diff --git a/nixos/modules/system/boot/loader/grub/install-grub.pl b/nixos/modules/system/boot/loader/grub/install-grub.pl
index a84e374624d1..d1e7a0cb8178 100644
--- a/nixos/modules/system/boot/loader/grub/install-grub.pl
+++ b/nixos/modules/system/boot/loader/grub/install-grub.pl
@@ -516,38 +516,53 @@ sub addEntry {
     $conf .= "}\n\n";
 }
 
+sub addGeneration {
+    my ($name, $nameSuffix, $path, $options, $current) = @_;
+
+    # Do not search for grand children
+    my @links = sort (glob "$path/specialisation/*");
+
+    if ($current != 1 && scalar(@links) != 0) {
+        $conf .= "submenu \"> $name$nameSuffix\" --class submenu {\n";
+    }
+
+    addEntry("$name" . (scalar(@links) == 0 ? "" : " - Default") . $nameSuffix, $path, $options, $current);
+
+    # Find all the children of the current default configuration
+    # Do not search for grand children
+    foreach my $link (@links) {
+
+        my $entryName = "";
+
+        my $cfgName = readFile("$link/configuration-name");
+
+        my $date = strftime("%F", localtime(lstat($link)->mtime));
+        my $version =
+            -e "$link/nixos-version"
+            ? readFile("$link/nixos-version")
+            : basename((glob(dirname(Cwd::abs_path("$link/kernel")) . "/lib/modules/*"))[0]);
+
+        if ($cfgName) {
+            $entryName = $cfgName;
+        } else {
+            my $linkname = basename($link);
+            $entryName = "($linkname - $date - $version)";
+        }
+        addEntry("$name - $entryName", $link, "", 1);
+    }
+
+    if ($current != 1 && scalar(@links) != 0) {
+        $conf .= "}\n";
+    }
+}
 
 # Add default entries.
 $conf .= "$extraEntries\n" if $extraEntriesBeforeNixOS;
 
-addEntry("@distroName@ - Default", $defaultConfig, $entryOptions, 1);
+addGeneration("@distroName@", "", $defaultConfig, $entryOptions, 1);
 
 $conf .= "$extraEntries\n" unless $extraEntriesBeforeNixOS;
 
-# Find all the children of the current default configuration
-# Do not search for grand children
-my @links = sort (glob "$defaultConfig/specialisation/*");
-foreach my $link (@links) {
-
-    my $entryName = "";
-
-    my $cfgName = readFile("$link/configuration-name");
-
-    my $date = strftime("%F", localtime(lstat($link)->mtime));
-    my $version =
-        -e "$link/nixos-version"
-        ? readFile("$link/nixos-version")
-        : basename((glob(dirname(Cwd::abs_path("$link/kernel")) . "/lib/modules/*"))[0]);
-
-    if ($cfgName) {
-        $entryName = $cfgName;
-    } else {
-        my $linkname = basename($link);
-        $entryName = "($linkname - $date - $version)";
-    }
-    addEntry("@distroName@ - $entryName", $link, "", 1);
-}
-
 my $grubBootPath = $grubBoot->path;
 # extraEntries could refer to @bootRoot@, which we have to substitute
 $conf =~ s/\@bootRoot\@/$grubBootPath/g;
@@ -577,7 +592,7 @@ sub addProfile {
             -e "$link/nixos-version"
             ? readFile("$link/nixos-version")
             : basename((glob(dirname(Cwd::abs_path("$link/kernel")) . "/lib/modules/*"))[0]);
-        addEntry("@distroName@ - Configuration " . nrFromGen($link) . " ($date - $version)", $link, $subEntryOptions, 0);
+        addGeneration("@distroName@ - Configuration " . nrFromGen($link), " ($date - $version)", $link, $subEntryOptions, 0);
     }
 
     $conf .= "}\n";
diff --git a/pkgs/applications/audio/eartag/default.nix b/pkgs/applications/audio/eartag/default.nix
index 841553c85cd7..f6ae96a5ec4a 100644
--- a/pkgs/applications/audio/eartag/default.nix
+++ b/pkgs/applications/audio/eartag/default.nix
@@ -18,7 +18,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "eartag";
-  version = "0.4.2";
+  version = "0.4.3";
   format = "other";
 
   src = fetchFromGitLab {
@@ -26,7 +26,7 @@ python3Packages.buildPythonApplication rec {
     owner = "World";
     repo = pname;
     rev = version;
-    hash = "sha256-sLnZPn4pi+sRcDW0f5NHiZaxmnf9xGZnbKYWrCNQsY4=";
+    hash = "sha256-0nkaKLkUnJiNTs7/qe+c4Lkst/ItHD1RKAERCo2O2ms=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/misc/swaynag-battery/default.nix b/pkgs/applications/misc/swaynag-battery/default.nix
index 71d15aa06584..b58758d8a417 100644
--- a/pkgs/applications/misc/swaynag-battery/default.nix
+++ b/pkgs/applications/misc/swaynag-battery/default.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
     hash = "sha256-7f9+4Fzw5B5ATuud4MJC3iyuNRTx6kwJ7/KsusGtQM8=";
   };
 
