diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a0569f44c06e..6b8060fcb292 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6839,6 +6839,12 @@
       fingerprint = "B722 6464 838F 8BDB 2BEA  C8C8 5B0E FDDF BA81 6105";
     }];
   };
+  Forden = {
+    email = "forden@zuku.tech";
+    github = "Forden";
+    githubId = 24463229;
+    name = "Forden";
+  };
   forkk = {
     email = "forkk@forkk.net";
     github = "Forkk";
diff --git a/nixos/doc/manual/development/option-declarations.section.md b/nixos/doc/manual/development/option-declarations.section.md
index 325f4d11cb08..ee4540d0cf6f 100644
--- a/nixos/doc/manual/development/option-declarations.section.md
+++ b/nixos/doc/manual/development/option-declarations.section.md
@@ -173,7 +173,7 @@ lib.mkOption {
 
 ## Extensible Option Types {#sec-option-declarations-eot}
 
-Extensible option types is a feature that allow to extend certain types
+Extensible option types is a feature that allows to extend certain types
 declaration through multiple module files. This feature only work with a
 restricted set of types, namely `enum` and `submodules` and any composed
 forms of them.
diff --git a/nixos/modules/programs/yazi.nix b/nixos/modules/programs/yazi.nix
index 5905f2afb946..d9f38d8d8118 100644
--- a/nixos/modules/programs/yazi.nix
+++ b/nixos/modules/programs/yazi.nix
@@ -5,7 +5,7 @@ let
 
   settingsFormat = pkgs.formats.toml { };
 
-  names = [ "yazi" "theme" "keymap" ];
+  files = [ "yazi" "theme" "keymap" ];
 in
 {
   options.programs.yazi = {
@@ -15,7 +15,7 @@ in
 
     settings = lib.mkOption {
       type = with lib.types; submodule {
-        options = lib.listToAttrs (map
+        options = (lib.listToAttrs (map
           (name: lib.nameValuePair name (lib.mkOption {
             inherit (settingsFormat) type;
             default = { };
@@ -25,26 +25,65 @@ in
               See https://yazi-rs.github.io/docs/configuration/${name}/ for documentation.
             '';
           }))
-          names);
+          files));
       };
       default = { };
       description = ''
         Configuration included in `$YAZI_CONFIG_HOME`.
       '';
     };
+
+    initLua = lib.mkOption {
+      type = with lib.types; nullOr path;
+      default = null;
+      description = ''
+        The init.lua for Yazi itself.
+      '';
+      example = lib.literalExpression "./init.lua";
+    };
+
+    plugins = lib.mkOption {
+      type = with lib.types; attrsOf (oneOf [ path package ]);
+      default = { };
+      description = ''
+        Lua plugins.
+
+        See https://yazi-rs.github.io/docs/plugins/overview/ for documentation.
+      '';
+      example = lib.literalExpression ''
+        {
+          foo = ./foo;
+          bar = pkgs.bar;
+        }
+      '';
+    };
+
+    flavors = lib.mkOption {
+      type = with lib.types; attrsOf (oneOf [ path package ]);
+      default = { };
+      description = ''
+        Pre-made themes.
+
+        See https://yazi-rs.github.io/docs/flavors/overview/ for documentation.
+      '';
+      example = lib.literalExpression ''
+        {
+          foo = ./foo;
+          bar = pkgs.bar;
+        }
+      '';
+    };
+
   };
 
   config = lib.mkIf cfg.enable {
-    environment = {
-      systemPackages = [ cfg.package ];
-      variables.YAZI_CONFIG_HOME = "/etc/yazi/";
-      etc = lib.attrsets.mergeAttrsList (map
-        (name: lib.optionalAttrs (cfg.settings.${name} != { }) {
-          "yazi/${name}.toml".source = settingsFormat.generate "${name}.toml" cfg.settings.${name};
-        })
-        names);
-    };
+    environment.systemPackages = [
+      (cfg.package.override {
+        inherit (cfg) settings initLua plugins flavors;
+      })
+    ];
   };
+
   meta = {
     maintainers = with lib.maintainers; [ linsui ];
   };
diff --git a/nixos/tests/kernel-generic.nix b/nixos/tests/kernel-generic.nix
index 5f0e7b3e37cd..07e15a380b6d 100644
--- a/nixos/tests/kernel-generic.nix
+++ b/nixos/tests/kernel-generic.nix
@@ -31,6 +31,7 @@ let
       linux_5_15_hardened
       linux_6_1_hardened
       linux_6_6_hardened
+      linux_6_8_hardened
       linux_rt_5_4
       linux_rt_5_10
       linux_rt_5_15
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-aws.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-aws.nix
index 78b9bc879aaa..44671b0809ed 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-aws.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixops-aws.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage {
   pname = "nixops-aws";
-  version = "unstable-2024-02-29";
+  version = "1.0.0-unstable-2024-02-29";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -45,7 +45,9 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "nixops_aws" ];
 
-  passthru.updateScript = unstableGitUpdater {};
+  passthru.updateScript = unstableGitUpdater {
+    tagPrefix = "v";
+  };
 
   meta = with lib; {
     description = "AWS plugin for NixOps";
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-digitalocean.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-digitalocean.nix
index f3f62e940729..094f493dbb72 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-digitalocean.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixops-digitalocean.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage {
   pname = "nixops-digitalocean";
-  version = "unstable-2022-08-14";
+  version = "0.1.0-unstable-2022-08-14";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-encrypted-links.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-encrypted-links.nix
index 0dddf771bd51..817da055d634 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-encrypted-links.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixops-encrypted-links.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage {
   pname = "nixops-encrypted-links";
-  version = "unstable-2021-02-16";
+  version = "0-unstable-2021-02-16";
   pyproject = true;
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-gce.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-gce.nix
index 604e82114bad..84b785a7d566 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-gce.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixops-gce.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage {
   pname = "nixops-gce";
-  version = "unstable-2023-05-26";
+  version = "0-unstable-2023-05-26";
   pyproject = true;
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-hercules-ci.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-hercules-ci.nix
index 90ed88edfa0e..04044b94da0f 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-hercules-ci.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixops-hercules-ci.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage {
   pname = "nixops-hercules-ci";
-  version = "unstable-2021-10-06";
+  version = "0-unstable-2021-10-06";
   pyproject = true;
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetzner.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetzner.nix
index c4d037fe75f5..6d883f5ba45f 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetzner.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetzner.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage {
   pname = "nixops-hetzner";
-  version = "unstable-2022-04-23";
+  version = "1.0.1-unstable-2022-04-24";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -43,7 +43,9 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "nixops_hetzner" ];
 
