diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 4654518a0e80..96bdccccf517 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -45,6 +45,7 @@
 /pkgs/build-support/setup-hooks                  @Ericson2314
 /pkgs/build-support/setup-hooks/auto-patchelf.sh @layus
 /pkgs/build-support/setup-hooks/auto-patchelf.py @layus
+/pkgs/pkgs-lib                                   @infinisil
 
 # Nixpkgs build-support
 /pkgs/build-support/writers @lassulus @Profpatsch
diff --git a/pkgs/applications/audio/mympd/default.nix b/pkgs/applications/audio/mympd/default.nix
index d987c770c983..fed0e1c663a8 100644
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mympd";
-  version = "10.2.5";
+  version = "10.2.6";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${version}";
-    sha256 = "sha256-ZxGMvbm9GKhhfCNZdeIYUh2FF4c3vXtvRdu24u3Zrtg=";
+    sha256 = "sha256-a/HjuBeq7ySDUcEcR6KKnwlvzUInjWmio/zI59sNsak=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/streamripper/default.nix b/pkgs/applications/audio/streamripper/default.nix
index a44a77237d1f..70ff4dd8605a 100644
--- a/pkgs/applications/audio/streamripper/default.nix
+++ b/pkgs/applications/audio/streamripper/default.nix
@@ -12,6 +12,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ glib libogg libvorbis libmad ];
 
+  makeFlags = [
+    "AR:=$(AR)"
+  ];
+
   meta = with lib; {
     homepage = "https://streamripper.sourceforge.net/";
     description = "Application that lets you record streaming mp3 to your hard drive";
diff --git a/pkgs/applications/blockchains/electrs/default.nix b/pkgs/applications/blockchains/electrs/default.nix
index 1ce458ffb11b..7854c76a16ab 100644
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "electrs";
-  version = "0.9.11";
+  version = "0.9.13";
 
   src = fetchFromGitHub {
     owner = "romanz";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-iudHdsSjoPal+ORMB3lU7ejGYv69q/8HcxScZS8D/u8=";
+    hash = "sha256-GV/cwFdYpXJXRTgdVfuzJpmwNhe0kVJnYAJe+DPmRV8=";
   };
 
-  cargoHash = "sha256-Ft1AluPfV6BIRGEddrrIGNRmaZIzUsA2DN2TcghCnSQ=";
+  cargoHash = "sha256-eQAizO26oQRosbMGJLwMmepBN3pocmnbc0qsHsAJysg=";
 
   # needed for librocksdb-sys
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
diff --git a/pkgs/applications/editors/neovim/utils.nix b/pkgs/applications/editors/neovim/utils.nix
index 0f03866cc75f..5eea1528d659 100644
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@@ -77,18 +77,6 @@ let
 
       luaEnv = neovim-unwrapped.lua.withPackages(extraLuaPackages);
 
-      # Mapping a boolean argument to a key that tells us whether to add or not to
-      # add to nvim's 'embedded rc' this:
-      #    let g:<key>_host_prog=$out/bin/nvim-<key>
-      # Or this:
-      #    let g:loaded_${prog}_provider=0
-      # While the latter tells nvim that this provider is not available
-      hostprog_check_table = {
-        node = withNodeJs;
-        python = false;
-        python3 = withPython3;
-        ruby = withRuby;
-      };
       # as expected by packdir
       packpathDirs.myNeovimPackages = myVimPackage;
       ## Here we calculate all of the arguments to the 1st call of `makeWrapper`
@@ -98,22 +86,9 @@ let
       makeWrapperArgs =
         let
           binPath = lib.makeBinPath (lib.optionals withRuby [ rubyEnv ] ++ lib.optionals withNodeJs [ nodejs ]);
-
-          hostProviderViml = lib.mapAttrsToList genProviderSettings hostprog_check_table;
-
-          # as expected by packdir
-          packDirArgs.myNeovimPackages = myVimPackage;
-
-          # vim accepts a limited number of commands so we join them all
-          flags = [
-            "--cmd" (lib.intersperse "|" hostProviderViml)
-          ] ++ lib.optionals (myVimPackage.start != [] || myVimPackage.opt != []) [
-            "--cmd" "set packpath^=${vimUtils.packDir packDirArgs}"
-            "--cmd" "set rtp^=${vimUtils.packDir packDirArgs}"
-          ];
         in
         [
-          "--inherit-argv0" "--add-flags" (lib.escapeShellArgs flags)
+          "--inherit-argv0"
         ] ++ lib.optionals withRuby [
           "--set" "GEM_HOME" "${rubyEnv}/${rubyEnv.ruby.gemPath}"
         ] ++ lib.optionals (binPath != "") [
@@ -144,12 +119,6 @@ let
       inherit rubyEnv;
     };
 
-    genProviderSettings = prog: withProg:
-      if withProg then
-        "let g:${prog}_host_prog='${placeholder "out"}/bin/nvim-${prog}'"
-      else
-        "let g:loaded_${prog}_provider=0"
-    ;
 
   # to keep backwards compatibility for people using neovim.override
   legacyWrapper = neovim: {
@@ -191,9 +160,43 @@ let
       wrapperArgs = lib.escapeShellArgs res.wrapperArgs + " " + extraMakeWrapperArgs;
       wrapRc = (configure != {});
   });
+
+  /* Generate vim.g.<LANG>_host_prog lua rc to setup host providers
+
+  Mapping a boolean argument to a key that tells us whether to add
+      vim.g.<LANG>_host_prog=$out/bin/nvim-<LANG>
+  Or this:
+      let g:loaded_${prog}_provider=0
+  While the latter tells nvim that this provider is not available */
+  generateProviderRc = {
+      withPython3 ? true
+    , withNodeJs ? false
+    , withRuby ? true
+
+    # so that we can pass the full neovim config while ignoring it
+    , ...
+    }: let
+      hostprog_check_table = {
+        node = withNodeJs;
+        python = false;
+        python3 = withPython3;
+        ruby = withRuby;
+      };
+
+      genProviderCommand = prog: withProg:
+        if withProg then
+          "vim.g.${prog}_host_prog='${placeholder "out"}/bin/nvim-${prog}'"
+        else
+          "vim.g.loaded_${prog}_provider=0";
+
+      hostProviderLua = lib.mapAttrsToList genProviderCommand hostprog_check_table;
+    in
+        lib.concatStringsSep ";" hostProviderLua;
+
 in
 {
   inherit makeNeovimConfig;
+  inherit generateProviderRc;
   inherit legacyWrapper;
 
