diff --git a/nixos/modules/services/hardware/throttled.nix b/nixos/modules/services/hardware/throttled.nix
index 9fa495886119..0f1f00348ee8 100644
--- a/nixos/modules/services/hardware/throttled.nix
+++ b/nixos/modules/services/hardware/throttled.nix
@@ -27,6 +27,7 @@ in {
       then pkgs.writeText "throttled.conf" cfg.extraConfig
       else "${pkgs.throttled}/etc/throttled.conf";
 
+    hardware.cpu.x86.msr.enable = true;
     # Kernel 5.9 spams warnings whenever userspace writes to CPU MSRs.
     # See https://github.com/erpalma/throttled/issues/215
     hardware.cpu.x86.msr.settings.allow-writes =
diff --git a/pkgs/applications/audio/monkeys-audio/default.nix b/pkgs/applications/audio/monkeys-audio/default.nix
index f04f343e85de..6165e2c6181a 100644
--- a/pkgs/applications/audio/monkeys-audio/default.nix
+++ b/pkgs/applications/audio/monkeys-audio/default.nix
@@ -5,13 +5,13 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "10.24";
+  version = "10.26";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${
       builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    sha256 = "sha256-18rHv9sbxpuMfMrqoSSeEncDmQlWpdA/xNPoYJoIgJ0=";
+    sha256 = "sha256-SXuuAavvqzZ7DRX6SKfPfC1smbTHVHUAv80w0RHLfpg=";
     stripRoot = false;
   };
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/mympd/default.nix b/pkgs/applications/audio/mympd/default.nix
index 189f1139d7e7..3e130b0855d4 100644
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "12.0.4";
+  version = "13.0.0";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-pOs3VfgpDUD8KiBmJ37qpGLguxOXm5cr+jlTEeRZ4Bk=";
+    sha256 = "sha256-cYoGjge2VtU+QqIURGd/EpkSQ4fhvsdnYZYyESAd56U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/graphics/freecad/0001-NIXOS-don-t-ignore-PYTHONPATH.patch b/pkgs/applications/graphics/freecad/0001-NIXOS-don-t-ignore-PYTHONPATH.patch
new file mode 100644
index 000000000000..371da24680e0
--- /dev/null
+++ b/pkgs/applications/graphics/freecad/0001-NIXOS-don-t-ignore-PYTHONPATH.patch
@@ -0,0 +1,60 @@
+From c4f452ef6ae083ed21095313582f6d1bd775cbf3 Mon Sep 17 00:00:00 2001
+From: Andreas Rammhold <andreas@rammhold.de>
+Date: Thu, 2 Nov 2023 17:32:07 +0100
+Subject: [PATCH] NIXOS: don't ignore PYTHONPATH
+
+On NixOS or rather within nixpkgs we provide the runtime Python
+packages via the PYTHONPATH environment variable. FreeCAD tries its
+best to ignore Python environment variables that are being inherited
+from the environment. For Python versions >=3.11 it also tries to
+initialize the interpreter config without any environmental data. We
+have to initialize the configuration *with* the information from the
+environment for our packaging to work.
+
+Upstream has purposely isolated the environments AFAIK and thus
+shouldn't accept this patch (as is). What they might accept (once
+support for older Python versions has been dropped) is removing the
+PYTHONPATH specific putenv calls.
+---
+ src/Base/Interpreter.cpp | 2 +-
+ src/Main/MainGui.cpp     | 3 ---
+ 2 files changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/src/Base/Interpreter.cpp b/src/Base/Interpreter.cpp
+index 52c47168af..9966bd0013 100644
+--- a/src/Base/Interpreter.cpp
++++ b/src/Base/Interpreter.cpp
+@@ -554,7 +554,7 @@ void initInterpreter(int argc,char *argv[])
+ {
+     PyStatus status;
+     PyConfig config;
+-    PyConfig_InitIsolatedConfig(&config);
++    PyConfig_InitPythonConfig(&config);
+ 
+     status = PyConfig_SetBytesArgv(&config, argc, argv);
+     if (PyStatus_Exception(status)) {
+diff --git a/src/Main/MainGui.cpp b/src/Main/MainGui.cpp
+index 48ae847ef4..28813df383 100644
+--- a/src/Main/MainGui.cpp
++++ b/src/Main/MainGui.cpp
+@@ -112,17 +112,14 @@ int main( int argc, char ** argv )
+     // See https://forum.freecad.org/viewtopic.php?f=18&t=20600
+     // See Gui::Application::runApplication()
+     putenv("LC_NUMERIC=C");
+-    putenv("PYTHONPATH=");
+ #elif defined(FC_OS_MACOSX)
+     (void)QLocale::system();
+-    putenv("PYTHONPATH=");
+ #elif defined(__MINGW32__)
+     const char* mingw_prefix = getenv("MINGW_PREFIX");
+     const char* py_home = getenv("PYTHONHOME");
+     if (!py_home && mingw_prefix)
+         _putenv_s("PYTHONHOME", mingw_prefix);
+ #else
+-    _putenv("PYTHONPATH=");
+     // https://forum.freecad.org/viewtopic.php?f=4&t=18288
+     // https://forum.freecad.org/viewtopic.php?f=3&t=20515
+     const char* fc_py_home = getenv("FC_PYTHONHOME");
+-- 
+2.42.0
+
diff --git a/pkgs/applications/graphics/freecad/default.nix b/pkgs/applications/graphics/freecad/default.nix
index f997f23d43cf..76b2a38320d8 100644
--- a/pkgs/applications/graphics/freecad/default.nix
+++ b/pkgs/applications/graphics/freecad/default.nix
@@ -108,6 +108,10 @@ stdenv.mkDerivation (finalAttrs: {
     qtx11extras
   ];
 
