diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 8fdf1f09cd18..2a23a32eaba6 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -382,6 +382,7 @@
   ./services/databases/pgmanage.nix
   ./services/databases/postgresql.nix
   ./services/databases/redis.nix
+  ./services/databases/surrealdb.nix
   ./services/databases/victoriametrics.nix
   ./services/desktops/accountsservice.nix
   ./services/desktops/bamf.nix
diff --git a/nixos/modules/services/databases/surrealdb.nix b/nixos/modules/services/databases/surrealdb.nix
new file mode 100644
index 000000000000..27269eb02f64
--- /dev/null
+++ b/nixos/modules/services/databases/surrealdb.nix
@@ -0,0 +1,79 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+
+  cfg = config.services.surrealdb;
+in {
+
+  options = {
+    services.surrealdb = {
+      enable = mkEnableOption (lib.mdDoc "A scalable, distributed, collaborative, document-graph database, for the realtime web ");
+
+      dbPath = mkOption {
+        type = types.str;
+        description = lib.mdDoc ''
+          The path that surrealdb will write data to. Use null for in-memory.
+          Can be one of "memory", "file://:path", "tikv://:addr".
+        '';
+        default = "file:///var/lib/surrealdb/";
+        example = "memory";
+      };
+
+      host = mkOption {
+        type = types.str;
+        description = lib.mdDoc ''
+          The host that surrealdb will connect to.
+        '';
+        default = "127.0.0.1";
+        example = "127.0.0.1";
+      };
+
+      port = mkOption {
+        type = types.port;
+        description = lib.mdDoc ''
+          The port that surrealdb will connect to.
+        '';
+        default = 8000;
+        example = 8000;
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    # Used to connect to the running service
+    environment.systemPackages = [ pkgs.surrealdb ] ;
+
+    systemd.services.surrealdb = {
+      description = "A scalable, distributed, collaborative, document-graph database, for the realtime web ";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        ExecStart = "${pkgs.surrealdb}/bin/surreal start --bind ${cfg.host}:${toString cfg.port} ${optionalString (cfg.dbPath != null) "-- ${cfg.dbPath}"}";
+        DynamicUser = true;
+        Restart = "on-failure";
+        StateDirectory = "surrealdb";
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectHome = true;
+        ProtectClock = true;
+        ProtectProc = "noaccess";
+        ProcSubset = "pid";
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        RestrictSUIDSGID = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        RemoveIPC = true;
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
+      };
+    };
+  };
+}
diff --git a/pkgs/applications/emulators/duckstation/default.nix b/pkgs/applications/emulators/duckstation/default.nix
index 88deb6653a02..31869fa9fe36 100644
--- a/pkgs/applications/emulators/duckstation/default.nix
+++ b/pkgs/applications/emulators/duckstation/default.nix
@@ -4,11 +4,11 @@
 , SDL2
 , cmake
 , copyDesktopItems
-, makeDesktopItem
 , curl
 , extra-cmake-modules
-, libpulseaudio
 , libXrandr
+, libpulseaudio
+, makeDesktopItem
 , mesa # for libgbm
 , ninja
 , pkg-config
@@ -18,14 +18,16 @@
 , vulkan-loader
 , wayland
 , wrapQtAppsHook
+, enableWayland ? true
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "duckstation";
   version = "unstable-2022-11-18";
+
   src = fetchFromGitHub {
     owner = "stenzek";
-    repo = pname;
+    repo = "duckstation";
     rev = "8d7aea5e19859ed483699cc4a5dbd47165c7be8b";
     sha256 = "sha256-92Wn1ZEEZszmVK/KrJqjDuQf/lyD8/VScfTI/St5dY4=";
   };
@@ -49,13 +51,13 @@ stdenv.mkDerivation rec {
     qtbase
     qtsvg
     vulkan-loader
-    wayland
-  ];
+  ]
+  ++ lib.optionals enableWayland [ wayland ];
 
   cmakeFlags = [
     "-DUSE_DRMKMS=ON"
-    "-DUSE_WAYLAND=ON"
-  ];
+  ]
+  ++ lib.optionals enableWayland [ "-DUSE_WAYLAND=ON" ];
 
   desktopItems = [
     (makeDesktopItem {
diff --git a/pkgs/applications/graphics/qimgv/default.nix b/pkgs/applications/graphics/qimgv/default.nix
index 8e4c4805750b..560cf666d262 100644
--- a/pkgs/applications/graphics/qimgv/default.nix
+++ b/pkgs/applications/graphics/qimgv/default.nix
@@ -15,13 +15,13 @@
 
 mkDerivation rec {
   pname = "qimgv";
-  version = "1.0.2";
+  version = "1.0.3-alpha";
 
   src = fetchFromGitHub {
     owner = "easymodo";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-YlV/ysm7bdPverpKpanrL+jPVvMtP1paoAm0PREMaww=";
+    sha256 = "sha256-fHMSo8zlOl9Lt8nYwClUzON4TPB9Ogwven+TidsesxY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/qimgv/qt5-12-compat.diff b/pkgs/applications/graphics/qimgv/qt5-12-compat.diff
deleted file mode 100644
index da64759e22d6..000000000000
--- a/pkgs/applications/graphics/qimgv/qt5-12-compat.diff
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/qimgv/components/directorymanager/watchers/linux/linuxworker.cpp b/qimgv/components/directorymanager/watchers/linux/linuxworker.cpp
-index 96ec9d3..6d95d08 100644
---- a/qimgv/components/directorymanager/watchers/linux/linuxworker.cpp
-+++ b/qimgv/components/directorymanager/watchers/linux/linuxworker.cpp
-@@ -21,7 +21,7 @@ void LinuxWorker::setDescriptor(int desc) {
- 
- void LinuxWorker::run() {
-     emit started();
--    isRunning.storeRelaxed(true);
-+    isRunning.store(true);
- 
-     if (fd == -1) {
-         qDebug() << TAG << "File descriptor isn't set! Stopping";
diff --git a/pkgs/applications/misc/process-compose/default.nix b/pkgs/applications/misc/process-compose/default.nix
new file mode 100644
index 000000000000..c52adbc4f0be
--- /dev/null
+++ b/pkgs/applications/misc/process-compose/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, installShellFiles
+}:
+
+buildGoModule rec {
+  pname = "process-compose";
+  version = "0.24.1";
+
+  src = fetchFromGitHub {
+    owner = "F1bonacc1";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "TKLLq6I+Mcvdz51m8nydTWcslBcQlJCJFoJ10SgfVWU=";
+  };
+
+  ldflags = [ "-X main.version=v${version}" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  vendorSha256 = "IsO1B6z1/HoGQ8xdNKQqZ/eZd90WikDbU9XiP0z28mU=";
+
+  doCheck = false;
+
+  postInstall = ''
+    mv $out/bin/{src,process-compose}
+
+    installShellCompletion --cmd process-compose \
+      --bash <($out/bin/process-compose completion bash) \
+      --zsh <($out/bin/process-compose completion zsh) \
+      --fish <($out/bin/process-compose completion fish)
+  '';
+
+  meta = with lib; {
+    description = "A simple and flexible scheduler and orchestrator to manage non-containerized applications";
+    homepage = "https://github.com/F1bonacc1/process-compose";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ thenonameguy ];
+    mainProgram = "process-compose";
+  };
+}
diff --git a/pkgs/applications/networking/browsers/luakit/default.nix b/pkgs/applications/networking/browsers/luakit/default.nix
index 8656b4aaa276..4812f69f34e8 100644
--- a/pkgs/applications/networking/browsers/luakit/default.nix
+++ b/pkgs/applications/networking/browsers/luakit/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luakit";
-  version = "2.3";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "luakit";
     repo = pname;
     rev = version;
-    hash = "sha256-5YeJkbWk1wHxWXqWOvhEDeScWPU/aRVhuOWRHLSHVZM=";
+    hash = "sha256-6baN3e5ZJ8hw6mhQ0AapyVIYFSdmXcfo45ReQNliIPw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 4c3a4bd98844..a562548242b6 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -96,7 +96,7 @@
 , gpgme
 , libwebp
 , abseil-cpp
-, langs ? [ "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sl" "uk" "zh-CN" ]
+, langs ? [ "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sl" "tr" "uk" "zh-CN" ]
 , withHelp ? true
 , kdeIntegration ? false
 , mkDerivation ? null
diff --git a/pkgs/applications/version-management/git-and-tools/gitui/default.nix b/pkgs/applications/version-management/git-and-tools/gitui/default.nix
index ccbe59317832..3b383647c2c9 100644
--- a/pkgs/applications/version-management/git-and-tools/gitui/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitui/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitui";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "extrawurst";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-B/RKPYq1U40NV3AM/cQi2eQaK5vxynP3JA0DReSBuCo=";
+    sha256 = "sha256-ZLGA0LHdGPqIoNG2k4nunVWYlOnwRT8nqTSwUWGkfCU=";
   };
 
