diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ed6291b3d081..0e99aecd954d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -19424,6 +19424,12 @@
     githubId = 3413119;
     name = "Vonfry";
   };
+  vonixxx = {
+    email = "vonixxx@tuta.io";
+    github = "vonixxx";
+    githubId = 144771550;
+    name = "Luca Uricariu";
+  };
   votava = {
     email = "votava@gmail.com";
     github = "janvotava";
diff --git a/nixos/modules/hardware/keyboard/qmk.nix b/nixos/modules/hardware/keyboard/qmk.nix
index df3bcaeccd2e..d95d36dedb44 100644
--- a/nixos/modules/hardware/keyboard/qmk.nix
+++ b/nixos/modules/hardware/keyboard/qmk.nix
@@ -12,5 +12,6 @@ in
 
   config = mkIf cfg.enable {
     services.udev.packages = [ pkgs.qmk-udev-rules ];
+    users.groups.plugdev = {};
   };
 }
diff --git a/nixos/modules/services/networking/jigasi.nix b/nixos/modules/services/networking/jigasi.nix
index 8d2d25c6edfc..e701689031b1 100644
--- a/nixos/modules/services/networking/jigasi.nix
+++ b/nixos/modules/services/networking/jigasi.nix
@@ -96,7 +96,7 @@ in
     config = mkOption {
       type = attrsOf str;
       default = { };
-      example = literalExample ''
+      example = literalExpression ''
         {
           "org.jitsi.jigasi.auth.URL" = "XMPP:jitsi-meet.example.com";
         }
diff --git a/pkgs/applications/misc/camunda-modeler/default.nix b/pkgs/applications/misc/camunda-modeler/default.nix
index c9caa508f171..10bdf17813c5 100644
--- a/pkgs/applications/misc/camunda-modeler/default.nix
+++ b/pkgs/applications/misc/camunda-modeler/default.nix
@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "camunda-modeler";
-  version = "5.17.0";
+  version = "5.18.0";
 
   src = fetchurl {
     url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz";
-    hash = "sha256-yxph3Aor5nZOhu2PY4MGcfScaz9w24JXqXbhT+QKlNI=";
+    hash = "sha256-f7XYcFleEe1f6Uh6mOqfakzfWzOiQtBPhowTJUZU1MU=";
   };
   sourceRoot = "camunda-modeler-${version}-linux-x64";
 
diff --git a/pkgs/applications/networking/remote/citrix-workspace/default.nix b/pkgs/applications/networking/remote/citrix-workspace/default.nix
index c73789ddeb7b..f6004c2a3fae 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/default.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/default.nix
@@ -5,7 +5,6 @@
 
 let
   inherit (callPackage ./sources.nix { }) supportedVersions unsupportedVersions;
-  mkCitrix = callPackage ./generic.nix { };
 
   toAttrName = x: "citrix_workspace_${builtins.replaceStrings [ "." ] [ "_" ] x}";
 
diff --git a/pkgs/applications/networking/remote/citrix-workspace/sources.nix b/pkgs/applications/networking/remote/citrix-workspace/sources.nix
index f1b1a83102ac..3d9391168514 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/sources.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/sources.nix
@@ -44,6 +44,17 @@ let
       x86hash   = "95436fb289602cf31c65b7df89da145fc170233cb2e758a2f11116f15b57d382";
       x64suffix = "24";
       x86suffix = "24";
+      homepage  = "https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-linux/workspace-app-for-linux-latest9.html";
+    };
+
+    "23.11.0" = {
+      major     = "23";
+      minor     = "11";
+      patch     = "0";
+      x64hash   = "d3dde64baa6db7675a025eff546d552544d3523f4f3047621884f7830a9e2822";
+      x86hash   = "65b8c144e51b5bd78b98ae69e0fa76d6c020a857d74fd5254be49492527072b6";
+      x64suffix = "82";
+      x86suffix = "82";
       homepage  = "https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
     };
 
diff --git a/pkgs/applications/radio/abracadabra/default.nix b/pkgs/applications/radio/abracadabra/default.nix
index a19c48fb72e3..417ca2bc3f42 100644
--- a/pkgs/applications/radio/abracadabra/default.nix
+++ b/pkgs/applications/radio/abracadabra/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "abracadabra";
-  version = "2.3.1";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "KejPi";
     repo = "AbracaDABra";
     rev = "v${version}";
-    hash = "sha256-HRwgtNCrEzo6uXNJHG3PwpBAXVTppYUTmiwKWi3reho=";
+    hash = "sha256-giQJ6lOD5TaOa98e7nXf6/HHxP6/TxD9Pgr7xAxvZzs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
index 687cff3f01e2..b6b5f13bba97 100644
--- a/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhsenv-bubblewrap/default.nix
@@ -16,6 +16,7 @@
 , extraInstallCommands ? ""
 , meta ? {}
 , passthru ? {}
+, extraPreBwrapCmds ? ""
 , extraBwrapArgs ? []
 , unshareUser ? false
 , unshareIpc ? false
@@ -23,6 +24,7 @@
 , unshareNet ? false
 , unshareUts ? false
 , unshareCgroup ? false
+, privateTmp ? false
 , dieWithParent ? true
 , ...
 } @ args:
@@ -38,8 +40,8 @@ let
   buildFHSEnv = callPackage ./buildFHSEnv.nix { };
 
   fhsenv = buildFHSEnv (removeAttrs (args // { inherit name; }) [
-    "runScript" "extraInstallCommands" "meta" "passthru" "extraBwrapArgs" "dieWithParent"
-    "unshareUser" "unshareCgroup" "unshareUts" "unshareNet" "unsharePid" "unshareIpc"
+    "runScript" "extraInstallCommands" "meta" "passthru" "extraPreBwrapCmds" "extraBwrapArgs" "dieWithParent"
+    "unshareUser" "unshareCgroup" "unshareUts" "unshareNet" "unsharePid" "unshareIpc" "privateTmp"
     "pname" "version"
   ]);
 
@@ -116,7 +118,8 @@ let
 
   indentLines = str: lib.concatLines (map (s: "  " + s) (filter (s: s != "") (lib.splitString "\n" str)));
   bwrapCmd = { initArgs ? "" }: ''
-    ignored=(/nix /dev /proc /etc)
+    ${extraPreBwrapCmds}
+    ignored=(/nix /dev /proc /etc ${lib.optionalString privateTmp "/tmp"})
     ro_mounts=()
     symlinks=()
     etc_ignored=()
@@ -150,10 +153,8 @@ let
       if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
         continue
       fi
-      if [[ -L $i ]]; then
-        symlinks+=(--symlink "$(${coreutils}/bin/readlink "$i")" "$i")
-      else
-        ro_mounts+=(--ro-bind-try "$i" "$i")
+      if [[ -e $i ]]; then
+        symlinks+=(--symlink "/.host-etc/''${i#/etc/}" "$i")
       fi
     done
 
