diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e0eedeac1147..7ca840ec20f7 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -15164,6 +15164,12 @@
     githubId = 848535;
     name = "Oleg Lebedev";
   };
+  oleina = {
+    email = "antholeinik@gmail.com";
+    github = "antholeole";
+    githubId = 48811365;
+    name = "Anthony Oleinik";
+  };
   olejorgenb = {
     email = "olejorgenb@yahoo.no";
     github = "olejorgenb";
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/consult-gh/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/consult-gh/package.nix
index 52dfd2ea095c..03adc5fd1f78 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/consult-gh/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/consult-gh/package.nix
@@ -12,13 +12,13 @@
 
 melpaBuild {
   pname = "consult-gh";
-  version = "0.12-unstable-2024-04-23";
+  version = "1.0-unstable-2024-08-02";
 
   src = fetchFromGitHub {
     owner = "armindarvish";
     repo = "consult-gh";
-    rev = "3a07139a1f7e38b959ce177a122c8f47c401d7fa";
-    hash = "sha256-BZloG5RuQzC2RwCfvqPPhGcbsCabQWBnRHdU62rwNdo=";
+    rev = "e12b24e68116ac6c171d628c547c017458d6aa2b";
+    hash = "sha256-skZkpYUWncGUf9k0IfEq3LAqDXHIfCJJ3p3b3ey+Rks=";
   };
 
   packageRequires = [
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/font-lock-plus/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/font-lock-plus/package.nix
index d7e8390b40b8..93d963a09e08 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/font-lock-plus/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/font-lock-plus/package.nix
@@ -8,13 +8,13 @@
 melpaBuild {
   pname = "font-lock-plus";
   ename = "font-lock+";
-  version = "208-unstable-2018-01-01";
+  version = "208-unstable-2022-04-02";
 
   src = fetchFromGitHub {
     owner = "emacsmirror";
     repo = "font-lock-plus";
-    rev = "f2c1ddcd4c9d581bd32be88fad026b49f98b6541";
-    hash = "sha256-lFmdVMXIIXZ9ZohAJw5rhxpTv017qIyzmpuKOWDdeJ4=";
+    rev = "aa1c82d05c9222b09099a0ccd7468e955497940c";
+    hash = "sha256-er+knxqAejgKAtOnhqHfsGN286biHFdeMIUlbW7JyYw=";
   };
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/voicemacs/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/voicemacs/package.nix
index 593dac257976..dbbec44f9ccc 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/voicemacs/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/voicemacs/package.nix
@@ -19,13 +19,13 @@
 
 melpaBuild {
   pname = "voicemacs";
-  version = "0-unstable-2022-02-16";
+  version = "0-unstable-2024-01-03";
 
   src = fetchFromGitHub {
     owner = "jcaw";
     repo = "voicemacs";
-    rev = "d91de2a31c68ab083172ade2451419d6bd7bb389";
-    hash = "sha256-/MBB2R9/V0aYZp15e0vx+67ijCPp2iPlgxe262ldmtc=";
+    rev = "d93f15d855d61f78827d78c9ca3508766266366c";
+    hash = "sha256-D/5+3SgECEb7A8qQqsAV1TQr+lA8EyOjf6NesnV2gos=";
   };
 
   patches = [
diff --git a/pkgs/applications/editors/kakoune/plugins/overrides.nix b/pkgs/applications/editors/kakoune/plugins/overrides.nix
index f03016e4b047..94aa387ab57f 100644
--- a/pkgs/applications/editors/kakoune/plugins/overrides.nix
+++ b/pkgs/applications/editors/kakoune/plugins/overrides.nix
@@ -2,6 +2,7 @@
 , buildKakounePluginFrom2Nix
 , kakoune-lsp, parinfer-rust, rep
 , fzf, git, guile, kakoune-unwrapped, lua5_3, plan9port
+, rustPlatform
 }:
 
 self: super: {
@@ -131,6 +132,41 @@ declare-option -hidden str ansi_filter %{'"$out"'/bin/kak-ansi-filter}
     '';
   });
 
