
+, docutils
+, ell
+, enableExperimental ? false
+, fetchpatch
+, fetchurl
+, glib
+, json_c
+, libical
+, pkg-config
+, python3
+, readline
+, systemdMinimal
+, udev
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bluez";
+  version = "5.71";
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
+    hash = "sha256-uCjUGMk87R9Vthb7VILPAVN0QL+zT72hpWTz7OlHNdg=";
+  };
+
+  buildInputs = [
+    alsa-lib
+    dbus
+    ell
+    glib
+    json_c
+    libical
+    python3
+    readline
+    udev
+  ];
+
+  nativeBuildInputs = [
+    docutils
+    pkg-config
+    python3.pkgs.wrapPython
+  ];
+
+  outputs = [ "out" "dev" "test" ];
+
+  postPatch = ''
+    substituteInPlace tools/hid2hci.rules \
+      --replace /sbin/udevadm ${systemdMinimal}/bin/udevadm \
+      --replace "hid2hci " "$out/lib/udev/hid2hci "
+  '' +
+  # Disable some tests:
+  # - test-mesh-crypto depends on the following kernel settings:
+  #   CONFIG_CRYPTO_[USER|USER_API|USER_API_AEAD|USER_API_HASH|AES|CCM|AEAD|CMAC]
+  ''
+    if [[ ! -f unit/test-mesh-crypto.c ]]; then
+      echo "unit/test-mesh-crypto.c no longer exists"
+      false
+    fi
+    echo 'int main() { return 77; }' > unit/test-mesh-crypto.c
+  '';
+
+  configureFlags = [
+    "--localstatedir=/var"
+    (lib.enableFeature enableExperimental "experimental")
+    (lib.enableFeature true "btpclient")
+    (lib.enableFeature true "cups")
+    (lib.enableFeature true "external-ell")
+    (lib.enableFeature true "health")
+    (lib.enableFeature true "hid2hci")
+    (lib.enableFeature true "library")
+    (lib.enableFeature true "logger")
+    (lib.enableFeature true "mesh")
+    (lib.enableFeature true "midi")
+    (lib.enableFeature true "nfc")
+    (lib.enableFeature true "pie")
+    (lib.enableFeature true "sixaxis")
+    # Set "deprecated" to provide ciptool, sdptool, and rfcomm (unmaintained);
+    # superseded by new D-Bus APIs
+    (lib.enableFeature true "deprecated")
+    (lib.withFeatureAs true "dbusconfdir" "${placeholder "out"}/share")
+    (lib.withFeatureAs true "dbussessionbusdir" "${placeholder "out"}/share/dbus-1/services")
+    (lib.withFeatureAs true "dbussystembusdir" "${placeholder "out"}/share/dbus-1/system-services")
+    (lib.withFeatureAs true "systemdsystemunitdir" "${placeholder "out"}/etc/systemd/system")
+    (lib.withFeatureAs true "systemduserunitdir" "${placeholder "out"}/etc/systemd/user")
+    (lib.withFeatureAs true "udevdir" "${placeholder "out"}/lib/udev")
+  ];
+
+  makeFlags = [
+    "rulesdir=${placeholder "out"}/lib/udev/rules.d"
+  ];
+
+  # Work around `make install' trying to create /var/lib/bluetooth.
+  installFlags = [
+    "statedir=$(TMPDIR)/var/lib/bluetooth"
+  ];
+
+  doCheck = stdenv.hostPlatform.isx86_64;
+
+  postInstall = let
+    pythonPath = with python3.pkgs; [
+      dbus-python
+      pygobject3
+      recursivePthLoader
+    ];
+  in
+  ''
+    mkdir -p $test/{bin,test}
+    cp -a test $test
+    pushd $test/test
+    for t in \
+            list-devices \
+            monitor-bluetooth \
+            simple-agent \
+            test-adapter \
+            test-device \
+            test-thermometer \
+            ; do
+      ln -s ../test/$t $test/bin/bluez-$t
+    done
+    popd
+    wrapPythonProgramsIn $test/test "$test/test ${toString pythonPath}"
+
+    # for bluez4 compatibility for NixOS
+    mkdir $out/sbin
+    ln -s ../libexec/bluetooth/bluetoothd $out/sbin/bluetoothd
+    ln -s ../libexec/bluetooth/obexd $out/sbin/obexd
+
+    # Add extra configuration
+    mkdir $out/etc/bluetooth
+    ln -s /etc/bluetooth/main.conf $out/etc/bluetooth/main.conf
+
+    # https://github.com/NixOS/nixpkgs/issues/204418
+    ln -s /etc/bluetooth/input.conf $out/etc/bluetooth/input.conf
+    ln -s /etc/bluetooth/network.conf $out/etc/bluetooth/network.conf
+
+    # Add missing tools, ref https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/bluez
+    for files in $(find tools/ -type f -perm -755); do
+      filename=$(basename $files)
+      install -Dm755 tools/$filename $out/bin/$filename
+    done
+    install -Dm755 attrib/gatttool $out/bin/gatttool
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = {
+    homepage = "https://www.bluez.org/";
+    description = "Official Linux Bluetooth protocol stack";
+    changelog = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/ChangeLog?h=${finalAttrs.version}";
+    license = with lib.licenses; [ bsd2 gpl2Plus lgpl21Plus mit ];
+    mainProgram = "btinfo";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/li/libplacebo_5/package.nix b/pkgs/by-name/li/libplacebo_5/package.nix
new file mode 100644
index 0000000000000..f307a869e940b
--- /dev/null
+++ b/pkgs/by-name/li/libplacebo_5/package.nix
@@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, python3Packages
+, vulkan-headers
+, vulkan-loader
+, shaderc
+, lcms2
+, libGL
+, libX11
+, libunwind
+, libdovi
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libplacebo";
+  version = "5.264.1";
+
+  src = fetchFromGitLab {
+    domain = "code.videolan.org";
+    owner = "videolan";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-YEefuEfJURi5/wswQKskA/J1UGzessQQkBpltJ0Spq8=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    vulkan-headers
+    python3Packages.jinja2
+    python3Packages.glad2
+  ];
+
+  buildInputs = [
+    vulkan-loader
+    shaderc
+    lcms2
+    libGL
+    libX11
+    libunwind
+    libdovi
+  ];
+
+  mesonFlags = with lib; [
+    (mesonOption "vulkan-registry" "${vulkan-headers}/share/vulkan/registry/vk.xml")
+    (mesonBool "demos" false) # Don't build and install the demo programs
+    (mesonEnable "d3d11" false) # Disable the Direct3D 11 based renderer
+    (mesonEnable "glslang" false) # rely on shaderc for GLSL compilation instead
+  ] ++ optionals stdenv.isDarwin [
+    (mesonEnable "unwind" false) # libplacebo doesn’t build with `darwin.libunwind`
+  ];
+
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace 'python_env.append' '#'
+  '';
+
+  meta = with lib; {
+    description = "Reusable library for GPU-accelerated video/image rendering primitives";
+    longDescription = ''
+      Reusable library for GPU-accelerated image/view processing primitives and
+      shaders, as well a batteries-included, extensible, high-quality rendering
+      pipeline (similar to mpv's vo_gpu). Supports Vulkan, OpenGL and Metal (via
+      MoltenVK).
+    '';
+    homepage = "https://code.videolan.org/videolan/libplacebo";
+    changelog = "https://code.videolan.org/videolan/libplacebo/-/tags/v${version}";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ primeos tadeokondrak ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch b/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch
deleted file mode 100644
index aea0348f4b638..0000000000000
--- a/pkgs/by-name/me/meson/007-darwin-case-sensitivity.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From a908a574daf8bac10bb2a0ee3771052d2167a85f Mon Sep 17 00:00:00 2001
-From: Randy Eckenrode <randy@largeandhighquality.com>
-Date: Sun, 3 Dec 2023 15:41:20 -0500
-Subject: [PATCH] Fix test failure on Darwin on a case-sensitive fs
-
-This was encountered while looking into an issue with
-https://github.com/NixOS/nixpkgs/pull/268583.
-
-I run my Nix store on case-sensitive APFS, so the test fails due to
-trying to link `-framework ldap` instead of `-framework LDAP`.
----
- test cases/osx/5 extra frameworks/meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/test cases/osx/5 extra frameworks/meson.build b/test cases/osx/5 extra frameworks/meson.build
-index f6c01e63a1bd..96532846c632 100644
---- a/test cases/osx/5 extra frameworks/meson.build	
-+++ b/test cases/osx/5 extra frameworks/meson.build	
-@@ -7,7 +7,7 @@ dep_main = dependency('Foundation')
- assert(dep_main.type_name() == 'extraframeworks', 'type_name is ' + dep_main.type_name())
- 
- # https://github.com/mesonbuild/meson/issues/10002
--ldap_dep = dependency('ldap', method : 'extraframework')
-+ldap_dep = dependency('LDAP', method : 'extraframework')
- assert(ldap_dep.type_name() == 'extraframeworks', 'type_name is ' + ldap_dep.type_name())
- 
- stlib = static_library('stat', 'stat.c', install : true, dependencies: [opengl_dep, ldap_dep])
diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index 86ac76ffafbb6..9064b9eaf793b 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -18,13 +18,13 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     rev = "refs/tags/${version}";
-    hash = "sha256-Jt3PWnbv/8P6Rvf3E/Yli2vdtfgx3CmsW+jlc9CK5KA=";
+    hash = "sha256-KNNtHi3jx0MRiOgmluA4ucZJWB2WeIYdApfHuspbCqg=";
   };
 
   patches = [
@@ -65,9 +65,6 @@ python3.pkgs.buildPythonApplication rec {
 
     # Nixpkgs cctools does not have bitcode support.
     ./006-disable-bitcode.patch
-
-    # https://github.com/mesonbuild/meson/pull/12587
-    ./007-darwin-case-sensitivity.patch
   ];
 
   buildInputs = lib.optionals (python3.pythonOlder "3.9") [
diff --git a/pkgs/by-name/up/uplosi/package.nix b/pkgs/by-name/up/uplosi/package.nix
index eaa1ef48e35db..0f91177636d2b 100644
--- a/pkgs/by-name/up/uplosi/package.nix
+++ b/pkgs/by-name/up/uplosi/package.nix
@@ -16,7 +16,7 @@ buildGoModule rec {
   vendorHash = "sha256-RsjUPLe8omoN+XGyNhHDxzNfZR7VVTkh/f/On1oCRqM=";
 
   CGO_ENABLED = "0";
-  ldflags = [ "-s" "-w" "-buildid=" "-X main.version=${version}" ];
+  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
   flags = [ "-trimpath" ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/vu/vulkan-volk/package.nix b/pkgs/by-name/vu/vulkan-volk/package.nix
new file mode 100644
index 0000000000000..1164fd2921e2a
--- /dev/null
+++ b/pkgs/by-name/vu/vulkan-volk/package.nix
@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchFromGitHub, cmake, vulkan-headers }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "volk";
+  version = "1.3.275.0";
+
+  src = fetchFromGitHub {
+    owner = "zeux";
+    repo = "volk";
+    rev = "vulkan-sdk-${finalAttrs.version}";
+    hash = "sha256-uTjLgJMGN8nOVhVIl/GNhO2jXe9ebhc9vzAwCDwfuf4=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ vulkan-headers ];
+
+  cmakeFlags = ["-DVOLK_INSTALL=1"];
+
+  meta = with lib; {
+    description = " Meta loader for Vulkan API";
+    homepage = "https://github.com/zeux/volk";
+    platforms = platforms.all;
+    license = licenses.mit;
+    maintainers = with maintainers; [ k900 ];
+  };
+})
diff --git a/pkgs/data/misc/iana-etc/default.nix b/pkgs/data/misc/iana-etc/default.nix
index de19347e34033..ee83d1cca0bbf 100644
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "iana-etc";
-  version = "20230316";
+  version = "20231227";
 
   src = fetchzip {
     url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256-5acFYPSwevEw5tZNbQDpui3stWuMdnhaKHqC8lhnsOY=";
+    sha256 = "sha256-8Pa6LtAml8axjrUS32UbFIqTtM8v124U2Tt0J4sC0Is=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 05fd9406377d6..b8dccf9fcc575 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -135,6 +135,8 @@ let
       # We pick "/" path to effectively avoid sysroot offset and make it work
       # as a native case.
       "--with-build-sysroot=/"
+      # Same with the stdlibc++ headers embedded in the gcc output
+      "--with-gxx-include-dir=${placeholder "out"}/include/c++/${version}/"
     ]
 
     # Basic configuration
diff --git a/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch b/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
index 4e6c392ce76e3..51078925eeb84 100644
--- a/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
+++ b/pkgs/development/compilers/gcc/patches/12/mangle-NIX_STORE-in-__FILE__.patch
@@ -12,9 +12,20 @@ inputs to be retained in runtime closure.
 Typical examples are `nix` -> `nlohmann_json` and `pipewire` ->
 `lttng-ust.dev`.
 
+For this reason we want to remove the occurrences of hashes in the
+expansion of `__FILE__`. `nuke-references` does it by replacing hashes
+by `eeeeee...` but those paths are also used for debug symbols. It is
+handy to be able to invert the transformation to go back to the original
+store path for debuginfod servers. The chosen solution is to make the
+hash uppercase:
+- it does not trigger runtime references (except for all digit hashes,
+  which are unlikely enough)
+- it visually looks like a bogus store path
+- it is easy to find the original store path if required
+
 Ideally we would like to use `-fmacro-prefix-map=` feature of `gcc` as:
 
-  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/eeee.eee-nlohmann-json-ver
+  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/$HASH1-nlohmann-json-ver
   -fmacro-prefix-map=/nix/...
 
 In practice it quickly exhausts argument length limit due to `gcc`
@@ -25,9 +36,9 @@ is present in the environment.
 
 Tested as:
 
-    $ printf "# 0 \"/nix/store/01234567890123456789012345678901-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
+    $ printf "# 0 \"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
     ...
-    .string "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-pppppp-vvvvvvv"
+    .string "/nix/store/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-pppppp-vvvvvvv"
     ...
 
 Mangled successfully.
@@ -43,7 +54,7 @@ Mangled successfully.
  /* Perform user-specified mapping of filename prefixes.  Return the
     GC-allocated new name corresponding to FILENAME or FILENAME if no
     remapping was performed.  */
-@@ -76,7 +79,30 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -76,7 +79,31 @@ remap_filename (file_prefix_map *maps, const char *filename)
      if (filename_ncmp (filename, map->old_prefix, map->old_len) == 0)
        break;
    if (!map)
@@ -51,8 +62,7 @@ Mangled successfully.
 +    {
 +      if (maps == macro_prefix_maps)
 +	{
-+	  /* Remap all fo $NIX_STORE/.{32} paths to
-+	  * equivalent $NIX_STORE/e{32}.
++	  /* Remap the 32 characters after $NIX_STORE/ to uppercase
 +	  *
 +	  * That way we avoid argument parameters explosion
 +	  * and still avoid embedding headers into runtime closure:
@@ -66,7 +76,9 @@ Mangled successfully.
 +	    {
 +	       s = (char *) ggc_alloc_atomic (name_len + 1);
 +	       memcpy(s, name, name_len + 1);
-+	       memset(s + nix_store_len + 1, 'e', 32);
++	       for (int i = nix_store_len + 1; i < nix_store_len + 1 + 32; i++) {
++		 s[i] = TOUPPER(s[i]);
++	       }
 +	       return s;
 +	    }
 +	}
@@ -75,7 +87,7 @@ Mangled successfully.
    name = filename + map->old_len;
    name_len = strlen (name) + 1;
  
-@@ -90,7 +116,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -90,7 +117,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
     ignore it in DW_AT_producer (dwarf2out.cc).  */
  
  /* Linked lists of file_prefix_map structures.  */
diff --git a/pkgs/development/compilers/gcc/patches/13/ICE-PR110280.patch b/pkgs/development/compilers/gcc/patches/13/ICE-PR110280.patch
new file mode 100644
index 0000000000000..7338b3dd1ede3
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/13/ICE-PR110280.patch
@@ -0,0 +1,60 @@
+From f4029de35fb1b293a4fd586574b1b4b73ddf7880 Mon Sep 17 00:00:00 2001
+From: Prathamesh Kulkarni <prathamesh.kulkarni@linaro.org>
+Date: Wed, 26 Jul 2023 22:36:26 +0530
+Subject: [PATCH] [aarch64/match.pd] Fix ICE observed in PR110280.
+
+gcc/ChangeLog:
+	PR tree-optimization/110280
+	* match.pd (vec_perm_expr(v, v, mask) -> v): Explicitly build vector
+	using build_vector_from_val with the element of input operand, and
+	mask's type if operand and mask's types don't match.
+
+gcc/testsuite/ChangeLog:
+	PR tree-optimization/110280
+	* gcc.target/aarch64/sve/pr110280.c: New test.
+
+(cherry picked from commit 85d8e0d8d5342ec8b4e6a54e22741c30b33c6f04)
+---
+ gcc/match.pd                                    |  9 ++++++++-
+ gcc/testsuite/gcc.target/aarch64/sve/pr110280.c | 12 ++++++++++++
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+ create mode 100644 gcc/testsuite/gcc.target/aarch64/sve/pr110280.c
+
+diff --git a/gcc/match.pd b/gcc/match.pd
+index 9118244825054..c3bb4fbc0a7a2 100644
+--- a/gcc/match.pd
++++ b/gcc/match.pd
+@@ -8292,7 +8292,14 @@ and,
+ 
+ (simplify
+  (vec_perm vec_same_elem_p@0 @0 @1)
+- @0)
++ (if (types_match (type, TREE_TYPE (@0)))
++  @0
++  (with
++   {
++     tree elem = uniform_vector_p (@0);
++   }
++   (if (elem)
++    { build_vector_from_val (type, elem); }))))
+ 
+ /* Push VEC_PERM earlier if that may help FMA perception (PR101895).  */
+ (simplify
+diff --git a/gcc/testsuite/gcc.target/aarch64/sve/pr110280.c b/gcc/testsuite/gcc.target/aarch64/sve/pr110280.c
+new file mode 100644
+index 0000000000000..d3279f383629f
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/aarch64/sve/pr110280.c
+@@ -0,0 +1,12 @@
++/* { dg-do compile } */
++/* { dg-options "-O3 -fdump-tree-optimized" } */
++
++#include "arm_sve.h"
++
++svuint32_t l()
++{
++  _Alignas(16) const unsigned int lanes[4] = {0, 0, 0, 0};
++  return svld1rq_u32(svptrue_b8(), lanes);
++}
++
++/* { dg-final { scan-tree-dump-not "VEC_PERM_EXPR" "optimized" } } */
diff --git a/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch b/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
index ea0673219eb1f..351d6d0f764ba 100644
--- a/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
+++ b/pkgs/development/compilers/gcc/patches/13/mangle-NIX_STORE-in-__FILE__.patch
@@ -12,9 +12,20 @@ inputs to be retained in runtime closure.
 Typical examples are `nix` -> `nlohmann_json` and `pipewire` ->
 `lttng-ust.dev`.
 
+For this reason we want to remove the occurrences of hashes in the
+expansion of `__FILE__`. `nuke-references` does it by replacing hashes
+by `eeeeee...` but those paths are also used for debug symbols. It is
+handy to be able to invert the transformation to go back to the original
+store path for debuginfod servers. The chosen solution is to make the
+hash uppercase:
+- it does not trigger runtime references (except for all digit hashes,
+  which are unlikely enough)
+- it visually looks like a bogus store path
+- it is easy to find the original store path if required
+
 Ideally we would like to use `-fmacro-prefix-map=` feature of `gcc` as:
 
-  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/eeee.eee-nlohmann-json-ver
+  -fmacro-prefix-map=/nix/store/$hash1-nlohmann-json-ver=/nix/store/$HASH1-nlohmann-json-ver
   -fmacro-prefix-map=/nix/...
 
 In practice it quickly exhausts argument length limit due to `gcc`
@@ -25,9 +36,9 @@ is present in the environment.
 
 Tested as:
 
-    $ printf "# 0 \"/nix/store/01234567890123456789012345678901-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
+    $ printf "# 0 \"/nix/store/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-pppppp-vvvvvvv\" \nconst char * f(void) { return __FILE__; }" | NIX_STORE=/nix/store ./gcc/xgcc -Bgcc -x c - -S -o -
     ...
-    .string "/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-pppppp-vvvvvvv"
+    .string "/nix/store/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-pppppp-vvvvvvv"
     ...
 
 Mangled successfully.
@@ -43,14 +54,13 @@ Mangled successfully.
  /* Perform user-specified mapping of filename prefixes.  Return the
     GC-allocated new name corresponding to FILENAME or FILENAME if no
     remapping was performed.  */
-@@ -102,6 +105,29 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -102,6 +105,30 @@ remap_filename (file_prefix_map *maps, const char *filename)
        break;
    if (!map)
      {
 +      if (maps == macro_prefix_maps)
 +	{
-+	  /* Remap all fo $NIX_STORE/.{32} paths to
-+	   * equivalent $NIX_STORE/e{32}.
++	  /* Remap all fo $NIX_STORE/.{32} paths to uppercase
 +	   *
 +	   * That way we avoid argument parameters explosion
 +	   * and still avoid embedding headers into runtime closure:
@@ -64,7 +74,9 @@ Mangled successfully.
 +	     {
 +		s = (char *) ggc_alloc_atomic (name_len + 1);
 +		memcpy(s, name, name_len + 1);
-+		memset(s + nix_store_len + 1, 'e', 32);
++		for (int i = nix_store_len + 1; i < nix_store_len + 1 + 32; i++) {
++		  s[i] = TOUPPER(s[i]);
++		}
 +		if (realname != filename)
 +		  free (const_cast <char *> (realname));
 +		return s;
@@ -73,7 +85,7 @@ Mangled successfully.
        if (realname != filename)
  	free (const_cast <char *> (realname));
        return filename;
-@@ -124,7 +150,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
+@@ -124,7 +151,6 @@ remap_filename (file_prefix_map *maps, const char *filename)
     ignore it in DW_AT_producer (gen_command_line_string in opts.cc).  */
  
  /* Linked lists of file_prefix_map structures.  */
@@ -81,4 +93,3 @@ Mangled successfully.
  static file_prefix_map *debug_prefix_maps; /* -fdebug-prefix-map  */
  static file_prefix_map *profile_prefix_maps; /* -fprofile-prefix-map  */
  
-
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 55636b8ab51cd..9cb2f701df577 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -74,6 +74,7 @@ in
 ++ optional langFortran (if atLeast12 then ./gcc-12-gfortran-driving.patch else ./gfortran-driving.patch)
 ++ optional atLeast7 ./ppc-musl.patch
 ++ optional is12 ./12/lambda-ICE-PR109241.patch # backport ICE fix on ccache code
+++ optional is13 ./13/ICE-PR110280.patch # backport ICE fix on const_unop
 ++ optional (atLeast9 && langD) ./libphobos.patch
 
 
diff --git a/pkgs/development/compilers/glslang/default.nix b/pkgs/development/compilers/glslang/default.nix
index ff55201ebd03f..5387eb15b713b 100644
--- a/pkgs/development/compilers/glslang/default.nix
+++ b/pkgs/development/compilers/glslang/default.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "glslang";
-  version = "13.1.1";
+  version = "14.0.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     rev = version;
-    hash = "sha256-fuzNsVYdnThMzd4tLN/sTbCBXg6qXKLDJRziOKyOBGg=";
+    hash = "sha256-7kIIU45pe+IF7lGltpIKSvQBmcXR+TWFvmx7ztMNrpc=";
   };
 
   # These get set at all-packages, keep onto them for child drvs
diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
index 5dec10e3e477f..06391b1740a6e 100644
--- a/pkgs/development/compilers/go/1.21.nix
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -46,11 +46,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.21.5";
+  version = "1.21.6";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-KFy730tubmLtWPNw8/bYwwgl1uVsWFPGbTwjvNsJ2xk=";
+    hash = "sha256-Ekkmpi5F942qu67bnAEdl2MxhqM8I4/8HiUyDAIEYkg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/llvm/10/default.nix b/pkgs/development/compilers/llvm/10/default.nix
index bc72be0ce7a16..16238221e279e 100644
--- a/pkgs/development/compilers/llvm/10/default.nix
+++ b/pkgs/development/compilers/llvm/10/default.nix
@@ -158,6 +158,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/10/llvm/default.nix b/pkgs/development/compilers/llvm/10/llvm/default.nix
index c09ec676e9ea7..534d38e866639 100644
--- a/pkgs/development/compilers/llvm/10/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/10/llvm/default.nix
@@ -248,7 +248,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/11/default.nix b/pkgs/development/compilers/llvm/11/default.nix
index 2d9790fe61ace..3044199e28112 100644
--- a/pkgs/development/compilers/llvm/11/default.nix
+++ b/pkgs/development/compilers/llvm/11/default.nix
@@ -173,6 +173,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/11/llvm/default.nix b/pkgs/development/compilers/llvm/11/llvm/default.nix
index 01e6483ad6408..423b08396666b 100644
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@@ -256,7 +256,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/12/default.nix b/pkgs/development/compilers/llvm/12/default.nix
index 4de0488270715..a38e35e91f6d0 100644
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@@ -173,6 +173,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/12/llvm/default.nix b/pkgs/development/compilers/llvm/12/llvm/default.nix
index 97d8f27672e3d..3263c4ddaf359 100644
--- a/pkgs/development/compilers/llvm/12/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/12/llvm/default.nix
@@ -244,7 +244,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/13/default.nix b/pkgs/development/compilers/llvm/13/default.nix
index c46ebee1d0dba..c811b24c48ef4 100644
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@@ -213,6 +213,7 @@ in let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/13/llvm/default.nix b/pkgs/development/compilers/llvm/13/llvm/default.nix
index 2a7c1c1867cb3..1e71cdd89c6c0 100644
--- a/pkgs/development/compilers/llvm/13/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/13/llvm/default.nix
@@ -206,7 +206,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/14/default.nix b/pkgs/development/compilers/llvm/14/default.nix
index 3513833c6f560..090eec2348869 100644
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@@ -216,6 +216,7 @@ in let
           (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
     };
 
     clangNoLibcxx = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/14/llvm/default.nix b/pkgs/development/compilers/llvm/14/llvm/default.nix
index 6eec4c563f9c1..eab49d326ad4b 100644
--- a/pkgs/development/compilers/llvm/14/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/14/llvm/default.nix
@@ -205,7 +205,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/15/default.nix b/pkgs/development/compilers/llvm/15/default.nix
index 307198b5e9a39..d9ca0819f2e07 100644
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ b/pkgs/development/compilers/llvm/15/default.nix
@@ -221,6 +221,7 @@ in let
           (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
     };
 
     clangNoLibcxx = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/15/libcxx/default.nix b/pkgs/development/compilers/llvm/15/libcxx/default.nix
index ed5f48e8c38fe..be56770039d80 100644
--- a/pkgs/development/compilers/llvm/15/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/15/libcxx/default.nix
@@ -56,6 +56,14 @@ stdenv.mkDerivation rec {
       hash = "sha256-AaM9A6tQ4YAw7uDqCIV4VaiUyLZv+unwcOqbakwW9/k=";
       relative = "libcxx";
     })
+    # fix for https://github.com/NixOS/nixpkgs/issues/269548
+    # https://github.com/llvm/llvm-project/pull/77218
+    (fetchpatch {
+      name = "darwin-system-libcxxabi-link-flags.patch";
+      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
+      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
+      relative = "libcxx";
+    })
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     ../../libcxx-0001-musl-hacks.patch
   ];
diff --git a/pkgs/development/compilers/llvm/15/llvm/default.nix b/pkgs/development/compilers/llvm/15/llvm/default.nix
index 0b9e83259b2c5..4f17678ba14f7 100644
--- a/pkgs/development/compilers/llvm/15/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/15/llvm/default.nix
@@ -343,7 +343,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 878806ff85aba..db9385043be26 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -226,6 +226,7 @@ in let
           (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
     };
 
     clangNoLibcxx = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/16/libcxx/default.nix b/pkgs/development/compilers/llvm/16/libcxx/default.nix
index 78cd632024cda..d6c8c57c17437 100644
--- a/pkgs/development/compilers/llvm/16/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/16/libcxx/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, llvm_meta
-, monorepoSrc, runCommand
+, monorepoSrc, runCommand, fetchpatch
 , cmake, ninja, python3, fixDarwinDylibNames, version
 , cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
 , libcxxabi, libcxxrt, libunwind
@@ -47,6 +47,14 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./gnu-install-dirs.patch
+    # fix for https://github.com/NixOS/nixpkgs/issues/269548
+    # https://github.com/llvm/llvm-project/pull/77218
+    (fetchpatch {
+      name = "darwin-system-libcxxabi-link-flags.patch";
+      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
+      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
+      relative = "libcxx";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/compilers/llvm/16/llvm/default.nix b/pkgs/development/compilers/llvm/16/llvm/default.nix
index a6faf9fd635d4..73fb6a7854131 100644
--- a/pkgs/development/compilers/llvm/16/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/16/llvm/default.nix
@@ -331,7 +331,7 @@ in
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/17/libcxx/default.nix b/pkgs/development/compilers/llvm/17/libcxx/default.nix
index 7b99966416638..8a5272ea07af0 100644
--- a/pkgs/development/compilers/llvm/17/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/17/libcxx/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, llvm_meta
-, monorepoSrc, runCommand
+, monorepoSrc, runCommand, fetchpatch
 , cmake, ninja, python3, fixDarwinDylibNames, version
 , cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
 , libcxxabi, libcxxrt, libunwind
@@ -45,6 +45,17 @@ stdenv.mkDerivation rec {
     chmod -R u+w .
   '';
 
+  patches = [
+    # fix for https://github.com/NixOS/nixpkgs/issues/269548
+    # https://github.com/llvm/llvm-project/pull/77218
+    (fetchpatch {
+      name = "darwin-system-libcxxabi-link-flags.patch";
+      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
+      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
+      relative = "libcxx";
+    })
+  ];
+
   postPatch = ''
     cd ../runtimes
   '';
diff --git a/pkgs/development/compilers/llvm/17/llvm/default.nix b/pkgs/development/compilers/llvm/17/llvm/default.nix
index b38fef333135e..627679ce812fc 100644
--- a/pkgs/development/compilers/llvm/17/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/17/llvm/default.nix
@@ -330,7 +330,7 @@ stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/8/default.nix b/pkgs/development/compilers/llvm/8/default.nix
index 0483916a620b7..83e19e7e90a29 100644
--- a/pkgs/development/compilers/llvm/8/default.nix
+++ b/pkgs/development/compilers/llvm/8/default.nix
@@ -161,6 +161,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/8/llvm/default.nix b/pkgs/development/compilers/llvm/8/llvm/default.nix
index 7cef04347429c..c2f9243310981 100644
--- a/pkgs/development/compilers/llvm/8/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/8/llvm/default.nix
@@ -222,7 +222,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/9/default.nix b/pkgs/development/compilers/llvm/9/default.nix
index fbd2e57805be2..a6274c8b2b9c0 100644
--- a/pkgs/development/compilers/llvm/9/default.nix
+++ b/pkgs/development/compilers/llvm/9/default.nix
@@ -161,6 +161,7 @@ let
         echo "-B${targetLlvmLibraries.compiler-rt}/lib" >> $out/nix-support/cc-cflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm) ''
         echo "--unwindlib=libunwind" >> $out/nix-support/cc-cflags
+        echo "-L${targetLlvmLibraries.libunwind}/lib" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false) ''
         echo "-lunwind" >> $out/nix-support/cc-ldflags
       '' + lib.optionalString stdenv.targetPlatform.isWasm ''
diff --git a/pkgs/development/compilers/llvm/9/llvm/default.nix b/pkgs/development/compilers/llvm/9/llvm/default.nix
index 75c7868559734..c0ef7801c348a 100644
--- a/pkgs/development/compilers/llvm/9/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/9/llvm/default.nix
@@ -237,7 +237,7 @@ in stdenv.mkDerivation (rec {
   ] ++ optionals (isDarwin) [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/llvm/git/default.nix b/pkgs/development/compilers/llvm/git/default.nix
index 41ce6076da5f3..efa8daf5d98b9 100644
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@@ -216,6 +216,7 @@ in let
           (!stdenv.targetPlatform.isWasm && stdenv.targetPlatform.useLLVM or false)
           "-lunwind"
         ++ lib.optional stdenv.targetPlatform.isWasm "-fno-exceptions";
+      nixSupport.cc-ldflags = lib.optionals (!stdenv.targetPlatform.isWasm) [ "-L${targetLlvmLibraries.libunwind}/lib" ];
     };
 
     clangNoLibcxx = wrapCCWith rec {
diff --git a/pkgs/development/compilers/llvm/git/libcxx/default.nix b/pkgs/development/compilers/llvm/git/libcxx/default.nix
index 7b99966416638..8a5272ea07af0 100644
--- a/pkgs/development/compilers/llvm/git/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxx/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, llvm_meta
-, monorepoSrc, runCommand
+, monorepoSrc, runCommand, fetchpatch
 , cmake, ninja, python3, fixDarwinDylibNames, version
 , cxxabi ? if stdenv.hostPlatform.isFreeBSD then libcxxrt else libcxxabi
 , libcxxabi, libcxxrt, libunwind
@@ -45,6 +45,17 @@ stdenv.mkDerivation rec {
     chmod -R u+w .
   '';
 