+  patches = [
+    ./0001-NIXOS-don-t-ignore-PYTHONPATH.patch
+  ];
+
   cmakeFlags = [
     "-Wno-dev" # turns off warnings which otherwise makes it hard to see what is going on
     "-DBUILD_FLAT_MESH:BOOL=ON"
@@ -127,10 +131,7 @@ stdenv.mkDerivation (finalAttrs: {
     export NIX_LDFLAGS="-L${gfortran.cc}/lib64 -L${gfortran.cc}/lib $NIX_LDFLAGS";
   '';
 
-  # Their main() removes PYTHONPATH=, and we rely on it.
   preConfigure = ''
-    sed '/putenv("PYTHONPATH/d' -i src/Main/MainGui.cpp
-
     qtWrapperArgs+=(--prefix PYTHONPATH : "$PYTHONPATH")
   '';
 
diff --git a/pkgs/applications/misc/waybar/default.nix b/pkgs/applications/misc/waybar/default.nix
index d02bd6f0942f..e82e7a266fb7 100644
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@@ -74,13 +74,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "waybar";
-  version = "0.9.23";
+  version = "0.9.24";
 
   src = fetchFromGitHub {
     owner = "Alexays";
     repo = "Waybar";
     rev = finalAttrs.version;
-    hash = "sha256-MYOnEqoIN74rw/+DdTLdZXG8JmF70j5hPXhahfp32m0=";
+    hash = "sha256-JhLKGzqZ8akWcyHTav2TGcGmXk9dy9Xj4+/oFCPeNU0=";
   };
 
   postUnpack = lib.optional cavaSupport ''
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
index d6898e9d86c2..3577c2a12b25 100644
--- a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
@@ -32,6 +32,9 @@
 , libuuid
 , systemd
 , wayland
+
+# command line arguments which are always set e.g "--disable-gpu"
+, commandLineArgs ? ""
 }:
 
 let
@@ -179,7 +182,9 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     wrapProgram "$out/bin/${longName}" \
-      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.pname}-${gtk3.version}"
+      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.pname}-${gtk3.version}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags ${lib.escapeShellArg commandLineArgs}
   '';
 