-  cargoSha256 = "sha256-r4kritS3v8GgFZfWeeyrsy6v3IlH3DByTU8Ir4FDngs=";
+  cargoSha256 = "sha256-ArJerq3gLzPm66RWDCvkpPFyh7ZyaoqLO/3zSjFTL04=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -32,6 +32,11 @@ rustPlatform.buildRustPackage rec {
   # Needed to get openssl-sys to use pkg-config.
   OPENSSL_NO_VENDOR = 1;
 
+  # The cargo config overrides linkers for some targets, breaking the build
+  # on e.g. `aarch64-linux`. These overrides are not required in the Nix
+  # environment: delete them.
+  postPatch = "rm .cargo/config";
+
   meta = with lib; {
     description = "Blazing fast terminal-ui for Git written in Rust";
     homepage = "https://github.com/extrawurst/gitui";
diff --git a/pkgs/development/compilers/chicken/4/eggDerivation.nix b/pkgs/development/compilers/chicken/4/eggDerivation.nix
index 10cf91579a40..96b3612b34ba 100644
--- a/pkgs/development/compilers/chicken/4/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/4/eggDerivation.nix
@@ -42,4 +42,8 @@ stdenv.mkDerivation ({
 
     runHook postInstall
   '';
-} // (builtins.removeAttrs args ["name" "buildInputs"]) // override)
+
+  meta = {
+    inherit (chicken.meta) platforms;
+  } // args.meta or {};
+} // (builtins.removeAttrs args ["name" "buildInputs" "meta"]) // override)
diff --git a/pkgs/development/compilers/chicken/5/eggDerivation.nix b/pkgs/development/compilers/chicken/5/eggDerivation.nix
index a6d19eaeb137..d1c8fc9e4736 100644
--- a/pkgs/development/compilers/chicken/5/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/5/eggDerivation.nix
@@ -39,4 +39,8 @@ stdenv.mkDerivation ({
 
     runHook postInstall
   '';
-} // (builtins.removeAttrs args ["name" "buildInputs"]) // override)
+
+  meta = {
+    inherit (chicken.meta) platforms;
+  } // args.meta or {};
+} // (builtins.removeAttrs args ["name" "buildInputs" "meta"]) // override)
diff --git a/pkgs/development/ocaml-modules/mlgmpidl/default.nix b/pkgs/development/ocaml-modules/mlgmpidl/default.nix
index 33f9f2d8e6b0..7952f811e7be 100644
--- a/pkgs/development/ocaml-modules/mlgmpidl/default.nix
+++ b/pkgs/development/ocaml-modules/mlgmpidl/default.nix
@@ -1,17 +1,18 @@
-{ stdenv, lib, fetchFromGitHub, perl, ocaml, findlib, camlidl, gmp, mpfr }:
+{ stdenv, lib, fetchFromGitHub, perl, ocaml, findlib, camlidl, gmp, mpfr, bigarray-compat }:
 
 stdenv.mkDerivation rec {
   pname = "ocaml${ocaml.version}-mlgmpidl";
-  version = "1.2.12";
+  version = "1.2.15";
   src = fetchFromGitHub {
     owner = "nberth";
     repo = "mlgmpidl";
     rev = version;
-    sha256 = "17xqiclaqs4hmnb92p9z6z9a1xfr31vcn8nlnj8ykk57by31vfza";
+    sha256 = "sha256-85wy5eVWb5qdaa2lLDcfqlUTIY7vnN3nGMdxoj5BslU=";
   };
 
   nativeBuildInputs = [ perl ocaml findlib camlidl ];
   buildInputs = [ gmp mpfr ];
+  propagatedBuildInputs = [ bigarray-compat ];
 
   strictDeps = true;
 
@@ -19,6 +20,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--gmp-prefix ${gmp.dev}"
     "--mpfr-prefix ${mpfr.dev}"
+    "-disable-profiling"
   ];
 
   postConfigure = ''
diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index 79f1f92a52bc..8394befc51e6 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.63.1";
+  version = "0.63.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -37,8 +37,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "simonw";
     repo = pname;
-    rev = version;
-    sha256 = "sha256-KMD4dmflmBp0s4nueLyPpDnXngpftS9/h5M6RPYMGrk=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-VDmh2Q/ab5xaNbj0APuQ9pkZ+GHoNXW2crrJXi556Fk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/dbus-fast/default.nix b/pkgs/development/python-modules/dbus-fast/default.nix
index d8e4507ae8b7..b658eeefd77f 100644
--- a/pkgs/development/python-modules/dbus-fast/default.nix
+++ b/pkgs/development/python-modules/dbus-fast/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "dbus-fast";
-  version = "1.73.0";
+  version = "1.75.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-JkhcDefz7SiZ+w6ijPAnKNyxTZ/5tmQUyOPnKb3EFGc=";
+    hash = "sha256-bmHUfRytUGlS0X1PEQHFocMZ4+FslA2rvzqHNE+3B3E=";
   };
 