@@ -192,6 +193,8 @@ let
       ${lib.optionalString unshareCgroup "--unshare-cgroup"}
       ${lib.optionalString dieWithParent "--die-with-parent"}
       --ro-bind /nix /nix
+      --ro-bind /etc /.host-etc
+      ${lib.optionalString privateTmp "--tmpfs /tmp"}
       # Our glibc will look for the cache in its own path in `/nix/store`.
       # As such, we need a cache to exist there, because pressure-vessel
       # depends on the existence of an ld cache. However, adding one
diff --git a/pkgs/by-name/ki/kikit/default.nix b/pkgs/by-name/ki/kikit/default.nix
index 45209545aa3d..886cca973837 100644
--- a/pkgs/by-name/ki/kikit/default.nix
+++ b/pkgs/by-name/ki/kikit/default.nix
@@ -16,13 +16,10 @@
 , pcbnew-transition
 , pybars3
 , versioneer
+, shapely_1_8
 }:
 let
   solidpython = callPackage ./solidpython { };
-
-  # https://github.com/yaqwsx/KiKit/issues/574
-  # copy-pasted from nixpkgs#8d8e62e74f511160a599471549a98bc9e4f4818d
-  shapely = callPackage ./shapely { };
 in
 buildPythonApplication rec {
   pname = "kikit";
@@ -48,7 +45,8 @@ buildPythonApplication rec {
     wxPython_4_2
     pcbnew-transition
     pybars3
-    shapely
+    # https://github.com/yaqwsx/KiKit/issues/574
+    shapely_1_8
     # https://github.com/yaqwsx/KiKit/issues/576
     solidpython
   ];
diff --git a/pkgs/by-name/ko/koodousfinder/package.nix b/pkgs/by-name/ko/koodousfinder/package.nix
new file mode 100644
index 000000000000..669783657081
--- /dev/null
+++ b/pkgs/by-name/ko/koodousfinder/package.nix
@@ -0,0 +1,42 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "koodousfinder";
+  version = "0.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "teixeira0xfffff";
+    repo = "KoodousFinder";
+    # Not properly tagged, https://github.com/teixeira0xfffff/KoodousFinder/issues/7
+    #rev = "refs/tags/v${version}";
+    rev = "d9dab5572f44e5cd45c04e6fcda38956897855d1";
+    hash = "sha256-skCbt2lDKgSyZdHY3WImbr6CF0icrDPTIXNV1736gKk=";
+  };
+
+  nativeBuildInputs = with python3.pkgs; [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    keyring
+    requests
+  ];
+
+  # Project has no tests, re-check with next release
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "koodousfinder"
+  ];
+
+  meta = with lib; {
+    description = "Tool to allows users to search for and analyze Android apps";
+    homepage = "https://github.com/teixeira0xfffff/KoodousFinder";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/by-name/wh/when/package.nix b/pkgs/by-name/wh/when/package.nix
new file mode 100644
index 000000000000..65fe306f447f
--- /dev/null
+++ b/pkgs/by-name/wh/when/package.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenvNoCC
+, perl
+, installShellFiles
+, fetchFromBitbucket
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname   = "when";
+  version = "1.1.45";
+
+  src = fetchFromBitbucket {
+    repo  = "when";
+    owner = "ben-crowell";
+    rev   = finalAttrs.version;
+    hash  = "sha256-+ggYjY6/aTUrdvREn0TTQ4Pu/VR4QTjflDaicRXuOMs=";
+  };
+
+  buildInputs = [ perl ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postBuild = ''
+     pod2man $src/when when.1
+  '';
+
+  installPhase = ''
+     runHook preInstall
+
+     install -Dm755 when $out/bin/when
+     installManPage when.1
+
+     runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An extremely simple personal calendar program";
+    homepage    = "https://www.lightandmatter.com/when/when.html";
+    license     = licenses.gpl2Only;
+    mainProgram = "when";
+    maintainers = with maintainers; [ vonixxx ];
+    platforms   = platforms.all;
+  };
+})
diff --git a/pkgs/development/interpreters/wavm/default.nix b/pkgs/development/interpreters/wavm/default.nix
index a9ed260a0fd0..c4d4c4f5f2d2 100644
--- a/pkgs/development/interpreters/wavm/default.nix
+++ b/pkgs/development/interpreters/wavm/default.nix
@@ -22,5 +22,6 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     homepage = "https://wavm.github.io";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ereslibre ];
+    platforms = platforms.unix;
   };
 })
diff --git a/pkgs/development/libraries/cpp-utilities/default.nix b/pkgs/development/libraries/cpp-utilities/default.nix
index b15335a37ca4..b76153304dfa 100644
--- a/pkgs/development/libraries/cpp-utilities/default.nix
+++ b/pkgs/development/libraries/cpp-utilities/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cpp-utilities";
-  version = "5.24.2";
+  version = "5.24.4";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "cpp-utilities";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-boV0OO8GzgH0HpNh00nYLM2+wCmvuDxwKHvCMCdmiJs=";
+    sha256 = "sha256-YQNnf/DAtc58OwOWa2SBijIDpuhqWxFZHZCXLJ8PstI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/geos/3.11.nix b/pkgs/development/libraries/geos/3.11.nix
new file mode 100644
index 000000000000..90bdfdb0d605
--- /dev/null
+++ b/pkgs/development/libraries/geos/3.11.nix
@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, callPackage
+, fetchpatch
+, fetchurl
+, testers
+
+, cmake
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "geos";
+  version = "3.11.2";
+
+  src = fetchurl {
+    url = "https://download.osgeo.org/geos/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-sfB3ZpSBxaPmKv/EnpbrBvKBmHpdNv2rIlIX5bgl5Mw=";
+  };
+
+  patches = [
+    # Pull upstream fix of `gcc-13` build failure:
+    #   https://github.com/libgeos/geos/pull/805
+    (fetchpatch {
+      name = "gcc-13.patch";
+      url = "https://github.com/libgeos/geos/commit/bea3188be44075034fd349f5bb117c943bdb7fb1.patch";
+      hash = "sha256-dQT3Hf9YJchgjon/r46TLIXXbE6C0ZnewyvfYJea4jM=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  doCheck = true;
+
+  passthru.tests = {
+    pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    geos = callPackage ./tests.nix { geos = finalAttrs.finalPackage; };
+  };
+
+  meta = with lib; {
+    description = "C/C++ library for computational geometry with a focus on algorithms used in geographic information systems (GIS) software";
+    homepage = "https://libgeos.org";
+    license = licenses.lgpl21Only;
+    maintainers = teams.geospatial.members;
+    pkgConfigModules = [ "geos" ];
+    mainProgram = "geosop";
+  };
+})
diff --git a/pkgs/development/libraries/geos/default.nix b/pkgs/development/libraries/geos/default.nix
index 90bdfdb0d605..fc3cff98d7e8 100644
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , callPackage
-, fetchpatch
 , fetchurl
 , testers
 