   buildNeovimPluginFrom2Nix = callPackage ./build-neovim-plugin.nix {
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index fac9b3c30990..887d647e2383 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -4,6 +4,8 @@
 , python3
 , python3Packages
 , callPackage
+, neovimUtils
+, vimUtils
 }:
 neovim:
 
@@ -12,6 +14,7 @@ let
       extraName ? ""
     # should contain all args but the binary. Can be either a string or list
     , wrapperArgs ? []
+    # a limited RC script used only to generate the manifest for remote plugins
     , manifestRc ? null
     , withPython2 ? false
     , withPython3 ? true,  python3Env ? python3
@@ -26,12 +29,30 @@ let
     # (e.g., in ~/.config/init.vim or project/.nvimrc)
     , wrapRc ? true
     , neovimRcContent ? ""
+    # entry to load in packpath
+    , packpathDirs
     , ...
   }@args:
   let
 
     wrapperArgsStr = if lib.isString wrapperArgs then wrapperArgs else lib.escapeShellArgs wrapperArgs;
 
+    # "--add-flags" (lib.escapeShellArgs flags)
+    # wrapper args used both when generating the manifest and in the final neovim executable
+    commonWrapperArgs = (lib.optionals (lib.isList wrapperArgs) wrapperArgs)
+      # vim accepts a limited number of commands so we join them all
+          ++ [
+            "--add-flags" ''--cmd "lua ${providerLuaRc}"''
+            # (lib.intersperse "|" hostProviderViml)
+          ] ++ lib.optionals (packpathDirs.myNeovimPackages.start != [] || packpathDirs.myNeovimPackages.opt != []) [
+            "--add-flags" ''--cmd "set packpath^=${vimUtils.packDir packpathDirs}"''
+            "--add-flags" ''--cmd "set rtp^=${vimUtils.packDir packpathDirs}"''
+          ]
+          ;
+
+    providerLuaRc = neovimUtils.generateProviderRc args;
+    # providerLuaRc = "toto";
+
     # If configure != {}, we can't generate the rplugin.vim file with e.g
     # NVIM_SYSTEM_RPLUGIN_MANIFEST *and* NVIM_RPLUGIN_MANIFEST env vars set in
     # the wrapper. That's why only when configure != {} (tested both here and
@@ -42,6 +63,7 @@ let
       [ "${neovim}/bin/nvim" "${placeholder "out"}/bin/nvim" ]
       ++ [ "--set" "NVIM_SYSTEM_RPLUGIN_MANIFEST" "${placeholder "out"}/rplugin.vim" ]
       ++ lib.optionals wrapRc [ "--add-flags" "-u ${writeText "init.vim" neovimRcContent}" ]
+      ++ commonWrapperArgs
       ;
   in
   assert withPython2 -> throw "Python2 support has been removed from the neovim wrapper, please remove withPython2 and python2Env.";
@@ -72,7 +94,7 @@ let
       ''
       + lib.optionalString (manifestRc != null) (let
         manifestWrapperArgs =
-          [ "${neovim}/bin/nvim" "${placeholder "out"}/bin/nvim-wrapper" ];
+          [ "${neovim}/bin/nvim" "${placeholder "out"}/bin/nvim-wrapper" ] ++ commonWrapperArgs;
       in ''
         echo "Generating remote plugin manifest"
         export NVIM_RPLUGIN_MANIFEST=$out/rplugin.vim
@@ -116,6 +138,7 @@ let
 
     nativeBuildInputs = [ makeWrapper ];
     passthru = {
+      inherit providerLuaRc packpathDirs;
       unwrapped = neovim;
       initRc = neovimRcContent;
 
diff --git a/pkgs/applications/misc/tandoor-recipes/default.nix b/pkgs/applications/misc/tandoor-recipes/default.nix
index a15b0a4ab7cb..89d1740a802c 100644
--- a/pkgs/applications/misc/tandoor-recipes/default.nix
+++ b/pkgs/applications/misc/tandoor-recipes/default.nix
@@ -1,12 +1,25 @@
 { callPackage
 , nixosTests
 , python3
+, fetchFromGitHub
 }:
 let
   python = python3.override {
     packageOverrides = self: super: {
       django = super.django_4;
 
+      django-crispy-forms = super.django-crispy-forms.overridePythonAttrs (_: rec {
+        version = "1.14.0";
+        format = "setuptools";
+
+        src = fetchFromGitHub {
+          owner = "django-crispy-forms";
+          repo = "django-crispy-forms";
+          rev = "refs/tags/${version}";
+          hash = "sha256-NZ2lWxsQHc7Qc4HDoWgjJTZ/bJHmjpBf3q1LVLtzA+8=";
+        };
+      });
+
       # Tests are incompatible with Django 4
       django-js-reverse = super.django-js-reverse.overridePythonAttrs (_: {
         doCheck = false;
diff --git a/pkgs/applications/misc/ttyper/default.nix b/pkgs/applications/misc/ttyper/default.nix
index ec968d0020aa..633a6c615c60 100644
--- a/pkgs/applications/misc/ttyper/default.nix
+++ b/pkgs/applications/misc/ttyper/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ttyper";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "max-niederman";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yReDHe5UJfBnEIhOp/3nHQkhp6YQQGDWqihLYi9IxdM=";
+    sha256 = "sha256-6oqUBLda6/qcRza5898WXjdopF8jKBDd93FdM0QwNUo=";
   };
 