+  patches = [
+    # fix for https://github.com/NixOS/nixpkgs/issues/269548
+    # https://github.com/llvm/llvm-project/pull/77218
+    (fetchpatch {
+      name = "darwin-system-libcxxabi-link-flags.patch";
+      url = "https://github.com/llvm/llvm-project/commit/c5b89b29ee6e3c444a355fd1cf733ce7ab2e316a.patch";
+      hash = "sha256-LNoPg1KCoP8RWxU/AzHR52f4Dww24I9BGQJedMhFxyQ=";
+      relative = "libcxx";
+    })
+  ];
+
   postPatch = ''
     cd ../runtimes
   '';
diff --git a/pkgs/development/compilers/llvm/git/llvm/default.nix b/pkgs/development/compilers/llvm/git/llvm/default.nix
index 36edfee8a091a..a6e9f9289d030 100644
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@@ -329,7 +329,7 @@ stdenv.mkDerivation (rec {
   ] ++ optionals isDarwin [
     "-DLLVM_ENABLE_LIBCXX=ON"
     "-DCAN_TARGET_i386=false"
-  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ optionals ((stdenv.hostPlatform != stdenv.buildPlatform) && !(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) [
     "-DCMAKE_CROSSCOMPILING=True"
     "-DLLVM_TABLEGEN=${buildLlvmTools.llvm}/bin/llvm-tblgen"
     (
diff --git a/pkgs/development/compilers/spirv-llvm-translator/default.nix b/pkgs/development/compilers/spirv-llvm-translator/default.nix
index 4db3b93217d7f..fb5b5b0b7ba53 100644
--- a/pkgs/development/compilers/spirv-llvm-translator/default.nix
+++ b/pkgs/development/compilers/spirv-llvm-translator/default.nix
@@ -48,7 +48,14 @@ disable-warnings-if-gcc13 (stdenv.mkDerivation {
     inherit (branch) rev hash;
   };
 
-  patches = lib.optionals (llvmMajor == "16") [
+  patches = [
+    # Fixes build after spirv-headers breaking change
+    (fetchpatch {
+      url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/0166a0fb86dc6c0e8903436bbc3a89bc3273ebc0.patch";
+      excludes = ["spirv-headers-tag.conf"];
+      hash = "sha256-17JJG8eCFVphElY5fVT/79hj0bByWxo8mVp1ZNjQk/M=";
+    })
+  ] ++ lib.optionals (llvmMajor == "16") [
     # Fixes builds that link against external LLVM dynamic library
     (fetchpatch {
       url = "https://github.com/KhronosGroup/SPIRV-LLVM-Translator/commit/f3b9b604d7eda18d0d1029d94a6eebd33aa3a3fe.patch";
diff --git a/pkgs/development/compilers/zulu/common.nix b/pkgs/development/compilers/zulu/common.nix
index d09555b00c9ca..75925ed81bece 100644
--- a/pkgs/development/compilers/zulu/common.nix
+++ b/pkgs/development/compilers/zulu/common.nix
@@ -57,7 +57,7 @@ let
   isJdk8 = lib.versions.major dist.jdkVersion == "8";
 
   jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-${javaPackage}";
+    pname = "zulu-${javaPackage}";
     version = dist.jdkVersion;
 
     src = fetchurl {
diff --git a/pkgs/development/interpreters/ruby/rubygems/default.nix b/pkgs/development/interpreters/ruby/rubygems/default.nix
index 95a6fb077eb12..dd89e0cd41d79 100644
--- a/pkgs/development/interpreters/ruby/rubygems/default.nix
+++ b/pkgs/development/interpreters/ruby/rubygems/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rubygems";
-  version = "3.5.3";
+  version = "3.5.5";
 
   src = fetchurl {
     url = "https://rubygems.org/rubygems/rubygems-${version}.tgz";
-    hash = "sha256-8xFe6AgJkvJXwBYbgR4HsBLyAXXtiTSfsayYl33cXJw=";
+    hash = "sha256-ErKsKMIEvs4oA8eS9v1ASfqlMOJOxeTVfCA99AIcTh0=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/aws-c-auth/default.nix b/pkgs/development/libraries/aws-c-auth/default.nix
index 284671b43f171..f818e35c458e8 100644
--- a/pkgs/development/libraries/aws-c-auth/default.nix
+++ b/pkgs/development/libraries/aws-c-auth/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
-  version = "0.7.7";
+  version = "0.7.10";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    sha256 = "sha256-GO3Sfbi1dwsqQM6rlnEHyE7wolQjdVwD5BAu5ychEuY=";
+    hash = "sha256-yJ0sgw0y9tIiIHgTPVnfYd8zAGjO83qfeeEzstGH9CE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/catch2/3.nix b/pkgs/development/libraries/catch2/3.nix
index f064eb7a4fdb5..6bf982aa75fb4 100644
--- a/pkgs/development/libraries/catch2/3.nix
+++ b/pkgs/development/libraries/catch2/3.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.4.0";
+  version = "3.5.2";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     rev = "v${version}";
-    hash = "sha256-DqGGfNjKPW9HFJrX9arFHyNYjB61uoL6NabZatTWrr0=";
+    hash = "sha256-xGPfXjk+oOnR7JqTrZd2pKJxalrlS8CMs7HWDClXaS8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index a809eda31c0d1..cb5fe9e4fbd3e 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
   '';
 
   outputs = [ "out" "dev" "lib" "doc" "man" ];
+  separateDebugInfo = true;
 
   strictDeps = true;
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/editline/default.nix b/pkgs/development/libraries/editline/default.nix
index 15a056edb6911..4f891a24f1f0a 100644
--- a/pkgs/development/libraries/editline/default.nix
+++ b/pkgs/development/libraries/editline/default.nix
@@ -16,6 +16,14 @@ stdenv.mkDerivation rec {
       url = "https://github.com/troglobit/editline/commit/265c1fb6a0b99bedb157dc7c320f2c9629136518.patch";
       sha256 = "sha256-9fhQH0hT8BcykGzOUoT18HBtWjjoXnePSGDJQp8GH30=";
     })
+
+    # Pending autoconf-2.72 upstream support:
+    #   https://github.com/troglobit/editline/pull/64
+    (fetchpatch {
+      name = "autoconf-2.72.patch";
+      url = "https://github.com/troglobit/editline/commit/f444a316f5178b8e20fe31e7b2d979e651da077e.patch";
+      hash = "sha256-m3jExTkPvE+ZBwHzf/A+ugzzfbLmeWYn726l7Po7f10=";
+    })
   ];
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index 43f9093848b8f..c843fef4a0efe 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-wcVxnypZfOPgbJOM+5n7aX2gk96nuFfMAE3B3PG7oYI=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     groff
     pkg-config
@@ -33,7 +35,7 @@ stdenv.mkDerivation rec {
     nuspell
   ];
 
-  nativeCheckInputs = [
+  checkInputs = [
     unittest-cpp
   ];
 
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 9d4369003e47d..12347318696c7 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -44,7 +44,6 @@
 , withFreetype ? withHeadlessDeps # Needed for drawtext filter
 , withFrei0r ? withFullDeps # frei0r video filtering
 , withFribidi ? withFullDeps # Needed for drawtext filter
-, withGlslang ? withFullDeps && !stdenv.isDarwin && lib.versionAtLeast version "5.0"
 , withGme ? withFullDeps # Game Music Emulator
 , withGnutls ? withHeadlessDeps
 , withGsm ? withFullDeps # GSM de/encoder
@@ -73,6 +72,7 @@
 , withRtmp ? false # RTMP[E] support
 , withSamba ? withFullDeps && !stdenv.isDarwin # Samba protocol
 , withSdl2 ? withSmallDeps
+, withShaderc ? withFullDeps && !stdenv.isDarwin && lib.versionAtLeast version "5.0"
 , withSoxr ? withHeadlessDeps # Resampling via soxr
 , withSpeex ? withHeadlessDeps # Speex de/encoder
 , withSrt ? withHeadlessDeps # Secure Reliable Transport (SRT) protocol
@@ -189,7 +189,6 @@
 , frei0r
 , fribidi
 , game-music-emu
-, glslang
 , gnutls
 , gsm
 , intel-media-sdk
@@ -213,6 +212,7 @@
 , libopenmpt
 , libopus
 , libplacebo
+, libplacebo_5
 , libpulseaudio
 , libraw1394
 , librsvg
@@ -244,6 +244,7 @@
 , rtmpdump
 , samba
 , SDL2
+, shaderc
 , soxr
 , speex
 , srt
@@ -356,7 +357,7 @@ stdenv.mkDerivation (finalAttrs: {
         hash = "sha256-FQV9/PiarPXCm45ldtCsxGHjlrriL8DKpn1LaKJ8owI=";
       }
     )
-    ++ (lib.optional (stdenv.isDarwin && lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2")
+    ++ (lib.optional (lib.versionAtLeast version "6.1" && lib.versionOlder version "6.2")
       { # this can be removed post 6.1
         name = "fix_build_failure_due_to_PropertyKey_EncoderID";
         url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/cb049d377f54f6b747667a93e4b719380c3e9475";
@@ -524,7 +525,7 @@ stdenv.mkDerivation (finalAttrs: {
     (enableFeature withZimg "libzimg")
     (enableFeature withZlib "zlib")
     (enableFeature withVulkan "vulkan")
-    (enableFeature withGlslang "libglslang")
+    (optionalString (lib.versionAtLeast version "5") (enableFeature withShaderc "libshaderc"))
     (enableFeature withSamba "libsmbclient")
     /*
      * Developer flags
@@ -577,14 +578,13 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withFreetype [ freetype ]
   ++ optionals withFrei0r [ frei0r ]
   ++ optionals withFribidi [ fribidi ]
-  ++ optionals withGlslang [ glslang ]
   ++ optionals withGme [ game-music-emu ]
   ++ optionals withGnutls [ gnutls ]
   ++ optionals withGsm [ gsm ]
   ++ optionals withIconv [ libiconv ] # On Linux this should be in libc, do we really need it?
   ++ optionals withJack [ libjack2 ]
   ++ optionals withLadspa [ ladspaH ]
-  ++ optionals withLibplacebo [ libplacebo vulkan-headers ]
+  ++ optionals withLibplacebo [ (if (lib.versionAtLeast version "6.1") then libplacebo else libplacebo_5) vulkan-headers ]
   ++ optionals withLzma [ xz ]
   ++ optionals withMfx [ intel-media-sdk ]
   ++ optionals withModplug [ libmodplug ]
@@ -604,6 +604,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals withRtmp [ rtmpdump ]
   ++ optionals withSamba [ samba ]
   ++ optionals withSdl2 [ SDL2 ]
+  ++ optionals withShaderc [ shaderc ]
   ++ optionals withSoxr [ soxr ]
   ++ optionals withSpeex [ speex ]
   ++ optionals withSrt [ srt ]
diff --git a/pkgs/development/libraries/folly/default.nix b/pkgs/development/libraries/folly/default.nix
index 4d98c163c6d3d..22d395785434a 100644
--- a/pkgs/development/libraries/folly/default.nix
+++ b/pkgs/development/libraries/folly/default.nix
@@ -4,7 +4,6 @@
 , boost
 , cmake
 , double-conversion
-, fetchpatch
 , fmt_8
 , gflags
 , glog
@@ -64,12 +63,21 @@ stdenv.mkDerivation rec {
     # temporary hack until folly builds work on aarch64,
     # see https://github.com/facebook/folly/issues/1880
     "-DCMAKE_LIBRARY_ARCHITECTURE=${if stdenv.isx86_64 then "x86_64" else "dummy"}"
+
+    # ensure correct dirs in $dev/lib/pkgconfig/libfolly.pc
+    # see https://github.com/NixOS/nixpkgs/issues/144170
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
   ];
 
+  # split outputs to reduce downstream closure sizes
+  outputs = [ "out" "dev" ];
+
+  # patch prefix issues again
+  # see https://github.com/NixOS/nixpkgs/issues/144170
   postFixup = ''
-    substituteInPlace "$out"/lib/pkgconfig/libfolly.pc \
-      --replace '=''${prefix}//' '=/' \
-      --replace '=''${exec_prefix}//' '=/'
+    substituteInPlace $dev/lib/cmake/${pname}/${pname}-targets-release.cmake  \
+      --replace '$'{_IMPORT_PREFIX}/lib/ $out/lib/
   '';
 
   # folly-config.cmake, will `find_package` these, thus there should be
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index eadb30352e9a9..9ff72c2021932 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch2
 , pkg-config
 , python3
 , freetype
@@ -15,25 +14,15 @@
 
 stdenv.mkDerivation rec {
   pname = "fontconfig";
-  version = "2.14.2";
+  version = "2.15.0";
 
   outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/fontconfig/release/${pname}-${version}.tar.xz";
-    hash = "sha256-26aVtXvOFQI9LO7e+CBiwrkl5R9dTMSu9zbPE/YKRos=";
+    hash = "sha256-Y6BljQ4G4PqIYQZFK1jvBPIfWCAuoCqUw53g0zNdfA4=";
   };
 
-  patches = [
-    # Provide 11-lcdfilter-none.conf for NixOS module
-    # https://gitlab.freedesktop.org/fontconfig/fontconfig/-/merge_requests/268
-    (fetchpatch2 {
-      name = "add-optional-11-lcdfilter-none-configuration.patch";
-      url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/c2666a6d9a6ed18b1bfcef8176e25f62993e24db.patch";
-      hash = "sha256-UBzkxy3uxFO+g0aQtPnBZv7OncgQdinwzNwWS8ngjcE=";
-    })
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
     gperf
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-conf.nix b/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
index aa84de4dcecdb..cfe0a21e1d35c 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
+++ b/pkgs/development/libraries/fontconfig/make-fonts-conf.nix
@@ -1,16 +1,29 @@
-{ runCommand, stdenv, lib, libxslt, fontconfig, dejavu_fonts, fontDirectories }:
+{ runCommand, stdenv, lib, libxslt, fontconfig, dejavu_fonts, fontDirectories
+, impureFontDirectories ? [
+    # nix user profile
+    "~/.nix-profile/lib/X11/fonts" "~/.nix-profile/share/fonts"
+  ]
+  ++ lib.optional stdenv.isDarwin "~/Library/Fonts"
+  ++ [
+    # FHS paths for non-NixOS platforms
+    "/usr/share/fonts" "/usr/local/share/fonts"
+  ]
+  # darwin paths
+  ++ lib.optionals stdenv.isDarwin [ "/Library/Fonts" "/System/Library/Fonts" ]
+  # nix default profile
+  ++ [ "/nix/var/nix/profiles/default/lib/X11/fonts" "/nix/var/nix/profiles/default/share/fonts" ] }:
 
 runCommand "fonts.conf"
   {
     nativeBuildInputs = [ libxslt ];
     buildInputs = [ fontconfig ];
+    inherit fontDirectories;
     # Add a default font for non-nixos systems, <1MB and in nixos defaults.
-    fontDirectories = fontDirectories ++ [ dejavu_fonts.minimal ]
-      # further non-nixos fonts on darwin
-      ++ lib.optionals stdenv.isDarwin [ "/System/Library/Fonts" "/Library/Fonts" "~/Library/Fonts" ];
+    impureFontDirectories = impureFontDirectories ++ [ dejavu_fonts.minimal ];
   }
   ''
     xsltproc --stringparam fontDirectories "$fontDirectories" \
+      --stringparam impureFontDirectories "$impureFontDirectories" \
       --path ${fontconfig.out}/share/xml/fontconfig \
       ${./make-fonts-conf.xsl} ${fontconfig.out}/etc/fonts/fonts.conf \
       > $out
diff --git a/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl b/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
index ed51b62a1d088..d04e4ffab967b 100644
--- a/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
+++ b/pkgs/development/libraries/fontconfig/make-fonts-conf.xsl
@@ -15,6 +15,7 @@
   <xsl:output method='xml' encoding="UTF-8" doctype-system="urn:fontconfig:fonts.dtd" />
 
   <xsl:param name="fontDirectories" />
+  <xsl:param name="impureFontDirectories" />
 
   <xsl:template match="/fontconfig">
 
@@ -23,29 +24,26 @@
 
       <!-- the first cachedir will be used to store the cache -->
       <cachedir prefix="xdg">fontconfig</cachedir>
+      <xsl:text>&#0010;</xsl:text>
       <!-- /var/cache/fontconfig is useful for non-nixos systems -->
       <cachedir>/var/cache/fontconfig</cachedir>
+      <xsl:text>&#0010;</xsl:text>
 
       <!-- system-wide config -->
       <include ignore_missing="yes">/etc/fonts/conf.d</include>
+      <xsl:text>&#0010;</xsl:text>
 
       <dir prefix="xdg">fonts</dir>
+      <xsl:text>&#0010;</xsl:text>
       <xsl:for-each select="str:tokenize($fontDirectories)">
         <dir><xsl:value-of select="." /></dir>
         <xsl:text>&#0010;</xsl:text>
       </xsl:for-each>
 
-      <!-- nix user profile -->
-      <dir>~/.nix-profile/lib/X11/fonts</dir>
-      <dir>~/.nix-profile/share/fonts</dir>
-
-      <!-- FHS paths for non-NixOS platforms -->
-      <dir>/usr/share/fonts</dir>
-      <dir>/usr/local/share/fonts</dir>
-
-      <!-- nix default profile -->
-      <dir>/nix/var/nix/profiles/default/lib/X11/fonts</dir>
-      <dir>/nix/var/nix/profiles/default/share/fonts</dir>
+      <xsl:for-each select="str:tokenize($impureFontDirectories)">
+        <dir><xsl:value-of select="." /></dir>
+        <xsl:text>&#0010;</xsl:text>
+      </xsl:for-each>
 
     </fontconfig>
 
diff --git a/pkgs/development/libraries/gd/default.nix b/pkgs/development/libraries/gd/default.nix
index c9845feb96783..af96d9d06d27b 100644
--- a/pkgs/development/libraries/gd/default.nix
+++ b/pkgs/development/libraries/gd/default.nix
@@ -44,8 +44,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoconf automake pkg-config ];
 
-  buildInputs = [ zlib fontconfig freetype libpng libjpeg libwebp libtiff libavif ]
-    ++ lib.optional withXorg libXpm;
+  buildInputs = [ zlib freetype libpng libjpeg libwebp libtiff libavif ]
+    ++ lib.optionals withXorg [ fontconfig libXpm ];
 
   outputs = [ "bin" "dev" "out" ];
 
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index bbbdf19a19095..b8c95653e366b 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -35,11 +35,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gnutls";
-  version = "3.8.2";
+  version = "3.8.3";
 
   src = fetchurl {
     url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
-    hash = "sha256-52XlAW/6m53SQ+NjoEYNV3B0RE7iSRJn2y6WycKt73c=";
+    hash = "sha256-90/FlUsn1Oxt+7Ed6ph4iLWxJCiaNwOvytoO5SD0Fz4=";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/development/libraries/gperftools/default.nix b/pkgs/development/libraries/gperftools/default.nix
index da40c66e9fe53..132ae64577a71 100644
--- a/pkgs/development/libraries/gperftools/default.nix
+++ b/pkgs/development/libraries/gperftools/default.nix
@@ -4,6 +4,7 @@
 , fetchpatch
 , autoreconfHook
 , libunwind
+, perl
 }:
 
 stdenv.mkDerivation rec {
@@ -29,7 +30,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
 
   # tcmalloc uses libunwind in a way that works correctly only on non-ARM dynamically linked linux
-  buildInputs = lib.optional (stdenv.isLinux && !(stdenv.hostPlatform.isAarch || stdenv.hostPlatform.isStatic )) libunwind;
+  buildInputs = [ perl ]
+             ++ lib.optional (stdenv.isLinux && !(stdenv.hostPlatform.isAarch || stdenv.hostPlatform.isStatic )) libunwind;
 
   # Disable general dynamic TLS on AArch to support dlopen()'ing the library:
   # https://bugzilla.redhat.com/show_bug.cgi?id=1483558
diff --git a/pkgs/development/libraries/kde-frameworks/fetch.sh b/pkgs/development/libraries/kde-frameworks/fetch.sh
index 590818546a4bf..a6797786ee539 100644
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.113/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.114/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/kde-frameworks/srcs.nix b/pkgs/development/libraries/kde-frameworks/srcs.nix
index 06b5e6b04cfa9..d51c74cc4e64f 100644
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -4,667 +4,667 @@
 