   nativeBuildInputs = [
@@ -89,9 +89,9 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    changelog = "https://github.com/Bluetooth-Devices/dbus-fast/releases/tag/v${version}";
     description = "Faster version of dbus-next";
     homepage = "https://github.com/bluetooth-devices/dbus-fast";
+    changelog = "https://github.com/Bluetooth-Devices/dbus-fast/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index 2b42454805c8..317f3d406759 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "fakeredis";
-  version = "1.10.1";
+  version = "2.0.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "dsoftwareinc";
     repo = "fakeredis-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Tqm1p3CNU61aHhiVyP5Gt6bMxni3wvEvR3HFv328Hk0=";
+    hash = "sha256-y9fuVg5Mu0ZT8hoja9V5mEfOz/hPH66Zbk5Rr/luPSc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/flux-led/default.nix b/pkgs/development/python-modules/flux-led/default.nix
index 65c6151fdf6d..21d1a51f8c41 100644
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "flux-led";
-  version = "0.28.32";
+  version = "0.28.34";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-YZ0ox04xakpazOIAERM2EO5c4PzmaSwYWULSjp0MJbw=";
+    hash = "sha256-bIL9ivjCLKeTLK3n0ytgGkXQggsuDiMCY7kAtE81qfY=";
   };
 
   propagatedBuildInputs = [
@@ -44,6 +44,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library to communicate with the flux_led smart bulbs";
     homepage = "https://github.com/Danielhiversen/flux_led";
+    changelog = "https://github.com/Danielhiversen/flux_led/releases/tag/${version}";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ colemickens ];
     platforms = platforms.linux;
diff --git a/pkgs/development/python-modules/mastodon-py/default.nix b/pkgs/development/python-modules/mastodon-py/default.nix
index be1c3d6532ef..ada014a6b81d 100644
--- a/pkgs/development/python-modules/mastodon-py/default.nix
+++ b/pkgs/development/python-modules/mastodon-py/default.nix
@@ -18,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "mastodon-py";
-  version = "1.6.1";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "halcy";
     repo = "Mastodon.py";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-ip2TT5ISOS6HJOnTWajOR5Bajs8ba9QX1EIuPmdHLsE=";
+    sha256 = "sha256-bzacM5bJa936sBW+hgm9GOezW8cVY2oPaWApqjDYLSo=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sentry-sdk/default.nix b/pkgs/development/python-modules/sentry-sdk/default.nix
index a3816d9b7dbf..5db4264507a4 100644
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@@ -1,52 +1,46 @@
 { lib
 , stdenv
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-
-# runtime
-, certifi
-, urllib3
-
-# optionals
 , aiohttp
 , apache-beam
+, asttokens
 , blinker
 , botocore
 , bottle
+, buildPythonPackage
 , celery
+, certifi
 , chalice
 , django
+, executing
 , falcon
+, fetchFromGitHub
 , flask
 , flask-login
+, gevent
 , httpx
+, jsonschema
+, mock
 , pure-eval
 , pyramid
+, pyrsistent
 , pyspark
+, pytest-forked
+, pytest-localserver
+, pytest-watch
+, pytestCheckHook
+, pythonOlder
 , rq
 , sanic
 , sqlalchemy
 , tornado
 , trytond
+, urllib3
 , werkzeug
-
-# tests
-, asttokens
-, executing
-, gevent
-, jsonschema
-, mock
-, pyrsistent
-, pytest-forked
-, pytest-localserver
-, pytest-watch
-, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "1.10.1";
+  version = "1.11.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -54,8 +48,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-python";
-    rev = version;
-    hash = "sha256-wNI92LVGFN+7LPxnrezPeF7dSS5UgwCuF62/ux3rik4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-PObYXwWYQ7cC//W3c+n/qceu2ShjFqMGAaLyNflwcL4=";
   };
 
   propagatedBuildInputs = [
@@ -155,6 +149,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python SDK for Sentry.io";
     homepage = "https://github.com/getsentry/sentry-python";
+    changelog = "https://github.com/getsentry/sentry-python/blob/${version}/CHANGELOG.md";
     license = licenses.bsd2;
     maintainers = with maintainers; [ fab gebner ];
   };
diff --git a/pkgs/development/python-modules/ssdeep/default.nix b/pkgs/development/python-modules/ssdeep/default.nix
index 6ad339a083f5..48ca8b6b938e 100644
--- a/pkgs/development/python-modules/ssdeep/default.nix
+++ b/pkgs/development/python-modules/ssdeep/default.nix
@@ -5,18 +5,21 @@
 , pytestCheckHook
 , six
 , ssdeep
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "ssdeep";
-  version = "3.4";
+  version = "3.4.1";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "DinoTools";
     repo = "python-ssdeep";
-    rev = version;
-    hash = "sha256-eAB4/HmPGj/ngHrqkOlY/kTdY5iUEBHxrsRYjR/RNyw=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-I5ci5BS+B3OE0xdLSahu3HCh99jjhnRHJFz830SvFpg=";
   };
 
   buildInputs = [
@@ -28,7 +31,6 @@ buildPythonPackage rec {
     six
   ];
 
-
   checkInputs = [
     pytestCheckHook
   ];
@@ -45,6 +47,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python wrapper for the ssdeep library";
     homepage = "https://github.com/DinoTools/python-ssdeep";
+    changelog = "https://github.com/DinoTools/python-ssdeep/blob/${version}/CHANGELOG.rst";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/tools/ocaml/camlidl/default.nix b/pkgs/development/tools/ocaml/camlidl/default.nix
index 5c3153a88493..a97ce8499b2a 100644
--- a/pkgs/development/tools/ocaml/camlidl/default.nix
+++ b/pkgs/development/tools/ocaml/camlidl/default.nix
@@ -1,16 +1,17 @@
-{ lib, stdenv, fetchurl, ocaml, writeText }:
+{ lib, stdenv, fetchFromGitHub, ocaml, writeText }:
+
+lib.throwIfNot (lib.versionAtLeast ocaml.version "4.03")
+  "camlidl is not available for OCaml ${ocaml.version}"
 
-let
-  pname = "camlidl";
-  webpage = "https://caml.inria.fr/pub/old_caml_site/camlidl/";
-in
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-  version = "1.05";
+  pname = "ocaml${ocaml.version}-camlidl";
+  version = "1.11";
 