-  vendorSha256 = "h9Zj3zmQ0Xpili5Pl6CXh1L0bb2uL1//B79I4/ron08=";
+  vendorHash = "sha256-h9Zj3zmQ0Xpili5Pl6CXh1L0bb2uL1//B79I4/ron08=";
 
   meta = with lib; {
     homepage = "https://github.com/m00qek/swaynag-battery";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 721c39578ccb..462240ce3cc6 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -146,11 +146,11 @@
     "vendorHash": null
   },
   "baiducloud": {
-    "hash": "sha256-NW3q+1132gBlyFDsqZyHoZzhljF+T9ZmVMfy8B4BsuQ=",
+    "hash": "sha256-yV5NgymZesYE/RhXccTE2Qdf7bHO35qAI+QdPYPUPDM=",
     "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
     "owner": "baidubce",
     "repo": "terraform-provider-baiducloud",
-    "rev": "v1.19.12",
+    "rev": "v1.19.13",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -363,13 +363,13 @@
     "vendorHash": "sha256-oVTanZpCWs05HwyIKW2ajiBPz1HXOFzBAt5Us+EtTRw="
   },
   "equinix": {
-    "hash": "sha256-lo3DxEXa0nSm+KXBmWwulyNNsctrFvZJLHVJ087BsoU=",
+    "hash": "sha256-MEsE1OQwKjd1Y+Ek7UmZMbLq4x84iQW40sMl78UbW2c=",
     "homepage": "https://registry.terraform.io/providers/equinix/equinix",
     "owner": "equinix",
     "repo": "terraform-provider-equinix",
-    "rev": "v1.14.6",
+    "rev": "v1.14.7",
     "spdx": "MIT",
-    "vendorHash": "sha256-7a90fzAU76QRXkSa+G/N3kMPP8jy68i72i2JSlUrvfc="
+    "vendorHash": "sha256-cfJG0DJJJX85ISz7dSZ+di1uhgJJd5xUH99PhqGMPgw="
   },
   "exoscale": {
     "hash": "sha256-93pCsHrsYLJYgg8MXHz2Gg+vaPC9gcHdLastb89/BMg=",
@@ -454,22 +454,22 @@
     "vendorHash": "sha256-AVTWTS16d8QsPLLAJeAfgcVDzUBMp+b2oAphaCBqhS0="
   },
   "google": {
-    "hash": "sha256-11iT/zjoSScSdLGWFPxEURiIBvcz5jK8QZAHdqRwHD0=",
+    "hash": "sha256-tfjrVWj+l9mNdgZ+unu4NW15OAOzViTVmSTzO/ZiqRE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google",
-    "rev": "v4.78.0",
+    "rev": "v4.79.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-lyOupw64LQvdTJZjJ1RvAn1JLDHAZ4qAaagASXHcEXA="
   },
   "google-beta": {
-    "hash": "sha256-dKB9rdMZP+Ln3M9bL7MC6RGlDXZ/IydD4g5Jp1jjEh4=",
+    "hash": "sha256-70Za/CGYv5HkkXMYtnIHzliW1551ZGF/L05RQtCtjHM=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "proxyVendor": true,
     "repo": "terraform-provider-google-beta",
-    "rev": "v4.78.0",
+    "rev": "v4.79.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-lyOupw64LQvdTJZjJ1RvAn1JLDHAZ4qAaagASXHcEXA="
   },
@@ -583,11 +583,11 @@
     "vendorHash": null
   },
   "ibm": {
-    "hash": "sha256-FxMBZQYYSOq1Y5jm+HPIsVA1RMv8jhPWIKHd9HV/f3g=",
+    "hash": "sha256-z3k4H4eP5NMufkHaEUIQBQUybpEcfkUO0k3pEMvMPFQ=",
     "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
     "owner": "IBM-Cloud",
     "repo": "terraform-provider-ibm",
-    "rev": "v1.56.0",
+    "rev": "v1.56.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-djpo+9BxWUptKRephw0by4xtPABEjsnCqwcbZoRNIug="
   },
@@ -619,13 +619,13 @@
     "vendorHash": "sha256-OMDMpL9ox6tI9tkoSU0oVuFzRObmUGgGQy6RtsNbyIg="
   },
   "kafka": {
-    "hash": "sha256-IG0xgMs0j2jRJBa52Wsx7/r4s9DRnw5b+AfYpZAewxI=",
+    "hash": "sha256-cWFPuKU7CQU8TYy125N88saBGPkrGa+7mKLi3TlnM2I=",
     "homepage": "https://registry.terraform.io/providers/Mongey/kafka",
     "owner": "Mongey",
     "repo": "terraform-provider-kafka",
-    "rev": "v0.5.3",
+    "rev": "v0.5.4",
     "spdx": "MIT",
-    "vendorHash": "sha256-Z5APR41/+MsrHAtpTZKnG0qTi1+JSBJbPTVxNpd6f84="
+    "vendorHash": "sha256-gWomOX/NaYdcqspquqpRjqGnzLRY3iIUJALACf78TV8="
   },
   "kafka-connect": {
     "hash": "sha256-PiSVfzNPEXAgONb/eaVAN4yPudn5glcHL0BLqE5PWsw=",
@@ -899,11 +899,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-pMim8Bjjtuysdd4LgsV4+JPjEMw+3bF8vOKIBJVSScY=",
+    "hash": "sha256-kVz63aXl03p6T22WPB9PuZm+QllGxJNt3fDZ1H64dqw=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v2.15.3",
+    "rev": "v2.16.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -980,13 +980,13 @@
     "vendorHash": null
   },
   "scaleway": {
-    "hash": "sha256-xllc6uQN0Pjak/8eFNWCn639Kpf2UQPoDUPnX9YhoOc=",
+    "hash": "sha256-YARTRjmrweBJAa5PAWZ/2yayBa9Q09vp1AgVJNxB53Q=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.26.0",
+    "rev": "v2.27.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-39MrDm4v7UIYDK/KNt9ES0SstkxEQ73CHvnxpZq1K5g="
+    "vendorHash": "sha256-TiR7t6RaaLT+1gqgdq/Dsegft3dqv7xwFAeeT6pNRbM="
   },
   "secret": {
     "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@@ -1043,13 +1043,13 @@
     "vendorHash": null
   },
   "snowflake": {
-    "hash": "sha256-gz41dRmJQm4cH7VhrEznir7IRA9+hGMjYzsOyQtNuG0=",
+    "hash": "sha256-v4rpdOsEYy0coZUq7frvF+IVLhI3Vz8Q6fk4koFg9a4=",
     "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
     "owner": "Snowflake-Labs",
     "repo": "terraform-provider-snowflake",
-    "rev": "v0.69.0",
+    "rev": "v0.70.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-ZNkZ2GMSBZHz+L626VqT7pTeb8fSYkaCi84O5ggd1FM="
+    "vendorHash": "sha256-7jB1p6+EVUp03Bw7AyL8jH/n1tslkPmK7FIqFbde1n4="
   },
   "sops": {
     "hash": "sha256-D1Yzs8hDimMP9y8ZRbizEhic3vGtLcZjOVSuSMUAqPk=",
@@ -1243,13 +1243,13 @@
     "vendorHash": null
   },
   "vsphere": {
-    "hash": "sha256-lWMtsBRAirNI7dNXI7APzS1AbPmkz5fsbpCdd/0XBRc=",
+    "hash": "sha256-Tvc3+HVsrD2CgfRVqfcF7DtszI+s7HrIgP2wiImqOXo=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vsphere",
     "owner": "hashicorp",
     "repo": "terraform-provider-vsphere",
-    "rev": "v2.4.1",
+    "rev": "v2.4.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wKKrBSJkbdqqnDLoS+jhvI26rOzvMWjjsN8wh67Le5U="
+    "vendorHash": "sha256-MrDY1zx4aXKRGmhTPMLnIVBAJh+szdL6rH0m0amlYS8="
   },
   "vultr": {
     "hash": "sha256-h9MQv4BTv9y4A6HSDE3dIV7aKwaIWRYy5EyE2T0mpG4=",
diff --git a/pkgs/desktops/deepin/apps/deepin-editor/default.nix b/pkgs/desktops/deepin/apps/deepin-editor/default.nix
index 58bfb22bce29..299319a0687a 100644
--- a/pkgs/desktops/deepin/apps/deepin-editor/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-editor/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "deepin-editor";
-  version = "6.0.10";
+  version = "6.0.11";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    hash = "sha256-NevylvfeoT69i1AFJTypSfJKEd38uSXwGm9doRrZ2TI=";
+    hash = "sha256-OdKEskxrzFo4VOsR2+rsH3G63uqMmsBuXufayHWSQac=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix b/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
index fd119592ba43..791c8ecbde52 100644
--- a/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix
@@ -1,4 +1,5 @@
 { mkXfceDerivation
+, gobject-introspection
 , dbus-glib
 , garcon
 , glib
@@ -11,11 +12,16 @@
 , libxfce4util
 , libxklavier
 , pam
+, python3
 , systemd
 , xfconf
 , lib
 }:
 