+  hop-kak = rustPlatform.buildRustPackage rec {
+    pname = "hop-kak";
+    version = "0.2.0";
+
+    src = fetchgit {
+      url = "https://git.sr.ht/~hadronized/hop.kak";
+      rev = "7314ec64809a69e0044ba7ec57a18b43e3b5f005";
+      sha256 = "stmGZQU0tp+5xxrexKMzwSwHj5F/F4HzDO9BorNWC3w=";
+
+      # this package uses git to put the commit hash in the
+      # help dialog, so leave the .git folder so the command
+      # succeeds.
+      leaveDotGit = true;
+    };
+
+    nativeBuildInputs = [
+      git
+    ];
+
+    cargoHash = "sha256-EjSj/+BysGwJBxK6Ccg2+pXHdB2Lg3dxIURRsSVTHVY=";
+
+    postInstall = ''
+      mkdir -p $out/share/kak/bin
+      mv $out/bin/hop-kak $out/share/kak/bin/
+    '';
+
+    meta = with lib; {
+      description = "hinting brought to Kakoune selections";
+      homepage = "https://git.sr.ht/~hadronized/hop.kak/";
+      license = licenses.bsd3;
+      maintainers = with maintainers; [ oleina ];
+      platforms = platforms.all;
+    };
+  };
+
   quickscope-kak = buildKakounePluginFrom2Nix rec {
     pname = "quickscope-kak";
     version = "1.0.0";
diff --git a/pkgs/applications/editors/kakoune/wrapper.nix b/pkgs/applications/editors/kakoune/wrapper.nix
index 451507885ce0..c3507576f28d 100644
--- a/pkgs/applications/editors/kakoune/wrapper.nix
+++ b/pkgs/applications/editors/kakoune/wrapper.nix
@@ -14,10 +14,17 @@ in
     paths = [ kakoune ] ++ requestedPlugins;
 
     postBuild = ''
+      # create a directory for bins that kakoune needs
+      # access to, without polluting the users path by adding
+      # that binary nested with this symlinkJoin.
+      mkdir -p $out/share/kak/bin
+
       # location of kak binary is used to find ../share/kak/autoload,
       # unless explicitly overriden with KAKOUNE_RUNTIME
       rm "$out/bin/kak"
-      makeWrapper "${kakoune}/bin/kak" "$out/bin/kak" --set KAKOUNE_RUNTIME "$out/share/kak"
+      makeWrapper "${kakoune}/bin/kak" "$out/bin/kak" \
+        --set KAKOUNE_RUNTIME "$out/share/kak" \
+        --set PATH "$PATH:$out/share/kak/bin"
 
       # currently kakoune ignores doc files if they are symlinks, so workaround by
       # copying doc files over, so they become regular files...
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 1dce8f5304be..ecfc00f958b2 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -47,7 +47,7 @@ let
   };
 
 in rec {
-  thunderbird = thunderbird-115;
+  thunderbird = thunderbird-128;
 
   thunderbird-115 = common {
     version = "115.13.0";
diff --git a/pkgs/by-name/aw/awscli2/package.nix b/pkgs/by-name/aw/awscli2/package.nix
index 4ba5c6cfc162..e8f6aec95d2a 100644
--- a/pkgs/by-name/aw/awscli2/package.nix
+++ b/pkgs/by-name/aw/awscli2/package.nix
@@ -59,14 +59,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.17.13"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.17.18"; # N.B: if you change this, check if overrides are still up-to-date
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     rev = "refs/tags/${version}";
-    hash = "sha256-hnD+2NE7gqbe99UQmRlHoPGdWZj0o2Buvk3kRR15tgI=";
+    hash = "sha256-HxFtMFeGR6XAMsP5LM0tvJ/ECWVpveIhWRTKvf8uYA0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ga/gamescope/package.nix b/pkgs/by-name/ga/gamescope/package.nix
index b1f93b041704..e0ac90ed64e9 100644
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@@ -27,6 +27,7 @@
 , stb
 , wlroots
 , libdecor
+, lcms
 , lib
 , makeBinaryWrapper
 , patchelfUnstable
@@ -44,14 +45,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gamescope";
-  version = "3.14.24";
+  version = "3.14.26";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "gamescope";
     rev = "refs/tags/${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-+8uojnfx8V8BiYAeUsOaXTXrlcST83z6Eld7qv1oboE=";
+    hash = "sha256-vCPKySLB1D9oKgCrYrXqt/s0hV+/ocuWOrcDUzKbdKI=";
   };
 