   passthru.updateScript = ./update.py;
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index d0c3a2145aac..b570c5bb53f0 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -1,12 +1,12 @@
 { callPackage }: builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; })) {
   signal-desktop = {
     dir = "Signal";
-    version = "6.36.0";
-    hash = "sha256-zoeRBBu+eYWibpCUiyDOcDVKFQSRI+l1dZgUlESdUsk=";
+    version = "6.37.0";
+    hash = "sha256-oPW2YHyYsbTvQ+8VQtaubBki7w2wd1tlgVmPL5v5E5s=";
   };
   signal-desktop-beta = {
     dir = "Signal Beta";
-    version = "6.36.0-beta.2";
-    hash = "sha256-LOfKdyXosU0bJB35+TSszfHROPhLvMtngzy4zFeVVmI=";
+    version = "6.38.0-beta.1";
+    hash = "sha256-DZXqq4AD1arP+o5xbuR8yD5By5VPBtClchScZb2Nb1U=";
   };
 }
diff --git a/pkgs/development/python-modules/aioairq/default.nix b/pkgs/development/python-modules/aioairq/default.nix
index 73be4e3f64cf..13eff2506598 100644
--- a/pkgs/development/python-modules/aioairq/default.nix
+++ b/pkgs/development/python-modules/aioairq/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aioairq";
-  version = "0.3.0";
+  version = "0.3.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "CorantGmbH";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-9OO3ox6q08QQcYfz4ArsKy/6jR329bAQPUo+mVYuhJs=";
+    hash = "sha256-SRsDSHTZkkygaQZjHENKNLx3ZWMi/PubS1m/MonEKNk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/aioairzone-cloud/default.nix b/pkgs/development/python-modules/aioairzone-cloud/default.nix
index 586f74c89c7a..3b722f0fa5f2 100644
--- a/pkgs/development/python-modules/aioairzone-cloud/default.nix
+++ b/pkgs/development/python-modules/aioairzone-cloud/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "aioairzone-cloud";
-  version = "0.3.2";
+  version = "0.3.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "aioairzone-cloud";
     rev = "refs/tags/${version}";
-    hash = "sha256-aaa2/E6QCeWtTc1c7n0z05Kn3gCCjuQVbdwCgMAYX1A=";
+    hash = "sha256-X3OhfMW+0oOzubDdSumja//GyI4qgfuyz9/I9xybR9M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aiortm/default.nix b/pkgs/development/python-modules/aiortm/default.nix
index c4e0d9c5aa47..93b345d89a1d 100644
--- a/pkgs/development/python-modules/aiortm/default.nix
+++ b/pkgs/development/python-modules/aiortm/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiortm";
-  version = "0.6.3";
+  version = "0.6.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,8 +21,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "MartinHjelmare";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-9Ny1Xby2e1lyrDTZLd6UVASx8/kwjsq4ogMTSKryQqg=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-PFZ8B2Wtjg3xUFYcnthTW5QXLk//lFH25jwpF7hygxQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aiosmtplib/default.nix b/pkgs/development/python-modules/aiosmtplib/default.nix
index 7eefe5fa155f..dda58fc011e8 100644
--- a/pkgs/development/python-modules/aiosmtplib/default.nix
+++ b/pkgs/development/python-modules/aiosmtplib/default.nix
@@ -12,16 +12,16 @@
 
 buildPythonPackage rec {
   pname = "aiosmtplib";
-  version = "3.0.0";
+  version = "3.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "cole";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-A9pvHj2riIHCd1F+ve6aLdbtl3tPPDovV1AZeWNeOEo=";
+    repo = "aiosmtplib";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-67Z+k+PBIGP2oGb/52dMtsapUsHufvFcX+wWiMj5Jsg=";
   };
 
   nativeBuildInputs = [
@@ -43,6 +43,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module which provides a SMTP client";
     homepage = "https://github.com/cole/aiosmtplib";
+    changelog = "https://github.com/cole/aiosmtplib/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/anywidget/default.nix b/pkgs/development/python-modules/anywidget/default.nix
index 8eb392f68595..25aa92449105 100644
--- a/pkgs/development/python-modules/anywidget/default.nix
+++ b/pkgs/development/python-modules/anywidget/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "anywidget";
-  version = "0.7.0";
+  version = "0.7.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OxwCnCGvSwrVxBzQwxMBqESsETu2q1vdevJHDr/IfUI=";
+    hash = "sha256-HEy1EGP47FFyuMjvsb+3mGHTQMNJEiDVa4wqaqjbOz0=";
   };
 