+let
+  # For xfce4-screensaver-configure
+  pythonEnv = python3.withPackages (pp: [ pp.pygobject3 ]);
+in
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-screensaver";
@@ -23,6 +29,10 @@ mkXfceDerivation {
 
   sha256 = "sha256-j5K5i+hl/miyHste73akZL62K6YTxXmN8mmFK9BCecs=";
 
+  nativeBuildInputs = [
+    gobject-introspection
+  ];
+
   buildInputs = [
     dbus-glib
     garcon
@@ -36,6 +46,7 @@ mkXfceDerivation {
     libxfce4util
     libxklavier
     pam
+    pythonEnv
     systemd
     xfconf
   ];
diff --git a/pkgs/development/compilers/cudatoolkit/auto-add-opengl-runpath-hook.sh b/pkgs/development/compilers/cudatoolkit/auto-add-opengl-runpath-hook.sh
index 395229ca79b7..f50a5f6c25c6 100644
--- a/pkgs/development/compilers/cudatoolkit/auto-add-opengl-runpath-hook.sh
+++ b/pkgs/development/compilers/cudatoolkit/auto-add-opengl-runpath-hook.sh
@@ -2,17 +2,21 @@
 # Run addOpenGLRunpath on all dynamically linked, ELF files
 echo "Sourcing auto-add-opengl-runpath-hook"
 
+elfHasDynamicSection() {
+    patchelf --print-rpath "$1" >& /dev/null
+}
+
 autoAddOpenGLRunpathPhase() (
   local outputPaths
   mapfile -t outputPaths < <(for o in $(getAllOutputNames); do echo "${!o}"; done)
   find "${outputPaths[@]}" -type f -executable -print0  | while IFS= read -rd "" f; do
     if isELF "$f"; then
       # patchelf returns an error on statically linked ELF files
-      if patchelf --print-interpreter "$f" >/dev/null 2>&1; then
+      if elfHasDynamicSection "$f" ; then
         echo "autoAddOpenGLRunpathHook: patching $f"
         addOpenGLRunpath "$f"
-      elif [ -n "${DEBUG-}" ]; then
-        echo "autoAddOpenGLRunpathHook: skipping ELF file $f"
+      elif (( "${NIX_DEBUG:-0}" >= 1 )) ; then
+        echo "autoAddOpenGLRunpathHook: skipping a statically-linked ELF file $f"
       fi
     fi
   done
diff --git a/pkgs/development/compilers/llvm/16/compiler-rt/default.nix b/pkgs/development/compilers/llvm/16/compiler-rt/default.nix
index e2b8d470f890..aa248c0e60eb 100644
--- a/pkgs/development/compilers/llvm/16/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/16/compiler-rt/default.nix
@@ -9,6 +9,7 @@ let
   useLLVM = stdenv.hostPlatform.useLLVM or false;
   bareMetal = stdenv.hostPlatform.parsed.kernel.name == "none";
   haveLibc = stdenv.cc.libc != null;
+  isDarwinStatic = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic;
   inherit (stdenv.hostPlatform) isMusl isGnu;
 