   patches = [
@@ -132,6 +133,7 @@ stdenv.mkDerivation (finalAttrs: {
     pixman
     libcap
     stb
+    lcms
   ]);
 
   postInstall = lib.optionalString enableExecutable ''
diff --git a/pkgs/by-name/gf/gfortran/package.nix b/pkgs/by-name/gf/gfortran/package.nix
new file mode 100644
index 000000000000..93b8c5a4906d
--- /dev/null
+++ b/pkgs/by-name/gf/gfortran/package.nix
@@ -0,0 +1,11 @@
+{ wrapCC, gcc }:
+# Use the same GCC version as the one from stdenv by default
+wrapCC (
+  gcc.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
diff --git a/pkgs/by-name/gf/gfortran10/package.nix b/pkgs/by-name/gf/gfortran10/package.nix
new file mode 100644
index 000000000000..9cd90cd6f3b8
--- /dev/null
+++ b/pkgs/by-name/gf/gfortran10/package.nix
@@ -0,0 +1,10 @@
+{ wrapCC, gcc10 }:
+wrapCC (
+  gcc10.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
diff --git a/pkgs/by-name/gf/gfortran11/package.nix b/pkgs/by-name/gf/gfortran11/package.nix
new file mode 100644
index 000000000000..d27a264fc529
--- /dev/null
+++ b/pkgs/by-name/gf/gfortran11/package.nix
@@ -0,0 +1,10 @@
+{ wrapCC, gcc11 }:
+wrapCC (
+  gcc11.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
diff --git a/pkgs/by-name/gf/gfortran12/package.nix b/pkgs/by-name/gf/gfortran12/package.nix
new file mode 100644
index 000000000000..95280bb8761b
--- /dev/null
+++ b/pkgs/by-name/gf/gfortran12/package.nix
@@ -0,0 +1,10 @@
+{ wrapCC, gcc12 }:
+wrapCC (
+  gcc12.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
diff --git a/pkgs/by-name/gf/gfortran13/package.nix b/pkgs/by-name/gf/gfortran13/package.nix
new file mode 100644
index 000000000000..71afda9d70f7
--- /dev/null
+++ b/pkgs/by-name/gf/gfortran13/package.nix
@@ -0,0 +1,10 @@
+{ wrapCC, gcc13 }:
+wrapCC (
+  gcc13.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
diff --git a/pkgs/by-name/gf/gfortran14/package.nix b/pkgs/by-name/gf/gfortran14/package.nix
new file mode 100644
index 000000000000..a77d10196e48
--- /dev/null
+++ b/pkgs/by-name/gf/gfortran14/package.nix
@@ -0,0 +1,10 @@
+{ wrapCC, gcc14 }:
+wrapCC (
+  gcc14.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
diff --git a/pkgs/by-name/gf/gfortran48/package.nix b/pkgs/by-name/gf/gfortran48/package.nix
new file mode 100644
index 000000000000..e31c9d0c6ebd
--- /dev/null
+++ b/pkgs/by-name/gf/gfortran48/package.nix
@@ -0,0 +1,10 @@
+{ wrapCC, gcc48 }:
+wrapCC (
+  gcc48.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
diff --git a/pkgs/by-name/gf/gfortran49/package.nix b/pkgs/by-name/gf/gfortran49/package.nix
new file mode 100644
index 000000000000..8016f9ff42ba
--- /dev/null
+++ b/pkgs/by-name/gf/gfortran49/package.nix
@@ -0,0 +1,10 @@
+{ wrapCC, gcc49 }:
+wrapCC (
+  gcc49.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
diff --git a/pkgs/by-name/gf/gfortran6/package.nix b/pkgs/by-name/gf/gfortran6/package.nix
new file mode 100644
index 000000000000..c6a91e99bf54
--- /dev/null
+++ b/pkgs/by-name/gf/gfortran6/package.nix
@@ -0,0 +1,10 @@
+{ wrapCC, gcc6 }:
+wrapCC (
+  gcc6.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
diff --git a/pkgs/by-name/gf/gfortran7/package.nix b/pkgs/by-name/gf/gfortran7/package.nix
new file mode 100644
index 000000000000..311b7e6b90a7
--- /dev/null
+++ b/pkgs/by-name/gf/gfortran7/package.nix
@@ -0,0 +1,10 @@
+{ wrapCC, gcc7 }:
+wrapCC (
+  gcc7.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
diff --git a/pkgs/by-name/gf/gfortran8/package.nix b/pkgs/by-name/gf/gfortran8/package.nix
new file mode 100644
index 000000000000..0d0e03c7bb0b
--- /dev/null
+++ b/pkgs/by-name/gf/gfortran8/package.nix
@@ -0,0 +1,10 @@
+{ wrapCC, gcc8 }:
+wrapCC (
+  gcc8.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
diff --git a/pkgs/by-name/gf/gfortran9/package.nix b/pkgs/by-name/gf/gfortran9/package.nix
new file mode 100644
index 000000000000..9fce86338bcd
--- /dev/null
+++ b/pkgs/by-name/gf/gfortran9/package.nix
@@ -0,0 +1,10 @@
+{ wrapCC, gcc9 }:
+wrapCC (
+  gcc9.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
diff --git a/pkgs/by-name/go/godns/package.nix b/pkgs/by-name/go/godns/package.nix
index 1bf3dbd2cf71..4f4a48c257b5 100644
--- a/pkgs/by-name/go/godns/package.nix
+++ b/pkgs/by-name/go/godns/package.nix
@@ -9,19 +9,19 @@
 
