diff --git a/nixos/modules/services/hardware/vdr.nix b/nixos/modules/services/hardware/vdr.nix
index afa64fa16c4a..5feb379b50d1 100644
--- a/nixos/modules/services/hardware/vdr.nix
+++ b/nixos/modules/services/hardware/vdr.nix
@@ -45,6 +45,7 @@ in {
     systemd.services.vdr = {
       description = "VDR";
       wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
       serviceConfig = {
         ExecStart = ''
           ${cfg.package}/bin/vdr \
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index f44400eb4159..1285c2bbb916 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -1132,14 +1132,6 @@ in
         '';
       }
 
-      {
-        assertion = any (host: host.kTLS) (attrValues virtualHosts) -> versionAtLeast cfg.package.version "1.21.4";
-        message = ''
-          services.nginx.virtualHosts.<name>.kTLS requires nginx version
-          1.21.4 or above; see the documentation for services.nginx.package.
-        '';
-      }
-
       {
         assertion = all (host: !(host.enableACME && host.useACMEHost != null)) (attrValues virtualHosts);
         message = ''
@@ -1348,6 +1340,8 @@ in
       nginx.gid = config.ids.gids.nginx;
     };
 
+    boot.kernelModules = optional (versionAtLeast config.boot.kernelPackages.kernel.version "4.17") "tls";
+
     # do not delete the default temp directories created upon nginx startup
     systemd.tmpfiles.rules = [
       "X /tmp/systemd-private-%b-nginx.service-*/tmp/nginx_*"
diff --git a/pkgs/applications/editors/quartus-prime/default.nix b/pkgs/applications/editors/quartus-prime/default.nix
index 57ad28b5b2da..538d3fb134ca 100644
--- a/pkgs/applications/editors/quartus-prime/default.nix
+++ b/pkgs/applications/editors/quartus-prime/default.nix
@@ -13,7 +13,7 @@ let
     genericName = "Quartus Prime";
     categories = [ "Development" ];
   };
-# I think modelsim_ase/linux/vlm checksums itself, so use FHSUserEnv instead of `patchelf`
+# I think questa_fse/linux/vlm checksums itself, so use FHSUserEnv instead of `patchelf`
 in buildFHSEnv rec {
   name = "quartus-prime-lite"; # wrapped
 
@@ -27,8 +27,13 @@ in buildFHSEnv rec {
     glib
     xorg.libICE
     xorg.libSM
-    zlib
+    xorg.libXau
+    xorg.libXdmcp
     libudev0-shim
+    bzip2
+    brotli
+    expat
+    dbus
     # qsys requirements
     xorg.libXtst
     xorg.libXi
@@ -43,7 +48,7 @@ in buildFHSEnv rec {
     fontconfig = pkgs.fontconfig.override { inherit freetype; };
     libXft = pkgs.xorg.libXft.override { inherit freetype fontconfig; };
   in [
-    # modelsim requirements
+    # questa requirements
     libxml2
     ncurses5
     unixODBC
@@ -58,15 +63,15 @@ in buildFHSEnv rec {
   ];
 
   extraInstallCommands = ''
-    mkdir -p $out/share/applications $out/share/icons/128x128
+    mkdir -p $out/share/applications $out/share/icons/hicolor/64x64/apps
     ln -s ${desktopItem}/share/applications/* $out/share/applications
-    ln -s ${unwrapped}/licenses/images/dc_quartus_panel_logo.png $out/share/icons/128x128/quartus.png
+    ln -s ${unwrapped}/quartus/adm/quartusii.png $out/share/icons/hicolor/64x64/apps/quartus.png
 
     progs_to_wrap=(
       "${unwrapped}"/quartus/bin/*
       "${unwrapped}"/quartus/sopc_builder/bin/qsys-{generate,edit,script}
-      "${unwrapped}"/modelsim_ase/bin/*
-      "${unwrapped}"/modelsim_ase/linuxaloem/lmutil
+      "${unwrapped}"/questa_fse/bin/*
+      "${unwrapped}"/questa_fse/linux_x86_64/lmutil
     )
 
     wrapper=$out/bin/${name}
@@ -78,8 +83,8 @@ in buildFHSEnv rec {
         mkdir -p "$(dirname "$wrapped")"
         echo "#!${runtimeShell}" >> "$wrapped"
         case "$relname" in
-            modelsim_ase/*)
-                echo "export NIXPKGS_IS_MODELSIM_WRAPPER=1" >> "$wrapped"
+            questa_fse/*)
+                echo "export NIXPKGS_IS_QUESTA_WRAPPER=1" >> "$wrapped"
                 ;;
         esac
         echo "$wrapper $prog \"\$@\"" >> "$wrapped"
@@ -98,10 +103,10 @@ in buildFHSEnv rec {
     # https://community.intel.com/t5/Intel-FPGA-Software-Installation/Running-Quartus-Prime-Standard-on-WSL-crashes-in-libudev-so/m-p/1189032
     #
     # But, as can be seen in the above resource, LD_PRELOADing libudev breaks
-    # compiling encrypted device libraries in ModelSim (with error
+    # compiling encrypted device libraries in Questa (with error
     # `(vlog-2163) Macro `<protected> is undefined.`), so only use LD_PRELOAD
-    # for non-ModelSim wrappers.
-    if [ "$NIXPKGS_IS_MODELSIM_WRAPPER" != 1 ]; then
+    # for non-Questa wrappers.
+    if [ "$NIXPKGS_IS_QUESTA_WRAPPER" != 1 ]; then
         export LD_PRELOAD=''${LD_PRELOAD:+$LD_PRELOAD:}/usr/lib/libudev.so.0
     fi
   '';
@@ -112,8 +117,8 @@ in buildFHSEnv rec {
   passthru = {
     inherit unwrapped;
     tests = {
-      modelsimEncryptedModel = runCommand "quartus-prime-lite-test-modelsim-encrypted-model" {} ''
-        "${quartus-prime-lite}/bin/vlog" "${quartus-prime-lite.unwrapped}/modelsim_ase/altera/verilog/src/arriav_atoms_ncrypt.v"
+      questaEncryptedModel = runCommand "quartus-prime-lite-test-questa-encrypted-model" {} ''
+        "${quartus-prime-lite}/bin/vlog" "${quartus-prime-lite.unwrapped}/questa_fse/intel/verilog/src/arriav_atoms_ncrypt.v"
         touch "$out"
       '';
     };
diff --git a/pkgs/applications/editors/quartus-prime/quartus.nix b/pkgs/applications/editors/quartus-prime/quartus.nix
index 134a7807e0b3..4b2d5d8c894c 100644
--- a/pkgs/applications/editors/quartus-prime/quartus.nix
+++ b/pkgs/applications/editors/quartus-prime/quartus.nix
@@ -25,20 +25,20 @@ let
   ) deviceIds;
 