@@ -10,23 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geos";
-  version = "3.11.2";
+  version = "3.12.1";
 
   src = fetchurl {
     url = "https://download.osgeo.org/geos/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-sfB3ZpSBxaPmKv/EnpbrBvKBmHpdNv2rIlIX5bgl5Mw=";
+    hash = "sha256-1up+SSIktRGT6CRP4+wXxNRNB3fzwyyk+xcRQFSaDQM=";
   };
 
-  patches = [
-    # Pull upstream fix of `gcc-13` build failure:
-    #   https://github.com/libgeos/geos/pull/805
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/libgeos/geos/commit/bea3188be44075034fd349f5bb117c943bdb7fb1.patch";
-      hash = "sha256-dQT3Hf9YJchgjon/r46TLIXXbE6C0ZnewyvfYJea4jM=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake ];
 
   doCheck = true;
@@ -40,8 +29,9 @@ stdenv.mkDerivation (finalAttrs: {
     description = "C/C++ library for computational geometry with a focus on algorithms used in geographic information systems (GIS) software";
     homepage = "https://libgeos.org";
     license = licenses.lgpl21Only;
+    mainProgram = "geosop";
     maintainers = teams.geospatial.members;
     pkgConfigModules = [ "geos" ];
-    mainProgram = "geosop";
+    changelog = "https://github.com/libgeos/geos/releases/tag/${finalAttrs.finalPackage.version}";
   };
 })
diff --git a/pkgs/development/ocaml-modules/functoria/default.nix b/pkgs/development/ocaml-modules/functoria/default.nix
index 1b4eb502b64a..e126c707285a 100644
--- a/pkgs/development/ocaml-modules/functoria/default.nix
+++ b/pkgs/development/ocaml-modules/functoria/default.nix
@@ -1,21 +1,19 @@
-{ lib, fetchurl, buildDunePackage, cmdliner
+{ lib, buildDunePackage, cmdliner
+, functoria-runtime
 , rresult, astring, fmt, logs, bos, fpath, emile, uri
+, alcotest
 }:
 
-buildDunePackage rec {
+buildDunePackage {
   pname   = "functoria";
-  version = "4.3.6";
+  inherit (functoria-runtime) version src;
 
   minimalOCamlVersion = "4.08";
 
-  src = fetchurl {
-    url = "https://github.com/mirage/mirage/releases/download/v${version}/mirage-${version}.tbz";
-    hash = "sha256-i/5sZHfxECoKYMdGje+U21GWxJ6dDZreVcQGtbuo4SE=";
-  };
-
   propagatedBuildInputs = [ cmdliner rresult astring fmt logs bos fpath emile uri ];
 
-  doCheck = false;
+  doCheck = true;
+  checkInputs = [ alcotest functoria-runtime ];
 
   meta = with lib; {
     description = "A DSL to organize functor applications";
diff --git a/pkgs/development/ocaml-modules/functoria/runtime.nix b/pkgs/development/ocaml-modules/functoria/runtime.nix
index 1eb2eec48e44..3ede6096e508 100644
--- a/pkgs/development/ocaml-modules/functoria/runtime.nix
+++ b/pkgs/development/ocaml-modules/functoria/runtime.nix
@@ -1,14 +1,21 @@
-{ lib, buildDunePackage, functoria, cmdliner, fmt }:
+{ lib, buildDunePackage, fetchurl, cmdliner }:
 
-buildDunePackage {
+buildDunePackage rec {
   pname = "functoria-runtime";
+  version = "4.4.1";
 
-  inherit (functoria) version src;
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage/releases/download/v${version}/mirage-${version}.tbz";
+    hash = "sha256-FKCdzrRJVpUrCWqrTiE8l00ZKJOYsvI9mNzJ0ZxDBwg=";
+  };
 
-  propagatedBuildInputs = [ cmdliner fmt ];
+  minimalOCamlVersion = "4.08";
+
+  propagatedBuildInputs = [ cmdliner ];
 
   meta = with lib; {
-    inherit (functoria.meta) homepage license;
+    homepage    = "https://github.com/mirage/functoria";
+    license     = licenses.isc;
     description = "Runtime support library for functoria-generated code";
     maintainers = [ maintainers.sternenseemann ];
   };
diff --git a/pkgs/development/ocaml-modules/mirage/default.nix b/pkgs/development/ocaml-modules/mirage/default.nix
index 98d96cf146f0..410475b6b5c0 100644
--- a/pkgs/development/ocaml-modules/mirage/default.nix
+++ b/pkgs/development/ocaml-modules/mirage/default.nix
@@ -8,7 +8,6 @@ buildDunePackage rec {
   inherit (mirage-runtime) version src;
 
   minimalOCamlVersion = "4.08";
-  duneVersion = "3";
 
   outputs = [ "out" "dev" ];
 
diff --git a/pkgs/development/ocaml-modules/mirage/runtime.nix b/pkgs/development/ocaml-modules/mirage/runtime.nix
index 0b7d929f5a8e..7e20e3363a47 100644
--- a/pkgs/development/ocaml-modules/mirage/runtime.nix
+++ b/pkgs/development/ocaml-modules/mirage/runtime.nix
@@ -1,5 +1,5 @@
 { lib, buildDunePackage, fetchurl, ipaddr, functoria-runtime
-, fmt, logs, lwt
+, logs, lwt
 , alcotest
 }:
 
@@ -8,9 +8,8 @@ buildDunePackage rec {
   inherit (functoria-runtime) src version;
 
   minimalOCamlVersion = "4.08";
-  duneVersion = "3";
 