 {
   attica = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/attica-5.113.0.tar.xz";
-      sha256 = "0p6n2jvky5x9gpwmp31mdxf0bzywaljgnkszgbklyc35xk9i6j14";
-      name = "attica-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/attica-5.114.0.tar.xz";
+      sha256 = "0gkdsm1vyyyxxyl4rni9s2bdz5w6zphzjl58fddjl899da06hqfq";
+      name = "attica-5.114.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/baloo-5.113.0.tar.xz";
-      sha256 = "1jv7202dj2w0vcv49bgp0iv1sfy3kdqr974rcr77pcfzhhda9bix";
-      name = "baloo-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/baloo-5.114.0.tar.xz";
+      sha256 = "19sib1y0m5h2gnnpr9rfk810p6pdfm4zzxlm0a44r7910llp8i50";
+      name = "baloo-5.114.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/bluez-qt-5.113.0.tar.xz";
-      sha256 = "1y6nkl9zc5298jc6klxz88h6srmma085w1q5l4jmjihgys2zkcx7";
-      name = "bluez-qt-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/bluez-qt-5.114.0.tar.xz";
+      sha256 = "1ni50jwnb5ww8mkql0p3q8660c0srj8p0ik27lvxakwdq4wf6l9s";
+      name = "bluez-qt-5.114.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/breeze-icons-5.113.0.tar.xz";
-      sha256 = "0kb3wchx84dpi77zsi1b9pzlkhg3sjagxcsf1pdappagq3xn1p48";
-      name = "breeze-icons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/breeze-icons-5.114.0.tar.xz";
+      sha256 = "0z5cpv10jyjdwjfkm7nj6hyp4vj29apm476hvbpb4gan27jyb91y";
+      name = "breeze-icons-5.114.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/extra-cmake-modules-5.113.0.tar.xz";
-      sha256 = "1i1vpf9860cwrq5b01yrgf94hmzk9dx637j638shgjmyxr058pi6";
-      name = "extra-cmake-modules-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/extra-cmake-modules-5.114.0.tar.xz";
+      sha256 = "0z4nqravsfzlsgvkg5rha2d0qxfr3pfncw7z2fxzzqvzj7mfk6im";
+      name = "extra-cmake-modules-5.114.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/frameworkintegration-5.113.0.tar.xz";
-      sha256 = "17i7frachq23kfg78ar33x5acwf7pmwl1a5c02qif44mml8b09hi";
-      name = "frameworkintegration-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/frameworkintegration-5.114.0.tar.xz";
+      sha256 = "1dqgzhhh8gnvl8jsvh2i6pjn935d61avh63b4z9kpllhvp9a2lnd";
+      name = "frameworkintegration-5.114.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kactivities-5.113.0.tar.xz";
-      sha256 = "1d9lkhp344wdss9vab3gh9h31f1k6fifdhp17fblpkykgyvbb26y";
-      name = "kactivities-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kactivities-5.114.0.tar.xz";
+      sha256 = "10pyynqz8c22la9aqms080iqlisj3irbi1kwnn3s0vg5dsjxr1p3";
+      name = "kactivities-5.114.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kactivities-stats-5.113.0.tar.xz";
-      sha256 = "136z2njw3k2l71xp4vg10sm5q925xh8yfr9a784wnr0kwngdb71i";
-      name = "kactivities-stats-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kactivities-stats-5.114.0.tar.xz";
+      sha256 = "1zhrs2p3c831rwx7ww87i82k5i236vfywdxv7zhz93k3vffyqby7";
+      name = "kactivities-stats-5.114.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kapidox-5.113.0.tar.xz";
-      sha256 = "05407c01wnjyslbbz0w5wipjpx6ng3izya41mg13g700ainj9q1x";
-      name = "kapidox-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kapidox-5.114.0.tar.xz";
+      sha256 = "0xxw3lvipyax8r1af3ypwjj6waarbp2z9n11fjb4kvyigsypglmb";
+      name = "kapidox-5.114.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/karchive-5.113.0.tar.xz";
-      sha256 = "03a3p85hmx4ycfp0y5l9yw4cy3i9jwy7jd27psmckr4q0538k91d";
-      name = "karchive-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/karchive-5.114.0.tar.xz";
+      sha256 = "015gc1zarny8r478p7g9m6r67l5dk3r0vcp28ilmfmznxy0k0hda";
+      name = "karchive-5.114.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kauth-5.113.0.tar.xz";
-      sha256 = "0ncpyq2l53p4yhhxkvk23x0ji9amrbnm6kbz8dp573cqww79pih2";
-      name = "kauth-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kauth-5.114.0.tar.xz";
+      sha256 = "1rkf9mc9718wn8pzd3d3wcg3lsn0vkr9a2cqnz86rbg3cf2qdbir";
+      name = "kauth-5.114.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kbookmarks-5.113.0.tar.xz";
-      sha256 = "1fgnh8amy2ghn50i59al0iyqvj05pzdxai9qxqzbvi65f1pibi7d";
-      name = "kbookmarks-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kbookmarks-5.114.0.tar.xz";
+      sha256 = "06lnsyjhh80mdcqjww40glinmrjydbmkhv27a267vf34r7kam9rc";
+      name = "kbookmarks-5.114.0.tar.xz";
     };
   };
   kcalendarcore = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcalendarcore-5.113.0.tar.xz";
-      sha256 = "18psjzqcfzaplcfjpjda983mrpv306il0j49q3rm9hj9ycj54wc2";
-      name = "kcalendarcore-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcalendarcore-5.114.0.tar.xz";
+      sha256 = "0aimda01zqw4fz5ldvz4vh767bi10r00kvm62n89nxhsq46wlk7p";
+      name = "kcalendarcore-5.114.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcmutils-5.113.0.tar.xz";
-      sha256 = "1xbfzw2zfl966zp70jzfp3hjzn334zf4hnwr82priffafgrin57s";
-      name = "kcmutils-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcmutils-5.114.0.tar.xz";
+      sha256 = "1pblf3c60m0gn3vhdprw28f8y54kij02jwz91r2vnmng8d1xkrp9";
+      name = "kcmutils-5.114.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcodecs-5.113.0.tar.xz";
-      sha256 = "1xvaq0yg4n4lwyq3yx2m8jrvfg7f0qrwgxxam4rmp2l245bvn34i";
-      name = "kcodecs-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcodecs-5.114.0.tar.xz";
+      sha256 = "080zvcqd8iq05p5x3qaf3rryx75lg2l2j1dr18sp50ir50zfwh2w";
+      name = "kcodecs-5.114.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcompletion-5.113.0.tar.xz";
-      sha256 = "016280h98j1ssvc3a4b3vyh4s93s9y9hn1jrpbfbkm9xxnvi7k79";
-      name = "kcompletion-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcompletion-5.114.0.tar.xz";
+      sha256 = "0qvdxqlh1dklkbmqfjg5gc3dkdicgzn6q5lgvyf8cv46dinj6mwc";
+      name = "kcompletion-5.114.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kconfig-5.113.0.tar.xz";
-      sha256 = "0fwhn3yp4gfwjiy5dx7gs0zd65yjlrrzkqpy7fpg7n97qf99q2a8";
-      name = "kconfig-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kconfig-5.114.0.tar.xz";
+      sha256 = "0hghdh4p6cq9ckp4g5jdgd8w47pdsxxvzimrdfjrs71lmy8ydiy2";
+      name = "kconfig-5.114.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kconfigwidgets-5.113.0.tar.xz";
-      sha256 = "0bmk5qxiss7a71xpfsbqj831wkcf94b7wfbw9xisvnxlfmf60y4v";
-      name = "kconfigwidgets-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kconfigwidgets-5.114.0.tar.xz";
+      sha256 = "16layydkcwfbvzxqjzprkq8bbxifn0z0wm7mc9bzwrfxy761rjnj";
+      name = "kconfigwidgets-5.114.0.tar.xz";
     };
   };
   kcontacts = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcontacts-5.113.0.tar.xz";
-      sha256 = "1y9cdv1g2ypwl4b0hk1sxk7lvb5qkbm4n1gh62plqsran62jsimm";
-      name = "kcontacts-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcontacts-5.114.0.tar.xz";
+      sha256 = "0lyqvbs216p5zpssaf4pyccph7nbwkbvhpmhbi32y2rm23cmxlwf";
+      name = "kcontacts-5.114.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcoreaddons-5.113.0.tar.xz";
-      sha256 = "1bhanzfjw2i49sx2hjnim8k72vvbs7gyig7nkqkgbaxzpa8qgwrf";
-      name = "kcoreaddons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcoreaddons-5.114.0.tar.xz";
+      sha256 = "1wv3s3xsiii96k17nzs2fb0ih2lyg52krf58v44nlk9wfi4wmnqx";
+      name = "kcoreaddons-5.114.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kcrash-5.113.0.tar.xz";
-      sha256 = "1mg90xm6ckcd30s07psn30sgh81lx8kfs0p1h6cblg4q8bkgkndv";
-      name = "kcrash-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kcrash-5.114.0.tar.xz";
+      sha256 = "1avi4yd3kpjqxrvci1nicxbh9mjafj1w2vgfmqanq66b76s4kxj1";
+      name = "kcrash-5.114.0.tar.xz";
     };
   };
   kdav = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdav-5.113.0.tar.xz";
-      sha256 = "1djng9c741xairr84nvjbkq4dk551p7yk91g8d4nndy8s1kiz1dv";
-      name = "kdav-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdav-5.114.0.tar.xz";
+      sha256 = "11959fxz24snk2l31kw8w96wah0s2fjimimrxh6xhppiy5qp2fp2";
+      name = "kdav-5.114.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdbusaddons-5.113.0.tar.xz";
-      sha256 = "101a406f8i0wgaxd0ilvfcb3plzjgvxw9bhhm5pin6fpr0xkjrnk";
-      name = "kdbusaddons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdbusaddons-5.114.0.tar.xz";
+      sha256 = "0pzzznyxhi48z5hhdsdxz3vaaihrdshpx65ha2v2nn2gh3ww7ikm";
+      name = "kdbusaddons-5.114.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdeclarative-5.113.0.tar.xz";
-      sha256 = "1wj9arkmjdrac04cq2w5bw5184jnlq5xn2cw6n7lajc31yrbc0rk";
-      name = "kdeclarative-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdeclarative-5.114.0.tar.xz";
+      sha256 = "0w98pj8acxb4m9645963rzq5vja1fbih5czz24mf9zdqlg2dkz8g";
+      name = "kdeclarative-5.114.0.tar.xz";
     };
   };
   kded = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kded-5.113.0.tar.xz";
-      sha256 = "1vb3z7r2l206n7p70a4cbkrm7fvyk7hqqf0bz7514r4g86l4l5n4";
-      name = "kded-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kded-5.114.0.tar.xz";
+      sha256 = "00n4isc4ahii0ldrg761lkmnq27kmrfqs9zkmpvmgbg57259mvc3";
+      name = "kded-5.114.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kdelibs4support-5.113.0.tar.xz";
-      sha256 = "1z843zq1g5n3b8gb20y8266hyikvbzdsgc77gvcgzvqfdxk19l24";
-      name = "kdelibs4support-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kdelibs4support-5.114.0.tar.xz";
+      sha256 = "17473him2fjfcw5f88diarqac815wsakfyb9fka82a4qqh9l41mc";
+      name = "kdelibs4support-5.114.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kdesignerplugin-5.113.0.tar.xz";
-      sha256 = "05hwq8rpm1f9ad5fyk2gjqxm6gvvx2gx2zdbklww9ghlh8qndl9i";
-      name = "kdesignerplugin-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kdesignerplugin-5.114.0.tar.xz";
+      sha256 = "0zlvkayv6zl5rp1076bscmdzyw93y7sxqb5848w11vs0g9amcj9n";
+      name = "kdesignerplugin-5.114.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdesu-5.113.0.tar.xz";
-      sha256 = "085d3d6qpl4m7z8smm0bq9khfjjglpb1gd9n8q0d541127y2cpq4";
-      name = "kdesu-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdesu-5.114.0.tar.xz";
+      sha256 = "14dcf32izn4lxr8vx372rfznflc1rcxwanx06phkd8mx9zyg4jxr";
+      name = "kdesu-5.114.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kdewebkit-5.113.0.tar.xz";
-      sha256 = "18bmg88xj07h8y5f3f2ckjs9m61mf8jrxrg4vg8hrf4nabxz20xn";
-      name = "kdewebkit-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kdewebkit-5.114.0.tar.xz";
+      sha256 = "04zc2qs13k04gsn124mnh6sqi3pax8c014jcb0qdh3h2r2y72bz3";
+      name = "kdewebkit-5.114.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdnssd-5.113.0.tar.xz";
-      sha256 = "1hbb9zy1f13m45b6kzndxw619vnmx0s418brqgkdaxgsh12j5anq";
-      name = "kdnssd-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdnssd-5.114.0.tar.xz";
+      sha256 = "1zw5rkprr54j05ic8zljk57zahp2v6333slr253r3n1679zqlv64";
+      name = "kdnssd-5.114.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kdoctools-5.113.0.tar.xz";
-      sha256 = "0cfs4znhp7psrz99j3brp8q39gg0bpzvkrdx90zl6vvrc06d2zaa";
-      name = "kdoctools-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kdoctools-5.114.0.tar.xz";
+      sha256 = "15s58r2zvdckw30x9q9ir8h1i8q2ncfgjn9h4jnmylwm79z3z27v";
+      name = "kdoctools-5.114.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kemoticons-5.113.0.tar.xz";
-      sha256 = "127frvsp1h9hg755vz2i609wxqqgzgsz15iqr7hcpbmmf6xvm8i2";
-      name = "kemoticons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kemoticons-5.114.0.tar.xz";
+      sha256 = "0w87prkhdmba7y8ylbycdpwdzd2djmp7hvv5ljb9s4aqqhnn3vw4";
+      name = "kemoticons-5.114.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kfilemetadata-5.113.0.tar.xz";
-      sha256 = "1ap25y66y1r185fghvkkkkp4f6acnkazny8wxw5hv1gg25ilpsir";
-      name = "kfilemetadata-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kfilemetadata-5.114.0.tar.xz";
+      sha256 = "15va29chlsrxii02w1ax718hp1b14ym59lcfyzh7w30zlf681560";
+      name = "kfilemetadata-5.114.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kglobalaccel-5.113.0.tar.xz";
-      sha256 = "0ibm1wd7fhi3j5za0agyq2zrs9nx5a8b47iijkzgkpz9ylxniwrs";
-      name = "kglobalaccel-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kglobalaccel-5.114.0.tar.xz";
+      sha256 = "19mmav055fnzyl760fyhf0pdvaidd5i1h04l2hcnpin4p1jnpfap";
+      name = "kglobalaccel-5.114.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kguiaddons-5.113.0.tar.xz";
-      sha256 = "1ykhxgx89x1qv916pcz3j0q14ylalg9v23jjw0dbwpg5hlj4qlyc";
-      name = "kguiaddons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kguiaddons-5.114.0.tar.xz";
+      sha256 = "0riya9plcz9c1ndhdbsradssndshbm12705swn7vf7am17n7f947";
+      name = "kguiaddons-5.114.0.tar.xz";
     };
   };
   kholidays = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kholidays-5.113.0.tar.xz";
-      sha256 = "1wq397j3m3s9a45k9h5hsdsfansvb3a5q8biag2w3fsb1i84id0i";
-      name = "kholidays-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kholidays-5.114.0.tar.xz";
+      sha256 = "19r8dxglz5ll6iyvigsccil3ikvcsnyy5nwcpjvjr1c0brigcjmy";
+      name = "kholidays-5.114.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/khtml-5.113.0.tar.xz";
-      sha256 = "0m284rwq8f49j71lcapzr4qi0f72a0adnv67mfg5blar867161mq";
-      name = "khtml-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/khtml-5.114.0.tar.xz";
+      sha256 = "1mf84zs9hjvmi74f8rgqzrfkqjq597f9k64dn1bqcj13v0w10vry";
+      name = "khtml-5.114.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/ki18n-5.113.0.tar.xz";
-      sha256 = "0hl0qp3653xiwa5ndk82ygy2kgrc0pygqkknb1cx5w54s56bm57w";
-      name = "ki18n-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/ki18n-5.114.0.tar.xz";
+      sha256 = "1yg03awcx5ay6lgbgwv91i0ankrm94z9m0wky4v03gnwnvw8pa0v";
+      name = "ki18n-5.114.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kiconthemes-5.113.0.tar.xz";
-      sha256 = "0q2c1s8pwl7dnx9v7q061zn5n1prk0vv0j77kki9wfncjaf15g0g";
-      name = "kiconthemes-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kiconthemes-5.114.0.tar.xz";
+      sha256 = "0ndiqmcs1ybj4acc6k3p9jwq09slqc4nj12ifqvlxrfj3ak6sb28";
+      name = "kiconthemes-5.114.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kidletime-5.113.0.tar.xz";
-      sha256 = "1cdfhn3mcxvizba1gpf0viba3g0mnva3l226lkca3p9ps8c4z3rm";
-      name = "kidletime-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kidletime-5.114.0.tar.xz";
+      sha256 = "06sc9w54g4n7s5gjkqz08rgcz6v3pr0bdgx3gbjgzass6l4m8w7p";
+      name = "kidletime-5.114.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kimageformats-5.113.0.tar.xz";
-      sha256 = "0gys83sazgbj7h3yiaacqr464z951ixygrhzcw16cnqjm8phic44";
-      name = "kimageformats-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kimageformats-5.114.0.tar.xz";
+      sha256 = "1nfzpgnrbwncx9zp9cwa169jlfv7i85p00a07d4jc5hrdyvvkn0w";
+      name = "kimageformats-5.114.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kinit-5.113.0.tar.xz";
-      sha256 = "1ydmgxyr5j9zi0a5vlb64kkjxka3rsyvzj10y3dww92qyapnn2bv";
-      name = "kinit-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kinit-5.114.0.tar.xz";
+      sha256 = "0b6z9gq05vz20hm5y9ai3sbqq3gxwm3a3z88dkvi7dywk7vbqcph";
+      name = "kinit-5.114.0.tar.xz";
     };
   };
   kio = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kio-5.113.0.tar.xz";
-      sha256 = "1bjmv3wdpmzqbv1xzzl0ydirccbknnjyqn6wzb057zgy7kpi1cd8";
-      name = "kio-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kio-5.114.0.tar.xz";
+      sha256 = "0nwmxbfhvfw69q07vxvflri7rkdczyc89xv4ll3nrzrhgf15kb2z";
+      name = "kio-5.114.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kirigami2-5.113.0.tar.xz";
-      sha256 = "0zy3s841q2xw4d048a3qh4cfh9kb3qaqxml4ny5zi73crm173h8y";
-      name = "kirigami2-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kirigami2-5.114.0.tar.xz";
+      sha256 = "1bd232gs4394fa3aq31mjqrn8f3vjsghx7817szi7ryvnn6fnqkw";
+      name = "kirigami2-5.114.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kitemmodels-5.113.0.tar.xz";
-      sha256 = "01i1s7rw7ndp3gnl3bg0pv8a9qz95rmz0jxkw97p72gcah2q2yvk";
-      name = "kitemmodels-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kitemmodels-5.114.0.tar.xz";
+      sha256 = "1bfmcrbcbrvp2rcaf32vzvarqwp41gn6s4xpf56hnxbwf9kgk1fl";
+      name = "kitemmodels-5.114.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kitemviews-5.113.0.tar.xz";
-      sha256 = "0wnmgm72kv7vxadsrkdbnjknb4lkzrmn6gk7car7jx2i91kz7xdd";
-      name = "kitemviews-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kitemviews-5.114.0.tar.xz";
+      sha256 = "00vl2ck0pq0sqcxvhlr2pimgr27hd9v7y9dz6w4arb5smi5q1ixg";
+      name = "kitemviews-5.114.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kjobwidgets-5.113.0.tar.xz";
-      sha256 = "0f5shrapjvwp8bc34vypzfsfl07pj7nmdflf9lcwc8h3kwf2rxqr";
-      name = "kjobwidgets-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kjobwidgets-5.114.0.tar.xz";
+      sha256 = "1ymlqi5cqcs79nj1vff8pqwgvy0dxj5vv7l529w3a3n315hkrny8";
+      name = "kjobwidgets-5.114.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kjs-5.113.0.tar.xz";
-      sha256 = "0h50jyd9mddnavafikn9haqqcq1mql2v8qcc1c233ffplkx1f6hb";
-      name = "kjs-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kjs-5.114.0.tar.xz";
+      sha256 = "08nh6yr6bqifpb5s9a4wbjwmwnm7zp5k8hcdmyb6mlcbam9qp6j7";
+      name = "kjs-5.114.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kjsembed-5.113.0.tar.xz";
-      sha256 = "0bwsj0n3d038vs3n2mw6x8srbg4da40bw59q14cpv70ws1sg2r2n";
-      name = "kjsembed-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kjsembed-5.114.0.tar.xz";
+      sha256 = "1xglisxv7nfsbj9lgpvc4c5ql4f6m7n71vf7vih5ff3aqybrkgxa";
+      name = "kjsembed-5.114.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kmediaplayer-5.113.0.tar.xz";
-      sha256 = "1nyn7x28j17yrb7zx31519h2ghp5h3pwk6baxais0q1mv9azyfay";
-      name = "kmediaplayer-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kmediaplayer-5.114.0.tar.xz";
+      sha256 = "092yvzvrkvr8xxncw7h5ghfd2bggzxsqfj67c2vhymhfw4i0c54x";
+      name = "kmediaplayer-5.114.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/knewstuff-5.113.0.tar.xz";
-      sha256 = "0fj17rxyp9wmmc9jh8zjpgwpia9r4xlvabvkb4ynd1vhy58k8w51";
-      name = "knewstuff-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/knewstuff-5.114.0.tar.xz";
+      sha256 = "15xmx7rnnrsz2cj044aviyr4hi9h8r0nnva9qzcjcq2hkkgj7wjj";
+      name = "knewstuff-5.114.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/knotifications-5.113.0.tar.xz";
-      sha256 = "1yzpf12wsi3h3v7z68b42rjdrnfkah6avq4y611b0r004shgkl1x";
-      name = "knotifications-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/knotifications-5.114.0.tar.xz";
+      sha256 = "0cjd5ml9hyzprjgmrc132cmp7g9hnl0h5swlxw2ifqnxxyfkg72b";
+      name = "knotifications-5.114.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/knotifyconfig-5.113.0.tar.xz";
-      sha256 = "1gdzyxcc371lmnzc153k8wdyxgsv7r2y44j8d5srld36amssxnc6";
-      name = "knotifyconfig-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/knotifyconfig-5.114.0.tar.xz";
+      sha256 = "049n64qlr69zv1dc1dhgbsca37179hp06xfsxnhg97lblz3p3gds";
+      name = "knotifyconfig-5.114.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kpackage-5.113.0.tar.xz";
-      sha256 = "04605kr2w0yhwx64lqq1qc1zmmip7vkxnxv3fs2846864814fkk2";
-      name = "kpackage-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kpackage-5.114.0.tar.xz";
+      sha256 = "0v165az3k5lfszxy0kl2464573y0dcq92fyfiklwnkkcjsvba69d";
+      name = "kpackage-5.114.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kparts-5.113.0.tar.xz";
-      sha256 = "0mx95xrr6pad4q5p0sn2iqmc59787bpfkvkyiz9li56wynh1jf48";
-      name = "kparts-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kparts-5.114.0.tar.xz";
+      sha256 = "1rrf765p554r7l8j23gx5zxdq6wimh0v91qdkwz7ilm2qr16vd5v";
+      name = "kparts-5.114.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kpeople-5.113.0.tar.xz";
-      sha256 = "08g44hq1iywycf44imdqkql4gx2vyg87n1nxxqq6ssva0kybia7n";
-      name = "kpeople-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kpeople-5.114.0.tar.xz";
+      sha256 = "04v0s3amn6lbb16qvp1r6figckva6xk8z7djk8jda8fbnx8dx2r1";
+      name = "kpeople-5.114.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kplotting-5.113.0.tar.xz";
-      sha256 = "16pfia711y9iqnl0svyg00g7a2x4ln8yaxmrmy74xj7y0dj5jcyj";
-      name = "kplotting-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kplotting-5.114.0.tar.xz";
+      sha256 = "17x58pplln0plqiyhjpzdiqxngylxq5gkc5gk7b91xzm783x2k0n";
+      name = "kplotting-5.114.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kpty-5.113.0.tar.xz";
-      sha256 = "0hzn18lidiiaxr08fjhk0r5zh0m01ls46w1fyjnv42bvf7vd7v5y";
-      name = "kpty-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kpty-5.114.0.tar.xz";
+      sha256 = "0fm7bfp89kvg1a64q8piiyal71p6vjnqcm13zak6r9fbfwcm0gs9";
+      name = "kpty-5.114.0.tar.xz";
     };
   };
   kquickcharts = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kquickcharts-5.113.0.tar.xz";
-      sha256 = "0v47c6mdx72rdz441zk4csc6a2bj6wi7772vlpz2yr3ay70l8f5d";
-      name = "kquickcharts-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kquickcharts-5.114.0.tar.xz";
+      sha256 = "1f91x92qdzxp31z7ixx9jn41hq9f3w9hjia94pab9vsnaz8prbd1";
+      name = "kquickcharts-5.114.0.tar.xz";
     };
   };
   kross = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kross-5.113.0.tar.xz";
-      sha256 = "1cqdcm086a4kjrb9k6cwqn05fg5ij3zppc8bi7dxrgrfxc494c8s";
-      name = "kross-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kross-5.114.0.tar.xz";
+      sha256 = "0bbpi63lxbb4ylx2jd172a2bqyxkd606n7w8zrvcjy466lkv3sz4";
+      name = "kross-5.114.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/krunner-5.113.0.tar.xz";
-      sha256 = "0z7d6nyvrlgr7aw9ibz1xgp62220iwzvhqpqikwlxhc9hjggmdlh";
-      name = "krunner-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/krunner-5.114.0.tar.xz";
+      sha256 = "1rjs9b87bi4f6pdm9fwnha2sj2mrq260l80iz2jq1zah83p546sw";
+      name = "krunner-5.114.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kservice-5.113.0.tar.xz";
-      sha256 = "09ph72jb40pkw1nzayvzzav4m6240amkj6jvx390dmsvr7jzn0nb";
-      name = "kservice-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kservice-5.114.0.tar.xz";
+      sha256 = "0jdvlplnsb9w628wh3ip6awxvhgyc097zh7ls9614ymkbnpc9xca";
+      name = "kservice-5.114.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/ktexteditor-5.113.0.tar.xz";
-      sha256 = "02nclhfgqximsl8w6la5w0fshzcj71nrz5kjb2p1s28xdf1ahvgg";
-      name = "ktexteditor-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/ktexteditor-5.114.0.tar.xz";
+      sha256 = "06amzk6290imi2gj3v1k3f56zdlad7zbz4wwlf34v4iibj9mfgw8";
+      name = "ktexteditor-5.114.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/ktextwidgets-5.113.0.tar.xz";
-      sha256 = "060grfna4kj8nhxgk38yf3csqfgxg0358dkwmg8aw5y5k0jys2az";
-      name = "ktextwidgets-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/ktextwidgets-5.114.0.tar.xz";
+      sha256 = "0w1wwyd3fy351rmkhf3i55is5031j2zxvswm0b1sb3pd159v888v";
+      name = "ktextwidgets-5.114.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kunitconversion-5.113.0.tar.xz";
-      sha256 = "1x7gwrz43wvd3r87x545bxxyzhqj87mhhx05dqh0b09vqk6gxzza";
-      name = "kunitconversion-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kunitconversion-5.114.0.tar.xz";
+      sha256 = "1qyqvl8fy105zwma5nrkz9zg5932w2f33daw0azhj322iffrm39n";
+      name = "kunitconversion-5.114.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kwallet-5.113.0.tar.xz";
-      sha256 = "0aq8d5c5p9j19bzspd205gh297n7fh5f26m49826fx5mp1im4lwn";
-      name = "kwallet-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kwallet-5.114.0.tar.xz";
+      sha256 = "1cji8bvy5m77zljyrrgipsw8pxcds1sgikxlq3sdfxymcsw2wr36";
+      name = "kwallet-5.114.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kwayland-5.113.0.tar.xz";
-      sha256 = "1anhvz4b1q835py451jznnfj9z2jh1fwnx4lfwhi67viaplpiwqg";
-      name = "kwayland-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kwayland-5.114.0.tar.xz";
+      sha256 = "1lzmlbv5vl656cigjj07hbc0gj6g1i2xqanvnhxj360109kzilf1";
+      name = "kwayland-5.114.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kwidgetsaddons-5.113.0.tar.xz";
-      sha256 = "01rabfl2v5l9r3fgwgy75krib1486mdc4k3kfi035s6dvg8iy015";
-      name = "kwidgetsaddons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kwidgetsaddons-5.114.0.tar.xz";
+      sha256 = "1cc8lsk9v0cp2wiy1q26mlkf8np0yj01sq8a7w13ga5s6hv4sh2n";
+      name = "kwidgetsaddons-5.114.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kwindowsystem-5.113.0.tar.xz";
-      sha256 = "1hzavawsl14rsl9qb874zahvsvkrbcin7fg1xn1d7ssypphlis51";
-      name = "kwindowsystem-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kwindowsystem-5.114.0.tar.xz";
+      sha256 = "03xbsf1pmswd2kpn3pdszp4vndclsh7j02fp22npxaxllmfr4va9";
+      name = "kwindowsystem-5.114.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/kxmlgui-5.113.0.tar.xz";
-      sha256 = "022l557z9jgrz2hj8hh9z7cjkvfhl5rdp81jhk2gd3wzmyf5zzmq";
-      name = "kxmlgui-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/kxmlgui-5.114.0.tar.xz";
+      sha256 = "0gvjf32ssc0r0bdpb1912ldsr5rjls8vrscwy5gm9g5gw504hmmr";
+      name = "kxmlgui-5.114.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/portingAids/kxmlrpcclient-5.113.0.tar.xz";
-      sha256 = "141vlxxnyll5q0wg2va5prg0wf0hpymlzfkg37h1ngjwjs2x2yc1";
-      name = "kxmlrpcclient-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/portingAids/kxmlrpcclient-5.114.0.tar.xz";
+      sha256 = "1fgjai3vj3yk67ynhd7blilyrdhdn5nvma3v3j1sbdg98pr7qzar";
+      name = "kxmlrpcclient-5.114.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/modemmanager-qt-5.113.0.tar.xz";
-      sha256 = "069irg7ckws06qzq5mwkxvzx4r2xqwagwif6dq284hjihrz38l8b";
-      name = "modemmanager-qt-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/modemmanager-qt-5.114.0.tar.xz";
+      sha256 = "16jqhmcpsffl9a7c0bb4hwjy3bw5rakdsnc5n6y8djc6237jl9pi";
+      name = "modemmanager-qt-5.114.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/networkmanager-qt-5.113.0.tar.xz";
-      sha256 = "03wdbw6dr9a49qcs1j2lm9q894rvdl8xqjpwm3yrrjb866yyhcg1";
-      name = "networkmanager-qt-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/networkmanager-qt-5.114.0.tar.xz";
+      sha256 = "10anjsnrzawrfjlznjvvl2sbxrajl2ddnq2kgl314b5dk7z3yk4n";
+      name = "networkmanager-qt-5.114.0.tar.xz";
     };
   };
   oxygen-icons = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/oxygen-icons-5.113.0.tar.xz";
-      sha256 = "0grdn0gz59lfp4n5mmlan71x3iwgm87dnhk8mla02dn7hv0fl0xx";
-      name = "oxygen-icons-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/oxygen-icons-5.114.0.tar.xz";
+      sha256 = "0f6hv5g8y2ggagrq9x9b78bqxqg6bqcpm1xxhf69ybgjikrqdf2r";
+      name = "oxygen-icons-5.114.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/plasma-framework-5.113.0.tar.xz";
-      sha256 = "0iijawnh9ri1n6qgdrraf3lq5sy7z0jy5ihmfzk22pn10ba992ky";
-      name = "plasma-framework-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/plasma-framework-5.114.0.tar.xz";
+      sha256 = "058hl76q35bw3rzmv348azk1lmhkpgmfrxr3jd9s1hphijr8sgcx";
+      name = "plasma-framework-5.114.0.tar.xz";
     };
   };
   prison = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/prison-5.113.0.tar.xz";
-      sha256 = "18y4gxj5zml59a8i7gzr5cbbzi5wyknbva2ihfdpqf85vw3x2wdp";
-      name = "prison-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/prison-5.114.0.tar.xz";
+      sha256 = "1wbr1lryxmrx65ilq1bhqsdhhikrih977nhpb02fq0cqnvv7v9i7";
+      name = "prison-5.114.0.tar.xz";
     };
   };
   purpose = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/purpose-5.113.0.tar.xz";
-      sha256 = "0p5zcvrkaw71w8795x2a4lx3z977j6jcnwbi9wi1956gcx4avhhf";
-      name = "purpose-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/purpose-5.114.0.tar.xz";
+      sha256 = "1lj67f0x4gvbh9by3c3crbbwwnx7b9ifjna9ggziya4m6zj0m4z1";
+      name = "purpose-5.114.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/qqc2-desktop-style-5.113.0.tar.xz";
-      sha256 = "0sk0sk7cq511m0rjmgsg1z8s4sy064qmbql472ljyblafm71wj6p";
-      name = "qqc2-desktop-style-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/qqc2-desktop-style-5.114.0.tar.xz";
+      sha256 = "1y5g91vybjvhwmzpfwrc70q5j7jxf5b972f9fh2vzb930jir6c8g";
+      name = "qqc2-desktop-style-5.114.0.tar.xz";
     };
   };
   solid = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/solid-5.113.0.tar.xz";
-      sha256 = "0vhhkn15axfvlwrf9np91hnipw1lb2x9zh0ajpngvxzcnj6kvn7r";
-      name = "solid-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/solid-5.114.0.tar.xz";
+      sha256 = "1slxlj5jhp8g745l328932934633nl81sq3n8fd73h655hymsk4s";
+      name = "solid-5.114.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/sonnet-5.113.0.tar.xz";
-      sha256 = "17v3a2j0vhx7mzv0wfgqky248m57gasyv1xbjqpzjdr3x2f1zhy6";
-      name = "sonnet-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/sonnet-5.114.0.tar.xz";
+      sha256 = "0zxi96i3gfpx759qc1nyz7jqlswg5ivgr1w9gbbsm1x5fi9ikadx";
+      name = "sonnet-5.114.0.tar.xz";
     };
   };
   syndication = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/syndication-5.113.0.tar.xz";
-      sha256 = "1nzcfk4qsjvrgci3vk78jjpbig61pm0y73h3qs83yld1zw3az3jx";
-      name = "syndication-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/syndication-5.114.0.tar.xz";
+      sha256 = "13rjb1zm9yd8vbm9h7avqih5v0rr2srqwglm29l7mcnankqlh4n7";
+      name = "syndication-5.114.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/syntax-highlighting-5.113.0.tar.xz";
-      sha256 = "1blifnqikvrlkcskwjdk54mvh8yd4r0vzz282mi64w7alimlilgl";
-      name = "syntax-highlighting-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/syntax-highlighting-5.114.0.tar.xz";
+      sha256 = "1skblg2m0sar63qrgkjsg0w9scixggm5qj7lp4gzjn4hwq6m3n63";
+      name = "syntax-highlighting-5.114.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.113.0";
+    version = "5.114.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.113/threadweaver-5.113.0.tar.xz";
-      sha256 = "1x7i7mdg5v22y04m720k9fqj7xagm8qnlssb1xjs9nj0aqif8jgp";
-      name = "threadweaver-5.113.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.114/threadweaver-5.114.0.tar.xz";
+      sha256 = "1y07g58w6z3i11y3djg3aaxanhp9hzaciq61l4dn1gqwghn09xgh";
+      name = "threadweaver-5.114.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/libcamera/default.nix b/pkgs/development/libraries/libcamera/default.nix
index 076eccb1c26ef..232fb29ecbe53 100644
--- a/pkgs/development/libraries/libcamera/default.nix
+++ b/pkgs/development/libraries/libcamera/default.nix
@@ -22,12 +22,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "0.0.5";
+  version = "0.1.0";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
     rev = "v${version}";
-    hash = "sha256-rd1YIEosg4+H/FJBYCoxdQlV9F0evU5fckHJrSdVPOE=";
+    hash = "sha256-icHZtv25QvJEv0DlELT3cDxho3Oz2BJAMNKr5W4bshk=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 5cb8f2cbad8e8..8d8a932f4994e 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.119";
+  version = "2.4.120";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-CknxLwm1tuaOqq/z8Cynz/mqkmk5shLTQxYdPorFYpE=";
+    hash = "sha256-O/VTY/dsclCUZEGrUdOmzArlGAVcD/AXMkq3bN77Mno=";
   };
 
   outputs = [ "out" "dev" "bin" ];
diff --git a/pkgs/development/libraries/libjxl/default.nix b/pkgs/development/libraries/libjxl/default.nix
index 820f466d84473..8454f3e1e83b3 100644
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@@ -9,7 +9,7 @@
 , libjpeg
 , libpng
 , libwebp
-, openexr
+, openexr_3
 , pkg-config
 , zlib
 , buildDocs ? true
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
     libjpeg
     libpng
     libwebp
-    openexr
+    openexr_3
     zlib
   ];
 
diff --git a/pkgs/development/libraries/libmbim/default.nix b/pkgs/development/libraries/libmbim/default.nix
index 9965771c1531a..8ceb1b3b03bf3 100644
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -19,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libmbim";
-  version = "1.28.4";
+  version = "1.30.0";
 
   outputs = [ "out" "dev" ]
     ++ lib.optionals withDocs [ "man" ];
@@ -29,27 +28,9 @@ stdenv.mkDerivation rec {
     owner = "mobile-broadband";
     repo = "libmbim";
     rev = version;
-    hash = "sha256-aaYjvJ2OMTzkUyqWCyHdmsKJ3VGqBmKQzb1DWK/1cPU=";
+    hash = "sha256-sHTpu9WeMZroT+1I18ObEHWSzcyj/Relyz8UNe+WawI=";
   };
 
-  patches = [
-    # Intel Mutual Authentication - FCC lock. Part of 1.30, backported to
-    # openSUSE and Fedora and ChromeOS.
-    # https://src.fedoraproject.org/rpms/libmbim/blob/rawhide/f/libmbim.spec
-    (fetchpatch {
-      url = "https://cgit.freedesktop.org/libmbim/libmbim/patch/?id=910db9cb2b6fde303d3b4720890cf6dc6fc00880";
-      hash = "sha256-412sXdWb8WsSexe1scI/C57dwENgNWoREGO1GxSF4hs=";
-    })
-
-    # Intel Tools. Allows tracing various commands. Part of 1.30, backported to
-    # openSUSE, Fedora and ChromeOS.
-    # https://src.fedoraproject.org/rpms/libmbim/blob/rawhide/f/libmbim.spec
-    (fetchpatch {
-      url = "https://cgit.freedesktop.org/libmbim/libmbim/patch/?id=8a6dec6ed11931601e605c9537da9904b3be5bc0";
-      hash = "sha256-tU4zkUl5aZJE+g/qbnWprUHe/PmZvqVKB9qecSaUBhk=";
-    })
-  ];
-
   mesonFlags = [
     "-Dudevdir=${placeholder "out"}/lib/udev"
     (lib.mesonBool "introspection" withIntrospection)
diff --git a/pkgs/development/libraries/libplacebo/default.nix b/pkgs/development/libraries/libplacebo/default.nix
index 60a3f89895784..c303ffb295589 100644
--- a/pkgs/development/libraries/libplacebo/default.nix
+++ b/pkgs/development/libraries/libplacebo/default.nix
@@ -10,21 +10,22 @@
 , shaderc
 , lcms2
 , libGL
-, xorg
+, libX11
 , libunwind
 , libdovi
+, xxHash
 }:
 
 stdenv.mkDerivation rec {
   pname = "libplacebo";
-  version = "5.264.1";
+  version = "6.338.1";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-YEefuEfJURi5/wswQKskA/J1UGzessQQkBpltJ0Spq8=";
+    hash = "sha256-NZmwR3+lIC2PF+k+kqCjoMYkMM/PKOJmDwAq7t6YONY=";
   };
 
   nativeBuildInputs = [
@@ -41,18 +42,19 @@ stdenv.mkDerivation rec {
     shaderc
     lcms2
     libGL
-    xorg.libX11
+    libX11
     libunwind
     libdovi
+    xxHash
   ];
 
-  mesonFlags = [
-    "-Dvulkan-registry=${vulkan-headers}/share/vulkan/registry/vk.xml"
-    "-Ddemos=false" # Don't build and install the demo programs
-    "-Dd3d11=disabled" # Disable the Direct3D 11 based renderer
-    "-Dglslang=disabled" # rely on shaderc for GLSL compilation instead
-  ] ++ lib.optionals stdenv.isDarwin [
-    "-Dunwind=disabled" # libplacebo doesn’t build with `darwin.libunwind`
+  mesonFlags = with lib; [
+    (mesonOption "vulkan-registry" "${vulkan-headers}/share/vulkan/registry/vk.xml")
+    (mesonBool "demos" false) # Don't build and install the demo programs
+    (mesonEnable "d3d11" false) # Disable the Direct3D 11 based renderer
+    (mesonEnable "glslang" false) # rely on shaderc for GLSL compilation instead
+  ] ++ optionals stdenv.isDarwin [
+    (mesonEnable "unwind" false) # libplacebo doesn’t build with `darwin.libunwind`
   ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libqmi/default.nix b/pkgs/development/libraries/libqmi/default.nix
index 6f7583d563b10..58fadd30ee8d5 100644
--- a/pkgs/development/libraries/libqmi/default.nix
+++ b/pkgs/development/libraries/libqmi/default.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.32.4";
+  version = "1.34.0";
 
   outputs = [ "out" "dev" ]
     ++ lib.optional withIntrospection "devdoc";
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     owner = "mobile-broadband";
     repo = "libqmi";
     rev = version;
-    hash = "sha256-cczGvoD+2+G6uiAt0Iv1BO4/FqzO9bkqhFsEwOfp7qw=";
+    hash = "sha256-l9ev9ZOWicVNZ/Wj//KNd3NHcefIrLVriqJhEpwWvtQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libraw/default.nix b/pkgs/development/libraries/libraw/default.nix
index b03be435aac51..d8e9f1f5a2f5d 100644
--- a/pkgs/development/libraries/libraw/default.nix
+++ b/pkgs/development/libraries/libraw/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , autoreconfHook
 , lcms2
 , pkg-config
@@ -16,23 +15,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libraw";
-  version = "0.21.1";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "LibRaw";
     repo = "LibRaw";
     rev = version;
-    sha256 = "sha256-K9mULf6V/TCl5Vu4iuIdSGF9HzQlgNQLRFHIpNbmAlY";
+    hash = "sha256-p9CmOCulvV7+KKn1lXwpcysOo0+mD5UgPqy2ki0cIFE=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2023-1729.patch";
-      url = "https://github.com/LibRaw/LibRaw/commit/9ab70f6dca19229cb5caad7cc31af4e7501bac93.patch";
-      hash = "sha256-OAyqphxvtSM15NI77HwtGTmTmP9YNu3xhZ6D1CceJ7I=";
-    })
-  ];
-
   outputs = [ "out" "lib" "dev" "doc" ];
 
   propagatedBuildInputs = [ lcms2 ];
diff --git a/pkgs/development/libraries/libunwind/default.nix b/pkgs/development/libraries/libunwind/default.nix
index 6f05307381a09..7330e42ff323a 100644
--- a/pkgs/development/libraries/libunwind/default.nix
+++ b/pkgs/development/libraries/libunwind/default.nix
@@ -1,22 +1,16 @@
-{ stdenv, lib, fetchurl, fetchpatch, autoreconfHook, xz, buildPackages }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, autoreconfHook, xz, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "libunwind";
-  version = "1.6.2";
+  version = "1.7.2";
 
-  src = fetchurl {
-    url = "mirror://savannah/libunwind/${pname}-${version}.tar.gz";
-    sha256 = "sha256-SmrsZmmR+0XQiJxErt6K1usQgHHDVU/N/2cfnJR5SXY=";
+  src = fetchFromGitHub {
+    owner = "libunwind";
+    repo = "libunwind";
+    rev = "v${version}";
+    hash = "sha256-z5YCue0zadQnMEbGFniFvDjXNy6dSHQDQnXRXS6Uh/Y=";
   };
 
-  patches = [
-    # Fix for aarch64 and non-4K pages. Remove once upgraded past 1.6.2.
-    (fetchpatch {
-      url = "https://github.com/libunwind/libunwind/commit/e85b65cec757ef589f28957d0c6c21c498a03bdf.patch";
-      sha256 = "1lnlygvhqrdrjgw303pg2k2k4ms4gaghpjsgmhk47q83vy1yjwfg";
-    })
-  ];
-
   postPatch = if (stdenv.cc.isClang || stdenv.hostPlatform.isStatic) then ''
     substituteInPlace configure.ac --replace "-lgcc_s" ""
   '' else lib.optionalString stdenv.hostPlatform.isMusl ''
@@ -46,7 +40,7 @@ stdenv.mkDerivation rec {
     description = "A portable and efficient API to determine the call-chain of a program";
     maintainers = with maintainers; [ orivej ];
     # https://github.com/libunwind/libunwind#libunwind
-    platforms = [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-freebsd13" "i686-linux" "mips64el-linux" "mipsel-linux" "powerpc64-linux" "powerpc64le-linux" "riscv64-linux" "x86_64-freebsd13" "x86_64-linux" "x86_64-solaris" ];
+    platforms = [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-freebsd13" "i686-linux" "mips64el-linux" "mipsel-linux" "powerpc64-linux" "powerpc64le-linux" "riscv64-linux" "loongarch64-linux" "x86_64-freebsd13" "x86_64-linux" "x86_64-solaris" ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/development/libraries/libxmlb/default.nix b/pkgs/development/libraries/libxmlb/default.nix
index 391874e531d73..522d3546b8e0a 100644
--- a/pkgs/development/libraries/libxmlb/default.nix
+++ b/pkgs/development/libraries/libxmlb/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libxmlb";
-  version = "0.3.14";
+  version = "0.3.15";
 
   outputs = [ "out" "lib" "dev" "devdoc" "installedTests" ];
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     owner = "hughsie";
     repo = "libxmlb";
     rev = version;
-    hash = "sha256-lpVXl/n/ecDLbbLQg9T+o4GdGZM7pNXGYTyVogNCl2E=";
+    hash = "sha256-S0wBVhfRa81mAmqpYYAKAyKLnfnVsXJEcGA21i5tdzo=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index dbca7f7fc2b79..95ecbbc44deea 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -60,6 +60,8 @@ stdenv.mkDerivation rec {
     "--without-crypto"
   ];
 
+  enableParallelBuilding = true;
+
   postFixup = ''
     moveToOutput bin/xslt-config "$dev"
     moveToOutput lib/xsltConf.sh "$dev"
diff --git a/pkgs/development/libraries/libzip/default.nix b/pkgs/development/libraries/libzip/default.nix
index 14e2f44808242..b343184760330 100644
--- a/pkgs/development/libraries/libzip/default.nix
+++ b/pkgs/development/libraries/libzip/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , cmake
+, fetchpatch2
 , fetchurl
 , perl
 , zlib
@@ -24,6 +25,15 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-lmmuXf46xbOJdTbchGaodMjPLA47H90I11snOIQpk2M=";
   };
 
+  patches = [
+    # https://github.com/nih-at/libzip/issues/404
+    (fetchpatch2 {
+      name = "Check-for-zstd_TARGET-before-using-it-in-a-regex.patch";
+      url = "https://github.com/nih-at/libzip/commit/c719428916b4d19e838f873b1a177b126a080d61.patch";
+      hash = "sha256-4ksbXEM8kNvs3wtbIaXLEQNSKaxl0es/sIg0EINaTHE=";
+    })
+  ];
+
   outputs = [ "out" "dev" "man" ];
 
   nativeBuildInputs = [ cmake perl groff ];
diff --git a/pkgs/development/libraries/openexr/default.nix b/pkgs/development/libraries/openexr/default.nix
index 1a135fa6d4a80..6d45ca33e982c 100644
--- a/pkgs/development/libraries/openexr/default.nix
+++ b/pkgs/development/libraries/openexr/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "2.5.8";
+  version = "2.5.10";
 
   outputs = [ "bin" "dev" "out" "doc" ];
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    sha256 = "sha256-N7XdDaDsYdx4TXvHplQDTvhHNUmW5rntdaTKua4C0es=";
+    hash = "sha256-xdC+T79ZQBx/XhuIXtP93Roj0N9lF+E65ReEKQ4kIsg=";
   };
 
   patches = [
@@ -36,8 +36,7 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-DrpldpNgN5pWKzIuuPIrynGX3EpP8YhJlu+lLfNFGxQ=";
     })
 