 buildGoModule rec {
   pname = "godns";
-  version = "3.1.6";
+  version = "3.1.7";
 
   src = fetchFromGitHub {
     owner = "TimothyYe";
     repo = "godns";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Kr+zMmjpHR2JtCaDyLMcQwOUXlPJeisu94zHRpEYV/I=";
+    hash = "sha256-aTCYnjv9DTlCohdESGAjMz7JQG0BsLTNMiknyB6Ut50=";
   };
 
   vendorHash = "sha256-E15h5p4ppRb91EUoz5dyWNFl745rt419NMCSurMLxis=";
   npmDeps = fetchNpmDeps {
     src = "${src}/web";
-    hash = "sha256-2yeqLly0guU/kpX+yH/QOoDGzyJTxkTaCt8EleJhybU=";
+    hash = "sha256-gnAUI3lLDhjZ+nLap41COq765ymR6a8FgVY/aqqidTQ=";
   };
 
   npmRoot = "web";
diff --git a/pkgs/by-name/te/terragrunt/package.nix b/pkgs/by-name/te/terragrunt/package.nix
index a8262a50d84e..600e9159a7ac 100644
--- a/pkgs/by-name/te/terragrunt/package.nix
+++ b/pkgs/by-name/te/terragrunt/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.63.2";
+  version = "0.66.1";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Y6bDXohGeQ5H4Cq50dwA503pOQA8+ab9po4slL3BRDg=";
+    hash = "sha256-Dp3hZoSpOBO//qpzry0zZ5GBqdyyL5mu4cS/M1GAUQg=";
   };
 
   nativeBuildInputs = [ go-mockery ];
@@ -21,7 +21,7 @@ buildGoModule rec {
     make generate-mocks
   '';
 