-  src = fetchurl {
-    url = "http://caml.inria.fr/pub/old_caml_site/distrib/bazar-ocaml/${pname}-${version}.tar.gz";
-    sha256 = "0483cs66zsxsavcllpw1qqvyhxb39ddil3h72clcd69g7fyxazl5";
+  src = fetchFromGitHub {
+    owner = "xavierleroy";
+    repo = "camlidl";
+    rev = "camlidl111";
+    sha256 = "sha256-8m0zem/6nvpEJtjJNP/+vafeVLlMvNQGdl8lyf/OeBg=";
   };
 
   nativeBuildInputs = [ ocaml ];
@@ -21,10 +22,10 @@ stdenv.mkDerivation rec {
   preBuild = ''
     mv config/Makefile.unix config/Makefile
     substituteInPlace config/Makefile --replace BINDIR=/usr/local/bin BINDIR=$out
-    substituteInPlace config/Makefile --replace OCAMLLIB=/usr/local/lib/ocaml OCAMLLIB=$out/lib/ocaml/${ocaml.version}/site-lib/camlidl
-    substituteInPlace config/Makefile --replace CPP=/lib/cpp CPP=${stdenv.cc}/bin/cpp
-    substituteInPlace config/Makefile --replace "OCAMLC=ocamlc -g" "OCAMLC=ocamlc -g -warn-error -31"
+    substituteInPlace config/Makefile --replace 'OCAMLLIB=$(shell $(OCAMLC) -where)' OCAMLLIB=$out/lib/ocaml/${ocaml.version}/site-lib/camlidl
+    substituteInPlace config/Makefile --replace CPP=cpp CPP=${stdenv.cc}/bin/cpp
     mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/camlidl/caml
+    mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/camlidl/stublibs
   '';
 
   postInstall = ''
@@ -40,15 +41,14 @@ stdenv.mkDerivation rec {
   '';
 
   setupHook = writeText "setupHook.sh" ''
-    export CAML_LD_LIBRARY_PATH="''${CAML_LD_LIBRARY_PATH-}''${CAML_LD_LIBRARY_PATH:+:}''$1/lib/ocaml/${ocaml.version}/site-lib/${name}/"
     export NIX_CFLAGS_COMPILE+=" -isystem $1/lib/ocaml/${ocaml.version}/site-lib/camlidl"
     export NIX_LDFLAGS+=" -L $1/lib/ocaml/${ocaml.version}/site-lib/camlidl"
   '';
 
   meta = {
     description = "A stub code generator and COM binding for Objective Caml";
-    homepage = webpage;
-    license = "LGPL";
+    homepage = "https://xavierleroy.org/camlidl/";
+    license = lib.licenses.lgpl21;
     maintainers = [ lib.maintainers.roconnor ];
   };
 }
diff --git a/pkgs/development/tools/ruff/default.nix b/pkgs/development/tools/ruff/default.nix
index a90eac39bd84..baec7b093aa0 100644
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.127";
+  version = "0.0.128";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-K2IZtuSbzengPhrOEkDri3D3cy9TmlCgrWm27/bVtxA=";
+    sha256 = "sha256-QJGlhwLXCj4lGI7VMu+1wHmy8K4wYnUFxwsut2q1MUs=";
   };
 