-  cargoSha256 = "sha256-5vhtF8GKg4Cw3F1GlhpWz2VMZfcMpCijlHTGmbKHjP8=";
+  cargoSha256 = "sha256-SfcO8nMle1ku3lK2UPW/Z+J4JzmhcoFr+UCGIidXOa0=";
 
   meta = with lib; {
     description = "Terminal-based typing test";
diff --git a/pkgs/applications/networking/browsers/vieb/default.nix b/pkgs/applications/networking/browsers/vieb/default.nix
index e9b690e933c7..6e15e5d955dd 100644
--- a/pkgs/applications/networking/browsers/vieb/default.nix
+++ b/pkgs/applications/networking/browsers/vieb/default.nix
@@ -2,20 +2,20 @@
 
 buildNpmPackage rec {
   pname = "vieb";
-  version = "9.6.0";
+  version = "9.7.0";
 
   src = fetchFromGitHub {
     owner = "Jelmerro";
     repo = pname;
     rev = version;
-    hash = "sha256-846yfD8B0/fX5cJOK62f/Uc+iS5WY0odKN7CXAUL6qY=";
+    hash = "sha256-uo5V5RRDSR+f9+AqojikrlybmtcWTmB7TPXEvLG9n4E=";
   };
 
   postPatch = ''
     sed -i '/"electron"/d' package.json
   '';
 
-  npmDepsHash = "sha256-IOlYip1AXsqsjRD/5Cd/E+hsT3ZbXP7qSHfCDzESisc=";
+  npmDepsHash = "sha256-RUpeqbb8bnSQ6sCYH8O9mL3Rpb+ZlcPi7fq6LlbkSic=";
   dontNpmBuild = true;
 
   nativeBuildInputs = [ makeWrapper ] ++ lib.optional stdenv.isAarch64 python3;
diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 21ec3533976d..93376ecc44e6 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -31,7 +31,7 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.5.33";
+  version = "3.5.36";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -39,7 +39,7 @@ python.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LzDXNl2IQ3+j9uP+nE6JS8E+pO0n9zwmA7wrMeKR6Ms=";
+    hash = "sha256-Aj3dOdZTpqBocBFySPZjvjeOZs7eAJeKqm7ykh0Y1CE=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 7e98e7be59a1..e7633cdde0df 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -349,6 +349,7 @@ in
       sed -e /CppunitTest_sw_layoutwriter/d -i sw/Module_sw.mk
       sed -e /CppunitTest_sw_htmlimport/d -i sw/Module_sw.mk
       sed -e /CppunitTest_sw_core_layout/d -i sw/Module_sw.mk
+      sed -e /CppunitTest_sw_uiwriter6/d -i sw/Module_sw.mk
       sed -e /CppunitTest_sdext_pdfimport/d -i sdext/Module_sdext.mk
       sed -e /CppunitTest_vcl_pdfexport/d -i vcl/Module_vcl.mk
       sed -e "s/DECLARE_SW_ROUNDTRIP_TEST(\([_a-zA-Z0-9.]\+\)[, ].*, *\([_a-zA-Z0-9.]\+\))/class \\1: public \\2 { public: void verify() override; }; void \\1::verify() /" -i "sw/qa/extras/ooxmlexport/ooxmlexport9.cxx"
diff --git a/pkgs/applications/video/vlc/default.nix b/pkgs/applications/video/vlc/default.nix
index 36e0a79c6ba4..457aa7a0da5d 100644
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@@ -197,9 +197,10 @@ stdenv.mkDerivation rec {
       sha256 = "0kyi8q2zn2ww148ngbia9c7qjgdrijf4jlvxyxgrj29cb5iy1kda";
     })
     # patch to build with recent libplacebo
+    # https://code.videolan.org/videolan/vlc/-/merge_requests/3027
     (fetchpatch {
-      url = "https://code.videolan.org/videolan/vlc/-/merge_requests/3027.patch";
-      hash = "sha256-aV+YT1l0ND/USoIIpxcPhdIlP/06J2FxVW4uArS8j88=";
+      url = "https://code.videolan.org/videolan/vlc/-/commit/65ea8d19d91ac1599a29e8411485a72fe89c45e2.patch";
+      hash = "sha256-Zz+g75V6X9OZI3sn614K9Uenxl3WtRHKSdLkWP3b17w=";
     })
   ];
 
diff --git a/pkgs/applications/window-managers/weston/default.nix b/pkgs/applications/window-managers/weston/default.nix
index 49a18187d76c..21eeb3949a1b 100644
--- a/pkgs/applications/window-managers/weston/default.nix
+++ b/pkgs/applications/window-managers/weston/default.nix
@@ -6,16 +6,17 @@
 , pipewire ? null, pango ? null, libunwind ? null, freerdp ? null, vaapi ? null
 , libva ? null, libwebp ? null, xwayland ? null
 # beware of null defaults, as the parameters *are* supplied by callPackage by default
-, buildDemo ? false
+, buildDemo ? true
+, buildRemoting ? true, gst_all_1
 }:
 
 stdenv.mkDerivation rec {
   pname = "weston";
-  version = "11.0.0";
+  version = "11.0.1";
 
   src = fetchurl {
-    url = "https://gitlab.freedesktop.org/wayland/weston/-/releases/${version}/downloads/weston-${version}.tar.xz";
-    sha256 = "078y14ff9wmmbzq314f7bq1bxx0rc12xy4j362n60iamr56qs4x6";
+    url = "https://gitlab.freedesktop.org/wayland/weston/uploads/f5648c818fba5432edc3ea63c4db4813/weston-${version}.tar.xz";
+    sha256 = "sha256-pBP2jCUpV/wxkcNlCCPsNWrowSTMwMtEDaXNxOLLnlc=";
   };
 