-    # Backport gcc-13 fix:
-    #   https://github.com/AcademySoftwareFoundation/openexr/pull/1264
+    # GCC 13 fixes
     ./gcc-13.patch
   ];
 
diff --git a/pkgs/development/libraries/openexr/gcc-13.patch b/pkgs/development/libraries/openexr/gcc-13.patch
index d508b6028f76d..6264a8df24331 100644
--- a/pkgs/development/libraries/openexr/gcc-13.patch
+++ b/pkgs/development/libraries/openexr/gcc-13.patch
@@ -1,33 +1,25 @@
-https://github.com/AcademySoftwareFoundation/openexr/pull/1264
-https://github.com/AcademySoftwareFoundation/openexr/commit/d0088a3c6943a9a53fc24e29885414d082d531fe.patch
+From 8aa103fe6e815514990e59708468eabc36f7f332 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=A9clairevoyant?=
+ <848000+eclairevoyant@users.noreply.github.com>
+Date: Fri, 5 Jan 2024 18:12:16 -0500
+Subject: [PATCH] gcc13
 
---- a/OpenEXR/IlmImf/ImfDwaCompressor.cpp
-+++ b/OpenEXR/IlmImf/ImfDwaCompressor.cpp
-@@ -159,6 +159,7 @@
- #include <limits>
- 
- #include <cstddef>
-+#include <cstdint>
- 
- 
- // Windows specific addition to prevent the indirect import of the redefined min/max macros
---- a/OpenEXR/IlmImf/ImfHuf.cpp
-+++ b/OpenEXR/IlmImf/ImfHuf.cpp
-@@ -53,6 +53,7 @@
- #include <cstring>
- #include <cassert>
+---
+ OpenEXR/IlmImf/ImfTiledMisc.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/OpenEXR/IlmImf/ImfTiledMisc.cpp b/OpenEXR/IlmImf/ImfTiledMisc.cpp
+index 06ea3144..749537d4 100644
+--- a/OpenEXR/IlmImf/ImfTiledMisc.cpp
++++ b/OpenEXR/IlmImf/ImfTiledMisc.cpp
+@@ -46,6 +46,7 @@
+ #include <ImfTileDescription.h>
  #include <algorithm>
+ #include <limits>
 +#include <cstdint>
  
- 
- using namespace std;
---- a/OpenEXR/IlmImf/ImfMisc.cpp
-+++ b/OpenEXR/IlmImf/ImfMisc.cpp
-@@ -52,6 +52,7 @@
- #include <ImfConvert.h>
- #include <ImfPartType.h>
- #include <ImfTileDescription.h>
-+#include <cstdint>
  #include "ImfNamespace.h"
  
- OPENEXR_IMF_INTERNAL_NAMESPACE_SOURCE_ENTER
+-- 
+2.42.0
+
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index fa5cb97b214fa..0d1e3b03a09a8 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -81,7 +81,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "pipewire";
-    version = "1.0.0";
+    version = "1.0.1";
 
     outputs = [
       "out"
@@ -97,7 +97,7 @@ let
       owner = "pipewire";
       repo = "pipewire";
       rev = version;
-      sha256 = "sha256-mfnMluxJAxDbB6JlIM6HJ0zg7e1q3ia3uFbht6zeHCk=";
+      sha256 = "sha256-rvf0sZRgDDLcqroLg7hcMUqXD/4JT+3lBRX6/m+3Ry8=";
     };
 
     patches = [
diff --git a/pkgs/development/libraries/pixman/default.nix b/pkgs/development/libraries/pixman/default.nix
index 76ec2244c8338..121bb03f4caca 100644
--- a/pkgs/development/libraries/pixman/default.nix
+++ b/pkgs/development/libraries/pixman/default.nix
@@ -1,6 +1,8 @@
 { lib
 , stdenv
 , fetchurl
+, meson
+, ninja
 , pkg-config
 , libpng
 , glib /*just passthru*/
@@ -12,41 +14,57 @@
 , tigervnc
 , wlroots
 , xwayland
+
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "pixman";
-  version = "0.42.2";
+  version = "0.43.0";
 
   src = fetchurl {
     urls = [
       "mirror://xorg/individual/lib/${pname}-${version}.tar.gz"
       "https://cairographics.org/releases/${pname}-${version}.tar.gz"
     ];
-    hash = "sha256-6hSA762i/ZSLx1Nm98NJ4cltMpfQmj/mJibjjiNKYl4=";
+    hash = "sha256-plwoIJhY+xa+5Q2AnID5Co5BXA5P2DIQeKGCJ4WlVgo=";
   };
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ meson ninja pkg-config ];
 
   buildInputs = [ libpng ];
 
-  configureFlags = lib.optional stdenv.isAarch32 "--disable-arm-iwmmxt"
-    # Disable until https://gitlab.freedesktop.org/pixman/pixman/-/issues/46 is resolved
-    ++ lib.optional (stdenv.isAarch64 && !stdenv.cc.isGNU) "--disable-arm-a64-neon";
+  # Default "enabled" value attempts to enable CPU features on all
+  # architectures and requires used to disable them:
+  #   https://gitlab.freedesktop.org/pixman/pixman/-/issues/88
+  mesonAutoFeatures = "auto";
+  mesonFlags = [
+    "-Diwmmxt=disabled"
+  ]
+  # Disable until https://gitlab.freedesktop.org/pixman/pixman/-/issues/46 is resolved
+  ++ lib.optional (stdenv.isAarch64 && !stdenv.cc.isGNU) "-Da64-neon=disabled";
 
   preConfigure = ''
     # https://gitlab.freedesktop.org/pixman/pixman/-/issues/62
     export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 184 ? 184 : NIX_BUILD_CORES))
   '';
 
+  enableParallelBuilding = true;
+
   doCheck = true;
 
   postInstall = glib.flattenInclude;
 
-  passthru.tests = {
-    inherit cairo qemu scribus tigervnc wlroots xwayland;
+  passthru = {
+    tests = {
+      inherit cairo qemu scribus tigervnc wlroots xwayland;
+    };
+    updateScript = gitUpdater {
+      url = "https://gitlab.freedesktop.org/pixman/pixman.git";
+      rev-prefix = "pixman-";
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/qrencode/default.nix b/pkgs/development/libraries/qrencode/default.nix
index a0e23813ade2c..83c20fcd51207 100644
--- a/pkgs/development/libraries/qrencode/default.nix
+++ b/pkgs/development/libraries/qrencode/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, SDL2, libpng, libiconv, libobjc }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: rec {
   pname = "qrencode";
   version = "4.1.1";
 
@@ -16,13 +16,9 @@ stdenv.mkDerivation rec {
   buildInputs = [ libiconv libpng ]
     ++ lib.optionals stdenv.isDarwin [ libobjc ];
 
-  configureFlags = [
-    "--with-tests"
-  ];
-
   nativeCheckInputs = [ SDL2 ];
 
-  doCheck = true;
+  doCheck = false;
 
   checkPhase = ''
     runHook preCheck
@@ -34,6 +30,11 @@ stdenv.mkDerivation rec {
     runHook postCheck
   '';
 
+  passthru.tests = finalAttrs.finalPackage.overrideAttrs (_: {
+    configureFlags = [ "--with-tests" ];
+    doCheck = true;
+  });
+
   meta = with lib; {
     homepage = "https://fukuchi.org/works/qrencode/";
     description = "C library for encoding data in a QR Code symbol";
@@ -47,4 +48,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
     mainProgram = "qrencode";
   };
-}
+})
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 7a5ff60c9acbb..b0e92290fe5b7 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -51,6 +51,8 @@ let
       ./qtdeclarative.patch
       # prevent headaches from stale qmlcache data
       ./qtdeclarative-default-disable-qmlcache.patch
+      # add version specific QML import path
+      ./qtdeclarative-qml-paths.patch
     ];
     qtlocation = lib.optionals stdenv.cc.isClang [
       # Fix build with Clang 16
diff --git a/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch b/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch
new file mode 100644
index 0000000000000..e207fa4df3bd4
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.15/qtdeclarative-qml-paths.patch
@@ -0,0 +1,33 @@
+diff --git a/src/qml/qml/qqmlimport.cpp b/src/qml/qml/qqmlimport.cpp
+index 289f11d006..9b0a48c6c7 100644
+--- a/src/qml/qml/qqmlimport.cpp
++++ b/src/qml/qml/qqmlimport.cpp
+@@ -1897,17 +1897,22 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
+     addImportPath(installImportsPath);
+ 
+     // env import paths
+-    if (Q_UNLIKELY(!qEnvironmentVariableIsEmpty("QML2_IMPORT_PATH"))) {
+-        const QString envImportPath = qEnvironmentVariable("QML2_IMPORT_PATH");
++    auto addEnvImportPath = [this](const char *var) {
+ #if defined(Q_OS_WIN)
+         QLatin1Char pathSep(';');
+ #else
+         QLatin1Char pathSep(':');
+ #endif
+-        QStringList paths = envImportPath.split(pathSep, Qt::SkipEmptyParts);
+-        for (int ii = paths.count() - 1; ii >= 0; --ii)
+-            addImportPath(paths.at(ii));
+-    }
++        if (Q_UNLIKELY(!qEnvironmentVariableIsEmpty(var))) {
++            const QString envImportPath = qEnvironmentVariable(var);
++            QStringList paths = envImportPath.split(pathSep, Qt::SkipEmptyParts);
++            for (int ii = paths.count() - 1; ii >= 0; --ii)
++                addImportPath(paths.at(ii));
++        }
++    };
++
++    addEnvImportPath("QML2_IMPORT_PATH");
++    addEnvImportPath("NIXPKGS_QT5_QML_IMPORT_PATH");
+ 
+     addImportPath(QStringLiteral("qrc:/qt-project.org/imports"));
+     addImportPath(QCoreApplication::applicationDirPath());
diff --git a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
index 2127be5e0a2a0..94df0a1a8e661 100644
--- a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -31,7 +31,7 @@ qtHostPathHook() {
     local qmlDir="$1/${qtQmlPrefix:?}"
     if [ -d "$qmlDir" ]
     then
-        qtWrapperArgs+=(--prefix QML2_IMPORT_PATH : "$qmlDir")
+        qtWrapperArgs+=(--prefix NIXPKGS_QT5_QML_IMPORT_PATH : "$qmlDir")
     fi
 }
 addEnvHooks "$targetOffset" qtHostPathHook
diff --git a/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
index 8b135a7d7492f..2d858055693cc 100644
--- a/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
@@ -31,7 +31,7 @@ if [[ -z "${__nix_wrapQtAppsHook-}" ]]; then
 
         local qmlDir="$1/${qtQmlPrefix:?}"
         if [ -d "$qmlDir" ]; then
-            qtWrapperArgs+=(--prefix QML2_IMPORT_PATH : "$qmlDir")
+            qtWrapperArgs+=(--prefix NIXPKGS_QT6_QML_IMPORT_PATH : "$qmlDir")
         fi
     }
     addEnvHooks "$targetOffset" qtHostPathHook
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
index afdb24d1d291a..697556e30edc5 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
@@ -12,5 +12,7 @@ qtModule {
   patches = [
     # prevent headaches from stale qmlcache data
     ../patches/qtdeclarative-default-disable-qmlcache.patch
+    # add version specific QML import path
+    ../patches/qtdeclarative-qml-paths.patch
   ];
 }
diff --git a/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch b/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch
new file mode 100644
index 0000000000000..39b7a30892cf3
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/qtdeclarative-qml-paths.patch
@@ -0,0 +1,12 @@
+diff --git a/src/qml/qml/qqmlimport.cpp b/src/qml/qml/qqmlimport.cpp
+index 2e482c220d..4873809bec 100644
+--- a/src/qml/qml/qqmlimport.cpp
++++ b/src/qml/qml/qqmlimport.cpp
+@@ -1517,6 +1517,7 @@ QQmlImportDatabase::QQmlImportDatabase(QQmlEngine *e)
+     // env import paths
+     addEnvImportPath("QML_IMPORT_PATH");
+     addEnvImportPath("QML2_IMPORT_PATH");
++    addEnvImportPath("NIXPKGS_QT6_QML_IMPORT_PATH");
+ 
+     addImportPath(QStringLiteral("qrc:/qt/qml"));
+     addImportPath(QStringLiteral("qrc:/qt-project.org/imports"));
diff --git a/pkgs/development/libraries/rapidfuzz-cpp/default.nix b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
index 8375d55e40567..2668025bcbe1b 100644
--- a/pkgs/development/libraries/rapidfuzz-cpp/default.nix
+++ b/pkgs/development/libraries/rapidfuzz-cpp/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rapidfuzz-cpp";
-  version = "2.2.3";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "maxbachmann";
     repo = "rapidfuzz-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yEDihPvTGGL5gsd4QMYNRyfLucKLItIQM4pm6W0i2W8=";
+    hash = "sha256-N9yGOxlk1+wgRXWLbDIXWQz+/pwbnYVs3ub4/16Nzws=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/readline/readline-8.2-patches.nix b/pkgs/development/libraries/readline/readline-8.2-patches.nix
index bc075df237c7b..77d5c495bac1c 100644
--- a/pkgs/development/libraries/readline/readline-8.2-patches.nix
+++ b/pkgs/development/libraries/readline/readline-8.2-patches.nix
@@ -8,4 +8,7 @@ patch: [
 (patch "005" "16ac25jz1a1mgkpfp1sydqf6qpsfh0s0dcmrnjpqbhg5va3s6av2")
 (patch "006" "18gmh6y3klh0vv28cyqz4is3rlb32pl7f1kf5r482kfjq3w5zd67")
 (patch "007" "1xmnpahs983n4w0gn3j0wr8nh1dpva33yj7fvfmhm46ph2wsa4ar")
+(patch "008" "0smjjzhwxi2ibpdisnk53lh1pzgka6rhlqyh3662xy69v34ysxx1")
+(patch "009" "05m1fwbs7mbs3pz3pg87gbbayandrrcgaqawzliqb6g1jbk8b61x")
+(patch "010" "0k3vyrjs2g6y2cfs03l2gp37fhxgqpiwvxb1c7z4q88cbb32x3km")
 ]
diff --git a/pkgs/development/libraries/science/math/liblapack/default.nix b/pkgs/development/libraries/science/math/liblapack/default.nix
index 3bf16057f835f..595ba2aa57136 100644
--- a/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "liblapack";
-  version = "3.11";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = "Reference-LAPACK";
     repo = "lapack";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-AYD78u70y8cY19hmM/aDjQEzxO8u9lPWhCFxRe5cqXI=";
+    sha256 = "sha256-xn9HL4YF8JPka1gwet5bGGo2k505H3RfWpxkUIYNecQ=";
   };
 
   nativeBuildInputs = [ gfortran cmake ];
diff --git a/pkgs/development/libraries/spirv-headers/default.nix b/pkgs/development/libraries/spirv-headers/default.nix
index 3e18424d6b74e..64362243229b2 100644
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-headers";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-uOnSTih14bUPtrJgp7vVb3/UfdKsF6jFQqjlFeJ81AI=";
+    hash = "sha256-/I9dJlBE0kvFvqooKuqMETtOE72Jmva3zIGnq0o4+aE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/srt/default.nix b/pkgs/development/libraries/srt/default.nix
index 5ba8039ccff80..be81970413b84 100644
--- a/pkgs/development/libraries/srt/default.nix
+++ b/pkgs/development/libraries/srt/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "srt";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${version}";
-    sha256 = "sha256-HW5l26k9w4F6IJrtiahU/8/CPY6M/cKn8AgESsntC6A=";
+    sha256 = "sha256-HmfbBPyR+z5d9/XBvNhosk8pSSPToNtM+V0hEyb2G2w=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/tiledb/default.nix b/pkgs/development/libraries/tiledb/default.nix
index f8540d4ffaa06..28b14d3a8a5be 100644
--- a/pkgs/development/libraries/tiledb/default.nix
+++ b/pkgs/development/libraries/tiledb/default.nix
@@ -58,6 +58,9 @@ stdenv.mkDerivation rec {
       cmake/Modules/FindOpenSSL_EP.cmake
   '';
 
+  # upstream will hopefully fix this in some newer release
+  env.CXXFLAGS = "-include random";
+
   # (bundled) blosc headers have a warning on some archs that it will be using
   # unaccelerated routines.
   cmakeFlags = [
diff --git a/pkgs/development/libraries/vulkan-headers/default.nix b/pkgs/development/libraries/vulkan-headers/default.nix
index f6c9dcb953e39..dc17404c84802 100644
--- a/pkgs/development/libraries/vulkan-headers/default.nix
+++ b/pkgs/development/libraries/vulkan-headers/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "vulkan-headers";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   nativeBuildInputs = [ cmake ];
 
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-CDjWTXXnUgj9QaLDNuSVy+wf8If5LehwOZ0t0Fuh2Ro=";
+    hash = "sha256-kBOkj7mr4stPXUCBhNJpNL3A+9BebEwrIBEIroxdH8Y=";
   };
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/development/libraries/vulkan-headers/update.sh b/pkgs/development/libraries/vulkan-headers/update.sh
index da4e42ded84a2..dd3fac2ee4dd1 100755
--- a/pkgs/development/libraries/vulkan-headers/update.sh
+++ b/pkgs/development/libraries/vulkan-headers/update.sh
@@ -11,6 +11,7 @@ SDK_PACKAGES=(
     "vulkan-tools-lunarg"
     "vulkan-extension-layer"
     "vulkan-utility-libraries"
+    "vulkan-volk"
     "spirv-headers"
     "spirv-cross"
     "spirv-tools"
diff --git a/pkgs/development/libraries/vulkan-loader/default.nix b/pkgs/development/libraries/vulkan-loader/default.nix
index 068c1d3d2c2a8..958cc2dadc7ba 100644
--- a/pkgs/development/libraries/vulkan-loader/default.nix
+++ b/pkgs/development/libraries/vulkan-loader/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-loader";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-TDn8eVz1fhGfvUiGcxqOk2BN9tuIF5+ssIXtOo3weS0=";
+    hash = "sha256-53PUXAWiK38ciV6oMvD7ZHdXi4RU4r0RmDWUUHU3mE0=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/development/libraries/vulkan-utility-libraries/default.nix b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
index 41d1854692fd9..301311e124128 100644
--- a/pkgs/development/libraries/vulkan-utility-libraries/default.nix
+++ b/pkgs/development/libraries/vulkan-utility-libraries/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.3.268";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-l6PiHCre/JQg8PSs1k/0Zzfwwv55AqVdZtBbjeKLS6E=";
+    rev = "vulkan-sdk-${finalAttrs.version}";
+    hash = "sha256-gvia+Xb9BpOjPARKo3Sgp85Bfh1roFZ2PzCtXVFYeIU=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/development/libraries/xapian/default.nix b/pkgs/development/libraries/xapian/default.nix
index 243ec53a3234c..f9fe5bac07fe5 100644
--- a/pkgs/development/libraries/xapian/default.nix
+++ b/pkgs/development/libraries/xapian/default.nix
@@ -28,7 +28,12 @@ let
     enableParallelBuilding = true;
 
     doCheck = true;
-    env.AUTOMATED_TESTING = true; # https://trac.xapian.org/changeset/8be35f5e1/git
+
+    env = {
+      AUTOMATED_TESTING = true; # https://trac.xapian.org/changeset/8be35f5e1/git
+    } // lib.optionalAttrs stdenv.is32bit {
+      NIX_CFLAGS_COMPILE = "-fpermissive";
+    };
 
     # the configure script thinks that Darwin has ___exp10
     # but it’s not available on my systems (or hydra apparently)
diff --git a/pkgs/development/libraries/xsimd/default.nix b/pkgs/development/libraries/xsimd/default.nix
index 87da2c546b866..d775cef4d6734 100644
--- a/pkgs/development/libraries/xsimd/default.nix
+++ b/pkgs/development/libraries/xsimd/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "C++ wrappers for SIMD intrinsics";
     homepage = "https://github.com/xtensor-stack/xsimd";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ tobim ];
+    maintainers = with maintainers; [ tobim doronbehar ];
     platforms = platforms.all;
   };
 })
diff --git a/pkgs/development/libraries/zxing-cpp/default.nix b/pkgs/development/libraries/zxing-cpp/default.nix
index 1c010638693e7..cd5d105511920 100644
--- a/pkgs/development/libraries/zxing-cpp/default.nix
+++ b/pkgs/development/libraries/zxing-cpp/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zxing-cpp";
-  version = "2.1.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "zxing-cpp";
     repo = "zxing-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-B/jGsHImRfj0iEio2b6R6laWBI1LL3OI407O7sren8s=";
+    hash = "sha256-teFspdATn9M7Z1vSr/7PdJx/xAv+TVai8rIekxqpBZk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/acme/default.nix b/pkgs/development/python-modules/acme/default.nix
index 538b8dff964ac..65e930e07414a 100644
--- a/pkgs/development/python-modules/acme/default.nix
+++ b/pkgs/development/python-modules/acme/default.nix
@@ -3,7 +3,7 @@
 , cryptography
 , pyasn1
 , pyopenssl
-, pyRFC3339
+, pyrfc3339
 , josepy
 , pytz
 , requests
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   format = "setuptools";
 
   propagatedBuildInputs = [
-    cryptography pyasn1 pyopenssl pyRFC3339 pytz requests requests-toolbelt six
+    cryptography pyasn1 pyopenssl pyrfc3339 pytz requests requests-toolbelt six
     werkzeug ndg-httpsclient josepy
   ];
 
diff --git a/pkgs/development/python-modules/awslambdaric/default.nix b/pkgs/development/python-modules/awslambdaric/default.nix
index 3e20875ac15d5..788148d5e441f 100644
--- a/pkgs/development/python-modules/awslambdaric/default.nix
+++ b/pkgs/development/python-modules/awslambdaric/default.nix
@@ -5,7 +5,7 @@
 , fetchpatch
 , isPy27
 , pytestCheckHook
-, autoconf
+, autoconf271
 , automake
 , cmake
 , gcc
@@ -44,7 +44,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [ simplejson ];
 
-  nativeBuildInputs = [ autoconf automake cmake libtool perl setuptools ];
+  nativeBuildInputs = [ autoconf271 automake cmake libtool perl setuptools ];
 
   buildInputs = [ gcc ];
 
diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index 621a0f991856f..0689319840e61 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -10,7 +10,7 @@
 , distro
 , josepy
 , parsedatetime
-, pyRFC3339
+, pyrfc3339
 , pyopenssl
 , pytz
 , requests
@@ -47,7 +47,7 @@ buildPythonPackage rec {
     distro
     josepy
     parsedatetime
-    pyRFC3339
+    pyrfc3339
     pyopenssl
     pytz
     requests
diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index db66e46f3d9d4..e07ab3c0d9536 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -60,7 +60,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ] ++ lib.concatLists (lib.attrVals ([
     "woff"
-    "interpolatable"
+    # "interpolatable" is not included because it only contains 2 tests at the time of writing but adds 270 extra dependencies
     "ufo"
   ] ++ lib.optionals (!skia-pathops.meta.broken) [
     "pathops" # broken
diff --git a/pkgs/development/python-modules/img2pdf/default.nix b/pkgs/development/python-modules/img2pdf/default.nix
index 1a69525d84388..2dc389f70ecc1 100644
--- a/pkgs/development/python-modules/img2pdf/default.nix
+++ b/pkgs/development/python-modules/img2pdf/default.nix
@@ -12,7 +12,7 @@
 , exiftool
 , ghostscript
 , imagemagick
-, mupdf
+, mupdf-headless
 , netpbm
 , numpy
 , poppler_utils
@@ -74,7 +74,7 @@ buildPythonPackage rec {
     exiftool
     ghostscript
     imagemagick
-    mupdf
+    mupdf-headless
     netpbm
     numpy
     poppler_utils
diff --git a/pkgs/development/python-modules/jinja2/default.nix b/pkgs/development/python-modules/jinja2/default.nix
index 1b154f90d3864..1c260e37c7b0b 100644
--- a/pkgs/development/python-modules/jinja2/default.nix
+++ b/pkgs/development/python-modules/jinja2/default.nix
@@ -9,79 +9,83 @@
 , pytestCheckHook
 , sphinxHook
 , pallets-sphinx-themes
+, setuptools
 , sphinxcontrib-log-cabinet
 , sphinx-issues
 }:
 
 buildPythonPackage rec {
-  pname = "Jinja2";
-  version = "3.1.2";
+  pname = "jinja2";
+  version = "3.1.3";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-MTUacCpAip51laj8YVD8P0O7a/fjGXcMvA2535Q36FI=";
+    pname = "Jinja2";
+    inherit version;
+    hash = "sha256-rIvWVE1Lssl5K/OhWegLuo/afwfoG8Ou1WVDLVklupA=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
-    babel
     markupsafe
   ];
 
+  passthru.optional-dependencies = {
+    i18n = [
+      babel
+    ];
+  };
+
   # Multiple tests run out of stack space on 32bit systems with python2.
   # See https://github.com/pallets/jinja/issues/1158
   doCheck = !stdenv.is32bit;
 
   nativeCheckInputs = [
     pytestCheckHook
-  ];
-
-  pytestFlagsArray = [
-    # Avoid failure due to deprecation warning
-    # Fixed in https://github.com/python/cpython/pull/28153
-    # Remove after cpython 3.9.8
-    "-p no:warnings"
-  ];
+  ] ++ passthru.optional-dependencies.i18n;
 
-  passthru = {
-    doc = stdenv.mkDerivation {
-      # Forge look and feel of multi-output derivation as best as we can.
-      #
-      # Using 'outputs = [ "doc" ];' breaks a lot of assumptions.
-      name = "${pname}-${version}-doc";
-      inherit src pname version;
+  passthru.doc = stdenv.mkDerivation {
+    # Forge look and feel of multi-output derivation as best as we can.
+    #
+    # Using 'outputs = [ "doc" ];' breaks a lot of assumptions.
+    name = "${pname}-${version}-doc";
+    inherit src pname version;
 
-      patches = [
-        # Fix import of "sphinxcontrib-log-cabinet"
-        ./patches/import-order.patch
-      ];
+    patches = [
+      # Fix import of "sphinxcontrib-log-cabinet"
+      ./patches/import-order.patch
+    ];
 
-      postInstallSphinx = ''
-        mv $out/share/doc/* $out/share/doc/python$pythonVersion-$pname-$version
-      '';
+    postInstallSphinx = ''
+      mv $out/share/doc/* $out/share/doc/python$pythonVersion-$pname-$version
+    '';
 
-      nativeBuildInputs = [
-        sphinxHook
-        sphinxcontrib-log-cabinet
-        pallets-sphinx-themes
-        sphinx-issues
-      ];
+    nativeBuildInputs = [
+      sphinxHook
+      sphinxcontrib-log-cabinet
+      pallets-sphinx-themes
+      sphinx-issues
+    ];
 
-      inherit (python) pythonVersion;
-      inherit meta;
-    };
+    inherit (python) pythonVersion;
+    inherit meta;
   };
 
   meta = with lib; {
-    homepage = "https://jinja.palletsprojects.com/";
-    description = "Stand-alone template engine";
+    changelog = "https://github.com/pallets/jinja/blob/${version}/CHANGES.rst";
+    description = "Very fast and expressive template engine";
+    downloadPage = "https://github.com/pallets/jinja";
+    homepage = "https://jinja.palletsprojects.com";
     license = licenses.bsd3;
     longDescription = ''
       Jinja is a fast, expressive, extensible templating engine. Special
       placeholders in the template allow writing code similar to Python
       syntax. Then the template is passed data to render the final document.
-      an optional sandboxed environment.
     '';
     maintainers = with maintainers; [ pierron ];
   };
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 1100d1bdbc99d..8fb5c7c292cf8 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -6,10 +6,8 @@
 , isPyPy
 , pythonOlder
 
-# https://github.com/matplotlib/matplotlib/blob/main/doc/devel/dependencies.rst
 # build-system
 , certifi
-, oldest-supported-numpy
 , pkg-config
 , pybind11
 , setuptools
@@ -109,19 +107,11 @@ buildPythonPackage rec {
       substituteInPlace src/_c_internal_utils.c \
         --replace libX11.so.6 ${libX11}/lib/libX11.so.6 \
         --replace libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
-    '' +
-    # bring our own system libraries
-    # https://github.com/matplotlib/matplotlib/blob/main/doc/devel/dependencies.rst#c-libraries
-    ''
-      echo "[libs]
-      system_freetype=true
-      system_qhull=true" > mplsetup.cfg
     '';
 
   nativeBuildInputs = [
     certifi
     numpy
-    oldest-supported-numpy # TODO remove after updating to 3.8.0
     pkg-config
     pybind11
     setuptools
@@ -184,16 +174,17 @@ buildPythonPackage rec {
     libs = {
       system_freetype = true;
       system_qhull = true;
-    } // lib.optionalAttrs stdenv.isDarwin {
       # LTO not working in darwin stdenv, see #19312
-      enable_lto = false;
+      enable_lto = !stdenv.isDarwin;
     };
   };
 
   env.MPLSETUPCFG = writeText "mplsetup.cfg" (lib.generators.toINI {} passthru.config);
 
-  # Matplotlib needs to be built against a specific version of freetype in
-  # order for all of the tests to pass.
+  # Encountering a ModuleNotFoundError, as describved and investigated at:
+  # https://github.com/NixOS/nixpkgs/issues/255262 . It could be that some of
+  # which may fail due to a freetype version that doesn't match the freetype
+  # version used by upstream.
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 9d34cb27c8cdc..deaab05a6574e 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -48,6 +48,6 @@ buildPythonPackage rec {
     description = "Meson Python build backend (PEP 517)";
     homepage = "https://github.com/mesonbuild/meson-python";
     license = [ lib.licenses.mit ];
-    maintainers = [ lib.maintainers.fridh ];
+    maintainers = with lib.maintainers; [ fridh doronbehar ];
   };
 }
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 1104bcc02f823..9b4e1d0287eb5 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -25,15 +25,14 @@
 , tqdm
 , typing-extensions
 , unpaper
-, wheel
 , installShellFiles
 }:
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "15.4.4";
+  version = "16.0.4";
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";
 
   pyproject = true;
 
@@ -47,7 +46,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-Ff0OrSJFglVPpSNB0KvDMnatj+P57zWdcVAFaM+Sg0s=";
+    hash = "sha256-1Bg1R8c5VtJsd8NHd+WWdJRA39Jjgv9JUMcijZm942o=";
   };
 
   patches = [
@@ -64,7 +63,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     setuptools
     setuptools-scm
-    wheel
     installShellFiles
   ];
 
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 4ba20f5aef315..386f64718eb09 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -7,7 +7,7 @@
 , jbig2dec
 , deprecated
 , lxml
-, mupdf
+, mupdf-headless
 , numpy
 , packaging
 , pillow
@@ -20,12 +20,11 @@
 , qpdf
 , setuptools
 , substituteAll
-, wheel
 }:
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "8.9.0";
+  version = "8.11.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,14 +39,14 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-ia+D0OeB/MQWRniYkBEWZsDCwEApYGgu0++I/HupK6w=";
+    hash = "sha256-mxUXXD7/ERC6mfmLLo+zdsVblIplrlcnzTNQ7YUk3Q4=";
   };
 
   patches = [
     (substituteAll {
       src = ./paths.patch;
-      jbig2dec = "${lib.getBin jbig2dec}/bin/jbig2dec";
-      mudraw = "${lib.getBin mupdf}/bin/mudraw";
+      jbig2dec = lib.getExe' jbig2dec "jbig2dec";
+      mutool = lib.getExe' mupdf-headless "mutool";
     })
   ];
 