-  cargoSha256 = "sha256-5QuA9/6OyERrR1YSwaeRab91yz4ugsz41JCAhYUwmcA=";
+  cargoSha256 = "sha256-vpfVXhJT65N18l/DZVi5ROgYKIi42rHW4Me+quqiG18=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices
diff --git a/pkgs/os-specific/linux/kernel/perf/5.19-binutils-2.39-support.patch b/pkgs/os-specific/linux/kernel/perf/5.19-binutils-2.39-support.patch
deleted file mode 100644
index 5f4f2fc0b4a9..000000000000
--- a/pkgs/os-specific/linux/kernel/perf/5.19-binutils-2.39-support.patch
+++ /dev/null
@@ -1,352 +0,0 @@
-Fetched as:
-    $ wget 'https://github.com/torvalds/linux/compare/00b32625982e0c796f0abb8effcac9c05ef55bd3...600b7b26c07a070d0153daa76b3806c1e52c9e00.patch'
-
-Adds support for binutils-2.39 API change around init_disassemble_info().
---- a/tools/build/Makefile.feature
-+++ b/tools/build/Makefile.feature
-@@ -70,6 +70,7 @@ FEATURE_TESTS_BASIC :=                  \
-         libaio				\
-         libzstd				\
-         disassembler-four-args		\
-+        disassembler-init-styled	\
-         file-handle
- 
- # FEATURE_TESTS_BASIC + FEATURE_TESTS_EXTRA is the complete list
---- a/tools/build/feature/Makefile
-+++ b/tools/build/feature/Makefile
-@@ -18,6 +18,7 @@ FILES=                                          \
-          test-libbfd.bin                        \
-          test-libbfd-buildid.bin		\
-          test-disassembler-four-args.bin        \
-+         test-disassembler-init-styled.bin	\
-          test-reallocarray.bin			\
-          test-libbfd-liberty.bin                \
-          test-libbfd-liberty-z.bin              \
-@@ -248,6 +249,9 @@ $(OUTPUT)test-libbfd-buildid.bin:
- $(OUTPUT)test-disassembler-four-args.bin:
- 	$(BUILD) -DPACKAGE='"perf"' -lbfd -lopcodes
- 
-+$(OUTPUT)test-disassembler-init-styled.bin:
-+	$(BUILD) -DPACKAGE='"perf"' -lbfd -lopcodes
-+
- $(OUTPUT)test-reallocarray.bin:
- 	$(BUILD)
- 
---- a/tools/build/feature/test-all.c
-+++ b/tools/build/feature/test-all.c
-@@ -166,6 +166,10 @@
- # include "test-disassembler-four-args.c"
- #undef main
- 
-+#define main main_test_disassembler_init_styled
-+# include "test-disassembler-init-styled.c"
-+#undef main
-+
- #define main main_test_libzstd
- # include "test-libzstd.c"
- #undef main
---- /dev/null
-+++ b/tools/build/feature/test-disassembler-init-styled.c
-@@ -0,0 +1,13 @@
-+// SPDX-License-Identifier: GPL-2.0
-+#include <stdio.h>
-+#include <dis-asm.h>
-+
-+int main(void)
-+{
-+	struct disassemble_info info;
-+
-+	init_disassemble_info(&info, stdout,
-+			      NULL, NULL);
-+
-+	return 0;
-+}
-
---- a/tools/build/Makefile.feature
-+++ b/tools/build/Makefile.feature
-@@ -135,8 +135,7 @@ FEATURE_DISPLAY ?=              \
-          get_cpuid              \
-          bpf			\
-          libaio			\
--         libzstd		\
--         disassembler-four-args
-+         libzstd
- 
- # Set FEATURE_CHECK_(C|LD)FLAGS-all for all FEATURE_TESTS features.
- # If in the future we need per-feature checks/flags for features not
-
---- /dev/null
-+++ b/tools/include/tools/dis-asm-compat.h
-@@ -0,0 +1,55 @@
-+/* SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause */
-+#ifndef _TOOLS_DIS_ASM_COMPAT_H
-+#define _TOOLS_DIS_ASM_COMPAT_H
-+
-+#include <stdio.h>
-+#include <dis-asm.h>
-+
-+/* define types for older binutils version, to centralize ifdef'ery a bit */
-+#ifndef DISASM_INIT_STYLED
-+enum disassembler_style {DISASSEMBLER_STYLE_NOT_EMPTY};
-+typedef int (*fprintf_styled_ftype) (void *, enum disassembler_style, const char*, ...);
-+#endif
-+
-+/*
-+ * Trivial fprintf wrapper to be used as the fprintf_styled_func argument to
-+ * init_disassemble_info_compat() when normal fprintf suffices.
-+ */
-+static inline int fprintf_styled(void *out,
-+				 enum disassembler_style style,
-+				 const char *fmt, ...)
-+{
-+	va_list args;
-+	int r;
-+
-+	(void)style;
-+
-+	va_start(args, fmt);
-+	r = vfprintf(out, fmt, args);
-+	va_end(args);
-+
-+	return r;
-+}
-+
-+/*
-+ * Wrapper for init_disassemble_info() that hides version
-+ * differences. Depending on binutils version and architecture either
-+ * fprintf_func or fprintf_styled_func will be called.
-+ */
-+static inline void init_disassemble_info_compat(struct disassemble_info *info,
-+						void *stream,
-+						fprintf_ftype unstyled_func,
-+						fprintf_styled_ftype styled_func)
-+{
-+#ifdef DISASM_INIT_STYLED
-+	init_disassemble_info(info, stream,
-+			      unstyled_func,
-+			      styled_func);
-+#else
-+	(void)styled_func;
-+	init_disassemble_info(info, stream,
-+			      unstyled_func);
-+#endif
-+}
-+
-+#endif /* _TOOLS_DIS_ASM_COMPAT_H */
-
---- a/tools/perf/Makefile.config
-+++ b/tools/perf/Makefile.config
-@@ -298,6 +298,7 @@ FEATURE_CHECK_LDFLAGS-libpython := $(PYTHON_EMBED_LDOPTS)
- FEATURE_CHECK_LDFLAGS-libaio = -lrt
- 
- FEATURE_CHECK_LDFLAGS-disassembler-four-args = -lbfd -lopcodes -ldl
-+FEATURE_CHECK_LDFLAGS-disassembler-init-styled = -lbfd -lopcodes -ldl
- 
- CORE_CFLAGS += -fno-omit-frame-pointer
- CORE_CFLAGS += -ggdb3
-@@ -924,13 +925,16 @@ ifndef NO_LIBBFD
-     ifeq ($(feature-libbfd-liberty), 1)
-       EXTLIBS += -lbfd -lopcodes -liberty
-       FEATURE_CHECK_LDFLAGS-disassembler-four-args += -liberty -ldl
-+      FEATURE_CHECK_LDFLAGS-disassembler-init-styled += -liberty -ldl
-     else
-       ifeq ($(feature-libbfd-liberty-z), 1)
-         EXTLIBS += -lbfd -lopcodes -liberty -lz
-         FEATURE_CHECK_LDFLAGS-disassembler-four-args += -liberty -lz -ldl
-+        FEATURE_CHECK_LDFLAGS-disassembler-init-styled += -liberty -lz -ldl
-       endif
-     endif
-     $(call feature_check,disassembler-four-args)
-+    $(call feature_check,disassembler-init-styled)
-   endif
- 
-   ifeq ($(feature-libbfd-buildid), 1)
-@@ -1044,6 +1048,10 @@ ifeq ($(feature-disassembler-four-args), 1)
-     CFLAGS += -DDISASM_FOUR_ARGS_SIGNATURE
- endif
- 
-+ifeq ($(feature-disassembler-init-styled), 1)
-+    CFLAGS += -DDISASM_INIT_STYLED
-+endif
-+
- ifeq (${IS_64_BIT}, 1)
-   ifndef NO_PERF_READ_VDSO32
-     $(call feature_check,compile-32)
---- a/tools/perf/util/annotate.c
-+++ b/tools/perf/util/annotate.c
-@@ -1720,6 +1720,7 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
- #include <bpf/btf.h>
- #include <bpf/libbpf.h>
- #include <linux/btf.h>
-+#include <tools/dis-asm-compat.h>
- 
- static int symbol__disassemble_bpf(struct symbol *sym,
- 				   struct annotate_args *args)
-@@ -1762,9 +1763,9 @@ static int symbol__disassemble_bpf(struct symbol *sym,
- 		ret = errno;
- 		goto out;
- 	}
--	init_disassemble_info(&info, s,
--			      (fprintf_ftype) fprintf);
--
-+	init_disassemble_info_compat(&info, s,
-+				     (fprintf_ftype) fprintf,
-+				     fprintf_styled);
- 	info.arch = bfd_get_arch(bfdf);
- 	info.mach = bfd_get_mach(bfdf);
- 
-
---- a/tools/bpf/Makefile
-+++ b/tools/bpf/Makefile
-@@ -34,7 +34,7 @@ else
- endif
- 
- FEATURE_USER = .bpf
--FEATURE_TESTS = libbfd disassembler-four-args
-+FEATURE_TESTS = libbfd disassembler-four-args disassembler-init-styled
- FEATURE_DISPLAY = libbfd disassembler-four-args
- 
- check_feat := 1
-@@ -56,6 +56,9 @@ endif
- ifeq ($(feature-disassembler-four-args), 1)
- CFLAGS += -DDISASM_FOUR_ARGS_SIGNATURE
- endif
-+ifeq ($(feature-disassembler-init-styled), 1)
-+CFLAGS += -DDISASM_INIT_STYLED
-+endif
- 
- $(OUTPUT)%.yacc.c: $(srctree)/tools/bpf/%.y
- 	$(QUIET_BISON)$(YACC) -o $@ -d $<
---- a/tools/bpf/bpf_jit_disasm.c
-+++ b/tools/bpf/bpf_jit_disasm.c
-@@ -28,6 +28,7 @@
- #include <sys/types.h>
- #include <sys/stat.h>
- #include <limits.h>
-+#include <tools/dis-asm-compat.h>
- 
- #define CMD_ACTION_SIZE_BUFFER		10
- #define CMD_ACTION_READ_ALL		3
-@@ -64,7 +65,9 @@ static void get_asm_insns(uint8_t *image, size_t len, int opcodes)
- 	assert(bfdf);
- 	assert(bfd_check_format(bfdf, bfd_object));
- 
--	init_disassemble_info(&info, stdout, (fprintf_ftype) fprintf);
-+	init_disassemble_info_compat(&info, stdout,
-+				     (fprintf_ftype) fprintf,
-+				     fprintf_styled);
- 	info.arch = bfd_get_arch(bfdf);
- 	info.mach = bfd_get_mach(bfdf);
- 	info.buffer = image;
-
---- a/tools/bpf/Makefile
-+++ b/tools/bpf/Makefile
-@@ -35,7 +35,7 @@ endif
- 
- FEATURE_USER = .bpf
- FEATURE_TESTS = libbfd disassembler-four-args disassembler-init-styled
--FEATURE_DISPLAY = libbfd disassembler-four-args
-+FEATURE_DISPLAY = libbfd
- 
- check_feat := 1
- NON_CHECK_FEAT_TARGETS := clean bpftool_clean runqslower_clean resolve_btfids_clean
-
---- a/tools/bpf/bpftool/Makefile
-+++ b/tools/bpf/bpftool/Makefile
-@@ -93,7 +93,7 @@ INSTALL ?= install
- RM ?= rm -f
- 
- FEATURE_USER = .bpftool
--FEATURE_TESTS = libbfd disassembler-four-args zlib libcap \
-+FEATURE_TESTS = libbfd disassembler-four-args disassembler-init-styled zlib libcap \
- 	clang-bpf-co-re
- FEATURE_DISPLAY = libbfd disassembler-four-args zlib libcap \
- 	clang-bpf-co-re
-@@ -117,6 +117,9 @@ endif
- ifeq ($(feature-disassembler-four-args), 1)
- CFLAGS += -DDISASM_FOUR_ARGS_SIGNATURE
- endif
-+ifeq ($(feature-disassembler-init-styled), 1)
-+    CFLAGS += -DDISASM_INIT_STYLED
-+endif
- 
- LIBS = $(LIBBPF) -lelf -lz
- LIBS_BOOTSTRAP = $(LIBBPF_BOOTSTRAP) -lelf -lz
---- a/tools/bpf/bpftool/jit_disasm.c
-+++ b/tools/bpf/bpftool/jit_disasm.c
-@@ -24,6 +24,7 @@
- #include <sys/stat.h>
- #include <limits.h>
- #include <bpf/libbpf.h>
-+#include <tools/dis-asm-compat.h>
- 
- #include "json_writer.h"
- #include "main.h"
-@@ -39,15 +40,12 @@ static void get_exec_path(char *tpath, size_t size)
- }
- 
- static int oper_count;
--static int fprintf_json(void *out, const char *fmt, ...)
-+static int printf_json(void *out, const char *fmt, va_list ap)
- {
--	va_list ap;
- 	char *s;
- 	int err;
- 
--	va_start(ap, fmt);
- 	err = vasprintf(&s, fmt, ap);
--	va_end(ap);
- 	if (err < 0)
- 		return -1;
- 
-@@ -73,6 +71,32 @@ static int fprintf_json(void *out, const char *fmt, ...)
- 	return 0;
- }
- 
-+static int fprintf_json(void *out, const char *fmt, ...)
-+{
-+	va_list ap;
-+	int r;
-+
-+	va_start(ap, fmt);
-+	r = printf_json(out, fmt, ap);
-+	va_end(ap);
-+
-+	return r;
-+}
-+
-+static int fprintf_json_styled(void *out,
-+			       enum disassembler_style style __maybe_unused,
-+			       const char *fmt, ...)
-+{
-+	va_list ap;
-+	int r;
-+
-+	va_start(ap, fmt);
-+	r = printf_json(out, fmt, ap);
-+	va_end(ap);
-+
-+	return r;
-+}
-+
- void disasm_print_insn(unsigned char *image, ssize_t len, int opcodes,
- 		       const char *arch, const char *disassembler_options,
- 		       const struct btf *btf,
-@@ -99,11 +123,13 @@ void disasm_print_insn(unsigned char *image, ssize_t len, int opcodes,
- 	assert(bfd_check_format(bfdf, bfd_object));
- 
- 	if (json_output)
--		init_disassemble_info(&info, stdout,
--				      (fprintf_ftype) fprintf_json);
-+		init_disassemble_info_compat(&info, stdout,
-+					     (fprintf_ftype) fprintf_json,
-+					     fprintf_json_styled);
- 	else
--		init_disassemble_info(&info, stdout,
--				      (fprintf_ftype) fprintf);
-+		init_disassemble_info_compat(&info, stdout,
-+					     (fprintf_ftype) fprintf,
-+					     fprintf_styled);
- 
- 	/* Update architecture info for offload. */
- 	if (arch) {
diff --git a/pkgs/os-specific/linux/kernel/perf/default.nix b/pkgs/os-specific/linux/kernel/perf/default.nix
index 709312ebdcdf..e4c8be02cbb0 100644
--- a/pkgs/os-specific/linux/kernel/perf/default.nix
+++ b/pkgs/os-specific/linux/kernel/perf/default.nix
@@ -4,9 +4,7 @@
 , fetchurl
 , kernel
 , elfutils
-, python2
 , python3
-, python3Packages
 , perl
 , newt
 , slang
@@ -61,34 +59,23 @@ stdenv.mkDerivation {
 