-  propagatedBuildInputs = [ ipaddr functoria-runtime fmt logs lwt ];
+  propagatedBuildInputs = [ ipaddr functoria-runtime logs lwt ];
   checkInputs = [ alcotest ];
   doCheck = true;
 
diff --git a/pkgs/development/python-modules/aemet-opendata/default.nix b/pkgs/development/python-modules/aemet-opendata/default.nix
index b238f184f0c1..6960b390ed03 100644
--- a/pkgs/development/python-modules/aemet-opendata/default.nix
+++ b/pkgs/development/python-modules/aemet-opendata/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "aemet-opendata";
-  version = "0.4.6";
+  version = "0.4.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.11";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Noltari";
     repo = "AEMET-OpenData";
     rev = "refs/tags/${version}";
-    hash = "sha256-eAHj37d0akxSz4rnf9f0tDknJQe//cMg0Korp1rtxfQ=";
+    hash = "sha256-kmU2HtNyYhfwWQv6asOtDpLZ6+O+eEICzBNLxUhAwaY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index ae981e949dec..04cf6abd82a4 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -1,28 +1,23 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-
-# build-system
-, cython_3
-, setuptools
-
-# dependencies
+, aiohappyeyeballs
 , async-timeout
+, buildPythonPackage
 , chacha20poly1305-reuseable
+, cython_3
+, fetchFromGitHub
+, mock
 , noiseprotocol
 , protobuf
-, zeroconf
-
-# tests
-, mock
 , pytest-asyncio
 , pytestCheckHook
+, pythonOlder
+, setuptools
+, zeroconf
 }:
 
 buildPythonPackage rec {
   pname = "aioesphomeapi";
-  version = "19.2.1";
+  version = "21.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -31,7 +26,7 @@ buildPythonPackage rec {
     owner = "esphome";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-WSWGO0kI1m6oaImUYZ6m5WKJ+xPs/rtn5wVq1bDr+bE=";
+    hash = "sha256-KT38NY1BZM6Qr1EeC05vM9IcVKO7GaEx0102TUzkyRE=";
   };
 
   nativeBuildInputs = [
@@ -40,6 +35,7 @@ buildPythonPackage rec {
   ];
 
   propagatedBuildInputs = [
+    aiohappyeyeballs
     chacha20poly1305-reuseable
     noiseprotocol
     protobuf
@@ -48,19 +44,20 @@ buildPythonPackage rec {
     async-timeout
   ];
 
-  pythonImportsCheck = [
-    "aioesphomeapi"
-  ];
   nativeCheckInputs = [
     mock
     pytest-asyncio
     pytestCheckHook
   ];
 
+  pythonImportsCheck = [
+    "aioesphomeapi"
+  ];
+
   meta = with lib; {
-    changelog = "https://github.com/esphome/aioesphomeapi/releases/tag/v${version}";
     description = "Python Client for ESPHome native API";
     homepage = "https://github.com/esphome/aioesphomeapi";
+    changelog = "https://github.com/esphome/aioesphomeapi/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab hexa ];
   };
diff --git a/pkgs/development/python-modules/aiohappyeyeballs/default.nix b/pkgs/development/python-modules/aiohappyeyeballs/default.nix
new file mode 100644
index 000000000000..8922c8283adc
--- /dev/null
+++ b/pkgs/development/python-modules/aiohappyeyeballs/default.nix
@@ -0,0 +1,54 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "aiohappyeyeballs";
+  version = "2.3.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "bdraco";
+    repo = "aiohappyeyeballs";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LMvELnN6Sy6DssXfH6fQ84N2rhdjqB8AlikTMidrjT4=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=aiohappyeyeballs --cov-report=term-missing:skip-covered" ""
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "aiohappyeyeballs"
+  ];
+
+  disabledTestPaths = [
+    # Test has typos
+    "tests/test_impl.py"
+  ];
+
+  meta = with lib; {
+    description = "Modul for connecting with Happy Eyeballs";
+    homepage = "https://github.com/bdraco/aiohappyeyeballs";
+    changelog = "https://github.com/bdraco/aiohappyeyeballs/blob/${version}/CHANGELOG.md";
+    license = licenses.psfl;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index 79484a4beea9..8fe2e78372d3 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , aiocoap
+, aiohappyeyeballs
 , async-interrupt
 , bleak
 , bleak-retry-connector
@@ -19,16 +20,16 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "3.0.9";
-  format = "pyproject";
+  version = "3.1.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "Jc2k";
-    repo = pname;
+    repo = "aiohomekit";
     rev = "refs/tags/${version}";
-    hash = "sha256-YaLSpWSaiEP7X+IujrQgXgWl3aPc1WDMq2yaMUTu328=";
+    hash = "sha256-yaPliPKa/mS9amUkEx/iM398HGoiKrR6miCtK7fThNw=";
   };
 
   nativeBuildInputs = [
@@ -37,6 +38,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiocoap
+    aiohappyeyeballs
     async-interrupt
     bleak
     bleak-retry-connector
diff --git a/pkgs/development/python-modules/bleak-esphome/default.nix b/pkgs/development/python-modules/bleak-esphome/default.nix
new file mode 100644
index 000000000000..8a6f46eaca9e
--- /dev/null
+++ b/pkgs/development/python-modules/bleak-esphome/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, aioesphomeapi
+, bleak
+, bluetooth-data-tools
+, buildPythonPackage
+, fetchFromGitHub
+, habluetooth
+, poetry-core
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "bleak-esphome";
+  version = "0.2.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "bluetooth-devices";
+    repo = "bleak-esphome";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QtSkrX7xGaV/13FonQhYR4MpZxVwR8dAFCRvID0zSGo=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=bleak_esphome --cov-report=term-missing:skip-covered" ""
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    aioesphomeapi
+    bleak
+    bluetooth-data-tools
+    habluetooth
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "bleak_esphome"
+  ];
+
+  meta = with lib; {
+    description = "Bleak backend of ESPHome";
+    homepage = "https://github.com/bluetooth-devices/bleak-esphome";
+    changelog = "https://github.com/bluetooth-devices/bleak-esphome/blob/${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/bluetooth-data-tools/default.nix b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
index 370dd50d41f7..1d2facc1ed1e 100644
--- a/pkgs/development/python-modules/bluetooth-data-tools/default.nix
+++ b/pkgs/development/python-modules/bluetooth-data-tools/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "bluetooth-data-tools";
-  version = "1.17.0";
+  version = "1.18.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-CJyTWNBtBk3YpoaiL1/P+aUE4ttthQDTdDuKBYEXrBg=";
+    hash = "sha256-AN0zalYQ4JQCaBDrE4tq2WwVEXz0LBlfvrxNiPL4oOs=";
   };
 