   depsBuildBuild = [ pkg-config ];
@@ -24,20 +25,21 @@ stdenv.mkDerivation rec {
     cairo colord dbus freerdp lcms2 libGL libXcursor libdrm libevdev libinput
     libjpeg seatd libunwind libva libwebp libxcb libxkbcommon mesa mtdev pam
     pango pipewire udev vaapi wayland wayland-protocols
+  ] ++ lib.optionals buildRemoting [
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
   ];
 
   mesonFlags= [
     "-Dbackend-drm-screencast-vaapi=${lib.boolToString (vaapi != null)}"
     "-Dbackend-rdp=${lib.boolToString (freerdp != null)}"
     "-Dxwayland=${lib.boolToString (xwayland != null)}" # Default is true!
-    "-Dremoting=false" # TODO
+    (lib.mesonBool "remoting" buildRemoting)
     "-Dpipewire=${lib.boolToString (pipewire != null)}"
     "-Dimage-webp=${lib.boolToString (libwebp != null)}"
     (lib.mesonBool "demo-clients" buildDemo)
     "-Dsimple-clients="
     "-Dtest-junit-xml=false"
-    # TODO:
-    #"--enable-clients"
   ] ++ lib.optionals (xwayland != null) [
     "-Dxwayland-path=${xwayland.out}/bin/Xwayland"
   ];
diff --git a/pkgs/desktops/pantheon/apps/elementary-files/default.nix b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
index df4690d05b25..442132787d72 100644
--- a/pkgs/desktops/pantheon/apps/elementary-files/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@@ -29,7 +28,7 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-files";
-  version = "6.3.0";
+  version = "6.3.1";
 
   outputs = [ "out" "dev" ];
 
@@ -37,18 +36,9 @@ stdenv.mkDerivation rec {
     owner = "elementary";
     repo = "files";
     rev = version;
-    sha256 = "sha256-DS39jCeN+FFiEqJqxa5F2XRKF7SJsm2qi5KKb79guKo=";
+    sha256 = "sha256-JFkyO4r/Fb8bjWn+wVS2rIpFz19/uBVCsLt8091xzVI=";
   };
 
-  patches = [
-    # Avoid crash due to ref counting issues in Directory cache
-    # https://github.com/elementary/files/pull/2149
-    (fetchpatch {
-      url = "https://github.com/elementary/files/commit/6a0d16e819dea2d0cd2d622414257da9433afe2f.patch";
-      sha256 = "sha256-ijuSMZzVbSwWMWsK24A/24NfxjxgK/BU2qZlq6xLBEU=";
-    })
-  ];
-
   nativeBuildInputs = [
     desktop-file-utils
     meson
diff --git a/pkgs/development/interpreters/clojure/default.nix b/pkgs/development/interpreters/clojure/default.nix
index 1228a765a775..00ebc8562334 100644
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "clojure";
-  version = "1.11.1.1262";
+  version = "1.11.1.1273";
 
   src = fetchurl {
     # https://clojure.org/releases/tools
     url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "sha256-k++uGj1CdOjPXYAVERs6UqLnrUXE1Bv/hm1JXRxAHuI=";
+    sha256 = "sha256-X4uvzyS9FIrJvL5gqOe4CTye2OuODzhxmXcOOPDkDOY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libpg_query/default.nix b/pkgs/development/libraries/libpg_query/default.nix
index 95d615c5d24d..1335eb3579d7 100644
--- a/pkgs/development/libraries/libpg_query/default.nix
+++ b/pkgs/development/libraries/libpg_query/default.nix
@@ -13,13 +13,17 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ which ];
 
-  makeFlags = [ "build" ];
+  makeFlags = [ "build" "build_shared" ];
 
   installPhase = ''
     install -Dm644 -t $out/lib libpg_query.a
     install -Dm644 -t $out/include pg_query.h
+    install -Dm644 -t $out/lib libpg_query${stdenv.hostPlatform.extensions.sharedLibrary}
   '';
 
+  doCheck = true;
+  checkTarget = "test";
+
   meta = with lib; {
     homepage = "https://github.com/pganalyze/libpg_query";
     description = "C library for accessing the PostgreSQL parser outside of the server environment";
diff --git a/pkgs/development/ocaml-modules/lwt_ssl/default.nix b/pkgs/development/ocaml-modules/lwt_ssl/default.nix
index c33f623529a6..7b74d92c2e50 100644
--- a/pkgs/development/ocaml-modules/lwt_ssl/default.nix
+++ b/pkgs/development/ocaml-modules/lwt_ssl/default.nix
@@ -1,14 +1,14 @@
-{ lib, fetchFromGitHub, buildDunePackage, ssl, lwt }:
+{ lib, fetchurl, buildDunePackage, ssl, lwt }:
 
 buildDunePackage rec {
   pname = "lwt_ssl";
-  version = "1.1.3";
+  version = "1.2.0";
 
-  src = fetchFromGitHub {
-    owner = "aantron";
-    repo = "lwt_ssl";
-    rev = version;
-    sha256 = "sha256-d/jkTI/D2LVi9nrndRGgqg6ca1FcmRKknR7YXyA7gWw=";
+  duneVersion = "3";
+
+  src = fetchurl {
+    url = "https://github.com/ocsigen/lwt_ssl/releases/download/${version}/lwt_ssl-${version}.tbz";
+    hash = "sha256-swIK0nrs83fhw/J0Cgizbcu6mR+EMGZRE1dBBUiImnc=";
   };
 
   propagatedBuildInputs = [ ssl lwt ];
diff --git a/pkgs/development/ocaml-modules/ssl/default.nix b/pkgs/development/ocaml-modules/ssl/default.nix
index 7eca606f93fc..67e841ae1b31 100644
--- a/pkgs/development/ocaml-modules/ssl/default.nix
+++ b/pkgs/development/ocaml-modules/ssl/default.nix
@@ -12,6 +12,8 @@ buildDunePackage rec {
   pname = "ssl";
   version = "0.5.13";
 