-  passthru.updateScript = unstableGitUpdater {};
+  passthru.updateScript = unstableGitUpdater {
+    tagPrefix = "v";
+  };
 
   meta = with lib; {
     description = "Hetzner bare metal NixOps plugin";
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetznercloud.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetznercloud.nix
index 17e94ab9f32b..ab9f54bcd8a3 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetznercloud.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixops-hetznercloud.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage {
   pname = "nixops-hetznercloud";
-  version = "unstable-2023-02-19";
+  version = "0-unstable-2023-02-19";
   pyproject = true;
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-libvirtd.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-libvirtd.nix
index b3439bf4fe52..4fec552e528c 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-libvirtd.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixops-libvirtd.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage {
   pname = "nixops-libvirtd";
-  version = "unstable-2023-09-01";
+  version = "1.0.0-unstable-2023-09-01";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -39,7 +39,9 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "nixops_virtd" ];
 
-  passthru.updateScript = unstableGitUpdater {};
+  passthru.updateScript = unstableGitUpdater {
+    tagPrefix = "v";
+  };
 
   meta = with lib; {
     description = "NixOps libvirtd backend plugin";
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixops-vbox.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixops-vbox.nix
index 4a9f0351094c..3d712e5c2397 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixops-vbox.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixops-vbox.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage {
   pname = "nixops-vbox";
-  version = "unstable-2023-08-10";
+  version = "1.0.0-unstable-2023-08-10";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -34,7 +34,9 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "nixopsvbox" ];
 
-  passthru.updateScript = unstableGitUpdater {};
+  passthru.updateScript = unstableGitUpdater {
+    tagPrefix = "v";
+  };
 
   meta = with lib; {
     description = "NixOps plugin for VirtualBox VMs";
diff --git a/pkgs/applications/networking/cluster/nixops/plugins/nixos-modules-contrib.nix b/pkgs/applications/networking/cluster/nixops/plugins/nixos-modules-contrib.nix
index 5c6e9fec32cf..494208d347f0 100644
--- a/pkgs/applications/networking/cluster/nixops/plugins/nixos-modules-contrib.nix
+++ b/pkgs/applications/networking/cluster/nixops/plugins/nixos-modules-contrib.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage {
   pname = "nixos-modules-contrib";
-  version = "unstable-2021-01-20";
+  version = "0-unstable-2021-01-20";
   pyproject = true;
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/networking/cluster/nixops/unwrapped.nix b/pkgs/applications/networking/cluster/nixops/unwrapped.nix
index 058f7f2d2c1c..a435c70520ef 100644
--- a/pkgs/applications/networking/cluster/nixops/unwrapped.nix
+++ b/pkgs/applications/networking/cluster/nixops/unwrapped.nix
@@ -13,7 +13,7 @@
 
 buildPythonApplication rec {
   pname = "nixops";
-  version = "unstable-2024-02-28";
+  version = "1.7-unstable-2024-02-28";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -51,7 +51,9 @@ buildPythonApplication rec {
 
   passthru = {
     tests.nixos = nixosTests.nixops.unstable;
-    updateScript = unstableGitUpdater {};
+    updateScript = unstableGitUpdater {
+      tagPrefix = "v";
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/mullvad-vpn/default.nix b/pkgs/applications/networking/mullvad-vpn/default.nix
index 6c3f30266e14..7e98a66bdf7d 100644
--- a/pkgs/applications/networking/mullvad-vpn/default.nix
+++ b/pkgs/applications/networking/mullvad-vpn/default.nix
@@ -122,6 +122,9 @@ stdenv.mkDerivation {
     wrapProgram $out/bin/mullvad-daemon \
         --set-default MULLVAD_RESOURCE_DIR "$out/share/mullvad/resources"
 
+    wrapProgram $out/bin/mullvad-gui \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+
     sed -i "s|Exec.*$|Exec=$out/bin/mullvad-vpn $U|" $out/share/applications/mullvad-vpn.desktop
 
     runHook postInstall
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
index 3a2920785fcd..6a2721b8dab9 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/default.nix
@@ -8,27 +8,29 @@
 , ninja
 , binutils
 , cairo
+, epoll-shim
 , git
 , hyprcursor
 , hyprland-protocols
 , hyprlang
+, hyprwayland-scanner
 , jq
 , libGL
 , libdrm
 , libexecinfo
 , libinput
-, libxcb
+, libuuid
 , libxkbcommon
 , mesa
 , pango
 , pciutils
+, pkgconf
 , python3
 , systemd
 , tomlplusplus
 , wayland
 , wayland-protocols
 , wayland-scanner
-, xcbutilwm
 , xwayland
 , hwdata
 , seatd
@@ -51,30 +53,28 @@ assert lib.assertMsg (!hidpiXWayland) "The option `hidpiXWayland` has been remov
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + lib.optionalString debug "-debug";
-  version = "0.39.1";
+  version = "0.40.0-unstable-2024-05-12";
+
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = finalAttrs.pname;
     fetchSubmodules = true;
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-7L5rqQRYH2iyyP5g3IdXJSlATfgnKhuYMf65E48MVKw=";
+    rev = "2ccd45a84475fab46c6fecd2fe226d3173104743";
+    hash = "sha256-nBCQuRl4sS/G/OUS+txeelFShBEgSk2OrN6kBYMHuOg=";
   };
 
   postPatch = ''
     # Fix hardcoded paths to /usr installation
     sed -i "s#/usr#$out#" src/render/OpenGL.cpp
 
-    # Generate version.h
-    cp src/version.h.in src/version.h
-    substituteInPlace src/version.h \
-      --replace-fail "@HASH@" '${finalAttrs.src.rev}' \
-      --replace-fail "@BRANCH@" "" \
-      --replace-fail "@MESSAGE@" "" \
-      --replace-fail "@DATE@" "2024-04-16" \
-      --replace-fail "@TAG@" "" \
-      --replace-fail "@DIRTY@" ""
+    # Remove extra @PREFIX@ to fix pkg-config paths
+    sed -i "s#@PREFIX@/##g" hyprland.pc.in
   '';
 
+  # used by version.sh
+  DATE = "2024-05-12";
+  HASH = finalAttrs.src.rev;
+
   depsBuildBuild = [
     # to find wayland-scanner when cross-compiling
     pkg-config
@@ -82,14 +82,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     hwdata
+    hyprwayland-scanner
     jq
     makeWrapper
-    meson
+    cmake
+    meson # for wlroots
     ninja
     pkg-config
     wayland-scanner
-    cmake # for subproject udis86
-    python3
+    python3 # for udis86
   ];
 
   outputs = [
@@ -107,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
     libGL
     libdrm
     libinput
+    libuuid
     libxkbcommon
     mesa
     wayland
@@ -121,27 +123,33 @@ stdenv.mkDerivation (finalAttrs: {
     xorg.xcbutilerrors
     xorg.xcbutilrenderutil
   ]
+  ++ lib.optionals stdenv.hostPlatform.isBSD [ epoll-shim ]
   ++ lib.optionals stdenv.hostPlatform.isMusl [ libexecinfo ]
-  ++ lib.optionals enableXWayland [ libxcb xcbutilwm xwayland ]
+  ++ lib.optionals enableXWayland [
+    xorg.libxcb
+    xorg.libXdmcp
+    xorg.xcbutil
+    xorg.xcbutilwm
+    xwayland
+  ]
   ++ lib.optionals withSystemd [ systemd ];
 