   # The project can build both an optimized cython version and an unoptimized
diff --git a/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix b/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix
index 1d1b21ceee57..4c2cabda2cd3 100644
--- a/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix
+++ b/pkgs/development/python-modules/chacha20poly1305-reuseable/default.nix
@@ -17,7 +17,7 @@
 
 let
   pname = "chacha20poly1305-reuseable";
-  version = "0.11.0";
+  version = "0.12.0";
 in
 
 buildPythonPackage {
@@ -30,7 +30,7 @@ buildPythonPackage {
     owner = "bdraco";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-uRndA0NnSQtJTftALzBF3FWZtavRyMwBlnCBqoIXE5Q=";
+    hash = "sha256-g1sLmYy5SClkdBSjFFYtikh2nuxfTIoaCyktqoFl+Ho=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix
index 077ea73bd8b9..295094c65928 100644
--- a/pkgs/development/python-modules/django/3.nix
+++ b/pkgs/development/python-modules/django/3.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , fetchPypi
 , substituteAll
-, geos39
+, geos_3_9
 , gdal
 , asgiref
 , pytz
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   ] ++ lib.optional withGdal
     (substituteAll {
       src = ./django_3_set_geos_gdal_lib.patch;
-      inherit geos39;
+      inherit geos_3_9;
       inherit gdal;
       extension = stdenv.hostPlatform.extensions.sharedLibrary;
     });
diff --git a/pkgs/development/python-modules/django/django_3_set_geos_gdal_lib.patch b/pkgs/development/python-modules/django/django_3_set_geos_gdal_lib.patch
index 15f0773dcf4f..a7dfa086a0a7 100644
--- a/pkgs/development/python-modules/django/django_3_set_geos_gdal_lib.patch
+++ b/pkgs/development/python-modules/django/django_3_set_geos_gdal_lib.patch
@@ -18,7 +18,7 @@ diff -Nur a/django/contrib/gis/geos/libgeos.py b/django/contrib/gis/geos/libgeos
          lib_path = settings.GEOS_LIBRARY_PATH
      except (AttributeError, ImportError, ImproperlyConfigured, OSError):
 -        lib_path = None
-+        lib_path = "@geos39@/lib/libgeos_c@extension@"
++        lib_path = "@geos_3_9@/lib/libgeos_c@extension@"
 
      # Setting the appropriate names for the GEOS-C library.
      if lib_path:
diff --git a/pkgs/development/python-modules/dvc-data/default.nix b/pkgs/development/python-modules/dvc-data/default.nix
index 3deec8ee65de..d8ea75e66017 100644
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-data";
-  version = "2.23.1";
+  version = "2.24.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = "dvc-data";
     rev = "refs/tags/${version}";
-    hash = "sha256-UsWMlwG1g59I+TIn1uwp6vyzVIBtj1lfchp+3SYognc=";
+    hash = "sha256-CDy7Ye/DPg7GQY5cg/wR4OH4C9wIlsz3Cxc4ntoNYFw=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/dvc-objects/default.nix b/pkgs/development/python-modules/dvc-objects/default.nix
index 0458828812d3..b5df60a987e6 100644
--- a/pkgs/development/python-modules/dvc-objects/default.nix
+++ b/pkgs/development/python-modules/dvc-objects/default.nix
@@ -1,48 +1,45 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, flatten-dict
 , fsspec
 , funcy
-, pygtrie
 , pytest-mock
 , pytestCheckHook
 , pythonOlder
 , reflink
 , setuptools-scm
 , shortuuid
-, tqdm
-, typing-extensions
 }:
 
 buildPythonPackage rec {
   pname = "dvc-objects";
-  version = "1.4.9";
-  format = "pyproject";
+  version = "2.0.1";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "iterative";
-    repo = pname;
+    repo = "dvc-objects";
     rev = "refs/tags/${version}";
-    hash = "sha256-9fuxlZDy83nl+rnVEFdAza1NHun8PdewgowMl3G5wZU=";
+    hash = "sha256-nxZN0Q9mRAZJUOoxfE58lXZVOrY0r05iROcuo+nV99A=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --benchmark-skip" ""
+  '';
+
   nativeBuildInputs = [
     setuptools-scm
   ];
 
   propagatedBuildInputs = [
-    flatten-dict
     fsspec
     funcy
-    pygtrie
     shortuuid
-    tqdm
-    typing-extensions
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/dvc/default.nix b/pkgs/development/python-modules/dvc/default.nix
index cf925f030944..c4577e691357 100644
--- a/pkgs/development/python-modules/dvc/default.nix
+++ b/pkgs/development/python-modules/dvc/default.nix
@@ -55,14 +55,14 @@
 
 buildPythonPackage rec {
   pname = "dvc";
-  version = "3.33.3";
+  version = "3.33.4";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-S6RHRY0G6YYcLa7CBFNxi1fVSJH7ZdgyqAo3wmLUNbE=";
+    hash = "sha256-NWu12FVJDSSuxYGVWFNlbAEUINg05s64EJ6gIaErQ9E=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pygeos/default.nix b/pkgs/development/python-modules/pygeos/default.nix
index 91c4231d604d..657da35b4ad3 100644
--- a/pkgs/development/python-modules/pygeos/default.nix
+++ b/pkgs/development/python-modules/pygeos/default.nix
@@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , python
-, geos
+, geos_3_11
 , pytestCheckHook
 , cython
 , numpy
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [
-    geos # for geos-config
+    geos_3_11 # for geos-config
     cython
   ];
 
diff --git a/pkgs/development/python-modules/pyhiveapi/default.nix b/pkgs/development/python-modules/pyhiveapi/default.nix
index 989b1d115d8d..341e08186470 100644
--- a/pkgs/development/python-modules/pyhiveapi/default.nix
+++ b/pkgs/development/python-modules/pyhiveapi/default.nix
@@ -15,8 +15,7 @@
 buildPythonPackage rec {
   pname = "pyhiveapi";
   version = "0.5.16";
-
-  format = "pyproject";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
@@ -59,6 +58,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library to interface with the Hive API";
     homepage = "https://github.com/Pyhass/Pyhiveapi";
+    changelog = "https://github.com/Pyhass/Pyhiveapi/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/by-name/ki/kikit/shapely/default.nix b/pkgs/development/python-modules/shapely/1.8.nix
similarity index 60%
rename from pkgs/by-name/ki/kikit/shapely/default.nix
rename to pkgs/development/python-modules/shapely/1.8.nix
index 7f136a1338ad..28a248af0bed 100644
--- a/pkgs/by-name/ki/kikit/shapely/default.nix
+++ b/pkgs/development/python-modules/shapely/1.8.nix
@@ -2,39 +2,32 @@
 , stdenv
 , buildPythonPackage
 , fetchPypi
-, substituteAll
-, pythonOlder
-, geos
 , pytestCheckHook
+, pythonOlder
+, substituteAll
+
 , cython
+, geos_3_11
 , numpy
+, oldest-supported-numpy
+, setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
   pname = "Shapely";
-  version = "1.8.4";
-  disabled = pythonOlder "3.6";
+  version = "1.8.5";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-oZXlHKr6IYKR8suqP+9p/TNTyT7EtlsqRyLEz0DDGYw=";
+    hash = "sha256-6CttYOz7EkEgyI/hBqR4WWu+qxQhFtfn9ko2TayQKpI=";
   };
 