   # We do not need the jupyterlab build dependency, because we do not need to
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index fd389308c931..45f61e63c10c 100644
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "atlassian-python-api";
-  version = "3.41.1";
+  version = "3.41.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "atlassian-api";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-DSIJOp5c/bqOOIZylhUGyIwIco5isA3ytCRR51WfTyI=";
+    hash = "sha256-MIzBuIeQfAVlllaU02htx1eufRlpe+V9Kzo+EFF45ME=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/awscrt/default.nix b/pkgs/development/python-modules/awscrt/default.nix
index d10e3a966344..36f282fe1e45 100644
--- a/pkgs/development/python-modules/awscrt/default.nix
+++ b/pkgs/development/python-modules/awscrt/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "awscrt";
-  version = "0.19.7";
+  version = "0.19.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-t/LwioUTZ0fNrJUlx83HG1ytmLW64gH6W17Gd2UXets=";
+    hash = "sha256-d6I1nRL41sWFvv9Nxw5dSJDEv15i9Lni0wySyWruEGU=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/python-modules/beartype/default.nix b/pkgs/development/python-modules/beartype/default.nix
index 42b3ea063de5..3eba6f3317a4 100644
--- a/pkgs/development/python-modules/beartype/default.nix
+++ b/pkgs/development/python-modules/beartype/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "beartype";
-  version = "0.15.0";
+  version = "0.16.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Kvao2KcmfM99Jx4aO9kIr7wCXSoJqlESNWfX17N0ON8=";
+    hash = "sha256-GtqJzy1usw624Vbu0utUkzV3gpN5ENdDgJGOU8Lq4L8=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 2efe49547834..3975fa900a1c 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -363,12 +363,12 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.28.64";
+  version = "1.28.78";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zky/LBr6GhTFw8xWp094wMGISAzalgom+Zi5P/FjzgY=";
+    hash = "sha256-LPjWdNfoXewM9M4I/jGqExgpzHq9NvIZ5ymslTUfTe4=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index c6472883c5c8..bccc6a2055c1 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.31.64";
+  version = "1.31.78";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-K1sbzvl1nNMgIyJ1PLrNk2s2rtAwFuUjh98y4aojMwo=";
+    hash = "sha256-zVUOuUqlDXGds8oAt5/7zEgOPe/tBx4SOiQ9+B3UVDA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/boxx/default.nix b/pkgs/development/python-modules/boxx/default.nix
index a2a71ad0c986..7dd580c345a7 100644
--- a/pkgs/development/python-modules/boxx/default.nix
+++ b/pkgs/development/python-modules/boxx/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "boxx";
-  version = "0.10.10";
+  version = "0.10.12";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7A5qFpISrjVrqQfKk6BPb7RhDWd9f90eF3bku+LsCcc=";
+    hash = "sha256-pumkDVyotm8bJEl/rrpNSsP8KZIVIgThGFB/Sy4OdUs=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/garth/default.nix b/pkgs/development/python-modules/garth/default.nix
index 8277d8e28f40..20c26da372b6 100644
--- a/pkgs/development/python-modules/garth/default.nix
+++ b/pkgs/development/python-modules/garth/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "garth";
-  version = "0.4.39";
+  version = "0.4.41";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-2jmgi0evGqVgtcPRTYpTWG0wFrG1i5W7ryZJslPweNc=";
+    hash = "sha256-1CnRgPJTG7cpfa/SyhBwVw0Lj6ENI/YY/q2yNeve9c0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/httpx-ntlm/default.nix b/pkgs/development/python-modules/httpx-ntlm/default.nix
index 83d427c73ef1..8d8a5e838b79 100644
--- a/pkgs/development/python-modules/httpx-ntlm/default.nix
+++ b/pkgs/development/python-modules/httpx-ntlm/default.nix
@@ -1,7 +1,6 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
 , httpx
 , pyspnego
 , pythonOlder
@@ -9,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "httpx-ntlm";
-  version = "1.1.0";
+  version = "1.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,18 +16,9 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "httpx_ntlm";
     inherit version;
-    hash = "sha256-a1a5laZ4tNOtpVDFCK1t2IXWbyJytZMhuad2JtmA52I=";
+    hash = "sha256-Qb6KK6hRQ0hOYX3LkX1LGeOuEq/caIYipJAQNJk7U+Q=";
   };
 