+  duneVersion = "3";
+
   src = fetchFromGitHub {
     owner = "savonet";
     repo = "ocaml-ssl";
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index 72dfbe23656b..223427f9e9d1 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.43.0";
+  version = "3.44.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Adafruit-PlatformDetect";
     inherit version;
-    hash = "sha256-7JsdHeYjPSXGdnvs67haOYqX+le+RmivfXPtxDT6BJ8=";
+    hash = "sha256-mEs1HnMn+3p4+YAyOmqFGrcMpeUwMbpkGQAx/pdDqhk=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/django-crispy-forms/default.nix b/pkgs/development/python-modules/django-crispy-forms/default.nix
index 53357b9d7ef8..c1cc31e8acfb 100644
--- a/pkgs/development/python-modules/django-crispy-forms/default.nix
+++ b/pkgs/development/python-modules/django-crispy-forms/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , django
+, setuptools
 , pytestCheckHook
 , pytest-django
 }:
@@ -9,6 +10,7 @@
 buildPythonPackage rec {
   pname = "django-crispy-forms";
   version = "2.0";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "django-crispy-forms";
@@ -19,6 +21,7 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     django
+    setuptools
   ];
 
   # FIXME: RuntimeError: Model class source.crispy_forms.tests.forms.CrispyTestModel doesn't declare an explicit app_label and isn't in an application in INSTALLED_APPS.
diff --git a/pkgs/development/python-modules/pyrainbird/default.nix b/pkgs/development/python-modules/pyrainbird/default.nix
index 8d9c546213f8..4b082e22d61d 100644
--- a/pkgs/development/python-modules/pyrainbird/default.nix
+++ b/pkgs/development/python-modules/pyrainbird/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "pyrainbird";
-  version = "2.0.0";
+  version = "2.0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-fQHWamtGA1Cz/9Hbxbns5lDd08Q01nIvaMXp9PWrelM=";
+    hash = "sha256-ssm/nFciUeWexgsKUpF4qZHz/grG8OYJV7roBAjMsac=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/build-managers/rocm-cmake/default.nix b/pkgs/development/tools/build-managers/rocm-cmake/default.nix
index 1d7f2cc38997..206038c0b6e6 100644
--- a/pkgs/development/tools/build-managers/rocm-cmake/default.nix
+++ b/pkgs/development/tools/build-managers/rocm-cmake/default.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocm-cmake";
-  version = "5.4.3";
+  version = "5.4.4";
 
   src = fetchFromGitHub {
     owner = "RadeonOpenCompute";
diff --git a/pkgs/development/tools/build-managers/scala-cli/sources.json b/pkgs/development/tools/build-managers/scala-cli/sources.json
index ffbf1a33130e..d9676acdee3c 100644
--- a/pkgs/development/tools/build-managers/scala-cli/sources.json
+++ b/pkgs/development/tools/build-managers/scala-cli/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "0.2.1",
+  "version": "1.0.0-RC1",
   "assets": {
     "aarch64-darwin": {
       "asset": "scala-cli-aarch64-apple-darwin.gz",
-      "sha256": "184ywxdqn729pjnhmy3y02j9zwvy89a4g95wng35j0wdlyrv7j1f"
+      "sha256": "154yw2dfppsa29zhbmngzzhvs69sidfd0j0qraapm1i23k5lz3j6"
     },
     "aarch64-linux": {
       "asset": "scala-cli-aarch64-pc-linux.gz",
-      "sha256": "0g55svbzy7nlrs7hn6lfn428zndahcln34p2szf6yx180h56irns"
+      "sha256": "0ig14zwcbj4grmas7in94bcr3kpmi0jrc0wb3dhfaiakjwvrfkp1"
     },
     "x86_64-darwin": {
       "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "1hm0gf4bq4hhnd54rlzpv6sbl1vyp6gzsswc8kyk7f31mzazqg14"
+      "sha256": "05jjzqyflvwhyqray0871y6xp840qwxncz9flvj7icyhhli4sd85"
     },
     "x86_64-linux": {
       "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "1v7hbr1wk89wzvdja2pdzridrdvw6vsb7qfsqx8fl6xi613wn66p"
+      "sha256": "1ga7sh8sc5i7rl73yhdfhk73qi0ncwkxx8iwzwrwnv7a2lizky4w"
     }
   }
 }
diff --git a/pkgs/development/tools/gptcommit/default.nix b/pkgs/development/tools/gptcommit/default.nix
index f6d079074f5b..47913668013f 100644
--- a/pkgs/development/tools/gptcommit/default.nix
+++ b/pkgs/development/tools/gptcommit/default.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "gptcommit";
-  version = "0.5.6";
+  version = "0.5.7";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage {
     owner = "zurawiki";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ZrJRXmtwHLUqaYhoAD9lo9k9t06TMGMLf33kgvbC0m8=";
+    sha256 = "sha256-ymG0D/geYH0o4fBzggeJH41fwZnO3THUV8ipk5GfwQc=";
   };
 
-  cargoSha256 = "sha256-625OFsFNNwILAFUC5eWcNETt7F1KpYE1N/Gf8pv9Gbw=";
+  cargoSha256 = "sha256-OiKuMbczyZ92x2rketRWNdYO2dTsJJo0cioKpxB9aAc=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/development/tools/konstraint/default.nix b/pkgs/development/tools/konstraint/default.nix
index bd679d79a95e..d08aee214a96 100644
--- a/pkgs/development/tools/konstraint/default.nix
+++ b/pkgs/development/tools/konstraint/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "konstraint";
-  version = "0.26.0";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner = "plexsystems";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xxNDzg+cnN6Sl8xNVgyLMPTy98r8SFjc5gQ3OT3FGwM=";
+    sha256 = "sha256-8n9VDFDpadbToHeefZLsqlRMwKPxDbQtjuDiOpts3qc=";
   };
-  vendorHash = "sha256-EHYsaE18C6UUX/d694hfczY054vP1xB/2Qc5PHxbra0=";
+  vendorHash = "sha256-fQZNQiyDpkPqwZXGEFPsUbEK7qvTObfDeA4PbS0TxAo=";
 