   baseName = "compiler-rt";
@@ -41,7 +42,7 @@ stdenv.mkDerivation {
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
   ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.libc == "glibc") [
     "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
-  ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
+  ] ++ lib.optionals (useLLVM || bareMetal || isMusl || isDarwinStatic) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
@@ -49,9 +50,10 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_BUILD_ORC=OFF" # may be possible to build with musl if necessary
   ] ++ lib.optionals (useLLVM || bareMetal) [
      "-DCOMPILER_RT_BUILD_PROFILE=OFF"
+  ] ++ lib.optionals ((useLLVM && !haveLibc) || bareMetal || isDarwinStatic ) [
+    "-DCMAKE_CXX_COMPILER_WORKS=ON"
   ] ++ lib.optionals ((useLLVM && !haveLibc) || bareMetal) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
-    "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
     "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
   ] ++ lib.optionals (useLLVM && !haveLibc) [
@@ -63,6 +65,7 @@ stdenv.mkDerivation {
   ] ++ lib.optionals (bareMetal) [
     "-DCOMPILER_RT_OS_DIR=baremetal"
   ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+    "-DCMAKE_LIPO=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}lipo"
     "-DDARWIN_macosx_OVERRIDE_SDK_VERSION=ON"
     "-DDARWIN_osx_ARCHS=${stdenv.hostPlatform.darwinArch}"
     "-DDARWIN_osx_BUILTIN_ARCHS=${stdenv.hostPlatform.darwinArch}"
diff --git a/pkgs/development/compilers/llvm/16/default.nix b/pkgs/development/compilers/llvm/16/default.nix
index 1e200b17b0b2..0c0ff44e155f 100644
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@@ -316,7 +316,7 @@ in let
 
     compiler-rt-libc = callPackage ./compiler-rt {
       inherit llvm_meta;
-      stdenv = if stdenv.hostPlatform.useLLVM or false
+      stdenv = if stdenv.hostPlatform.useLLVM or false || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic)
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
                else stdenv;
     };
@@ -329,7 +329,7 @@ in let
     };
 
     # N.B. condition is safe because without useLLVM both are the same.
-    compiler-rt = if stdenv.hostPlatform.isAndroid
+    compiler-rt = if stdenv.hostPlatform.isAndroid || stdenv.hostPlatform.isDarwin
       then libraries.compiler-rt-libc
       else libraries.compiler-rt-no-libc;
 
diff --git a/pkgs/development/compilers/zig/generic.nix b/pkgs/development/compilers/zig/generic.nix
index a0dbea04869e..7a2ac1c7375b 100644
--- a/pkgs/development/compilers/zig/generic.nix
+++ b/pkgs/development/compilers/zig/generic.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://ziglang.org/";
     changelog = "https://ziglang.org/download/${finalAttrs.version}/release-notes.html";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ andrewrk ] ++ lib.teams.zig.members;
+    maintainers = [ lib.maintainers.andrewrk ] ++ lib.teams.zig.members;
     platforms = lib.platforms.unix;
   };
 } // removeAttrs args [ "hash" ])
diff --git a/pkgs/development/compilers/zig/hook.nix b/pkgs/development/compilers/zig/hook.nix
index 254a64597dd3..3d3e6f9ffee5 100644
--- a/pkgs/development/compilers/zig/hook.nix
+++ b/pkgs/development/compilers/zig/hook.nix
@@ -10,10 +10,13 @@ makeSetupHook {
 
   substitutions = {
     zig_default_flags =
-      if lib.versionAtLeast zig.version "0.11" then
-        "-Doptimize=ReleaseSafe -Dcpu=baseline"
-      else
-        "-Drelease-safe=true -Dcpu=baseline";
+      let
+        cpu = "-Dcpu=baseline";
+        releaseType = if lib.versionAtLeast zig.version "0.11"
+                      then "-Doptimize=ReleaseSafe"
+                      else "-Drelease-safe=true";
+      in
+        lib.concatStringsSep " " [ cpu releaseType ];
   };
 
   passthru = { inherit zig; };
diff --git a/pkgs/development/compilers/zig/shell-completions.nix b/pkgs/development/compilers/zig/shell-completions.nix
index 74beb5f63d65..db76250bf802 100644
--- a/pkgs/development/compilers/zig/shell-completions.nix
+++ b/pkgs/development/compilers/zig/shell-completions.nix
@@ -2,9 +2,10 @@
 , stdenv
 , fetchFromGitHub
 , installShellFiles
+, unstableGitUpdater
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zig-shell-completions";
   version = "unstable-2023-08-17";
 
@@ -29,11 +30,13 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
     homepage = "https://github.com/ziglang/shell-completions";
     description = "Shell completions for the Zig compiler";
-    license = licenses.mit;
-    maintainers = with maintainers; [ aaronjheng ];
-    platforms = platforms.all;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ aaronjheng ];
+    platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/development/interpreters/php/8.3.nix b/pkgs/development/interpreters/php/8.3.nix
index a12feb9c4e14..0e7d7111f245 100644
--- a/pkgs/development/interpreters/php/8.3.nix
+++ b/pkgs/development/interpreters/php/8.3.nix
@@ -2,12 +2,12 @@
 
 let
   base = (callPackage ./generic.nix (_args // {
-    version = "8.3.0beta2";
+    version = "8.3.0beta3";
     hash = null;
   })).overrideAttrs (oldAttrs: {
     src = fetchurl {
-      url = "https://downloads.php.net/~jakub/php-8.3.0beta2.tar.xz";
-      hash = "sha256-ND1OlmSMtBxTE/0qfgy3Cz/gF08eIzydU2W/eKg58wQ=";
+      url = "https://downloads.php.net/~eric/php-8.3.0beta3.tar.xz";
+      hash = "sha256-XW3t9BOsBFvThYXF66faVl8VyMLFB+Oi7h45vWUmE6Y=";
     };
   });
 in
diff --git a/pkgs/development/python-modules/astropy/default.nix b/pkgs/development/python-modules/astropy/default.nix
index a222dbe92eca..2176a6ff1fc3 100644
--- a/pkgs/development/python-modules/astropy/default.nix
+++ b/pkgs/development/python-modules/astropy/default.nix
@@ -5,10 +5,11 @@
 
 # build time
 , astropy-extension-helpers
-, astropy-helpers
 , cython
 , jinja2
+, oldest-supported-numpy
 , setuptools-scm
+, wheel
 