-  mesonBuildType =
+  cmakeBuildType =
     if debug
-    then "debug"
-    else "release";
+    then "Debug"
+    else "RelWithDebInfo";
 
-  mesonAutoFeatures = "enabled";
 
-  mesonFlags = [
-    (lib.mesonEnable "xwayland" enableXWayland)
-    (lib.mesonEnable "legacy_renderer" legacyRenderer)
-    (lib.mesonEnable "systemd" withSystemd)
+  cmakeFlags = [
+    (lib.cmakeBool "NO_XWAYLAND" (!enableXWayland))
+    (lib.cmakeBool "LEGACY_RENDERER" legacyRenderer)
+    (lib.cmakeBool "NO_SYSTEMD" (!withSystemd))
   ];
 
   postInstall = ''
     ${lib.optionalString wrapRuntimeDeps ''
       wrapProgram $out/bin/Hyprland \
-        --suffix PATH : ${lib.makeBinPath [binutils pciutils stdenv.cc]}
+        --suffix PATH : ${lib.makeBinPath [binutils pciutils pkgconf]}
     ''}
   '';
 
diff --git a/pkgs/by-name/ca/cargo-features-manager/package.nix b/pkgs/by-name/ca/cargo-features-manager/package.nix
new file mode 100644
index 000000000000..3d8947ce3031
--- /dev/null
+++ b/pkgs/by-name/ca/cargo-features-manager/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-features-manager";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "ToBinio";
+    repo = "cargo-features-manager";
+    rev = "v${version}";
+    hash = "sha256-ez8WIDHV6/f0Kk6cvzB25LoYBPT+JTzmOWrSxXXzpBc=";
+  };
+
+  cargoHash = "sha256-G1MBH4c9b/h87QgCleTMnndjWc70KZI+6W4KWaxk28o=";
+
+  meta = {
+    description = "A command-line tool for managing Architectural Decision Records";
+    homepage = "https://github.com/ToBinio/cargo-features-manager";
+    changelog = "https://github.com/ToBinio/cargo-features-manager/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ luftmensch-luftmensch ];
+    mainProgram = "cargo-features-manager";
+  };
+}
diff --git a/pkgs/by-name/co/consul/package.nix b/pkgs/by-name/co/consul/package.nix
index 1a5eb769016d..edc3db672bd6 100644
--- a/pkgs/by-name/co/consul/package.nix
+++ b/pkgs/by-name/co/consul/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.18.1";
+  version = "1.18.2";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
   # vendored. See
@@ -22,7 +22,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-r1xdz1rjvbvB93hRpvTNQwSqQLOJwqMhqCiXdIttY10=";
+    hash = "sha256-9feeWsCAZKip+AYUJTCcqFOTfxsUFMzTRqHjo/Pptho=";
   };
 
   # This corresponds to paths with package main - normally unneeded but consul
@@ -32,7 +32,7 @@ buildGoModule rec {
     "connect/certgen"
   ];
 
-  vendorHash = "sha256-DcpEHJ88Ehz5m+ddMd44mYTz0agwYhoels5jWJzu1EM=";
+  vendorHash = "sha256-bBc3qgPUOmR8c/sFyiskePKLKjHTQcWVTLY6esFIRTc=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ek/eksctl/package.nix b/pkgs/by-name/ek/eksctl/package.nix
index b749c561eeac..e012e298dbe0 100644
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.176.0";
+  version = "0.177.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-snxpAHxej/RySdC0k1r/4UZx+yUNVOTVb37xDrxpJKY=";
+    hash = "sha256-rNs7Ko+NNO2/zqPRu4j+y7KJ62lvfTEndZEnBSi8K5I=";
   };
 
-  vendorHash = "sha256-aDv9ZV3v94pIpUYQaREPellHBo9sxrAKUIYqJzBSWXA=";
+  vendorHash = "sha256-0ZEVOsfb4FBGhNk7CoP7KDhApPTLBz4l5kwcRRBIq5g=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/hy/hyprwayland-scanner/package.nix b/pkgs/by-name/hy/hyprwayland-scanner/package.nix
new file mode 100644
index 000000000000..fc9fb5a820a0
--- /dev/null
+++ b/pkgs/by-name/hy/hyprwayland-scanner/package.nix
@@ -0,0 +1,39 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, pugixml
+,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hyprwayland-scanner";
+  version = "0.3.7";
+
+  src = fetchFromGitHub {
+    owner = "hyprwm";
+    repo = "hyprwayland-scanner";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-BPc9FdIzQAmP1JnYGfr+3O30Yp1BywUvKUz57ZOZ39A=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    pugixml
+  ];
+
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/hyprwm/hyprwayland-scanner";
+    description = "A Hyprland version of wayland-scanner in and for C++";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fufexan ];
+    mainProgram = "hyprwayland-scanner";
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/pi/picom-pijulius/package.nix b/pkgs/by-name/pi/picom-pijulius/package.nix
new file mode 100644
index 000000000000..bb41a7d221af
--- /dev/null
+++ b/pkgs/by-name/pi/picom-pijulius/package.nix
@@ -0,0 +1,32 @@
+{
+  picom,
+  lib,
+  fetchFromGitHub,
+  pcre
+}:
+picom.overrideAttrs (previousAttrs: {
+  pname = "picom-pijulius";
+  version = "8.2-unstable-2024-04-30";
+
+  src = fetchFromGitHub {
+    owner = "pijulius";
+    repo = "picom";
+    rev = "e7b14886ae644aaa657383f7c4f44be7797fd5f6";
+    hash = "sha256-YQVp5HicO+jbvCYSY+hjDTnXCU6aS3aCvbux6NFcJ/Y=";
+  };
+
+  buildInputs = (previousAttrs.buildInputs or [ ]) ++ [ pcre ];
+
+  meta = {
+    inherit (previousAttrs.meta)
+      license
+      platforms
+      mainProgram
+      longDescription
+      ;
+
+    description = "Pijulius's picom fork with extensive animation support";
+    homepage = "https://github.com/pijulius/picom";
+    maintainers = with lib.maintainers; [ YvesStraten ];
+  };
+})
diff --git a/pkgs/by-name/py/pynitrokey/package.nix b/pkgs/by-name/py/pynitrokey/package.nix
index beafb787b63b..aadc6d4a56e8 100644
--- a/pkgs/by-name/py/pynitrokey/package.nix
+++ b/pkgs/by-name/py/pynitrokey/package.nix
@@ -1,28 +1,3 @@
-{ python3
-, fetchPypi
-, rustPlatform
-}:
+{ python3 }:
 