   componentHashes = {
-    "arria_lite" = "140jqnb97vrxx6398cpgpw35zrrx3z5kv1x5gr9is1xdbnf4fqhy";
-    "cyclone" = "116kf69ryqcmlc2k8ra0v32jy7nrk7w4s5z3yll7h3c3r68xcsfr";
-    "cyclone10lp" = "07wpgx9bap6rlr5bcmr9lpsxi3cy4yar4n3pxfghazclzqfi2cyl";
-    "cyclonev" = "11baa9zpmmfkmyv33w1r57ipf490gnd3dpi2daripf38wld8lgak";
-    "max" = "1zy2d42dqmn97fwmv4x6pmihh4m23jypv3nd830m1mj7jkjx9kcq";
-    "max10" = "1hvi9cpcjgbih3l6nh8x1vsp0lky5ax85jb2yqmzla80n7dl9ahs";
+    "arria_lite" = "07p862i3dn2c0s3p39y23g94id59nzrpzbwdmrdnhy61ca3m0vzp";
+    "cyclone" = "0dic35j9q1ndrn8i2vdqg9176fr3kn6c8iiv0c03nni0m4ar3ykn";
+    "cyclone10lp" = "03w4f71fhhwvnkzzly9m15nrdf0jw8m0ckhhzv1vg3nd9pkk86jh";
+    "cyclonev" = "091mlg2iy452fk28idbiwi3rhcgkbhg7ggh3xvnqa9jrfffq9pjc";
+    "max" = "0r649l2n6hj6x5v6hx8k4xnvd6df6wxajx1xp2prq6dpapjfb06y";
+    "max10" = "1p5ds3cq2gq2mzq2hjwwjhw50c931kgiqxaf7ss228c6s7rv6zpk";
   };
 
-  version = "20.1.1.720";
+  version = "22.1std.2.922";
 
   download = {name, sha256}: fetchurl {
     inherit name sha256;
-    # e.g. "20.1.1.720" -> "20.1std.1/720"
-    url = "https://downloads.intel.com/akdlm/software/acdsinst/${lib.versions.majorMinor version}std.${lib.versions.patch version}/${lib.elemAt (lib.splitVersion version) 3}/ib_installers/${name}";
+    # e.g. "22.1std.2.922" -> "22.1std.2/922"
+    url = "https://downloads.intel.com/akdlm/software/acdsinst/${lib.versions.majorMinor version}std.${lib.elemAt (lib.splitVersion version) 3}/${lib.elemAt (lib.splitVersion version) 4}/ib_installers/${name}";
   };
 
 in stdenv.mkDerivation rec {
@@ -47,10 +47,10 @@ in stdenv.mkDerivation rec {
 
   src = map download ([{
     name = "QuartusLiteSetup-${version}-linux.run";
-    sha256 = "0mjp1rg312dipr7q95pb4nf4b8fwvxgflnd1vafi3g9cshbb1c3k";
+    sha256 = "078x42pbc51n6ynrvzpwiwgi6g2sg4csv6x2vnnzjgx6bg5kq6l3";
   } {
-    name = "ModelSimSetup-${version}-linux.run";
-    sha256 = "1cqgv8x6vqga8s4v19yhmgrr886rb6p7sbx80528df5n4rpr2k4i";
+    name = "QuestaSetup-${version}-linux.run";
+    sha256 = "04pv5fq3kfy3xsjnj435zzpj5kf6329cbs1xgvkgmq1gpn4ji5zy";
   }] ++ (map (id: {
     name = "${id}-${version}.qdz";
     sha256 = lib.getAttr id componentHashes;
@@ -68,12 +68,12 @@ in stdenv.mkDerivation rec {
         patchelf --interpreter $(cat $NIX_CC/nix-support/dynamic-linker) $TEMP/${installer.name}
       '';
     copyComponent = component: "cp ${component} $TEMP/${component.name}";
-    # leaves enabled: quartus, modelsim_ase, devinfo
+    # leaves enabled: quartus, questa_fse, devinfo
     disabledComponents = [
       "quartus_help"
       "quartus_update"
-      # not modelsim_ase
-      "modelsim_ae"
+      # not questa_fse
+      "questa_fe"
     ] ++ (lib.attrValues unsupportedDeviceIds);
   in ''
       ${lib.concatMapStringsSep "\n" copyInstaller installers}
diff --git a/pkgs/applications/misc/gimoji/default.nix b/pkgs/applications/misc/gimoji/default.nix
index 7787e71691d3..36c29cd2444c 100644
--- a/pkgs/applications/misc/gimoji/default.nix
+++ b/pkgs/applications/misc/gimoji/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gimoji";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "zeenix";
     repo = "gimoji";
     rev = version;
-    hash = "sha256-rXGnSXqKxxmC2V2qapWZb+TB89a854ZGq1kG/3JjlUg=";
+    hash = "sha256-PF7vjbmoNSBD9C6JOB1s5NHnBEkv1LD/3RZAB0/HFPc=";
   };
 
-  cargoHash = "sha256-WYMqKwe78D00ZZ+uwV61keRBNiJQKNqlpQtteVR0bVA=";
+  cargoHash = "sha256-iJblgcwn9uCl2X0AjG+dlAwdwwyZ321LRBFjDCZOr/A=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.AppKit
diff --git a/pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix b/pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix
index 77124120d5d3..28b425a05e3b 100644
--- a/pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix
+++ b/pkgs/applications/networking/p2p/transmission-remote-gtk/default.nix
@@ -7,6 +7,7 @@
 , geoip
 , gettext
 , glib
+, glib-networking
 , gtk3
 , json-glib
 , libappindicator
@@ -50,7 +51,9 @@ stdenv.mkDerivation rec {
     libmrss
     libproxy
     libsoup_3
-  ] ++ libsoup_3.propagatedUserEnvPackages;
+    # For TLS support.
+    glib-networking
+  ];
 
   doCheck = false; # Requires network access
 
diff --git a/pkgs/applications/radio/dump1090/default.nix b/pkgs/applications/radio/dump1090/default.nix
index f4f049818e3d..94d844aba8c5 100644
--- a/pkgs/applications/radio/dump1090/default.nix
+++ b/pkgs/applications/radio/dump1090/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dump1090";
-  version = "8.2";
+  version = "9.0";
 
   src = fetchFromGitHub {
     owner = "flightaware";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-SUvK9XTXIDimEMEnORnp/Af/F030TZTxLI43Jzz31Js=";
+    sha256 = "sha256-rc4mg+Px+0p2r38wxIah/rHqWjHSU0+KCPgqj/Gl3oo=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -31,9 +31,9 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional stdenv.isLinux limesuite;
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang
-    "-Wno-implicit-function-declaration -Wno-int-conversion";
+    "-Wno-implicit-function-declaration -Wno-int-conversion -Wno-unknown-warning-option";
 