 # runtime
 , numpy
@@ -32,14 +33,18 @@ buildPythonPackage {
     hash = "sha256-9q4noHf46oSQPvp2x5C5hWFzQaAISw0hw5H3o/MyrCM=";
   };
 
-  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'cython==' 'cython>='
+  '';
 
   nativeBuildInputs = [
     astropy-extension-helpers
-    astropy-helpers
     cython
     jinja2
+    oldest-supported-numpy
     setuptools-scm
+    wheel
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/dvc-objects/default.nix b/pkgs/development/python-modules/dvc-objects/default.nix
index 6854f827491d..fb7fed4858d4 100644
--- a/pkgs/development/python-modules/dvc-objects/default.nix
+++ b/pkgs/development/python-modules/dvc-objects/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-objects";
-  version = "1.0.0";
+  version = "1.0.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-9R1fhRwGYkwykiTnddjIJHmJxMcpwS+a9hgqBzFyJeM=";
+    hash = "sha256-mpYSlddzYIUZctF3kGWQWT+kxshIdAckVvaXWuyJnlw=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/pycocotools/default.nix b/pkgs/development/python-modules/pycocotools/default.nix
index b2279b8e4ccc..6cba9e71a756 100644
--- a/pkgs/development/python-modules/pycocotools/default.nix
+++ b/pkgs/development/python-modules/pycocotools/default.nix
@@ -7,12 +7,12 @@
 
 buildPythonPackage rec {
   pname = "pycocotools";
-  version = "2.0.6";
+  version = "2.0.7";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-f+CJsFzBjoBtzzvXZHCNhtq5IqEA83NOt3+3enCh0Yw=";
+    hash = "sha256-2ot4FRlu6/Ctq/Z/zEWRJsvGSYu8arH9FEw3FGXYaHk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pydeps/default.nix b/pkgs/development/python-modules/pydeps/default.nix
index faa85f6f4a85..f84123163ccf 100644
--- a/pkgs/development/python-modules/pydeps/default.nix
+++ b/pkgs/development/python-modules/pydeps/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pydeps";
-  version = "1.12.13";
+  version = "1.12.17";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "thebjorn";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-n4FmMqpCqxPmGJokfaxnruG9d5oodv6Yfg80Y1EIr34=";
+    hash = "sha256-DVSZeNuDz/y0jh/HimV+jFgNFevMhUKOu6EhZytMMqQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/pysaml2/default.nix b/pkgs/development/python-modules/pysaml2/default.nix
index 3cd65c271e9a..b8ace412614c 100644
--- a/pkgs/development/python-modules/pysaml2/default.nix
+++ b/pkgs/development/python-modules/pysaml2/default.nix
@@ -3,7 +3,6 @@
 , cryptography
 , defusedxml
 , fetchFromGitHub
-, fetchPypi
 , importlib-resources
 , poetry-core
 , pyasn1
@@ -21,18 +20,9 @@
 , xmlsec
 }:
 
-let
-  pymongo3 = pymongo.overridePythonAttrs(old: rec {
-    version = "3.12.3";
-    src = fetchPypi {
-      pname = "pymongo";
-      inherit version;
-      hash = "sha256-ConK3ABipeU2ZN3gQ/bAlxcrjBxfAJRJAJUoL/mZWl8=";
-    };
-  });
-in buildPythonPackage rec {
+buildPythonPackage rec {
   pname = "pysaml2";
-  version = "7.4.1";
+  version = "7.4.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -40,10 +30,22 @@ in buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "IdentityPython";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-QHAbm6u5oH3O7MEVFE+sW98raquv89KJ8gonk3Yyu/0=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-f8qd1Mfy32CYH9/PshfMMBviDg7OhOPlwz69bPjlYbg=";
   };
 
+  patches = [
+    (substituteAll {
+      src = ./hardcode-xmlsec1-path.patch;
+      inherit xmlsec;
+    })
+  ];
+
+  postPatch = ''
+    # Fix failing tests on systems with 32bit time_t
+    sed -i 's/2999\(-.*T\)/2029\1/g' tests/*.xml
+  '';
+
   nativeBuildInputs = [
     poetry-core
   ];
@@ -63,23 +65,11 @@ in buildPythonPackage rec {
 
   nativeCheckInputs = [
     pyasn1
-    pymongo3
+    pymongo
     pytestCheckHook
     responses
   ];
 
-  patches = [
-    (substituteAll {
-      src = ./hardcode-xmlsec1-path.patch;
-      inherit xmlsec;
-    })
-  ];
-
-  postPatch = ''
-    # fix failing tests on systems with 32bit time_t
-    sed -i 's/2999\(-.*T\)/2029\1/g' tests/*.xml
-  '';
-
   disabledTests = [
     # Disabled tests try to access the network
     "test_load_extern_incommon"
@@ -95,6 +85,7 @@ in buildPythonPackage rec {
   meta = with lib; {
     description = "Python implementation of SAML Version 2 Standard";
     homepage = "https://github.com/IdentityPython/pysaml2";
+    changelog = "https://github.com/IdentityPython/pysaml2/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ ];
   };
diff --git a/pkgs/development/python-modules/scikit-image/add-testing-data.patch b/pkgs/development/python-modules/scikit-image/add-testing-data.patch
deleted file mode 100644
index 60f9287f8b1c..000000000000
--- a/pkgs/development/python-modules/scikit-image/add-testing-data.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git a/skimage/data/setup.py b/skimage/data/setup.py
-index 528e9c284ce..ba0e155559c 100644
---- a/skimage/data/setup.py
-+++ b/skimage/data/setup.py
-@@ -11,7 +11,11 @@ def configuration(parent_package='', top_path=None):
-     # further notice.
-     # Testing data and additional datasets should only
-     # be made available via pooch
--    config.add_data_files(*legacy_datasets)
-+    # Nix patch: add ALL images to facilitate testing of a fully-built package
-+    from pathlib import Path
-+    config.add_data_files(
-+        *(path.name for path in Path(__file__).parent.glob("*") if path.suffix != ".py")
-+    )
-     # It seems hard to create a consistent hash for README.txt since
-     # the line endings keep getting converted
-     config.add_data_files('README.txt')
diff --git a/pkgs/development/python-modules/scikit-image/default.nix b/pkgs/development/python-modules/scikit-image/default.nix
index 22c7387ff0d1..03eaf556050f 100644
--- a/pkgs/development/python-modules/scikit-image/default.nix
+++ b/pkgs/development/python-modules/scikit-image/default.nix
@@ -3,53 +3,98 @@
 , fetchFromGitHub
 , buildPythonPackage
 , python
-, cython
-, pythran
-, numpy
-, scipy
-, matplotlib
-, networkx
-, six
-, pillow
-, pywavelets
-, dask
+, pythonOlder
+, astropy
 , cloudpickle
+, cython
+, dask
 , imageio
-, tifffile
+, lazy-loader
+, matplotlib
+, meson-python
+, networkx
+, numpy
+, packaging
+, pillow
+, pooch
+, pyamg
 , pytestCheckHook
+, pythran
+, pywavelets
+, scikit-learn
+, scipy
+, setuptools
+, simpleitk
+, six
+, tifffile
+, wheel
 }:
 