@@ -63,7 +62,6 @@ buildPythonPackage rec {
   nativeBuildInputs = [
     pybind11
     setuptools
-    wheel
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/pikepdf/paths.patch b/pkgs/development/python-modules/pikepdf/paths.patch
index c9c61176aa6f4..1bd030c186c23 100644
--- a/pkgs/development/python-modules/pikepdf/paths.patch
+++ b/pkgs/development/python-modules/pikepdf/paths.patch
@@ -1,18 +1,18 @@
 diff --git a/src/pikepdf/_methods.py b/src/pikepdf/_methods.py
-index d27c660..6796984 100644
+index da40043f..4f566f01 100644
 --- a/src/pikepdf/_methods.py
 +++ b/src/pikepdf/_methods.py
-@@ -72,7 +72,7 @@ def _mudraw(buffer, fmt) -> bytes:
+@@ -74,7 +74,7 @@ def _mudraw(buffer, fmt) -> bytes:
          tmp_in.flush()
  
          proc = run(
--            ['mudraw', '-F', fmt, '-o', '-', tmp_in.name],
-+            ['@mudraw@', '-F', fmt, '-o', '-', tmp_in.name],
+-            ['mutool', 'draw', '-F', fmt, '-o', '-', tmp_in.name],
++            ['@mutool@', 'draw', '-F', fmt, '-o', '-', tmp_in.name],
              capture_output=True,
              check=True,
          )
 diff --git a/src/pikepdf/jbig2.py b/src/pikepdf/jbig2.py
-index f89b4f9..f187ebd 100644
+index f89b4f90..f187ebdf 100644
 --- a/src/pikepdf/jbig2.py
 +++ b/src/pikepdf/jbig2.py
 @@ -63,7 +63,7 @@ class JBIG2Decoder(JBIG2DecoderInterface):
diff --git a/pkgs/development/python-modules/pycryptodome/default.nix b/pkgs/development/python-modules/pycryptodome/default.nix
index 4b37a0765f0e4..444d673100bbb 100644
--- a/pkgs/development/python-modules/pycryptodome/default.nix
+++ b/pkgs/development/python-modules/pycryptodome/default.nix
@@ -10,14 +10,14 @@ let
 in
 buildPythonPackage rec {
   pname = "pycryptodome";
-  version = "3.19.0";
+  version = "3.19.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Legrandin";
     repo = "pycryptodome";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WD+OEjePVtqlmn7h1CIfraLuEQlodkvjmYQ8q7nNoGU=";
+    hash = "sha256-+m0gF47l3c9gZ9dLdOUNW0I2W1O+OGrmsdysu7QdjvI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index 29c4a2034b2f7..80a9458e32c63 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -70,6 +70,7 @@ buildPythonPackage rec {
     # https://github.com/pycurl/pycurl/issues/819
     "test_multi_socket_select"
     # https://github.com/pycurl/pycurl/issues/729
+    "test_easy_pause_unpause"
     "test_multi_socket_action"
     # https://github.com/pycurl/pycurl/issues/822
     "test_request_with_verifypeer"
diff --git a/pkgs/development/python-modules/pymemcache/default.nix b/pkgs/development/python-modules/pymemcache/default.nix
index 68925fe7f4a9d..74784a35ff953 100644
--- a/pkgs/development/python-modules/pymemcache/default.nix
+++ b/pkgs/development/python-modules/pymemcache/default.nix
@@ -5,6 +5,7 @@
 , mock
 , six
 , pytestCheckHook
+, python-memcached
 , pythonOlder
 , zstd
 , stdenv
@@ -32,6 +33,7 @@ buildPythonPackage rec {
     faker
     mock
     pytestCheckHook
+    python-memcached
     zstd
   ];
 
@@ -39,10 +41,7 @@ buildPythonPackage rec {
     sed -i "/--cov/d" setup.cfg
   '';
 
-  disabledTests = [
-    # python-memcached is not available (last release in 2017)
-    "TestClientSocketConnect"
-  ] ++ lib.optionals stdenv.is32bit [
+  disabledTests = lib.optionals stdenv.is32bit [
     # test_compressed_complex is broken on 32-bit platforms
     # this can be removed on the next version bump
     # see also https://github.com/pinterest/pymemcache/pull/480
diff --git a/pkgs/development/python-modules/pyrfc3339/default.nix b/pkgs/development/python-modules/pyrfc3339/default.nix
index 9345b819f75cc..368f3cda24de7 100644
--- a/pkgs/development/python-modules/pyrfc3339/default.nix
+++ b/pkgs/development/python-modules/pyrfc3339/default.nix
@@ -14,12 +14,13 @@
 }:
 
 buildPythonPackage rec {
-  pname = "pyRFC3339";
+  pname = "pyrfc3339";
   version = "1.1";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "pyRFC3339";
+    inherit version;
     sha256 = "06jv7ar7lpvvk0dixzwdr3wgm0g1lipxs429s2z7knwwa7hwpf41";
   };
 
diff --git a/pkgs/development/python-modules/python-memcached/default.nix b/pkgs/development/python-modules/python-memcached/default.nix
index 27a9eed537bb2..e82b6b51643aa 100644
--- a/pkgs/development/python-modules/python-memcached/default.nix
+++ b/pkgs/development/python-modules/python-memcached/default.nix
@@ -1,25 +1,25 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, six
+, setuptools
 , mock
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "python-memcached";
-  version = "1.59";
-  format = "setuptools";
+  version = "1.61";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "linsomniac";
     repo = "python-memcached";
     rev = version;
-    hash = "sha256-tHqkwNloPTXOrEGtuDLu1cTw4SKJ4auv8UUbqdNp698=";
+    hash = "sha256-7bUCVAmOJ6znVmTZg9AJokOuym07NHL12gZgQ2uhfNo=";
   };
 
-  propagatedBuildInputs = [
-    six
+  nativeBuildInputs = [
+    setuptools
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/pythran/default.nix b/pkgs/development/python-modules/pythran/default.nix
index 047a4ea1af07e..3e62fa882cc9b 100644
--- a/pkgs/development/python-modules/pythran/default.nix
+++ b/pkgs/development/python-modules/pythran/default.nix
@@ -25,14 +25,14 @@ let
 
 in buildPythonPackage rec {
   pname = "pythran";
-  version = "0.14.0";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "serge-sans-paille";
     repo = "pythran";
     rev = version;
-    hash = "sha256-in0ty0aBAIx7Is13hjiHZGS8eKbhxb6TL3bENzfx5vQ=";
+    hash = "sha256-TpD8YZnnv48PKYrUqR0/qvJG1XRbcMBcrkcERh6Q4q0=";
   };
 
   patches = [
@@ -41,17 +41,12 @@ in buildPythonPackage rec {
       src = ./0001-hardcode-path-to-libgomp.patch;
       gomp = "${if stdenv.cc.isClang then openmp else stdenv.cc.cc.lib}/lib/libgomp${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
-    (fetchpatch {
-      # Python 3.12 support
-      url = "https://github.com/serge-sans-paille/pythran/commit/258ab9aaf26172f669eab1bf2a346b5f65db3ac0.patch";
-      hash = "sha256-T+FLptDYIgzHBSXShULqHr/G8ttBFamq1M5JlB2HxDM=";
-    })
   ];
 
   # xsimd: unvendor this header-only C++ lib
   postPatch = ''
-    rm -r third_party/xsimd
-    ln -s '${lib.getDev xsimd}'/include/xsimd third_party/
+    rm -r pythran/xsimd
+    ln -s '${lib.getDev xsimd}'/include/xsimd pythran/
   '';
 
   nativeBuildInputs = [
@@ -84,5 +79,6 @@ in buildPythonPackage rec {
     description = "Ahead of Time compiler for numeric kernels";
     homepage = "https://github.com/serge-sans-paille/pythran";
     license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ doronbehar ];
   };
 }
diff --git a/pkgs/development/python-modules/rapidfuzz/default.nix b/pkgs/development/python-modules/rapidfuzz/default.nix
index 97f2a09e55e21..3dcffdd2ecc53 100644
--- a/pkgs/development/python-modules/rapidfuzz/default.nix
+++ b/pkgs/development/python-modules/rapidfuzz/default.nix
@@ -18,8 +18,8 @@
 
 buildPythonPackage rec {
   pname = "rapidfuzz";
-  version = "3.5.2";
-  format = "pyproject";
+  version = "3.6.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "RapidFuzz";
     rev = "refs/tags/v${version}";
-    hash = "sha256-D7Z0xKqAJAPKSAEK+3Mpz/LaEKqKYczp+m6SqfzufwA=";
+    hash = "sha256-QJVRT+d/IIGxkWfSNoXFSmbW017+8CTKuWD4W+TzvBs=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index caca48153b72b..ec6e966d79bf4 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -13,6 +13,9 @@
 , pkg-config
 , pythran
 , wheel
+, nose
+, setuptools
+, hypothesis
 , pytestCheckHook
 , pytest-xdist
 , numpy
@@ -31,8 +34,8 @@ let
   #     nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy
   #
   # The update script uses sed regexes to replace them with the updated hashes.
-  version = "1.11.4";
-  srcHash = "sha256-hNAZOMDFYqZpb67Pzg/WALWagFYvqYO1jOmcipDDRbE=";
+  version = "1.12.0";
+  srcHash = "sha256-PuiyYTgSegDTV9Kae5N68FOXT1jyJrNv9p2aFP70Z20=";
   datasetsHashes = {
     ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3";
     ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj";
@@ -75,13 +78,11 @@ in buildPythonPackage {
     })
   ];
 
-  # Relax deps a bit
+  # Upstream complicated numpy version pinning is causing issues in the
+  # configurePhase, so we pass on it.
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace 'meson-python>=0.12.1,<0.15.0' 'meson-python' \
-      --replace 'numpy==' 'numpy>=' \
-      --replace "pybind11>=2.10.4,<2.11.1" "pybind11>=2.10.4,<2.12.0" \
-      --replace 'wheel<0.41.0' 'wheel'
+      --replace-fail 'numpy==' 'numpy>=' \
   '';
 
   nativeBuildInputs = [
@@ -91,6 +92,7 @@ in buildPythonPackage {
     pythran
     pkg-config
     wheel
+    setuptools
   ];
 
   buildInputs = [
@@ -108,6 +110,8 @@ in buildPythonPackage {
   __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = [
+    nose
+    hypothesis
     pytestCheckHook
     pytest-xdist
   ];
@@ -157,42 +161,9 @@ in buildPythonPackage {
   #
   hardeningDisable = lib.optionals (stdenv.isAarch64 && stdenv.isDarwin) [ "stackprotector" ];
 
-  checkPhase = ''
-    runHook preCheck
-
-    # Adapted from pytestCheckHook because scipy uses a custom check phase.
-    # It needs to pass `$args` as a Python list to `scipy.test` rather than as
-    # arguments to pytest on the command-line.
-    args=""
-    if [ -n "$disabledTests" ]; then
-      disabledTestsString=$(_pytestComputeDisabledTestsString "''${disabledTests[@]}")
-      args+="'-k','$disabledTestsString'"
-    fi
-
-    if [ -n "''${disabledTestPaths-}" ]; then
-        eval "disabledTestPaths=($disabledTestPaths)"
-    fi
-
-    for path in ''${disabledTestPaths[@]}; do
-      if [ ! -e "$path" ]; then
-        echo "Disabled tests path \"$path\" does not exist. Aborting"
-        exit 1
-      fi
-      args+="''${args:+,}'--ignore=\"$path\"'"
-    done
-    args+="''${args:+,}$(printf \'%s\', "''${pytestFlagsArray[@]}")"
-    args=''${args%,}
-
-    pushd "$out"
+  preCheck = ''
     export OMP_NUM_THREADS=$(( $NIX_BUILD_CORES / 4 ))
-    ${python.interpreter} -c "import scipy, sys; sys.exit(scipy.test(
-        'fast',
-        verbose=10,
-        extra_argv=[$args],
-        parallel=$NIX_BUILD_CORES
-    ) != True)"
-    popd
-    runHook postCheck
+    cd $out
   '';
 
   requiredSystemFeatures = [ "big-parallel" ]; # the tests need lots of CPU time
diff --git a/pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix b/pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix
index 3945f8bf4c4f3..327ff267eebc8 100644
--- a/pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-apidoc/default.nix
@@ -2,12 +2,13 @@
 , buildPythonPackage
 , fetchPypi
 , pbr
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "sphinxcontrib-apidoc";
   version = "0.4.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
@@ -19,8 +20,9 @@ buildPythonPackage rec {
     rm test-requirements.txt requirements.txt
   '';
 
-  propagatedBuildInputs = [
+  nativeBuildInputs = [
     pbr
+    setuptools
   ];
 
   # Check is disabled due to circular dependency of sphinx
diff --git a/pkgs/development/ruby-modules/bundler/default.nix b/pkgs/development/ruby-modules/bundler/default.nix
index 05d1bfbf64e64..04e6a6d35a111 100644
--- a/pkgs/development/ruby-modules/bundler/default.nix
+++ b/pkgs/development/ruby-modules/bundler/default.nix
@@ -4,8 +4,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.5.3";
-  source.sha256 = "sha256-JJzQdaxPM1rnD3iMm+D0wYgJOk2n0FvVO+K67z8l58s=";
+  version = "2.5.5";
+  source.sha256 = "sha256-E8f+JpAw4qZAKmVMBt7/Aa72dM7WSds76YtVA6CApGI=";
   dontPatchShebangs = true;
 
   postFixup = ''
diff --git a/pkgs/development/ruby-modules/gem/default.nix b/pkgs/development/ruby-modules/gem/default.nix
index 7ae9168975ab6..409c2c9d027b8 100644
--- a/pkgs/development/ruby-modules/gem/default.nix
+++ b/pkgs/development/ruby-modules/gem/default.nix
@@ -34,7 +34,7 @@ lib.makeOverridable (
 , stdenv ? ruby.stdenv
 , namePrefix ? (let
     rubyName = builtins.parseDrvName ruby.name;
-  in "${rubyName.name}${rubyName.version}-")
+  in "${rubyName.name}${lib.versions.majorMinor rubyName.version}-")
 , nativeBuildInputs ? []
 , buildInputs ? []
 , meta ? {}
diff --git a/pkgs/development/tools/documentation/doxygen/default.nix b/pkgs/development/tools/documentation/doxygen/default.nix
index 3b1a1fa0aa1fb..ddf27b35dbd05 100644
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@@ -8,18 +8,18 @@
 , qt5
 , CoreServices
 , libiconv
-, withSqlite ? true, sqlite
+, sqlite
 }:
 
 stdenv.mkDerivation rec {
   pname = "doxygen";
-  version = "1.9.8";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "doxygen";
     repo = "doxygen";
     rev = "Release_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-uQ1Fl2kmY7qmzy34NOmZCgPxVGwmqRqDvV6yEab5P4w=";
+    sha256 = "sha256-FPI5ICdn9Tne/g9SP6jAQS813AAyoDNooDR/Hyvq6R4=";
   };
 
   nativeBuildInputs = [
@@ -29,14 +29,14 @@ stdenv.mkDerivation rec {
     bison
   ];
 
-  buildInputs = [ libiconv ]
-    ++ lib.optionals withSqlite [ sqlite ]
+  buildInputs = [ libiconv sqlite ]
     ++ lib.optionals (qt5 != null) (with qt5; [ qtbase wrapQtAppsHook ])
     ++ lib.optionals stdenv.isDarwin [ CoreServices ];
 
-  cmakeFlags = [ "-DICONV_INCLUDE_DIR=${libiconv}/include" ]
-    ++ lib.optional withSqlite "-Duse_sqlite3=ON"
-    ++ lib.optional (qt5 != null) "-Dbuild_wizard=YES";
+  cmakeFlags = [
+    "-DICONV_INCLUDE_DIR=${libiconv}/include"
+    "-Duse_sys_sqlite3=ON"
+  ] ++ lib.optional (qt5 != null) "-Dbuild_wizard=YES";
 
   env.NIX_CFLAGS_COMPILE =
     lib.optionalString stdenv.isDarwin "-mmacosx-version-min=10.9";
diff --git a/pkgs/development/tools/gocode/default.nix b/pkgs/development/tools/gocode/default.nix
deleted file mode 100644
index 687b69cf20278..0000000000000
--- a/pkgs/development/tools/gocode/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
-
-buildGoPackage rec {
-  pname = "gocode-unstable";
-  version = "2020-04-06";
-  rev = "4acdcbdea79de6b3dee1c637eca5cbea0fdbe37c";
-
-  goPackagePath = "github.com/mdempsky/gocode";
-
-  # we must allow references to the original `go` package,
-  # because `gocode` needs to dig into $GOROOT to provide completions for the
-  # standard packages.
-  allowGoReference = true;
-
-  src = fetchFromGitHub {
-    inherit rev;
-
-    owner = "mdempsky";
-    repo = "gocode";
-    sha256 = "0i1hc089gb6a4mcgg56vn5l0q96wrlza2n08l4349s3dc2j559fb";
-  };
-
-  goDeps = ./deps.nix;
-
-  meta = with lib; {
-    description = "An autocompletion daemon for the Go programming language";
-    longDescription = ''
-      Gocode is a helper tool which is intended to be integrated with your
-      source code editor, like vim, neovim and emacs. It provides several
-      advanced capabilities, which currently includes:
-
-        - Context-sensitive autocompletion
-
-      It is called daemon, because it uses client/server architecture for
-      caching purposes. In particular, it makes autocompletions very fast.
-      Typical autocompletion time with warm cache is 30ms, which is barely
-      noticeable.
-    '';
-    homepage = "https://github.com/mdempsky/gocode";
-    license = licenses.mit;
-    maintainers = with maintainers; [ kalbasit ];
-  };
-}
diff --git a/pkgs/development/tools/gocode/deps.nix b/pkgs/development/tools/gocode/deps.nix
deleted file mode 100644
index b2518109171a9..0000000000000
--- a/pkgs/development/tools/gocode/deps.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "72e4a01eba4315301fd9ce00c8c2f492580ded8a";
-      sha256 = "0a8c7j4w784w441j3j3bh640vy1g6g214641qv485wyi0xj49anf";
-    };
-  }
-]
diff --git a/pkgs/development/tools/gofumpt/default.nix b/pkgs/development/tools/gofumpt/default.nix
index 6becc6f4002d4..36e38163e2a77 100644
--- a/pkgs/development/tools/gofumpt/default.nix
+++ b/pkgs/development/tools/gofumpt/default.nix
@@ -21,7 +21,11 @@ buildGoModule rec {
 
   CGO_ENABLED = "0";
 
-  ldflags = "-s -w -X main.version=v${version}";
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=v${version}"
+  ];
 
   checkFlags = [
     # Requires network access (Error: module lookup disabled by GOPROXY=off).
diff --git a/pkgs/development/tools/kind/default.nix b/pkgs/development/tools/kind/default.nix
index 63f6fff66b623..1f58fd637a6de 100644
--- a/pkgs/development/tools/kind/default.nix
+++ b/pkgs/development/tools/kind/default.nix
@@ -20,7 +20,7 @@ buildGoModule rec {
 
   CGO_ENABLED = 0;
   GOFLAGS = [ "-trimpath" ];
-  ldflags = [ "-buildid=" "-w" ];
+  ldflags = [ "-w" ];
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/misc/autoconf/2.71.nix b/pkgs/development/tools/misc/autoconf/2.71.nix
new file mode 100644
index 0000000000000..1fcb819bd4b72
--- /dev/null
+++ b/pkgs/development/tools/misc/autoconf/2.71.nix
@@ -0,0 +1,69 @@
+{ lib, stdenv, fetchurl, m4, perl, texinfo }:
+
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
+stdenv.mkDerivation rec {
+  pname = "autoconf";
+  version = "2.71";
+  outputs = [ "out" "doc" ];
+
+  src = fetchurl {
+    url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
+    sha256 = "197sl23irn6s9pd54rxj5vcp5y8dv65jb9yfqgr2g56cxg7q6k7i";
+  };
+  patches = [
+    # fix stale autom4te cache race condition:
+    #  https://savannah.gnu.org/support/index.php?110521
+    ./2.71-fix-race.patch
+  ];
+
+  strictDeps = true;
+  nativeBuildInputs = [ m4 perl texinfo ];
+  buildInputs = [ m4 ];
+  postBuild = "
+    make html
+  ";
+
+  postInstall = "
+    make install-html
+  ";
+
+  # Work around a known issue in Cygwin.  See
+  # http://thread.gmane.org/gmane.comp.sysutils.autoconf.bugs/6822 for
+  # details.
+  # There are many test failures on `i386-pc-solaris2.11'.
+  doCheck = ((!stdenv.isCygwin) && (!stdenv.isSunOS));
+
+  # Don't fixup "#! /bin/sh" in Autoconf, otherwise it will use the
+  # "fixed" path in generated files!
+  dontPatchShebangs = true;
+
+  enableParallelBuilding = true;
+
+  # Make the Autotest test suite run in parallel.
+  preCheck =''
+    export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
+  '';
+
+  meta = {
+    homepage = "https://www.gnu.org/software/autoconf/";
+    description = "Part of the GNU Build System";
+
+    longDescription = ''
+      GNU Autoconf is an extensible package of M4 macros that produce
+      shell scripts to automatically configure software source code
+      packages.  These scripts can adapt the packages to many kinds of
+      UNIX-like systems without manual user intervention.  Autoconf
+      creates a configuration script for a package from a template
+      file that lists the operating system features that the package
+      can use, in the form of M4 macro calls.
+    '';
+
+    license = lib.licenses.gpl3Plus;
+
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/tools/misc/autoconf/default.nix b/pkgs/development/tools/misc/autoconf/default.nix
index 1fcb819bd4b72..8039e36a4f209 100644
--- a/pkgs/development/tools/misc/autoconf/default.nix
+++ b/pkgs/development/tools/misc/autoconf/default.nix
@@ -7,18 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "autoconf";
-  version = "2.71";
+  version = "2.72";
   outputs = [ "out" "doc" ];
 
   src = fetchurl {
     url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
-    sha256 = "197sl23irn6s9pd54rxj5vcp5y8dv65jb9yfqgr2g56cxg7q6k7i";
+    hash = "sha256-uohcExlXjWyU1G6bDc60AUyq/iSQ5Deg28o/JwoiP1o=";
   };
-  patches = [
-    # fix stale autom4te cache race condition:
-    #  https://savannah.gnu.org/support/index.php?110521
-    ./2.71-fix-race.patch
-  ];
 
   strictDeps = true;
   nativeBuildInputs = [ m4 perl texinfo ];
diff --git a/pkgs/development/tools/misc/lttng-ust/default.nix b/pkgs/development/tools/misc/lttng-ust/default.nix
index 0c19b59c5c35e..b1fb9c83e8d0e 100644
--- a/pkgs/development/tools/misc/lttng-ust/default.nix
+++ b/pkgs/development/tools/misc/lttng-ust/default.nix
@@ -1,4 +1,4 @@
 import ./generic.nix {
-  version = "2.13.6";
-  sha256 = "sha256-5+BFlt1zrHqpnifNAA+UnbsP7VG9KQmfmwiiXB3wztU=";
+  version = "2.13.7";
+  sha256 = "sha256-X7TxfDB8jBt5xoVh6JvpVi0H50Jb9A5yjE1mdVNCpes=";
 }
diff --git a/pkgs/development/tools/misc/ycmd/default.nix b/pkgs/development/tools/misc/ycmd/default.nix
index aeca3c437ff4d..ae741234a8e26 100644
--- a/pkgs/development/tools/misc/ycmd/default.nix
+++ b/pkgs/development/tools/misc/ycmd/default.nix
@@ -1,5 +1,4 @@
 { stdenv, lib, fetchFromGitHub, cmake, ninja, python
-, withGocode ? true, gocode
 , withGodef ? true, godef
 , withGotools? true, gotools
 , withTypescript ? true, typescript
@@ -63,10 +62,6 @@ stdenv.mkDerivation {
     mkdir -p $out/lib/ycmd/third_party
     cp -r third_party/* $out/lib/ycmd/third_party/
 
-  '' + lib.optionalString withGocode ''
-    TARGET=$out/lib/ycmd/third_party/gocode
-    mkdir -p $TARGET
-    ln -sf ${gocode}/bin/gocode $TARGET
   '' + lib.optionalString withGodef ''
     TARGET=$out/lib/ycmd/third_party/godef
     mkdir -p $TARGET
diff --git a/pkgs/development/tools/rust/maturin/default.nix b/pkgs/development/tools/rust/maturin/default.nix
index 37cec14ee4c4c..fa17f4f036241 100644
--- a/pkgs/development/tools/rust/maturin/default.nix
+++ b/pkgs/development/tools/rust/maturin/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maturin";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     rev = "v${version}";
-    hash = "sha256-MVmu9m+9XhWuPBEEoaYmsSbMFziSZaM5Gg5kOr1DT54=";
+    hash = "sha256-mD/7wWeclV5Xqii9hcZMustvR6tf7MoyTZ3WsvEc61U=";
   };
 
-  cargoHash = "sha256-hrdrGFtL2vGczINnvDa4rclkXsNWnEqtTt3NVaRay8w=";
+  cargoHash = "sha256-w8XpCJ8GS2VszW/9/O2suy82zVO1UpWTrU1lFGYwhvw=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security libiconv ];
 
diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 8827d6b709e7b..648b2615166c1 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spirv-tools";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-Bned5Pa6zCFByfNvqD0M5t3l4uAJYkDlpe6wu8e7a3U=";
+    hash = "sha256-RzGvoDt1Qc+f6mZsfs99MxX4YB3yFc5FP92Yx/WGrsI=";
   };
 
   # The cmake options are sufficient for turning on static building, but not
diff --git a/pkgs/development/tools/vulkan-validation-layers/default.nix b/pkgs/development/tools/vulkan-validation-layers/default.nix
index 09a11cef84f4e..1d0a39fb2b8bd 100644
--- a/pkgs/development/tools/vulkan-validation-layers/default.nix
+++ b/pkgs/development/tools/vulkan-validation-layers/default.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vulkan-validation-layers";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-DwkSUclStYKe54tC1H3jMv1KOSScgqf25tR5ajQZ6os=";
+    hash = "sha256-hJx8gn0zCN3+DhO6niylZJXPHgQ+VhQV5tL8qAeRaUg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index 5868c5d9a990b..d1a75dcdf7e5c 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -8,8 +8,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "20.10.0";
-  sha256 = "sha256-MuslbuvYys1VdOZjHlS0K+fsjr4lrUeoymhUA7rRVTU=";
+  version = "20.11.0";
+  sha256 = "sha256-MYB+vu6wScU/F2XkqVrtaUdqS2lt0QDLU5q2aNeVC0A=";
   patches = [
     ./revert-arm64-pointer-auth.patch
     ./disable-darwin-v8-system-instrumentation-node19.patch
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
deleted file mode 100644
index d864f30096d7c..0000000000000
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ /dev/null
@@ -1,164 +0,0 @@
-{ stdenv
-, lib
-, fetchurl
-, fetchpatch
-, alsa-lib
-, dbus
-, ell
-, glib
-, json_c
-, libical
-, docutils
-, pkg-config
-, python3
-, readline
-, systemdMinimal
-, udev
-, withExperimental ? false
-}: let
-  pythonPath = with python3.pkgs; [
-    dbus-python
-    pygobject3
-    recursivePthLoader
-  ];
-in stdenv.mkDerivation rec {
-  pname = "bluez";
-  version = "5.70";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-N+Ny6RaVXhRMuIL4iOS+QImPEK47fCE93N1V7pwAkng=";
-  };
-
-  patches = [
-    # replace use of a non-standard symbol to fix build with musl libc (pkgsMusl.bluez)
-    (fetchpatch {
-      url = "https://git.alpinelinux.org/aports/plain/main/bluez/max-input.patch?id=32b31b484cb13009bd8081c4106e4cf064ec2f1f";
-      sha256 = "sha256-SczbXtsxBkCO+izH8XOBcrJEO2f7MdtYVT3+2fCV8wU=";
-    })
-    # Fix device pairing regression
-    # FIXME: remove in next release
-    (fetchpatch {
-      url = "https://github.com/bluez/bluez/commit/3a9c637010f8dc1ba3e8382abe01065761d4f5bb.patch";
-      hash = "sha256-UUmYMHnxYrw663nEEC2mv3zj5e0omkLNejmmPUtgS3c=";
-    })
-    # CVE-2023-45866 / https://github.com/skysafe/reblog/tree/main/cve-2023-45866
-    (fetchpatch {
-      name = "CVE-2023-45866.patch";
-      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675";
-      sha256 = "sha256-IuPQ18yN0EO/PkqdT/JETyOxdZCKewBiDjGN4CG2GLo=";
-    })
-  ];
-
-  buildInputs = [
-    alsa-lib
-    dbus
-    ell
-    glib
-    json_c
-    libical
-    python3
-    readline
-    udev
-  ];
-
-  nativeBuildInputs = [
-    docutils
-    pkg-config
-    python3.pkgs.wrapPython
-  ];
-
-  outputs = [ "out" "dev" "test" ];
-
-  postPatch = ''
-    substituteInPlace tools/hid2hci.rules \
-      --replace /sbin/udevadm ${systemdMinimal}/bin/udevadm \
-      --replace "hid2hci " "$out/lib/udev/hid2hci "
-    # Disable some tests:
-    # - test-mesh-crypto depends on the following kernel settings:
-    #   CONFIG_CRYPTO_[USER|USER_API|USER_API_AEAD|USER_API_HASH|AES|CCM|AEAD|CMAC]
-    if [[ ! -f unit/test-mesh-crypto.c ]]; then echo "unit/test-mesh-crypto.c no longer exists"; false; fi
-    echo 'int main() { return 77; }' > unit/test-mesh-crypto.c
-  '';
-
-  configureFlags = [
-    "--localstatedir=/var"
-    "--enable-library"
-    "--enable-cups"
-    "--enable-pie"
-    "--enable-external-ell"
-    "--with-dbusconfdir=${placeholder "out"}/share"
-    "--with-dbussystembusdir=${placeholder "out"}/share/dbus-1/system-services"
-    "--with-dbussessionbusdir=${placeholder "out"}/share/dbus-1/services"
-    "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
-    "--with-systemduserunitdir=${placeholder "out"}/etc/systemd/user"
-    "--with-udevdir=${placeholder "out"}/lib/udev"
-    "--enable-health"
-    "--enable-mesh"
-    "--enable-midi"
-    "--enable-nfc"
-    "--enable-sixaxis"
-    "--enable-btpclient"
-    "--enable-hid2hci"
-    "--enable-logger"
-
-    # To provide ciptool, sdptool, and rfcomm (unmaintained)
-    # superseded by new D-Bus APIs
-    "--enable-deprecated"
-  ] ++ lib.optional withExperimental "--enable-experimental";
-
-
-  # Work around `make install' trying to create /var/lib/bluetooth.
-  installFlags = [ "statedir=$(TMPDIR)/var/lib/bluetooth" ];
-
-  makeFlags = [ "rulesdir=${placeholder "out"}/lib/udev/rules.d" ];
-
-  doCheck = stdenv.hostPlatform.isx86_64;
-
-  postInstall = ''
-    mkdir -p $test/{bin,test}
-    cp -a test $test
-    pushd $test/test
-    for a in \
-            simple-agent \
-            test-adapter \
-            test-device \
-            test-thermometer \
-            list-devices \
-            monitor-bluetooth \
-            ; do
-      ln -s ../test/$a $test/bin/bluez-$a
-    done
-    popd
-    wrapPythonProgramsIn $test/test "$test/test ${toString pythonPath}"
-  '' + ''
-    # for bluez4 compatibility for NixOS
-    mkdir $out/sbin
-    ln -s ../libexec/bluetooth/bluetoothd $out/sbin/bluetoothd
-    ln -s ../libexec/bluetooth/obexd $out/sbin/obexd
-
-    # Add extra configuration
-    mkdir $out/etc/bluetooth
-    ln -s /etc/bluetooth/main.conf $out/etc/bluetooth/main.conf
-
-    # https://github.com/NixOS/nixpkgs/issues/204418
-    ln -s /etc/bluetooth/input.conf $out/etc/bluetooth/input.conf
-    ln -s /etc/bluetooth/network.conf $out/etc/bluetooth/network.conf
-
-    # Add missing tools, ref https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/bluez
-    for files in `find tools/ -type f -perm -755`; do
-      filename=$(basename $files)
-      install -Dm755 tools/$filename $out/bin/$filename
-    done
-    install -Dm755 attrib/gatttool $out/bin/gatttool
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "Bluetooth support for Linux";
-    homepage = "http://www.bluez.org/";
-    license = with licenses; [ gpl2 lgpl21 ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 83dd82e6ab260..a705a9fb5d381 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.377-2";
+  version = "0.378";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-Nh+EIsJ/98NnflndQeSgiV2iOC0icTEfgwAySPbG6Lo=";
+    hash = "sha256-YCx0b4crg8A7mGXwqk1XQZKsm/3TUE8C2bOYKnb/FSA=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index e621a15bd8c9b..69f16fd79cf68 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -381,6 +381,16 @@ let
       DRM_VC4_HDMI_CEC = yes;
     };
 
+    # Enables Rust support in the Linux kernel. This is currently not enabled by default, because it occasionally requires
+    # patching the Linux kernel for the specific Rust toolchain in nixpkgs. These patches usually take a bit
+    # of time to appear and this would hold up Linux kernel and Rust toolchain updates.
+    #
+    # Once Rust in the kernel has more users, we can reconsider enabling it by default.
+    rust = optionalAttrs ((features.rust or false) && versionAtLeast version "6.7") {
+      RUST = yes;
+      GCC_PLUGINS = no;
+    };
+
     sound = {
       SND_DYNAMIC_MINORS  = yes;
       SND_AC97_POWER_SAVE = yes; # AC97 Power-Saving Mode
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 27d744c1ab778..a2f80505cd95d 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -9,6 +9,9 @@
 , pahole
 , lib
 , stdenv
+, rustc
+, rustPlatform
+, rust-bindgen
 
 , # The kernel source tarball.
   src
@@ -115,6 +118,8 @@ let
         map ({extraConfig ? "", ...}: extraConfig) kernelPatches;
     in lib.concatStringsSep "\n" ([baseConfigStr] ++ configFromPatches);
 
+  withRust = ((configfile.moduleStructuredConfig.settings.RUST or {}).tristate or null) == "y";
+
   configfile = stdenv.mkDerivation {
     inherit ignoreConfigErrors autoModules preferBuiltin kernelArch extraMakeFlags;
     pname = "linux-config";
@@ -128,7 +133,11 @@ let
     depsBuildBuild = [ buildPackages.stdenv.cc ];
     nativeBuildInputs = [ perl gmp libmpc mpfr ]
       ++ lib.optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-      ++ lib.optional (lib.versionAtLeast version "5.2") pahole;
+      ++ lib.optional (lib.versionAtLeast version "5.2") pahole
+      ++ lib.optionals withRust [ rust-bindgen rustc ]
+    ;
+
+    RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
 
     platformName = stdenv.hostPlatform.linux-kernel.name;
     # e.g. "defconfig"
@@ -200,7 +209,7 @@ let
     inherit kernelPatches randstructSeed extraMakeFlags extraMeta configfile;
     pos = builtins.unsafeGetAttrPos "version" args;
 