-  buildFlags = [ "dump1090" "view1090" ];
+  buildFlags = [ "DUMP1090_VERSION=${version}" "dump1090" "view1090" ];
 
   doCheck = true;
 
diff --git a/pkgs/applications/version-management/git-mit/default.nix b/pkgs/applications/version-management/git-mit/default.nix
index a2e89614b1c9..7e5fb5ab58fd 100644
--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "5.12.181";
+  version = "5.12.182";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-XXVLYKicFcYNx33eElqlZcDNZgq4FnbwvYSshZwwHls=";
+    hash = "sha256-MED38N+4ZeiFqsdaVb7TK7WsANwEOPR8hqcgMBGS64c=";
   };
 
-  cargoHash = "sha256-PskRV+LfHjHK0WTwb9Lt2E2R9g+lyyEY7A1vvFLhPdw=";
+  cargoHash = "sha256-KfROYHiau6nKnsMAyVk1Rb4ciRMJ721zfLnEcUc2qO0=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/applications/video/vdr/default.nix b/pkgs/applications/video/vdr/default.nix
index 08d6c004de10..2df646d7578a 100644
--- a/pkgs/applications/video/vdr/default.nix
+++ b/pkgs/applications/video/vdr/default.nix
@@ -5,12 +5,12 @@
 }: stdenv.mkDerivation rec {
 
   pname = "vdr";
-  version = "2.6.4";
+  version = "2.6.5";
 
   src = fetchgit {
     url = "git://git.tvdr.de/vdr.git";
     rev = version;
-    sha256 = "sha256-QCq+IxulrxDX+fzI+IHywboemJQnUfZrHRzP6B9qfvk=";
+    hash = "sha256-CKgo1Saj6EkSRNoIh16wzGHmToIMADZtjd8VQ+c1nus=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/video/vdr/markad/default.nix b/pkgs/applications/video/vdr/markad/default.nix
index 808552d4f935..335767204c43 100644
--- a/pkgs/applications/video/vdr/markad/default.nix
+++ b/pkgs/applications/video/vdr/markad/default.nix
@@ -19,12 +19,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vdr-markad";
-  version = "3.3.6";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     repo = "vdr-plugin-markad";
     owner = "kfb77";
-    sha256 = "sha256-aHhQljWE1om/mILM+TXB9uPTrUwNNc4Loiejbakj9NU=";
+    sha256 = "sha256-C7s/92xmG6bffRqr3ndecmi/RbVlboRsYZLLThLYEzQ=";
     rev = "V${version}";
   };
 
diff --git a/pkgs/applications/video/vdr/softhddevice/default.nix b/pkgs/applications/video/vdr/softhddevice/default.nix
index 437c8d16cfd8..1f0cee44df32 100644
--- a/pkgs/applications/video/vdr/softhddevice/default.nix
+++ b/pkgs/applications/video/vdr/softhddevice/default.nix
@@ -9,15 +9,17 @@
 , libva
 , libvdpau
 , xorg
+, libGL
+, libGLU
 }:
 stdenv.mkDerivation rec {
   pname = "vdr-softhddevice";
-  version = "2.0.6";
+  version = "2.0.7";
 
   src = fetchFromGitHub {
     owner = "ua0lnj";
     repo = "vdr-plugin-softhddevice";
-    sha256 = "sha256-eE2cxqV/XpGyxneVzpP7f215IReH1nwGEkfCHbxUgVs=";
+    sha256 = "sha256-AzWYgR0IdB4922HxH7K83heRIEi31fz20Z2W7E9ljXw=";
     rev = "v${version}";
   };
 
@@ -30,6 +32,8 @@ stdenv.mkDerivation rec {
     libvdpau
     xorg.libxcb
     xorg.libX11
+    libGL
+    libGLU
   ];
 
   makeFlags = [ "DESTDIR=$(out)" ];
diff --git a/pkgs/applications/window-managers/i3/wmfocus.nix b/pkgs/applications/window-managers/i3/wmfocus.nix
index 43a1c13ee0e5..8b45c7f8a1d9 100644
--- a/pkgs/applications/window-managers/i3/wmfocus.nix
+++ b/pkgs/applications/window-managers/i3/wmfocus.nix
@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wmfocus";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "svenstaro";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zXqPZORwi7X1wBTecPg9nOCvRHWNTtloCpgbPwtFhzo=";
+    sha256 = "sha256-94MgE2j8HaS8IyzHEDtoqTls2A8xD96v2iAFx9XfMcw=";
   };
 
-  cargoHash = "sha256-4eoV/viI7Q7I7mIqcHVAyPf/y2RWaWX0B+mLZWMEbcI=";
+  cargoHash = "sha256-sSJAlDe1vBYs1vZW/X04cU14Wj1OF4Jy8oI4uWkrEjk=";
 
   nativeBuildInputs = [ python3 pkg-config ];
   buildInputs = [ cairo expat libxkbcommon xorg.xcbutilkeysyms ];
diff --git a/pkgs/build-support/rust/import-cargo-lock.nix b/pkgs/build-support/rust/import-cargo-lock.nix
index c17b0e41cca8..e3fe57ef06da 100644
--- a/pkgs/build-support/rust/import-cargo-lock.nix
+++ b/pkgs/build-support/rust/import-cargo-lock.nix
@@ -193,7 +193,7 @@ let
 
         if grep -q workspace "$out/Cargo.toml"; then
           chmod u+w "$out/Cargo.toml"
-          ${replaceWorkspaceValues} "$out/Cargo.toml" "${tree}/Cargo.toml"
+          ${replaceWorkspaceValues} "$out/Cargo.toml" "$(${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $crateCargoTOML | ${jq}/bin/jq -r .workspace_root)/Cargo.toml"
         fi
 