   # Exclude go within .github folder
   excludedPackages = ".github";
diff --git a/pkgs/development/tools/twilio-cli/default.nix b/pkgs/development/tools/twilio-cli/default.nix
index b4f5b5f1604d..d670d2502d9b 100644
--- a/pkgs/development/tools/twilio-cli/default.nix
+++ b/pkgs/development/tools/twilio-cli/default.nix
@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "twilio-cli";
-  version = "5.5.0";
+  version = "5.6.0";
 
   src = fetchzip {
     url = "https://twilio-cli-prod.s3.amazonaws.com/twilio-v${finalAttrs.version}/twilio-v${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-ZY0AiT1hrxsBXnIkBcoB5d2s8Cc/N7qmVGjuYm2DvOM=";
+    sha256 = "sha256-M6UQ6P021FYQOSZ3AXfXHDgD8NLkcdhzfDin9ElXyNU=";
   };
 
   buildInputs = [ nodejs ];
diff --git a/pkgs/development/tools/yamlfmt/default.nix b/pkgs/development/tools/yamlfmt/default.nix
index 662fc5cb3d7a..a2783ff0a23a 100644
--- a/pkgs/development/tools/yamlfmt/default.nix
+++ b/pkgs/development/tools/yamlfmt/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yamlfmt";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2gcB44tpYXRES0nqLfXt3Srj2NCuQ/iBdv4yxjfmrnk=";
+    sha256 = "sha256-l081PgSAT9h2oHp1eH96XztcCLeyv1Y11l6lJhHQj1I=";
   };
 
-  vendorHash = "sha256-7Ip6dgpO3sPGXcwymYcaoFydTPIt+BmJC7UqyfltJx0=";
+  vendorHash = "sha256-qrHrLOfyJhsuU75arDtfOhLaLqP+GWTfX+oyLX3aea8=";
 
   doCheck = false;
 
diff --git a/pkgs/games/aaaaxy/default.nix b/pkgs/games/aaaaxy/default.nix
index af3dc01edb7d..c10390d49037 100644
--- a/pkgs/games/aaaaxy/default.nix
+++ b/pkgs/games/aaaaxy/default.nix
@@ -16,17 +16,17 @@
 
 buildGoModule rec {
   pname = "aaaaxy";
-  version = "1.3.372";
+  version = "1.3.421";
 
   src = fetchFromGitHub {
     owner = "divVerent";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-vm3wA8lzoaJ5iGwf2nZ0EvoSATHGftQ77lwdEjGe2RU=";
+    hash = "sha256-MZXnIkOVv49HEkatLEGbIxeJyaiOrh2XLTp5TdvMhk8=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-WEK7j7FMiue0Fl1R+To5GKwvM03pjc1nKig/wePEAAY=";
+  vendorHash = "sha256-TPm2X0QERJ5lBfojOAWIS60CeAz+Ps2REFtNIT2zGnY=";
 
