diff --git a/pkgs/applications/misc/wttrbar/default.nix b/pkgs/applications/misc/wttrbar/default.nix
index 4e4a84988115..54775719a2e5 100644
--- a/pkgs/applications/misc/wttrbar/default.nix
+++ b/pkgs/applications/misc/wttrbar/default.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wttrbar";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "bjesus";
     repo = "wttrbar";
     rev = version;
-    hash = "sha256-RQeRDu8x6OQAD7VYT7FwBfj8gxn1nj6hP60oCIiuAgg=";
+    hash = "sha256-697LoXu6x8ODQa7tG/NqpSqnLJgM765wBFFnKyul7uI=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk_11_0.frameworks.Security ];
 
-  cargoHash = "sha256-hJCEA6m/iZuSjWRbbaoJ5ryG0z5U/IWhbEvNAohFyjg=";
+  cargoHash = "sha256-sxZ4R7QXQSuNFNRuOI/omON6QmQ0DTKQvjHy1BcvXAA=";
 
   meta = {
     description = "A simple but detailed weather indicator for Waybar using wttr.in";
diff --git a/pkgs/applications/networking/cloudflared/default.nix b/pkgs/applications/networking/cloudflared/default.nix
index 9163b8a5d59f..a83f1e1dfa61 100644
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2023.8.0";
+  version = "2023.8.2";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
     rev = "refs/tags/${version}";
-    hash = "sha256-2gBVq7qCOJtSPbE1Yiq7J3roAku1ax+vfZ0SZ8WVHz8=";
+    hash = "sha256-8khwpGOBSpbAHnKeKFZUrJoE0dgQB3bN6Y/W2gwRfCM=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/science/math/gretl/default.nix b/pkgs/applications/science/math/gretl/default.nix
index 64e2b9f91313..f7ccbf8905c0 100644
--- a/pkgs/applications/science/math/gretl/default.nix
+++ b/pkgs/applications/science/math/gretl/default.nix
@@ -1,13 +1,29 @@
-{ lib, stdenv, fetchurl, curl, fftw, gmp, gnuplot, gtk3, gtksourceview3, json-glib
-, lapack, libxml2, mpfr, openblas, pkg-config, readline }:
+{ lib
+, stdenv
+, fetchurl
+, curl
+, fftw
+, gmp
+, gnuplot
+, gtk3
+, gtksourceview3
+, json-glib
+, lapack
+, libxml2
+, mpfr
+, openblas
+, readline
+, Accelerate
+, pkg-config
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gretl";
-  version = "2023a";
+  version = "2023b";
 
   src = fetchurl {
-    url = "mirror://sourceforge/gretl/${pname}-${version}.tar.xz";
-    sha256 = "sha256-T1UwQhw/Tr/juYqVJBkst2LRBCIXPLvVd0N+QCJcVtM=";
+    url = "mirror://sourceforge/gretl/gretl-${finalAttrs.version}.tar.xz";
+    hash = "sha256-Hf025JjFxde43TN/1m9PeA1uHqxKTZMI8+1qf3XJLGs=";
   };
 
   buildInputs = [
@@ -23,9 +39,13 @@ stdenv.mkDerivation rec {
     mpfr
     openblas
     readline
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    Accelerate
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
   enableParallelBuilding = true;
   # Missing install depends:
@@ -33,15 +53,15 @@ stdenv.mkDerivation rec {
   #  make[1]: *** [Makefile:73: install_datafiles] Error 1
   enableParallelInstalling = false;
 
-  meta = with lib; {
+  meta = {
     description = "A software package for econometric analysis";
+    homepage = "https://gretl.sourceforge.net";
+    license = lib.licenses.gpl3;
     longDescription = ''
       gretl is a cross-platform software package for econometric analysis,
       written in the C programming language.
     '';
-    homepage = "https://gretl.sourceforge.net";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ dmrauh ];
-    platforms = with platforms; all;
+    maintainers = with lib.maintainers; [ dmrauh ];
+    platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/development/libraries/java/commons/lang/default.nix b/pkgs/development/libraries/java/commons/lang/default.nix
index b9ccfef8382c..9eca9e3070b2 100644
--- a/pkgs/development/libraries/java/commons/lang/default.nix
+++ b/pkgs/development/libraries/java/commons/lang/default.nix
@@ -1,26 +1,31 @@
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+}:
 
-stdenv.mkDerivation rec {
-  version = "3.12.0";
+stdenv.mkDerivation (finalAttrs: {
+  version = "3.13.0";
   pname = "commons-lang";
 
   src = fetchurl {
-    url    = "mirror://apache/commons/lang/binaries/commons-lang3-${version}-bin.tar.gz";
-    sha256 = "sha256-MwEkZd/Lf3kKyjM+CevxBeKl+5XCxjiz33kNPvqQjig=";
+    url = "mirror://apache/commons/lang/binaries/commons-lang3-${finalAttrs.version}-bin.tar.gz";
+    hash = "sha256-yDEbe1wqyfxuJe2DK55YnNLKLh7JcsHAgp2OohWBwWU=";
   };
 
   installPhase = ''
-    tar xf ${src}
+    runHook preInstall
+    tar xf ${finalAttrs.src}
     mkdir -p $out/share/java
     cp *.jar $out/share/java/
+    runHook postInstall
   '';
 
   meta = {
-    homepage    = "https://commons.apache.org/proper/commons-lang";
     description = "Provides additional methods to manipulate standard Java library classes";
+    homepage = "https://commons.apache.org/proper/commons-lang";
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ copumpkin ];
-    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
-    license     = lib.licenses.asl20;
     platforms = with lib.platforms; unix;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
   };
-}
+})
diff --git a/pkgs/development/tools/database/vitess/default.nix b/pkgs/development/tools/database/vitess/default.nix
index 1b3d0a849110..da9740740615 100644
--- a/pkgs/development/tools/database/vitess/default.nix
+++ b/pkgs/development/tools/database/vitess/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "vitess";
-  version = "17.0.1";
+  version = "17.0.2";
 
   src = fetchFromGitHub {
     owner = "vitessio";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-EvCH1NxsGQzkXv0i5WOZXG9jeile0IHyZAoINgBIwYs=";
+    hash = "sha256-uST+FtYhGIn/Tieyofbh2r8xonw8qsS6ODrpd/A27r4=";
   };
 