         # Cargo is happy with empty metadata.
diff --git a/pkgs/by-name/c2/c2fmzq/package.nix b/pkgs/by-name/c2/c2fmzq/package.nix
index 36cc9518514d..088f27ad3e74 100644
--- a/pkgs/by-name/c2/c2fmzq/package.nix
+++ b/pkgs/by-name/c2/c2fmzq/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "c2FmZQ";
-  version = "0.4.16";
+  version = "0.4.17";
 
   src = fetchFromGitHub {
     owner = "c2FmZQ";
     repo = "c2FmZQ";
     rev = "v${version}";
-    hash = "sha256-DJvcWUPIEu3zCVIVB/mUBqbOzHwUI+01gMQUdYk4qm4=";
+    hash = "sha256-xjgoE1HlCmSPZ6TQcemI7fNE9wbIrk/WSrz6vlVt66U=";
   };
 
   ldflags = [ "-s" "-w" ];
diff --git a/pkgs/by-name/gi/gickup/package.nix b/pkgs/by-name/gi/gickup/package.nix
index 9253894968f6..be39f62e0b3a 100644
--- a/pkgs/by-name/gi/gickup/package.nix
+++ b/pkgs/by-name/gi/gickup/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "gickup";
-  version = "0.10.24";
+  version = "0.10.25";
 
   src = fetchFromGitHub {
     owner = "cooperspencer";
     repo = "gickup";
     rev = "refs/tags/v${version}";
-    hash = "sha256-c7IP5jYP8DbJkQEHmU2cMgClLqmMTAJkPCCHbdW5yLw=";
+    hash = "sha256-2ydYGuIcoxw9iBSeCg3q6gVW2yMqL8j3nRzlplIm8Ps=";
   };
 
-  vendorHash = "sha256-fqtZL3Tr9QTFRUsczs11Y3b127CqoYkHV+dPI+vYpDk=";
+  vendorHash = "sha256-zyjtiZzePqWtxqkHqdNp04g70V42Rkrf60V7BY8JMz4=";
 
   ldflags = ["-X main.version=${version}"];
 
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index ee23810c3547..85ddf9c2dd6f 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -5,7 +5,6 @@
 , fetchpatch
 , nix-update-script
 , stdenv
-, symlinkJoin
 
 , config
 , cudaSupport ? config.cudaSupport
@@ -17,30 +16,19 @@
 , openclSupport ? false
 , clblast
 
-, openblasSupport ? !rocmSupport
+, blasSupport ? !rocmSupport && !cudaSupport
 , openblas
 , pkg-config
+, metalSupport ? stdenv.isDarwin && stdenv.isAarch64 && !openclSupport
 }:
 
-assert lib.assertMsg
-  (lib.count lib.id [openclSupport openblasSupport rocmSupport] == 1)
-  "llama-cpp: exactly one  of openclSupport, openblasSupport and rocmSupport should be enabled";
-
 let
-  cudatoolkit_joined = symlinkJoin {
-    name = "${cudaPackages.cudatoolkit.name}-merged";
-    paths = [
-      cudaPackages.cudatoolkit.lib
-      cudaPackages.cudatoolkit.out
-    ] ++ lib.optionals (lib.versionOlder cudaPackages.cudatoolkit.version "11") [
-      # for some reason some of the required libs are in the targets/x86_64-linux
-      # directory; not sure why but this works around it
-      "${cudaPackages.cudatoolkit}/targets/${stdenv.system}"
-    ];
-  };
-  metalSupport = stdenv.isDarwin && stdenv.isAarch64;
+  # It's necessary to consistently use backendStdenv when building with CUDA support,
+  # otherwise we get libstdc++ errors downstream.
+  # cuda imposes an upper bound on the gcc version, e.g. the latest gcc compatible with cudaPackages_11 is gcc11
+  effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
 in
-stdenv.mkDerivation (finalAttrs: {
+effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
   version = "1710";
 
@@ -67,25 +55,42 @@ stdenv.mkDerivation (finalAttrs: {
       --replace '[bundle pathForResource:@"ggml-metal" ofType:@"metal"];' "@\"$out/bin/ggml-metal.metal\";"
   '';
 
-  nativeBuildInputs = [ cmake ] ++ lib.optionals openblasSupport [ pkg-config ];
+  nativeBuildInputs = [ cmake ] ++ lib.optionals blasSupport [ pkg-config ] ++ lib.optionals cudaSupport [
+    cudaPackages.cuda_nvcc
 
-  buildInputs = lib.optionals metalSupport
+    # TODO: Replace with autoAddDriverRunpath
+    # once https://github.com/NixOS/nixpkgs/pull/275241 has been merged
+    cudaPackages.autoAddOpenGLRunpathHook
+  ];
+
+  buildInputs = lib.optionals effectiveStdenv.isDarwin
     (with darwin.apple_sdk.frameworks; [
       Accelerate
       CoreGraphics
       CoreVideo
       Foundation
-      MetalKit
     ])
-  ++ lib.optionals cudaSupport [
-    cudatoolkit_joined
-  ] ++ lib.optionals rocmSupport [
+  ++ lib.optionals metalSupport (with darwin.apple_sdk.frameworks; [
+    MetalKit
+  ])
+  ++ lib.optionals cudaSupport (with cudaPackages; [
+    cuda_cccl.dev # <nv/target>
+
+    # A temporary hack for reducing the closure size, remove once cudaPackages
+    # have stopped using lndir: https://github.com/NixOS/nixpkgs/issues/271792
+    cuda_cudart.dev
+    cuda_cudart.lib
+    cuda_cudart.static
+    libcublas.dev
+    libcublas.lib
+    libcublas.static
+  ]) ++ lib.optionals rocmSupport [
     rocmPackages.clr
     rocmPackages.hipblas
     rocmPackages.rocblas
   ] ++ lib.optionals openclSupport [
     clblast
-  ] ++ lib.optionals openblasSupport [
+  ] ++ lib.optionals blasSupport [
     openblas
   ];
 