   inherit (kernel) src;
 
-  patches = lib.optionals (lib.versionAtLeast kernel.version "5.19" && lib.versionOlder kernel.version "5.20") [
-    # binutils-2.39 support around init_disassemble_info()
-    # API change.
-    # Will be included in 5.20.
-    ./5.19-binutils-2.39-support.patch
-  ];
-
   postPatch = ''
-    patchShebangs scripts tools/perf/pmu-events/jevents.py
-  '' + lib.optionalString (lib.versionAtLeast kernel.version "5.8") ''
-    substituteInPlace tools/perf/scripts/python/flamegraph.py \
-      --replace "/usr/share/d3-flame-graph/d3-flamegraph-base.html" \
-      "${d3-flame-graph-templates}/share/d3-flame-graph/d3-flamegraph-base.html"
-  '';
+    # Linux scripts
+    patchShebangs scripts
 
-  preConfigure = ''
     cd tools/perf
 
-    substituteInPlace Makefile \
-      --replace /usr/include/elfutils $elfutils/include/elfutils
-
     for x in util/build-id.c util/dso.c; do
       substituteInPlace $x --replace /usr/lib/debug /run/current-system/sw/lib/debug
     done
 
-    if [ -f bash_completion ]; then
-      sed -i 's,^have perf,_have perf,' bash_completion
-    fi
+  '' + lib.optionalString (lib.versionAtLeast kernel.version "5.8") ''
+    substituteInPlace scripts/python/flamegraph.py \
+      --replace "/usr/share/d3-flame-graph/d3-flamegraph-base.html" \
+      "${d3-flame-graph-templates}/share/d3-flame-graph/d3-flamegraph-base.html"
+
+  '' + lib.optionalString (lib.versionAtLeast kernel.version "6.0") ''
+    patchShebangs pmu-events/jevents.py
   '';
 
   makeFlags = [ "prefix=$(out)" "WERROR=0" ] ++ kernel.makeFlags;
@@ -127,10 +114,9 @@ stdenv.mkDerivation {
   then [ libbfd libopcodes ]
   else [ libbfd_2_38 libopcodes_2_38 ])
   ++ lib.optional withGtk gtk2
-  ++ (if (lib.versionAtLeast kernel.version "4.19") then [ python3 ] else [ python2 ])
   ++ lib.optional withZstd zstd
   ++ lib.optional withLibcap libcap
-  ++ lib.optional (lib.versionAtLeast kernel.version "6.0") python3Packages.setuptools;
+  ++ lib.optional (lib.versionAtLeast kernel.version "6.0") python3.pkgs.setuptools;
 
   NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=cpp"
@@ -140,22 +126,23 @@ stdenv.mkDerivation {
   ];
 
   doCheck = false; # requires "sparse"
-  doInstallCheck = false; # same
 
-  separateDebugInfo = true;
   installFlags = [ "install" "install-man" "ASCIIDOC8=1" "prefix=$(out)" ];
 
-  postInstall =''
+  # TODO: Add completions based on perf-completion.sh
+  postInstall = ''
     # Same as perf. Remove.
     rm -f $out/bin/trace
   '';
 
+  separateDebugInfo = true;
+
   preFixup = ''
     # Pull in 'objdump' into PATH to make annotations work.
     # The embeded Python interpreter will search PATH to calculate the Python path configuration(Should be fixed by upstream).
     # Add python.interpreter to PATH for now.
     wrapProgram $out/bin/perf \
-      --prefix PATH : ${lib.makeBinPath ([ binutils-unwrapped ] ++ (if (lib.versionAtLeast kernel.version "4.19") then [ python3 ] else [ python2 ]))}
+      --prefix PATH : ${lib.makeBinPath [ binutils-unwrapped python3 ]}
   '';
 
   meta = with lib; {
diff --git a/pkgs/servers/nosql/surrealdb/default.nix b/pkgs/servers/nosql/surrealdb/default.nix
index 6e89e5ba03ad..f6bca761f23f 100644
--- a/pkgs/servers/nosql/surrealdb/default.nix
+++ b/pkgs/servers/nosql/surrealdb/default.nix
@@ -31,6 +31,8 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [
     pkg-config
+    # needed on top of LIBCLANG_PATH to compile rquickjs
+    llvmPackages.clang
   ];
 
   buildInputs = [ openssl ]
diff --git a/pkgs/servers/web-apps/outline/default.nix b/pkgs/servers/web-apps/outline/default.nix
index 03f8a0e45b7b..19cc2ee94cfd 100644
--- a/pkgs/servers/web-apps/outline/default.nix
+++ b/pkgs/servers/web-apps/outline/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "outline";
-  version = "0.66.2";
+  version = "0.66.3";
 
   src = fetchFromGitHub {
     owner = "outline";
     repo = "outline";
     rev = "v${version}";
-    sha256 = "sha256-jRnw6UIUA3gAgyqQg6R1GOI4O8HXKnVfTH3d3SFBa9A=";
+    sha256 = "sha256-2o5rRVOd+dvJOzQFGuuA0PZmmK/wnItcNu8WX9WShQ8=";
   };
 
   nativeBuildInputs = [ makeWrapper yarn2nix-moretea.fixup_yarn_lock ];
diff --git a/pkgs/tools/misc/ncdu/default.nix b/pkgs/tools/misc/ncdu/default.nix
index 4844e81079a6..b8b5d93c3813 100644
--- a/pkgs/tools/misc/ncdu/default.nix
+++ b/pkgs/tools/misc/ncdu/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ncdu";
-  version = "2.1.2";
+  version = "2.2.1";
 
   src = fetchurl {
     url = "https://dev.yorhel.nl/download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ng1u8DYYo8MWcmv0khe37+Rc7HWLLJF86JLe10Myxtw=";
+    sha256 = "sha256-Xkr49rzYz3rY/T15ANqxMgdFoEUxAenjdPmnf3Ku0UE=";
   };
 