   vendorHash = "sha256-0OrPbMG7ElOD+9/kWx1HtvGUBiFpIsNs5Vu7QofzE6Q=";
diff --git a/pkgs/development/tools/flyway/default.nix b/pkgs/development/tools/flyway/default.nix
index 4fec2ef0c065..54f2056732b9 100644
--- a/pkgs/development/tools/flyway/default.nix
+++ b/pkgs/development/tools/flyway/default.nix
@@ -1,10 +1,11 @@
-{ lib, stdenv, fetchurl, jre_headless, makeWrapper }:
-stdenv.mkDerivation rec{
+{ lib, stdenv, fetchurl, jre_headless, makeWrapper, testers }:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "flyway";
-  version = "9.21.2";
+  version = "9.22.0";
   src = fetchurl {
-    url = "mirror://maven/org/flywaydb/flyway-commandline/${version}/flyway-commandline-${version}.tar.gz";
-    sha256 = "sha256-7MIjXF1qgEye2Z/cyeuSFkEmXT8AxkwYfw+/UevsPFg=";
+    url = "mirror://maven/org/flywaydb/flyway-commandline/${finalAttrs.version}/flyway-commandline-${finalAttrs.version}.tar.gz";
+    sha256 = "sha256-vdg66ETDfa0WG1TrRWJ9XpMSCE9sd5GlYAJY2TERC5Y=";
   };
   nativeBuildInputs = [ makeWrapper ];
   dontBuild = true;
@@ -12,13 +13,16 @@ stdenv.mkDerivation rec{
   installPhase = ''
     mkdir -p $out/bin $out/share/flyway
     cp -r sql jars drivers conf $out/share/flyway
-    install -Dt $out/share/flyway/lib lib/community/*.jar lib/*.jar
+    install -Dt $out/share/flyway/lib lib/community/*.jar lib/*.jar lib/aad/*.jar lib/oracle_wallet/*.jar
     makeWrapper "${jre_headless}/bin/java" $out/bin/flyway \
       --add-flags "-Djava.security.egd=file:/dev/../dev/urandom" \
       --add-flags "-classpath '$out/share/flyway/lib/*:$out/share/flyway/drivers/*'" \
       --add-flags "org.flywaydb.commandline.Main" \
       --add-flags "-jarDirs='$out/share/flyway/jars'"
   '';
+  passthru.tests = {
+    version = testers.testVersion { package = finalAttrs.finalPackage; };
+  };
   meta = with lib; {
     description = "Evolve your Database Schema easily and reliably across all your instances";
     longDescription = ''
@@ -30,9 +34,10 @@ stdenv.mkDerivation rec{
     '';
     downloadPage = "https://github.com/flyway/flyway";
     homepage = "https://flywaydb.org/";
+    changelog = "https://documentation.red-gate.com/fd/release-notes-for-flyway-engine-179732572.html";
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.asl20;
     platforms = platforms.unix;
     maintainers = [ maintainers.cmcdragonkai ];
   };
-}
+})
diff --git a/pkgs/games/vintagestory/default.nix b/pkgs/games/vintagestory/default.nix
index b0f5b54bc93e..2e3b1b3b0e7a 100644
--- a/pkgs/games/vintagestory/default.nix
+++ b/pkgs/games/vintagestory/default.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vintagestory";
-  version = "1.18.8";
+  version = "1.18.10";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${version}.tar.gz";
-    hash = "sha256-q7MxmsWCGODOt/hCkCPz964m7az27SddIRBJ1vYg02k=";
+    hash = "sha256-xkpoVFZWlqhSSDn62MbhBYU6X+l5MmPxtrewg9xKuJc=";
   };
 