@@ -109,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals openclSupport [
     "-DLLAMA_CLBLAST=ON"
   ]
-  ++ lib.optionals openblasSupport [
+  ++ lib.optionals blasSupport [
     "-DLLAMA_BLAS=ON"
     "-DLLAMA_BLAS_VENDOR=OpenBLAS"
   ];
@@ -140,7 +145,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.mit;
     mainProgram = "llama-cpp-main";
     maintainers = with maintainers; [ dit7ya elohmeier ];
-    broken = stdenv.isDarwin && stdenv.isx86_64;
+    broken = (effectiveStdenv.isDarwin && effectiveStdenv.isx86_64) || lib.count lib.id [openclSupport blasSupport rocmSupport cudaSupport] == 0;
     platforms = platforms.unix;
   };
 })
diff --git a/pkgs/by-name/sp/spicetify-cli/package.nix b/pkgs/by-name/sp/spicetify-cli/package.nix
index 410dad2c898e..8d074163672c 100644
--- a/pkgs/by-name/sp/spicetify-cli/package.nix
+++ b/pkgs/by-name/sp/spicetify-cli/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.28.1";
+  version = "2.29.1";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "spicetify-cli";
     rev = "v${version}";
-    hash = "sha256-PiOpj9FsolFZzoMATnJmMwjZrBLGXDIHv8SIaJQetRc=";
+    hash = "sha256-fgecZn0/CWQFH4Tnm5kqOOvWlE1jzGvG6LxVN7KryPg=";
   };
 
   vendorHash = "sha256-alNUJ+ejwZPvefCTHt0/NWSAIt4MFzbPmkMinMrpe2M=";
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index 29ffd316747d..d3f60b8f6e98 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -192,5 +192,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.bsd3;
     maintainers = teams.golang.members;
     platforms = platforms.darwin ++ platforms.linux;
+    mainProgram = "go";
   };
 })
diff --git a/pkgs/development/compilers/go/1.20.nix b/pkgs/development/compilers/go/1.20.nix
index 8a0b86864b9d..0b83a57994c2 100644
--- a/pkgs/development/compilers/go/1.20.nix
+++ b/pkgs/development/compilers/go/1.20.nix
@@ -184,5 +184,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.bsd3;
     maintainers = teams.golang.members;
     platforms = platforms.darwin ++ platforms.linux;
+    mainProgram = "go";
   };
 })
diff --git a/pkgs/development/compilers/go/1.21.nix b/pkgs/development/compilers/go/1.21.nix
index 715050cc0a73..5dec10e3e477 100644
--- a/pkgs/development/compilers/go/1.21.nix
+++ b/pkgs/development/compilers/go/1.21.nix
@@ -184,5 +184,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.bsd3;
     maintainers = teams.golang.members;
     platforms = platforms.darwin ++ platforms.linux;
+    mainProgram = "go";
   };
 })
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
index d8916ad8527d..481db0d258fb 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
@@ -105,14 +105,9 @@ self: super: {
   ghc-lib-parser-ex = doDistribute self.ghc-lib-parser-ex_9_2_1_1;
   ghc-lib = doDistribute self.ghc-lib_9_2_8_20230729;
 
-  mod = super.mod_0_1_2_2;
   path-io = doJailbreak super.path-io;
 
-
-  ormolu = self.ormolu_0_5_0_1;
-  fourmolu = dontCheck self.fourmolu_0_9_0_0;
   hlint = self.hlint_3_4_1;
-  stylish-haskell = doJailbreak self.stylish-haskell_0_14_3_0;
 
   mime-string = disableOptimization super.mime-string;
 
diff --git a/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix b/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
index 7d71328bdc23..c6b48129b6b4 100644
--- a/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.6.x.nix
@@ -8,7 +8,8 @@ in
 
 self: super: {
 
-  llvmPackages = pkgs.lib.dontRecurseIntoAttrs self.ghc.llvmPackages;
+  # Should be llvmPackages_6 which has been removed from nixpkgs
+  llvmPackages = null;
 
   # Disable GHC 8.6.x core libraries.
   array = null;
@@ -49,6 +50,9 @@ self: super: {
 
   # Need the Cabal-syntax-3.6.0.0 fake package for Cabal < 3.8 to allow callPackage and the constraint solver to work
   Cabal-syntax = self.Cabal-syntax_3_6_0_0;
+  # These core package only exist for GHC >= 9.4. The best we can do is feign
+  # their existence to callPackages, but their is no shim for lower GHC versions.
+  system-cxx-std-lib = null;
 
   # Needs Cabal 3.0.x.
   jailbreak-cabal = super.jailbreak-cabal.overrideScope (cself: _: { Cabal = cself.Cabal_3_2_1_0; });
@@ -91,7 +95,7 @@ self: super: {
   ghc-lib-parser-ex = addBuildDepend self.ghc-lib-parser super.ghc-lib-parser-ex;
 
   # This became a core library in ghc 8.10., so we don’t have an "exception" attribute anymore.
-  exceptions = super.exceptions_0_10_4;
+  exceptions = null;
 
   # Older compilers need the latest ghc-lib to build this package.
   hls-hlint-plugin = addBuildDepend self.ghc-lib super.hls-hlint-plugin;
diff --git a/pkgs/development/libraries/gtksourceview/4.x.nix b/pkgs/development/libraries/gtksourceview/4.x.nix
index e824e1ed9c67..df66d4b9eb72 100644
--- a/pkgs/development/libraries/gtksourceview/4.x.nix
+++ b/pkgs/development/libraries/gtksourceview/4.x.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch2
 , meson
 , ninja
 , pkg-config
@@ -40,6 +41,19 @@ stdenv.mkDerivation (finalAttrs: {
     # but not from its own datadr (it assumes it will be in XDG_DATA_DIRS).
     # Since this is not generally true with Nix, let’s add $out/share unconditionally.
     ./4.x-nix_share_path.patch
+
+    # nix.lang: Add Nix syntax highlighting
+    # https://gitlab.gnome.org/GNOME/gtksourceview/-/merge_requests/303
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/gtksourceview/-/commit/685b3bd08869c2aefe33fad696a7f5f2dc831016.patch";
+      hash = "sha256-yeYXJ2l/QS857C4UXOnMFyh0JsptA0TQt0lfD7wN5ic=";
+    })
+
+    # nix.lang: fix section name
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/gtksourceview/-/commit/1dbbb01da98140e0b2d5d0c6c2df29247650ed83.patch";
+      hash = "sha256-6HxLKQyI5DDvmKhmldQlwVPV62RfFa2gwWbcHA2cICs=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libsoup/3.x.nix b/pkgs/development/libraries/libsoup/3.x.nix
index 60b7d2f38321..6d1545af4079 100644
--- a/pkgs/development/libraries/libsoup/3.x.nix
+++ b/pkgs/development/libraries/libsoup/3.x.nix
@@ -8,7 +8,6 @@
 , gnome
 , libsysprof-capture
 , sqlite
-, glib-networking
 , buildPackages
 , gobject-introspection
 , withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
@@ -93,9 +92,6 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    propagatedUserEnvPackages = [
-      glib-networking.out
-    ];
     updateScript = gnome.updateScript {
       attrPath = "libsoup_3";
       packageName = pname;
diff --git a/pkgs/development/libraries/libsoup/default.nix b/pkgs/development/libraries/libsoup/default.nix
index 6d5b0183cdda..11e1a5a40f1e 100644
--- a/pkgs/development/libraries/libsoup/default.nix
+++ b/pkgs/development/libraries/libsoup/default.nix
@@ -14,7 +14,6 @@
 , brotli
 , gnomeSupport ? true
 , sqlite
-, glib-networking
 , buildPackages
 , withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 }:
@@ -85,9 +84,6 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    propagatedUserEnvPackages = [
-      glib-networking.out
-    ];
     updateScript = gnome.updateScript {
       packageName = pname;
       versionPolicy = "odd-unstable";
diff --git a/pkgs/development/libraries/mlib/default.nix b/pkgs/development/libraries/mlib/default.nix
index 1960d1e8a202..f3415adadf74 100644
--- a/pkgs/development/libraries/mlib/default.nix
+++ b/pkgs/development/libraries/mlib/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlib";
-  version = "0.7.0";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "P-p-H-d";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-obQD3TWuGCAs5agnaiJF5Rasn8J283H/cdvKCCAzcB8=";
+    hash = "sha256-wt/wLtvAZ19ZiLIjPrKbqVztLyXEa8hy6cEkaCO+tuY=";
   };
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "PREFIX=$(out)" ];
diff --git a/pkgs/development/libraries/redis-plus-plus/default.nix b/pkgs/development/libraries/redis-plus-plus/default.nix
index 529bf73351ec..03a5c9ba3308 100644
--- a/pkgs/development/libraries/redis-plus-plus/default.nix
+++ b/pkgs/development/libraries/redis-plus-plus/default.nix
@@ -8,13 +8,13 @@ assert enableShared || enableStatic;
 