   buildInputs = [
     alsa-lib
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 323b54cae1d6..f1ad3d04951e 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -32,31 +32,31 @@
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.104-hardened1.patch",
-            "sha256": "0gz3csflp34aadrgmlhy4y3sybxdlzvb2wsss9yb9l5zikxm2h1c",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.104-hardened1/linux-hardened-5.15.104-hardened1.patch"
+            "name": "linux-hardened-5.15.105-hardened1.patch",
+            "sha256": "0hkg9198ljp7hv5n5wv6dg2fh042wxlm1mzfk5adfylyl7rrm7js",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.105-hardened1/linux-hardened-5.15.105-hardened1.patch"
         },
-        "sha256": "0m3bscml2mvafbj5k9a3qa8akfxms8wfpzsr687lfblr17735ibi",
-        "version": "5.15.104"
+        "sha256": "0kz4ymaqb1kpniqq2mwv3z8rirz5yyf1c9m648kqblij0djkgd81",
+        "version": "5.15.105"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.238-hardened1.patch",
-            "sha256": "0fj3q8ykf9fi179hjspi5zq5bzxmn154g5nsdcvnphmizvlzy1qg",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.238-hardened1/linux-hardened-5.4.238-hardened1.patch"
+            "name": "linux-hardened-5.4.239-hardened1.patch",
+            "sha256": "12lmajxli4v84h3197xzyj21hyqdn4v596c24iirg72xch3ca5hw",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.239-hardened1/linux-hardened-5.4.239-hardened1.patch"
         },
-        "sha256": "07x9ibcshsm451qcpawv3l0z7g8w8jg79h6dfdmbm3jrhpdb58kh",
-        "version": "5.4.238"
+        "sha256": "0nw02lqkvachksyan4n11q0g6jhm1ii7d5zs276n46891ypn80m9",
+        "version": "5.4.239"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.21-hardened1.patch",
-            "sha256": "04sksmh4zym2z8bjg8hdr1zv1fv1r08z1b5kyl7rm9b1ic3gd39w",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.21-hardened1/linux-hardened-6.1.21-hardened1.patch"
+            "name": "linux-hardened-6.1.22-hardened1.patch",
+            "sha256": "1nwjchs8jlishdcxc4f5834d7p03f1iiyhbp1gv2j1b48qrlf17l",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.22-hardened1/linux-hardened-6.1.22-hardened1.patch"
         },
-        "sha256": "0fnr2pw4pi0vnkpv8hfipya09cgdz6ghks7p6vdl2d71dawb2g5k",
-        "version": "6.1.21"
+        "sha256": "1a7xkjqj13q5dgk1gml27kdzs381p0z203alamd0wkgprr0r3s1b",
+        "version": "6.1.22"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index bd7ad55a35e0..555539eafcf4 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.311";
+  version = "4.14.312";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1mbwrgjz575qxg4gwi2fxc94kprmiblwap3jix0mj4887zllqgw0";
+    sha256 = "03bwrnm7z8jxxn681dd5jffrj76l14ngkcccfgbg1p4a0471q436";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index ce742ba681ac..1cc372fb3dbf 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.279";
+  version = "4.19.280";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "104qkyflkfkp8iyshpirb9q708vvsgfbxfwgl0dnas3k7nyc6v3k";
+    sha256 = "1xmg9p3ky75n5q894f522s8nwcmbd5c15nmjr0n96m6xzag3kd7w";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index f95140a162ac..30b5abf9a496 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.176";
+  version = "5.10.177";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "14zpdrrrpgxx44nxjn0rifrchnmsvvpkzpm1n82kw5q4p9h2q1yf";
+    sha256 = "0waml6svj07b7f8yb1kzrflqlf61x4kcqbgsr372s484m3z628lz";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index b414e75bc2b1..9a69eb222be2 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.105";
+  version = "5.15.106";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0kz4ymaqb1kpniqq2mwv3z8rirz5yyf1c9m648kqblij0djkgd81";
+    sha256 = "1r4g7ipcmj7k9dpwd5p2kd0f3iidnzl6z9g2cq4mfcw0h97r7rl4";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 6a133252adc5..be2ee59f1584 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.239";
+  version = "5.4.240";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0nw02lqkvachksyan4n11q0g6jhm1ii7d5zs276n46891ypn80m9";
+    sha256 = "0ihf0rqhx7dav3k3igk29962sscb1xyniy2gx8chyllprr0z126w";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index ddc381166091..6e5bc9c6c58c 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.22";
+  version = "6.1.23";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1a7xkjqj13q5dgk1gml27kdzs381p0z203alamd0wkgprr0r3s1b";
+    sha256 = "1szblfmm8gx0am017y30ywc60b1gqarplgmcs5zy7bshhwp3fn3l";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.2.nix b/pkgs/os-specific/linux/kernel/linux-6.2.nix
index 9b2a21a4af1a..5b941f88212d 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.2.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.2.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.2.9";
+  version = "6.2.10";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1xa3znandhyn1ygbfv4cl83mwn33hphj1jdc59s0wgy0ck0ljd4h";
+    sha256 = "1zm4xvxdy6sqqwcich46mr4dh3kpmp40bawwahrg4lr7rp1n5iap";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 2e129c1075fa..a3c59a5a6c9b 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -90,7 +90,7 @@
 , withCoredump ? true
 , withCryptsetup ? true
 , withDocumentation ? true
-, withEfi ? stdenv.hostPlatform.isEfi && !stdenv.hostPlatform.isMusl
+, withEfi ? stdenv.hostPlatform.isEfi
 , withFido2 ? true
 , withHomed ? !stdenv.hostPlatform.isMusl
 , withHostnamed ? true
@@ -187,32 +187,33 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
-        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-cccd4bcaf381c2729adc000381bd89906003e72a.tar.gz";
-        sha256 = "2CFZEzWqUy6OOF3c+LN4Zmy3RqMzfdRHp+B5zlWJsoE=";
+        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-f34f6ab04b443608497b73668365819343d0c2fe.tar.gz";
+        sha256 = "DFcLPvjQIxGEDADpP232ZRd7cOEKt6B48Ah29nIGTt4=";
       };
       musl-patches = oe-core + "/meta/recipes-core/systemd/systemd";
     in
     [
-      (musl-patches + "/0003-missing_type.h-add-comparison_fn_t.patch")
-      (musl-patches + "/0004-add-fallback-parse_printf_format-implementation.patch")
-      (musl-patches + "/0005-src-basic-missing.h-check-for-missing-strndupa.patch")
-      (musl-patches + "/0007-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch")
-      (musl-patches + "/0008-add-missing-FTW_-macros-for-musl.patch")
-      (musl-patches + "/0010-Use-uintmax_t-for-handling-rlim_t.patch")
-      (musl-patches + "/0011-test-sizeof.c-Disable-tests-for-missing-typedefs-in-.patch")
-      (musl-patches + "/0012-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch")
-      (musl-patches + "/0013-Define-glibc-compatible-basename-for-non-glibc-syste.patch")
-      (musl-patches + "/0014-Do-not-disable-buffering-when-writing-to-oom_score_a.patch")
-      (musl-patches + "/0015-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch")
-      (musl-patches + "/0018-avoid-redefinition-of-prctl_mm_map-structure.patch")
-      (musl-patches + "/0022-do-not-disable-buffer-in-writing-files.patch")
-      (musl-patches + "/0025-Handle-__cpu_mask-usage.patch")
-      (musl-patches + "/0026-Handle-missing-gshadow.patch")
-      (musl-patches + "/0028-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch")
-      (musl-patches + "/0001-pass-correct-parameters-to-getdents64.patch")
-      (musl-patches + "/0002-Add-sys-stat.h-for-S_IFDIR.patch")
       (musl-patches + "/0001-Adjust-for-musl-headers.patch")
-      (musl-patches + "/0001-test-bus-error-strerror-is-assumed-to-be-GNU-specifi.patch")
+      (musl-patches + "/0005-pass-correct-parameters-to-getdents64.patch")
+      (musl-patches + "/0006-test-bus-error-strerror-is-assumed-to-be-GNU-specifi.patch")
+      (musl-patches + "/0007-Add-sys-stat.h-for-S_IFDIR.patch")
+      (musl-patches + "/0009-missing_type.h-add-comparison_fn_t.patch")
+      (musl-patches + "/0010-add-fallback-parse_printf_format-implementation.patch")
+      (musl-patches + "/0011-src-basic-missing.h-check-for-missing-strndupa.patch")
+      (musl-patches + "/0012-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch")
+      (musl-patches + "/0013-add-missing-FTW_-macros-for-musl.patch")
+      (musl-patches + "/0014-Use-uintmax_t-for-handling-rlim_t.patch")
+      (musl-patches + "/0015-test-sizeof.c-Disable-tests-for-missing-typedefs-in-.patch")
+      (musl-patches + "/0016-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch")
+      (musl-patches + "/0017-Define-glibc-compatible-basename-for-non-glibc-syste.patch")
+      (musl-patches + "/0018-Do-not-disable-buffering-when-writing-to-oom_score_a.patch")
+      (musl-patches + "/0019-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch")
+      (musl-patches + "/0020-avoid-redefinition-of-prctl_mm_map-structure.patch")
+      (musl-patches + "/0021-do-not-disable-buffer-in-writing-files.patch")
+      (musl-patches + "/0022-Handle-__cpu_mask-usage.patch")
+      (musl-patches + "/0023-Handle-missing-gshadow.patch")
+      (musl-patches + "/0024-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch")
+      (musl-patches + "/0026-src-boot-efi-efi-string.c-define-wchar_t-from-__WCHA.patch")
     ]
   );
 