-    config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
+    config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; } // lib.optionalAttrs withRust { CONFIG_RUST = "y"; };
   } // lib.optionalAttrs (modDirVersion != null) { inherit modDirVersion; });
 
   passthru = basicArgs // {
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 2ba31fbc97892..baf0231f13e16 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
 , libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, kmod, ubootTools
 , fetchpatch
+, rustc, rust-bindgen, rustPlatform
 }:
 
 let
@@ -56,15 +57,6 @@ let
   inherit (lib)
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
-  # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = [
-    pahole
-    perl
-    libelf
-    # module makefiles often run uname commands to find out the kernel version
-    (buildPackages.deterministic-uname.override { inherit modDirVersion; })
-  ] ++ optional (lib.versionAtLeast version "5.13") zstd;
-
   drvAttrs = config_: kernelConf: kernelPatches: configfile:
     let
       config = let attrName = attr: "CONFIG_" + attr; in {
@@ -84,14 +76,27 @@ let
       } // config_;
 
       isModular = config.isYes "MODULES";
+      withRust = config.isYes "RUST";
 
       buildDTBs = kernelConf.DTB or false;
 
+      # Dependencies that are required to build kernel modules
+      moduleBuildDependencies = [
+        pahole
+        perl
+        libelf
+        # module makefiles often run uname commands to find out the kernel version
+        (buildPackages.deterministic-uname.override { inherit modDirVersion; })
+      ]
+      ++ optional (lib.versionAtLeast version "5.13") zstd
+      ++ optionals withRust [ rustc rust-bindgen ]
+      ;
+
     in (optionalAttrs isModular { outputs = [ "out" "dev" ]; }) // {
       passthru = rec {
         inherit version modDirVersion config kernelPatches configfile
           moduleBuildDependencies stdenv;
-        inherit isZen isHardened isLibre;
+        inherit isZen isHardened isLibre withRust;
         isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
         baseVersion = lib.head (lib.splitString "-rc" version);
         kernelOlder = lib.versionOlder baseVersion;
@@ -100,6 +105,16 @@ let
 
       inherit src;
 
+      depsBuildBuild = [ buildPackages.stdenv.cc ];
+      nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ubootTools ]
+                          ++ optional  (lib.versionOlder version "5.8") libelf
+                          ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
+                          ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
+                          ++ optional  (lib.versionAtLeast version "5.8")  elfutils
+                          ++ optionals withRust [ rustc rust-bindgen ];
+
+      RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
+
       patches =
         map (p: p.patch) kernelPatches
         # Required for deterministic builds along with some postPatch magic.
@@ -363,14 +378,6 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
 
   enableParallelBuilding = true;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ubootTools ]
-      ++ optional  (lib.versionOlder version "5.8") libelf
-      ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-      ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
-      ++ optional  (lib.versionAtLeast version "5.8")  elfutils
-      ;
-
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
 
   # Absolute paths for compilers avoid any PATH-clobbering issues.
diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index 0f60a8655cedf..59aa5bbc0e5d0 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libcap-ng";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchurl {
     url = "https://people.redhat.com/sgrubb/libcap-ng/libcap-ng-${version}.tar.gz";
-    sha256 = "sha256-vtb2hI4iuy+Dtfdksq7w7TkwVOgDqOOocRyyo55rSS0=";
+    sha256 = "sha256-aFgdOzjnVTy29t33gTsfyZ5ShW8hQh97R3zlq9JgWoo=";
   };
 
   outputs = [ "out" "dev" "man" ];
diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index b2f6b0aa8a23d..fa0a2cc8a6009 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.22";
-  hash = "sha256-TFppI70aznzgRHRgioSTfOBTupGxrOnwsAFyaOcy3Hw=";
+  version = "2.03.23";
+  hash = "sha256-dOeUqene4bz4ogZfZbkZbET98yHiLWO5jtfejJqhel0=";
 }
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index 7b9cc10be1672..97f1eb3a17719 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -103,8 +103,8 @@ stdenv.mkDerivation rec {
     }))
     # Musl fix from Alpine
     ./fix-stdio-usage.patch
-  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
-    ./no-shared.patch
+    # https://gitlab.com/lvmteam/lvm2/-/merge_requests/8
+    ./fix-static.patch
   ];
 
   doCheck = false; # requires root
diff --git a/pkgs/os-specific/linux/lvm2/fix-static.patch b/pkgs/os-specific/linux/lvm2/fix-static.patch
new file mode 100644
index 0000000000000..89192744adecb
--- /dev/null
+++ b/pkgs/os-specific/linux/lvm2/fix-static.patch
@@ -0,0 +1,28 @@
+From 0cbe7f0adc86c92c61156c417b27b063f156b31b Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Tue, 2 Jan 2024 18:15:20 +0100
+Subject: [PATCH] makefiles: fix disabling shared link
+
+LIB_SHARED still gets set when shared linking has been disabled, so
+the previous version of this check still attempted to build the
+shared library.
+---
+ libdm/make.tmpl.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libdm/make.tmpl.in b/libdm/make.tmpl.in
+index 2dd9625d4d..69ba2c35ab 100644
+--- a/libdm/make.tmpl.in
++++ b/libdm/make.tmpl.in
+@@ -436,7 +436,7 @@ DEFS+=-D_FILE_OFFSET_BITS=64
+ 	@echo "    [CC] $(<F)"
+ 	$(Q) $(CC) -c $(CFLAGS) $(CLDFLAGS) $< $(LIBS) -o $@
+ 
+-ifneq (,$(LIB_SHARED))
++ifeq ("@SHARED_LINK@", "yes")
+ 
+ TARGETS += $(LIB_SHARED).$(LIB_VERSION)
+ $(LIB_SHARED).$(LIB_VERSION): $(OBJECTS) $(LDDEPS)
+-- 
+GitLab
+
diff --git a/pkgs/os-specific/linux/lvm2/no-shared.patch b/pkgs/os-specific/linux/lvm2/no-shared.patch
deleted file mode 100644
index 23a82a0fa294d..0000000000000
--- a/pkgs/os-specific/linux/lvm2/no-shared.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-diff --git a/libdm/Makefile.in b/libdm/Makefile.in
-index 2758648e6..f305a12b0 100644
---- a/libdm/Makefile.in
-+++ b/libdm/Makefile.in
-@@ -47,7 +47,6 @@ endif
- 
- LIB_SHARED = $(interface)/libdevmapper.$(LIB_SUFFIX)
- LIB_VERSION = $(LIB_VERSION_DM)
--TARGETS = libdevmapper.$(LIB_SUFFIX) libdevmapper.$(LIB_SUFFIX).$(LIB_VERSION) .symver_check
- 
- CFLOW_LIST = $(SOURCES)
- CFLOW_LIST_TARGET = libdevmapper.cflow
-diff --git a/libdm/make.tmpl.in b/libdm/make.tmpl.in
-index a731687c2..9366cdf1c 100644
---- a/libdm/make.tmpl.in
-+++ b/libdm/make.tmpl.in
-@@ -314,7 +314,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
- SUBDIRS.clean := $(SUBDIRS:=.clean)
- SUBDIRS.distclean := $(SUBDIRS:=.distclean)
- 
--TARGETS += $(LIB_SHARED) $(LIB_STATIC)
-+TARGETS += $(LIB_STATIC)
- 
- all: $(SUBDIRS) $(TARGETS)
- 
-@@ -431,7 +431,6 @@ DEFS+=-D_FILE_OFFSET_BITS=64
- 
- ifneq (,$(LIB_SHARED))
- 
--TARGETS += $(LIB_SHARED).$(LIB_VERSION)
- $(LIB_SHARED).$(LIB_VERSION): $(OBJECTS) $(LDDEPS)
- 	@echo "    [CC] $@"
- ifeq ("@LIB_SUFFIX@","so")
-diff --git a/make.tmpl.in b/make.tmpl.in
-index b73176f5a..6100d0dfd 100644
---- a/make.tmpl.in
-+++ b/make.tmpl.in
-@@ -368,7 +368,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
- SUBDIRS.clean := $(SUBDIRS:=.clean)
- SUBDIRS.distclean := $(SUBDIRS:=.distclean)
- 
--TARGETS += $(LIB_SHARED) $(LIB_STATIC)
-+TARGETS += $(LIB_STATIC)
- 
- INTERNAL_LIBS = \
- 	$(top_builddir)/libdaemon/client/libdaemonclient.a \
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index 10864df2597b9..241f33f1e00ac 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "linux-pam";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchurl {
-    url    = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
-    sha256 = "sha256-5OxxMakdpEUSV0Jo9JPG2MoQXIcJFpG46bVspoXU+U0=";
+    url = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
+    hash = "sha256-esS1D+7gBKn6iPHf0tL6c4qCiWdjBQzXc7PFSwqBgoM=";
   };
 
   patches = [
@@ -57,6 +57,9 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--includedir=${placeholder "out"}/include/security"
     "--enable-sconfigdir=/etc/security"
+    # The module is deprecated. We re-enable it explicitly until NixOS
+    # module stops using it.
+    "--enable-lastlog"
   ];
 
   installFlags = [
diff --git a/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix b/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix
new file mode 100644
index 0000000000000..fd6b85a4dbd69
--- /dev/null
+++ b/pkgs/os-specific/linux/rust-out-of-tree-module/default.nix
@@ -0,0 +1,28 @@
+{ lib, fetchFromGitHub, kernel }:
+kernel.stdenv.mkDerivation {
+  name = "rust-out-of-tree-module";
+
+  src = fetchFromGitHub {
+    owner = "Rust-for-linux";
+    repo = "rust-out-of-tree-module";
+
+    rev = "7addf9dafba795524f6179a557f7272ecbe1b165";
+    hash = "sha256-Bj7WonZ499W/FajbxjM7yBkU9iTxTW7CrRbCSzWbsSc=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  meta = {
+    broken = !kernel.withRust;
+    description = "A basic template for an out-of-tree Linux kernel module written in Rust";
+    homepage = "https://github.com/Rust-for-Linux/rust-out-of-tree-module";
+    license = lib.licenses.gpl2Only;
+    maintainers = [ lib.maintainers.blitz ];
+    platforms = lib.platforms.linux;
+  };
+
+}
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index 104a9dad959a9..b08026278edb6 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -13,10 +13,10 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index c0defc31de..8f80235731 100644
+index 0d68f31d36..6b52f7ed4b 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
-@@ -20,10 +20,6 @@ SUBSYSTEM=="block", TAG+="systemd"
+@@ -22,10 +22,6 @@ SUBSYSTEM=="block", TAG+="systemd"
  SUBSYSTEM=="block", ENV{DM_SUSPENDED}=="1", IMPORT{db}="SYSTEMD_READY", GOTO="systemd_end"
  SUBSYSTEM=="block", ACTION=="add", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
  
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index dda8524c498da..8507bb583c8a8 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -14,10 +14,10 @@ Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
  2 files changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index 4ffec25c75..b99031c54e 100644
+index 55e76b6e16..015a608035 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
-@@ -43,6 +43,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
+@@ -66,6 +66,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
          /* Don't bother with the OS data itself */
          if (PATH_IN_SET(mount,
                          "/",
@@ -27,7 +27,7 @@ index 4ffec25c75..b99031c54e 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 1586c2e214..fcae95f824 100644
+index 1a9b99d761..04ef9af1ea 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
 @@ -170,8 +170,10 @@ int mount_points_list_get(const char *mountinfo, MountPoint **head) {
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 2d86d1e6957a1..535ca3d86457b 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index e170958fc5..898a674631 100644
+index 38196ef3d6..57d1750b00 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5648,6 +5648,7 @@ static int run(int argc, char *argv[]) {
+@@ -5602,6 +5602,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,7 +21,7 @@ index e170958fc5..898a674631 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -5662,6 +5663,7 @@ static int run(int argc, char *argv[]) {
+@@ -5618,6 +5619,7 @@ static int run(int argc, char *argv[]) {
                                                      "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
                                  goto finish;
                          }
diff --git a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
index c905a4d812af2..d2232765f71da 100644
--- a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
@@ -11,12 +11,12 @@ Also, remove /usr and /lib as these don't exist on NixOS.
 
 Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
 ---
- src/basic/path-lookup.c | 17 ++---------------
+ src/basic/path-lookup.c | 18 ++----------------
  src/core/systemd.pc.in  |  8 ++++----
- 2 files changed, 6 insertions(+), 19 deletions(-)
+ 2 files changed, 6 insertions(+), 20 deletions(-)
 
 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 7d158a8295..f9bd62b631 100644
+index 4e3d59fc56..0d18b9a2d0 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
 @@ -92,11 +92,7 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
@@ -31,7 +31,7 @@ index 7d158a8295..f9bd62b631 100644
          NULL
  };
  
-@@ -617,15 +613,13 @@ int lookup_paths_init(
+@@ -613,16 +609,13 @@ int lookup_paths_init(
                                          persistent_config,
                                          SYSTEM_CONFIG_UNIT_DIR,
                                          "/etc/systemd/system",
@@ -44,11 +44,12 @@ index 7d158a8295..f9bd62b631 100644
 -                                        "/usr/local/lib/systemd/system",
                                          SYSTEM_DATA_UNIT_DIR,
 -                                        "/usr/lib/systemd/system",
+-                                        /* To be used ONLY for images which might be legacy split-usr */
 -                                        STRV_IFNOTNULL(flags & LOOKUP_PATHS_SPLIT_USR ? "/lib/systemd/system" : NULL),
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -641,14 +635,11 @@ int lookup_paths_init(
+@@ -638,14 +631,11 @@ int lookup_paths_init(
                                          persistent_config,
                                          USER_CONFIG_UNIT_DIR,
                                          "/etc/systemd/user",
@@ -64,7 +65,7 @@ index 7d158a8295..f9bd62b631 100644
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -808,7 +799,6 @@ char **generator_binary_paths(RuntimeScope scope) {
+@@ -805,7 +795,6 @@ char **generator_binary_paths(RuntimeScope scope) {
                  case RUNTIME_SCOPE_SYSTEM:
                          add = strv_new("/run/systemd/system-generators",
                                         "/etc/systemd/system-generators",
@@ -72,7 +73,7 @@ index 7d158a8295..f9bd62b631 100644
                                         SYSTEM_GENERATOR_DIR);
                          break;
  
-@@ -816,7 +806,6 @@ char **generator_binary_paths(RuntimeScope scope) {
+@@ -813,7 +802,6 @@ char **generator_binary_paths(RuntimeScope scope) {
                  case RUNTIME_SCOPE_USER:
                          add = strv_new("/run/systemd/user-generators",
                                         "/etc/systemd/user-generators",
@@ -80,7 +81,7 @@ index 7d158a8295..f9bd62b631 100644
                                         USER_GENERATOR_DIR);
                          break;
  
-@@ -855,14 +844,12 @@ char **env_generator_binary_paths(RuntimeScope runtime_scope) {
+@@ -852,14 +840,12 @@ char **env_generator_binary_paths(RuntimeScope runtime_scope) {
                  case RUNTIME_SCOPE_SYSTEM:
                          add = strv_new("/run/systemd/system-environment-generators",
                                          "/etc/systemd/system-environment-generators",
@@ -96,10 +97,10 @@ index 7d158a8295..f9bd62b631 100644
                          break;
  
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index 693433b34b..5932a21b5b 100644
+index f3b85b0190..8ae544b495 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
-@@ -38,10 +38,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
+@@ -43,10 +43,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
  systemd_user_conf_dir=${sysconfdir}/systemd/user
  systemduserconfdir=${systemd_user_conf_dir}
  
@@ -111,8 +112,8 @@ index 693433b34b..5932a21b5b 100644
 +systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/user:${systemduserunitdir}
  systemduserunitpath=${systemd_user_unit_path}
  
- systemd_system_generator_dir=${root_prefix}/lib/systemd/system-generators
-@@ -50,10 +50,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
+ systemd_system_generator_dir=${prefix}/lib/systemd/system-generators
+@@ -55,10 +55,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
  systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
  systemdusergeneratordir=${systemd_user_generator_dir}
  
@@ -124,4 +125,4 @@ index 693433b34b..5932a21b5b 100644
 +systemd_user_generator_path=/run/systemd/user-generators:/etc/systemd/user-generators:${systemd_user_generator_dir}
  systemdusergeneratorpath=${systemd_user_generator_path}
  
- systemd_sleep_dir=${root_prefix}/lib/systemd/system-sleep
+ systemd_sleep_dir=${prefix}/lib/systemd/system-sleep
diff --git a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
index 0a80d5ac4e83e..a0bcc6afaa12a 100644
--- a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 22ec6e79b1..771e8e7f16 100644
+index e61ebee253..22cc5cc843 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1559,7 +1559,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1562,7 +1562,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
index abc6c24dbf511..b350e36bc5c22 100644
--- a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -11,7 +11,7 @@ Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index 9ef45f8e75..99b1ec2e36 100644
+index e1d53f2395..a224e6dadc 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
 @@ -1053,6 +1053,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
@@ -35,7 +35,7 @@ index 9ef45f8e75..99b1ec2e36 100644
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index f544a73580..ce00c262cc 100644
+index 5d96237fae..9af35cd29c 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
 @@ -229,6 +229,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
@@ -69,10 +69,10 @@ index f544a73580..ce00c262cc 100644
  
          r = x11_context_verify_and_warn(&in, LOG_ERR, error);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index ad1d492d6b..331af34505 100644
+index c7be30f563..50f8aa8675 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -665,6 +665,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+@@ -659,6 +659,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
          if (r < 0)
                  return r;
  
@@ -83,7 +83,7 @@ index ad1d492d6b..331af34505 100644
          if (!timezone_is_valid(z, LOG_DEBUG))
                  return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
  
-@@ -743,6 +747,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+@@ -737,6 +741,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
          if (r < 0)
                  return r;
  
@@ -93,7 +93,7 @@ index ad1d492d6b..331af34505 100644
          if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -923,6 +930,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -917,6 +924,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
diff --git a/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 3150d97be2e1a..30178675f7f9b 100644
--- a/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -35,10 +35,10 @@ index e486474c44..5f373d0723 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 1db630003a..31744c3e68 100644
+index f9014dc560..3ee0363369 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1350,7 +1350,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1412,7 +1412,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,7 +47,7 @@ index 1db630003a..31744c3e68 100644
          if (!f)
                  return -errno;
  
-@@ -1391,7 +1391,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1453,7 +1453,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
  
          assert(ret);
  
@@ -56,7 +56,7 @@ index 1db630003a..31744c3e68 100644
          if (!f)
                  return -errno;
  
-@@ -1503,7 +1503,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1565,7 +1565,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 1db630003a..31744c3e68 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1563,7 +1563,7 @@ int get_timezone(char **ret) {
+@@ -1625,7 +1625,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* returns EINVAL if not a symlink */
  
@@ -75,10 +75,10 @@ index 1db630003a..31744c3e68 100644
                  return -EINVAL;
  
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index 1956ab3b13..9ef356f8af 100644
+index f77a5f6266..63bac85b29 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -630,7 +630,7 @@ static int process_timezone(int rfd) {
+@@ -632,7 +632,7 @@ static int process_timezone(int rfd) {
          if (isempty(arg_timezone))
                  return 0;
  
@@ -88,10 +88,10 @@ index 1956ab3b13..9ef356f8af 100644
          r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
          if (r < 0)
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 898a674631..c41a416e04 100644
+index e48ebe8342..41796f3358 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1924,8 +1924,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1845,8 +1845,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -103,10 +103,10 @@ index 898a674631..c41a416e04 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 331af34505..722c4b5b4f 100644
+index 50f8aa8675..aff156ab42 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -282,7 +282,7 @@ static int context_read_data(Context *c) {
+@@ -276,7 +276,7 @@ static int context_read_data(Context *c) {
  
          r = get_timezone(&t);
          if (r == -EINVAL)
@@ -115,7 +115,7 @@ index 331af34505..722c4b5b4f 100644
          else if (r < 0)
                  log_warning_errno(r, "Failed to get target of /etc/localtime: %m");
  
-@@ -306,7 +306,7 @@ static int context_write_data_timezone(Context *c) {
+@@ -300,7 +300,7 @@ static int context_write_data_timezone(Context *c) {
  
          if (isempty(c->zone) || streq(c->zone, "UTC")) {
  
@@ -124,7 +124,7 @@ index 331af34505..722c4b5b4f 100644
  
                          if (unlink("/etc/localtime") < 0 && errno != ENOENT)
                                  return -errno;
-@@ -314,9 +314,9 @@ static int context_write_data_timezone(Context *c) {
+@@ -308,9 +308,9 @@ static int context_write_data_timezone(Context *c) {
                          return 0;
                  }
  
diff --git a/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch b/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
deleted file mode 100644
index 7777ba7e42593..0000000000000
--- a/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Nikolay Amiantov <ab@fmap.me>
-Date: Thu, 7 Jul 2016 02:47:13 +0300
-Subject: [PATCH] Fix hwdb paths
-
-Patch by vcunat.
----
- src/libsystemd/sd-hwdb/hwdb-internal.h | 6 +-----
- 1 file changed, 1 insertion(+), 5 deletions(-)
-
-diff --git a/src/libsystemd/sd-hwdb/hwdb-internal.h b/src/libsystemd/sd-hwdb/hwdb-internal.h
-index 5302679a62..39e59a527f 100644
---- a/src/libsystemd/sd-hwdb/hwdb-internal.h
-+++ b/src/libsystemd/sd-hwdb/hwdb-internal.h
-@@ -83,8 +83,4 @@ struct trie_value_entry2_f {
- } _packed_;
- 
- #define hwdb_bin_paths                          \
--        "/etc/systemd/hwdb/hwdb.bin\0"          \
--        "/etc/udev/hwdb.bin\0"                  \
--        "/usr/lib/systemd/hwdb/hwdb.bin\0"      \
--        _CONF_PATHS_SPLIT_USR_NULSTR("systemd/hwdb/hwdb.bin") \
--        UDEVLIBEXECDIR "/hwdb.bin\0"
-+        "/etc/udev/hwdb.bin\0"
diff --git a/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
index c0f6afd7fc7ba..fe0dca1863dd1 100644
--- a/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -10,7 +10,7 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index d8db9d9d22..4601bb5431 100644
+index 32354027f1..1d231f1afc 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
 @@ -297,7 +297,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
diff --git a/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
index fa201126ae277..15fe403c28fc2 100644
--- a/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
@@ -12,16 +12,16 @@ files that I might have missed.
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/constants.h b/src/basic/constants.h
-index 3f96786da9..6e8fb40c08 100644
+index 6bb5f3c281..678d13737d 100644
 --- a/src/basic/constants.h
 +++ b/src/basic/constants.h
-@@ -74,13 +74,15 @@
+@@ -65,13 +65,15 @@
+         "/etc/" n "\0"                          \
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
-         "/usr/lib/" n "\0"                      \
--        _CONF_PATHS_SPLIT_USR_NULSTR(n)
-+        _CONF_PATHS_SPLIT_USR_NULSTR(n)         \
-+        ROOTPREFIX "/lib/" n "\0"
+-        "/usr/lib/" n "\0"
++        "/usr/lib/" n "\0"                      \
++        PREFIX "/lib/" n "\0"
  
  #define CONF_PATHS_USR(n)                       \
          "/etc/" n,                              \
@@ -29,7 +29,7 @@ index 3f96786da9..6e8fb40c08 100644
          "/usr/local/lib/" n,                    \
 -        "/usr/lib/" n
 +        "/usr/lib/" n,                          \
-+        ROOTPREFIX "/lib/" n
++        PREFIX "/lib/" n
  
  #define CONF_PATHS(n)                           \
-         CONF_PATHS_USR(n)                       \
+         CONF_PATHS_USR(n)
diff --git a/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
deleted file mode 100644
index b8f97308acfb7..0000000000000
--- a/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Franz Pletz <fpletz@fnordicwalking.de>
-Date: Sun, 11 Feb 2018 04:37:44 +0100
-Subject: [PATCH] build: don't create statedir and don't touch prefixdir
-
----
- meson.build | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index 395eca1943..082cd748bb 100644
---- a/meson.build
-+++ b/meson.build
-@@ -4707,9 +4707,6 @@ install_data('LICENSE.GPL2',
- install_subdir('LICENSES',
-                install_dir : docdir)
- 
--meson.add_install_script('sh', '-c', mkdir_p.format(systemdstatedir))
--meson.add_install_script('sh', '-c', 'touch $DESTDIR@0@'.format(prefixdir))
--
- ############################################################
- 
- # Ensure that changes to the docs/ directory do not break the
diff --git a/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index fde1e2b276c51..6f0b81a32aa77 100644
--- a/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -10,10 +10,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index 8395bb429d..14fbc85bb4 100644
+index b976b7d8cf..b1c02df6fd 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
-@@ -334,6 +334,7 @@ static void init_watchdog(void) {
+@@ -336,6 +336,7 @@ static void init_watchdog(void) {
  int main(int argc, char *argv[]) {
          static const char* const dirs[] = {
                  SYSTEM_SHUTDOWN_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index d91150cfc4901..a5ed574afa24d 100644
--- a/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -9,10 +9,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index de1f6c7ec1..d0cdebd80a 100644
+index 21af3e9e52..6d096e3c78 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -224,6 +224,7 @@ static int execute(
+@@ -215,6 +215,7 @@ static int execute(
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 13dec1070ffc0..55e556288c084 100644
--- a/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -10,21 +10,19 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 97175bee11..3839704901 100644
+index 6d943e967f..d4380aa7e3 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
-@@ -25,11 +25,11 @@
+@@ -25,9 +25,9 @@
  #  define PATH_SBIN_BIN_NULSTR(x) PATH_NORMAL_SBIN_BIN_NULSTR(x)
  #endif
  
--#define DEFAULT_PATH_NORMAL PATH_SBIN_BIN("/usr/local/") ":" PATH_SBIN_BIN("/usr/")
--#define DEFAULT_PATH_NORMAL_NULSTR PATH_SBIN_BIN_NULSTR("/usr/local/") PATH_SBIN_BIN_NULSTR("/usr/")
-+#define DEFAULT_PATH_NORMAL "@defaultPathNormal@"
-+#define DEFAULT_PATH_NORMAL_NULSTR "@defaultPathNormal@\0"
- #define DEFAULT_PATH_SPLIT_USR DEFAULT_PATH_NORMAL ":" PATH_SBIN_BIN("/")
- #define DEFAULT_PATH_SPLIT_USR_NULSTR DEFAULT_PATH_NORMAL_NULSTR PATH_SBIN_BIN_NULSTR("/")
+-#define DEFAULT_PATH PATH_SBIN_BIN("/usr/local/") ":" PATH_SBIN_BIN("/usr/")
+-#define DEFAULT_PATH_NULSTR PATH_SBIN_BIN_NULSTR("/usr/local/") PATH_SBIN_BIN_NULSTR("/usr/")
 -#define DEFAULT_PATH_COMPAT PATH_SPLIT_SBIN_BIN("/usr/local/") ":" PATH_SPLIT_SBIN_BIN("/usr/") ":" PATH_SPLIT_SBIN_BIN("/")
-+#define DEFAULT_PATH_COMPAT DEFAULT_PATH_NORMAL
++#define DEFAULT_PATH "@defaultPathNormal@"
++#define DEFAULT_PATH_NULSTR "@defaultPathNormal@\0"
++#define DEFAULT_PATH_COMPAT DEFAULT_PATH
  
- #if HAVE_SPLIT_USR
- #  define DEFAULT_PATH DEFAULT_PATH_SPLIT_USR
+ #ifndef DEFAULT_USER_PATH
+ #  define DEFAULT_USER_PATH DEFAULT_PATH
diff --git a/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
index d6640c87454a8..8bccf55390580 100644
--- a/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 771e8e7f16..acf3ead8d7 100644
+index 22cc5cc843..5dc7d4504f 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -3899,9 +3899,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3914,9 +3914,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
diff --git a/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
index 73b237a29602b..8b862918500eb 100644
--- a/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
+++ b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
@@ -13,21 +13,20 @@ so showing the taint isn't really helpful.
 
 See also: https://github.com/systemd/systemd/issues/24191
 ---
- src/core/manager.c | 4 ----
- 1 file changed, 4 deletions(-)
+ src/core/manager.c | 3 ---
+ 1 file changed, 3 deletions(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index acf3ead8d7..bdbab16829 100644
+index 5dc7d4504f..6208c9aa31 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4754,10 +4754,6 @@ char* manager_taint_string(const Manager *m) {
-         if (m->taint_usr)
-                 stage[n++] = "split-usr";
+@@ -4800,9 +4800,6 @@ char* manager_taint_string(const Manager *m) {
+         const char* stage[12] = {};
+         size_t n = 0;
  
 -        _cleanup_free_ char *usrbin = NULL;
 -        if (readlink_malloc("/bin", &usrbin) < 0 || !PATH_IN_SET(usrbin, "usr/bin", "/usr/bin"))
 -                stage[n++] = "unmerged-usr";
--
+ 
          if (access("/proc/cgroups", F_OK) < 0)
                  stage[n++] = "cgroups-missing";
- 
diff --git a/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch b/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
deleted file mode 100644
index 3fbfd7f10ab49..0000000000000
--- a/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Sun, 6 Dec 2020 08:34:19 +0100
-Subject: [PATCH] pkg-config: derive prefix from --prefix
-
-Point prefix to the one configured, instead of `/usr` `systemd` has limited
-support for making the pkgconfig prefix overridable, and interpolates those
-values later down.
-
-So we only need to patch this one value to get the correct paths.
-See systemd/systemd@bc4e6e27922a2873985ab9367d79fb099f70b505 for details.
-
-Co-Authored-By: Florian Klink <flokli@flokli.de>
----
- src/core/systemd.pc.in | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index 5932a21b5b..20bf8e316d 100644
---- a/src/core/systemd.pc.in
-+++ b/src/core/systemd.pc.in
-@@ -11,7 +11,7 @@
- # considered deprecated (though there is no plan to remove them). New names
- # shall have underscores.
- 
--prefix=/usr
-+prefix={{PREFIX}}
- root_prefix={{ROOTPREFIX_NOSLASH}}
- rootprefix=${root_prefix}
- sysconf_dir={{SYSCONF_DIR}}
diff --git a/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
index 6de01a0ae8020..768f57e1335b4 100644
--- a/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
+++ b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
@@ -27,15 +27,15 @@ filename_is_valid with path_is_valid.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index ae8a8bc073..c284b244f8 100644
+index 5e07b88a89..8dd7315009 100644
 --- a/src/shared/tpm2-util.c
 +++ b/src/shared/tpm2-util.c
-@@ -582,7 +582,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
+@@ -654,7 +654,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
                  fn = strjoina("libtss2-tcti-", driver, ".so.0");
  
                  /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
 -                if (!filename_is_valid(fn))
 +                if (!path_is_valid(fn))
-                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
+                         return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
  
                  context->tcti_dl = dlopen(fn, RTLD_NOW);
diff --git a/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
index dd9af6738c4e5..96cd420221e5f 100644
--- a/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+++ b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
@@ -30,10 +30,10 @@ are written into `$XDG_CONFIG_HOME/systemd/user`.
  1 file changed, 3 insertions(+)
 
 diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
-index e3f25d52d5..81c9c6f6b7 100644
+index 367afa20f7..5777154d01 100644
 --- a/src/systemctl/systemctl-edit.c
 +++ b/src/systemctl/systemctl-edit.c
-@@ -323,6 +323,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
+@@ -322,6 +322,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
          sd_bus *bus;
          int r;
  
diff --git a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
new file mode 100644
index 0000000000000..fd38aa9a2850c
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
@@ -0,0 +1,21 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: nikstur <nikstur@outlook.com>
+Date: Mon, 6 Nov 2023 22:51:38 +0100
+Subject: [PATCH] meson.build: do not create systemdstatedir
+
+---
+ meson.build | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 7419e2b0b0..c82a527976 100644
+--- a/meson.build
++++ b/meson.build
+@@ -2497,7 +2497,6 @@ install_data('LICENSE.GPL2',
+ install_subdir('LICENSES',
+                install_dir : docdir)
+ 
+-install_emptydir(systemdstatedir)
+ 
+ ############################################################
+ 
diff --git a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
index 68ae226448354..68ae226448354 100644
--- a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+++ b/pkgs/os-specific/linux/systemd/0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 39ec1a6eac176..c17aa380dd801 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -5,7 +5,6 @@
 , nixosTests
 , pkgsCross
 , fetchFromGitHub
-, fetchpatch
 , fetchzip
 , buildPackages
 , makeBinaryWrapper
@@ -20,7 +19,6 @@
 
   # glib is only used during tests (test-bus-gvariant, test-bus-marshal)
 , glib
-, substituteAll
 , gettext
 , python3Packages
 
@@ -52,7 +50,6 @@
 , intltool
 , bzip2
 , pcre2
-, e2fsprogs
 , elfutils
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
 , gnutls
@@ -68,6 +65,8 @@
 , libmicrohttpd
 , libfido2
 , p11-kit
+, libpwquality
+, qrencode
 
   # the (optional) BPF feature requires bpftool, libbpf, clang and llvm-strip to be available during build time.
   # Only libbpf should be a runtime dependency.
@@ -106,6 +105,7 @@
 , withHostnamed ? true
 , withHwdb ? true
 , withImportd ? !stdenv.hostPlatform.isMusl
+, withIptables ? true
 , withKmod ? true
 , withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
     && (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") # assumes hard floats
@@ -126,10 +126,11 @@
 , withNss ? !stdenv.hostPlatform.isMusl
 , withOomd ? true
 , withPam ? true
-, withPasswordQuality ? false
+, withPasswordQuality ? true
 , withPCRE2 ? true
 , withPolkit ? true
 , withPortabled ? !stdenv.hostPlatform.isMusl
+, withQrencode ? true
 , withRemote ? !stdenv.hostPlatform.isMusl
 , withResolved ? true
 , withShellCompletions ? true
@@ -141,6 +142,7 @@
 , withUkify ? false  # adds python to closure which is too much by default
 , withUserDb ? true
 , withUtmp ? !stdenv.hostPlatform.isMusl
+, withVmspawn ? true
   # tests assume too much system access for them to be feasible for us right now
 , withTests ? false
   # build only libudev and libsystemd
@@ -163,19 +165,17 @@ assert withHomed -> withPam;
 assert withUkify -> (withEfi && withBootloader);
 assert withRepart -> withCryptsetup;
 assert withBootloader -> withEfi;
-# passwdqc is not packaged in nixpkgs yet, if you want to fix this, please submit a PR.
-assert !withPasswordQuality;
 