 stdenv.mkDerivation rec {
   pname = "redis-plus-plus";
-  version = "1.3.10";
+  version = "1.3.11";
 
   src = fetchFromGitHub {
     owner = "sewenew";
     repo = "redis-plus-plus";
     rev = version;
-    sha256 = "sha256-lupS4WoJ4r0Vsh3sEGSuka0TtEBo2FPX2eks2blqRGk=";
+    sha256 = "sha256-ZALnF2h+9LSeh1OA33fdVyT0PYcGen5j+qsufBv5t5I=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/trompeloeil/default.nix b/pkgs/development/libraries/trompeloeil/default.nix
index 9df3196ee1fe..1a2ec33dae5f 100644
--- a/pkgs/development/libraries/trompeloeil/default.nix
+++ b/pkgs/development/libraries/trompeloeil/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "trompeloeil";
-  version = "46";
+  version = "47";
 
   src = fetchFromGitHub {
     owner = "rollbear";
     repo = "trompeloeil";
     rev = "v${version}";
-    sha256 = "sha256-x/Chzho6RTfyOb/Is7bAM8KrvipEqQ/+a6pVCuTG108=";
+    sha256 = "sha256-eVMlepthJuy9BQnR2u8PFSfuWNg8QxDOJyV5qzcztOE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/gspread/default.nix b/pkgs/development/python-modules/gspread/default.nix
index fa68122dcb13..6f107cc610a0 100644
--- a/pkgs/development/python-modules/gspread/default.nix
+++ b/pkgs/development/python-modules/gspread/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "gspread";
-  version = "5.12.3";
+  version = "5.12.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "burnash";
     repo = "gspread";
     rev = "refs/tags/v${version}";
-    hash = "sha256-NmIWGHS40VOUL3IGSR/SW9inbSQFv+2UDgo1FZWROHI=";
+    hash = "sha256-i+QbnF0Y/kUMvt91Wzb8wseO/1rZn9xzeA5BWg1haks=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mdformat-mkdocs/default.nix b/pkgs/development/python-modules/mdformat-mkdocs/default.nix
index 9052c67be207..b35a1eb348b5 100644
--- a/pkgs/development/python-modules/mdformat-mkdocs/default.nix
+++ b/pkgs/development/python-modules/mdformat-mkdocs/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "mdformat-mkdocs";
-  version = "1.1.0";
+  version = "1.1.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "KyleKing";
     repo = "mdformat-mkdocs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5MCsXCkYnoLEZZoj9WrO/Z3VzTKagoOrMCuTpA4dGAQ=";
+    hash = "sha256-GUSoGx4cwhjQO4AiC9s0YIcK3N/Gr+PrYR3+B8G9CoQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/sanic-routing/default.nix b/pkgs/development/python-modules/sanic-routing/default.nix
index c9402b30b125..f0e09c73862f 100644
--- a/pkgs/development/python-modules/sanic-routing/default.nix
+++ b/pkgs/development/python-modules/sanic-routing/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "sanic-routing";
-  version = "23.6.0";
+  version = "23.12.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "sanic-org";
     repo = "sanic-routing";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ual/vjL3M/nqlaRttJPoBcOYE3L/OAahbBLceUEVLXc=";
+    hash = "sha256-IUubPd6mqtCfY4ruI/8wkFcAcS0xXHWbe9RzDac5kRc=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/unidata-blocks/default.nix b/pkgs/development/python-modules/unidata-blocks/default.nix
index cded041c46b8..1275543088d3 100644
--- a/pkgs/development/python-modules/unidata-blocks/default.nix
+++ b/pkgs/development/python-modules/unidata-blocks/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "unidata-blocks";
-  version = "0.0.8";
+  version = "0.0.9";
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     pname = "unidata_blocks";
     inherit version;
-    hash = "sha256-Y7OSFuPHgzNc/KtmBWwdVqH7Xy4v4w2UGHBUF9pIuSU=";
+    hash = "sha256-OuIhajgUyO5qdcxJCO06Q1xNbeSNGzlbaWnAqXORm9g=";
   };
 
   format = "pyproject";
diff --git a/pkgs/development/python2-modules/attrs/default.nix b/pkgs/development/python2-modules/attrs/default.nix
index 4b10f4203e8b..f4b4b505721f 100644
--- a/pkgs/development/python2-modules/attrs/default.nix
+++ b/pkgs/development/python2-modules/attrs/default.nix
@@ -32,10 +32,6 @@ buildPythonPackage rec {
   # Instead, we do this as a passthru.tests test.
   doCheck = false;
 