-  patches = [
-    # Update version specifiers, https://github.com/ulodciv/httpx-ntlm/pull/15
-    (fetchpatch {
-      name = "update-version-specifiers.patch";
-      url = "https://github.com/ulodciv/httpx-ntlm/commit/dac67a957c5c23df29d4790ddbc7cc4bccfc0e35.patch";
-      hash = "sha256-YtgRrgGG/x7jvNg+NuQIrkOUdyD6Bk53fRaiXBwiV+o=";
-    })
-  ];
-
   propagatedBuildInputs = [
     httpx
     pyspnego
@@ -44,6 +34,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "NTLM authentication support for HTTPX";
     homepage = "https://github.com/ulodciv/httpx-ntlm";
+    changelog = "https://github.com/ulodciv/httpx-ntlm/releases/tag/${version}";
     license = licenses.isc;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/neo4j/default.nix b/pkgs/development/python-modules/neo4j/default.nix
index e973c2289e5e..1e034efa1971 100644
--- a/pkgs/development/python-modules/neo4j/default.nix
+++ b/pkgs/development/python-modules/neo4j/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "neo4j";
-  version = "5.14.0";
+  version = "5.14.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "neo4j";
     repo = "neo4j-python-driver";
     rev = "refs/tags/${version}";
-    hash = "sha256-HNgH01ZoQLuZ3K9sSYAYa6/ZTbVYsOUFhOqgP7y2F3Q=";
+    hash = "sha256-lQNsVpkMRn23qzqAa/K6aPrip67TsL+nXpMRqOXNFik=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/openapi3/default.nix b/pkgs/development/python-modules/openapi3/default.nix
new file mode 100644
index 000000000000..72e852d209c9
--- /dev/null
+++ b/pkgs/development/python-modules/openapi3/default.nix
@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, requests
+, pyyaml
+, setuptools
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "openapi3";
+  version = "1.8.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-ohpJBXPYnKaa2ny+WFrbL8pJZCV/bzod9THxKBVFXSw=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    requests
+    pyyaml
+  ];
+
+  nativeCheckinputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+   "openapi3"
+  ];
+
+  meta = with lib; {
+    changelog = "https://github.com/Dorthu/openapi3/releases/tag/${version}";
+    description = "A Python3 OpenAPI 3 Spec Parser";
+    homepage = "https://github.com/Dorthu/openapi3";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ techknowlogick ];
+  };
+}
diff --git a/pkgs/development/python-modules/peewee/default.nix b/pkgs/development/python-modules/peewee/default.nix
index ca5d4f45677c..deeccfe69881 100644
--- a/pkgs/development/python-modules/peewee/default.nix
+++ b/pkgs/development/python-modules/peewee/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "peewee";
-  version = "3.16.3";
+  version = "3.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "coleifer";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-QeJaGTKZHmzN+J8uUGXQJXCTINX7iP30u+s+GDP/kpQ=";
+    hash = "sha256-QbbwC55q/BjMGtm3fH8HPd0aETMzLAFwVYFvOS/4dqA=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pyduotecno/default.nix b/pkgs/development/python-modules/pyduotecno/default.nix
index 17fd2d78885c..365490a224c5 100644
--- a/pkgs/development/python-modules/pyduotecno/default.nix