diff --git a/pkgs/servers/misc/gobgpd/default.nix b/pkgs/servers/misc/gobgpd/default.nix
index d20a60e5208c..284159bc4970 100644
--- a/pkgs/servers/misc/gobgpd/default.nix
+++ b/pkgs/servers/misc/gobgpd/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "gobgpd";
-  version = "3.12.0";
+  version = "3.13.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-keev3DZ3xN5UARuYKfSdox0KKBjrM5RoMD273Aw0AGY=";
+    hash = "sha256-qXLg/EZF2eU7BhILHO7Uu4juz0tVZLq37foQcSKv0P8=";
   };
 
-  vendorHash = "sha256-5lRW9gWQZRRqZoVB16kI1VEnr0XsiPtLUuioK/0f8w0=";
+  vendorHash = "sha256-ofPz9IX+4ylch6Qe0ksGZqrP5x6AktqF0JAs/hLBQo0=";
 
   postConfigure = ''
     export CGO_ENABLED=0
diff --git a/pkgs/servers/spicedb/default.nix b/pkgs/servers/spicedb/default.nix
index 50c6b2a5ed03..8da312f5c707 100644
--- a/pkgs/servers/spicedb/default.nix
+++ b/pkgs/servers/spicedb/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "spicedb";
-  version = "1.17.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "spicedb";
     rev = "v${version}";
-    hash = "sha256-oTmEMFoSIW1JQIzhGxAuHW/VSZZk5FnzdLZvjhg90ZQ=";
+    hash = "sha256-2s5FR3qICB3nw0RAgwiuHLFh/aTzu7jXuIGi0xLIXNY=";
   };
 
-  vendorHash = "sha256-tIjHgEfq7kKwyQ9iCzI51ne88WrxUATYvJYcHbVX4jQ=";
+  vendorHash = "sha256-w6Ch0oyiF32ChJopdgXFh+QTadLIMFiNBBDyfVgtCik=";
 
   subPackages = [ "cmd/spicedb" ];
 
diff --git a/pkgs/tools/misc/mongodb-compass/default.nix b/pkgs/tools/misc/mongodb-compass/default.nix
index 6ac50936efe7..7bd813a58294 100644
--- a/pkgs/tools/misc/mongodb-compass/default.nix
+++ b/pkgs/tools/misc/mongodb-compass/default.nix
@@ -33,7 +33,7 @@ xorg,
 }:
 
 let
-  version = "1.36.1";
+  version = "1.36.2";
 
   rpath = lib.makeLibraryPath [
     alsa-lib
@@ -82,7 +82,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://downloads.mongodb.com/compass/mongodb-compass_${version}_amd64.deb";
-        sha256 = "sha256-nM4Afka2dTjI9xn3cu23ACoj5qIFH4c7tJTNLmD23Jw=";
+        sha256 = "sha256-IegS2qQrInWiJAtAP9/voymuyWyyBYK6hbatmkOnFX4=";
       }
     else
       throw "MongoDB compass is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/tools/security/saml2aws/default.nix b/pkgs/tools/security/saml2aws/default.nix
index 19a1b275028b..e7dc4954b0e9 100644
--- a/pkgs/tools/security/saml2aws/default.nix
+++ b/pkgs/tools/security/saml2aws/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "saml2aws";
-  version = "2.36.5";
+  version = "2.36.6";
 
   src = fetchFromGitHub {
     owner = "Versent";
     repo = "saml2aws";
     rev = "v${version}";
-    sha256 = "sha256-v5lr0CtKBDNB3Cy9/3mA6E0koQyQvtGe1ET2Mm4EfDc=";
+    sha256 = "sha256-llEdO19TvHzvH4sV1c+1dHqowG2fVLOqMOqCrH6Urws=";
   };
 
   vendorHash = "sha256-MXm1V8GrjZn/x0Q6fW8zJN351zVsPGME4eFg6f8cEX8=";
diff --git a/pkgs/tools/typesetting/typst/default.nix b/pkgs/tools/typesetting/typst/default.nix
index 73cb0a819893..7d6f3215fac5 100644
--- a/pkgs/tools/typesetting/typst/default.nix
+++ b/pkgs/tools/typesetting/typst/default.nix
@@ -7,7 +7,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typst";
-  version = "0.1";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "typst";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2ccfa5a5df91..78a111a7da7a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -34658,6 +34658,8 @@ with pkgs;
     libwebp = null;
     xwayland = null;
     pipewire = null;
+    buildDemo = false;
+    buildRemoting = false;
   };
 
   chatterino2 = libsForQt5.callPackage ../applications/networking/instant-messengers/chatterino2 {