-  passthru.tests = {
-    pytest = callPackage ./tests.nix { };
-  };
-
   meta = with lib; {
     description = "Python attributes without boilerplate";
     homepage = "https://github.com/hynek/attrs";
diff --git a/pkgs/development/tools/misc/act/default.nix b/pkgs/development/tools/misc/act/default.nix
index f4540cdacc63..5a22531dbcf5 100644
--- a/pkgs/development/tools/misc/act/default.nix
+++ b/pkgs/development/tools/misc/act/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "act";
-  version = "0.2.56";
+  version = "0.2.57";
 
   src = fetchFromGitHub {
     owner = "nektos";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Lco14Zwnad9AlujmPwhT5zRhsrifbQ3oi0AftjqsUQk=";
+    hash = "sha256-lof3PWscGHQ9ZTF83wGyG0jMebYY2xec+HouQezr2d8=";
   };
 
-  vendorHash = "sha256-rQCxRUIzTJtL8gC9nYV+HKzB7hozyR24TCb+1y/qKM4=";
+  vendorHash = "sha256-7nvUs1R2jybh+PR/cHml8lR5jU25b2liPKLH47WDVxQ=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/misc/fzf-make/default.nix b/pkgs/development/tools/misc/fzf-make/default.nix
index c46419dda732..6e8f7ff45070 100644
--- a/pkgs/development/tools/misc/fzf-make/default.nix
+++ b/pkgs/development/tools/misc/fzf-make/default.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fzf-make";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "kyu08";
     repo = "fzf-make";
     rev = "v${version}";
-    hash = "sha256-0fzc18OWCkGiSNNyZgtkv0J3n8C3L/w8UC7ejqt6efs=";
+    hash = "sha256-M7xoHYbBvMVipw19WOQ1f8knqob7+eS4eBNTMvPZhDI=";
   };
 
-  cargoHash = "sha256-GwqfH5NSJu6kNKg4aa7a+eqZf79JBdF9LxRa207Krwo=";
+  cargoHash = "sha256-JKxq4AIezuBsnrIIjqEIywZeq/GzAy1tPbzjlxpvvGQ=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
diff --git a/pkgs/development/tools/misc/pwninit/default.nix b/pkgs/development/tools/misc/pwninit/default.nix
index b1df19f2441b..92cfa6f4fcb0 100644
--- a/pkgs/development/tools/misc/pwninit/default.nix
+++ b/pkgs/development/tools/misc/pwninit/default.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pwninit";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "io12";
     repo = "pwninit";
     rev = version;
-    sha256 = "sha256-Tskbwavr+MFa8wmwaFGe7o4/6ZpZqczzwOnqFR66mmM=";
+    sha256 = "sha256-tbZS7PdRFvO2ifoHA/w3cSPfqqHrLeLHAg6V8oG9gVE=";
   };
 
   buildInputs = [ openssl xz ] ++ lib.optionals stdenv.isDarwin [ Security ];
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {
   '';
   doCheck = false; # there are no tests to run
 
-  cargoSha256 = "sha256-LPypmFeF9NZOX1ogpIqc++Pun7pInKzpxYiGUvSUcso=";
+  cargoHash = "sha256-J2uQoqStBl+qItaXWi17H/IailZ7P4YzhLNs17BY92Q=";
 
   meta = {
     description = "Automate starting binary exploit challenges";
diff --git a/pkgs/development/tools/rust/cargo-tally/default.nix b/pkgs/development/tools/rust/cargo-tally/default.nix
index 65bc7de80884..1f5718e38898 100644
--- a/pkgs/development/tools/rust/cargo-tally/default.nix
+++ b/pkgs/development/tools/rust/cargo-tally/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tally";
-  version = "1.0.32";
+  version = "1.0.33";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-sbSGqVH0pEFhNhIBu/RzrkEViN4ilEJbgYQEtxU986E=";
+    hash = "sha256-8tOADZV1Kz9o+1fEMOH8/ZX7Fj4uxTdHV5xoa6DXzwM=";
   };
 
-  cargoHash = "sha256-VMFPWAdOeAYsr0tdlSxtYsahEm/8K0L25lOfPG0P+uU=";
+  cargoHash = "sha256-hvVDnBD4MI+yzG/vCGhMlOHZRLYiAsCKZDD5tPaaPhg=";
 
   buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk_11_0.frameworks; [
     DiskArbitration
diff --git a/pkgs/games/prismlauncher/default.nix b/pkgs/games/prismlauncher/default.nix
index 2409794cdfdc..c6378fbc368f 100644
--- a/pkgs/games/prismlauncher/default.nix
+++ b/pkgs/games/prismlauncher/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontWrapQtApps = true;
 
-  meta = with lib; {
+  meta = {
     mainProgram = "prismlauncher";
     homepage = "https://prismlauncher.org/";
     description = "A free, open source launcher for Minecraft";
@@ -78,9 +78,9 @@ stdenv.mkDerivation (finalAttrs: {
       their own mods, texture packs, saves, etc) and helps you manage them and
       their associated options with a simple interface.
     '';
-    platforms = with platforms; linux ++ darwin;
-    changelog = "https://github.com/PrismLauncher/PrismLauncher/releases/tag/${version}";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ minion3665 Scrumplex getchoo ];
+    platforms = with lib.platforms; linux ++ darwin;
+    changelog = "https://github.com/PrismLauncher/PrismLauncher/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ minion3665 Scrumplex getchoo ];
   };
 })
diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index b3ce65abf5f1..ac521f59634f 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -4,7 +4,7 @@ outer@{ lib, stdenv, fetchurl, fetchpatch, openssl, zlib, pcre, libxml2, libxslt
 , nixosTests
 , installShellFiles, substituteAll, removeReferencesTo, gd, geoip, perl
 , withDebug ? false
-, withKTLS ? false
+, withKTLS ? true
 , withStream ? true
 , withMail ? false
 , withPerl ? true
diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix
index 971c1e28cdb0..87cd8e4c53e3 100644
--- a/pkgs/servers/http/openresty/default.nix
+++ b/pkgs/servers/http/openresty/default.nix
@@ -11,11 +11,11 @@
 callPackage ../nginx/generic.nix args rec {
   pname = "openresty";
   nginxVersion = "1.21.4";
-  version = "${nginxVersion}.1";
+  version = "${nginxVersion}.3";
 
   src = fetchurl {
     url = "https://openresty.org/download/openresty-${version}.tar.gz";
-    sha256 = "sha256-DFCTtk94IehQZcmeXU5swxggz9fze5oN7IQgnYeir5k=";
+    sha256 = "sha256-M6hMY8/Z5GsOXGLrLdx7gGi9ouFoYxQ0O4n8P/0kzdM=";
   };
 