+++ b/pkgs/development/python-modules/pyduotecno/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyduotecno";
-  version = "2023.10.1";
+  version = "2023.11.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Cereal2nd";
     repo = "pyDuotecno";
     rev = "refs/tags/${version}";
-    hash = "sha256-fDooQb1i9rgzDZBzZ+lYb0WUYC8JNPEYk5DJ9wtS2Dg=";
+    hash = "sha256-XtNaghYVoE28Dp6YY92SNy0Zw2BxZLYX83EzUSvx/HM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pyside2/default.nix b/pkgs/development/python-modules/pyside2/default.nix
index 7670b443318b..5dfa7fb823fa 100644
--- a/pkgs/development/python-modules/pyside2/default.nix
+++ b/pkgs/development/python-modules/pyside2/default.nix
@@ -10,11 +10,6 @@
 , qt5
 , shiboken2
 }:
-
-# Only build when Python<=3.10
-# See https://bugreports.qt.io/browse/PYSIDE-1864
-# "There are no plans to support Python versions > 3.10 in the 5.15 branch."
-disabledIf (pythonAtLeast "3.11") (
 stdenv.mkDerivation rec {
   pname = "pyside2";
   version = "5.15.11";
@@ -80,4 +75,4 @@ stdenv.mkDerivation rec {
     homepage = "https://wiki.qt.io/Qt_for_Python";
     maintainers = with maintainers; [ gebner ];
   };
-})
+}
diff --git a/pkgs/development/python-modules/python-smarttub/default.nix b/pkgs/development/python-modules/python-smarttub/default.nix
index 59d3058b1757..418ce7c7928a 100644
--- a/pkgs/development/python-modules/python-smarttub/default.nix
+++ b/pkgs/development/python-modules/python-smarttub/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "python-smarttub";
-  version = "0.0.33";
+  version = "0.0.34";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "mdz";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-BGG5SQfVxhp6ID2Ob+afm75cInVixSPD5012K4HwthU=";
+    hash = "sha256-PFlVxSxGcbqvA1cQZkKLtrmg+Dere4B1VCUzIU8RaI8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/rich-click/default.nix b/pkgs/development/python-modules/rich-click/default.nix
index bd6dfe20f082..6aad6e527975 100644
--- a/pkgs/development/python-modules/rich-click/default.nix
+++ b/pkgs/development/python-modules/rich-click/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "rich-click";
-  version = "1.7.0";
+  version = "1.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "ewels";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Fmdxs7yeaHe8++LSQGuYK3Qwc0CdPvV9UCSXa09Djt4=";
+    hash = "sha256-rWVJEuJx5nDUg6RvhubHu9U2Glilrkugjg28SpFIZys=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/types-awscrt/default.nix b/pkgs/development/python-modules/types-awscrt/default.nix
index 77f1acb86871..afd09159424d 100644
--- a/pkgs/development/python-modules/types-awscrt/default.nix
+++ b/pkgs/development/python-modules/types-awscrt/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "types-awscrt";
-  version = "0.19.7";
+  version = "0.19.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "types_awscrt";
     inherit version;
-    hash = "sha256-OkqKWCnwpNgGR2vZTEp+IxpWGHn6xP4ERwWsxEshKmQ=";
+    hash = "sha256-otU0twF8NHbuaaRL2K6vO1iMQrqoMiRz0QCkXuZ1ENc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
index 715d261eea4f..7f2e8ab81a39 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
@@ -2,12 +2,11 @@
 }:
 