-  vendorHash = "sha256-l0RFHOQIHLSCzSKq09ibtXEMph/Lhv9ie6B+jpLTxbY=";
+  vendorHash = "sha256-kxMSNh0kn9WJuE4ARnihkjX96Vp9FUfPQE4B4p3KMac=";
 
   doCheck = false;
 
diff --git a/pkgs/data/fonts/annapurna-sil/default.nix b/pkgs/data/fonts/annapurna-sil/default.nix
index 606b0f0161c2..325a1a5bcd57 100644
--- a/pkgs/data/fonts/annapurna-sil/default.nix
+++ b/pkgs/data/fonts/annapurna-sil/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "annapurna-sil";
-  version = "2.000";
+  version = "2.100";
 
   src = fetchzip {
     url = "https://software.sil.org/downloads/r/annapurna/AnnapurnaSIL-${version}.zip";
-    hash = "sha256-tvh1E9uGCikJgjmbn28gD7rUgBdKjtvdwgoRIeccGq8=";
+    hash = "sha256-TFaCchtd9SRGsU9r+m8QOvZfc7/FJxwclkSfbLwf6/4=";
   };
 
   installPhase = ''
diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 96c4708c3145..c2b1ad98dacc 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.112";
+  version = "9.2.113";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "ailment";
     rev = "refs/tags/v${version}";
-    hash = "sha256-R1Tvo4xqxKB2yQypiOtmuCzujE1DhHo2kPQUL7RuWGk=";
+    hash = "sha256-vrCWGteCVhvEYgXQTcJdeWxF9hkmk2Y8b5Bend4cv34=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index 6f715ccbf160..cca249a6e187 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -36,7 +36,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.112";
+  version = "9.2.113";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "angr";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OrLkKPQFhcDv/9Rj8c6UYhS5QbpjfEXBSAK61Y1I6YQ=";
+    hash = "sha256-vj166aUVjyce3EJE/d8aY90Ho1VaIgiqRYGep1gNoW0=";
   };
 
   pythonRelaxDeps = [ "capstone" ];
diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index dc417d723e99..7f4cee89996d 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.112";
+  version = "9.2.113";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "archinfo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-L//vOpW3iKQyWnB0rjBIXMeL/9meMcv58DBD/84GGR0=";
+    hash = "sha256-+cI6aZZxP8501UkiyKaP2nXulT8CVMImLUXkN7sy5i0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index efcf200f4d41..2ed176900d84 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.112";
+  version = "9.2.113";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "claripy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UfHTV1I3V5NpeKAjXkQmaX6d/f7o+9QOsh1y2Ws02DA=";
+    hash = "sha256-lGXxu6xI0ndMH9/S8uQCqvpV0mStNzMsCT5mXjBgP9Q=";
   };
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail
diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index bd7a2ba4d703..d5d425dfb5ab 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -18,14 +18,14 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.112";
+  version = "9.2.113";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
     owner = "angr";
     repo = "binaries";
     rev = "refs/tags/v${version}";
-    hash = "sha256-uVoM6Ae8r9xQ4+EzdQ5A3OrpOdt6hhJATvuzSZVxvy8=";
+    hash = "sha256-SlML9os4ThZML77SBg2VosGzKWZdb1p9ClDf6nfB+yQ=";
   };
 in
 buildPythonPackage rec {
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = "cle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Gdj3LVIYQKhDN5Dnw06D96wmvExyN5/OmNPu/EJeKw0=";
+    hash = "sha256-wyowItw7KgcIl0nu57s1cDdZc0oFQaL9yRxPa1Wjx90=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pip-api/default.nix b/pkgs/development/python-modules/pip-api/default.nix
index c6239ac4d151..562f701dece7 100644
--- a/pkgs/development/python-modules/pip-api/default.nix
+++ b/pkgs/development/python-modules/pip-api/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pip-api";
-  version = "0.0.33";
+  version = "0.0.34";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "di";
     repo = "pip-api";
     rev = "refs/tags/${version}";
-    hash = "sha256-bDM31YpVB0pZMqeGTCbnINSmJc03N0HuU8hcc8nnHgw=";
+    hash = "sha256-nmCP4hp+BsD80OBjerOu+QTBBExGHvn/v19od4V3ncI=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index fc0a3830e73f..a35c477f85ea 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.112";
+  version = "9.2.113";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-IxrH8Ej1PmyQXtS7CROvxopf9tmjKiOYqwfAc6mLMnw=";
+    hash = "sha256-mmtRFY++zxc97hgc7aVzRd+M5vHqkgNARfznrL2yLZg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/memray/default.nix b/pkgs/development/tools/memray/default.nix
index 8e0b2689984e..8dabb8a23969 100644
--- a/pkgs/development/tools/memray/default.nix
+++ b/pkgs/development/tools/memray/default.nix
@@ -1,58 +1,71 @@
-{ lib
-, fetchFromGitHub
-, libunwind
-, lz4
-, pkg-config
-, python3
+{
+  lib,
+  elfutils,
+  fetchFromGitHub,
+  libunwind,
+  lz4,
+  pkg-config,
+  python3Packages,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "memray";
-  version = "1.11.0";
-  format = "setuptools";
+  version = "1.13.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bloomberg";
     repo = "memray";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DaJ1Hhg7q4ckA5feUx0twOsmy28v5aBBCTUAkn43xAo=";
+    hash = "sha256-8ztnXNdsthoMvooWoJLKrB9yGHjkYhQ2jiwF3KujAnw=";
   };
 