   # generic.nix applies fixPatch on top of every patch defined there.
diff --git a/pkgs/servers/web-apps/freshrss/default.nix b/pkgs/servers/web-apps/freshrss/default.nix
index 3c2c27a9e956..639a9a780c62 100644
--- a/pkgs/servers/web-apps/freshrss/default.nix
+++ b/pkgs/servers/web-apps/freshrss/default.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "FreshRSS";
-  version = "1.23.0";
+  version = "1.23.1";
 
   src = fetchFromGitHub {
     owner = "FreshRSS";
     repo = "FreshRSS";
     rev = version;
-    hash = "sha256-X7MYPn1OFmzMWGGlZZ67EHEaRJRKGrdnw6nCzuUfbgU=";
+    hash = "sha256-uidTsL8TREZ/qcqO/J+6hguP6Dr6J+995WNWCJCduBw=";
   };
 
   passthru.tests = {
diff --git a/pkgs/tools/admin/aliyun-cli/default.nix b/pkgs/tools/admin/aliyun-cli/default.nix
index 970d7f8933dc..323be3bfe07f 100644
--- a/pkgs/tools/admin/aliyun-cli/default.nix
+++ b/pkgs/tools/admin/aliyun-cli/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.190";
+  version = "3.0.191";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aliyun";
     repo = pname;
     fetchSubmodules = true;
-    sha256 = "sha256-16mHIvrXtFHmH6Uc2qcBTSltuHDs5jfZ2+hHvUpOjOQ=";
+    sha256 = "sha256-8BYp4bE9dXCKPngc4fzr6Vo10LF+TVPBaRTFhiICuu8=";
   };
 
   vendorHash = "sha256-ZcW0Ab7uPx8XUpo3tSSt2eKjUlRlbiMvrLGJK2StKf8=";
diff --git a/pkgs/tools/misc/plocate/default.nix b/pkgs/tools/misc/plocate/default.nix
index 2a55841d7e53..8cc8b9b6b801 100644
--- a/pkgs/tools/misc/plocate/default.nix
+++ b/pkgs/tools/misc/plocate/default.nix
@@ -10,12 +10,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "plocate";
-  version = "1.1.19";
+  version = "1.1.20";
 
   src = fetchgit {
     url = "https://git.sesse.net/plocate";
     rev = version;
-    sha256 = "sha256-Vf/NgUPDL3KWMpjnyB2QR2sU6rQfPIADNU6OlpN+O0M=";
+    sha256 = "sha256-Nc39wPVW+GpmT8X8q/VbrPhPxO/PgFBPTOCWAkkUfDY=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/rtx/default.nix b/pkgs/tools/misc/rtx/default.nix
index 038c08eabb42..78d5f654d181 100644
--- a/pkgs/tools/misc/rtx/default.nix
+++ b/pkgs/tools/misc/rtx/default.nix
@@ -11,6 +11,8 @@
 , direnv
 , Security
 , SystemConfiguration
+, rtx
+, testers
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,7 +29,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-LvW5xGVggzuXlFPhbrc93Dht3S9zaQyx9Nm+Mx/Mjh0=";
 
   nativeBuildInputs = [ installShellFiles pkg-config ];
-  buildInputs = [ openssl  ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
 
   postPatch = ''
     patchShebangs --build ./test/data/plugins/**/bin/* ./src/fake_asdf.rs ./src/cli/reshim.rs
@@ -59,6 +61,7 @@ rustPlatform.buildRustPackage rec {
 
   passthru = {
     updateScript = nix-update-script { };
+    tests.version = testers.testVersion { package = rtx; };
   };
 
   meta = {
diff --git a/pkgs/tools/security/ghidra/build.nix b/pkgs/tools/security/ghidra/build.nix
index 50fd64656f4a..da164c94b0b5 100644
--- a/pkgs/tools/security/ghidra/build.nix
+++ b/pkgs/tools/security/ghidra/build.nix
@@ -16,13 +16,13 @@
 let
   pkg_path = "$out/lib/ghidra";
   pname = "ghidra";
-  version = "10.4";
+  version = "11.0";
 
   src = fetchFromGitHub {
     owner = "NationalSecurityAgency";
     repo = "Ghidra";
     rev = "Ghidra_${version}_build";
-    hash = "sha256-g0JM6pm1vkCh9yBB5mfrOiNrImqoyWdQcEe2g+AO6LQ=";
+    hash = "sha256-LVtDqgceZUrMriNy6+yK/ruBrTI8yx6hzTaPa1BTGlc=";
   };
 
   gradle = gradle_7;
@@ -92,7 +92,7 @@ HERE
     '';
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "sha256-HveS3f8XHpJqefc4djYmnYfd01H2OBFK5PLNOsHAqlc=";
+    outputHash = "sha256-KT+XXowCNaNfOiPzYLwbPMaF84omKFobHkkNqZ6oyUA=";
   };
 
 in stdenv.mkDerivation {
@@ -124,6 +124,8 @@ in stdenv.mkDerivation {
 
     sed -i "s#mavenLocal()#mavenLocal(); maven { url '${deps}/maven' }#g" build.gradle
 
+    rm -v Ghidra/Debug/Debugger-rmi-trace/build.gradle.orig
+
     gradle --offline --no-daemon --info -Dorg.gradle.java.home=${openjdk17} buildGhidra
   '';
 
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index 0d35206b82f6..d29f17679c85 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -5,7 +5,7 @@
 
 buildGoModule rec {
   pname = "keybase";
-  version = "6.2.3";
+  version = "6.2.4";
 
   modRoot = "go";
   subPackages = [ "kbnm" "keybase" ];
@@ -16,7 +16,7 @@ buildGoModule rec {
     owner = "keybase";
     repo = "client";
     rev = "v${version}";
-    hash = "sha256-uZIoFivyFqC+AeFTJaEw2BbP7qoOVF8gtSIdUStxsHU=";
+    hash = "sha256-z7vpCUK+NU7xU9sNBlQnSy9sjXD7/m8jSRKfJAgyyN8=";
   };
   vendorHash = "sha256-tXEEVEfjoKub2A4m7F3hDc5ABJ+R+axwX1+1j7e3BAM=";
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a509bf8a4995..d4778d42ec69 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -40820,9 +40820,7 @@ with pkgs;
 
   rucksack = callPackage ../development/tools/rucksack { };
 
-  ruff = callPackage ../development/tools/ruff {
-    inherit (python3.pkgs) ruff-lsp;
-  };
+  ruff = callPackage ../development/tools/ruff { };
 
   sam-ba = callPackage ../tools/misc/sam-ba { };