-let
-  python = python3.override {
-    packageOverrides = self: super: {
-      # https://github.com/nxp-mcuxpresso/spsdk/issues/64
-      cryptography = super.cryptography.overridePythonAttrs (old: rec {
-        version = "41.0.7";
-        src = fetchPypi {
-          inherit (old) pname;
-          inherit version;
-          hash = "sha256-E/k86b6oAWwlOzSvxr1qdZk+XEBnLtVAWpyDLw1KALw=";
-        };
-        cargoDeps = rustPlatform.fetchCargoTarball {
-          inherit src;
-          sourceRoot = "${old.pname}-${version}/${old.cargoRoot}";
-          name = "${old.pname}-${version}";
-          hash = "sha256-VeZhKisCPDRvmSjGNwCgJJeVj65BZ0Ge+yvXbZw86Rw=";
-        };
-        patches = [ ];
-        doCheck = false; # would require overriding cryptography-vectors
-      });
-    };
-  };
-in with python.pkgs; toPythonApplication pynitrokey
+with python3.pkgs; toPythonApplication pynitrokey
diff --git a/pkgs/by-name/ya/yazi-unwrapped/package.nix b/pkgs/by-name/ya/yazi-unwrapped/package.nix
index d0a0d77ecfec..77a9b9ad8b5b 100644
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage rec {
     description = "Blazing fast terminal file manager written in Rust, based on async I/O";
     homepage = "https://github.com/sxyazi/yazi";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ xyenon matthiasbeyer ];
+    maintainers = with lib.maintainers; [ xyenon matthiasbeyer linsui ];
     mainProgram = "yazi";
   };
 }
diff --git a/pkgs/by-name/ya/yazi/package.nix b/pkgs/by-name/ya/yazi/package.nix
index 134db023edd9..ee807645c3fd 100644
--- a/pkgs/by-name/ya/yazi/package.nix
+++ b/pkgs/by-name/ya/yazi/package.nix
@@ -3,6 +3,7 @@
 , makeWrapper
 , yazi-unwrapped
 
+, withRuntimeDeps ? true
 , withFile ? true
 , file
 , withJq ? true
@@ -21,10 +22,16 @@
 , fzf
 , withZoxide ? true
 , zoxide
+, settings ? { }
+, formats
+, plugins ? { }
+, flavors ? { }
+, initLua ? null
 }:
 
 let
-  runtimePaths = with lib; [ ]
+  runtimePaths = with lib;
+    [ ]
     ++ optional withFile file
     ++ optional withJq jq
     ++ optional withPoppler poppler_utils
@@ -34,7 +41,40 @@ let
     ++ optional withRipgrep ripgrep
     ++ optional withFzf fzf
     ++ optional withZoxide zoxide;
+
+  settingsFormat = formats.toml { };
+
+  files = [ "yazi" "theme" "keymap" ];
+
+  configHome = if (settings == { } && initLua == null && plugins == { } && flavors == { }) then null else
+  runCommand "YAZI_CONFIG_HOME" { } ''
+    mkdir -p $out
+    ${lib.concatMapStringsSep
+      "\n"
+      (name: lib.optionalString (settings ? ${name} && settings.${name} != { }) ''
+        ln -s ${settingsFormat.generate "${name}.toml" settings.${name}} $out/${name}.toml
+      '')
+      files}
+
+    mkdir $out/plugins
+    ${lib.optionalString (plugins != { }) ''
+        ${lib.concatMapStringsSep
+        "\n"
+        (lib.mapAttrsToList (name: value: "ln -s ${value} $out/plugins/${name}") plugins)}
+    ''}
+
+    mkdir $out/flavors
+    ${lib.optionalString (flavors != { }) ''
+        ${lib.concatMapStringsSep
+        "\n"
+        (lib.mapAttrsToList (name: value: "ln -s ${value} $out/flavors/${name}") flavors)}
+    ''}
+
+
+    ${lib.optionalString (initLua != null) "ln -s ${initLua} $out/init.lua"}
+  '';
 in
+if (!withRuntimeDeps && configHome == null) then yazi-unwrapped else
 runCommand yazi-unwrapped.name
 {
   inherit (yazi-unwrapped) pname version meta;
@@ -44,5 +84,6 @@ runCommand yazi-unwrapped.name
   mkdir -p $out/bin
   ln -s ${yazi-unwrapped}/share $out/share
   makeWrapper ${yazi-unwrapped}/bin/yazi $out/bin/yazi \
-    --prefix PATH : "${lib.makeBinPath runtimePaths}"
+    ${lib.optionalString withRuntimeDeps "--prefix PATH : \"${lib.makeBinPath runtimePaths}\""} \
+    ${lib.optionalString (configHome != null) "--set YAZI_CONFIG_HOME ${configHome}"}
 ''
diff --git a/pkgs/development/compilers/circt/circt-llvm.nix b/pkgs/development/compilers/circt/circt-llvm.nix
index efde87b0789c..0043702fd847 100644
--- a/pkgs/development/compilers/circt/circt-llvm.nix
+++ b/pkgs/development/compilers/circt/circt-llvm.nix
@@ -1,4 +1,5 @@
-{ stdenv
+{ lib
+, stdenv
 , cmake
 , ninja
 , circt
@@ -31,6 +32,14 @@
 
   outputs = [ "out" "lib" "dev" ];
 
+  # Get rid of ${extra_libdir} (which ends up containing a path to circt-llvm.dev
+  # in circt) so that we only have to remove the one fixed rpath.
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace llvm/llvm/cmake/modules/AddLLVM.cmake \
+      --replace-fail 'set(_install_rpath "@loader_path/../lib''${LLVM_LIBDIR_SUFFIX}" ''${extra_libdir})' \
+        'set(_install_rpath "@loader_path/../lib''${LLVM_LIBDIR_SUFFIX}")'
+  '';
+
   postInstall = ''
     # move llvm-config to $dev to resolve a circular dependency
     moveToOutput "bin/llvm-config*" "$dev"
@@ -50,6 +59,30 @@
       --replace "$out/bin/llvm-config" "$dev/bin/llvm-config" # patch path for llvm-config
   '';
 