-  nativeBuildInputs = [
-    pkg-config
+  build-system = with python3Packages; [
+    distutils
+    setuptools
   ];
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     libunwind
     lz4
-  ] ++ (with python3.pkgs; [
-    cython
-  ]);
+    elfutils # for `-ldebuginfod`
+  ] ++ (with python3Packages; [ cython ]);
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3Packages; [
+    pkgconfig
+    textual
     jinja2
     rich
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
-    ipython
-    pytestCheckHook
-  ] ++ lib.optionals (pythonOlder "3.12") [
-    greenlet
-  ];
+  nativeCheckInputs =
+    with python3Packages;
+    [
+      ipython
+      pytestCheckHook
+      pytest-cov # fix Unknown pytest.mark.no_cover
+    ]
+    ++ lib.optionals (pythonOlder "3.12") [ greenlet ];
 
-  pythonImportsCheck = [
-    "memray"
-  ];
+  pythonImportsCheck = [ "memray" ];
 
-  pytestFlagsArray = [
-    "tests"
-  ];
+  pytestFlagsArray = [ "tests" ];
 
   disabledTests = [
     # Import issue
     "test_header_allocator"
     "test_hybrid_stack_of_allocations_inside_ceval"
+
+    # snapshot-based tests are too fragile
+    # see https://github.com/bloomberg/memray/issues/654
+    "TestTUILooks"
+    "test_tui_basic"
+    "test_tui_pause"
+    "test_tui_gradient"
+    "test_merge_threads"
+    "test_unmerge_threads"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/os-specific/linux/libnvme/default.nix b/pkgs/os-specific/linux/libnvme/default.nix
index 4d86812698e5..3209539f020f 100644
--- a/pkgs/os-specific/linux/libnvme/default.nix
+++ b/pkgs/os-specific/linux/libnvme/default.nix
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libnvme";
-  version = "1.9";
+  version = "1.10";
 
   outputs = [ "out" ] ++ lib.optionals withDocs [ "man" ];
 