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "254.6";
+  version = "255.2";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
-  releaseTimestamp = "1690536449";
+  releaseTimestamp = "1701895110";
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
@@ -186,7 +186,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    hash = "sha256-Ku24ecDeQt0t7A8/adR3Jm47QZ19+wdMPyJRzCxU4uU=";
+    hash = "sha256-8SfJY/pcH4yrDeJi0GfIUpetTbpMwyswvSu+RSfgqfY=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
@@ -201,21 +201,19 @@ stdenv.mkDerivation (finalAttrs: {
     ./0004-Add-some-NixOS-specific-unit-directories.patch
     ./0005-Get-rid-of-a-useless-message-in-user-sessions.patch
     ./0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
-    ./0007-Fix-hwdb-paths.patch
-    ./0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
-    ./0009-localectl-use-etc-X11-xkb-for-list-x11.patch
-    ./0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
-    ./0011-add-rootprefix-to-lookup-dir-paths.patch
-    ./0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
-    ./0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
-    ./0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
-    ./0015-pkg-config-derive-prefix-from-prefix.patch
-    ./0016-inherit-systemd-environment-when-calling-generators.patch
-    ./0017-core-don-t-taint-on-unmerged-usr.patch
-    ./0018-tpm2_context_init-fix-driver-name-checking.patch
-    ./0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+    ./0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+    ./0008-localectl-use-etc-X11-xkb-for-list-x11.patch
+    ./0009-add-rootprefix-to-lookup-dir-paths.patch
+    ./0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+    ./0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+    ./0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+    ./0013-inherit-systemd-environment-when-calling-generators.patch
+    ./0014-core-don-t-taint-on-unmerged-usr.patch
+    ./0015-tpm2_context_init-fix-driver-name-checking.patch
+    ./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+    ./0017-meson.build-do-not-create-systemdstatedir.patch
   ] ++ lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
-    ./0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+    ./0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
@@ -299,14 +297,17 @@ stdenv.mkDerivation (finalAttrs: {
           { name = "libbpf.so.1"; pkg = opt withLibBPF libbpf; }
           { name = "libbpf.so.0"; pkg = null; }
 
-          # We did never provide support for libxkbcommon & qrencode
+          # We did never provide support for libxkbcommon
           { name = "libxkbcommon.so.0"; pkg = null; }
-          { name = "libqrencode.so.4"; pkg = null; }
+
+          # qrencode
+          { name = "libqrencode.so.4"; pkg = opt withQrencode qrencode; }
           { name = "libqrencode.so.3"; pkg = null; }
 
-          # We did not provide libpwquality before so it is safe to disable it for
-          # now.
-          { name = "libpwquality.so.1"; pkg = null; }
+          # Password quality
+          # We currently do not package passwdqc, only libpwquality.
+          { name = "libpwquality.so.1"; pkg = opt withPasswordQuality libpwquality; }
+          { name = "libpasswdqc.so.1"; pkg = null; }
 
           # Only include cryptsetup if it is enabled. We might not be able to
           # provide it during "bootstrap" in e.g. the minimal systemd build as
@@ -338,8 +339,7 @@ stdenv.mkDerivation (finalAttrs: {
           # Support for PKCS#11 in systemd-cryptsetup, systemd-cryptenroll and systemd-homed
           { name = "libp11-kit.so.0"; pkg = opt (withHomed || withCryptsetup) p11-kit; }
 
-          # Password quality support
-          { name = "libpasswdqc.so.1"; pkg = opt withPasswordQuality null; }
+          { name = "libip4tc.so.2"; pkg = opt withIptables iptables; }
         ];
 
       patchDlOpen = dl:
@@ -434,14 +434,14 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional withApparmor libapparmor
     ++ lib.optional withAudit audit
     ++ lib.optional wantCurl (lib.getDev curl)
-    ++ lib.optionals withCompression [ bzip2 lz4 xz zstd ]
+    ++ lib.optionals withCompression [ zlib bzip2 lz4 xz zstd ]
     ++ lib.optional withCoredump elfutils
     ++ lib.optional withCryptsetup (lib.getDev cryptsetup.dev)
     ++ lib.optional withKexectools kexec-tools
     ++ lib.optional withKmod kmod
     ++ lib.optional withLibidn2 libidn2
     ++ lib.optional withLibseccomp libseccomp
-    ++ lib.optional withNetworkd iptables
+    ++ lib.optional withIptables iptables
     ++ lib.optional withPam pam
     ++ lib.optional withPCRE2 pcre2
     ++ lib.optional withSelinux libselinux
@@ -451,132 +451,167 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals withLibBPF [ libbpf ]
     ++ lib.optional withTpm2Tss tpm2-tss
     ++ lib.optional withUkify (python3Packages.python.withPackages (ps: with ps; [ pefile ]))
+    ++ lib.optionals withPasswordQuality [ libpwquality ]
+    ++ lib.optionals withQrencode [ qrencode ]
   ;
 
   mesonBuildType = "release";
 
   mesonFlags = [
-    "-Dversion-tag=${version}"
+    # Options
+
     # We bump this variable on every (major) version change to ensure
     # that we have known-good value for a timestamp that is in the (not so distant) past.
     # This serves as a lower bound for valid system timestamps during startup. Systemd will
     # reset the system timestamp if this date is +- 15 years from the system time.
     # See the systemd v250 release notes for further details:
     # https://github.com/systemd/systemd/blob/60e930fc3e6eb8a36fbc184773119eb8d2f30364/NEWS#L258-L266
-    "-Dtime-epoch=${releaseTimestamp}"
-
-    "-Dmode=release"
-    "-Ddbuspolicydir=${placeholder "out"}/share/dbus-1/system.d"
-    "-Ddbussessionservicedir=${placeholder "out"}/share/dbus-1/services"
-    "-Ddbussystemservicedir=${placeholder "out"}/share/dbus-1/system-services"
-    "-Dpam=${lib.boolToString withPam}"
-    "-Dpamconfdir=${placeholder "out"}/etc/pam.d"
-    "-Drootprefix=${placeholder "out"}"
-    "-Dpkgconfiglibdir=${placeholder "dev"}/lib/pkgconfig"
-    "-Dpkgconfigdatadir=${placeholder "dev"}/share/pkgconfig"
-    "-Dloadkeys-path=${kbd}/bin/loadkeys"
-    "-Dsetfont-path=${kbd}/bin/setfont"
-    "-Dtty-gid=3" # tty in NixOS has gid 3
-    "-Ddebug-shell=${bashInteractive}/bin/bash"
-    "-Dglib=${lib.boolToString withTests}"
-    # while we do not run tests we should also not build them. Removes about 600 targets
-    "-Dtests=false"
-    "-Dacl=${lib.boolToString withAcl}"
-    "-Danalyze=${lib.boolToString withAnalyze}"
-    "-Daudit=${lib.boolToString withAudit}"
-    "-Dgcrypt=${lib.boolToString wantGcrypt}"
-    "-Dimportd=${lib.boolToString withImportd}"
-    "-Dlz4=${lib.boolToString withCompression}"
-    "-Dhomed=${lib.boolToString withHomed}"
-    "-Dlogind=${lib.boolToString withLogind}"
-    "-Dlocaled=${lib.boolToString withLocaled}"
-    "-Dhostnamed=${lib.boolToString withHostnamed}"
-    "-Dmachined=${lib.boolToString withMachined}"
-    "-Dnetworkd=${lib.boolToString withNetworkd}"
-    "-Doomd=${lib.boolToString withOomd}"
-    "-Dpolkit=${lib.boolToString withPolkit}"
-    "-Dlibcryptsetup=${lib.boolToString withCryptsetup}"
-    "-Dportabled=${lib.boolToString withPortabled}"
-    "-Dhwdb=${lib.boolToString withHwdb}"
-    "-Dremote=${lib.boolToString withRemote}"
-    "-Dtimedated=${lib.boolToString withTimedated}"
-    "-Dtimesyncd=${lib.boolToString withTimesyncd}"
-    "-Duserdb=${lib.boolToString withUserDb}"
-    "-Dcoredump=${lib.boolToString withCoredump}"
-    "-Dfirstboot=false"
-    "-Dresolve=${lib.boolToString withResolved}"
-    "-Dsplit-usr=false"
-    "-Dlibcurl=${lib.boolToString wantCurl}"
-    "-Dlibidn=false"
-    "-Dlibidn2=${lib.boolToString withLibidn2}"
-    "-Dfirstboot=${lib.boolToString withFirstboot}"
-    "-Dsysusers=${lib.boolToString withSysusers}"
-    "-Drepart=${lib.boolToString withRepart}"
-    "-Dsysupdate=${lib.boolToString withSysupdate}"
-    "-Dquotacheck=false"
-    "-Dldconfig=false"
-    "-Dsmack=true"
-    "-Db_pie=true"
-    "-Dinstall-sysconfdir=false"
-    "-Dsbat-distro=nixos"
-    "-Dsbat-distro-summary=NixOS"
-    "-Dsbat-distro-url=https://nixos.org/"
-    "-Dsbat-distro-pkgname=${pname}"
-    "-Dsbat-distro-version=${version}"
-    /*
-      As of now, systemd doesn't allow runtime configuration of these values. So
-      the settings in /etc/login.defs have no effect on it. Many people think this
-      should be supported however, see
-      - https://github.com/systemd/systemd/issues/3855
-      - https://github.com/systemd/systemd/issues/4850
-      - https://github.com/systemd/systemd/issues/9769
-      - https://github.com/systemd/systemd/issues/9843
-      - https://github.com/systemd/systemd/issues/10184
-    */
-    "-Dsystem-uid-max=999"
-    "-Dsystem-gid-max=999"
-
-    "-Dsysvinit-path="
-    "-Dsysvrcnd-path="
-
-    "-Dsulogin-path=${util-linux.login}/bin/sulogin"
-    "-Dnologin-path=${util-linux.login}/bin/nologin"
-    "-Dmount-path=${lib.getOutput "mount" util-linux}/bin/mount"
-    "-Dumount-path=${lib.getOutput "mount" util-linux}/bin/umount"
-    "-Dcreate-log-dirs=false"
+    (lib.mesonOption "time-epoch" releaseTimestamp)
 
+    (lib.mesonOption "version-tag" version)
+    (lib.mesonOption "mode" "release")
+    (lib.mesonOption "tty-gid" "3") # tty in NixOS has gid 3
+    (lib.mesonOption "debug-shell" "${bashInteractive}/bin/bash")
+    (lib.mesonOption "pamconfdir" "${placeholder "out"}/etc/pam.d")
     # Use cgroupsv2. This is already the upstream default, but better be explicit.
-    "-Ddefault-hierarchy=unified"
-    # Upstream defaulted to disable manpages since they optimize for the much
-    # more frequent development builds
-    "-Dman=true"
-
-    "-Defi=${lib.boolToString withEfi}"
-    "-Dbootloader=${lib.boolToString withBootloader}"
+    (lib.mesonOption "default-hierarchy" "unified")
+    (lib.mesonOption "kmod-path" "${kmod}/bin/kmod")
+
+    # D-Bus
+    (lib.mesonOption "dbuspolicydir" "${placeholder "out"}/share/dbus-1/system.d")
+    (lib.mesonOption "dbussessionservicedir" "${placeholder "out"}/share/dbus-1/services")
+    (lib.mesonOption "dbussystemservicedir" "${placeholder "out"}/share/dbus-1/system-services")
+
+    # pkgconfig
+    (lib.mesonOption "pkgconfiglibdir" "${placeholder "dev"}/lib/pkgconfig")
+    (lib.mesonOption "pkgconfigdatadir" "${placeholder "dev"}/share/pkgconfig")
+
+    # Keyboard
+    (lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys")
+    (lib.mesonOption "setfont-path" "${kbd}/bin/setfont")
+
+    # SBAT
+    (lib.mesonOption "sbat-distro" "nixos")
+    (lib.mesonOption "sbat-distro-summary" "NixOS")
+    (lib.mesonOption "sbat-distro-url" "https://nixos.org/")
+    (lib.mesonOption "sbat-distro-pkgname" pname)
+    (lib.mesonOption "sbat-distro-version" version)
+
+    # Users
+    (lib.mesonOption "system-uid-max" "999")
+    (lib.mesonOption "system-gid-max" "999")
+
+    # SysVinit
+    (lib.mesonOption "sysvinit-path" "")
+    (lib.mesonOption "sysvrcnd-path" "")
+
+    # Login
+    (lib.mesonOption "sulogin-path" "${util-linux.login}/bin/sulogin")
+    (lib.mesonOption "nologin-path" "${util-linux.login}/bin/nologin")
+
+    # Mount
+    (lib.mesonOption "mount-path" "${lib.getOutput "mount" util-linux}/bin/mount")
+    (lib.mesonOption "umount-path" "${lib.getOutput "mount" util-linux}/bin/umount")
+
+
+    # Features
+
+    # Tests
+    (lib.mesonBool "tests" withTests)
+    (lib.mesonEnable "glib" withTests)
+    (lib.mesonEnable "dbus" withTests)
+
+    # Compression
+    (lib.mesonEnable "bzip2" withCompression)
+    (lib.mesonEnable "lz4" withCompression)
+    (lib.mesonEnable "xz" withCompression)
+    (lib.mesonEnable "zstd" withCompression)
+    (lib.mesonEnable "zlib" withCompression)
+
+    # NSS
+    (lib.mesonEnable "nss-mymachines" withNss)
+    (lib.mesonEnable "nss-resolve" withNss)
+    (lib.mesonBool "nss-myhostname" withNss)
+    (lib.mesonBool "nss-systemd" withNss)
+
+    # Cryptsetup
+    (lib.mesonEnable "libcryptsetup" withCryptsetup)
+    (lib.mesonEnable "libcryptsetup-plugins" withCryptsetup)
+    (lib.mesonEnable "p11kit" (withHomed || withCryptsetup))
+
+    # FIDO2
+    (lib.mesonEnable "libfido2" withFido2)
+    (lib.mesonEnable "openssl" withFido2)
+
+    # Password Quality
+    (lib.mesonEnable "pwquality" withPasswordQuality)
+    (lib.mesonEnable "passwdqc" false)
+
+    # Remote
+    (lib.mesonEnable "remote" withRemote)
+    (lib.mesonEnable "microhttpd" withRemote)
+
+    (lib.mesonEnable "pam" withPam)
+    (lib.mesonEnable "acl" withAcl)
+    (lib.mesonEnable "audit" withAudit)
+    (lib.mesonEnable "apparmor" withApparmor)
+    (lib.mesonEnable "gcrypt" wantGcrypt)
+    (lib.mesonEnable "importd" withImportd)
+    (lib.mesonEnable "homed" withHomed)
+    (lib.mesonEnable "polkit" withPolkit)
+    (lib.mesonEnable "elfutils" withCoredump)
+    (lib.mesonEnable "libcurl" wantCurl)
+    (lib.mesonEnable "libidn" false)
+    (lib.mesonEnable "libidn2" withLibidn2)
+    (lib.mesonEnable "libiptc" withIptables)
+    (lib.mesonEnable "repart" withRepart)
+    (lib.mesonEnable "sysupdate" withSysupdate)
+    (lib.mesonEnable "selinux" withSelinux)
+    (lib.mesonEnable "tpm2" withTpm2Tss)
+    (lib.mesonEnable "pcre2" withPCRE2)
+    (lib.mesonEnable "bpf-framework" withLibBPF)
+    (lib.mesonEnable "bootloader" withBootloader)
+    (lib.mesonEnable "ukify" withUkify)
+    (lib.mesonEnable "kmod" withKmod)
+    (lib.mesonEnable "qrencode" withQrencode)
+    (lib.mesonEnable "vmspawn" withVmspawn)
+    (lib.mesonEnable "xenctrl" false)
+    (lib.mesonEnable "gnutls" false)
+    (lib.mesonEnable "xkbcommon" false)
+    (lib.mesonEnable "man" true)
+
+    (lib.mesonBool "analyze" withAnalyze)
+    (lib.mesonBool "logind" withLogind)
+    (lib.mesonBool "localed" withLocaled)
+    (lib.mesonBool "hostnamed" withHostnamed)
+    (lib.mesonBool "machined" withMachined)
+    (lib.mesonBool "networkd" withNetworkd)
+    (lib.mesonBool "oomd" withOomd)
+    (lib.mesonBool "portabled" withPortabled)
+    (lib.mesonBool "hwdb" withHwdb)
+    (lib.mesonBool "timedated" withTimedated)
+    (lib.mesonBool "timesyncd" withTimesyncd)
+    (lib.mesonBool "userdb" withUserDb)
+    (lib.mesonBool "coredump" withCoredump)
+    (lib.mesonBool "firstboot" withFirstboot)
+    (lib.mesonBool "resolve" withResolved)
+    (lib.mesonBool "sysusers" withSysusers)
+    (lib.mesonBool "efi" withEfi)
+    (lib.mesonBool "utmp" withUtmp)
+    (lib.mesonBool "log-trace" withLogTrace)
+    (lib.mesonBool "quotacheck" false)
+    (lib.mesonBool "ldconfig" false)
+    (lib.mesonBool "install-sysconfdir" false)
+    (lib.mesonBool "create-log-dirs" false)
+    (lib.mesonBool "smack" true)
+    (lib.mesonBool "b_pie" true)
 
-    "-Dukify=${lib.boolToString withUkify}"
   ] ++ lib.optionals (withShellCompletions == false) [
-    "-Dbashcompletiondir=no"
-    "-Dzshcompletiondir=no"
-  ] ++ lib.optionals (!withNss) [
-    "-Dnss-myhostname=false"
-    "-Dnss-mymachines=false"
-    "-Dnss-resolve=false"
-    "-Dnss-systemd=false"
-  ] ++ lib.optionals withLibBPF [
-    "-Dbpf-framework=true"
-  ] ++ lib.optionals withTpm2Tss [
-    "-Dtpm2=true"
-  ] ++ lib.optionals (!withUtmp) [
-    "-Dutmp=false"
+    (lib.mesonOption "bashcompletiondir" "no")
+    (lib.mesonOption "zshcompletiondir" "no")
   ] ++ lib.optionals stdenv.hostPlatform.isMusl [
-    "-Dgshadow=false"
-    "-Didn=false"
-  ] ++ lib.optionals withKmod [
-    "-Dkmod=true"
-    "-Dkmod-path=${kmod}/bin/kmod"
-  ] ++ lib.optionals withLogTrace [
-    "-Dlog-trace=true"
+    (lib.mesonBool "gshadow" false)
+    (lib.mesonBool "idn" false)
   ];
   preConfigure =
     let
@@ -753,7 +788,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Wrap in the correct path for LUKS2 tokens.
   postFixup = lib.optionalString withCryptsetup ''
-    for f in lib/systemd/systemd-cryptsetup bin/systemd-cryptenroll; do
+    for f in bin/systemd-cryptsetup bin/systemd-cryptenroll; do
       # This needs to be in LD_LIBRARY_PATH because rpath on a binary is not propagated to libraries using dlopen, in this case `libcryptsetup.so`
       wrapProgram $out/$f --prefix LD_LIBRARY_PATH : ${placeholder "out"}/lib/cryptsetup
     done
@@ -763,7 +798,7 @@ stdenv.mkDerivation (finalAttrs: {
     # To cross compile a derivation that builds a UKI with ukify, we need to wrap
     # ukify with the correct binutils. When wrapping, no splicing happens so we
     # have to explicitly pull binutils from targetPackages.
-    wrapProgram $out/lib/systemd/ukify --prefix PATH : ${lib.makeBinPath [ targetPackages.stdenv.cc.bintools ] }:${placeholder "out"}/lib/systemd
+    wrapProgram $out/bin/ukify --prefix PATH : ${lib.makeBinPath [ targetPackages.stdenv.cc.bintools ] }:${placeholder "out"}/lib/systemd
   '';
 
   disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
diff --git a/pkgs/servers/firebird/default.nix b/pkgs/servers/firebird/default.nix
index e49f683da8777..7e7387819ab00 100644
--- a/pkgs/servers/firebird/default.nix
+++ b/pkgs/servers/firebird/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, libedit, autoreconfHook, zlib, unzip, libtommath, libtomcrypt, icu, superServer ? false }:
+{ lib, stdenv, fetchFromGitHub, libedit, autoreconfHook271, zlib, unzip, libtommath, libtomcrypt, icu, superServer ? false }:
 
 let base = {
   pname = "firebird";
@@ -13,7 +13,7 @@ let base = {
     maintainers = with maintainers; [ marcweber ];
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook271 ];
 
   buildInputs = [ libedit icu ];
 
diff --git a/pkgs/servers/nosql/redis/default.nix b/pkgs/servers/nosql/redis/default.nix
index c3ac0ebbf969b..923de9126b5f0 100644
--- a/pkgs/servers/nosql/redis/default.nix
+++ b/pkgs/servers/nosql/redis/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, lua, jemalloc, pkg-config, nixosTests
+{ lib, stdenv, fetchurl, fetchpatch, lua, jemalloc, pkg-config, nixosTests
 , tcl, which, ps, getconf
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
 # dependency ordering is broken at the moment when building with openssl
@@ -12,14 +12,21 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "redis";
-  version = "7.2.3";
+  version = "7.2.4";
 
   src = fetchurl {
     url = "https://download.redis.io/releases/redis-${finalAttrs.version}.tar.gz";
-    hash = "sha256-PisZbW603bnnQwiL/CkVzLtC1A9aij7djLaccW7DS+c=";
+    hash = "sha256-jRBMJqFUsp/WfWVotPN1ISISrUHgwsqj1mSA5429O1k=";
   };
 
-  patches = lib.optionals useSystemJemalloc [
+  patches = [
+    # fixes: make test [exception]: Executing test client: permission denied
+    # https://github.com/redis/redis/issues/12792
+    (fetchpatch {
+      url = "https://github.com/redis/redis/pull/12887.diff";
+      hash = "sha256-VZEMShW7Ckn5hLJHffQvE94Uly41WZW1bwvxny+Y3W8=";
+    })
+  ] ++ lib.optionals useSystemJemalloc [
     # use system jemalloc
     (fetchurl {
       url = "https://gitlab.archlinux.org/archlinux/packaging/packages/redis/-/raw/102cc861713c796756abd541bf341a4512eb06e6/redis-5.0-use-system-jemalloc.patch";
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index ec8df76f2c79a..efb233312b571 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -815,6 +815,8 @@ fi
 ######################################################################
 # Textual substitution functions.
 
+# only log once, due to max logging limit on hydra
+_substituteStream_has_warned_replace_deprecation=""
 
 substituteStream() {
     local var=$1
@@ -822,8 +824,24 @@ substituteStream() {
     shift 2
 
     while (( "$#" )); do
+        local is_required=1
+        local is_quiet=""
         case "$1" in
+            --replace-quiet)
+                is_quiet=1
+                ;&
             --replace)
+                # deprecated 2023-11-22
+                # this will either get removed, or switch to the behaviour of --replace-fail in the future
+                if [ -z "$_substituteStream_has_warned_replace_deprecation" ]; then
+                    echo "substituteStream(): WARNING: '--replace' is deprecated, use --replace-{fail,warn,quiet}. ($description)" >&2
+                    _substituteStream_has_warned_replace_deprecation=1
+                fi
+                ;&
+            --replace-warn)
+                is_required=""
+                ;&
+            --replace-fail)
                 pattern="$2"
                 replacement="$3"
                 shift 3
@@ -832,7 +850,14 @@ substituteStream() {
                 eval "$var"'=${'"$var"'//"$pattern"/"$replacement"}'
                 if [ "$pattern" != "$replacement" ]; then
                     if [ "${!var}" == "$savedvar" ]; then
-                        echo "substituteStream(): WARNING: pattern '$pattern' doesn't match anything in $description" >&2
+                        if [ -z "$is_required" ]; then
+                            if [ -z "$is_quiet" ]; then
+                                printf "substituteStream(): WARNING: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
+                            fi
+                        else
+                            printf "substituteStream(): ERROR: pattern %q doesn't match anything in %s\n" "$pattern" "$description" >&2
+                            return 1
+                        fi
                     fi
                 fi
                 ;;
diff --git a/pkgs/tools/graphics/spirv-cross/default.nix b/pkgs/tools/graphics/spirv-cross/default.nix
index cd7489be9aec7..73413c1aee4c1 100644
--- a/pkgs/tools/graphics/spirv-cross/default.nix
+++ b/pkgs/tools/graphics/spirv-cross/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-UIk5hihUPjXNzEeO2laS4dUef/rEExxXAZjMcftx+3A=";
+    hash = "sha256-Mhr3Yxm5MeLLQFmxWmtXLsq+ZcOE+KMs+3iiTYF8t30=";
   };
 
   nativeBuildInputs = [ cmake python3 ];
diff --git a/pkgs/tools/graphics/vulkan-extension-layer/default.nix b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
index dae55225a0b3f..336c31811aa21 100644
--- a/pkgs/tools/graphics/vulkan-extension-layer/default.nix
+++ b/pkgs/tools/graphics/vulkan-extension-layer/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-extension-layer";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-rSKPTeTDOz6IeJGRt9aIu1VH8VfVzXNYZfjdiSXEJxg=";
+    hash = "sha256-zQycF3yKoa54KBUIuG1BqFGB00yc6oZQzdcDel2rXN0=";
   };
 
   nativeBuildInputs = [ cmake pkg-config jq ];
diff --git a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
index 0db3cf1597713..778b136558869 100644
--- a/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools-lunarg/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools-lunarg";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
    owner = "LunarG";
    repo = "VulkanTools";
    rev = "vulkan-sdk-${version}";
-   hash = "sha256-2ZUD+RBsl35QV3250JOPCIoJb4sJcBsiRE4SZaS6ROs=";
+   hash = "sha256-MEQX90HL90jyVBWWcvOF7QLzm1+fNE5TW3MWdK4w53M=";
  };
 
   nativeBuildInputs = [ cmake python3 jq which pkg-config libsForQt5.qt5.wrapQtAppsHook ];
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index d590ac7d340c6..087326f71322a 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -14,6 +14,7 @@
 , libXrandr
 , vulkan-headers
 , vulkan-loader
+, vulkan-volk
 , wayland
 , wayland-protocols
 , moltenvk
@@ -23,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.3.268.0";
+  version = "1.3.275.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-IsMxiAR4ak6kC3BNYhtI+JVNkEka4ZceSElxk39THXg=";
+    hash = "sha256-0sAwO8gXzpMst+7l7LS1oiDLo9E6otDktCti+v8jwDw=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +43,7 @@ stdenv.mkDerivation rec {
     glslang
     vulkan-headers
     vulkan-loader
+    vulkan-volk
   ] ++ lib.optionals (!stdenv.isDarwin) [
     libffi
     libX11
diff --git a/pkgs/tools/inputmethods/m17n-lib/default.nix b/pkgs/tools/inputmethods/m17n-lib/default.nix
index c526f6a844d7f..ca586a449703e 100644
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -7,11 +7,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "m17n-lib";
-  version = "1.8.2";
+  version = "1.8.4";
 
   src = fetchurl {
     url = "https://download.savannah.gnu.org/releases/m17n/m17n-lib-${version}.tar.gz";
-    hash = "sha256-5bA0SvnxFdlJV6P5ud68T45nG2n4wf1eC2iKeU16J/I=";
+    hash = "sha256-xqJYLG5PKowueihE+lx+s2Oq0lOLBS8gPHEGSd1CHMg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 01208f0a121ca..d7d78cea11b71 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -15,6 +15,7 @@
   ), libkrb5
 , http2Support ? true, nghttp2
 , http3Support ? false, nghttp3, ngtcp2
+, websocketSupport ? false
 , idnSupport ? false, libidn2
 , ldapSupport ? false, openldap
 , opensslSupport ? zlibSupport, openssl
@@ -47,14 +48,14 @@ assert !((lib.count (x: x) [ gnutlsSupport opensslSupport wolfsslSupport rustlsS
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.4.0";
+  version = "8.5.0";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/curl-${finalAttrs.version}.tar.xz"
       "https://github.com/curl/curl/releases/download/curl-${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-FsYqnErw9wPSi9pte783ukcFWtNBTXDexj4uYzbyqC0=";
+    hash = "sha256-QquNueINgpCjtjPn+7POwV2zTfZf0QFe+KweRyN1Dus=";
   };
 
   patches = [
@@ -111,6 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.enableFeature c-aresSupport "ares")
       (lib.enableFeature ldapSupport "ldap")
       (lib.enableFeature ldapSupport "ldaps")
+      (lib.enableFeature websocketSupport "websockets")
       # --with-ca-fallback is only supported for openssl and gnutls https://github.com/curl/curl/blame/curl-8_0_1/acinclude.m4#L1640
       (lib.withFeature (opensslSupport || gnutlsSupport) "ca-fallback")
       (lib.withFeature http3Support "nghttp3")
diff --git a/pkgs/tools/networking/inetutils/default.nix b/pkgs/tools/networking/inetutils/default.nix
index 47533f13cb373..cbd327b07297d 100644
--- a/pkgs/tools/networking/inetutils/default.nix
+++ b/pkgs/tools/networking/inetutils/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , ncurses
 , perl
 , help2man
@@ -12,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "inetutils";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-F4nWsbGlff4qere1M+6fXf2cv1tZuxuzwmEu0I0PaLI=";
+    hash = "sha256-h2l9YKMeELXLhqnwZR4ex77pgyDQSMBzlDGqw9V2T7Y=";
   };
 
   outputs = ["out" "apparmor"];
@@ -24,11 +23,6 @@ stdenv.mkDerivation rec {
   patches = [
     # https://git.congatec.com/yocto/meta-openembedded/commit/3402bfac6b595c622e4590a8ff5eaaa854e2a2a3
     ./inetutils-1_9-PATH_PROCNET_DEV.patch
-    (fetchpatch {
-      name = "CVE-2023-40303.patch";
-      url = "https://git.savannah.gnu.org/cgit/inetutils.git/patch/?id=e4e65c03f4c11292a3e40ef72ca3f194c8bffdd6";
-      hash = "sha256-I5skN537owfpFpAZr4vDKPHuERI6+oq5/hFW2RQeUxI=";
-    })
   ];
 
   strictDeps = true;
diff --git a/pkgs/tools/networking/modemmanager/default.nix b/pkgs/tools/networking/modemmanager/default.nix
index d66c277f1dacd..dd36f4b7465af 100644
--- a/pkgs/tools/networking/modemmanager/default.nix
+++ b/pkgs/tools/networking/modemmanager/default.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation rec {
   pname = "modemmanager";
-  version = "1.20.6";
+  version = "1.22.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mobile-broadband";
     repo = "ModemManager";
     rev = version;
-    hash = "sha256-/A4WTsUQVeZDi5ei6qBvqoWYLKdRcZaYZU8/qWOPrvM=";
+    hash = "sha256-/D9b2rCCUhpDCUfSNAWR65+3EyUywzFdH1R17eSKRDo=";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/tun2socks/default.nix b/pkgs/tools/networking/tun2socks/default.nix
index 9296b0df0068e..37019a38b348b 100644
--- a/pkgs/tools/networking/tun2socks/default.nix
+++ b/pkgs/tools/networking/tun2socks/default.nix
@@ -17,7 +17,7 @@ buildGoModule rec {
   vendorHash = "sha256-zeiOcn33PnyoseYb0wynkn7MfGp3rHEYBStY98C6aR8=";
 
   ldflags = [
-    "-w" "-s" "-buildid="
+    "-w" "-s"
     "-X github.com/xjasonlyu/tun2socks/v2/internal/version.Version=v${version}"
     "-X github.com/xjasonlyu/tun2socks/v2/internal/version.GitCommit=v${version}"
   ];
diff --git a/pkgs/tools/networking/v2ray/default.nix b/pkgs/tools/networking/v2ray/default.nix
index 1da2adba9d542..4d783fb47345f 100644
--- a/pkgs/tools/networking/v2ray/default.nix
+++ b/pkgs/tools/networking/v2ray/default.nix
@@ -19,7 +19,7 @@ buildGoModule rec {
   # https://github.com/Mic92/nix-update/pull/95
   vendorHash = "sha256-ZBvHu4BEmQi6PQwRHuVwx/6X4gBqlRR44OktKRBGcs4=";
 