   XDG_CACHE_HOME="Cache"; # FIXME This should be set in stdenv
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index 7959e18698d2..68cd26e5cc34 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.26"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.2.27"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index d635a1231580..2fef911c967a 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: ef8b26c32cbcf48e9ba6a4d6c01d587a1d45f6cc
-  ref: refs/tags/6.2.26
+  revision: 1847611817b4dbea38ac13c83ac2c4abd92d7bc2
+  ref: refs/tags/6.2.27
   specs:
-    metasploit-framework (6.2.26)
+    metasploit-framework (6.2.27)
       actionpack (~> 6.0)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -32,7 +32,7 @@ GIT
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 2.0.99)
+      metasploit-payloads (= 2.0.101)
       metasploit_data_models
       metasploit_payloads-mettle (= 1.0.20)
       mqtt
@@ -129,13 +129,13 @@ GEM
     arel-helpers (2.14.0)
       activerecord (>= 3.1.0, < 8)
     aws-eventstream (1.2.0)
-    aws-partitions (1.659.0)
-    aws-sdk-core (3.167.0)
+    aws-partitions (1.664.0)
+    aws-sdk-core (3.168.1)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.5)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-ec2 (1.349.0)
+    aws-sdk-ec2 (1.351.0)
       aws-sdk-core (~> 3, >= 3.165.0)
       aws-sigv4 (~> 1.1)
     aws-sdk-iam (1.73.0)
@@ -176,10 +176,10 @@ GEM
     eventmachine (1.2.7)
     faker (3.0.0)
       i18n (>= 1.8.11, < 2)
-    faraday (2.6.0)
+    faraday (2.7.1)
       faraday-net_http (>= 2.0, < 3.1)
       ruby2_keywords (>= 0.0.4)
-    faraday-net_http (3.0.1)
+    faraday-net_http (3.0.2)
     faraday-retry (2.0.0)
       faraday (~> 2.0)
     faye-websocket (0.11.1)
@@ -204,7 +204,7 @@ GEM
     i18n (1.12.0)
       concurrent-ruby (~> 1.0)
     io-console (0.5.11)
-    irb (1.4.2)
+    irb (1.4.3)
       reline (>= 0.3.0)
     jmespath (1.6.1)
     jsobfu (0.4.2)
@@ -236,7 +236,7 @@ GEM
       activemodel (~> 6.0)
       activesupport (~> 6.0)
       railties (~> 6.0)
-    metasploit-payloads (2.0.99)
+    metasploit-payloads (2.0.101)
     metasploit_data_models (5.0.6)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -286,13 +286,13 @@ GEM
       hashery (~> 2.0)
       ruby-rc4
       ttfunk
-    pg (1.4.4)
+    pg (1.4.5)
     public_suffix (5.0.0)
     puma (6.0.0)
       nio4r (~> 2.0)
     racc (1.6.0)
     rack (2.2.4)
-    rack-protection (3.0.2)
+    rack-protection (3.0.3)
       rack
     rack-test (2.0.2)
       rack (>= 1.3)
@@ -367,7 +367,7 @@ GEM
     ruby-macho (3.0.0)
     ruby-rc4 (0.1.5)
     ruby2_keywords (0.0.5)
-    ruby_smb (3.2.0)
+    ruby_smb (3.2.1)
       bindata
       openssl-ccm
       openssl-cmac
@@ -380,12 +380,12 @@ GEM
       faraday (>= 0.17.3, < 3)
     simpleidn (0.2.1)
       unf (~> 0.1.4)
-    sinatra (3.0.2)
+    sinatra (3.0.3)
       mustermann (~> 3.0)
       rack (~> 2.2, >= 2.2.4)
-      rack-protection (= 3.0.2)
+      rack-protection (= 3.0.3)
       tilt (~> 2.0)
-    sqlite3 (1.5.3)
+    sqlite3 (1.5.4)
       mini_portile2 (~> 2.8.0)
     sshkey (2.0.0)
     swagger-blocks (3.0.0)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index cae6648f5ef9..8acd5d35d510 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.2.26";
+  version = "6.2.27";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-qPhN+N0AFSrkdxtUPZwJMicDafKpuwaQg+sDA6ssHow=";
+    sha256 = "sha256-0wovO6Dt65vA5C2/XNfHf4fsc3GvWp4mnh9gsY3O8Is=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 8e9709c984e3..38f9f23b3344 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -104,30 +104,30 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0iwkwvx56rivfrqgsjap7bkn0zd9d5m712fx0b1mgcfalm6xjcpl";
+      sha256 = "1h69kvk5nrjfznms3dy9xk552xzv4kbq7ks9wgj1fdbxzc3rszng";
       type = "gem";
     };
-    version = "1.659.0";
+    version = "1.664.0";
   };
   aws-sdk-core = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "095nj7sf8914y60m1grnpy7cm6ybnw4ywnc0j84gz2vgv1m8awfk";
+      sha256 = "1vnnv9gk3dapng8siaqdimqkr4a99lfavx7lkwx2jiyy1p6c50rb";
       type = "gem";
     };
-    version = "3.167.0";
+    version = "3.168.1";
   };
   aws-sdk-ec2 = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1xk33r0q44ngsy9d6nh4isw9aa9rz31ajb69apk4b2wmc2gi1mcw";
+      sha256 = "0fcisnrj46idp0gmzjba39w5ay7phs0q8lai5mdwgn790n3cxkqr";
       type = "gem";
     };
-    version = "1.349.0";
+    version = "1.351.0";
   };
   aws-sdk-iam = {
     groups = ["default"];
@@ -344,20 +344,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0mqv17hfmph4ylmb2bqyccy64gsgpmzapq5yrmf5yjsqkvw9rxbv";
+      sha256 = "1wyz9ab0mzi84gpf81fs19vrixglmmxi25k6n1mn9h141qmsp590";
       type = "gem";
     };
-    version = "2.6.0";
+    version = "2.7.1";
   };
   faraday-net_http = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13b717ddw90iaf4vijy06srmkvrfbzsnyjap93yll0nibad4dbxq";
+      sha256 = "13byv3mp1gsjyv8k0ih4612y6vw5kqva6i03wcg4w2fqpsd950k8";
       type = "gem";
     };
-    version = "3.0.1";
+    version = "3.0.2";
   };
   faraday-retry = {
     groups = ["default"];
@@ -504,10 +504,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1g2xhrjjgbix2acss59kwzfzgcwf450j91paz7vqa578g95i32my";
+      sha256 = "0s28igrsspxmhwmwalv9c7g6ld2glzns2vhlfqmc3jnvnr68yhf1";
       type = "gem";
     };
-    version = "1.4.2";
+    version = "1.4.3";
   };
   jmespath = {
     groups = ["default"];
@@ -604,12 +604,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "ef8b26c32cbcf48e9ba6a4d6c01d587a1d45f6cc";
-      sha256 = "130y5jmh60zbhf80dfx9y9lh69rj16f3sm0vfzj2l580vpw4vy58";
+      rev = "1847611817b4dbea38ac13c83ac2c4abd92d7bc2";
+      sha256 = "12zhrs6v2q0zkqk9wnmgf5ryr1vzqzbmrgrdwk09pszdl0xjy2nk";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.2.26";
+    version = "6.2.27";
   };
   metasploit-model = {
     groups = ["default"];
@@ -626,10 +626,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rfnxkg31ksylg1rjk05d9kk4af4rbw66ipwl3q0vl3qvnbymfm8";
+      sha256 = "0m9w4yy5iwpbbjycpxyhfql2b4dnm4wgcn039aw43igjgfdrkmkz";
       type = "gem";
     };
-    version = "2.0.99";
+    version = "2.0.101";
   };
   metasploit_data_models = {
     groups = ["default"];
@@ -907,10 +907,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09a5z9qhxnybahx162q2q1cygdhxfp6cihdivvzh32jlwc37z1x3";
+      sha256 = "1wd6nl81nbdwck04hccsm7wf23ghpi8yddd9j4rbwyvyj0sbsff1";
       type = "gem";
     };
-    version = "1.4.4";
+    version = "1.4.5";
   };
   public_suffix = {
     groups = ["default"];
@@ -957,10 +957,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jmixih0qrsdz60dhznkk29v50ks55cqq51jjf0yn3amqghh4bhk";
+      sha256 = "1sfk4i52yijcggkzkwj3z6k2iv9fdacmcgcid1c8xjcldh93fhpg";
       type = "gem";
     };
-    version = "3.0.2";
+    version = "3.0.3";
   };
   rack-test = {
     groups = ["default"];
@@ -1287,10 +1287,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0iyp4j0j2bd0barp7057mr7280921c05ij2ygr1715lj1p9j4h5x";
+      sha256 = "0rsxb9bi3x4kxhhsaa4araxfz0zk573v0j4xv64d3p176kii6cmm";
       type = "gem";
     };
-    version = "3.2.0";
+    version = "3.2.1";
   };
   rubyntlm = {
     groups = ["default"];
@@ -1337,10 +1337,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0c2vmy0j5amy9fihs2gz2ssm4bdpqqh4llyjfl6qqqry7f87c6xz";
+      sha256 = "0znx4qhvgah5k696crv954xkrh8z4gick2fx04xl67wng7nnwrrc";
       type = "gem";
     };
-    version = "3.0.2";
+    version = "3.0.3";
   };
   sqlite3 = {
     dependencies = ["mini_portile2"];
@@ -1348,10 +1348,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i95rgfxdj2rhxifps27dz7fjfdih5iyl7b01di9gdmh9m04ylk6";
+      sha256 = "009124l2yw7csrq3mvzffjflgpqi3y30flazjqf6aad64gnnnksx";
       type = "gem";
     };
-    version = "1.5.3";
+    version = "1.5.4";
   };
   sshkey = {
     groups = ["default"];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d705cc3306ce..787e54ec249c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -17582,6 +17582,8 @@ with pkgs;
 
   privacyidea = callPackage ../applications/misc/privacyidea { };
 
+  process-compose = callPackage ../applications/misc/process-compose { };
+
   process-viewer = callPackage ../applications/misc/process-viewer {
     inherit (darwin.apple_sdk.frameworks) DiskArbitration Foundation IOKit;
   };