@@ -26,12 +26,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "linux-nvme";
     repo = "libnvme";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nXzYbj4BDxFii30yR+aTgqjQfyYMFiAIcV/OHI2y5Ws=";
+    hash = "sha256-guNABLpDKdWDE79gxoNq0ukAUE7CnMw5QRXA3rl3Dk4=";
   };
 
   postPatch = ''
     patchShebangs scripts
-    substituteInPlace test/sysfs/sysfs-tree-diff.sh \
+    substituteInPlace test/sysfs/tree-diff.sh test/config/config-diff.sh \
       --replace-fail /bin/bash ${bash}/bin/bash
   '';
 
diff --git a/pkgs/os-specific/linux/nvme-cli/default.nix b/pkgs/os-specific/linux/nvme-cli/default.nix
index a39c26ac7c19..88959851c545 100644
--- a/pkgs/os-specific/linux/nvme-cli/default.nix
+++ b/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nvme-cli";
-  version = "2.9.1";
+  version = "2.10";
 
   src = fetchFromGitHub {
     owner = "linux-nvme";
     repo = "nvme-cli";
     rev = "v${version}";
-    hash = "sha256-zs7UksB5QkvCP29iELDGMJeObvMdKrs6ajQkEzCPzzQ=";
+    hash = "sha256-pFSVCbGiJ+8T2Eeew1M6TZC5Vh46OJDmf7hfU9M26Iw=";
   };
 
   mesonFlags = [
diff --git a/pkgs/servers/miniflux/default.nix b/pkgs/servers/miniflux/default.nix
index 9a9be0e85e93..f29e46c2a455 100644
--- a/pkgs/servers/miniflux/default.nix
+++ b/pkgs/servers/miniflux/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles, nixosTests }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch2, installShellFiles, nixosTests }:
 
 buildGoModule rec {
   pname = "miniflux";
@@ -11,6 +11,15 @@ buildGoModule rec {
     hash = "sha256-1EH8KtKdAssxLk0IyhJsbrFU1obDTvmaGtFyLVlnOdQ=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # Fix panic during YouTube channel feed discovery
+      name = "miniflux-pr2742.patch";
+      url = "https://github.com/miniflux/v2/commit/79ea9e28b5a8c09f4d1dcbf31b661fb5f8e85e6a.patch";
+      hash = "sha256-BZPv83QsJ6iJs12FLALfTN//VZL/BfGkXs3Pzn9cGeU=";
+    })
+  ];
+
   vendorHash = "sha256-kr2qCKuwp6Fpr0zEjggqk4Mff3V9pxGLU71lRhdRrW8=";
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index 666e1404a66a..1e62aedc614f 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "11.14.0";
+  version = "11.15.1";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gG/KlwepzF0JWEzaGh/8KfuHXTgLenIX55ZXYr1n560=";
+    hash = "sha256-r3UivIoWWE6TShTJ9ipCpJ8vgDSi13or/jVXqB7F0qY=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-sMUl7jkNb9ki3ChjAraqTJwhMDfUexU+g/eslrLF3ig=";
+  vendorHash = "sha256-sDTUzWgmosL+jnjXD9T6TPp56dywwEPcJO9+0vXqwHo=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/tools/security/knockpy/default.nix b/pkgs/tools/security/knockpy/default.nix
index 57b653035725..c3ed52db593b 100644
--- a/pkgs/tools/security/knockpy/default.nix
+++ b/pkgs/tools/security/knockpy/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "knockpy";
-  version = "7.0.0";
+  version = "7.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "guelfoweb";
     repo = "knock";
     rev = "refs/tags/${version}";
-    hash = "sha256-Xtv7K19OBS2iHFFoSasNcy9VLL15eQ8AD79wAEhxCHk=";
+    hash = "sha256-ALsSpygJlqYW/7Z44PZmBcIxfrtOPPrvuuMIOyFE5kE=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 150c5785dcc0..6d08ebeca01e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15204,103 +15204,6 @@ with pkgs;
 
   gcc_latest = gcc14;
 