+  # Replace all references to @rpath with absolute paths and remove the rpaths.
+  #
+  # This is different from what the regular LLVM package does, which is to make
+  # everything absolute from the start: however, that doesn't work for us because
+  # we have `-DBUILD_SHARED_LIBS=ON`, meaning that many more things are
+  # dynamically rather than statically linked. This includes TableGen, which then
+  # fails to run halfway through the build because it tries to reference $lib when
+  # it hasn't been populated yet.
+  #
+  # Inspired by fixDarwinDylibNames.
+  postFixup = lib.optionalString stdenv.isDarwin ''
+    local flags=(-delete_rpath @loader_path/../lib)
+    for file in "$lib"/lib/*.dylib; do
+      flags+=(-change @rpath/"$(basename "$file")" "$file")
+    done
+
+    for file in "$out"/bin/* "$lib"/lib/*.dylib; do
+      if [ -L "$file" ]; then continue; fi
+      echo "$file: fixing dylib references"
+      # note that -id does nothing on binaries
+      install_name_tool -id "$file" "''${flags[@]}" "$file"
+    done
+  '';
+
   # circt only use the mlir part of llvm, occasionally there are some unrelated failure from llvm,
   # disable the llvm check, but keep the circt check enabled.
   doCheck = false;
diff --git a/pkgs/development/compilers/circt/default.nix b/pkgs/development/compilers/circt/default.nix
index 2b9f64bb6b20..4b572a33bb85 100644
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@@ -67,6 +67,13 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "lib" "dev" ];
 
+  # Copy circt-llvm's postFixup stage so that it can make all our dylib references
+  # absolute as well.
+  #
+  # We don't need `postPatch` because circt seems to be automatically inheriting
+  # the config somehow, presumably via. `-DMLIR_DIR`.
+  postFixup = circt-llvm.postFixup;
+
   postInstall = ''
     moveToOutput lib "$lib"
   '';
diff --git a/pkgs/development/python-modules/spsdk/default.nix b/pkgs/development/python-modules/spsdk/default.nix
index b64ef4a3d910..35b10ef7c97c 100644
--- a/pkgs/development/python-modules/spsdk/default.nix
+++ b/pkgs/development/python-modules/spsdk/default.nix
@@ -107,7 +107,6 @@ buildPythonPackage rec {
   passthru.tests.version = testers.testVersion { package = spsdk; };
 
   meta = with lib; {
-    broken = versionAtLeast cryptography.version "41.1";
     changelog = "https://github.com/nxp-mcuxpresso/spsdk/blob/${src.rev}/docs/release_notes.rst";
     description = "NXP Secure Provisioning SDK";
     homepage = "https://github.com/nxp-mcuxpresso/spsdk";
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index d8d3a6532a50..452b2f8598ec 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -495,7 +495,7 @@ in buildPythonPackage rec {
   requiredSystemFeatures = [ "big-parallel" ];
 
   passthru = {
-    inherit cudaSupport cudaPackages;
+    inherit cudaSupport cudaPackages rocmSupport rocmPackages;
     # At least for 1.10.2 `torch.fft` is unavailable unless BLAS provider is MKL. This attribute allows for easy detection of its availability.
     blasProvider = blas.provider;
     # To help debug when a package is broken due to CUDA support
diff --git a/pkgs/development/python-modules/torchaudio/default.nix b/pkgs/development/python-modules/torchaudio/default.nix
index ff56db53a675..2ad66d1691a4 100644
--- a/pkgs/development/python-modules/torchaudio/default.nix
+++ b/pkgs/development/python-modules/torchaudio/default.nix
@@ -9,10 +9,46 @@
 , pybind11
 , sox
 , torch
+
 , cudaSupport ? torch.cudaSupport
 , cudaPackages
+, rocmSupport ? torch.rocmSupport
+, rocmPackages
+
+, gpuTargets ? []
 }:
 
+let
+  # TODO: Reuse one defined in torch?
+  # Some of those dependencies are probbly not required,
+  # but it breaks when the store path is different between torch and torchaudio
+  rocmtoolkit_joined = symlinkJoin {
+    name = "rocm-merged";
+
+    paths = with rocmPackages; [
+      rocm-core clr rccl miopen miopengemm rocrand rocblas
+      rocsparse hipsparse rocthrust rocprim hipcub roctracer
+      rocfft rocsolver hipfft hipsolver hipblas
+      rocminfo rocm-thunk rocm-comgr rocm-device-libs
+      rocm-runtime clr.icd hipify
+    ];
+
+    # Fix `setuptools` not being found
+    postBuild = ''
+      rm -rf $out/nix-support
+    '';
+  };
+  # Only used for ROCm
+  gpuTargetString = lib.strings.concatStringsSep ";" (
+    if gpuTargets != [ ] then
+    # If gpuTargets is specified, it always takes priority.
+      gpuTargets
+    else if rocmSupport then
+      rocmPackages.clr.gpuTargets
+    else
+      throw "No GPU targets specified"
+  );
+in
 buildPythonPackage rec {
   pname = "torchaudio";
   version = "2.3.0";
@@ -33,6 +69,11 @@ buildPythonPackage rec {
     substituteInPlace setup.py \
       --replace 'print(" --- Initializing submodules")' "return" \
       --replace "_fetch_archives(_parse_sources())" "pass"
+  ''
+  + lib.optionalString rocmSupport ''
+    # There is no .info/version-dev, only .info/version
+    substituteInPlace cmake/LoadHIP.cmake \
+      --replace "/.info/version-dev" "/.info/version"
   '';
 
   env = {
@@ -55,7 +96,11 @@ buildPythonPackage rec {
     ninja
   ] ++ lib.optionals cudaSupport [
     cudaPackages.cuda_nvcc
-  ];
+  ] ++ lib.optionals rocmSupport (with rocmPackages; [
+    clr
+    rocblas
+    hipblas
+  ]);
 
   buildInputs = [
     ffmpeg-full
@@ -73,6 +118,11 @@ buildPythonPackage rec {
   BUILD_RNNT=0;
   BUILD_CTC_DECODER=0;
 
+  preConfigure = lib.optionalString rocmSupport ''
+    export ROCM_PATH=${rocmtoolkit_joined}
+    export PYTORCH_ROCM_ARCH="${gpuTargetString}"
+  '';
+
   dontUseCmakeConfigure = true;
 
   doCheck = false; # requires sox backend
diff --git a/pkgs/development/tools/continuous-integration/buildbot/master.nix b/pkgs/development/tools/continuous-integration/buildbot/master.nix
index 8de60461f730..7bf5eeab82ec 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/master.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/master.nix
@@ -72,14 +72,14 @@ let
 in
 buildPythonApplication rec {
   pname = "buildbot";
-  version = "3.11.1";
+  version = "3.11.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ruYW1sVoGvFMi+NS+xiNsn0Iq2RmKlax4bxHgYrj6ZY=";
+    hash = "sha256-x7RaApfIe1x7Py1KLQCcotxU6dJRXTOk67W+QOhNJf0=";
   };
 
   build-system = [
diff --git a/pkgs/development/tools/continuous-integration/buildbot/pkg.nix b/pkgs/development/tools/continuous-integration/buildbot/pkg.nix
index 4ccdb66d7b11..d121ec68cbde 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/pkg.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/pkg.nix
@@ -1,12 +1,12 @@
 { lib, buildPythonPackage, fetchPypi, isPy3k, buildbot }:
 