 let
   installedPackageRoot = "${builtins.placeholder "out"}/${python.sitePackages}";
   self = buildPythonPackage rec {
     pname = "scikit-image";
-    version = "0.19.3";
+    version = "0.21.0";
+    format = "pyproject";
+
+    disabled = pythonOlder "3.8";
 
     src = fetchFromGitHub {
-      owner = pname;
-      repo = pname;
+      owner = "scikit-image";
+      repo = "scikit-image";
       rev = "v${version}";
-      hash = "sha256-zvXgZdvYycFbbMsBFSqMDzLanEtF9+JuVSQ3AM8/LQk=";
+      hash = "sha256-WJ2WNlcFCEtPr+bV/af6MoBBhbXDpOBEsJu4FmudoIo=";
     };
 
-    patches = [ ./add-testing-data.patch ];
+    patches = [
+      # https://github.com/scikit-image/scikit-image/pull/7052
+      # prepare a patch file because the commit contains additional changes
+      ./suppress-deprecation-warning.patch
+    ];
 
-    nativeBuildInputs = [ cython pythran ];
+    postPatch = ''
+      patchShebangs skimage/_build_utils/{version,cythoner}.py
+    '';
+
+    nativeBuildInputs = [
+      cython
+      meson-python
+      numpy
+      packaging
+      pythran
+      setuptools
+      wheel
+    ];
 
     propagatedBuildInputs = [
-      cloudpickle
-      dask
       imageio
+      lazy-loader
       matplotlib
       networkx
       numpy
+      packaging
       pillow
       pywavelets
       scipy
-      six
       tifffile
     ];
 
+    passthru.optional-dependencies = {
+      data = [
+        pooch
+      ];
+      optional = [
+        astropy
+        cloudpickle
+        dask
+        matplotlib
+        pooch
+        pyamg
+        scikit-learn
+        simpleitk
+      ] ++ dask.optional-dependencies.array;
+    };
+
     # test suite is very cpu intensive, move to passthru.tests
     doCheck = false;
     nativeCheckInputs = [ pytestCheckHook ];
@@ -78,6 +123,10 @@ let
       "skimage/feature/tests/test_util.py::test_plot_matches"
       "skimage/filters/tests/test_thresholding.py::TestSimpleImage::test_try_all_threshold"
       "skimage/io/tests/test_mpl_imshow.py::"
+    ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+      # https://github.com/scikit-image/scikit-image/issues/7104
+      "skimage/measure/tests/test_fit.py"
+      "skimage/measure/tests/test_moments.py"
     ]);
 
     # Check cythonized modules
@@ -88,7 +137,6 @@ let
       "skimage.feature"
       "skimage.restoration"
       "skimage.filters"
-      "skimage.future.graph"
       "skimage.graph"
       "skimage.io"
       "skimage.measure"
@@ -105,6 +153,7 @@ let
     meta = {
       description = "Image processing routines for SciPy";
       homepage = "https://scikit-image.org";
+      changelog = "https://github.com/scikit-image/scikit-image/releases/tag/${src.rev}";
       license = lib.licenses.bsd3;
       maintainers = with lib.maintainers; [ yl3dy ];
     };
diff --git a/pkgs/development/python-modules/scikit-image/suppress-deprecation-warning.patch b/pkgs/development/python-modules/scikit-image/suppress-deprecation-warning.patch
new file mode 100644
index 000000000000..f51f1d9860a4
--- /dev/null
+++ b/pkgs/development/python-modules/scikit-image/suppress-deprecation-warning.patch
@@ -0,0 +1,30 @@
+diff --git a/skimage/exposure/tests/test_exposure.py b/skimage/exposure/tests/test_exposure.py
+index ed8dd6bc8..8ec7d13bf 100644
+--- a/skimage/exposure/tests/test_exposure.py
++++ b/skimage/exposure/tests/test_exposure.py
+@@ -368,19 +368,16 @@ def test_rescale_nan_warning(in_range, out_range):
+     )
+ 
+     # 2019/11/10 Passing NaN to np.clip raises a DeprecationWarning for
+-    # versions above 1.17
+-    # TODO: Remove once NumPy removes this DeprecationWarning
++    # versions above 1.17, "|\A\Z" marks as optional warning
++    # TODO: Remove once NumPy 1.25.0 is minimal dependency
+     numpy_warning_1_17_plus = (
+-        "Passing `np.nan` to mean no clipping in np.clip"
++        "|\\A\\ZPassing `np.nan` to mean no clipping in np.clip"
+     )
+ 
+-    if in_range == "image":
+-        exp_warn = [msg, numpy_warning_1_17_plus]
+-    else:
+-        exp_warn = [msg]
++    with expected_warnings([msg, numpy_warning_1_17_plus]):
++        result = exposure.rescale_intensity(image, in_range, out_range)
+ 
+-    with expected_warnings(exp_warn):
+-        exposure.rescale_intensity(image, in_range, out_range)
++    assert np.all(np.isnan(result))
+ 
+ 
+ @pytest.mark.parametrize(
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index 6e56df8b183d..1d9fd2a469f6 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -225,7 +225,7 @@ in buildPythonPackage rec {
 