 
diff --git a/pkgs/test/cc-wrapper/fortify1-example.c b/pkgs/test/cc-wrapper/fortify1-example.c
new file mode 100644
index 000000000000..48b9c268e728
--- /dev/null
+++ b/pkgs/test/cc-wrapper/fortify1-example.c
@@ -0,0 +1,16 @@
+/* an example that should be protected by FORTIFY_SOURCE=1 */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+
+int main(int argc, char *argv[]) {
+    /* allocate on the heap so we're likely to get an
+     * over-allocation and can be more sure that a
+     * failure is because of fortify protection rather
+     * than a genuine segfault */
+    char* buffer = malloc(sizeof(char) * 7);
+    strcpy(buffer, argv[1]);
+    puts(buffer);
+    return 0;
+}
diff --git a/pkgs/test/cc-wrapper/fortify2-example.c b/pkgs/test/cc-wrapper/fortify2-example.c
new file mode 100644
index 000000000000..dfb5a8e87294
--- /dev/null
+++ b/pkgs/test/cc-wrapper/fortify2-example.c
@@ -0,0 +1,16 @@
+/* an example that should be protected by FORTIFY_SOURCE=2 but
+ * not FORTIFY_SOURCE=1 */
+#include <stdio.h>
+#include <string.h>
+
+struct buffer_with_pad {
+    char buffer[7];
+    char pad[25];
+};
+
+int main(int argc, char *argv[]) {
+    struct buffer_with_pad b;
+    strcpy(b.buffer, argv[1]);
+    puts(b.buffer);
+    return 0;
+}
diff --git a/pkgs/test/cc-wrapper/fortify3-example.c b/pkgs/test/cc-wrapper/fortify3-example.c
new file mode 100644
index 000000000000..9a0a5f4792c3
--- /dev/null
+++ b/pkgs/test/cc-wrapper/fortify3-example.c
@@ -0,0 +1,13 @@
+/* an example that should be protected by FORTIFY_SOURCE=3 but
+ * not FORTIFY_SOURCE=2 */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+
+int main(int argc, char *argv[]) {
+    char* buffer = malloc(atoi(argv[2]));
+    strcpy(buffer, argv[1]);
+    puts(buffer);
+    return 0;
+}
diff --git a/pkgs/test/cc-wrapper/hardening.nix b/pkgs/test/cc-wrapper/hardening.nix
new file mode 100644
index 000000000000..41ddaefdfea8
--- /dev/null
+++ b/pkgs/test/cc-wrapper/hardening.nix
@@ -0,0 +1,396 @@
+{ lib
+, stdenv
+, runCommand
+, runCommandWith
+, runCommandCC
+, debian-devscripts
+}:
+
+let
+  # writeCBin from trivial-builders won't let us choose
+  # our own stdenv
+  writeCBinWithStdenv = codePath: stdenv': env: runCommandWith {
+    name = "test-bin";
+    stdenv = stdenv';
+    derivationArgs = {
+      inherit codePath;
+      preferLocalBuild = true;
+      allowSubstitutes = false;
+    } // env;
+  } ''
+    [ -n "$preBuild" ] && eval "$preBuild"
+    n=$out/bin/test-bin
+    mkdir -p "$(dirname "$n")"
+    cp "$codePath" code.c
+    NIX_DEBUG=1 $CC -x c code.c -O1 $TEST_EXTRA_FLAGS -o "$n"
+  '';
+
+  f1exampleWithStdEnv = writeCBinWithStdenv ./fortify1-example.c;
+  f2exampleWithStdEnv = writeCBinWithStdenv ./fortify2-example.c;
+  f3exampleWithStdEnv = writeCBinWithStdenv ./fortify3-example.c;
+
+  stdenvUnsupport = additionalUnsupported: stdenv.override {
+    cc = stdenv.cc.override {
+      cc = (lib.extendDerivation true {
+        hardeningUnsupportedFlags = (stdenv.cc.cc.hardeningUnsupportedFlags or []) ++ additionalUnsupported;
+      } stdenv.cc.cc);
+    };
+    allowedRequisites = null;
+  };
+
+  checkTestBin = testBin: {
+    # can only test flags that are detectable by hardening-check
+    ignoreBindNow ? true,
+    ignoreFortify ? true,
+    ignorePie ? true,
+    ignoreRelRO ? true,
+    ignoreStackProtector ? true,
+    expectFailure ? false,
+  }: let
+    expectFailureClause = lib.optionalString expectFailure
+      " && echo 'ERROR: Expected hardening-check to fail, but it passed!' >&2 && exit 1";
+  in runCommandCC "check-test-bin" {
+    nativeBuildInputs = [ debian-devscripts ];
+    buildInputs = [ testBin ];
+    meta.platforms = lib.platforms.linux;  # ELF-reliant
+  } ''
+    hardening-check --nocfprotection \
+      ${lib.optionalString ignoreBindNow "--nobindnow"} \
+      ${lib.optionalString ignoreFortify "--nofortify"} \
+      ${lib.optionalString ignorePie "--nopie"} \
+      ${lib.optionalString ignoreRelRO "--norelro"} \
+      ${lib.optionalString ignoreStackProtector "--nostackprotector"} \
+      $(PATH=$HOST_PATH type -P test-bin) ${expectFailureClause}
+    touch $out
+  '';
+
+  nameDrvAfterAttrName = builtins.mapAttrs (name: drv:
+    drv.overrideAttrs (_: { name = "test-${name}"; })
+  );
+
+  # returning a specific exit code when aborting due to a fortify
+  # check isn't mandated. so it's better to just ensure that a
+  # nonzero exit code is returned when we go a single byte beyond
+  # the buffer, with the example programs being designed to be
+  # unlikely to genuinely segfault for such a small overflow.
+  fortifyExecTest = testBin: runCommand "exec-test" {
+    buildInputs = [
+      testBin
+    ];
+    meta.broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
+  } ''
+    (
+      export PATH=$HOST_PATH
+      echo "Saturated buffer:" # check program isn't completly broken
+      test-bin 012345 7
+      echo "One byte too far:" # eighth byte being the null terminator
+      (! test-bin 0123456 7) || (echo 'Expected failure, but succeeded!' && exit 1)
+    )
+    echo "Expected behaviour observed"
+    touch $out
+  '';
+
+  brokenIf = cond: drv: if cond then drv.overrideAttrs (old: { meta = old.meta or {} // { broken = true; }; }) else drv;
+
+in nameDrvAfterAttrName ({
+  bindNowExplicitEnabled = brokenIf stdenv.hostPlatform.isStatic (checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningEnable = [ "bindnow" ];
+  }) {
+    ignoreBindNow = false;
+  });
+
+  # musl implementation undetectable by this means even if present
+  fortifyExplicitEnabled = brokenIf stdenv.hostPlatform.isMusl (checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningEnable = [ "fortify" ];
+  }) {
+    ignoreFortify = false;
+  });
+
+  fortify1ExplicitEnabledExecTest = fortifyExecTest (f1exampleWithStdEnv stdenv {
+    hardeningEnable = [ "fortify" ];
+  });
+
+  # musl implementation is effectively FORTIFY_SOURCE=1-only,
+  # clang-on-glibc also only appears to support FORTIFY_SOURCE=1 (!)
+  fortifyExplicitEnabledExecTest = brokenIf (
+    stdenv.hostPlatform.isMusl || (stdenv.cc.isClang && stdenv.hostPlatform.libc == "glibc")
+  ) (fortifyExecTest (f2exampleWithStdEnv stdenv {
+    hardeningEnable = [ "fortify" ];
+  }));
+
+  fortify3ExplicitEnabled = brokenIf (
+    stdenv.hostPlatform.isMusl || !stdenv.cc.isGNU || lib.versionOlder stdenv.cc.version "12"
+  ) (checkTestBin (f3exampleWithStdEnv stdenv {
+    hardeningEnable = [ "fortify3" ];
+  }) {
+    ignoreFortify = false;
+  });
+
+  # musl implementation is effectively FORTIFY_SOURCE=1-only
+  fortify3ExplicitEnabledExecTest = brokenIf (
+    stdenv.hostPlatform.isMusl || !stdenv.cc.isGNU || lib.versionOlder stdenv.cc.version "12"
+  ) (fortifyExecTest (f3exampleWithStdEnv stdenv {
+    hardeningEnable = [ "fortify3" ];
+  }));
+
+  pieExplicitEnabled = brokenIf stdenv.hostPlatform.isStatic (checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningEnable = [ "pie" ];
+  }) {
+    ignorePie = false;
+  });
+
+  relROExplicitEnabled = checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningEnable = [ "relro" ];
+  }) {
+    ignoreRelRO = false;
+  };
+
+  stackProtectorExplicitEnabled = brokenIf stdenv.hostPlatform.isStatic (checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningEnable = [ "stackprotector" ];
+  }) {
+    ignoreStackProtector = false;
+  });
+
+  bindNowExplicitDisabled = checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningDisable = [ "bindnow" ];
+  }) {
+    ignoreBindNow = false;
+    expectFailure = true;
+  };
+
+  fortifyExplicitDisabled = checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningDisable = [ "fortify" ];
+  }) {
+    ignoreFortify = false;
+    expectFailure = true;
+  };
+
+  fortify3ExplicitDisabled = checkTestBin (f3exampleWithStdEnv stdenv {
+    hardeningDisable = [ "fortify3" ];
+  }) {
+    ignoreFortify = false;
+    expectFailure = true;
+  };
+
+  fortifyExplicitDisabledDisablesFortify3 = checkTestBin (f3exampleWithStdEnv stdenv {
+    hardeningEnable = [ "fortify3" ];
+    hardeningDisable = [ "fortify" ];
+  }) {
+    ignoreFortify = false;
+    expectFailure = true;
+  };
+
+  fortify3ExplicitDisabledDoesntDisableFortify = checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningEnable = [ "fortify" ];
+    hardeningDisable = [ "fortify3" ];
+  }) {
+    ignoreFortify = false;
+  };
+
+  pieExplicitDisabled = brokenIf (
+    stdenv.hostPlatform.isMusl && stdenv.cc.isClang
+  ) (checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningDisable = [ "pie" ];
+  }) {
+    ignorePie = false;
+    expectFailure = true;
+  });
+
+  # can't force-disable ("partial"?) relro
+  relROExplicitDisabled = brokenIf true (checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningDisable = [ "pie" ];
+  }) {
+    ignoreRelRO = false;
+    expectFailure = true;
+  });
+
+  stackProtectorExplicitDisabled = checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningDisable = [ "stackprotector" ];
+  }) {
+    ignoreStackProtector = false;
+    expectFailure = true;
+  };
+
+  # most flags can't be "unsupported" by compiler alone and
+  # binutils doesn't have an accessible hardeningUnsupportedFlags
+  # mechanism, so can only test a couple of flags through altered
+  # stdenv trickery
+
+  fortifyStdenvUnsupp = checkTestBin (f2exampleWithStdEnv (stdenvUnsupport ["fortify"]) {
+    hardeningEnable = [ "fortify" ];
+  }) {
+    ignoreFortify = false;
+    expectFailure = true;
+  };
+
+  fortify3StdenvUnsupp = checkTestBin (f3exampleWithStdEnv (stdenvUnsupport ["fortify3"]) {
+    hardeningEnable = [ "fortify3" ];
+  }) {
+    ignoreFortify = false;
+    expectFailure = true;
+  };
+
+  fortifyStdenvUnsuppUnsupportsFortify3 = checkTestBin (f3exampleWithStdEnv (stdenvUnsupport ["fortify"]) {
+    hardeningEnable = [ "fortify3" ];
+  }) {
+    ignoreFortify = false;
+    expectFailure = true;
+  };
+
+  fortify3StdenvUnsuppDoesntUnsuppFortify = brokenIf stdenv.hostPlatform.isMusl (checkTestBin (f2exampleWithStdEnv (stdenvUnsupport ["fortify3"]) {
+    hardeningEnable = [ "fortify" ];
+  }) {
+    ignoreFortify = false;
+  });
+
+  fortify3StdenvUnsuppDoesntUnsuppFortifyExecTest = fortifyExecTest (f2exampleWithStdEnv (stdenvUnsupport ["fortify3"]) {
+    hardeningEnable = [ "fortify" ];
+  });
+
+  stackProtectorStdenvUnsupp = checkTestBin (f2exampleWithStdEnv (stdenvUnsupport ["stackprotector"]) {
+    hardeningEnable = [ "stackprotector" ];
+  }) {
+    ignoreStackProtector = false;
+    expectFailure = true;
+  };
+
+  # NIX_HARDENING_ENABLE set in the shell overrides hardeningDisable
+  # and hardeningEnable
+
+  stackProtectorReenabledEnv = checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningDisable = [ "stackprotector" ];
+    preBuild = ''
+      export NIX_HARDENING_ENABLE="stackprotector"
+    '';
+  }) {
+    ignoreStackProtector = false;
+  };
+
+  stackProtectorReenabledFromAllEnv = checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningDisable = [ "all" ];
+    preBuild = ''
+      export NIX_HARDENING_ENABLE="stackprotector"
+    '';
+  }) {
+    ignoreStackProtector = false;
+  };
+
+  stackProtectorRedisabledEnv = checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningEnable = [ "stackprotector" ];
+    preBuild = ''
+      export NIX_HARDENING_ENABLE=""
+    '';
+  }) {
+    ignoreStackProtector = false;
+    expectFailure = true;
+  };
+
+  fortify3EnabledEnvEnablesFortify = brokenIf stdenv.hostPlatform.isMusl (checkTestBin (f2exampleWithStdEnv stdenv {
+    hardeningDisable = [ "fortify" "fortify3" ];
+    preBuild = ''
+      export NIX_HARDENING_ENABLE="fortify3"
+    '';
+  }) {
+    ignoreFortify = false;
+  });
+
+  fortify3EnabledEnvEnablesFortifyExecTest = fortifyExecTest (f2exampleWithStdEnv stdenv {
+    hardeningDisable = [ "fortify" "fortify3" ];
+    preBuild = ''
+      export NIX_HARDENING_ENABLE="fortify3"
+    '';
+  });
+
+  fortifyEnabledEnvDoesntEnableFortify3 = checkTestBin (f3exampleWithStdEnv stdenv {
+    hardeningDisable = [ "fortify" "fortify3" ];
+    preBuild = ''
+      export NIX_HARDENING_ENABLE="fortify"
+    '';
+  }) {
+    ignoreFortify = false;
+    expectFailure = true;
+  };
+
+  # NIX_HARDENING_ENABLE can't enable an unsupported feature
+
+  stackProtectorUnsupportedEnabledEnv = checkTestBin (f2exampleWithStdEnv (stdenvUnsupport ["stackprotector"]) {
+    preBuild = ''
+      export NIX_HARDENING_ENABLE="stackprotector"
+    '';
+  }) {
+    ignoreStackProtector = false;
+    expectFailure = true;
+  };
+
+  # undetectable by this means on static even if present
+  fortify1ExplicitEnabledCmdlineDisabled = brokenIf stdenv.hostPlatform.isStatic (checkTestBin (f1exampleWithStdEnv stdenv {
+    hardeningEnable = [ "fortify" ];
+    preBuild = ''
+      export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=0'
+    '';
+  }) {
+    ignoreFortify = false;
+    expectFailure = true;
+  });
+
+  # musl implementation undetectable by this means even if present
+  fortify1ExplicitDisabledCmdlineEnabled = brokenIf (
+    stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isStatic
+  ) (checkTestBin (f1exampleWithStdEnv stdenv {
+    hardeningDisable = [ "fortify" ];
+    preBuild = ''
+      export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=1'
+    '';
+  }) {
+    ignoreFortify = false;
+  });
+
+  fortify1ExplicitDisabledCmdlineEnabledExecTest = fortifyExecTest (f1exampleWithStdEnv stdenv {
+    hardeningDisable = [ "fortify" ];
+    preBuild = ''
+      export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=1'
+    '';
+  });
+
+  fortify1ExplicitEnabledCmdlineDisabledNoWarn = f1exampleWithStdEnv stdenv {
+    hardeningEnable = [ "fortify" ];
+    preBuild = ''
+      export TEST_EXTRA_FLAGS='-D_FORTIFY_SOURCE=0 -Werror'
+    '';
+  };
+
+} // (let
+  tb = f2exampleWithStdEnv stdenv {
+    hardeningDisable = [ "all" ];
+    hardeningEnable = [ "fortify" "pie" ];
+  };
+in {
+
+  allExplicitDisabledBindNow = checkTestBin tb {
+    ignoreBindNow = false;
+    expectFailure = true;
+  };
+
+  allExplicitDisabledFortify = checkTestBin tb {
+    ignoreFortify = false;
+    expectFailure = true;
+  };
+
+  allExplicitDisabledPie = brokenIf (
+    stdenv.hostPlatform.isMusl && stdenv.cc.isClang
+  ) (checkTestBin tb {
+    ignorePie = false;
+    expectFailure = true;
+  });
+
+  # can't force-disable ("partial"?) relro
+  allExplicitDisabledRelRO = brokenIf true (checkTestBin tb {
+    ignoreRelRO = false;
+    expectFailure = true;
+  });
+
+  allExplicitDisabledStackProtector = checkTestBin tb {
+    ignoreStackProtector = false;
+    expectFailure = true;
+  };
+}))
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index d6fd75359fc4..c479070c6078 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -23,6 +23,14 @@ with pkgs;
   stdenv-inputs = callPackage ./stdenv-inputs { };
   stdenv = callPackage ./stdenv { };
 