 buildPythonPackage rec {
-  pname = "buildbot-pkg";
+  pname = "buildbot_pkg";
   inherit (buildbot) version;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cfPsNnR0gEgz1y/GNR6faixk2HyuHaRh1E9nGHjCb58=";
+    hash = "sha256-ZgDHPC2j3vV3m7wBZhUUh/Th/oGKq+8RxnfQ71Cr6oY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/continuous-integration/buildbot/plugins.nix b/pkgs/development/tools/continuous-integration/buildbot/plugins.nix
index b84e42c1bee7..ade8f2e243d4 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/plugins.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/plugins.nix
@@ -3,12 +3,12 @@
   # this is exposed for potential plugins to use and for nix-update
   inherit buildbot-pkg;
   www = buildPythonPackage rec {
-    pname = "buildbot-www";
+    pname = "buildbot_www";
     inherit (buildbot-pkg) version;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-5q4N76XHUhvc2lIqup0dYwrEdI5bR/96N7m2rhvPJh4=";
+      hash = "sha256-xOsz71kprzKKqvvwpsZTACWf4z+Svx9BQ72xGEZXKdw=";
     };
 
     # Remove unnecessary circular dependency on buildbot
@@ -30,12 +30,12 @@
   };
 
   www-react = buildPythonPackage rec {
-    pname = "buildbot-www-react";
+    pname = "buildbot_www_react";
     inherit (buildbot-pkg) version;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-kjow5WksdBzeo8nwXk5Djm/4tym8XvMo+VgiqSSAyKk=";
+      hash = "sha256-wUiMEAFmqjHXPjnPhsaLWqxvOXyEQIeRBL4W3LB3vkw=";
     };
 
     # Remove unnecessary circular dependency on buildbot
@@ -57,12 +57,12 @@
   };
 
   console-view = buildPythonPackage rec {
-    pname = "buildbot-console-view";
+    pname = "buildbot_console_view";
     inherit (buildbot-pkg) version;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-IrXDwO0YSpiZfw6B/lorEQdbAIZ5qCja75L/PFRmJms=";
+      hash = "sha256-KerHS5F4b30TvlGeSf6QLUt49S6Iki7O5nex6KPypJY=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -79,12 +79,12 @@
   };
 
   react-console-view = buildPythonPackage rec {
-    pname = "buildbot-react-console-view";
+    pname = "buildbot_react_console_view";
     inherit (buildbot-pkg) version;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-ZkUsAN56OEI/SphQydv4HkVV6Eobd0pd+UbXa23mBfQ=";
+      hash = "sha256-XrywoVM2ErJ4i7WrRKPRaCOwt5JVDJT6xP7L/Dfv+gk=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -101,12 +101,12 @@
   };
 
   waterfall-view = buildPythonPackage rec {
-    pname = "buildbot-waterfall-view";
+    pname = "buildbot_waterfall_view";
     inherit (buildbot-pkg) version;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-qL1+bpgxflcRTFPOvDHKdHilio28bbHClqy1Um4Se+o=";
+      hash = "sha256-mhVbuOhe0BrXHbn8bd41Q7I8Xak7fO8ahIK0r113vGY=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -123,12 +123,12 @@
   };
 
   react-waterfall-view = buildPythonPackage rec {
-    pname = "buildbot-react-waterfall-view";
+    pname = "buildbot_react_waterfall_view";
     inherit (buildbot-pkg) version;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-5D0N/5Sf8YNQBKt8GzAk1htdEY/xOmE5Abt5y7P9h34=";
+      hash = "sha256-X89XrjdD0GL7MabLWtkQcdCa4Ain1AGre6mXF/inmck=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -145,12 +145,12 @@
   };
 
   grid-view = buildPythonPackage rec {
-    pname = "buildbot-grid-view";
+    pname = "buildbot_grid_view";
     inherit (buildbot-pkg) version;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-snyJbQZqSIqOk6dTJidSv1VmE/Gn+pblcZs8BpZ+fdA=";
+      hash = "sha256-YH5SfYuW07Pp00LoBvcDB8MiHB1HzYWg5kQVICrkS5s=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -167,12 +167,12 @@
   };
 
   react-grid-view = buildPythonPackage rec {
-    pname = "buildbot-react-grid-view";
+    pname = "buildbot_react_grid_view";
     inherit (buildbot-pkg) version;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-0Ggm3NQn1ZZfMsMqf1qdCD1+HkJZmM1p+TqOPF0Q9CE=";
+      hash = "sha256-rmyAsFCTeIYPdrlWDCxlbjw+BCKwcIaTHlK8KJP0T88=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -189,12 +189,12 @@
   };
 
   wsgi-dashboards = buildPythonPackage rec {
-    pname = "buildbot-wsgi-dashboards";
+    pname = "buildbot_wsgi_dashboards";
     inherit (buildbot-pkg) version;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-rBUrYSeAWrxn5mlXaAAtE58jIZVLs/q69ARY2u6rTsI=";
+      hash = "sha256-Ls3NJka5vVTx1GW9bnr3jlulj7/pNkX9omXrTIWrwtU=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -211,12 +211,12 @@
   };
 
   react-wsgi-dashboards = buildPythonPackage rec {
-    pname = "buildbot-react-wsgi-dashboards";
+    pname = "buildbot_react_wsgi_dashboards";
     inherit (buildbot-pkg) version;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-U0DHWFMmvTKFBW1C5bnoemjMOKpw1H3GXnBn/AU52vY=";
+      hash = "sha256-t3LLZJ+kPcowqSyeRcuH3kEjBEiju1MI0z1qhU6KPBs=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -233,12 +233,12 @@
   };
 
   badges = buildPythonPackage rec {
-    pname = "buildbot-badges";
+    pname = "buildbot_badges";
     inherit (buildbot-pkg) version;
 
     src = fetchPypi {
       inherit pname version;
-      hash = "sha256-7t4E7twn4TeJJCE5Vn83UzIRE2Okvcox2us1d8j50Os=";
+      hash = "sha256-//MftUqUWE2+RpxRPzDEH7tOCN2D1HD8dETZw1OQe5s=";
     };
 
     buildInputs = [ buildbot-pkg ];
diff --git a/pkgs/development/tools/continuous-integration/buildbot/worker.nix b/pkgs/development/tools/continuous-integration/buildbot/worker.nix
index 1b73737e42cb..80e255153b77 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/worker.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/worker.nix
@@ -23,12 +23,12 @@
 }:
 