 rec {
-  name = "stage0-posix-${version}-${rev}-source";
-  # Pinned from https://github.com/oriansj/stage0-posix/commit/3189b5f325b7ef8b88e3edec7c1cde4fce73c76c
-  version = "unstable-2023-05-02";
-  rev = "3189b5f325b7ef8b88e3edec7c1cde4fce73c76c";
+  name = "stage0-posix-${version}-source";
+  version = "1.6.0";
+  rev = "Release_${version}";
   outputHashAlgo = "sha256";
-  outputHash = "sha256-7Y9+csTwZIQp0WGbagX+Q4f2zavN7AUk1TSBp/H5Xks=";
+  outputHash = "sha256-epUaShjKiAd749ICvc6rS6WhUkS8R4heKuPdwUjEtsQ=";
 
   /*
   Since `make-minimal-bootstrap-sources` requires nixpkgs and nix it
diff --git a/pkgs/servers/isso/default.nix b/pkgs/servers/isso/default.nix
index 00432ab5fc6f..735db1f0b435 100644
--- a/pkgs/servers/isso/default.nix
+++ b/pkgs/servers/isso/default.nix
@@ -23,6 +23,12 @@ buildPythonApplication rec {
     "doc"
   ];
 
+  postPatch = ''
+    # Remove when https://github.com/posativ/isso/pull/973 is available.
+    substituteInPlace isso/tests/test_comments.py \
+      --replace "self.client.delete_cookie('localhost.local', '1')" "self.client.delete_cookie(key='1', domain='localhost')"
+  '';
+
   propagatedBuildInputs = [
     itsdangerous
     jinja2
diff --git a/pkgs/servers/nosql/apache-jena/binary.nix b/pkgs/servers/nosql/apache-jena/binary.nix
index 2277c997b7a8..2b7e3c04735d 100644
--- a/pkgs/servers/nosql/apache-jena/binary.nix
+++ b/pkgs/servers/nosql/apache-jena/binary.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-jena";
-  version = "4.9.0";
+  version = "4.10.0";
   src = fetchurl {
     url = "mirror://apache/jena/binaries/apache-jena-${version}.tar.gz";
-    hash = "sha256-kUsEdEKwYjyM5G8YKTt90fWzX21hiulRj3W5jK45Keg=";
+    hash = "sha256-G2kCh5F2WfrSOCr+fEO02mlOSVfV2Oy3uZGNEarLR+M=";
   };
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/tools/filesystems/btrfs-progs/default.nix b/pkgs/tools/filesystems/btrfs-progs/default.nix
index 602e1ff77071..05dbc34c7d9b 100644
--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "6.5.3";
+  version = "6.6";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    hash = "sha256-/OfLP5IOYV5j+vJlpM2fK/OdStyqZiEcmHaX2oWi7t0=";
+    hash = "sha256-lnkple77LqrgUcLOO1YJt+m7LBpcuD/mn5LxEBtUuGk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/filesystems/zfstools/default.nix b/pkgs/tools/filesystems/zfstools/default.nix
index feb5b23df52a..0a4447bacc4f 100644
--- a/pkgs/tools/filesystems/zfstools/default.nix
+++ b/pkgs/tools/filesystems/zfstools/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, ruby, zfs }:
+{ lib, stdenv, fetchFromGitHub, ruby, zfs, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "zfstools";
@@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ ruby ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out/bin
@@ -20,10 +21,10 @@ stdenv.mkDerivation rec {
     cp -R lib $out/
 
     for f in $out/bin/*; do
-      substituteInPlace $f --replace "/usr/bin/env ruby" "ruby -I$out/lib"
+      wrapProgram $f \
+        --set RUBYLIB $out/lib \
+        --prefix PATH : ${zfs}/bin
     done
-
-    sed -e 's|cmd.*=.*"zfs |cmd = "${zfs}/sbin/zfs |g' -i $out/lib/zfstools/{dataset,snapshot}.rb
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index 0f4c544f8f48..4e0782c752de 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "9.5.0";
+  version = "9.5.1";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XDsZyDTULetUnV0zFn6ZhP/2MJN0gs/HlvWmdeTa0NU=";
+    hash = "sha256-nQ6Dd87ZkA+DPUtLnL83+jGcBNOoO6jmqtQXoynMS+8=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/tools/virtualization/linode-cli/default.nix b/pkgs/tools/virtualization/linode-cli/default.nix
index e25fcb3a19bc..a4f54ec86177 100644
--- a/pkgs/tools/virtualization/linode-cli/default.nix
+++ b/pkgs/tools/virtualization/linode-cli/default.nix
@@ -8,29 +8,33 @@
 , requests
 , setuptools
 , terminaltables
+, rich
+, openapi3
+, packaging
 }:
 
 let
-  sha256 = "0r5by5d6wr5zbsaj211s99qg28nr7wm8iri6jxnksx5b375dah6g";
+  hash = "sha256-J0L+FTVzYuAqTDOwpoH12lQr03UNo5dsQpd/iUKR40Q=";
   # specVersion taken from: https://www.linode.com/docs/api/openapi.yaml at `info.version`.
-  specVersion = "4.140.0";
-  specSha256 = "0ay54m4aa8bmmpjc7s66rfzqzk4w25h48b9a665y29g67ybb432g";
+  specVersion = "4.166.0";
+  specHash = "sha256-rUwKQt3y/ALZUoW3eJiiIDJYLQpUHO7Abm0h09ra02g=";
   spec = fetchurl {
     url = "https://raw.githubusercontent.com/linode/linode-api-docs/v${specVersion}/openapi.yaml";
-    sha256 = specSha256;
+    hash = specHash;
   };
 