-  ldflags = [ "-s" "-w" "-buildid=" ];
+  ldflags = [ "-s" "-w" ];
 
   subPackages = [ "main" ];
 
diff --git a/pkgs/tools/networking/xray/default.nix b/pkgs/tools/networking/xray/default.nix
index bb317055dc041..683cd9e484479 100644
--- a/pkgs/tools/networking/xray/default.nix
+++ b/pkgs/tools/networking/xray/default.nix
@@ -26,7 +26,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  ldflags = [ "-s" "-w" "-buildid=" ];
+  ldflags = [ "-s" "-w" ];
   subPackages = [ "main" ];
 
    installPhase = ''
diff --git a/pkgs/tools/security/gnupg/24-revert-rfc4880bis-defaults.patch b/pkgs/tools/security/gnupg/24-revert-rfc4880bis-defaults.patch
new file mode 100644
index 0000000000000..8bc65ede79c06
--- /dev/null
+++ b/pkgs/tools/security/gnupg/24-revert-rfc4880bis-defaults.patch
@@ -0,0 +1,200 @@
+From 1e4f1550996334d2a631a5d769e937d29ace47bb Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Thu, 9 Feb 2023 16:38:58 +0100
+Subject: [PATCH gnupg] Revert the introduction of the RFC4880bis draft into
+ defaults
+
+This reverts commit 4583f4fe2 (gpg: Merge --rfc4880bis features into
+--gnupg, 2022-10-31).
+---
+ g10/gpg.c    | 35 ++++++++++++++++++++++++++++++++---
+ g10/keygen.c | 30 ++++++++++++++++++------------
+ 2 files changed, 50 insertions(+), 15 deletions(-)
+
+diff --git a/g10/gpg.c b/g10/gpg.c
+index dcab0a11a..796888013 100644
+--- a/g10/gpg.c
++++ b/g10/gpg.c
+@@ -247,6 +247,7 @@ enum cmd_and_opt_values
+     oGnuPG,
+     oRFC2440,
+     oRFC4880,
++    oRFC4880bis,
+     oOpenPGP,
+     oPGP7,
+     oPGP8,
+@@ -636,6 +637,7 @@ static gpgrt_opt_t opts[] = {
+   ARGPARSE_s_n (oGnuPG, "no-pgp8", "@"),
+   ARGPARSE_s_n (oRFC2440, "rfc2440", "@"),
+   ARGPARSE_s_n (oRFC4880, "rfc4880", "@"),
++  ARGPARSE_s_n (oRFC4880bis, "rfc4880bis", "@"),
+   ARGPARSE_s_n (oOpenPGP, "openpgp", N_("use strict OpenPGP behavior")),
+   ARGPARSE_s_n (oPGP7, "pgp6", "@"),
+   ARGPARSE_s_n (oPGP7, "pgp7", "@"),
+@@ -978,7 +980,6 @@ static gpgrt_opt_t opts[] = {
+   ARGPARSE_s_n (oNoop, "no-allow-multiple-messages", "@"),
+   ARGPARSE_s_s (oNoop, "aead-algo", "@"),
+   ARGPARSE_s_s (oNoop, "personal-aead-preferences","@"),
+-  ARGPARSE_s_n (oNoop, "rfc4880bis", "@"),
+   ARGPARSE_s_n (oNoop, "override-compliance-check", "@"),
+ 
+ 
+@@ -2227,7 +2228,7 @@ static struct gnupg_compliance_option compliance_options[] =
+   {
+     { "gnupg",      oGnuPG },
+     { "openpgp",    oOpenPGP },
+-    { "rfc4880bis", oGnuPG },
++    { "rfc4880bis", oRFC4880bis },
+     { "rfc4880",    oRFC4880 },
+     { "rfc2440",    oRFC2440 },
+     { "pgp6",       oPGP7 },
+@@ -2243,8 +2244,28 @@ static struct gnupg_compliance_option compliance_options[] =
+ static void
+ set_compliance_option (enum cmd_and_opt_values option)
+ {
++  opt.flags.rfc4880bis = 0;  /* Clear because it is initially set.  */
++
+   switch (option)
+     {
++    case oRFC4880bis:
++      opt.flags.rfc4880bis = 1;
++      opt.compliance = CO_RFC4880;
++      opt.flags.dsa2 = 1;
++      opt.flags.require_cross_cert = 1;
++      opt.rfc2440_text = 0;
++      opt.allow_non_selfsigned_uid = 1;
++      opt.allow_freeform_uid = 1;
++      opt.escape_from = 1;
++      opt.not_dash_escaped = 0;
++      opt.def_cipher_algo = 0;
++      opt.def_digest_algo = 0;
++      opt.cert_digest_algo = 0;
++      opt.compress_algo = -1;
++      opt.s2k_mode = 3; /* iterated+salted */
++      opt.s2k_digest_algo = DIGEST_ALGO_SHA256;
++      opt.s2k_cipher_algo = CIPHER_ALGO_AES256;
++      break;
+     case oOpenPGP:
+     case oRFC4880:
+       /* This is effectively the same as RFC2440, but with
+@@ -2288,6 +2309,7 @@ set_compliance_option (enum cmd_and_opt_values option)
+     case oPGP8:  opt.compliance = CO_PGP8;  break;
+     case oGnuPG:
+       opt.compliance = CO_GNUPG;
++      opt.flags.rfc4880bis = 1;
+       break;
+ 
+     case oDE_VS:
+@@ -2491,6 +2513,7 @@ main (int argc, char **argv)
+     opt.emit_version = 0;
+     opt.weak_digests = NULL;
+     opt.compliance = CO_GNUPG;
++    opt.flags.rfc4880bis = 1;
+ 
+     /* Check special options given on the command line.  */
+     orig_argc = argc;
+@@ -3033,6 +3056,7 @@ main (int argc, char **argv)
+           case oOpenPGP:
+           case oRFC2440:
+           case oRFC4880:
++          case oRFC4880bis:
+           case oPGP7:
+           case oPGP8:
+           case oGnuPG:
+@@ -3862,6 +3886,11 @@ main (int argc, char **argv)
+     if( may_coredump && !opt.quiet )
+ 	log_info(_("WARNING: program may create a core file!\n"));
+ 
++    if (!opt.flags.rfc4880bis)
++      {
++        opt.mimemode = 0; /* This will use text mode instead.  */
++      }
++
+     if (eyes_only) {
+       if (opt.set_filename)
+ 	  log_info(_("WARNING: %s overrides %s\n"),
+@@ -4078,7 +4107,7 @@ main (int argc, char **argv)
+     /* Check our chosen algorithms against the list of legal
+        algorithms. */
+ 
+-    if(!GNUPG)
++    if(!GNUPG && !opt.flags.rfc4880bis)
+       {
+ 	const char *badalg=NULL;
+ 	preftype_t badtype=PREFTYPE_NONE;
+diff --git a/g10/keygen.c b/g10/keygen.c
+index a2cfe3ccf..2a1dd1f81 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -404,7 +404,7 @@ keygen_set_std_prefs (const char *string,int personal)
+ 	      strcat(dummy_string,"S7 ");
+ 	    strcat(dummy_string,"S2 "); /* 3DES */
+ 
+-            if (!openpgp_aead_test_algo (AEAD_ALGO_OCB))
++            if (opt.flags.rfc4880bis && !openpgp_aead_test_algo (AEAD_ALGO_OCB))
+ 	      strcat(dummy_string,"A2 ");
+ 
+             if (personal)
+@@ -889,7 +889,7 @@ keygen_upd_std_prefs (PKT_signature *sig, void *opaque)
+   /* Make sure that the MDC feature flag is set if needed.  */
+   add_feature_mdc (sig,mdc_available);
+   add_feature_aead (sig, aead_available);
+-  add_feature_v5 (sig, 1);
++  add_feature_v5 (sig, opt.flags.rfc4880bis);
+   add_keyserver_modify (sig,ks_modify);
+   keygen_add_keyserver_url(sig,NULL);
+ 
+@@ -3382,7 +3382,10 @@ parse_key_parameter_part (ctrl_t ctrl,
+                 }
+             }
+           else if (!ascii_strcasecmp (s, "v5"))
+-            keyversion = 5;
++            {
++              if (opt.flags.rfc4880bis)
++                keyversion = 5;
++            }
+           else if (!ascii_strcasecmp (s, "v4"))
+             keyversion = 4;
+           else
+@@ -3641,7 +3644,7 @@ parse_key_parameter_part (ctrl_t ctrl,
+  *   ecdsa := Use algorithm ECDSA.
+  *   eddsa := Use algorithm EdDSA.
+  *   ecdh  := Use algorithm ECDH.
+- *   v5    := Create version 5 key
++ *   v5    := Create version 5 key (requires option --rfc4880bis)
+  *
+  * There are several defaults and fallbacks depending on the
+  * algorithm.  PART can be used to select which part of STRING is
+@@ -4513,9 +4516,9 @@ read_parameter_file (ctrl_t ctrl, const char *fname )
+ 	    }
+ 	}
+ 
+-        if ((keywords[i].key == pVERSION
+-             || keywords[i].key == pSUBVERSION))
+-          ; /* Ignore version.  */
++        if (!opt.flags.rfc4880bis && (keywords[i].key == pVERSION
++                                      || keywords[i].key == pSUBVERSION))
++          ; /* Ignore version unless --rfc4880bis is active.  */
+         else
+           {
+             r = xmalloc_clear( sizeof *r + strlen( value ) );
+@@ -4610,11 +4613,14 @@ quickgen_set_para (struct para_data_s *para, int for_subkey,
+       para = r;
+     }
+ 
+-  r = xmalloc_clear (sizeof *r + 20);
+-  r->key = for_subkey? pSUBVERSION : pVERSION;
+-  snprintf (r->u.value, 20, "%d", version);
+-  r->next = para;
+-  para = r;
++  if (opt.flags.rfc4880bis)
++    {
++      r = xmalloc_clear (sizeof *r + 20);
++      r->key = for_subkey? pSUBVERSION : pVERSION;
++      snprintf (r->u.value, 20, "%d", version);
++      r->next = para;
++      para = r;
++    }
+ 
+   if (keytime)
+     {
diff --git a/pkgs/tools/security/gnupg/24.nix b/pkgs/tools/security/gnupg/24.nix
index 2f5c6e2ce428e..49beed63b53a7 100644
--- a/pkgs/tools/security/gnupg/24.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@@ -13,11 +13,11 @@ assert guiSupport -> enableMinimal == false;
 
 stdenv.mkDerivation rec {
   pname = "gnupg";
-  version = "2.4.1";
+  version = "2.4.3";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
-    hash = "sha256-drceWutEO/2RDOnLyCgbYXyDQWh6+2e65FWHeXK1neg=";
+    hash = "sha256-onGubXMvb02AwlitnuiN2clMj9wzw+RTKMTXwSa9IZ0=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
     ./tests-add-test-cases-for-import-without-uid.patch
     ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
     ./24-allow-import-of-previously-known-keys-even-without-UI.patch
+    ./24-revert-rfc4880bis-defaults.patch
     # Patch for DoS vuln from https://seclists.org/oss-sec/2022/q3/27
     ./v3-0001-Disallow-compressed-signatures-and-certificates.patch
   ];
diff --git a/pkgs/tools/security/slsa-verifier/default.nix b/pkgs/tools/security/slsa-verifier/default.nix
index d02b574b1563b..5a6ab18a49ec5 100644
--- a/pkgs/tools/security/slsa-verifier/default.nix
+++ b/pkgs/tools/security/slsa-verifier/default.nix
@@ -27,7 +27,6 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-buildid="
     "-X sigs.k8s.io/release-utils/version.gitVersion=${version}"
   ];
 
diff --git a/pkgs/tools/security/step-ca/default.nix b/pkgs/tools/security/step-ca/default.nix
index 5c1463ec117b8..6bdbfa02d62a3 100644
--- a/pkgs/tools/security/step-ca/default.nix
+++ b/pkgs/tools/security/step-ca/default.nix
@@ -23,10 +23,6 @@ buildGoModule rec {
 
   vendorHash = "sha256-AXMMpzXEhdKSGeVg/KK2NEgalxIXP6DUTcoxOQVqow4=";
 
-  ldflags = [
-    "-buildid="
-  ];
-
   nativeBuildInputs = lib.optionals hsmSupport [
     pkg-config
   ];
diff --git a/pkgs/tools/text/groff/site.tmac b/pkgs/tools/text/groff/site.tmac
index 07923f1200095..6f0f18dea6d5f 100644
--- a/pkgs/tools/text/groff/site.tmac
+++ b/pkgs/tools/text/groff/site.tmac
@@ -1,13 +1,26 @@
 .
 .if n \{\
-.  \" Character translations for non-keyboard
-.  \" characters - to make them searchable
+.  \" With groff 1.23.0 "[t]he 'utf8' output device now maps the input
+.  \" characters '^' (caret, circumflex accent, or 'hat') and '~' (tilde)
+.  \" to U+02C6 (modifier letter circumflex accent) and U+02DC (small tilde),
+.  \" respectively, for consistency with groff's other output devices.
+.  \" This change is expected to expose glyph usage errors in man pages.
+.  \" See [http://git.savannah.gnu.org/cgit/groff.git/tree/PROBLEMS] for
+.  \" a recipe that will conceal these errors"
+.  \" -- https://lists.gnu.org/archive/html/groff/2023-07/msg00051.html
+.  \"
+.  \" Conceal glyph usage errors in man pages with the following
+.  \" character translations for non-keyboard characters to make them searchable.
 .  if '\*[.T]'utf8' \{\
 .    char \- \N'45'
 .    char - \N'45'
-.    char ' \N'39'
-.    char \' \N'39'
+.    char \' \[aq]
+.    char ' \[aq]
+.    char ` \[ga]
+.    char ^ \[ha]
+.    char ~ \[ti]
 .  \}
+.\}
 .
 .ds doc-default-operating-system Nixpkgs
 .ds doc-volume-operating-system Nixpkgs
diff --git a/pkgs/tools/video/rav1e/default.nix b/pkgs/tools/video/rav1e/default.nix
index 859e523dfa65d..406276977c520 100644
--- a/pkgs/tools/video/rav1e/default.nix
+++ b/pkgs/tools/video/rav1e/default.nix
@@ -15,14 +15,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rav1e";
-  version = "0.6.6";
+  version = "0.7.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-urYMT1sJUMBj1L/2Hi+hcYbWbi0ScSls0pm9gLj9H3o=";
+    sha256 = "sha256-Db7qb7HBAy6lniIiN07iEzURmbfNtuhmgJRv7OUagUM=";
   };
 
-  cargoHash = "sha256-qQfEpynhlIEKU1Ptq/jM1Wdtn+BVCZT1lmou2S1GL4I=";
+  cargoHash = "sha256-VyQ6n2kIJ7OjK6Xlf0T0GNsBvgESRETzKZDZzAn8ZuY=";
 
   depsBuildBuild = [ pkg-config ];
 
@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage rec {
   # Darwin uses `llvm-strip`, which results in link errors when using `-x` to strip the asm library
   # and linking it with cctools ld64.
   postPatch = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
-    substituteInPlace build.rs --replace 'cmd.arg("-x")' 'cmd.arg("-S")'
+    substituteInPlace build.rs --replace-fail '.arg("-x")' '.arg("-S")'
   '';
 
   checkType = "debug";
diff --git a/pkgs/tools/virtualization/mkosi/default.nix b/pkgs/tools/virtualization/mkosi/default.nix
index cf3a934b0bef8..12f752432e4d2 100644
--- a/pkgs/tools/virtualization/mkosi/default.nix
+++ b/pkgs/tools/virtualization/mkosi/default.nix
@@ -30,20 +30,7 @@
 let
   # For systemd features used by mkosi, see
   # https://github.com/systemd/mkosi/blob/19bb5e274d9a9c23891905c4bcbb8f68955a701d/action.yaml#L64-L72
-  systemdForMkosi = (systemd.overrideAttrs (oldAttrs: {
-    patches = oldAttrs.patches ++ [
-      # Enable setting a deterministic verity seed for systemd-repart. Remove when upgrading to systemd 255.
-      (fetchpatch {
-        url = "https://github.com/systemd/systemd/commit/81e04781106e3db24e9cf63c1d5fdd8215dc3f42.patch";
-        hash = "sha256-KO3poIsvdeepPmXWQXNaJJCPpmBb4sVmO+ur4om9f5k=";
-      })
-      # repart: make sure rewinddir() is called before readdir() when performing rm -rf. Remove when upgrading to systemd 255.
-      (fetchpatch {
-        url = "https://github.com/systemd/systemd/commit/6bbb893b90e2dcb05fb310ba4608f9c9dc587845.patch";
-        hash = "sha256-A6cF2QAeYHGc0u0V1JMxIcV5shzf5x3Q6K+blZOWSn4=";
-      })
-    ];
-  })).override {
+  systemdForMkosi = systemd.override {
     withRepart = true;
     withBootloader = true;
     withSysusers = true;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 98c3c66e780f8..0b190ebb9a629 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -24,7 +24,7 @@ let
   # to appear while listing all the packages available.
   removeRecurseForDerivations = alias: with lib;
     if alias.recurseForDerivations or false
-    then removeAttrs alias ["recurseForDerivations"]
+    then removeAttrs alias [ "recurseForDerivations" ]
     else alias;
 
   # Disabling distribution prevents top-level aliases for non-recursed package
@@ -41,10 +41,11 @@ let
     else alias;
 
   mapAliases = aliases:
-    lib.mapAttrs (n: alias:
-      removeDistribute
-        (removeRecurseForDerivations
-          (checkInPkgs n alias)))
+    lib.mapAttrs
+      (n: alias:
+        removeDistribute
+          (removeRecurseForDerivations
+            (checkInPkgs n alias)))
       aliases;
 in
 
@@ -59,7 +60,7 @@ mapAliases ({
   a4term = a4; # Added 2023-10-06
   aether = throw "aether has been removed from nixpkgs; upstream unmaintained, security issues"; # Added 2023-10-03
   airfield = throw "airfield has been removed due to being unmaintained"; # Added 2023-05-19
-  alertmanager-bot = throw "alertmanager-bot is broken and has been archived by upstream" ; # Added 2023-07-28
+  alertmanager-bot = throw "alertmanager-bot is broken and has been archived by upstream"; # Added 2023-07-28
   alsa-project = throw "alsa-project was removed and its sub-attributes were promoted to top-level."; # Added 2023-11-12
   alsaLib = alsa-lib; # Added 2021-06-09
   alsaOss = alsa-oss; # Added 2021-06-10
@@ -102,7 +103,8 @@ mapAliases ({
   bitwig-studio2 = throw "bitwig-studio2 has been removed, you can upgrade to 'bitwig-studio'"; # Added 2023-01-03
   blender-with-packages = args:
     lib.warn "blender-with-packages is deprecated in favor of blender.withPackages, e.g. `blender.withPackages(ps: [ ps.foobar ])`"
-    (blender.withPackages (_: args.packages)).overrideAttrs (lib.optionalAttrs (args ? name) { pname = "blender-" + args.name; }); # Added 2023-10-30
+      (blender.withPackages (_: args.packages)).overrideAttrs
+      (lib.optionalAttrs (args ? name) { pname = "blender-" + args.name; }); # Added 2023-10-30
   bluezFull = throw "'bluezFull' has been renamed to/replaced by 'bluez'"; # Converted to throw 2023-09-10
   bookletimposer = throw "bookletimposer has been removed from nixpkgs; upstream unmaintained and broke with pypdf3"; # Added 2024-01-01
   boost168 = throw "boost168 has been deprecated in favor of the latest version"; # Added 2023-06-08
@@ -188,10 +190,10 @@ mapAliases ({
   clang16Stdenv = lowPrio llvmPackages_16.stdenv;
   clang17Stdenv = lowPrio llvmPackages_17.stdenv;
 
-  clang-tools_6  = throw "clang-tools_6 has been removed from nixpkgs"; # Added 2024-01-08
-  clang-tools_7  = throw "clang-tools_7 has been removed from nixpkgs"; # Added 2023-11-19
-  clang_6  = throw "clang_6 has been removed from nixpkgs"; # Added 2024-01-08
-  clang_7  = throw "clang_7 has been removed from nixpkgs"; # Added 2023-11-19
+  clang-tools_6 = throw "clang-tools_6 has been removed from nixpkgs"; # Added 2024-01-08
+  clang-tools_7 = throw "clang-tools_7 has been removed from nixpkgs"; # Added 2023-11-19
+  clang_6 = throw "clang_6 has been removed from nixpkgs"; # Added 2024-01-08
+  clang_7 = throw "clang_7 has been removed from nixpkgs"; # Added 2023-11-19
 
   ### D ###
 
@@ -223,8 +225,8 @@ mapAliases ({
   dotnet-sdk_3 = dotnetCorePackages.sdk_3_1; # Added 2020-01-19
   dotnet-sdk_5 = dotnetCorePackages.sdk_5_0; # Added 2020-09-11
   drgeo = throw "'drgeo' has been removed as it is outdated and unmaintained"; # Added 2023-10-15
-  dtv-scan-tables_linuxtv = dtv-scan-tables;  # Added 2023-03-03
-  dtv-scan-tables_tvheadend = dtv-scan-tables;  # Added 2023-03-03
+  dtv-scan-tables_linuxtv = dtv-scan-tables; # Added 2023-03-03
+  dtv-scan-tables_tvheadend = dtv-scan-tables; # Added 2023-03-03
   dylibbundler = macdylibbundler; # Added 2021-04-24
 
   ### E ###
@@ -344,8 +346,14 @@ mapAliases ({
 
   gnuradio-with-packages = gnuradio3_7.override {
     extraPackages = lib.attrVals [
-      "osmosdr" "ais" "gsm" "nacl" "rds" "limesdr"
-    ] gnuradio3_7Packages;
+      "osmosdr"
+      "ais"
+      "gsm"
+      "nacl"
+      "rds"
+      "limesdr"
+    ]
+      gnuradio3_7Packages;
   }; # Added 2020-10-16
 
   gmock = gtest; # moved from top-level 2021-03-14
@@ -371,6 +379,7 @@ mapAliases ({
   google-chrome-dev = throw "'google-chrome-dev' has been removed due to the lack of maintenance in nixpkgs. Consider using 'google-chrome' instead."; # Added 2023-10-18
   google-gflags = throw "'google-gflags' has been renamed to/replaced by 'gflags'"; # Converted to throw 2023-09-10
   go-thumbnailer = thud; # Added 2023-09-21
+  gocode = throw "'gocode' has been removed as the upstream project was archived. 'gopls' is suggested as replacement"; # Added 2023-12-26
   govendor = throw "'govendor' has been removed as it is no longer maintained upstream, please use Go modules instead"; # Added 2023-12-26
   gometer = throw "gometer has been removed from nixpkgs because goLance stopped offering Linux support"; # Added 2023-02-10
 
@@ -471,7 +480,7 @@ mapAliases ({
   kerberos = libkrb5; # moved from top-level 2021-03-14
   kexectools = kexec-tools; # Added 2021-09-03
   keysmith = libsForQt5.kdeGear.keysmith; # Added 2021-07-14
-  kfctl = throw "kfctl is broken and has been archived by upstream" ; # Added 2023-08-21
+  kfctl = throw "kfctl is broken and has been archived by upstream"; # Added 2023-08-21
   kgx = gnome-console; # Added 2022-02-19
   kibana7 = throw "Kibana 7.x has been removed from nixpkgs as it depends on an end of life Node.js version and received no maintenance in time."; # Added 2023-30-10
   kibana = kibana7;
@@ -518,7 +527,7 @@ mapAliases ({
   librewolf-wayland = librewolf; # Added 2022-11-15
   libseat = seatd; # Added 2021-06-24
   libsigcxx12 = throw "'libsigcxx12' has been removed, please use newer versions"; # Added 2023-10-20
-  libsForQt515 = libsForQt5;  # Added 2022-11-24
+  libsForQt515 = libsForQt5; # Added 2022-11-24
   libtensorflow-bin = libtensorflow; # Added 2022-09-25
   libtorrentRasterbar = libtorrent-rasterbar; # Added 2020-12-20
   libtorrentRasterbar-1_2_x = libtorrent-rasterbar-1_2_x; # Added 2020-12-20
@@ -705,12 +714,13 @@ mapAliases ({
   neochat = libsForQt5.kdeGear.neochat; # added 2022-05-10
   nitrokey-udev-rules = libnitrokey; # Added 2023-03-25
   nix-direnv-flakes = nix-direnv;
-  nix-repl = throw ( # Added 2018-08-26
+  nix-repl = throw (
+    # Added 2018-08-26
     "nix-repl has been removed because it's not maintained anymore, " +
     "use `nix repl` instead. Also see https://github.com/NixOS/nixpkgs/pull/44903"
   );
   nix-review = throw "'nix-review' has been renamed to/replaced by 'nixpkgs-review'"; # Converted to throw 2023-09-10
-  nix-template-rpm = throw "'nix-template-rpm' has been removed as it is broken and unmaintained" ; # Added 2023-11-20
+  nix-template-rpm = throw "'nix-template-rpm' has been removed as it is broken and unmaintained"; # Added 2023-11-20
   nixFlakes = nixVersions.stable; # Added 2021-05-21
   nixStable = nixVersions.stable; # Added 2022-01-24
   nixUnstable = nixVersions.unstable; # Added 2022-01-26
@@ -866,7 +876,7 @@ mapAliases ({
   qlandkartegt = throw "'qlandkartegt' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2023-04-17
   qscintilla = libsForQt5.qscintilla; # Added 2023-09-20
   qscintilla-qt6 = qt6Packages.qscintilla; # Added 2023-09-20
-  qt515 = qt5;  # Added 2022-11-24
+  qt515 = qt5; # Added 2022-11-24
   qt5ct = libsForQt5.qt5ct; # Added 2021-12-27
   qt6ct = qt6Packages.qt6ct; # Added 2023-03-07
   qtcurve = libsForQt5.qtcurve; # Added 2020-11-07
@@ -955,7 +965,7 @@ mapAliases ({
   sgtpuzzles = throw "'sgtpuzzles' has been renamed to 'sgt-puzzles'"; # Added 2023-10-06
   sgtpuzzles-mobile = throw "'sgtpuzzles-mobile' has been renamed to 'sgt-puzzles-mobile'"; # Added 2023-10-06
   inherit (libsForQt5.mauiPackages) shelf; # added 2022-05-17
-  shhgit = throw "shhgit is broken and is no longer maintained. See https://github.com/eth0izzle/shhgit#-shhgit-is-no-longer-maintained-" ; # Added 2023-08-08
+  shhgit = throw "shhgit is broken and is no longer maintained. See https://github.com/eth0izzle/shhgit#-shhgit-is-no-longer-maintained-"; # Added 2023-08-08
   shipyard = jumppad; # Added 2023-06-06
   signumone-ks = throw "signumone-ks has been removed from nixpkgs because the developers stopped offering the binaries"; # Added 2023-08-17
   simplenote = throw "'simplenote' has been removed because it is no longer maintained and insecure"; # Added 2023-10-09
@@ -1074,7 +1084,7 @@ mapAliases ({
   vamp = { vampSDK = vamp-plugin-sdk; }; # Added 2020-03-26
   vaapiIntel = intel-vaapi-driver; # Added 2023-05-31
   vaultwarden-vault = vaultwarden.webvault; # Added 2022-12-13
-  vdirsyncerStable  = vdirsyncer; # Added 2020-11-08, see https://github.com/NixOS/nixpkgs/issues/103026#issuecomment-723428168
+  vdirsyncerStable = vdirsyncer; # Added 2020-11-08, see https://github.com/NixOS/nixpkgs/issues/103026#issuecomment-723428168
   ventoy-bin = ventoy; # Added 2023-04-12
   ventoy-bin-full = ventoy-full; # Added 2023-04-12
   ViennaRNA = viennarna; # Added 2023-08-23
@@ -1172,7 +1182,7 @@ mapAliases ({
   });
 
   /* If these are in the scope of all-packages.nix, they cause collisions
-  between mixed versions of qt. See:
+    between mixed versions of qt. See:
   https://github.com/NixOS/nixpkgs/pull/101369 */
 
   inherit (plasma5Packages)
@@ -1195,9 +1205,9 @@ mapAliases ({
     plasma-vault plasma-workspace plasma-workspace-wallpapers polkit-kde-agent
     powerdevil qqc2-breeze-style sddm-kcm skanlite skanpage spectacle
     systemsettings xdg-desktop-portal-kde yakuake zanshin
-  ;
+    ;
 
-  kalendar = merkuro;  # Renamed in 23.08
+  kalendar = merkuro; # Renamed in 23.08
   kfloppy = throw "kfloppy has been removed upstream in KDE Gear 23.08";
 
   inherit (plasma5Packages.thirdParty)
@@ -1208,11 +1218,11 @@ mapAliases ({
     kwin-tiling
     plasma-applet-caffeine-plus
     plasma-applet-virtual-desktop-bar
-  ;
+    ;
 
   inherit (libsForQt5)
     sddm
-  ;
+    ;
 
   inherit (pidginPackages)
     pidgin-indicator
@@ -1240,6 +1250,6 @@ mapAliases ({
     tdlib-purple
     pidgin-opensteamworks
     purple-facebook
-  ;
+    ;
 
 })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 79239e00c3e15..aa1af79dbe8a0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -184,6 +184,9 @@ with pkgs;
   autoreconfHook269 = autoreconfHook.override {
     autoconf = autoconf269;
   };
+  autoreconfHook271 = autoreconfHook.override {
+    autoconf = autoconf271;
+  };
 
   autorestic = callPackage ../tools/backup/autorestic { };
 
@@ -7330,6 +7333,7 @@ with pkgs;
     gsaslSupport = true;
     rtmpSupport = true;
     pslSupport = true;
+    websocketSupport = true;
   };
 
   curlHTTP3 = curl.override {
@@ -15814,7 +15818,6 @@ with pkgs;
   default-gcc-version =
     if (with stdenv.targetPlatform; isVc4 || libc == "relibc") then 6
     else if stdenv.buildPlatform.isDarwin  then 12  # unable to test
-    else if stdenv.buildPlatform.isAarch64 then 12  # unable to test
     else 13;
   gcc = pkgs.${"gcc${toString default-gcc-version}"};
   gccFun = callPackage ../development/compilers/gcc;
@@ -18472,14 +18475,13 @@ with pkgs;
 
   autobuild = callPackage ../development/tools/misc/autobuild { };
 
-  autoconf = autoconf271;
-
   autoconf-archive = callPackage ../development/tools/misc/autoconf-archive { };
 
+  autoconf = callPackage ../development/tools/misc/autoconf { };
   autoconf213 = callPackage ../development/tools/misc/autoconf/2.13.nix { };
   autoconf264 = callPackage ../development/tools/misc/autoconf/2.64.nix { };
   autoconf269 = callPackage ../development/tools/misc/autoconf/2.69.nix { };
-  autoconf271 = callPackage ../development/tools/misc/autoconf { };
+  autoconf271 = callPackage ../development/tools/misc/autoconf/2.71.nix { };
 
   acr  = callPackage ../development/tools/misc/acr { };
 
@@ -27652,14 +27654,13 @@ with pkgs;
 
   blktrace = callPackage ../os-specific/linux/blktrace { };
 
-  bluez5 = callPackage ../os-specific/linux/bluez { };
+  bluez5 = bluez;
+  bluez5-experimental = bluez-experimental;
 
-  bluez5-experimental = callPackage ../os-specific/linux/bluez {
-    withExperimental = true;
+  bluez-experimental = bluez.override {
+    enableExperimental = true;
   };
 
-  bluez = bluez5;
-
   bolt = callPackage ../os-specific/linux/bolt { };
 
   bpf-linker = callPackage ../development/tools/bpf-linker { };
@@ -28354,8 +28355,6 @@ with pkgs;
 
   go-outline = callPackage ../development/tools/go-outline { };
 
-  gocode = callPackage ../development/tools/gocode { };
-
   gocode-gomod = callPackage ../development/tools/gocode-gomod { };
 
   goconst = callPackage ../development/tools/goconst { };
@@ -28724,6 +28723,7 @@ with pkgs;
     withHomed = false;
     withHwdb = false;
     withImportd = false;
+    withIptables = false;
     withLibBPF = false;
     withLibidn2 = false;
     withLocaled = false;
@@ -28747,6 +28747,9 @@ with pkgs;
     withUserDb = false;
     withUkify = false;
     withBootloader = false;
+    withPasswordQuality = false;
+    withVmspawn = false;
+    withQrencode = false;
   };
   systemdLibs = systemdMinimal.override {
     pname = "systemd-minimal-libs";
@@ -34221,6 +34224,10 @@ with pkgs;
   };
 
   mupdf = callPackage ../applications/misc/mupdf { };
+  mupdf-headless = mupdf.override {
+    enableX11 = false;
+    enableGL = false;
+  };
   mupdf_1_17 = callPackage ../applications/misc/mupdf/1.17 { };
 
   muso = callPackage ../applications/audio/muso {
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index dc71b01f3c268..9017edd701268 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -458,6 +458,8 @@ in {
 
     facetimehd = callPackage ../os-specific/linux/facetimehd { };
 
+    rust-out-of-tree-module = if lib.versionAtLeast kernel.version "6.7" then callPackage ../os-specific/linux/rust-out-of-tree-module { } else null;
+
     tuxedo-keyboard = if lib.versionAtLeast kernel.version "4.14" then callPackage ../os-specific/linux/tuxedo-keyboard { } else null;
 
     jool = callPackage ../os-specific/linux/jool { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 9ecd7b6d38446..c2b6c54f2ad1c 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -356,6 +356,7 @@ mapAliases ({
   pyramid_multiauth = pyramid-multiauth; # added 2023-08-24
   pyreadability = readability-lxml; # added 2022-05-24
   pyres = throw "pyres has been removed, since it is abandoned and broken"; # added 2023-06-20
+  pyRFC3339 = pyrfc3339; # added 2024-01-07
   pyroute2-core = throw "pyroute2 migrated back to a single package scheme in version 0.7.1"; # added 2022-07-16
   pyroute2-ethtool = throw "pyroute2 migrated back to a single package scheme in version 0.7.1"; # added 2022-07-16
   pyroute2-ipdb = throw "pyroute2 migrated back to a single package scheme in version 0.7.1"; # added 2022-07-16
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 27ed55d001ea0..80463161232cd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2558,10 +2558,10 @@ self: super: with self; {
   cython = callPackage ../development/python-modules/cython { };
 
   cython_3 = self.cython.overridePythonAttrs (old: rec {
-    version = "3.0.6";
+    version = "3.0.7";
     src = old.src.override {
       inherit version;
-      hash = "sha256-OZ0YVnLGZ7Juq73KQgyYVkWDeYrzvEdnCooJ6fGd1mA=";
+      hash = "sha256-+ymazzpXhXPBkMhY1J4M+ddfS8ScPyTFpjgEmX7wkhM=";
     };
     patches = [ ];
   });
@@ -11165,7 +11165,7 @@ self: super: with self; {
 
   pyrituals = callPackage ../development/python-modules/pyrituals { };
 
-  pyRFC3339 = callPackage ../development/python-modules/pyrfc3339 { };
+  pyrfc3339 = callPackage ../development/python-modules/pyrfc3339 { };
 
   pyrmvtransport = callPackage ../development/python-modules/pyrmvtransport { };
 
diff --git a/pkgs/top-level/unixtools.nix b/pkgs/top-level/unixtools.nix
index 40faa76421297..bcbbd6799d88d 100644
--- a/pkgs/top-level/unixtools.nix
+++ b/pkgs/top-level/unixtools.nix
@@ -174,8 +174,8 @@ let
       darwin = pkgs.darwin.basic_cmds;
     };
     xxd = {
-      linux = pkgs.vim;
-      darwin = pkgs.vim;
+      linux = pkgs.vim.xxd;
+      darwin = pkgs.vim.xxd;
     };
   };