+  hardeningFlags = recurseIntoAttrs (callPackage ./cc-wrapper/hardening.nix {});
+  hardeningFlags-gcc = recurseIntoAttrs (callPackage ./cc-wrapper/hardening.nix {
+    stdenv = gccStdenv;
+  });
+  hardeningFlags-clang = recurseIntoAttrs (callPackage ./cc-wrapper/hardening.nix {
+    stdenv = llvmPackages.stdenv;
+  });
+
   config = callPackage ./config.nix { };
 
   haskell = callPackage ./haskell { };
diff --git a/pkgs/tools/filesystems/bindfs/default.nix b/pkgs/tools/filesystems/bindfs/default.nix
index 46f237d87cf5..dfcf6aba9e08 100644
--- a/pkgs/tools/filesystems/bindfs/default.nix
+++ b/pkgs/tools/filesystems/bindfs/default.nix
@@ -1,25 +1,36 @@
-{ lib, stdenv, fetchurl, fuse, fuse3, pkg-config }:
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, fuse
+, fuse3
+}:
 
-stdenv.mkDerivation rec {
-  version = "1.17.3";
+stdenv.mkDerivation (finalAttrs: {
+  version = "1.17.4";
   pname = "bindfs";
 
   src = fetchurl {
-    url    = "https://bindfs.org/downloads/${pname}-${version}.tar.gz";
-    sha256 = "sha256-wWh2CRVywjJCwW6Hxb5+NRL0Q6rmNzKNjAEcBx6TAus=";
+    url = "https://bindfs.org/downloads/bindfs-${finalAttrs.version}.tar.gz";
+    hash = "sha256-b9Svm6LsK9tgPvjuoqnRLbLl/py+UrhkC0FXNKWfPcw=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
   buildInputs = if stdenv.isDarwin then [ fuse ] else [ fuse3 ];
+
   postFixup = ''
     ln -s $out/bin/bindfs $out/bin/mount.fuse.bindfs
   '';
 
   meta = {
+    changelog = "https://github.com/mpartel/bindfs/raw/${finalAttrs.version}/ChangeLog";
     description = "A FUSE filesystem for mounting a directory to another location";
-    homepage    = "https://bindfs.org";
-    license     = lib.licenses.gpl2Only;
+    homepage = "https://bindfs.org";
+    license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ lovek323 lovesegfault ];
-    platforms   = lib.platforms.unix;
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/tools/misc/debian-devscripts/default.nix b/pkgs/tools/misc/debian-devscripts/default.nix
index e1ee9757fe89..b8a58ff400e2 100644
--- a/pkgs/tools/misc/debian-devscripts/default.nix
+++ b/pkgs/tools/misc/debian-devscripts/default.nix
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, xz, dpkg
+{lib, stdenv, fetchurl, fetchpatch, xz, dpkg
 , libxslt, docbook_xsl, makeWrapper, writeShellScript
 , python3Packages
 , perlPackages, curl, gnupg, diffutils, nano, pkg-config, bash-completion, help2man
@@ -19,6 +19,14 @@ in stdenv.mkDerivation rec {
     hash = "sha256-j0fUVTS/lPKFdgeMhksiJz2+E5koB07IK2uEj55EWG0=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "hardening-check-obey-binutils-env-vars.patch";
+      url = "https://github.com/Debian/devscripts/pull/2/commits/c6a018e0ef50a1b0cb4962a2f96dae7c6f21f1d4.patch";
+      hash = "sha256-UpS239JiAM1IYxNuJLdILq2h0xlR5t0Tzhj47xiMHww=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace scripts/Makefile --replace /usr/share/dpkg ${dpkg}/share/dpkg
     substituteInPlace scripts/debrebuild.pl --replace /usr/bin/perl ${perlPackages.perl}/bin/perl
diff --git a/pkgs/tools/networking/veilid/Cargo.lock b/pkgs/tools/networking/veilid/Cargo.lock
index ebd2d157cf31..75cc901e1fdd 100644
--- a/pkgs/tools/networking/veilid/Cargo.lock
+++ b/pkgs/tools/networking/veilid/Cargo.lock
@@ -4,9 +4,9 @@ version = 3
 