-  nativeBuildInputs = [
-    geos # for geos-config
-    cython
-  ];
-
-  propagatedBuildInputs = [
-    numpy
-  ];
-
-  checkInputs = [
-    pytestCheckHook
-  ];
-
   # Environment variable used in shapely/_buildcfg.py
-  GEOS_LIBRARY_PATH = "${geos}/lib/libgeos_c${stdenv.hostPlatform.extensions.sharedLibrary}";
+  GEOS_LIBRARY_PATH = "${geos_3_11}/lib/libgeos_c${stdenv.hostPlatform.extensions.sharedLibrary}";
 
   patches = [
     # Patch to search form GOES .so/.dylib files in a Nix-aware way
@@ -45,6 +38,30 @@ buildPythonPackage rec {
     })
   ];
 
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace "setuptools<64" "setuptools"
+  '';
+
+  nativeBuildInputs = [
+    cython
+    geos_3_11 # for geos-config
+    oldest-supported-numpy
+    setuptools
+    wheel
+  ];
+
+  buildInputs = [
+    geos_3_11
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
   preCheck = ''
     rm -r shapely # prevent import of local shapely
   '';
@@ -63,9 +80,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "shapely" ];
 
   meta = with lib; {
-    description = "Geometric objects, predicates, and operations";
-    homepage = "https://pypi.python.org/pypi/Shapely/";
-    license = with licenses; [ bsd3 ];
-    maintainers = with maintainers; [ knedlsepp ];
+    changelog = "https://github.com/shapely/shapely/blob/${version}/CHANGES.txt";
+    description = "Manipulation and analysis of geometric objects";
+    homepage = "https://github.com/shapely/shapely";
+    license = licenses.bsd3;
+    maintainers = teams.geospatial.members;
   };
 }
diff --git a/pkgs/by-name/ki/kikit/shapely/library-paths.patch b/pkgs/development/python-modules/shapely/library-paths.patch
similarity index 100%
rename from pkgs/by-name/ki/kikit/shapely/library-paths.patch
rename to pkgs/development/python-modules/shapely/library-paths.patch
diff --git a/pkgs/development/tools/analysis/include-what-you-use/default.nix b/pkgs/development/tools/analysis/include-what-you-use/default.nix
index 98aade37c2b5..7266b76a4ad6 100644
--- a/pkgs/development/tools/analysis/include-what-you-use/default.nix
+++ b/pkgs/development/tools/analysis/include-what-you-use/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
   pname = "include-what-you-use";
   # Also bump llvmPackages in all-packages.nix to the supported version!
-  version = "0.19";
+  version = "0.21";
 
   src = fetchurl {
     url = "${meta.homepage}/downloads/${pname}-${version}.src.tar.gz";
-    hash = "sha256-KxAVe2DqCK3AjjiWtJIcc/yt1exOtlKymjQSnVAeXuA=";
+    hash = "sha256-ajUZGf+JvafJXIlUcmAYaNs9qrlqlYs44DYokNWHYLY=";
   };
 
   postPatch = ''
@@ -17,11 +17,21 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = with llvmPackages; [ cmake llvm.dev llvm python3 ];
   buildInputs = with llvmPackages; [ libclang clang-unwrapped python3 ];
 
+  clang = llvmPackages.clang;
+
   cmakeFlags = [ "-DCMAKE_PREFIX_PATH=${llvmPackages.llvm.dev}" ];
 
   postInstall = ''
     substituteInPlace $out/bin/iwyu_tool.py \
       --replace "'include-what-you-use'" "'$out/bin/include-what-you-use'"
+
+
+    mv $out/bin/include-what-you-use $out/bin/.include-what-you-use-unwrapped
+    mv $out/bin/iwyu_tool.py $out/bin/.iwyu_tool.py-unwrapped
+    substituteAll ${./wrapper} $out/bin/include-what-you-use
+    ln -s $out/bin/include-what-you-use $out/bin/iwyu_tool.py
+    chmod +x $out/bin/include-what-you-use
+    patchShebangs $out/bin/include-what-you-use
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/tools/analysis/include-what-you-use/wrapper b/pkgs/development/tools/analysis/include-what-you-use/wrapper
new file mode 100755
index 000000000000..3fd37902cf2d
--- /dev/null
+++ b/pkgs/development/tools/analysis/include-what-you-use/wrapper
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+buildcpath() {
+  local path after
+  while (( $# )); do
+    case $1 in
+        -isystem)
+            shift
+            path=$path${path:+':'}$1
+            ;;
+        -idirafter)
+            shift
+            after=$after${after:+':'}$1
+            ;;
+    esac
+    shift
+  done
+  echo $path${after:+':'}$after
+}
+
+export CPATH=${CPATH}${CPATH:+':'}$(buildcpath ${NIX_CFLAGS_COMPILE} \
+                                               $(<@clang@/nix-support/libc-cflags)):@clang@/resource-root/include
+export CPLUS_INCLUDE_PATH=${CPLUS_INCLUDE_PATH}${CPLUS_INCLUDE_PATH:+':'}$(buildcpath ${NIX_CFLAGS_COMPILE} \
+                                                                                      $(<@clang@/nix-support/libcxx-cxxflags) \
+                                                                                      $(<@clang@/nix-support/libc-cflags)):@clang@/resource-root/include
+exec -a "$0" @out@/bin/.$(basename $0)-unwrapped "$@"
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index 8ba5087ef7fe..7bcc7976f1f9 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -3,11 +3,12 @@
 , extraPkgs ? pkgs: [ ] # extra packages to add to targetPkgs
 , extraLibraries ? pkgs: [ ] # extra packages to add to multiPkgs
 , extraProfile ? "" # string to append to profile
-, extraBwrapArgs ? [ ] # extra arguments to pass to bubblewrap
+, extraPreBwrapCmds ? "" # extra commands to run before calling bubblewrap (real default is at usage site)
+, extraBwrapArgs ? [ ] # extra arguments to pass to bubblewrap (real default is at usage site)
 , extraArgs ? "" # arguments to always pass to steam
 , extraEnv ? { } # Environment variables to pass to Steam
 , withGameSpecificLibraries ? true # include game specific libraries
-}:
+}@args:
 
 let
   commonTargetPkgs = pkgs: with pkgs; [
@@ -16,6 +17,8 @@ let
     lsb-release
     # Errors in output without those
     pciutils
+    # run.sh wants ldconfig
+    glibc.bin
     # Games' dependencies
     xorg.xrandr
     which
@@ -57,7 +60,10 @@ let
     fi
   '';
 