 in
 
 buildPythonApplication rec {
   pname = "linode-cli";
-  version = "5.26.1";
+  version = "5.45.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "linode";
     repo = pname;
-    rev = version;
-    inherit sha256;
+    rev = "v${version}";
+    inherit hash;
   };
 
   patches = [
@@ -40,7 +44,7 @@ buildPythonApplication rec {
   # remove need for git history
   prePatch = ''
     substituteInPlace setup.py \
-      --replace "version=get_version()," "version='${version}',"
+      --replace "version = get_version()" "version='${version}',"
   '';
 
   propagatedBuildInputs = [
@@ -49,11 +53,15 @@ buildPythonApplication rec {
     requests
     setuptools
     terminaltables
+    rich
+    openapi3
+    packaging
   ];
 
   postConfigure = ''
     python3 -m linodecli bake ${spec} --skip-config
     cp data-3 linodecli/
+    echo "${version}" > baked_version
   '';
 
   doInstallCheck = true;
@@ -69,9 +77,10 @@ buildPythonApplication rec {
   passthru.updateScript = ./update.sh;
 
   meta = with lib; {
+    mainProgram = "linode-cli";
     description = "The Linode Command Line Interface";
     homepage = "https://github.com/linode/linode-cli";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ ryantm ];
+    maintainers = with maintainers; [ ryantm techknowlogick ];
   };
 }
diff --git a/pkgs/tools/virtualization/linode-cli/remove-update-check.patch b/pkgs/tools/virtualization/linode-cli/remove-update-check.patch
index 316d2855b1f4..f26b30edf72d 100644
--- a/pkgs/tools/virtualization/linode-cli/remove-update-check.patch
+++ b/pkgs/tools/virtualization/linode-cli/remove-update-check.patch
@@ -1,11 +1,13 @@
---- a/linodecli/cli.py
-+++ b/linodecli/cli.py
-@@ -555,7 +555,7 @@
-         if self.debug_request:
-             self.print_response_debug_info(result)
- 
--        if not self.suppress_warnings:
-+        if False:
-             # check the major/minor version API reported against what we were built
-             # with to see if an upgrade should be available
-             api_version_higher = False
+diff --git a/linodecli/api_request.py b/linodecli/api_request.py
+index 4273aa6..3ada5c2 100644
+--- a/linodecli/api_request.py
++++ b/linodecli/api_request.py
+@@ -305,7 +305,7 @@ def _attempt_warn_old_version(ctx, result):
+                 file=sys.stderr,
+             )
+
+-    if api_version_higher:
++    if False:
+         # check to see if there is, in fact, a version to upgrade to.  If not, don't
+         # suggest an upgrade (since there's no package anyway)
+         new_version_exists = False
\ No newline at end of file
diff --git a/pkgs/tools/virtualization/linode-cli/update.sh b/pkgs/tools/virtualization/linode-cli/update.sh
index f232dd1e03b0..8bd0bfe8602e 100755
--- a/pkgs/tools/virtualization/linode-cli/update.sh
+++ b/pkgs/tools/virtualization/linode-cli/update.sh
@@ -18,13 +18,13 @@ VERSION=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
     | grep -v -e rc -e list \
     | cut -d '"' -f4 | sort -rV | head -n 1)
 
-SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/linode/linode-cli/archive/refs/tags/${VERSION}.tar.gz)
+SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/linode/linode-cli/archive/refs/tags/v${VERSION}.tar.gz)
 
 setKV () {
     sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" ./default.nix
 }
 
 setKV specVersion ${SPEC_VERSION}
-setKV specSha256 ${SPEC_SHA256}
+setKV specHash ${SPEC_SHA256}
 setKV version ${VERSION}
-setKV sha256 ${SHA256}
+setKV hash ${SHA256}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9ccbcaeefe37..883b6d7490ff 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8431,6 +8431,8 @@ self: super: with self; {
 
   openapi-spec-validator = callPackage ../development/python-modules/openapi-spec-validator { };
 
+  openapi3 = callPackage ../development/python-modules/openapi3 { };
+
   openbabel-bindings = callPackage ../development/python-modules/openbabel-bindings {
       openbabel = callPackage ../development/libraries/openbabel { inherit (self) python; };
   };