 [[package]]
 name = "addr2line"
-version = "0.20.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4fa78e18c64fce05e902adecd7a5eed15a5e0a3439f7b0e169f0252214865e3"
+checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
 dependencies = [
  "gimli",
 ]
@@ -64,9 +64,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6748e8def348ed4d14996fa801f4122cd763fff530258cdc03f64b25f89d3a5a"
+checksum = "0c378d78423fdad8089616f827526ee33c19f2fddbd5de1629152c9593ba4783"
 dependencies = [
  "memchr",
 ]
@@ -86,24 +86,6 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0942ffc6dcaadf03badf6e6a2d0228460359d5e34b57ccdc720b7382dfbd5ec5"
 
-[[package]]
-name = "android-logd-logger"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89d7b9303373a56714732e3371513edd14d12987d04ff4f48527444e804bc3ae"
-dependencies = [
- "bytes 1.4.0",
- "env_logger 0.10.0",
- "lazy_static",
- "libc",
- "log",
- "parking_lot 0.12.1",
- "redox_syscall 0.3.5",
- "thiserror",
- "time 0.3.25",
- "winapi",
-]
-
 [[package]]
 name = "android-tzdata"
 version = "0.1.1"
@@ -116,13 +98,31 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "85965b6739a430150bdd138e2374a98af0c3ee0d030b3bb7fc3bddff58d0102e"
 
+[[package]]
+name = "android_log-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ecc8056bf6ab9892dcd53216c83d1597487d7dacac16c8df6b877d127df9937"
+
 [[package]]
 name = "android_logger"
 version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8619b80c242aa7bd638b5c7ddd952addeecb71f69c75e33f1d47b2804f8f883a"
 dependencies = [
- "android_log-sys",
+ "android_log-sys 0.2.0",
+ "env_logger 0.10.0",
+ "log",
+ "once_cell",
+]
+
+[[package]]
+name = "android_logger"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c494134f746c14dc653a35a4ea5aca24ac368529da5370ecf41fe0341c35772f"
+dependencies = [
+ "android_log-sys 0.3.1",
  "env_logger 0.10.0",
  "log",
  "once_cell",
@@ -158,24 +158,23 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.3.2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ca84f3628370c59db74ee214b3263d58f9aadd9b4fe7e711fd87dc452b7f163"
+checksum = "b1f58811cfac344940f1a400b6e6231ce35171f614f26439e80f8c1465c5cc0c"
 dependencies = [
  "anstyle",
  "anstyle-parse",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
- "is-terminal",
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a30da5c5f2d5e72842e00bcb57657162cdabef0931f40e2deb9b4140440cecd"
+checksum = "15c4c2c83f81532e5845a733998b6971faca23490340a418e9b72a3ec9de12ea"
 
 [[package]]
 name = "anstyle-parse"
@@ -197,9 +196,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle-wincon"
-version = "1.0.2"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c677ab05e09154296dd37acecd46420c17b9713e8366facafa8fc0885167cf4c"
+checksum = "58f54d10c6dfa51283a066ceab3ec1ab78d13fae00aa49243a45e4571fb79dfd"
 dependencies = [
  "anstyle",
  "windows-sys 0.48.0",
@@ -213,9 +212,9 @@ checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
 
 [[package]]
 name = "arboard"
-version = "3.2.0"
+version = "3.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6041616acea41d67c4a984709ddab1587fd0b10efe5cc563fee954d2f011854"
+checksum = "ac57f2b058a76363e357c056e4f74f1945bf734d37b8b3ef49066c4787dde0fc"
 dependencies = [
  "clipboard-win",
  "core-graphics",
@@ -224,7 +223,6 @@ dependencies = [
  "objc",
  "objc-foundation",
  "objc_id",
- "once_cell",
  "parking_lot 0.12.1",
  "thiserror",
  "winapi",
@@ -610,9 +608,9 @@ dependencies = [
 
 [[package]]
 name = "backtrace"
-version = "0.3.68"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4319208da049c43661739c5fade2ba182f09d1dc2299b32298d3a31692b17e12"
+checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
 dependencies = [
  "addr2line",
  "cc",
@@ -637,9 +635,9 @@ checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
 [[package]]
 name = "base64"
-version = "0.21.2"
+version = "0.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "604178f6c5c21f02dc555784810edfb88d34ac2c73b2eae109655649ee73ce3d"
+checksum = "414dcefbc63d77c526a76b3afcf6fbb9b5e2791c19c3aa2297733208750c6e53"
 
 [[package]]
 name = "base64ct"
@@ -854,9 +852,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.82"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "305fe645edc1442a0fa8b6726ba61d422798d37a52e12eaecf4b022ebbb88f01"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
 dependencies = [
  "libc",
 ]
@@ -923,9 +921,9 @@ dependencies = [
 
 [[package]]
 name = "chrono"
-version = "0.4.26"
+version = "0.4.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec837a71355b28f6556dbd569b37b3f363091c0bd4b2e735674521b4c5fd9bc5"
+checksum = "95ed24df0632f708f5f6d8082675bef2596f7084dee3dd55f632290bf35bfe0f"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -933,7 +931,7 @@ dependencies = [
  "num-traits",
  "time 0.1.45",
  "wasm-bindgen",
- "winapi",
+ "windows-targets 0.48.5",
 ]
 
 [[package]]
@@ -977,54 +975,39 @@ dependencies = [
  "atty",
  "bitflags 1.3.2",
  "strsim 0.8.0",
- "textwrap 0.11.0",
+ "textwrap",
  "unicode-width",
  "vec_map",
 ]
 
 [[package]]
 name = "clap"
-version = "3.2.25"
+version = "4.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
-dependencies = [
- "atty",
- "bitflags 1.3.2",
- "clap_lex 0.2.4",
- "indexmap 1.9.3",
- "strsim 0.10.0",
- "termcolor",
- "textwrap 0.16.0",
-]
-
-[[package]]
-name = "clap"
-version = "4.3.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03aef18ddf7d879c15ce20f04826ef8418101c7e528014c3eeea13321047dca3"
+checksum = "6a13b88d2c62ff462f88e4a121f17a82c1af05693a2f192b5c38d14de73c19f6"
 dependencies = [
  "clap_builder",
  "clap_derive",
- "once_cell",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.3.23"
+version = "4.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ce6fffb678c9b80a70b6b6de0aad31df727623a70fd9a842c30cd573e2fa98"
+checksum = "2bb9faaa7c2ef94b2743a21f5a29e6f0010dff4caa69ac8e9d6cf8b6fa74da08"
 dependencies = [
  "anstream",
  "anstyle",
- "clap_lex 0.5.0",
+ "clap_lex",
  "strsim 0.10.0",
+ "terminal_size",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.3.12"
+version = "4.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54a9bb5758fc5dfe728d1019941681eccaf0cf8a4189b692a0ee2f2ecf90a050"
+checksum = "0862016ff20d69b84ef8247369fabf5c008a7417002411897d40ee1f4532b873"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -1034,18 +1017,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.2.4"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
-dependencies = [
- "os_str_bytes",
-]
-
-[[package]]
-name = "clap_lex"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2da6da31387c7e4ef160ffab6d5e7f00c42626fe39aea70a7b0f1773f7dd6c1b"
+checksum = "cd7cc57abe963c6d3b9d8be5b06ba7c8957a930305ca90304f24ef040aa6f961"
 
 [[package]]
 name = "clipboard-win"
@@ -1190,11 +1164,11 @@ checksum = "f7144d30dcf0fafbce74250a3963025d8d52177934239851c917d29f1df280c2"
 