   # Avoid using pybind11 from git submodule
   # Also avoids pytorch exporting the headers of pybind11
-  USE_SYSTEM_BIND11 = true;
+  USE_SYSTEM_PYBIND11 = true;
 
   preBuild = ''
     export MAX_JOBS=$NIX_BUILD_CORES
diff --git a/pkgs/development/python-modules/tubeup/default.nix b/pkgs/development/python-modules/tubeup/default.nix
index 58ae2d387b44..a264c4b2f93a 100644
--- a/pkgs/development/python-modules/tubeup/default.nix
+++ b/pkgs/development/python-modules/tubeup/default.nix
@@ -5,20 +5,19 @@
 , yt-dlp
 , docopt
 , pythonOlder
-, urllib3
 , pythonRelaxDepsHook
 }:
 
 buildPythonPackage rec {
   pname = "tubeup";
-  version = "2023.8.17";
+  version = "2023.8.19";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-nL0oXI06qH0K0LLlrT/jdJ+76ZPMUhaFfOYGi71M3PM=";
+    sha256 = "sha256-0atpOUJIfXgw/5fi5w2ciAFDMgWmVH4U8d84zwLCRXk=";
   };
 
   nativeBuildInputs = [
@@ -28,12 +27,10 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     internetarchive
     docopt
-    urllib3
     yt-dlp
   ];
 
   pythonRelaxDeps = [
-    "urllib3"
     "docopt"
   ];
 
diff --git a/pkgs/development/web/bootstrap-studio/default.nix b/pkgs/development/web/bootstrap-studio/default.nix
index 67b2af313a6a..e82d69a94a20 100644
--- a/pkgs/development/web/bootstrap-studio/default.nix
+++ b/pkgs/development/web/bootstrap-studio/default.nix
@@ -2,10 +2,10 @@
 
 let
   pname = "bootstrap-studio";
-  version = "6.2.1";
+  version = "6.4.5";
   src = fetchurl {
-    url = "https://bootstrapstudio.io/releases/desktop/${version}/Bootstrap%20Studio.AppImage";
-    sha256 = "sha256-1+3YCM1K2k1Gga7Y2ciMqmwzxYJQ7Ab5uDHP1iHXK7g=";
+    url = "https://releases.bootstrapstudio.io/${version}/Bootstrap%20Studio.AppImage";
+    sha256 = "sha256-kCMqDNRC3H3WBpDJCBXBxvWRuiGCrZ7gRGghXiGtGq8=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/games/quake3/ioquake/Makefile.local b/pkgs/games/quake3/ioquake/Makefile.local
new file mode 100644
index 000000000000..9f487970eabc
--- /dev/null
+++ b/pkgs/games/quake3/ioquake/Makefile.local
@@ -0,0 +1,6 @@
+USE_CURL = 1
+USE_CURL_DLOPEN = 0
+USE_FREETYPE = 1
+USE_INTERNAL_LIBS = 0
+USE_OPENAL = 1
+USE_OPENAL_DLOPEN = 0
diff --git a/pkgs/games/quake3/ioquake/default.nix b/pkgs/games/quake3/ioquake/default.nix
index 7161b9474f24..437b99ae3439 100644
--- a/pkgs/games/quake3/ioquake/default.nix
+++ b/pkgs/games/quake3/ioquake/default.nix
@@ -16,6 +16,7 @@
 , libjpeg
 , makeDesktopItem
 , freetype
+, mumble
 }:
 
 stdenv.mkDerivation {
@@ -47,11 +48,14 @@ stdenv.mkDerivation {
     libvorbis
     libjpeg
     freetype
+    mumble
   ];
 
   enableParallelBuilding = true;
 
-  makeFlags = [ "USE_INTERNAL_LIBS=0" "USE_FREETYPE=1" "USE_OPENAL_DLOPEN=0" "USE_CURL_DLOPEN=0" ];
+  preConfigure = ''
+    cp ${./Makefile.local} ./Makefile.local
+  '';
 
   installTargets = [ "copyfiles" ];
 
diff --git a/pkgs/games/urbanterror/Makefile.local b/pkgs/games/urbanterror/Makefile.local
new file mode 100644
index 000000000000..aee08a8ade79
--- /dev/null
+++ b/pkgs/games/urbanterror/Makefile.local
@@ -0,0 +1,5 @@
+USE_CURL = 1
+USE_CURL_DLOPEN = 0
+USE_FREETYPE = 1
+USE_OPENAL = 1
+USE_OPENAL_DLOPEN = 0
diff --git a/pkgs/games/urbanterror/default.nix b/pkgs/games/urbanterror/default.nix
index 6c54984eccbf..a1bf80784d03 100644
--- a/pkgs/games/urbanterror/default.nix
+++ b/pkgs/games/urbanterror/default.nix
@@ -56,15 +56,8 @@ stdenv.mkDerivation {
     SDL
   ];
 