-  # Use the same GCC version as the one from stdenv by default
-  gfortran = wrapCC (gcc.cc.override {
-    name = "gfortran";
-    langFortran = true;
-    langCC = false;
-    langC = false;
-    profiledCompiler = false;
-  });
-
-  gfortran48 = wrapCC (gcc48.cc.override {
-    name = "gfortran";
-    langFortran = true;
-    langCC = false;
-    langC = false;
-    profiledCompiler = false;
-  });
-
-  gfortran49 = wrapCC (gcc49.cc.override {
-    name = "gfortran";
-    langFortran = true;
-    langCC = false;
-    langC = false;
-    profiledCompiler = false;
-  });
-
-  gfortran6 = wrapCC (gcc6.cc.override {
-    name = "gfortran";
-    langFortran = true;
-    langCC = false;
-    langC = false;
-    profiledCompiler = false;
-  });
-
-  gfortran7 = wrapCC (gcc7.cc.override {
-    name = "gfortran";
-    langFortran = true;
-    langCC = false;
-    langC = false;
-    profiledCompiler = false;
-  });
-
-  gfortran8 = wrapCC (gcc8.cc.override {
-    name = "gfortran";
-    langFortran = true;
-    langCC = false;
-    langC = false;
-    profiledCompiler = false;
-  });
-
-  gfortran9 = wrapCC (gcc9.cc.override {
-    name = "gfortran";
-    langFortran = true;
-    langCC = false;
-    langC = false;
-    profiledCompiler = false;
-  });
-
-  gfortran10 = wrapCC (gcc10.cc.override {
-    name = "gfortran";
-    langFortran = true;
-    langCC = false;
-    langC = false;
-    profiledCompiler = false;
-  });
-
-  gfortran11 = wrapCC (gcc11.cc.override {
-    name = "gfortran";
-    langFortran = true;
-    langCC = false;
-    langC = false;
-    profiledCompiler = false;
-  });
-
-  gfortran12 = wrapCC (gcc12.cc.override {
-    name = "gfortran";
-    langFortran = true;
-    langCC = false;
-    langC = false;
-    profiledCompiler = false;
-  });
-
-  gfortran13 = wrapCC (gcc13.cc.override {
-    name = "gfortran";
-    langFortran = true;
-    langCC = false;
-    langC = false;
-    profiledCompiler = false;
-  });
-
-  gfortran14 = wrapCC (gcc14.cc.override {
-    name = "gfortran";
-    langFortran = true;
-    langCC = false;
-    langC = false;
-    profiledCompiler = false;
-  });
-
   libgccjit = gcc.cc.override {
     name = "libgccjit";
     langFortran = false;
@@ -30428,7 +30331,7 @@ with pkgs;
   firefox-devedition-unwrapped = firefoxPackages.firefox-devedition;
   firefox-esr-115-unwrapped = firefoxPackages.firefox-esr-115;
   firefox-esr-128-unwrapped = firefoxPackages.firefox-esr-128;
-  firefox-esr-unwrapped = firefoxPackages.firefox-esr-115;
+  firefox-esr-unwrapped = firefoxPackages.firefox-esr-128;
 
   firefox = wrapFirefox firefox-unwrapped { };
   firefox-beta = wrapFirefox firefox-beta-unwrapped {
@@ -30458,7 +30361,7 @@ with pkgs;
     wmClass = "firefox-esr";
     icon = "firefox-esr";
   };
-  firefox-esr = firefox-esr-115;
+  firefox-esr = firefox-esr-128;
 
   firefox-bin-unwrapped = callPackage ../applications/networking/browsers/firefox-bin {
     channel = "release";
@@ -34103,6 +34006,7 @@ with pkgs;
   thunderbird-unwrapped = thunderbirdPackages.thunderbird;
   thunderbird = wrapThunderbird thunderbird-unwrapped { };
 
+  thunderbird-115 = wrapThunderbird thunderbirdPackages.thunderbird-115 { };
   thunderbird-128 = wrapThunderbird thunderbirdPackages.thunderbird-128 { };
 
   thunderbird-bin = wrapThunderbird thunderbird-bin-unwrapped {