-  envScript = lib.toShellVars extraEnv;
+  envScript = ''
+    # prevents various error messages
+    unset GIO_EXTRA_MODULES
+  '' + lib.toShellVars extraEnv;
 
 in buildFHSEnv rec {
   name = "steam";
@@ -279,7 +285,17 @@ in buildFHSEnv rec {
     exec steam ${extraArgs} "$@"
   '';
 
-  inherit extraBwrapArgs;
+  # steamwebhelper deletes unrelated electron programs' singleton cookies from /tmp on startup:
+  # https://github.com/ValveSoftware/steam-for-linux/issues/9121
+  privateTmp = true;
+
+  extraPreBwrapCmds = ''
+    install -m 1777 -d /tmp/dumps
+  '' + args.extraPreBwrapCmds or "";
+
+  extraBwrapArgs = [
+    "--bind-try /tmp/dumps /tmp/dumps"
+  ] ++ args.extraBwrapArgs or [];
 
   meta =
     if steam != null
diff --git a/pkgs/os-specific/linux/bpftools/default.nix b/pkgs/os-specific/linux/bpftools/default.nix
index a23c4eb7b9e6..9ec4778ca38c 100644
--- a/pkgs/os-specific/linux/bpftools/default.nix
+++ b/pkgs/os-specific/linux/bpftools/default.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
+    homepage    = "https://github.com/libbpf/bpftool";
     description = "Debugging/program analysis tools for the eBPF subsystem";
     license     = [ licenses.gpl2 licenses.bsd2 ];
     platforms   = platforms.linux;
diff --git a/pkgs/servers/tailscale/default.nix b/pkgs/servers/tailscale/default.nix
index 60f82bf57e88..1b1546427db0 100644
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub, makeWrapper, iptables, iproute2, procps, shadow, getent }:
 
 let
-  version = "1.54.1";
+  version = "1.56.0";
 in
 buildGoModule {
   pname = "tailscale";
@@ -11,9 +11,9 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-dYYmqz1o3+FhdHmQ3KzUkAoSfEHNQhQt6neV3rFI+QE=";
+    hash = "sha256-st+s4fJMq1tad6IfPewGnM3LC7JDRoSt0LDV7392Kp4=";
   };
-  vendorHash = "sha256-/kuu7DKPklMZOvYqJpsOp3TeDG9KDEET4U0G+sq+4qY=";
+  vendorHash = "sha256-bG/ydsJf2UncOcDo8/BXdvQJO3Mk0tl8JGje1b6kto4=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
 
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index 52ccfa8ccaaa..727c6ae073e6 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -91,6 +91,32 @@ stdenv.mkDerivation rec {
       revert = true;
       hash = "sha256-p8Kcv9d7ri4eJU6Fgqyzdj0hV5MHSe50AF02FPDJx2Y=";
     })
+
+    # Fixes for NTFS bugs (CVE-2023-4692 and CVE-2023-4693)
+    (fetchpatch {
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=43651027d24e62a7a463254165e1e46e42aecdea";
+      hash = "sha256-/oudbfL8Ph7ZsgsFUI0YIddji+7okFRG12E/rDsgvNM=";
+    })
+    (fetchpatch {
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=0ed2458cc4eff6d9a9199527e2a0b6d445802f94";
+      hash = "sha256-6EhLzVapN2n62Lgo+PnB4SRvDkYWFkrKNinCvArRUXk=";
+    })
+    (fetchpatch {
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7e5f031a6a6a3decc2360a7b0c71abbe598e7354";
+      hash = "sha256-R2vmVGidm1ZFxopt/71y2816z2i/vvPrthZE52oc4CI=";
+    })
+    (fetchpatch {
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7a5a116739fa6d8a625da7d6b9272c9a2462f967";
+      hash = "sha256-T1LglEcUl9GXQjJ6Y4fKuFyFAujNRbcAb9KoNkl6jXs=";
+    })
+    (fetchpatch {
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=1fe82c41e070385e273d7bb1cfb482627a3c28e8";
+      hash = "sha256-x/V7bmRaNxo8NNOUwVti59n9ST/2yTJ/blWjk3omdqE=";
+    })
+    (fetchpatch {
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=e58b870ff926415e23fc386af41ff81b2f588763";
+      hash = "sha256-a0faNQafL+uRIglnILkLj64ROWxqmczQTQSu3VdklSk=";
+    })
   ];
 