 [[package]]
 name = "core-foundation"
-version = "0.6.4"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25b9e03f145fd4f2bf705e07b900cd41fc636598fe5dc452fd0db1441c3f496d"
+checksum = "57d24c7a13c43e870e37c1556b74555437870a04514f7685f5b354e090567171"
 dependencies = [
- "core-foundation-sys 0.6.2",
+ "core-foundation-sys 0.7.0",
  "libc",
 ]
 
@@ -1210,9 +1184,9 @@ dependencies = [
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.6.2"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ca8a5221364ef15ce201e8ed2f609fc312682a8f4e0e3d4aa5879764e0fa3b"
+checksum = "b3a71ab494c0b5b860bdc8407ae08978052417070c2ced38573a9157ad75b8ac"
 
 [[package]]
 name = "core-foundation-sys"
@@ -1333,7 +1307,7 @@ version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a011bbe2c35ce9c1f143b7af6f94f29a167beb4cd1d29e6740ce836f723120e"
 dependencies = [
- "nix 0.26.2",
+ "nix 0.26.4",
  "windows-sys 0.48.0",
 ]
 
@@ -1366,7 +1340,7 @@ dependencies = [
  "flexi_logger",
  "lazy_static",
  "log",
- "time 0.3.25",
+ "time 0.3.28",
  "unicode-width",
 ]
 
@@ -1408,7 +1382,7 @@ dependencies = [
  "owning_ref",
  "serde_json",
  "serde_yaml",
- "time 0.3.25",
+ "time 0.3.28",
  "tokio",
  "toml 0.7.6",
  "unicode-segmentation",
@@ -1533,9 +1507,9 @@ dependencies = [
 
 [[package]]
 name = "dashmap"
-version = "5.5.0"
+version = "5.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6943ae99c34386c84a470c499d3414f66502a41340aa895406e0d2e4a207b91d"
+checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
 dependencies = [
  "cfg-if 1.0.0",
  "hashbrown 0.14.0",
@@ -1787,9 +1761,9 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b30f669a7961ef1631673d2766cc92f52d64f7ef354d4fe0ddfd30ed52f0f4f"
+checksum = "136526188508e25c6fef639d7927dfb3e0e3084488bf202267829cf7fc23dbdd"
 dependencies = [
  "errno-dragonfly",
  "libc",
@@ -1937,7 +1911,7 @@ dependencies = [
  "regex",
  "rustversion",
  "thiserror",
- "time 0.3.25",
+ "time 0.3.28",
 ]
 
 [[package]]
@@ -1990,12 +1964,12 @@ dependencies = [
 
 [[package]]
 name = "fs4"
-version = "0.5.4"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cef5c93884e5cef757f63446122c2f420713c3e03f85540d09485b9415983b4a"
+checksum = "2eeb4ed9e12f43b7fa0baae3f9cdda28352770132ef2e09a23760c29cae8bd47"
 dependencies = [
- "libc",
- "winapi",
+ "rustix 0.38.11",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -2182,9 +2156,9 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.27.3"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c80984affa11d98d1b88b66ac8853f143217b399d3c74116778ff8fdb4ed2e"
+checksum = "6fb8d784f27acf97159b40fc4db5ecd8aa23b9ad5ef69cdd136d3bc80665f0c0"
 
 [[package]]
 name = "glob"
@@ -2249,9 +2223,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.3.20"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97ec8491ebaf99c8eaa73058b045fe58073cd6be7f596ac993ced0b0a0c01049"
+checksum = "91fc23aa11be92976ef4729127f1a74adf36d8436f7816b185d18df956790833"
 dependencies = [
  "bytes 1.4.0",
  "fnv",
@@ -2319,9 +2293,9 @@ dependencies = [
 
 [[package]]
 name = "hashlink"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "312f66718a2d7789ffef4f4b7b213138ed9f1eb3aa1d0d82fc99f88fb3ffd26f"
+checksum = "e8094feaf31ff591f651a2664fb9cfd92bba7a60ce3197265e9482ebe753c8f7"
 dependencies = [
  "hashbrown 0.14.0",
 ]
@@ -2662,17 +2636,6 @@ version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28b29a3cd74f0f4598934efe3aeba42bae0eb4680554128851ebbecb02af14e6"
 
-[[package]]
-name = "is-terminal"
-version = "0.4.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
-dependencies = [
- "hermit-abi 0.3.2",
- "rustix 0.38.8",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "itertools"
 version = "0.10.5"
@@ -2688,20 +2651,6 @@ version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
 
-[[package]]
-name = "jni"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "039022cdf4d7b1cf548d31f60ae783138e5fd42013f6271049d7df7afadef96c"
-dependencies = [
- "cesu8",
- "combine",
- "jni-sys",
- "log",
- "thiserror",
- "walkdir",
-]
-
 [[package]]
 name = "jni"
 version = "0.21.1"
@@ -2758,13 +2707,13 @@ dependencies = [
 
 [[package]]
 name = "keychain-services"
-version = "0.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fd01702fbd22eee99431f553959f86d558cfc1dbf7f98b8df159be14e29a349"
+version = "0.1.2"
+source = "git+https://github.com/iqlusioninc/keychain-services.rs.git?rev=7410fb8baf4ecdf04cdcd7d06d02658f4f158d77#7410fb8baf4ecdf04cdcd7d06d02658f4f158d77"
 dependencies = [
- "core-foundation 0.6.4",
+ "core-foundation 0.7.0",
  "failure",
  "failure_derive",
+ "zeroize",
 ]
 
 [[package]]
@@ -2775,9 +2724,9 @@ dependencies = [
  "cfg-if 1.0.0",
  "core-foundation 0.9.3",
  "core-foundation-sys 0.8.4",
- "directories 4.0.1",
+ "directories 5.0.1",
  "fs4",
- "jni 0.20.0",
+ "jni",
  "keychain-services",
  "lazy_static",
  "log",
@@ -2985,9 +2934,9 @@ checksum = "ed1202b2a6f884ae56f04cff409ab315c5ce26b5e58d7412e484f01fd52f52ef"
 
 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+checksum = "5486aed0026218e61b8a01d5fbd5a0a134649abb71a0e53b7bc088529dced86e"
 
 [[package]]
 name = "memoffset"
@@ -3098,7 +3047,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0434fabdd2c15e0aab768ca31d5b7b333717f03cf02037d5a0a3ff3c278ed67f"
 dependencies = [
- "android_logger",
+ "android_logger 0.11.3",
  "libc",
  "log",
  "ndk",
@@ -3233,16 +3182,26 @@ dependencies = [
 
 [[package]]
 name = "nix"
-version = "0.26.2"
+version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfdda3d196821d6af13126e40375cdf7da646a96114af134d5f417a9a1dc8e1a"
+checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
 dependencies = [
  "bitflags 1.3.2",
  "cfg-if 1.0.0",
  "libc",
  "memoffset 0.7.1",
  "pin-utils",
- "static_assertions",
+]
+
+[[package]]
+name = "nix"
+version = "0.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
+dependencies = [
+ "bitflags 2.4.0",
+ "cfg-if 1.0.0",
+ "libc",
 ]
 
 [[package]]
@@ -3310,9 +3269,9 @@ dependencies = [
 
 [[package]]
 name = "num-bigint"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f93ab6289c7b344a8a9f60f88d80aa20032336fe78da341afc91c8a2341fc75f"
+checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
 dependencies = [
  "autocfg",
  "num-integer",
@@ -3441,9 +3400,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.31.1"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bda667d9f2b5051b8833f59f3bf748b28ef54f850f4fcb389a252aa383866d1"
+checksum = "77ac5bbd07aea88c60a577a1ce218075ffd59208b2d7ca97adf9bfc5aeb21ebe"
 dependencies = [
  "memchr",
 ]
@@ -3570,12 +3529,6 @@ dependencies = [
  "hashbrown 0.12.3",
 ]
 