-  configurePhase = ''
-    runHook preConfigure
-
-    echo "USE_OPENAL = 1" > Makefile.local
-    echo "USE_OPENAL_DLOPEN = 0" >> Makefile.local
-    echo "USE_CURL = 1" >> Makefile.local
-    echo "USE_CURL_DLOPEN = 0" >> Makefile.local
-
-    runHook postConfigure
+  preConfigure = ''
+    cp ${./Makefile.local} ./Makefile.local
   '';
 
   installTargets = [ "copyfiles" ];
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 5393188ccd6f..fa08cb20b234 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.21.635";
+  version = "0.21.674";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha512-KhQUuRJUqnCOLbwhTJiWOHj/yGsdne9TY9qyuE6c7y0gvAdKPE9Xkolt0RV/pjQtr6Hnbw5MaXahHHDOrhkN5Q==";
+    hash = "sha512-sLgTnj1Z/zeAML8B1I40xGuEkyrxYeXVR/Two7vMGP3xmyv/KfssikVu8yFDtA4bdQq9RsLU8GxC74VQKe3txQ==";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/shells/zsh/zsh-fzf-tab/default.nix b/pkgs/shells/zsh/zsh-fzf-tab/default.nix
index a173f8cbc506..d84dc2233562 100644
--- a/pkgs/shells/zsh/zsh-fzf-tab/default.nix
+++ b/pkgs/shells/zsh/zsh-fzf-tab/default.nix
@@ -4,13 +4,13 @@ let
   INSTALL_PATH="${placeholder "out"}/share/fzf-tab";
 in stdenv.mkDerivation rec {
   pname = "zsh-fzf-tab";
-  version = "unstable-2023-05-19";
+  version = "unstable-2023-06-11";
 
   src = fetchFromGitHub {
     owner = "Aloxaf";
     repo = "fzf-tab";
-    rev = "5a81e13792a1eed4a03d2083771ee6e5b616b9ab";
-    sha256 = "sha256-bIlnYKjjOC6h5/Gg7xBg+i2TBk+h82wmHgAJPhzMsek=";
+    rev = "c2b4aa5ad2532cca91f23908ac7f00efb7ff09c9";
+    sha256 = "sha256-gvZp8P3quOtcy1Xtt1LAW1cfZ/zCtnAmnWqcwrKel6w=";
   };
 
   strictDeps = true;
diff --git a/pkgs/tools/X11/numlockx/default.nix b/pkgs/tools/X11/numlockx/default.nix
index 5cd23a81f308..32eb652d8b72 100644
--- a/pkgs/tools/X11/numlockx/default.nix
+++ b/pkgs/tools/X11/numlockx/default.nix
@@ -1,21 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, libX11, libXext, autoconf }:
+{ lib, stdenv, fetchFromGitHub, autoconf, libX11, libXext }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   version = "1.2";
   pname = "numlockx";
 
   src = fetchFromGitHub {
     owner = "rg3";
-    repo = pname;
+    repo = "numlockx";
     rev = "9159fd3c5717c595dadfcb33b380a85c88406185";
-    sha256 = "1w49fayhwzn5rx0z1q2lrvm7z8jrd34lgb89p853a024bixc3cf2";
+    hash = "sha256-wrHBelxEADUKugmtR8loWaJ/6s5U4PBBz8V+Dr1yifA=";
   };
 
   buildInputs = [ libX11 libXext autoconf ];
 
-  meta = with lib; {
+  meta = {
     description = "Allows to start X with NumLock turned on";
-    license = licenses.mit;
-    platforms = platforms.all;
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    mainProgram = "numlockx";
   };
 }
diff --git a/pkgs/tools/misc/colorpicker/default.nix b/pkgs/tools/misc/colorpicker/default.nix
index 475041b4f682..8b45da17626c 100644
--- a/pkgs/tools/misc/colorpicker/default.nix
+++ b/pkgs/tools/misc/colorpicker/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "colorpicker";
-  version = "unstable-2018-01-14";
+  version = "unstable-2017-09-01";
 
   src = fetchFromGitHub {
-    owner = "Ancurio";
+    owner = "Jack12816";
     repo = "colorpicker";
-    rev = "287676947e6e3b5b0cee784aeb1638cf22f0ce17";
-    sha256 = "1kj1dpb79llrfpszraaz6r7ci114zqi5rmqxwsvq2dnnpjxyi29r";
+    rev = "a4455b92fde1dfbac81e7852f171093932154a30";
+    sha256 = "z2asxTIP8WcsWcePmIg0k4bOF2JwkqOxNqSpQv4/a40=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Click on a pixel on your screen and print its color value in RGB";
-    homepage = "https://github.com/Ancurio/colorpicker";
+    homepage = "https://github.com/Jack12816/colorpicker";
     maintainers = with maintainers; [ jb55 ];
     license = licenses.mit;
     mainProgram = "colorpicker";
diff --git a/pkgs/tools/networking/minio-client/default.nix b/pkgs/tools/networking/minio-client/default.nix
index b60fa715004a..b7c084bf776d 100644
--- a/pkgs/tools/networking/minio-client/default.nix
+++ b/pkgs/tools/networking/minio-client/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2023-08-08T17-23-59Z";
+  version = "2023-08-15T23-03-09Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-rXYpAidwwd1sa+22r39VAirVCDdhzFRE5qSQNZf65sg=";
+    sha256 = "sha256-vsCbmT6uWy+VA0qx8x9hx3pDSVKiDeXjnnrFRnhm4C8=";
   };
 
-  vendorHash = "sha256-2zBwqwYyE/9R8Ns5kkvu/JxxYyjnEULBnW+ObYnZ40w=";
+  vendorHash = "sha256-xtGXYCmiT7xY9OL8x0tTBP9y8UfzlJ6ZR2DhKOwVgkM=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/tools/security/doppler/default.nix b/pkgs/tools/security/doppler/default.nix
index ddc4b55432b3..28956edeaa37 100644
--- a/pkgs/tools/security/doppler/default.nix
+++ b/pkgs/tools/security/doppler/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "doppler";
-  version = "3.65.1";
+  version = "3.65.2";
 
   src = fetchFromGitHub {
     owner = "dopplerhq";
     repo = "cli";
     rev = version;
-    sha256 = "sha256-scFjaxUMlKGpO7UQrIS/f1Rsxu4weZ26jRCRmoUBGCs=";
+    sha256 = "sha256-rs+V19YaBvo5U9AAUks/nWl8TYveH8t+/rcQqjtG1gE=";
   };
 
   vendorHash = "sha256-FOmaK6S61fkzybpDx6qfi6m4e2IaqBpavaFhEgIvmqw=";