   postPatch = if kbdcompSupport then ''
diff --git a/pkgs/tools/misc/libbitcoin/fix-gcc11-compilation.patch b/pkgs/tools/misc/libbitcoin/fix-gcc11-compilation.patch
deleted file mode 100644
index fe1b9777275e..000000000000
--- a/pkgs/tools/misc/libbitcoin/fix-gcc11-compilation.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/include/bitcoin/bitcoin/wallet/dictionary.hpp b/include/bitcoin/bitcoin/wallet/dictionary.hpp
-index 632f1afc..63a51764 100644
---- a/include/bitcoin/bitcoin/wallet/dictionary.hpp
-+++ b/include/bitcoin/bitcoin/wallet/dictionary.hpp
-@@ -19,6 +19,7 @@
- #ifndef LIBBITCOIN_WALLET_DICTIONARY_HPP
- #define LIBBITCOIN_WALLET_DICTIONARY_HPP
- 
-+#include <cstddef>
- #include <array>
- #include <vector>
- #include <bitcoin/bitcoin/compat.hpp>
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
index a940fba29676..266ef9accca6 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-client.nix
@@ -1,18 +1,15 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook
 , boost, libbitcoin, libbitcoin-protocol }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libbitcoin-client";
-  version = "3.5.0";
-
-in stdenv.mkDerivation {
-  name = "${pname}-${version}";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "libbitcoin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0a9c00f1pfi8wczbfd1djkvr7di3iw1ynak6if910w01dkhbm6v4";
+    hash = "sha256-5qbxixaozHFsOcBxnuGEfNJyGL8UaYCOPwPakfc0bAg=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
index 7d00e4c09add..48c8e9a4f721 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-explorer.nix
@@ -1,18 +1,15 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook
 , boost, libbitcoin-client, libbitcoin-network }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libbitcoin-explorer";
-  version = "3.5.0";
-
-in stdenv.mkDerivation {
-  name = "${pname}-${version}";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "libbitcoin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "033nrdzrha4kypxk4biixjsbjd16r4m2mjvpid4gdj5hzbbj1p93";
+    hash = "sha256-NUAtjrfRbZg5ewQo4PZ1HEoG8GRrsPcNb78UYMHqdyo=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-network.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-network.nix
index 5d330ee3cacc..ee9cb1da687f 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin-network.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-network.nix
@@ -1,18 +1,15 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook
 , boost, libbitcoin, zeromq }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libbitcoin-network";
-  version = "3.5.0";
-
-in stdenv.mkDerivation {
-  name = "${pname}-${version}";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "libbitcoin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0vqg3i40kwmbys4lyp82xvg2nx3ik4qhc66gcm8k66a86wpj9ji6";
+    hash = "sha256-zDT92bvA779mzTodpKugCoxapB6vY2jCMSGZEkJLTXQ=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin-protocol.nix b/pkgs/tools/misc/libbitcoin/libbitcoin-protocol.nix
index 06f6546e964d..57e55400aa27 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin-protocol.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-protocol.nix
@@ -1,18 +1,15 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook
 , boost, libbitcoin, secp256k1, zeromq }:
 
-let
+stdenv.mkDerivation rec {
   pname = "libbitcoin-protocol";
-  version = "3.5.0";
-
-in stdenv.mkDerivation {
-  name = "${pname}-${version}";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "libbitcoin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1ln9r04hlnc7qmv17rakyhrnzw1a541pg5jc1sw3ccn90a5x6cfv";
+    hash = "sha256-xf0qQQnZ8h6ent1sgkVTo55+9drZM8Zbx0deYZnLBho=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/tools/misc/libbitcoin/libbitcoin.nix b/pkgs/tools/misc/libbitcoin/libbitcoin.nix
index 347d6eae7ce4..70a0f9bff6ef 100644
--- a/pkgs/tools/misc/libbitcoin/libbitcoin.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbitcoin";
-  version = "3.6.0";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1rppyp3zpb6ymwangjpblwf6qh4y3d1hczrjx8aavmrq7hznnrhq";
+    hash = "sha256-7fxj2hnuGRUS4QSQ1w0s3looe9pMvE2U50/yhNyBMf0=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
@@ -18,8 +18,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  patches = [ ./fix-gcc11-compilation.patch ];
-
   configureFlags = [
     "--with-tests=no"
     "--with-boost=${boost.dev}"
diff --git a/pkgs/tools/security/terrascan/default.nix b/pkgs/tools/security/terrascan/default.nix
index 9bff2f0679e4..c492ce43709e 100644
--- a/pkgs/tools/security/terrascan/default.nix
+++ b/pkgs/tools/security/terrascan/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "terrascan";
-  version = "1.18.5";
+  version = "1.18.7";
 
   src = fetchFromGitHub {
     owner = "accurics";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-RDKy588qUvs0SGysz4DnQMliKiTJn4GA53kDyMZhzQE=";
+    hash = "sha256-i621Qi0wlDYMpK/srFAiwALJ0cwMGh5jNlCqj8fM96w=";
   };
 
   vendorHash = "sha256-9zD81p/UjH43B0aeqlItP9vrGMaT/zhVYv60ot153Gc=";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f33684548702..2179be6dc0de 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6893,8 +6893,9 @@ with pkgs;
     citrix_workspace_23_02_0
     citrix_workspace_23_07_0
     citrix_workspace_23_09_0
+    citrix_workspace_23_11_0
   ;
-  citrix_workspace = citrix_workspace_23_09_0;
+  citrix_workspace = citrix_workspace_23_11_0;
 
   clima = callPackage ../tools/text/clima { };
 
@@ -19404,7 +19405,7 @@ with pkgs;
   img = callPackage ../development/tools/img { };
 
   include-what-you-use = callPackage ../development/tools/analysis/include-what-you-use {
-    llvmPackages = llvmPackages_15;
+    llvmPackages = llvmPackages_17;
   };
 
   indent = callPackage ../development/tools/misc/indent { };
@@ -21473,7 +21474,9 @@ with pkgs;
     stdenv = if stdenv.cc.isClang then overrideLibcxx llvmPackages_14.stdenv else stdenv;
   };
 
-  geos39 = callPackage ../development/libraries/geos/3.9.nix { };
+  geos_3_9 = callPackage ../development/libraries/geos/3.9.nix { };
+
+  geos_3_11 = callPackage ../development/libraries/geos/3.11.nix { };
 
   getdata = callPackage ../development/libraries/getdata { };
 
@@ -41413,7 +41416,9 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreFoundation SystemConfiguration Security;
   };
 
-  wavm = callPackage ../development/interpreters/wavm { };
+  wavm = callPackage ../development/interpreters/wavm {
+    llvmPackages = llvmPackages_12;
+  };
 
   yabasic = callPackage ../development/interpreters/yabasic { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0aff609305a2..6f6f06d9bd9e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -218,6 +218,8 @@ self: super: with self; {
 
   aiogram = callPackage ../development/python-modules/aiogram { };
 
+  aiohappyeyeballs = callPackage ../development/python-modules/aiohappyeyeballs { };
+
   aioharmony = callPackage ../development/python-modules/aioharmony { };
 
   aiohomekit = callPackage ../development/python-modules/aiohomekit { };
@@ -1514,6 +1516,8 @@ self: super: with self; {
 
   bleak = callPackage ../development/python-modules/bleak { };
 
+  bleak-esphome = callPackage ../development/python-modules/bleak-esphome { };
+
   bleak-retry-connector = callPackage ../development/python-modules/bleak-retry-connector { };
 
   blebox-uniapi = callPackage ../development/python-modules/blebox-uniapi { };
@@ -13018,6 +13022,8 @@ self: super: with self; {
 
   shapely = callPackage ../development/python-modules/shapely { };
 
+  shapely_1_8 = callPackage ../development/python-modules/shapely/1.8.nix { };
+
   shaperglot = callPackage ../development/python-modules/shaperglot { };
 
   sharedmem = callPackage ../development/python-modules/sharedmem { };