-[[package]]
-name = "os_str_bytes"
-version = "6.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d5d9eb14b174ee9aa2ef96dc2b94637a2d4b6e7cb873c7e171f0c20c6cf3eac"
-
 [[package]]
 name = "oslog"
 version = "0.2.0"
@@ -3713,19 +3666,20 @@ checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
 
 [[package]]
 name = "pest"
-version = "2.7.2"
+version = "2.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1acb4a4365a13f749a93f1a094a7805e5cfa0955373a9de860d962eaa3a5fe5a"
+checksum = "d7a4d085fd991ac8d5b05a147b437791b4260b76326baf0fc60cf7c9c27ecd33"
 dependencies = [
+ "memchr",
  "thiserror",
  "ucd-trie",
 ]
 
 [[package]]
 name = "pest_derive"
-version = "2.7.2"
+version = "2.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "666d00490d4ac815001da55838c500eafb0320019bbaa44444137c48b443a853"
+checksum = "a2bee7be22ce7918f641a33f08e3f43388c7656772244e2bbb2477f44cc9021a"
 dependencies = [
  "pest",
  "pest_generator",
@@ -3733,9 +3687,9 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.7.2"
+version = "2.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ca01446f50dbda87c1786af8770d535423fa8a53aec03b8f4e3d7eb10e0929"
+checksum = "d1511785c5e98d79a05e8a6bc34b4ac2168a0e3e92161862030ad84daa223141"
 dependencies = [
  "pest",
  "pest_meta",
@@ -3746,9 +3700,9 @@ dependencies = [
 
 [[package]]
 name = "pest_meta"
-version = "2.7.2"
+version = "2.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56af0a30af74d0445c0bf6d9d051c979b516a1a5af790d251daee76005420a48"
+checksum = "b42f0394d3123e33353ca5e1e89092e533d2cc490389f2bd6131c43c634ebc5f"
 dependencies = [
  "once_cell",
  "pest",
@@ -3757,12 +3711,12 @@ dependencies = [
 
 [[package]]
 name = "petgraph"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dd7d28ee937e54fe3080c91faa1c3a46c06de6252988a7f4592ba2310ef22a4"
+checksum = "e1d3afd2628e69da2be385eb6f2fd57c8ac7977ceeff6dc166ff1657b0e386a9"
 dependencies = [
  "fixedbitset",
- "indexmap 1.9.3",
+ "indexmap 2.0.0",
 ]
 
 [[package]]
@@ -3817,9 +3771,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.12"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12cc1b0bf1727a77a54b6654e7b5f1af8604923edc8b81885f8ec92f9e3f0a05"
+checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
 
 [[package]]
 name = "pin-utils"
@@ -3845,9 +3799,9 @@ checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
 
 [[package]]
 name = "platforms"
-version = "3.0.2"
+version = "3.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3d7ddaed09e0eb771a79ab0fd64609ba0afb0a8366421957936ad14cbd13630"
+checksum = "4503fa043bf02cee09a9582e9554b4c6403b2ef55e4612e96561d294419429f8"
 
 [[package]]
 name = "png"
@@ -4128,14 +4082,14 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.9.3"
+version = "1.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81bc1d4caf89fac26a70747fe603c130093b53c773888797a6329091246d651a"
+checksum = "12de2eff854e5fa4b1295edd650e227e9d8fb0c9e90b12e7f36d6a6811791a29"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.3.6",
- "regex-syntax 0.7.4",
+ "regex-automata 0.3.7",
+ "regex-syntax 0.7.5",
 ]
 
 [[package]]
@@ -4149,13 +4103,13 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.3.6"
+version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fed1ceff11a1dddaee50c9dc8e4938bd106e9d89ae372f192311e7da498e3b69"
+checksum = "49530408a136e16e5b486e883fbb6ba058e8e4e8ae6621a77b048b314336e629"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax 0.7.4",
+ "regex-syntax 0.7.5",
 ]
 
 [[package]]
@@ -4166,9 +4120,9 @@ checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5ea92a5b6195c6ef2a0295ea818b312502c6fc94dde986c5553242e18fd4ce2"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
 
 [[package]]
 name = "resolv-conf"
@@ -4232,7 +4186,7 @@ dependencies = [
  "netlink-packet-utils",
  "netlink-proto",
  "netlink-sys",
- "nix 0.26.2",
+ "nix 0.26.4",
  "thiserror",
  "tokio",
 ]
@@ -4246,7 +4200,7 @@ dependencies = [
  "bitflags 2.4.0",
  "fallible-iterator",
  "fallible-streaming-iterator",
- "hashlink 0.8.3",
+ "hashlink 0.8.4",
  "libsqlite3-sys",
  "smallvec",
 ]
@@ -4298,9 +4252,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.8"
+version = "0.38.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19ed4fa021d81c8392ce04db050a3da9a60299050b7ae1cf482d862b54a7218f"
+checksum = "c0c3dde1fc030af041adc40e79c0e7fbcf431dd24870053d187d7c66e4b87453"
 dependencies = [
  "bitflags 2.4.0",
  "errno",
@@ -4311,9 +4265,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.20.8"
+version = "0.20.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fff78fc74d175294f4e83b28343315ffcfb114b156f0185e9741cb5570f50e2f"
+checksum = "1b80e3dec595989ea8510028f30c408a4630db12c9cbb8de34203b89d6577e99"
 dependencies = [
  "log",
  "ring",
@@ -4327,7 +4281,7 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d3987094b1d07b653b7dfdc3f70ce9a1da9c51ac18c1b06b662e4f9a0e9f4b2"
 dependencies = [
- "base64 0.21.2",
+ "base64 0.21.3",
 ]
 
 [[package]]
@@ -4353,9 +4307,9 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "0.8.12"
+version = "0.8.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02c613288622e5f0c3fdc5dbd4db1c5fbe752746b1d1a56a0630b78fd00de44f"
+checksum = "763f8cd0d4c71ed8389c90cb8100cba87e763bd01a8e614d4f0af97bcd50a161"
 dependencies = [
  "dyn-clone",
  "schemars_derive",
@@ -4365,9 +4319,9 @@ dependencies = [
 
 [[package]]
 name = "schemars_derive"
-version = "0.8.12"
+version = "0.8.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "109da1e6b197438deb6db99952990c7f959572794b80ff93707d55a232545e7c"
+checksum = "ec0f696e21e10fa546b7ffb1c9672c6de8fbc7a81acf59524386d8639bf12737"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4463,9 +4417,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.183"
+version = "1.0.188"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32ac8da02677876d532745a130fc9d8e6edfa81a269b107c5b00829b91d8eb3c"
+checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
 dependencies = [
  "serde_derive",
 ]
@@ -4491,9 +4445,9 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.183"
+version = "1.0.188"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aafe972d60b0b9bee71a91b92fee2d4fb3c9d7e8f6b179aa99f27203d99a4816"
+checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4745,14 +4699,14 @@ checksum = "acee08041c5de3d5048c8b3f6f13fafb3026b24ba43c6a695a0c76179b844369"
 dependencies = [
  "log",
  "termcolor",
- "time 0.3.25",
+ "time 0.3.28",
 ]
 
 [[package]]
 name = "slab"
-version = "0.4.8"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6528351c9bc8ab22353f9d776db39a20288e8d6c37ef8cfe3317cf875eecfc2d"
+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
 dependencies = [
  "autocfg",
 ]
@@ -4929,7 +4883,7 @@ dependencies = [
  "cfg-if 1.0.0",
  "fastrand 2.0.0",
  "redox_syscall 0.3.5",
- "rustix 0.38.8",
+ "rustix 0.38.11",
  "windows-sys 0.48.0",
 ]
 
@@ -4942,6 +4896,16 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "terminal_size"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e6bf6f19e9f8ed8d4048dc22981458ebcf406d67e94cd422e5ecd73d63b3237"
+dependencies = [
+ "rustix 0.37.23",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "textwrap"
 version = "0.11.0"
@@ -4951,12 +4915,6 @@ dependencies = [
  "unicode-width",
 ]
 