 buildPythonPackage (rec {
-  pname = "buildbot-worker";
+  pname = "buildbot_worker";
   inherit (buildbot) version;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-hRsmgP8IiWg5+YCqMVYgZc4ljWwz7YWfAFrmMHx8wBY=";
+    hash = "sha256-7DAo1Yy20FeWXawV4wHzXDGtgyIGDJQuD2joJma96rM=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 21772b2e03eb..ada6932dc85f 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,81 +2,71 @@
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.309-hardened1.patch",
-            "sha256": "1hww72w5anmfr9czqbl31glzl70s34492k9qz9zax141zg1sf6sp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.309-hardened1/linux-hardened-4.19.309-hardened1.patch"
+            "name": "linux-hardened-4.19.313-hardened1.patch",
+            "sha256": "1fa30s98cbk64315y7vwz7pc2ba0rcs2msaiiib8p85kid5c80v8",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.313-hardened1/linux-hardened-4.19.313-hardened1.patch"
         },
-        "sha256": "1yc45kfiwdqsqa11sxafs82b0day6qvgjcll8rx9vipidsmagbcm",
-        "version": "4.19.309"
+        "sha256": "1j1r4mrdh1ray468jr5i8d2afiswb653bhq0ck8bcdw4rwp5w558",
+        "version": "4.19.313"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.212-hardened1.patch",
-            "sha256": "0h04i94vshhcli5m4qpnqg4vsi5v1ifvdhhklk7c0bvkfk35cbml",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.212-hardened1/linux-hardened-5.10.212-hardened1.patch"
+            "name": "linux-hardened-5.10.216-hardened1.patch",
+            "sha256": "1hj59x5wrh8bkgxp1f5sh8h5rirh4878gywanjmf7qjq6w2wj5rh",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.216-hardened1/linux-hardened-5.10.216-hardened1.patch"
         },
-        "sha256": "14vll2bghd52wngjxy78hgglydcxka59yziji0w56dcdpmky9wqc",
-        "version": "5.10.212"
+        "sha256": "0lg1zfb9y4ps86q85mlnyalb3s90zix003z62jb9bw139f65h473",
+        "version": "5.10.216"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.151-hardened1.patch",
-            "sha256": "040jc5n9qsdz2wv5ksfvc28vd72nmya2i2f0ps0jiras6l2wlhjz",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.151-hardened1/linux-hardened-5.15.151-hardened1.patch"
+            "name": "linux-hardened-5.15.158-hardened1.patch",
+            "sha256": "1q37hdac1mk91rrl2p3j4d69wiphzm1mfbvl6cxlsrc42pjbapz3",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.158-hardened1/linux-hardened-5.15.158-hardened1.patch"
         },
-        "sha256": "0jby224ncdardjwmf8c59s5j71inpvdlzah984ilf2b6y85pc7la",
-        "version": "5.15.151"
+        "sha256": "1inmdpif3qf1blmvjj4i7y42bylvhv0wyj3b0apq12zxlj1iq1zr",
+        "version": "5.15.158"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.271-hardened1.patch",
-            "sha256": "0rw5il7885d0d3k2hmh46541svib6rp32g00fcl5bw37ydmq3z8b",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.271-hardened1/linux-hardened-5.4.271-hardened1.patch"
+            "name": "linux-hardened-5.4.275-hardened1.patch",
+            "sha256": "10fw4hkavnj6nhjqz186sqxbvjz6g62mhyjmlnlxik322nbh6jk6",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.275-hardened1/linux-hardened-5.4.275-hardened1.patch"
         },
-        "sha256": "0l2qv4xlhnry9crs90rkihsxyny6jz8kxw08bfad7nys9hrn3g6d",
-        "version": "5.4.271"
+        "sha256": "0k1hyknx854k8z27j4rq1gcp8l0xc0bspmrhc41a033gjilb1lns",
+        "version": "5.4.275"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.81-hardened1.patch",
-            "sha256": "0af9dxdsa858zyqc0vsrzg098afhg5vpb2wpr6gj2ykwc13iaf07",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.81-hardened1/linux-hardened-6.1.81-hardened1.patch"
+            "name": "linux-hardened-6.1.90-hardened1.patch",
+            "sha256": "1wjckrv0p7phai6ian39kl0rpmzvrzz10bi92xgdq8hhsbp2p3fk",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.90-hardened1/linux-hardened-6.1.90-hardened1.patch"
         },
-        "sha256": "0arl96yrqplbmp2gjyqcfma1lgc30kbn95m0sflv0yyldwf8dg8f",
-        "version": "6.1.81"
-    },
-    "6.5": {
-        "patch": {
-            "extra": "-hardened1",
-            "name": "linux-hardened-6.5.13-hardened1.patch",
-            "sha256": "1fj6yaq2gdjlj2h19vkm13jrx0yiczj6pvric1kq1r6cprqrkkki",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.5.13-hardened1/linux-hardened-6.5.13-hardened1.patch"
-        },
-        "sha256": "1dfbbydmayfj9npx3z0g38p574pmcx3qgs49dv0npigl48wd9yvq",
-        "version": "6.5.13"
+        "sha256": "07cfg0chssvpc4mqls3aln6s4lqjp6k4x2n63wndmkjgfqpdg8w3",
+        "version": "6.1.90"
     },
     "6.6": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.6.21-hardened1.patch",
-            "sha256": "0k35s5pj92lvfp6kw3isg78zc3gijsg0xbzcyvxdkmhzaq8j6i1i",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.21-hardened1/linux-hardened-6.6.21-hardened1.patch"
+            "name": "linux-hardened-6.6.30-hardened1.patch",
+            "sha256": "0q6x7prx1ncf3ni5zvpjav9jcq1n50fq0wcarw022bis1rmrhczy",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.30-hardened1/linux-hardened-6.6.30-hardened1.patch"
         },
-        "sha256": "0mz420w99agr7jv1jgqfr4fjhzbv005xif086sqx556s900l62zf",
-        "version": "6.6.21"
+        "sha256": "1ilwmgpgvddwkd9nx5999cb6z18scjyq7jklid26k1hg7f35nsmn",
+        "version": "6.6.30"
     },
-    "6.7": {
+    "6.8": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.7.6-hardened1.patch",
-            "sha256": "063yrs3g0knlz37aq979jhng9k6l19873nbi1jy167xfqmpqqajr",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.7.6-hardened1/linux-hardened-6.7.6-hardened1.patch"
+            "name": "linux-hardened-6.8.9-hardened1.patch",
+            "sha256": "115d1fgddfcffmfg5f31w50lf2cskkwakngb343didrwfa28nrxf",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.8.9-hardened1/linux-hardened-6.8.9-hardened1.patch"
         },
-        "sha256": "1lrp7pwnxnqyy8c2l4n4nz997039gbnssrfm8ss8kl3h2c7fr2g4",
-        "version": "6.7.6"
+        "sha256": "1dn9bgmf03bdfbmgq98d043702g808rjikxs2i9yia57iqiz21gr",
+        "version": "6.8.9"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/hardened/update.py b/pkgs/os-specific/linux/kernel/hardened/update.py
index cb624ebe86b9..1e34ca209aa9 100755
--- a/pkgs/os-specific/linux/kernel/hardened/update.py
+++ b/pkgs/os-specific/linux/kernel/hardened/update.py
@@ -211,6 +211,7 @@ with open(NIXPKGS_KERNEL_PATH / "kernels-org.json") as kernel_versions_json:
 