-[[package]]
-name = "textwrap"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
-
 [[package]]
 name = "thiserror"
 version = "1.0.47"
@@ -5011,9 +4969,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.25"
+version = "0.3.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0fdd63d58b18d663fbdf70e049f00a22c8e42be082203be7f26589213cd75ea"
+checksum = "17f6bb557fd245c28e6411aa56b6403c689ad95061f50e4be16c274e70a17e48"
 dependencies = [
  "deranged",
  "itoa",
@@ -5032,9 +4990,9 @@ checksum = "7300fbefb4dadc1af235a9cef3737cea692a9d97e1b9cbcd4ebdae6f8868e6fb"
 
 [[package]]
 name = "time-macros"
-version = "0.2.11"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb71511c991639bb078fd5bf97757e03914361c48100d52878b8e52b46fb92cd"
+checksum = "1a942f44339478ef67935ab2bbaec2fb0322496cf3cbe84b261e06ac3814c572"
 dependencies = [
  "time-core",
 ]
@@ -5204,7 +5162,7 @@ checksum = "3082666a3a6433f7f511c7192923fa1fe07c69332d3c6a2e6bb040b569199d5a"
 dependencies = [
  "async-trait",
  "axum",
- "base64 0.21.2",
+ "base64 0.21.3",
  "bytes 1.4.0",
  "futures-core",
  "futures-util",
@@ -5289,7 +5247,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09d48f71a791638519505cefafe162606f706c25592e4bde4d97600c0195312e"
 dependencies = [
  "crossbeam-channel",
- "time 0.3.25",
+ "time 0.3.28",
  "tracing-subscriber",
 ]
 
@@ -5595,9 +5553,9 @@ checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
 
 [[package]]
 name = "url"
-version = "2.4.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50bff7831e19200a85b17131d085c25d7811bc4e186efdaf54bbd132994a88cb"
+checksum = "143b538f18257fac9cad154828a57c6bf5157e1aa604d4816b5995bf6de87ae5"
 dependencies = [
  "form_urlencoded",
  "idna 0.4.0",
@@ -5642,14 +5600,14 @@ checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
 
 [[package]]
 name = "veilid-cli"
-version = "0.1.10"
+version = "0.2.0"
 dependencies = [
  "arboard",
  "async-std",
  "async-tungstenite 0.8.0",
  "bugsalot",
  "cfg-if 1.0.0",
- "clap 4.3.23",
+ "clap 4.4.2",
  "config",
  "crossbeam-channel",
  "cursive",
@@ -5678,7 +5636,7 @@ dependencies = [
 
 [[package]]
 name = "veilid-core"
-version = "0.1.10"
+version = "0.2.0"
 dependencies = [
  "argon2",
  "async-io",
@@ -5714,7 +5672,7 @@ dependencies = [
  "hex",
  "ifstructs",
  "igd",
- "jni 0.21.1",
+ "jni",
  "jni-sys",
  "js-sys",
  "json",
@@ -5724,12 +5682,13 @@ dependencies = [
  "keyvaluedb-web",
  "lazy_static",
  "libc",
+ "lock_api",
  "lz4_flex",
  "ndk",
  "ndk-glue",
  "netlink-packet-route",
  "netlink-sys",
- "nix 0.26.2",
+ "nix 0.26.4",
  "num-traits",
  "once_cell",
  "owning_ref",
@@ -5781,7 +5740,7 @@ dependencies = [
 
 [[package]]
 name = "veilid-flutter"
-version = "0.1.10"
+version = "0.2.0"
 dependencies = [
  "allo-isolate",
  "async-std",
@@ -5791,7 +5750,7 @@ dependencies = [
  "ffi-support",
  "futures-util",
  "hostname",
- "jni 0.21.1",
+ "jni",
  "lazy_static",
  "opentelemetry",
  "opentelemetry-otlp",
@@ -5810,7 +5769,7 @@ dependencies = [
 
 [[package]]
 name = "veilid-server"
-version = "0.1.10"
+version = "0.2.0"
 dependencies = [
  "ansi_term",
  "async-std",
@@ -5818,7 +5777,7 @@ dependencies = [
  "backtrace",
  "bugsalot",
  "cfg-if 1.0.0",
- "clap 3.2.25",
+ "clap 4.4.2",
  "color-eyre",
  "config",
  "console-subscriber",
@@ -5830,7 +5789,7 @@ dependencies = [
  "hostname",
  "json",
  "lazy_static",
- "nix 0.26.2",
+ "nix 0.27.1",
  "opentelemetry",
  "opentelemetry-otlp",
  "opentelemetry-semantic-conventions",
@@ -5860,9 +5819,9 @@ dependencies = [
 
 [[package]]
 name = "veilid-tools"
-version = "0.1.10"
+version = "0.2.0"
 dependencies = [
- "android-logd-logger",
+ "android_logger 0.13.3",
  "async-lock",
  "async-std",
  "async_executors",
@@ -5874,7 +5833,7 @@ dependencies = [
  "flume",
  "fn_name",
  "futures-util",
- "jni 0.21.1",
+ "jni",
  "jni-sys",
  "js-sys",
  "lazy_static",
@@ -5882,7 +5841,7 @@ dependencies = [
  "log",
  "ndk",
  "ndk-glue",
- "nix 0.26.2",
+ "nix 0.26.4",
  "once_cell",
  "oslog",
  "paranoid-android",
@@ -5911,7 +5870,7 @@ dependencies = [
 
 [[package]]
 name = "veilid-wasm"
-version = "0.1.10"
+version = "0.2.0"
 dependencies = [
  "cfg-if 1.0.0",
  "console_error_panic_hook",
@@ -6109,9 +6068,9 @@ dependencies = [
 
 [[package]]
 name = "webpki"
-version = "0.22.0"
+version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd"
+checksum = "f0e74f82d49d545ad128049b7e88f6576df2da6b02e9ce565c6f533be576957e"
 dependencies = [
  "ring",
  "untrusted",
@@ -6407,9 +6366,9 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "winnow"
-version = "0.5.14"
+version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d09770118a7eb1ccaf4a594a221334119a44a814fcb0d31c5b85e83e97227a97"
+checksum = "7c2e3184b9c4e92ad5167ca73039d0c42476302ab603e2fec4487511f38ccefc"
 dependencies = [
  "memchr",
 ]
diff --git a/pkgs/tools/networking/veilid/default.nix b/pkgs/tools/networking/veilid/default.nix
index 7dada12bb85b..6e1531cd6e26 100644
--- a/pkgs/tools/networking/veilid/default.nix
+++ b/pkgs/tools/networking/veilid/default.nix
@@ -10,20 +10,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "veilid";
-  version = "0.1.10";
+  version = "0.2.0";
 
   src = fetchFromGitLab {
     owner = "veilid";
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-43VCv0MqRIqKioM5Uj3sap9SvGnjgrZFxGPG98hk1v0=";
+    sha256 = "sha256-OgV6Rp5Az5iPUekeO8L28bxlXj/wZ5mOGmlXz14wcoQ=";
   };
 
   cargoLock = {
      lockFile = ./Cargo.lock;
      outputHashes = {
        "bugsalot-0.2.2" = "sha256-9zLzK22dOB7w+ejk1SfkA98z4rEzrB6mAVUpPFuDUnY=";
+       "keychain-services-0.1.2" = "sha256-gkiE9PoSIgHngXc/BLMTL97/6dSnqAj42+q01CLbu+E=";
      };
    };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 12ae194d6b1a..917ae0baa3d4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -845,7 +845,9 @@ with pkgs;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
-  gretl = callPackage ../applications/science/math/gretl { };
+  gretl = callPackage ../applications/science/math/gretl {
+    inherit (darwin.apple_sdk.frameworks) Accelerate;
+  };
 
   grsync = callPackage ../applications/misc/grsync { };