 # Remove patches for unpackaged kernel versions.
 for kernel_key in sorted(patches.keys() - kernel_versions.keys()):
+    del patches[kernel_key]
     commit_patches(kernel_key=kernel_key, message="remove")
 
 g = Github(os.environ.get("GITHUB_TOKEN"))
diff --git a/pkgs/servers/telegram-bot-api/default.nix b/pkgs/servers/telegram-bot-api/default.nix
index d8dc668fb69b..3481b853715d 100644
--- a/pkgs/servers/telegram-bot-api/default.nix
+++ b/pkgs/servers/telegram-bot-api/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "telegram-bot-api";
-  version = "5.7";
+  version = "7.3";
 
   src = fetchFromGitHub {
     repo = "telegram-bot-api";
     owner = "tdlib";
-    rev = "c57b04c4c8c4e8d8bb6fdd0bd3bfb5b93b9d8f05";
-    sha256 = "sha256-WetzX8GBdwQAnnZjek+W4v+QN1aUFdlvs+Jv6n1B+eY=";
+    rev = "5951bfbab8b1274437c613c1c48d91be2a050371";
+    hash = "sha256-5aNZqP4K+zP7q1+yllr6fysEcewhh/V9Vl6GXQolanI=";
     fetchSubmodules = true;
   };
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
     description = "Telegram Bot API server";
     homepage = "https://github.com/tdlib/telegram-bot-api";
     license = licenses.boost;
-    maintainers = with maintainers; [ Anillc ];
+    maintainers = with maintainers; [ Anillc Forden ];
     platforms = platforms.all;
     mainProgram = "telegram-bot-api";
   };
diff --git a/pkgs/tools/security/nitrokey-app2/default.nix b/pkgs/tools/security/nitrokey-app2/default.nix
index 6f392f5d7f53..8e97ce02af4c 100644
--- a/pkgs/tools/security/nitrokey-app2/default.nix
+++ b/pkgs/tools/security/nitrokey-app2/default.nix
@@ -1,35 +1,29 @@
 { lib
+, stdenv
 , python3
 , fetchPypi
-, rustPlatform
 , fetchFromGitHub
+, wrapQtAppsHook
+, qtbase
+, qtwayland
 }:
 
 let
   python = python3.override {
     packageOverrides = self: super: {
-      # https://github.com/nxp-mcuxpresso/spsdk/issues/64
-      cryptography = super.cryptography.overridePythonAttrs (old: rec {
-        version = "41.0.7";
+      pynitrokey = super.pynitrokey.overridePythonAttrs (old: rec {
+        version = "0.4.45";
         src = fetchPypi {
           inherit (old) pname;
           inherit version;
-          hash = "sha256-E/k86b6oAWwlOzSvxr1qdZk+XEBnLtVAWpyDLw1KALw=";
+          hash = "sha256-iY4ThrmXP7pEjTYYU4lePVAbuJGTdHX3iKswXzuf7W8=";
         };
-        cargoDeps = rustPlatform.fetchCargoTarball {
-          inherit src;
-          sourceRoot = "${old.pname}-${version}/${old.cargoRoot}";
-          name = "${old.pname}-${version}";
-          hash = "sha256-VeZhKisCPDRvmSjGNwCgJJeVj65BZ0Ge+yvXbZw86Rw=";
-        };
-        patches = [ ];
-        doCheck = false; # would require overriding cryptography-vectors
       });
     };
   };
 in python.pkgs.buildPythonApplication rec {
   pname = "nitrokey-app2";
-  version = "2.1.5";
+  version = "2.2.2";
   pyproject = true;
 
   disabled = python.pythonOlder "3.9";
@@ -38,7 +32,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "Nitrokey";
     repo = "nitrokey-app2";
     rev = "v${version}";
-    hash = "sha256-mR13zUgCdNS09EnpGLrnOnoIn3p6ZM/0fHKg0OUMWj4=";
+    hash = "sha256-MiyfmsrKZRoe7YMEjR1LHPesfJh6+dcSydoEAgrALJ8=";
   };
 
   # https://github.com/Nitrokey/nitrokey-app2/issues/152
@@ -51,6 +45,11 @@ in python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = with python.pkgs; [
     poetry-core
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [ qtbase ] ++ lib.optionals stdenv.isLinux [
+    qtwayland
   ];
 
   propagatedBuildInputs = with python.pkgs; [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3faee9c5f29c..857a26f87fda 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27309,6 +27309,8 @@ with pkgs;
   linux_6_1_hardened = linuxKernel.kernels.linux_6_1_hardened;
   linuxPackages_6_6_hardened = linuxKernel.packages.linux_6_6_hardened;
   linux_6_6_hardened = linuxKernel.kernels.linux_6_6_hardened;
+  linuxPackages_6_8_hardened = linuxKernel.packages.linux_6_8_hardened;
+  linux_6_8_hardened = linuxKernel.kernels.linux_6_8_hardened;
 
   # GNU Linux-libre kernels
   linuxPackages-libre = linuxKernel.packages.linux_libre;
@@ -40640,7 +40642,7 @@ with pkgs;
 
   nitrokey-app = libsForQt5.callPackage ../tools/security/nitrokey-app { };
 
-  nitrokey-app2 = callPackage ../tools/security/nitrokey-app2 { };
+  nitrokey-app2 = qt6Packages.callPackage ../tools/security/nitrokey-app2 { };
 
   fpm2 = callPackage ../tools/security/fpm2 { };
 
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 0335f52465ea..57ae6c5f36a9 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -269,6 +269,7 @@ in {
     linux_5_15_hardened = hardenedKernelFor kernels.linux_5_15 { };
     linux_6_1_hardened = hardenedKernelFor kernels.linux_6_1 { };
     linux_6_6_hardened = hardenedKernelFor kernels.linux_6_6 { };
+    linux_6_8_hardened = hardenedKernelFor kernels.linux_6_8 { };
 
   } // lib.optionalAttrs config.allowAliases {
     linux_4_9 = throw "linux 4.9 was removed because it will reach its end of life within 22.11";
@@ -657,6 +658,7 @@ in {
     linux_5_15_hardened = recurseIntoAttrs (packagesFor kernels.linux_5_15_hardened);
     linux_6_1_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_1_hardened);
     linux_6_6_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_6_hardened);
+    linux_6_8_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_8_hardened);
 
     linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
     linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);